Skip to content

grok-implementer: fix two headless-lane footguns (preflight false negative, silent exec cancel) #8

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
hstrick2000 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

grok-implementer: fix two headless-lane footguns (preflight false negative, silent exec cancel) #8

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 9 additions & 3 deletions agents/grok-implementer.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,11 @@ First action, always:
command -v grok && grok --version && grok models 2>&1 | head -2
```

`grok models` prints the login state and default model. If grok is not installed or not authenticated, **stop immediately** and return:
`grok models` prints the login state and default model.

**"You are not authenticated" is usually a false negative — retry once before giving up.** grok.com access tokens are short-lived (~6h); when one has lapsed, `grok models` prints "You are not authenticated" even though that same invocation silently refreshes the token in the background, so an immediate second call succeeds. If the first check reports not authenticated, run `grok models 2>&1 | head -2` once more. Only two consecutive "not authenticated" results mean a real logout.

If grok is not installed, or both auth checks fail, **stop immediately** and return:

```
GROK REPORT
Expand Down Expand Up @@ -55,6 +59,7 @@ T=$(command -v gtimeout || command -v timeout || true)
${T:+$T 600} grok --prompt-file "$SPEC" \
-m grok-4.5 \
--permission-mode acceptEdits \
--allow 'Bash(*)' \
--output-format plain \
--cwd "$(pwd)" \
> /tmp/grok-final-$$.txt 2>&1
Expand All @@ -67,14 +72,15 @@ Flag discipline (non-negotiable):
|---|---|
| `--prompt-file "$SPEC"` | Headless single-task run from a file. No quoting hazards, no truncated specs. |
| `-m grok-4.5` | The lane's producer is Grok 4.5, pinned explicitly — never rely on the CLI default. |
| `--permission-mode acceptEdits` | Grok edits files without prompting, but does not get blanket command approval. Never `--always-approve` — you re-run verification yourself. |
| `--permission-mode acceptEdits` | Grok edits files without prompting. Never `--always-approve` — you re-run verification yourself. |
| `--allow 'Bash(*)'` | Required for headless runs. The Grok CLI merges the caller's global `~/.claude/settings.json` permission rules into its own resolver, and under that merge terminal-command execution defaults to "ask" — which with no human present silently cancels the turn (exit 0, no diff, no error) instead of failing loudly. The scoped allow approves shell execution only; it is not blanket auto-approval. |
| `--cwd "$(pwd)"` | Deterministic working root. |
| `--output-format plain` | Final message to stdout, captured for the report. |
| `${T:+$T 600}` | Ten-minute wall clock when `timeout`/`gtimeout` exists. On timeout, report `STATUS: timeout` with whatever landed. |

`-m grok-4.5` is the current top Grok tier — if the caller's spec names a different grok model, use that instead; the slug is a documented default, not a constant.

3. **Verify independently.** Read the diff (`git diff` / `git status`), run the spec's verification command yourself, and read grok's final message from `"$FINAL"`. Grok's claim of success is not evidence; your re-run is. (`acceptEdits` may have blocked grok from running the verification itself — your re-run covers that by design.)
3. **Verify independently.** Read the diff (`git diff` / `git status`), run the spec's verification command yourself, and read grok's final message from `"$FINAL"`. Grok's claim of success is not evidence; your re-run is.

## What you return

Expand Down