Add grok as a guest agent by alisaifee · Pull Request #473 · trailofbits/coop

alisaifee · 2026-09-11T15:43:33Z

Problem

coop can launch Claude Code and Codex in the guest. Grok Build has to be
installed and configured by hand.

Description

coop grok launches Grok Build in the guest. coop setup installs it from
https://x.ai/cli/install.sh as the guest user. The image ships home skel
files as root, so setup chown -Rs the guest home first. The launcher
SSHes in with --always-approve, --trust, and --cwd /workspace.
--ask adds --permission-mode default. login and logout keep
--trust and --cwd /workspace.

Changes

Golden image: official installer, ~/.grok/bin on PATH,
/usr/local/bin/grok, grok-yolo. The guest installers share one
shell; Grok deletes its temp installer after it runs.
[grok]: api_key, env_forward, config_dir, marketplaces,
plugins, Model Context Protocol servers.
Bootstrap: XAI_API_KEY goes in over SSH SendEnv. Allowlisted host
files overlay into ~/.grok. Restart overwrites files still present
on the host; guest-only files and config_dir = false keep prior
copies. Directory symlinks, hidden directories, and bare git repos
stay on the host. Host config.toml is merged except [plugins];
guest [plugins] is kept. /workspace is recorded in
trusted_folders.toml. A copied auth.json is mode 0600.
Configured plugins install on first boot.
coop agent update --grok runs grok update. The guest user can run
grok update directly. --check prints Claude Code, Codex, and
Grok Build.
Lima: growing an instance disk updates lima.yaml disk: and
restores the original yaml if the grow fails.
Docs: docs/grok-integration.md, commands, getting started, trust
model, changelog. --no-agents names Grok Build.
Integration: binary, symlink, PATH, grok-yolo, settings merge after
restart, --check names all three. The suite sets
[grok] config_dir = false. The merge phase points config_dir at a
fixture directory.

Existing images: coop setup --rebuild. Existing VMs:
coop restore <vm> --image <image> --reprovision (or destroy and
recreate).

Validation

Lima guest suite
Firecracker guest suite

CLAassistant · 2026-09-11T15:43:42Z

All committers have signed the CLA.

Add the official installer, put grok and agent on the guest PATH, and require the binary in the golden image. Marketplace baking comes later.

Parse api_key, env_forward, config_dir, marketplaces, plugins, and Model Context Protocol servers the same way [claude] and [codex] work.

Add coop grok, forward XAI_API_KEY, and copy host allowlisted files without following directory symlinks. Write managed settings and folder trust, drop the host [plugins] table, set a copied auth.json to 0600, and install configured plugins. coop agent update --grok runs grok update.

Add the integration guide and update the command, config, trust-model, and getting-started docs so the third agent is listed with Claude and Codex.

A developer ~/.grok/skills can hold gigabytes of git lore and venvs. Copying that into every VM start filled the Lima disk and left read-only packs that a second scp could not overwrite. The restart remove quoted ~ so it never expanded. Skip hidden and bare-git directories, leave ~/ unquoted in the guest remove, and isolate the integration suite from host ~/.grok.

Growing a disk with truncate left lima.yaml at the old size, so the next start looked like a shrink and Lima refused to boot. Update disk: with the grow, and revert the yaml if truncate fails.

hbrodin · 2026-09-14T05:52:48Z

+            // A previous boot may have copied read-only files. scp cannot
+            // overwrite those; replace the dest directory first.
+            if let Some(name) = path.file_name().and_then(|n| n.to_str()) {
+                target.exec(remove_guest_staged_dir(guest_subdir, name))?;


Please preserve guest-only files when refreshing these directories. This shared helper also copies Claude rules/ and commands/ and Codex prompts/. If the host supplies one of those directories, restarting now deletes files created only in the guest; the previous recursive copy was additive. Removing the directory before transfer also leaves it missing or partially restored if SCP fails. Could the read-only-file handling preserve existing entries and avoid deleting the destination before a successful transfer?

hbrodin · 2026-09-14T05:52:49Z

+        toml::Value::String("always-approve".to_string()),
+    );
+
+    if root.remove("plugins").is_some() {


This removes guest plugin activation as well as imported host settings. bootstrap_grok calls this merge on every boot, even with config_dir = false, but installs plugins only on first boot and only for the delta missing from the image. In the inspected upstream implementation, installation writes [plugins].enabled, and discovery disables user/marketplace plugins absent from that list. Consequently, this loses activation on restart, or on first boot for Lima-baked plugins. Please preserve guest plugin state separately from the host table being imported. The upstream behavior is visible in installation/config handling and discovery; I did not verify an installed Grok artifact against that source revision.

