feat: qualify grok native project E2E

cli/internal/agentpluginscli/project_grok_cycle_contract_test.go

@@ -0,0 +1,187 @@
+//go:build linux
+
+package agentpluginscli
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"reflect"
+	"strings"
+	"testing"
+
+	"github.com/777genius/plugin-kit-ai/install/integrationctl/adapters/dirswap"
+	"github.com/777genius/plugin-kit-ai/install/integrationctl/agentplugins/adapters/processlock"
+	"github.com/777genius/plugin-kit-ai/install/integrationctl/agentplugins/adapters/statev2"
+	"github.com/777genius/plugin-kit-ai/install/integrationctl/agentplugins/domain"
+	"github.com/777genius/plugin-kit-ai/install/integrationctl/agentplugins/installer"
+	clientplanner "github.com/777genius/plugin-kit-ai/install/integrationctl/agentplugins/planner"
+	"github.com/777genius/plugin-kit-ai/install/integrationctl/agentplugins/plannertest"
+	"github.com/777genius/plugin-kit-ai/install/integrationctl/agentplugins/providers"
+	"github.com/777genius/plugin-kit-ai/install/integrationctl/agentplugins/providerstest"
+	"github.com/777genius/plugin-kit-ai/install/integrationctl/agentplugins/transaction"
+	legacyports "github.com/777genius/plugin-kit-ai/install/integrationctl/ports"
+)
+
+type cycleGrokCLIRunner struct{ project, executable string }
+
+func (r cycleGrokCLIRunner) Run(_ context.Context, command legacyports.Command) (legacyports.CommandResult, error) {
+	if command.Dir != r.project || !reflect.DeepEqual(command.Argv, []string{r.executable, "inspect", "--json"}) {
+		return legacyports.CommandResult{}, fmt.Errorf("unregistered inert Grok CLI command")
+	}
+	plugins := []any{}
+	root := filepath.Join(r.project, ".grok", "plugins")
+	entries, err := os.ReadDir(root)
+	if err != nil && !os.IsNotExist(err) {
+		return legacyports.CommandResult{}, err
+	}
+	for _, entry := range entries {
+		path := filepath.Join(root, entry.Name())
+		body, err := os.ReadFile(filepath.Join(path, ".grok-plugin", "plugin.json"))
+		if err != nil {
+			return legacyports.CommandResult{}, err
+		}
+		var manifest map[string]any
+		if err := json.Unmarshal(body, &manifest); err != nil {
+			return legacyports.CommandResult{}, err
+		}
+		plugins = append(plugins, map[string]any{"name": manifest["name"], "scope": "project", "path": path, "enabled": true})
+	}
+	body, err := json.Marshal(map[string]any{"grokVersion": "1.0.70", "cwd": r.project, "projectRoot": r.project + "/", "projectTrusted": true, "plugins": plugins, "skills": []any{}})
+	return legacyports.CommandResult{Stdout: body}, err
+}
+
+// Exercise public Cobra routing and the real grouped lifecycle with an inert
+// in-memory inspector. No vendor executable is run or qualified.
