plugin-scanner 2.0.628__tar.gz → 2.0.629__tar.gz

{plugin_scanner-2.0.628 → plugin_scanner-2.0.629}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.628
+Version: 2.0.629
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard
@@ -178,6 +178,8 @@ See [docs/guard/get-started.md](docs/guard/get-started.md) for the full local fl
   Guard authors package-level policy while OpenCode keeps native once, always, or reject prompts for managed MCP tools.
 - `kimi`
   Guard installs managed `PreToolUse` and `UserPromptSubmit` hooks in `~/.kimi-code/config.toml`, blocks with exit code `2` and a JSON `permissionDecision: "deny"` response, and fails open on hook crash or timeout.
+- `grok`
+  Guard installs managed Grok hook JSON under `~/.grok/hooks/` plus permission deny rules in `~/.grok/managed_config.toml`, blocks with exit code `2` and a Grok-native `{"decision":"deny"}` response, and never reads `~/.grok/auth`.
 - `hermes`
   Guard installs a managed Hermes overlay bundle, routes MCP servers through Guard proxies, and prefers native-or-center delivery for blocked requests.
 - `gemini`

{plugin_scanner-2.0.628 → plugin_scanner-2.0.629}/README.md

@@ -136,6 +136,8 @@ See [docs/guard/get-started.md](docs/guard/get-started.md) for the full local fl
   Guard authors package-level policy while OpenCode keeps native once, always, or reject prompts for managed MCP tools.
 - `kimi`
   Guard installs managed `PreToolUse` and `UserPromptSubmit` hooks in `~/.kimi-code/config.toml`, blocks with exit code `2` and a JSON `permissionDecision: "deny"` response, and fails open on hook crash or timeout.
+- `grok`
+  Guard installs managed Grok hook JSON under `~/.grok/hooks/` plus permission deny rules in `~/.grok/managed_config.toml`, blocks with exit code `2` and a Grok-native `{"decision":"deny"}` response, and never reads `~/.grok/auth`.
 - `hermes`
   Guard installs a managed Hermes overlay bundle, routes MCP servers through Guard proxies, and prefers native-or-center delivery for blocked requests.
 - `gemini`

{plugin_scanner-2.0.628 → plugin_scanner-2.0.629}/dashboard/src/app-routing.test.ts

@@ -10,6 +10,7 @@ function assert(condition: boolean, message: string): void {
 assert(parseAppDetail("/apps/opencode") === "opencode", "valid app route parses harness slug");
 assert(parseAppDetail("/apps/claude-code") === "claude-code", "hyphenated app route parses harness slug");
 assert(parseAppDetail("/apps/kimi") === "kimi", "kimi app route parses harness slug");
+assert(parseAppDetail("/apps/grok") === "grok", "grok app route parses harness slug");
 assert(parseAppDetail("/apps/OpenCode") === "opencode", "app route normalizes case");
 assert(parseAppDetail("/apps/*") === null, "wildcard app route is rejected");
 assert(parseAppDetail("/apps/%2A") === null, "encoded wildcard app route is rejected");
@@ -42,6 +43,8 @@ assert(isDisplayableHarness("codex"), "real app harness is displayable");
 assert(!isDisplayableHarness("*"), "wildcard pseudo-harness is not displayable");
 assert(!isDisplayableHarness("Ce2b7ac2ccab4fab9902347b033bf25e"), "token-like pseudo-harness is not displayable");
 assert(harnessDisplayName("*") === "All apps", "wildcard pseudo-harness never renders as raw star");
+assert(harnessDisplayName("grok") === "Grok", "grok harness displays as Grok");
+assert(harnessDisplayName("grok") !== "*", "grok harness never renders as wildcard");
 assert(
   harnessDisplayName("Ce2b7ac2ccab4fab9902347b033bf25e") === "Unknown app",
   "token-like pseudo-harness never renders raw"

{plugin_scanner-2.0.628 → plugin_scanner-2.0.629}/dashboard/src/approval-center-utils.ts

@@ -455,7 +455,7 @@ function normalizeDuplicateReviewText(value: string): string {
 
 function stripDuplicateReviewContextPrefix(value: string): string | null {
   const stripped = value.replace(
-    /^\s*(codex|claude|claude code|claudecode|copilot|opencode|gemini)?\s*(prompt|command|tool)\s+for\s+[`"']?[^:`"']+[`"']?\s*:\s*/i,
+    /^\s*(codex|claude|claude code|claudecode|copilot|opencode|gemini|grok|kimi)?\s*(prompt|command|tool)\s+for\s+[`"']?[^:`"']+[`"']?\s*:\s*/i,
     "",
   );
   return stripped === value ? null : stripped;
@@ -552,6 +552,8 @@ export function harnessDisplayName(harness: string): string {
       return "OpenClaw";
     case "kimi":
       return "Kimi";
+    case "grok":
+      return "Grok";
     default:
       return capitalizeHarness(normalized);
   }

