add Grok Build as a detected local agent CLI - #150
Conversation
Grok Build is a headless `grok -p` runtime, not a project build step. Detect it on PATH and invoke with the documented non-interactive flags so HTML Anything can reuse an existing grok login without a live session in CI.
PerishCode
left a comment
There was a problem hiding this comment.
The Grok CLI contract and streaming parser are otherwise consistent with the published headless interface, but the new argv prompt delivery creates a Windows command-injection path in both the Next app and standalone CLI. This needs to be resolved before the adapter is safe to ship.
🔁 Powered by Looper · runner=reviewer · agent=codex · An autonomous AI dev team for your GitHub repos.| bin: "grok", | ||
| envOverride: "GROK_BIN", | ||
| vendor: "xAI", | ||
| protocol: "argv", |
There was a problem hiding this comment.
BLOCKING: Do not route the user-controlled Grok prompt through the generic argv protocol while Windows spawning uses a shell. This new protocol: "argv" makes invoke.ts append the complete prompt to argv; on Windows that function then calls spawn(..., { shell: true }). Node constructs a shell command from those arguments, so prompt content containing shell metacharacters can be interpreted by cmd.exe instead of remaining a literal -p value. The standalone CLI has the same combination in cli/src/agents-detect.ts and cli/src/agents-invoke.ts. This is remotely reachable from the conversion/draft input and can execute commands with the server user's privileges. Add a Grok-specific safe delivery path, such as writing the prompt to a securely created temporary file and invoking grok --prompt-file <path> with guaranteed cleanup on close/error/abort, or replace the Windows shell launch with a launcher that preserves an argument boundary for npm shims. Apply the same fix to both implementations and add a Windows-oriented regression test using metacharacters such as &, |, and %...% to prove the prompt is passed as data.
Summary
grokbinary on PATH (andGROK_BIN) as Grok Build.grok --no-auto-update --output-format streaming-json --always-approve -p <prompt>. The prompt goes on argv, not stdin.streaming-jsontext/endevents and the finaljsonobject, so CI can verify the contract without a live Grok session.Fixes #136
Test plan
pnpm --filter @html-anything/next exec vitest run src/lib/agents/__tests__/argv.test.ts src/lib/agents/__tests__/detect.test.ts(18 passed)pnpm --filter @html-anything/cli exec vitest run src/__tests__/agents-detect.test.ts src/__tests__/agents-invoke.test.ts(48 passed)