hbrodin · 2026-09-14T05:52:50Z

+    let disk_value = format!("\"{}GiB\"", new_size.as_u32());
+    let edited = set_yaml_scalar(&original, "disk", &disk_value)
+        .with_context(|| format!("No top-level 'disk' key in {}", yaml_path.display()))?;
+    crate::fs_util::atomic_write_with_mode(&yaml_path, &edited, 0o644)?;


Please restore the original YAML when truncate cannot be spawned, too. This write happens before .status().context(...) ?, which returns immediately if the executable is missing or cannot run. The restoration below only handles a successfully spawned process returning a nonzero status, so a spawn failure reports an unsuccessful resize while leaving the enlarged disk setting persisted. Both failure paths should restore the original configuration.

hbrodin · 2026-09-14T05:52:51Z

+    if coop_exec /home/ubuntu/.grok/bin/grok --version >/dev/null; then
+        pass "grok binary invocable via full path"
+    else
+        skip "grok --version" "binary exists but --version returned non-zero"


Please fail this check when an installed Grok executable cannot report its version. Provisioning already checks test -x, but that does not establish that the loader/runtime works. Skipping a failed --version allows an executable but unusable installation to pass this phase. The earlier missing-binary skip can remain for deliberately supported older images; this branch should distinguish an installed binary that fails to run.

hbrodin · 2026-09-14T05:52:52Z

+        if curl -fsSL -o "$INSTALLER" https://x.ai/cli/install.sh 2>/tmp/grok-curl-err; then
+            break
+        fi
+        CURL_EXIT=$?


$? here is the status of the completed if, not the failed curl. An if with a false condition and no else returns zero, so these retry and final-error messages always report curl exit code 0. Please capture the failure status inside an else branch. An isolated Bash reproduction with a child exiting 22 returned 0 after the if, versus 22 inside else.

hbrodin · 2026-09-14T05:52:53Z

Thanks for contributing Grok Build support! The main changes I'd like to see are preserving guest-created config files and Grok plugin activation across restarts, restoring Lima's configuration on every resize failure path, failing the version check when an installed Grok binary cannot run, and reporting curl's actual failure status. I've left the details inline.

alisaifee added 6 commits September 11, 2026 08:46

Install Grok Build in the guest image

41fe589

Add the official installer, put grok and agent on the guest PATH, and require the binary in the golden image. Marketplace baking comes later.

Add [grok] configuration

f0ff654

Parse api_key, env_forward, config_dir, marketplaces, plugins, and Model Context Protocol servers the same way [claude] and [codex] work.

Document Grok Build as a guest agent

cd74b0f

Add the integration guide and update the command, config, trust-model, and getting-started docs so the third agent is listed with Claude and Codex.

Keep Lima disk yaml in sync on resize

02d2463

Growing a disk with truncate left lima.yaml at the old size, so the next start looked like a shrink and Lima refused to boot. Update disk: with the grow, and revert the yaml if truncate fails.

alisaifee force-pushed the main branch from ef42c19 to 02d2463 Compare September 11, 2026 15:46

alisaifee marked this pull request as ready for review September 11, 2026 15:52

hbrodin reviewed Sep 14, 2026

View reviewed changes

hbrodin mentioned this pull request Sep 14, 2026

Run Linux image provisioning inside a Firecracker builder VM #474

Open

Navigation Menu

Add grok as a guest agent - #473

Add grok as a guest agent#473
alisaifee wants to merge 6 commits into
trailofbits:mainfrom
alisaifee:main

alisaifee commented Sep 11, 2026 •

edited

Loading

Uh oh!

CLAassistant commented Sep 11, 2026 •

edited

Loading

Uh oh!

hbrodin Sep 14, 2026

Uh oh!

hbrodin Sep 14, 2026

Uh oh!

hbrodin Sep 14, 2026

Uh oh!

hbrodin Sep 14, 2026

Uh oh!

hbrodin Sep 14, 2026

Uh oh!

hbrodin commented Sep 14, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

alisaifee commented Sep 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Description

Changes

Validation

Uh oh!

CLAassistant commented Sep 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

hbrodin Sep 14, 2026

Choose a reason for hiding this comment

Uh oh!

hbrodin Sep 14, 2026

Choose a reason for hiding this comment

Uh oh!

hbrodin Sep 14, 2026

Choose a reason for hiding this comment

Uh oh!

hbrodin Sep 14, 2026

Choose a reason for hiding this comment

Uh oh!

hbrodin Sep 14, 2026

Choose a reason for hiding this comment

Uh oh!

hbrodin commented Sep 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

alisaifee commented Sep 11, 2026 •

edited

Loading

CLAassistant commented Sep 11, 2026 •

edited

Loading

hbrodin commented Sep 14, 2026 •

edited

Loading