{plugin_scanner-2.0.628 → plugin_scanner-2.0.629}/dashboard/src/apps/app-catalog.ts

@@ -8,15 +8,16 @@ export const SUPPORTED_APP_SLUGS = [
   "hermes",
   "openclaw",
   "kimi",
+  "grok",
 ] as const;
 
 export type SupportedAppSlug = (typeof SUPPORTED_APP_SLUGS)[number];
 
 export const SUPPORTED_APPS_BRIEF =
-  "Guard works with Codex, Claude Code, OpenCode, Copilot, Cursor, Gemini, Hermes, OpenClaw, and Kimi.";
+  "Guard works with Codex, Claude Code, OpenCode, Copilot, Cursor, Gemini, Hermes, OpenClaw, Kimi, and Grok.";
 
 export const SUPPORTED_APPS_FULL =
-  "Guard works with Codex, Claude Code, OpenCode, Copilot, Cursor, Gemini, Hermes, OpenClaw, Kimi, and more. Run your AI app once and Guard will detect it automatically.";
+  "Guard works with Codex, Claude Code, OpenCode, Copilot, Cursor, Gemini, Hermes, OpenClaw, Kimi, Grok, and more. Run your AI app once and Guard will detect it automatically.";
 
 export type AppInstallStatus = "active" | "partial" | "observed" | "not_installed";
 

{plugin_scanner-2.0.628 → plugin_scanner-2.0.629}/dashboard/src/evidence/evidence-filters.test.ts

@@ -201,6 +201,11 @@ assert(scopeWs.length === 1 && scopeWs[0].receipt_id === "r1", "sourceScope: wor
 const scopeEmpty = filterBySourceScope(ALL, "");
 assert(scopeEmpty.length === ALL.length, "sourceScope: empty returns all");
 
+const rGrok = makeReceipt("rgrok", { harness: "grok", policy_decision: "block", artifact_name: "grok-bash" });
+const grokFiltered = filterByHarness([...ALL, rGrok], "grok");
+assert(grokFiltered.every((r) => r.harness === "grok"), "harness: grok filter keeps grok receipts only");
+assert(grokFiltered.length === 1, "harness: grok filter returns one receipt");
+
 // filterEvidence combined
 const filters: EvidenceFilterState = {
   ...DEFAULT_FILTER_STATE,

{plugin_scanner-2.0.628 → plugin_scanner-2.0.629}/dashboard/src/fleet-workspace-phase11.test.ts

@@ -10,11 +10,11 @@ function assert(condition: boolean, message: string): void {
 }
 
 function testSupportedAppSlugs(): void {
-  const expected = ["codex", "claude-code", "opencode", "copilot", "cursor", "gemini", "hermes", "openclaw", "kimi"];
+  const expected = ["codex", "claude-code", "opencode", "copilot", "cursor", "gemini", "hermes", "openclaw", "kimi", "grok"];
   for (const slug of expected) {
     assert(SUPPORTED_APP_SLUGS.includes(slug as typeof SUPPORTED_APP_SLUGS[number]), `SUPPORTED_APP_SLUGS missing: ${slug}`);
   }
-  assert(SUPPORTED_APP_SLUGS.length === 9, `Expected 9 slugs, got ${SUPPORTED_APP_SLUGS.length}`);
+  assert(SUPPORTED_APP_SLUGS.length === 10, `Expected 10 slugs, got ${SUPPORTED_APP_SLUGS.length}`);
 }
 
 function testSupportedAppsBriefMentionsAllApps(): void {
@@ -22,6 +22,7 @@ function testSupportedAppsBriefMentionsAllApps(): void {
   assert(brief.includes("codex"), "SUPPORTED_APPS_BRIEF should mention Codex");
   assert(brief.includes("copilot"), "SUPPORTED_APPS_BRIEF should mention Copilot");
   assert(brief.includes("cursor"), "SUPPORTED_APPS_BRIEF should mention Cursor");
+  assert(brief.includes("grok"), "SUPPORTED_APPS_BRIEF should mention Grok");
   assert(SUPPORTED_APPS_BRIEF.length > 20, "SUPPORTED_APPS_BRIEF should be a non-trivial string");
 }
 

{plugin_scanner-2.0.628 → plugin_scanner-2.0.629}/dashboard/src/guard-api.test.ts

