grok-implementer: fix two headless-lane footguns (preflight false negative, silent exec cancel)#8
Open
hstrick2000 wants to merge 1 commit into
Open
Conversation
1. Preflight: retry 'grok models' once before STATUS: unavailable — the CLI prints 'You are not authenticated' when the ~6h access token has lapsed even though the same invocation silently refreshes it, so a single failed check is usually a false negative. 2. Invocation: add scoped --allow 'Bash(*)'. The Grok CLI merges the caller's global ~/.claude/settings.json permission rules into its resolver; terminal exec defaults to 'ask', which headlessly cancels silently (exit 0, no diff). --always-approve stays forbidden. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two failure modes hit in production use of the
grok-implementerlane, both costing a full turn each time. Diagnosed 2026-07-16/18 from the Grok CLI's own~/.grok/logs/unified.jsonland--debugoutput; both are now also documented as operator runbook rules in the reporting workspace'sCLAUDE.md.1. Preflight false negative:
grok modelssays "You are not authenticated" while auth is finegrok.com access tokens are short-lived (~6h). When one has lapsed,
grok modelsprints "You are not authenticated" even though that same invocation silently refreshes the token successfully. Caught in the CLI's unified log (grok 0.2.101): the same pid loggedauth.refresh.successat21:49:51.403Zyet printed "not authenticated" at.663Z. An immediate second call succeeds.The preflight as written treats one failed check as fatal, so the lane reports
STATUS: unavailableand the caller falls back to a more expensive lane — precisely the routing this agent exists to avoid.Fix: retry
grok modelsonce; only two consecutive failures mean a real logout.2. Silent no-op: headless runs exit 0 with no files when grok needs a shell command
The Grok CLI merges the caller's global
~/.claude/settings.jsonpermission rules into its own resolver. Under that merge, terminal-command execution defaults to "ask" — and with no human present, an "ask" silently cancels the turn: exit 0, no diff, no error. Any spec step that needs even a trivial shell command (ls) kills the run invisibly. Two invocations were lost to this before--debugsurfaced the cancel.Fix: add a scoped
--allow 'Bash(*)'to the documented invocation. This approves shell execution only —--always-approveremains forbidden, and the wrapper still re-runs verification itself (the stale parenthetical claimingacceptEditsmay have blocked grok's own verification is removed, since it no longer applies).🤖 Generated with Claude Code