Add Grok Build CLI agent backend

@ayush-that is attempting to deploy a commit to the Vercel Labs Team on Vercel.

A member of the Team first needs to authorize it.

Security review details

🤖 auto-maintain review

Automated, advisory triage for @ayush-that's PR. Facts below are read from the GitHub API.

Review panel: 🔴 high highest severity

deepsec maintainer code review: 🟡 medium

Grok execution is wired through the pipeline, but onboarding and credential preflight remain incorrect for common local configurations.

• packages/deepsec/src/commands/init.ts:214 — Interactive `init --agent grok` still prompts for a brokered model route and, with the default Gateway choice, requires a Vercel login before reaching Grok's XAI/login preflight. Skip the route prompt and early Vercel linking when the selected agent is Grok.
• packages/deepsec/src/preflight.ts:287 — A persisted `ai.mode: "local"` returns before the new Grok credential check, so Grok setup/process proceeds without `XAI_API_KEY` or `grok login` and fails only after starting agent work. Run the Grok-specific check before the generic local-route shortcut.

General code review: 🟡 medium

Grok execution is mostly integrated, but Grok-only onboarding still depends on Vercel in two paths and medium-sized prompts fail on Windows.

• packages/deepsec/src/commands/init.ts:275 — Interactive `init --agent grok` still calls `ensureVercelLink` because this condition only exempts local routes, forcing an unnecessary Vercel login despite Grok using XAI auth.
• packages/deepsec/src/setup/plan.ts:98 — `init --plan --agent grok` still reports missing Vercel authentication and `ready: false`, contradicting the new Grok-only connection path.
• packages/processor/src/agents/grok-build.ts:300 — Prompts are passed through argv until 80 KB, exceeding Windows' roughly 32K-character command-line limit; ordinary 32–80K investigation prompts fail to spawn instead of using `--prompt-file`.

Scanner and matcher quality: 🔴 high

The Grok backend introduces a merge-blocking prompt-injection path with arbitrary command execution and credential exposure.

• packages/processor/src/agents/grok-build.ts:45 — The scanner grants untrusted repository content approval-free `run_terminal_cmd` access while Grok receives `XAI_API_KEY`/login credentials. With the documented `DEEPSEC_GROK_SANDBOX=off` fallback, prompt injection can execute arbitrary commands, modify the checkout, or expose credentials through command output. Replace this with a constrained read-only command wrapper that strips secrets and blocks network/writes.

Sandbox and credential boundaries: 🟡 medium

Grok backend itself is reasonably contained (env allowlist, isolated GROK_HOME, sandbox path blocked), but the new `xai` model route is persisted into workspace config without a compatibility guard and silently misroutes Codex/Claude credentials, and the prompt is exposed on argv.

• packages/deepsec/src/auth/model-route.ts:77 — `modelRouteFromCli` can now mint a `{mode:"direct", provider:"xai"}` route (`deepsec init --agent grok --model-auth direct`), and `reconcileWorkspaceConfig` persists it into `deepsec.config.ts` before `ensureConnectedWorkspace` ever gets to short-circuit — so the "do not persist a fabricated xai route" comment in ensure-connected-workspace.ts does not hold. `modelRouteCompatibilityError` gained no `xai`-vs-non-grok rule (it only guards anthropic↔codex and openai↔claude), so a subsequent `--agent codex` run resolves that persisted route and silently sets `OPENAI_API_KEY=$XAI_API_KEY` / `OPENAI_BASE_URL=https://api.x.ai/v1`, repointing Codex at xAI and overwriting its real gateway credential; in sandbox mode the broker host/header are likewise rewritten to api.x.ai.
• packages/deepsec/src/preflight.ts:303 — For `--agent claude`/`--agent codex` under that same persisted xai route, `assertAgentCredential` takes the `options.modelRoute.mode !== "local"` branch, computes `keyEnv = "XAI_API_KEY"`, and returns successfully — the Anthropic/OpenAI credential preflight is bypassed entirely, so the run proceeds without the credential it actually needs and fails deep inside the agent instead of at preflight.
• packages/processor/src/agents/grok-build.ts:268 — The investigate/revalidate prompt — which embeds untrusted repository file contents and prior findings — is passed as an argv element (`-p <prompt>`) and is therefore visible to every local user via `ps`/`/proc/<pid>/cmdline`. The Claude and Codex backends stream the prompt over SDK stdio instead. The `--prompt-file` path already implemented here is only used above 80 KB; it should be used unconditionally.
• packages/deepsec/src/preflight.ts:251 — `KNOWN_BACKENDS` adds `"grok"` but not `"grok-build"`, while the rest of the PR treats both as live aliases (`isGrok`, `isGrokAgent`, `setup-agent.ts`, the sandbox early exits). `assertAgentCredential("grok-build", …)` hits the `!KNOWN_BACKENDS.has(agentType)` early return and skips the new XAI_API_KEY / `grok login` check silently, making the new `isGrok(agentType)` branch dead for that alias.

Durability and distributed state: 🟡 medium

The Grok backend has a shutdown durability gap that can orphan paid work, and its persisted xAI route can poison later cross-agent runs.

• packages/processor/src/agents/grok-build.ts:438 — Grok is spawned detached, but normal process/revalidate commands do not connect OS shutdown signals to this AbortSignal. On SIGINT/SIGTERM the run handler exits the parent immediately, leaving Grok orphaned to consume quota and duplicate work after resume; temporary homes/prompts may also remain. Register and terminate active children during shutdown or avoid detaching them.
• packages/deepsec/src/auth/model-route.ts:49 — Direct xAI routes can now be persisted, but compatibility checking still accepts them for Codex/Claude. A later `--agent codex` run rehydrates the xAI route as OPENAI_API_KEY/OPENAI_BASE_URL and sends the default GPT model to api.x.ai instead of falling back to Codex credentials. Treat persisted xAI routes as incompatible with non-Grok harnesses.

_{Posted by auto-maintain. This automated code review is advisory; a human maintainer makes the call.}

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​earendil-works/​pi-coding-agent@​0.81.1 ⏵ 0.86.1	-1		+1	+2

View full report