feat(grok-build): host Grok Build as a Cindy harness like Claude Code

[yuchenlin]

这次改了什么

摘要

把 Grok Build 做成和 Claude Code / Pi 同级的 Cindy 托管 harness：走 Cindy Pi loop + SuperGrok / 网关，独占 Grok catalog slug，不要独立 ACP / grok login 通道。本 PR 从当前 main 重放，替代 #3479。

变更类型

• feat 新功能

范围

• 关联 Issue / 需求：替代 feat(maker-core): add optional Grok Build ACP harness #3479；对齐 MagicLizi 的 harness 产品条；讨论 issue 维护者确认：#3967 将 Grok Build 做成 Cindy 一等 harness #3969
• 本 PR 包含：Cindy hosted loop 注册、SuperGrok 来源门禁、独占 Grok 钉 xAI、rewind/fork 走 Pi tail-turn、统一选择器 harness chip
• 明确不包含：删除遗留 ACP 模块；合入 product hold；修 grok-build 会话后 composer 翻成 Opus 的落盘问题
• 用户可见变化：模型选择器里独占 Grok 行可切 Grok Build；未连 SuperGrok 时引导去设置 → 模型供应商
• 是否存在 breaking change：无

UI 变化

• 引用的设计规范：DESIGN.md §Select & Dropdown（统一选择器 trigger / harness chip，Grok Build 是引擎芯片不是模型行）；DESIGN.md §15 色彩与 docs/design-rules/cindy-design-system.md（新增 engine-badge-grok-build 中性石墨灰，与 cc/codex/pi 徽标可区分，light/dark 同值）。权限档文案对齐 Pi 托管循环的 ask / auto / bypass，不再描述 ACP。

改动后界面效果（统一选择器独占 Grok 行的 Grok Build harness chip + 权限档）：

<div class="unified-row" data-model="grok-4.6" data-source="xai">
  <span class="model-name">Grok 4.6</span>
  <span class="badge-sub">Subscription</span>
  <button type="button" data-engine-badge="grok-build" aria-pressed="true"
    style="background: color-mix(in srgb, #6b7280 14%, transparent); border-color: color-mix(in srgb, #6b7280 30%, transparent);">
    Grok Build
  </button>
</div>
<div class="permission-selector" data-vendor="grok-build">
  <button data-mode="ask">Default permissions — Read-only tools run directly; writing files, running commands, and MCP tools ask each time.</button>
  <button data-mode="auto">Auto-review — In-workspace writes and safe commands run automatically; out-of-workspace writes, risky commands, and MCP tools still ask.</button>
  <button data-mode="bypassPermissions">Full access — Routine tools run without asking. Highest risk.</button>
</div>

怎么验证的

自动验证

# hosted identity (real GrokBuildAgent)
pnpm --dir packages/maker-core test src/agents/grok-build/__tests__/grok-build-capabilities.test.ts src/agents/grok-build/__tests__/grok-build-session.test.ts
结果：7/7 pass

# source-ready (hasUsableConnectedSource)
pnpm --dir packages/model-providers test src/__tests__/source-registry.test.ts
结果：67/67 pass

# exclusive route + remote readiness + rewind/fork
NODE_OPTIONS=--max-old-space-size=8192 pnpm --dir apps/desktop test \
  src/main/maker-host/__tests__/model-route-guard.test.ts \
  src/renderer/__tests__/vendorAuthGateRemoteReadiness.test.ts \
  src/main/__tests__/rewind.test.ts \
  src/main/__tests__/fork.test.ts
结果：120/120 pass（含 grok-build tail-turn rewind/fork）

# design-tokens classification (engine-badge-grok-build)
pnpm --dir packages/design-tokens generate
pnpm --dir packages/design-tokens test src/__tests__/classification.test.ts
结果：9/9 pass；classification.json snapshotCount=521，含 engine-badge-grok-build

# extra
pnpm --dir packages/maker-core test src/agents/grok-build
pnpm --dir packages/model-providers test src/__tests__/unifiedSelection.test.ts
NODE_OPTIONS=--max-old-space-size=8192 pnpm --dir apps/desktop test src/main/maker-host/__tests__/catalogDerivedModels.test.ts
pnpm --dir apps/mobile test src/__tests__/agentAuthGate.test.ts src/__tests__/newSession.test.ts
结果：全部通过