+func TestProjectGrokPublicGroupedRepairRestagesIntactAndMissingPackage(t *testing.T) {
+	client := fixtureClient(t, domain.ClientGrok)
+	f := newCLIFixture(t, []domain.DetectedClient{client})
+	project := filepath.Join(f.root, "project")
+	for _, path := range []string{project, client.ConfigRoot} {
+		if err := os.MkdirAll(path, 0700); err != nil {
+			t.Fatal(err)
+		}
+	}
+	client.ExecutablePath, client.Version = filepath.Join(f.root, "inert-grok"), "1.0.70"
+	if err := os.WriteFile(client.ExecutablePath, []byte("inert bytes; never executed\n"), 0700); err != nil {
+		t.Fatal(err)
+	}
+	f.app.Detector = staticDetector{clients: []domain.DetectedClient{client}}
+	stateRoot := filepath.Join(project, ".uap")
+	f.store = statev2.Store{Path: filepath.Join(stateRoot, "state-v2.json"), ProjectRoot: project}
+	f.app.Scope, f.app.ProjectRoot, f.app.ManagedRoot, f.app.StateStore = domain.ScopeProject, project, filepath.Join(stateRoot, "managed"), f.store
+	f.app.EnvironmentLockPath = filepath.Join(stateRoot, "environment.lock")
+	planner := plannertest.NewPlanner(clientplanner.Planner{ProjectRoot: project, ManagedRoot: f.app.ManagedRoot})
+	f.app.Planner, f.app.Targets = planner, planner
+	runner := cycleGrokCLIRunner{project, client.ExecutablePath}
+	f.app.Lifecycle.ProjectRoot, f.app.Lifecycle.StateStore = project, f.store
+	f.app.Lifecycle.Planner, f.app.Lifecycle.Targets = planner, planner
+	f.app.Lifecycle.Activator = providerstest.NewActivator(providers.Activator{Runner: runner})
+	f.app.Lifecycle.NativeObserver = providerstest.NewObserver(providers.NativeIdentityObserver{Runner: runner, Stager: f.app.Lifecycle.Stager})
+	f.app.Lifecycle.Lock = processlock.Lock{Path: filepath.Join(stateRoot, "mutation.lock")}
+	f.app.Lifecycle.Kernel = transaction.Kernel{StateStore: f.store, Directory: dirswap.Manager{JournalDir: filepath.Join(stateRoot, "operations")}}
+	f.app.Lifecycle.PluginData = providers.PluginDataManager{Base: filepath.Join(stateRoot, "plugin-data")}
+	var err error
+	f.app.Installer, err = installer.New(installer.Config{ProjectRoot: project, StateRoot: stateRoot, Registry: f.app.ClientRegistry, Runner: runner, HelperExecutable: client.ExecutablePath, EnableNativeObserver: true, TrustedLocalPackages: true})
+	if err != nil {
+		t.Fatal(err)
+	}
+	f.app.Lifecycle.CheckNamespace = f.app.Installer.CheckProjectNamespace
+	source := writeCLIPlugin(t)
+	skill := []byte("---\nname: guide\ndescription: Inert public repair\n---\nRecorded source.\n")
+	if err := os.MkdirAll(filepath.Join(source, "skills", "guide"), 0700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(source, "skills", "guide", "SKILL.md"), skill, 0600); err != nil {
+		t.Fatal(err)
+	}
+	run := func(verb, selector string, mutated bool) {
+		t.Helper()
+		args := []string{verb, selector, "--scope", "project", "--project-root", project, "--target", "grok", "--format", "json"}
+		if verb == "add" {
+			args = append(args, "--no-save")
+		}
+		stdout, stderr, err := f.execute(false, args...)
+		if err != nil {
+			t.Fatalf("actual public %s: %v\n%s\n%s", verb, err, stdout, stderr)
+		}
+		var result map[string]any
+		if err := json.Unmarshal([]byte(stdout), &result); err != nil {
+			t.Fatal(err)
+		}
+		data := result["data"].(map[string]any)
+		output := data
+		if verb == "add" && !mutated {
+			if _, exists := data["targets"]; exists || data["operation_id"] != nil {
+				t.Fatal("actual repeat add invented a batch/group", stdout)
+			}
+		} else {
+			if data["batch"] != true {
+				t.Fatal("actual grouped lifecycle lost batch output", stdout)
+			}
+			output = data["targets"].([]any)[0].(map[string]any)["output"].(map[string]any)
+		}
+		expectedSource := "direct local source"
+		if verb == "repair" || verb == "remove" {
+			expectedSource = "local"
+		}
+		if output["source"] != expectedSource {
+			t.Fatal("actual public source differs", verb, stdout)
+		}
+		out := output["result"].(map[string]any)
+		if out["mutated"] != mutated {
+			t.Fatalf("actual public %s mutated=%v want%t", verb, out["mutated"], mutated)
+		}
+	}
+	run("add", source, true)
+	state, err := f.store.Load()
+	if err != nil || len(state.Installations) != 1 {
+		t.Fatal(err)
+	}
+	i := state.Installations[0]
+	beforeNoop, err := os.ReadFile(f.store.Path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	run("add", source, false)
+	run("update", i.DeclaredName, false)
