Grok Bot 0.18 Reconstructed Documentation

Pages

1. OverviewWhat this reconstruction exposes, who can run it, the hybrid runtime split, and the first docs routes after clone.
2. InstallationmacOS Apple Silicon prerequisites, Node 26.5.x, Git LFS, Xcode tools, optional Docker, and npm ci.
3. QuickstartClone, LFS pull, bootstrap, check, package, and open dist/Grok Bot 0.18 Reconstructed.app with the expected success signal.
4. Reconstruction boundaryCompiled source/ runtimes, checksum-pinned shipped renderer, reconstructed bundle id com.anysphere.sand.reconstructed, and ignored src/app/dist hydration.
5. Inference routerSandInferenceProvider ids cursor, claude-code, codex, openrouter; default cursor; local transcript store schemaVersion 2; usage schemaVersion 1.
6. Box runtimeSandBoxRuntime remote versus local-docker, default remote, coordinator restart on switch, and loopback-only local gateway ownership.
7. Evidence and provenancePinned 0.18.0 DMG and app.asar SHA-256 identities, evidence-only UI rule, and production bindings that must resolve into source/.
8. Choose an inference providerSet Settings → Router, persist inferenceProvider, and satisfy Cursor session, Claude Code login, Codex auth.json, or OPENROUTER_API_KEY.
9. Enable the local Docker sandboxToggle Use local Docker VM, start grok-bot-local-vm, wait for http://127.0.0.1:1340/health, and roll back to remote on start failure.
10. Route Grok Bot plugin toolslistRoutedMcpTools and executeRoutedMcpTool across Claude Code MCP bridge versus Codex/OpenRouter direct tool execution.
11. Bootstrap the pinned runtimenpm run bootstrap order: GROK_BOT_018_APP, cached app, LFS DMG, then public URL; verify DMG and app.asar SHA-256; hydrate src/app/dist.
12. Package the macOS appnpm run package compiles runtimes, patches Settings Router, replaces app.asar, sets reconstructed identity, ad-hoc signs, and verifies.
13. Work on the frontend reconstructionfrontend/ is a Vite design workspace; packaged UI stays the patched shipped renderer unless GROK_BOT_RENDERER_SOURCE overrides it.
14. npm scriptsExact package.json commands: bootstrap, check, package, verify, smoke, publication:check, frontend:build, and test globs.
15. Settings schemasettings.json version 1 fields: inferenceProvider, inferenceRouterUsage, boxRuntime, MCP instruction maps, and atomic persist path.
16. Environment variablesGROK_BOT_018_APP, GROK_BOT_OUTPUT_APP_NAME, SAND_DISABLE_*, OPENROUTER_API_KEY, SAND_OPENROUTER_MODEL, CODEX_HOME, CLAUDE_CODE_PATH, and binding-manifest overrides.
17. Desktop RPCwindow.desktop.agent getInferenceRouter, setInferenceRouter, getBoxRuntime, setBoxRuntime, and secrets upsert/list channels.
18. Local Docker connectorImage, container name, owner label, schema version 6, loopback gateway URL, health probe, and content-addressed host-main.cjs mounts.
19. Provider clientsCursor default path, Claude Agent SDK query, Codex Responses at chatgpt.com/backend-api/codex/responses, OpenRouter OpenAI-compatible model default openai/gpt-5.2.
20. Bootstrap failuresLFS pointer-sized archives, DMG checksum mismatch, missing app.asar files, GROK_BOT_018_APP version mismatch, and hydration checksum errors.
21. Packaging failuresNon-darwin package abort, missing renderer patch anchors, ad-hoc codesign retry, xattr quarantine, and verify required ASAR entries.
22. Router and sandbox failuresUnknown provider, Codex private auth.json, Claude Code not installed, missing OPENROUTER_API_KEY, and unowned grok-bot-local-vm container.
23. Verify and smokenpm run verify required ASAR paths and evidence markers; npm run smoke native e2e with 12s timeout; updater guard SAND_DISABLE_* defaults.
24. Preserve original installersGit LFS 0.18.0 macOS DMG and Windows setup.exe identities, artifacts.json schemaVersion 1, and shasum -c SHA256SUMS.
25. Publication exportnpm run publication:check archive/init/add tree equality, LFS push of installers, and NOTICE/rights review before a public remote.
26. ContributingRequired check and package commands, no generated payloads in Git, do not weaken checksum or signing gates, private security reports.