平台：macOS arm64 本地 worktree /Users/yuchenlin/cindy-hosted-pr，基于当前 origin/main。

手工验证

Cindy Electron 隔离沙箱 CindyGlobal-dev2-dev（CDP 9222）：新建会话，Grok Build only + Grok 4.6，发送 Reply with exactly: PONG-HOSTED-GROK-BUILD。会话 aa769416 回了 PONG-HOSTED-GROK-BUILD。无 grok-login 弹窗，无 default-gateway SuperGrok 报错。DB agent_kind=grok-build。

未执行的验证

• 全量 desktop vitest（本机 OOM）
• Windows 全量本地（依赖 CI）
• 移动端完整会话

风险

风险分类

• 存量插件兼容（批准状态 / 指纹 / manifest 校验 / 安装布局 / 包格式）
• 其他：模型面 / SuperGrok 计费；核心路径和大 diff；product hold（issue 维护者确认：#3967 将 Grok Build 做成 Cindy 一等 harness #3969）

影响与回滚

• errandPrefsStore.ts 把 GHOST_ERRAND_AGENT_KINDS 从 cc|codex|pi 扩成含 grok-build。已装 Ghost / errand 插件读这份词汇表时会多一个合法 agent；旧偏好 JSON 没有该键时仍按原三档解析，不改存量批准状态或指纹。回滚：还原该数组并撤回 harness 注册即可，无需 migration。
• 独占 Grok 未连 SuperGrok、或目录没有该 slug 拷贝时，发送会被门禁 / route guard 拦住，不会再 fail-open 进默认网关。
• 回滚路径：关闭本 PR / revert feat/grok-build-hosted-harness；不改 schema。ACP 文件仍在树里但 host 不 spawn。

Why

MagicLizi 的条是：Grok Build 必须是 Cindy 一等 harness，坐在模型面 / 计费上，带 MCP / Orca / Ghost 和 rewind / fork / steer / plan。独立 ACP + grok login 不是这个产品。

What

• GrokBuildAgent 继承 Cindy hosted Pi loop。kind 仍是 grok-build。
• 注册跟 Cindy hosted loop，不看 PATH grok。
• Auth 是 SuperGrok / Cindy 网关。未鉴权去设置 → 模型供应商。不跑 grok login，不读 ~/.grok/auth.json。
• 模型只投影独占 Grok catalog slug。没有 grok-build 模型行。
• 独占 Grok 在 xAI 已连接且有目录拷贝时钉 SuperGrok；断连或没有该 slug 的拷贝则 exclusive-source-unavailable。
• rewind / fork 走 Pi tail-turn，不再 ACP fail-closed。

ACP client / detect / stdio 文件还在树里，host 不 spawn grok agent stdio。

Supersedes #3479.

[greptile-apps]

Greptile Summary

This PR adds Grok Build as a fourth Cindy harness by subclassing the hosted Pi runtime, projecting exclusive Grok catalog models, routing them through SuperGrok/xAI, and extending desktop, mobile, persistence, automation, IPC, and UI contracts.

• Registers Grok Build from Cindy’s managed hosted loop with a separate session home.
• Extends agent-kind contracts, model selection, source readiness, session switching, search, scheduling, Orca, and device-link projections.
• Adds Grok Build presentation, localization, tests, and retained-but-unused ACP support modules.
• Two behavioral gaps remain: advertised fork/rewind operations are unconditionally rejected, and source readiness does not validate the selected Grok model.
• README and permission copy still describe the superseded CLI/ACP architecture.

Confidence Score: 3/5

The PR is not yet safe to merge because advertised fork and rewind operations always fail, and unavailable Grok model slugs can pass source and route admission.

Grok Build exposes inherited hosted-loop capabilities that its orchestration paths explicitly reject, while its readiness and routing special cases validate only the xAI connection rather than the selected model’s availability. The remaining findings are user-facing documentation mismatches.