+	afterNoop, err := os.ReadFile(f.store.Path)
+	if err != nil || string(beforeNoop) != string(afterNoop) {
+		t.Fatal("actual public no-op changed installed state", err)
+	}
+	var binding domain.ClientBinding
+	for _, b := range i.Clients {
+		binding = b
+	}
+	run("repair", i.InstallationID, true)
+	path := filepath.Join(binding.TargetLocator, "skills", "guide", "SKILL.md")
+	if err := os.Remove(path); err != nil {
+		t.Fatal(err)
+	}
+	before, err := os.ReadFile(f.store.Path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	files := preparedClaudeCLIFiles(t, binding.TargetLocator)
+	_, _, err = f.execute(false, "repair", i.InstallationID, "--scope", "project", "--project-root", project, "--target", "grok", "--format", "json")
+	after, readErr := os.ReadFile(f.store.Path)
+	if err == nil || !strings.Contains(err.Error(), "native identity ownership is indeterminate") || readErr != nil || string(before) != string(after) || !reflect.DeepEqual(files, preparedClaudeCLIFiles(t, binding.TargetLocator)) {
+		t.Fatal("public grouped repair adopted or changed partially missing package", err, readErr)
+	}
+	if len(files) != 2 || files[filepath.Join(binding.TargetLocator, "plugin.json")] == "" || files[filepath.Join(binding.TargetLocator, ".grok-plugin", "plugin.json")] == "" {
+		t.Fatal("inert owned package membership changed before exact absence fault")
+	}
+	for _, relative := range []string{"plugin.json", ".grok-plugin/plugin.json", "skills/guide", "skills", ".grok-plugin", "."} {
+		if err := os.Remove(filepath.Join(binding.TargetLocator, filepath.FromSlash(relative))); err != nil {
+			t.Fatal("exact nonrecursive owned package absence fault", err)
+		}
+	}
+	run("repair", i.InstallationID, true)
+	restored, err := os.ReadFile(path)
+	if err != nil || string(restored) != string(skill) {
+		t.Fatal("public grouped repair did not restore exact missing leaf", err)
+	}
+	run("remove", i.DeclaredName, true)
+}

docs/GROK_PROJECT_BYOK_OBSERVATION_PLAN.md

@@ -0,0 +1,181 @@
+# Grok installed startup through its documented custom provider
+
+## Current observed boundary and authority
+
+PR522 current source b4a2d5dea1cc2cd9a0165660924732ec6e1df811 has tree
+d09f2103389f697b3c6c5afb3f01056aae247d93. Local baseline
+648d79623b71efd1518d60eb02f90ffe7f34b4f3 has that exact tree, preserving
+the published runtime concurrency overlay. Genuine runtime40408742120 already
+passes public project add and the exact disabled/untrusted installed-candidate
+inspection, then the ordinary native startup asks for vendor sign-in. That
+failure proves neither loaded skills nor an unavailable custom-provider route.
+All five qualification flags and vendor/model flags remain false.
+
+The publisher's official settings and enterprise documentation, checked on
+2026-10-27, documents user-scope model.<id> with model, base_url, env_key and
+api_backend=chat_completions, plus per-model key resolution for headless use:
+https://docs.x.ai/build/settings/reference
+https://docs.x.ai/build/settings
+https://docs.x.ai/build/enterprise
+These current documents support a bounded custom-provider experiment, not an
+assertion that the pinned1.0.70 binary has already accepted it. Its reported
+build f50904eaee6c does not resolve in the publisher's public grok-build Git
+history, so no immutable source claim is made for that build.
+
+The actual pinned help permits --model, --single, streaming-json and the
+existing deny-all command. Preserve the exact native pin and original HOME.
+This slice may configure an explicitly labelled scripted loopback provider;
+it may not invent a vendor account, use a real API key, alter enterprise
+requirements, grant trust, enable tools or weaken any installed ownership guard.
+
+## Bounded implementation after two independent plan GOs
+
+Add one Grok-only helper and inert contracts, with small explicit hooks in the
+existing four-client attempt. No new generic provider/client framework.
+Before the first native command in this fresh fixture, start a context-owned
+HTTP listener on 127.0.0.1:0 and exclusively create original
+HOME/.grok/config.toml. Select one fixed model uap-grok-fixture in that user
+config, with model=uap-grok-fixture, the held loopback /v1 base URL,
+env_key=UAP_GROK_TEST_PROVIDER_KEY, api_backend=chat_completions,
+supports_backend_search=false, supports_reasoning_effort=false and max_retries=0.