@@ -118,6 +118,19 @@ assert(
   formatHarnessCommand(["hol-guard", "apps", "connect", "opencode"]) === "hol-guard apps connect opencode",
   "T760: harness setup fallback command should use real hol-guard apps connect command"
 );
+assert(
+  formatHarnessCommand(["hol-guard", "apps", "connect", "grok"]) === "hol-guard apps connect grok",
+  "T760b: grok setup command formats correctly"
+);
+assert(
+  formatHarnessCommand(["hol-guard", "apps", "repair", "grok"]) === "hol-guard apps repair grok",
+  "grok repair command formats correctly"
+);
+assert(
+  formatHarnessCommand(["hol-guard", "apps", "disconnect", "grok", "--confirm", "disconnect-grok"])
+    === "hol-guard apps disconnect grok --confirm disconnect-grok",
+  "grok disconnect command formats correctly"
+);
 assert(
   formatHarnessCommand(["hol-guard", "apps", "connect", "claude code"]) === 'hol-guard apps connect "claude code"',
   "T760: harness setup fallback command should quote spaced args"

{plugin_scanner-2.0.628 → plugin_scanner-2.0.629}/dashboard/src/home-dashboard.test.ts

@@ -140,6 +140,7 @@ const displayNames = [
   { harness: "hermes", expected: "Hermes" },
   { harness: "openclaw", expected: "OpenClaw" },
   { harness: "kimi", expected: "Kimi" },
+  { harness: "grok", expected: "Grok" },
 ];
 
 for (const { harness, expected } of displayNames) {

{plugin_scanner-2.0.628 → plugin_scanner-2.0.629}/dashboard/src/home-dashboard.tsx

@@ -72,7 +72,7 @@ export function resolveCloudUpsellVisible(
 export function buildEmptyStateCopy(): { title: string; body: string; installHint: string } {
   return {
     title: "No apps connected",
-    body: "Connect an AI app so Guard can start protecting it. Guard works with Codex, Claude Code, Cursor, Hermes, Kimi, and more.",
+    body: "Connect an AI app so Guard can start protecting it. Guard works with Codex, Claude Code, Cursor, Grok, Hermes, Kimi, and more.",
     installHint: "hol-guard apps connect <app>",
   };
 }

{plugin_scanner-2.0.628 → plugin_scanner-2.0.629}/dashboard/src/runtime-overview.tsx

@@ -2,7 +2,7 @@ import { ActionButton, Badge, KeyValueGrid, SectionLabel, Surface, Tag, ProofStr
 import { harnessDisplayName, formatRelativeTime } from "./approval-center-utils";
 import type { GuardCloudSyncHealth, GuardInventoryItem, GuardProofStatus, GuardReceipt, GuardRuntimeDevice, GuardRuntimeSnapshot, PackageManagerProtection } from "./guard-types";
 
-const WATCHED_HARNESSES = ["codex", "claude-code", "opencode", "copilot", "gemini", "cursor", "hermes", "openclaw", "kimi"] as const;
+const WATCHED_HARNESSES = ["codex", "claude-code", "opencode", "copilot", "gemini", "cursor", "hermes", "openclaw", "kimi", "grok"] as const;
 
 type WatchedHarnessName = (typeof WATCHED_HARNESSES)[number];
 

{plugin_scanner-2.0.628 → plugin_scanner-2.0.629}/docs/guard/architecture.md

@@ -4,7 +4,7 @@ Guard lives inside `codex_plugin_scanner` and is the local product surface for h
 
 The runtime is split into:
 
-- `guard/adapters`: harness discovery for Codex, Claude Code, Copilot CLI, Cursor, Gemini, Kimi, and OpenCode
+- `guard/adapters`: harness discovery for Codex, Claude Code, Copilot CLI, Cursor, Gemini, Grok, Kimi, and OpenCode
 - `guard/shims`: local launcher shims that route harness launches through Guard
 - `guard/consumer`: orchestration for detection, policy evaluation, and consumer-mode scan output
 - `guard/policy`: local action resolution for allow, review, warn, and block decisions

{plugin_scanner-2.0.628 → plugin_scanner-2.0.629}/docs/guard/get-started.md

@@ -334,6 +334,10 @@ Current strategy:
   installs Guard-owned `PreToolUse` and `UserPromptSubmit` hooks in `~/.kimi-code/config.toml`, blocks dangerous tool
   calls and prompts with exit code `2` plus a JSON `permissionDecision: "deny"` response, and fails open on hook crash
   or timeout
+- `grok`
+  installs Guard-owned Grok hook JSON in `~/.grok/hooks/` and permission deny rules in `~/.grok/managed_config.toml`,
+  blocks with Grok-native stdout JSON `{"decision":"deny"}` plus approval-center copy, never reads `~/.grok/auth`, and
+  treats `--always-approve` or `bypassPermissions` as degraded protection when detected
 
 Guard does not claim VS Code Copilot extension-host interception in this pass. A VS Code inline tool prompt by itself is
 not proof that Guard blocked the action, because that prompt can come from VS Code's own permission surface. For Copilot,