Files Needing Attention: apps/desktop/src/main/maker-orchestration/fork.ts, apps/desktop/src/main/maker-orchestration/rewind.ts, packages/model-providers/src/registry.ts, apps/desktop/src/main/maker-host/model-route-guard.ts

Important Files Changed

Filename	Overview
packages/maker-core/src/agents/grok-build/index.ts	Defines Grok Build as a Pi-hosted agent with a distinct kind and disabled Fast mode; inherited capabilities conflict with host-level fork and rewind rejection.
apps/desktop/src/main/maker-host/grok-build-host.ts	Registers the harness through the managed Pi loop and isolates its session home from ordinary Pi sessions.
apps/desktop/src/main/maker-host/model-route-guard.ts	Pins exclusive Grok routes to xAI but accepts a connected provider even when the selected model copy is absent.
packages/model-providers/src/registry.ts	Adds shared Grok Build source readiness, but the special case ignores per-model availability.
apps/desktop/src/main/maker-orchestration/fork.ts	Unconditionally rejects Grok Build despite the runtime advertising fork support.
apps/desktop/src/main/maker-orchestration/rewind.ts	Unconditionally rejects Grok Build despite the runtime advertising rewind support.
apps/desktop/src/main/maker-host/index.ts	Wires Grok Build into the desktop Maker registry with catalog-derived Grok models and shared hosted-loop dependencies.
packages/model-providers/src/unifiedSelection.ts	Attaches Grok Build as a harness candidate to exclusive Grok model rows without creating a synthetic model or provider row.
apps/desktop/src/renderer/components/new-chat/ChatInput.tsx	Extends unified selection and send readiness to Grok Build while gating exposure on runtime registration.
apps/mobile/src/session/newSession.ts	Adds remotely registered Grok Build as an opt-in mobile session choice.
README.md	Documents an obsolete PATH-based availability requirement that contradicts the hosted implementation.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
    UI[Desktop or mobile selector] --> Gate[Runtime and source readiness]
    Gate --> Catalog[Exclusive Grok catalog slug]
    Catalog --> Guard[Model route guard]
    Guard --> XAI[SuperGrok / xAI route]
    XAI --> Host[GrokBuildAgent]
    Host --> Pi[Cindy-hosted Pi loop]
    Pi --> Tools[MCP / Orca / Ghost tools]
    Pi --> Session[Session events and persistence]

Loading

Prompt To Fix All With AI

### Issue 1
apps/desktop/src/main/maker-orchestration/fork.ts:697-702
**Advertised actions always fail**

Grok Build inherits Pi's `fork` and `rewind` capabilities as supported, and the capability test explicitly requires both. The UI therefore exposes these actions, but this guard rejects every Grok Build fork before the Pi-compatible path runs; the matching guard in `rewind.ts:187-192` does the same for rewind. Users who click either advertised action always receive an unsupported-history error. Grok Build should either use the hosted Pi implementations or report both capabilities as unsupported.

### Issue 2
packages/model-providers/src/registry.ts:321-325
**Readiness ignores model availability**

For Grok Build, this branch ignores `modelId` and treats any connected xAI provider as a usable source. The route guard in `apps/desktop/src/main/maker-host/model-route-guard.ts:128-137` likewise pins xAI when the selected model has no catalog copy. A stale or default Grok slug that the connected account does not offer can therefore pass the picker and send gates, then fail during route resolution or upstream invocation instead of being rejected or reconciled to an available model.

### Issue 3
README.md:26
**README states wrong prerequisite**

This says Grok Build is available when the `grok` CLI is on PATH, but the implementation registers it from Cindy's managed Pi runtime and does not consult that CLI. Users without `grok` can still receive the harness, while installing `grok` does not ensure that the hosted runtime is available. Update this line and the matching Chinese text in `README.zh-CN.md:29` to describe the hosted-loop and SuperGrok requirements.