+Use the exact --model uap-grok-fixture on the existing native startup argv.
+Keep --deny "", default permission mode, no-subagents, disable-web-search and
+max-turns1 unchanged. No trust configuration is authored; the existing native
+inspection must still prove the untrusted disabled Prepared candidate.
+
+Generate a fixture-only private random credential for that loopback endpoint.
+Pass only its explicit environment variable in this Grok fixture's closed child
+environment; inherit no host credentials. Do not put its value in config,
+argv, command receipts or evidence. Add the newly authored config's digest to
+the existing protected set before any native command. Never reset that baseline
+after startup. Preserve all runtime/archive/source/installer/receipt/data guards.
+
+The listener accepts only POST /v1/chat/completions with the exact held bearer,
+loopback peer, bounded headers and a maximum1MiB body within the original total
+deadline. Permit at most one admitted request and one fixed response. Record
+wrong-route/auth/method/duplicate/overlimit/invalid-JSON failures as finite
+categories only, without echoing headers, credentials or exception text.
+Strictly decode JSON with the existing duplicate/depth/number limits. Require
+an object, exact selected model, stream=true and a nonempty bounded messages
+array. Unknown request fields remain opaque captured research bytes; they are
+not approved runtime grammar or accepted qualification. Do not interpret or
+execute tool requests. Reply with the minimal fixed OpenAI-compatible SSE text
+completion followed by [DONE], containing only a fixture sentinel independent
+of installed skill contents. No tool-call response or provider-directed action.
+
+Capture the admitted request body and fixed response bytes under two exact
+Grok-specific filenames plus one bounded provider receipt. Redact the private
+fixture credential before any bytes enter f.files, including native stdout and
+stderr. The receipt contains only fixed transport/model labels, request and
+response counts, whether the exact test credential matched, finite error and
+ordinary listener shutdown status. Never retain HTTP headers, config bodies,
+real auth state or private native profile inventories. Reject any remaining
+fixture credential canary before artifact serialization and in the shared
+Python envelope validator.
+
+Tie HTTP deadlines to the existing fixture context and use bounded server
+read/header/write/idle deadlines. Close the listener and active handler on every
+exit, including constructor/setup/native failure; await its serve goroutine
+and record actual shutdown outcome before the attempt summary is finalized.
+Cleanup failure remains a test failure. Do not extend the original150/180-second
+attempt budgets, native60-second command limit, command inventory, process
+supervision, hosted admission or output bounds. Other three clients receive no
+listener, profile, environment, argv, provider artifact or cleanup change.
+
+This is a first measured custom-provider capture. Preserve the existing
+deliberate runtime fatal gate even if the native command exits0. No exact
+native session/stream/skill-load grammar is inferred from a scripted text
+response. All qualification, vendor-authentication and real-model flags remain
+false. A fresh genuine hosted capture must establish whether the pinned native
+client accepts this supported route and what it actually discovers before a
+separate reviewed full user/A/B lifecycle and native restart/removal slice.
+Grok's production project MCP remains explicitly unsupported.
+
+## Closed scope and verification
+
+Files: repotests/agentplugins_project_native_cli_attempt_test.go; one new
+repotests/agentplugins_grok_project_native_provider_test.go containing the
+bounded helper; one new matching provider-contract test file; existing shared
+CLI argv contracts only for their exact Grok argv expectation; and
+scripts/project_native_runtime.py plus scripts/test_project_native_runtime.py
+for the exact Grok-only provider member/receipt/secret closure, and this plan.
+Preserve all existing shared-client and failure admission cases.
+
+Inert actual-HTTP contracts must prove the single exact route/credential/model
+exchange and fixed SSE, refusal of wrong route/auth/method/model/stream,
+duplicates, malformed or duplicate-key JSON, oversized body and late/cancelled
+requests, bounded cleanup after partial input/failure, and secret-canary
+redaction/refusal. Verify unchanged deny-all flags, protected config bytes and
+original HOME; no loopback authority is added to other clients. Python contracts
+must reject incomplete/extra/misrouted provider members, inconsistent counts,
+malformed finite receipt fields and unredacted canaries; all existing source,
+member, failed-attempt and false-qualification checks remain required.