{plugin_scanner-2.0.628 → plugin_scanner-2.0.629}/docs/guard/harness-support.md

@@ -83,6 +83,13 @@ Current Guard support in this repo:
   - blocks dangerous tool calls and prompts by returning exit code `2` and a JSON `permissionDecision: "deny"` response in `hookSpecificOutput`
   - fails open if a hook crashes or times out, so Kimi Code keeps working when Guard is unreachable
   - uses the same JSON stdin/stdout wire protocol as Codex and Claude Code
+- `grok`
+  - detects the `grok` executable, `~/.grok/config.toml`, `~/.grok/managed_config.toml`, `~/.grok/hooks/`, skills, plugins, and project `.grok/` surfaces
+  - installs Guard-owned `PreToolUse` hooks for `Bash`, `Read`, `Edit`, `Grep`, `MCPTool`, and `WebFetch` plus `UserPromptSubmit` prompt screening in `~/.grok/hooks/hol-guard-*.json`
+  - installs Guard-managed deny rules in `~/.grok/managed_config.toml` without touching user `~/.grok/config.toml` or `~/.grok/auth`
+  - blocks by returning exit code `2` and Grok-native stdout JSON `{"decision":"deny","reason":"..."}` with approval-center copy in stderr
+  - surfaces `--always-approve`, `bypassPermissions`, and sandbox `off` as degraded protection states when detected in Grok config
+  - fails open if a hook crashes or times out, so Grok keeps working when Guard is unreachable
 
 Approval tiers:
 
@@ -142,3 +149,4 @@ Generated from `src/codex_plugin_scanner/guard/adapters/contracts.py`.
 | `openclaw` | `openclaw` | ❌ | ✅ | ❌ | mcp_tool |
 | `antigravity` | `antigravity` | ❌ | ✅ | ❌ | mcp_tool, prompt |
 | `kimi` | `kimi`, `kimi-code`, `kimi-cli` | ❌ | ✅ | ❌ | shell, prompt |
+| `grok` | `grok`, `grok-build`, `grok-build-cli`, `xai-grok` | ❌ | ✅ | ❌ | shell, prompt, mcp_tool, file_read |

{plugin_scanner-2.0.628 → plugin_scanner-2.0.629}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.628"
+version = "2.0.629"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.628 → plugin_scanner-2.0.629}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.628"
+version = "2.0.629"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.628 → plugin_scanner-2.0.629}/src/codex_plugin_scanner/guard/adapters/__init__.py

@@ -9,6 +9,7 @@ from .codex import CodexHarnessAdapter
 from .copilot import CopilotHarnessAdapter
 from .cursor import CursorHarnessAdapter
 from .gemini import GeminiHarnessAdapter
+from .grok import GrokHarnessAdapter
 from .hermes import HermesHarnessAdapter
 from .kimi import KimiHarnessAdapter
 from .openclaw import OpenClawHarnessAdapter
@@ -21,6 +22,7 @@ ADAPTERS: tuple[HarnessAdapter, ...] = (
     CursorHarnessAdapter(),
     AntigravityHarnessAdapter(),
     GeminiHarnessAdapter(),
+    GrokHarnessAdapter(),
     HermesHarnessAdapter(),
     KimiHarnessAdapter(),
     OpenClawHarnessAdapter(),

{plugin_scanner-2.0.628 → plugin_scanner-2.0.629}/src/codex_plugin_scanner/guard/adapters/contracts.py

@@ -138,6 +138,7 @@ _DISPLAY_NAMES = {
     "openclaw": "OpenClaw",
     "antigravity": "Antigravity",
     "kimi": "Kimi",
+    "grok": "Grok",
 }
 
 
@@ -295,6 +296,24 @@ HARNESS_CONTRACTS: tuple[HarnessProtectionContract, ...] = (
         ),
         smoke_command="hol-guard install kimi --dry-run",
     ),
+    HarnessProtectionContract(
+        harness="grok",
+        install_aliases=("grok", "grok-build", "grok-build-cli", "xai-grok"),
+        config_paths=(
+            "~/.grok/config.toml",
+            "~/.grok/managed_config.toml",
+            "~/.grok/hooks/",
+        ),
+        event_surfaces=("shell", "prompt", "mcp_tool", "file_read"),
+        native_approval=False,
+        browser_fallback=True,
+        resume_support=False,
+        known_blind_spots=(
+            "Grok hooks fail open on crash or timeout. --always-approve and bypassPermissions weaken "
+            "prompt policy but PreToolUse hooks still run when installed."
+        ),
+        smoke_command="hol-guard install grok --dry-run",
+    ),
 )
 
 _CONTRACT_BY_ALIAS: dict[str, HarnessProtectionContract] = {}