### Issue 4
apps/desktop/src/renderer/i18n/locales/en/common.json:7327-7338
**Permission copy describes ACP**

These new descriptions tell users that Grok Build uses ACP prompts, ACP interception, and ACP-style always-approve behavior, although this PR replaces ACP execution with the Cindy-hosted Pi loop. That describes a permission boundary the runtime does not use and can mislead users choosing between Default permissions, Auto-review, and Full access. Update this text and the corresponding Japanese, Korean, Simplified Chinese, and Traditional Chinese entries to describe the actual hosted-loop approval behavior.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "feat(grok-build): host Grok Build on the..." | Re-trigger Greptile}

[MagicLizi]

@yuchenlin 👋 这个 PR 还有 4 条 review conversation 没 resolve(apps/desktop/src/main/maker-orchestration/fork.ts / packages/model-providers/src/registry.ts / README.md / apps/desktop/src/renderer/i18n/locales/en/common.json),auto-review 因此暂时跳过、没法继续审查 / 合并。

如果你已经按评论改完或回应了,请到对应 thread 上点 Resolve conversation;全部 resolve 后,下一轮 auto-review 会自动重新审查这个 PR。

[yuchenlin]

四条 Greptile conversation 已改完并 resolve：

1. fork/rewind 广告能力却 fail-closed — 已走 hosted Pi tail-turn（25b47f9a2）。
2. source-ready 只看 xAI 已连接、不看模型拷贝 — 现在要 SuperGrok 且 目录里有该独占 Grok slug；没有拷贝则 route guard reject。
3. README 还写 PATH grok — 改成 SuperGrok + Cindy hosted loop。
4. 权限文案写 ACP — 五语都改成托管循环的 ask / auto / bypass。

另外补了 CI：引用的设计规范、IM merge 快照、color freeze、newMakerProjectPicker fail-open 断言。

[MagicLizi]

这条 PR 需要维护者确认后才能合并，自动审查不会代为放行。

原因：

• 产品：把 Grok Build 做成一等 harness，并改到模型选择 / 设置等界面；
• 插件基座：改到 errandPrefsStore.ts，会影响全部已装插件的兼容；
• 架构：核心路径和大 diff。

请维护者直接在本 PR 上 Approve；若要改，请 Request Changes，作者改完后再 Approve。讨论 issue：#3969

另外，Description 还缺「这次改了什么 / 怎么验证的 / 风险」三段，界面改动也还没有效果证据（截图、录屏或 HTML）。这些会另开格式打回，不代替本次维护者确认。

[MagicLizi]

命中 UI 路径（模型选择、设置、侧栏图标、用量等）但 description 未附界面效果证据。建议补充改动后效果：截图/录屏，或改动后界面的 HTML 页面（```html 代码块、.html 附件或在线预览链接），便于确认界面符合 DESIGN.md。

[MagicLizi]

格式门仍未通过，请按仓库 PR 模板补全 Description 后再请求审查。

• Description 缺段落：怎么验证的 / 风险
  当前正文有 Why / What，但仍对不上 .github/PULL_REQUEST_TEMPLATE.md 要求的三段。请明确写出：
  1. 怎么验证的（实际跑过的命令、平台、关键回归）；
  2. 风险（插件基座 errandPrefsStore.ts、存量插件兼容、核心路径/大 diff、模型面与计费）。

[yuchenlin]

Description 已按模板补全：

• 这次改了什么（含 UI 变化 + DESIGN.md 引用 + HTML 效果证据）
• 怎么验证的（实际命令与结果，含 hosted identity / source-ready / route / rewind-fork / design-tokens）
• 风险（errandPrefsStore.ts 存量插件词汇表扩 grok-build、模型面/计费、回滚路径）

design-tokens 分类快照也已 regenerate：engine-badge-grok-build 进 classification.json（count 521）。

[MagicLizi]

@yuchenlin 👋 这个 PR 目前与 main 有合并冲突,auto-review 因此暂时跳过、没法继续审查 / 合并。

请在本地 merge 最新的 origin/main 解决冲突后推送;冲突解除后,下一轮 auto-review 会自动重新处理这个 PR。

这些问题已在当前 head 的后续 commit 中修复(格式门/安全门已通过),自动 dismiss 旧的 CHANGES_REQUESTED 以解除合并阻塞。

[yuchenlin]

冲突已解：head 已 merge 当前 origin/main（含 #2829 bots）。Bot 模型链仍只走 Claude / Codex / Pi 三引擎，Grok Build 不进入 teammate/worker 派发（#3969 另议）。verify-checks 的 typecheck 刚补上。