From 1e63f123a1778bede30a48f73228f270dd47b019 Mon Sep 17 00:00:00 2001 From: Kavya Katal Date: Mon, 12 Oct 2026 01:23:15 +0530 Subject: [PATCH] docs(sandbox-lint): declare Grok harness support --- docs/vendor-neutrality.md | 4 ++-- tools/sandbox-lint/README.md | 6 +++--- tools/sandbox-lint/src/sandbox_lint/__init__.py | 6 +++--- tools/sandbox-lint/src/sandbox_lint/posture.py | 2 +- 4 files changed, 9 insertions(+), 9 deletions(-) diff --git a/docs/vendor-neutrality.md b/docs/vendor-neutrality.md index dc878af88..762ae45fb 100644 --- a/docs/vendor-neutrality.md +++ b/docs/vendor-neutrality.md @@ -640,7 +640,7 @@ Organization scope (declared, orthogonal to vendor): ASF = 16, agnostic = 63. | `release-config` | release | any | ✅ agnostic | | `release-verify` | release | any | ✅ agnostic | | `reproducible-archive` | release | any | ✅ agnostic | -| `sandbox-lint` | sandbox | Claude Code, Codex, Cursor, Gemini CLI, Kiro, OpenCode | ✅ portable | +| `sandbox-lint` | sandbox | Claude Code, Codex, Cursor, Gemini CLI, Grok, Kiro, OpenCode | ✅ portable | | `security-tracker-stats-dashboard` | analytics | any | ✅ agnostic | | `setup-preflight` | setup | any | ✅ agnostic | | `skill-and-tool-validator` | framework-dev | any | ✅ agnostic | @@ -662,7 +662,7 @@ Harness → substrate tools it supports: - **Copilot** (1): `agent-guard` - **Cursor** (2): `sandbox-lint`, `spec-loop` - **Gemini CLI** (3): `agent-guard`, `sandbox-lint`, `spec-loop` -- **Grok** (2): `agent-guard`, `spec-loop` +- **Grok** (3): `agent-guard`, `sandbox-lint`, `spec-loop` - **Kiro** (3): `agent-guard`, `sandbox-lint`, `spec-loop` - **OpenCode** (3): `agent-guard`, `sandbox-lint`, `spec-loop` - **any harness** (29): `adversarial-review`, `agent-isolation`, `container-gateway`, `contributor-metrics`, `dashboard-generator`, `dev`, `egress-gateway`, `maven-artifact-verify`, `permission-audit`, `pilot-report-validator`, `pr-management`, `preflight-audit`, `privacy-llm`, `probe-templates`, `release-config`, `release-verify`, `reproducible-archive`, `security-tracker-stats-dashboard`, `setup-preflight`, `skill-and-tool-validator`, `skill-evals`, `skill-reconciler-diff`, `skill-token-count`, `spec-inventory`, `spec-status-index`, `spec-validator`, `symlink-lint`, `vendor-neutrality-score`, `vetted-ops` diff --git a/tools/sandbox-lint/README.md b/tools/sandbox-lint/README.md index f08e1dfd3..91ae1394e 100644 --- a/tools/sandbox-lint/README.md +++ b/tools/sandbox-lint/README.md @@ -23,7 +23,7 @@ **Capability:** substrate:sandbox -**Harness:** Claude Code, Codex, Cursor, Gemini CLI, OpenCode, Kiro +**Harness:** Claude Code, Codex, Cursor, Gemini CLI, OpenCode, Kiro, Grok Lints `.claude/settings.json` against the shipped baseline at `tools/sandbox-lint/expected.json`, and against the security @@ -93,7 +93,7 @@ uv run --project tools/sandbox-lint sandbox-lint --gemini .gemini The ordinary regression suite needs no Gemini or Node installation. Optional [runtime integration tests](tests/integration/README.md) exercise Gemini's policy engine and Linux sandbox without a model. -**Any other harness (Cursor, …).** `--any-harness` +**Harnesses without a dedicated config profile (Cursor, Grok, …).** `--any-harness` validates the harness-neutral OS-level security posture: checks that the two enforcement components shared across all runtimes — `tools/agent-isolation/agent-iso.sh` (layer 0, clean-env credential strip) @@ -181,7 +181,7 @@ baseline drift. ## Harness-neutral posture check (any runtime) For runtimes that do not expose a per-harness sandbox configuration file -(Cursor and any other agent harness not listed under +(Cursor, Grok, and any other agent harness not listed under `--settings`, `--opencode`, `--kiro`, `--codex`, or `--gemini`), the security posture is enforced at the OS level by two harness-agnostic components: diff --git a/tools/sandbox-lint/src/sandbox_lint/__init__.py b/tools/sandbox-lint/src/sandbox_lint/__init__.py index 79273ae2e..79be7c1cf 100644 --- a/tools/sandbox-lint/src/sandbox_lint/__init__.py +++ b/tools/sandbox-lint/src/sandbox_lint/__init__.py @@ -456,7 +456,7 @@ def _lint_any_harness(framework_root: Path | None) -> int: ``tools/agent-isolation/`` (layer 0, clean-env wrapper) and ``tools/agent-guard/`` (layer 3, action guard) — are present in the framework tree. This is the posture check for runtimes that do not have a - dedicated per-harness config mode here (Cursor, …). + dedicated per-harness config mode here (Cursor, Grok, …). """ from sandbox_lint.posture import PostureViolation, check_posture_violations, find_framework_root @@ -474,7 +474,7 @@ def _lint_any_harness(framework_root: Path | None) -> int: return 0 print( f"sandbox-lint: harness-neutral posture violations at {root} —\n" - " For runtimes without a dedicated config mode (Cursor, …)\n" + " For runtimes without a dedicated config mode (Cursor, Grok, …)\n" " the security posture is enforced by these OS-level components:", file=sys.stderr, ) @@ -576,7 +576,7 @@ def main(argv: list[str] | None = None) -> int: metavar="FRAMEWORK_ROOT", help=( "Validate the harness-neutral security posture for runtimes without " - "a dedicated settings file (Cursor, …). " + "a dedicated settings file (Cursor, Grok, …). " "Checks that the OS-level enforcement components (agent-isolation " "layer-0 clean-env wrapper and agent-guard layer-3 action guard) " "are present. Optionally supply the framework root directory; " diff --git a/tools/sandbox-lint/src/sandbox_lint/posture.py b/tools/sandbox-lint/src/sandbox_lint/posture.py index d949c616e..f4c21a230 100644 --- a/tools/sandbox-lint/src/sandbox_lint/posture.py +++ b/tools/sandbox-lint/src/sandbox_lint/posture.py @@ -18,7 +18,7 @@ """Harness-neutral security-posture check for sandbox-lint. For agentic harnesses that do not have a dedicated sandbox configuration file -(Cursor, Gemini CLI, and others), the security posture comes from +(Cursor, Grok, and others), the security posture comes from OS-level enforcement components shared across all harnesses. This module validates that those components are present in the framework tree so the security posture holds regardless of which harness drives the session.