+
+After independent code review, use the exclusive Go/lint slot for focused
+Grok/new-provider/shared-CLI contracts, affected all-enabled lint and unfiltered
+whole-file size/architecture lint. Run the shared Python admission tests,
+gofmt/whitespace checks and retained actual failed Grok envelope replay. No
+vendor process executes locally. Root alone publishes to existing PR522 with
+fresh actual ref and expected_sha, force=false. No new PR or release; VS Code
+is deferred by the latest explicit owner instruction.
+
+
+## Review checkpoint
+
+CLI R1 and desktop R2 independently approved plan SHA256
+dd85798b4871626281b79ca3e4692584a5158633b46ef403be544fe3d804ff56
+before plan commit b9a40b860061b3671fff62cb9f17be2da69ae195 and source edits.
+The listener is created only after deferred finish owns cleanup, before the
+first native command. The implementation additionally enforces a literal
+origin-form RequestURI, held Host, single authorization/content-type values
+and actual loopback peer; no unknown request field supplies qualification.
+
+Both critics independently approved the complete six-file implementation
+manifest SHA256 7a33859c0ac4df509f0e18021b5c4a169ee41d58cd30a99ff114da585ddcfd20,
+conditional on actual focused Go and both lint gates. All23 existing/new shared
+Python admission contracts pass in0.023 seconds. The Go gates are pending the
+exclusive shared validation slot; this checkpoint does not claim they passed.
+No vendor executable has run locally. The genuine new-source first capture and
+all subsequent full native lifecycle proof remain outstanding.
+
+## Final correction and actual local verification
+
+An independent critic subsequently found that whole-JSON decoding alone misses
+an escaped private-key prefix in a multi-record native JSONL stream. The final
+correction retains raw and whole-JSON canaries, then checks each bounded JSON
+record before capture and at final admission. Go uses a Go1.22-compatible
+`bytes.Cut` loop without an all-lines allocation; Python checks every Grok
+member, including envelopes without a provider receipt, through bounded
+`BytesIO` iteration. The existing one-MiB native member bound applies first.
+Actual first/last-record escaped-prefix controls, benign JSONL and over-bound
+controls cover the demonstrated gap. Both independent critics re-reviewed the
+correction and approved the final bytes.
+
+The actual affected lint initially reported three concrete issues: the inert
+route request needed an explicit context and `http.NoBody`, and connection-state
+accounting needed a tagged switch. These were fixed without suppression or a
+newer-than-Go1.22 API; both critics approved the exact mechanical delta. Final
+provider source SHA256 is
+`1cdd22201b8b18966515b92f1026fd2ee8a732bc393e4cbf900c353f11dc9d8a`,
+and its contract file is
+`6aeaf8af3953324b28075e042835b4875e3e66e2c780b831c4fb30bc93bba801`.
+The shared Python admission source/test hashes are
+`21f93c824812be17d06a4e7ce70757e3caf957d50686e4353eb0c26d2adaa568`
+and `1d22830536b24de7241ecd40942ab7a5c06696288153fdc1882ff8b1bf406f98`.
+
+Final focused Grok/provider/shared-CLI inert Go tests passed in `1.026s`.
+All23 Python admission contracts passed in `0.031s`. Actual all-enabled affected
+lint and unfiltered whole-file size/complexity/architecture lint each reported
+`0 issues`; gofmt and diff whitespace checks pass. Checks used the exclusive
+slot, canonical Go1.26.10, bounded existing caches and direct source indexing
+after the duplicate toolchain cleanup. No vendor executable ran locally.
+
+The actual prior Grok native envelope from source
+`b4a2d5dea1cc2cd9a0165660924732ec6e1df811`, tree
+`d09f2103389f697b3c6c5afb3f01056aae247d93`, also re-admitted all19 closed members
+under the corrected Python code. Its inner SHA256 is
+`dfa0d82412f2654e51bcfcde0c856f00763774dd77c5617b99e284f85704b354`.
+The failed-attempt result, all five false qualification flags, false vendor-auth
+and false real-model flags remain unchanged. These local checks qualify the
+fixture correction only; genuine acceptance of the documented provider settings
+and the complete native project lifecycle remain outstanding.