Delegate bounded coding tasks to Grok Build and review diffs

Grok Delegate hands a bounded coding task to the Grok Build CLI (grok) as a separate implementer working under an explicit autonomy profile, while you stay the orchestrator writing the brief and reviewing the diff. Grok's default permission mode is ask, which blocks on approval prompts in a headless pipe, so the relay always sets autonomy explicitly through three profiles: the default passes --always-approve --sandbox workspace for normal implementation scoped to the working tree; --read-only passes --sandbox read-only --permission-mode plan for review and diagnosis; --full-access passes --always-approve --sandbox off as an explicit opt-in for unrestricted tools. --read-only is best-effort, not a hard guarantee - the sandbox restricts out-of-workspace filesystem/network access, not Grok's own edit tool, and a run verified here still wrote the working tree when told to. The relay automates a reporting tripwire that compares parsed git porcelain and fingerprints working-tree identity and index entries of already-dirty Git-visible paths: readOnlyViolation is true when a signal proves a change, false when coverage is complete and detects none, and null when coverage is incomplete - ignored paths, submodule internals, and perfect restores stay outside it, so the diff review remains the real guarantee.

Use it to delegate a bounded coding task you want implemented and then review yourself, or when the user explicitly asks for delegation to Grok. Do not use it when the task is small enough to do inline, when the grok CLI is not installed, not authenticated, or the account lacks Grok Build beta access, or when you only want a review without an implementer run.

Input is a self-contained brief - Grok sees only the text sent, no orchestrator chat history - with the goal, current state, what to change, what to leave untouched, the project's actual gate commands (discovered from CLAUDE.md/AGENTS.md/Makefile, not assumed), and a report contract telling Grok it will not commit; one task per brief. Prerequisites checked once: grok version succeeds (install via npm i -g @xai-official/grok or xAI's installer, authenticate with grok login, grok login --device-auth on headless hosts, or an XAI_API_KEY), and command -v grok confirms which binary is active - the relay records the version it ran into result.json. Output is a result.json with the implementer's finalMessage, touchedFiles, and status (a missing grok binary exits 127 and writes status: "grok_unavailable"; a pre-run usage error exits 2 with no result file).

Wraps grok -p through a scripts/relay.mjs helper that writes its own artifacts to a temp dir so the reviewed repo stays clean; that executable script is not bundled here - see the upstream project for the runtime. Designed for and proven on Claude Code and Cursor; other orchestrators that can run a shell command and read a file are treated as designed-for, not yet proven. A prior session resumes with --resume-last (delta brief only), and --timeout caps a run (off by default; implementation runs routinely need 1-2h). Adapted from amElnagdy/delegate-skills (MIT).

Anyone orchestrating with Claude Code, Cursor, or a comparable agent that can run a shell command and read a file, who wants to hand a bounded coding task to Grok Build as implementer, verify its diff and re-run the project's own gates rather than trusting Grok's self-report, and land the reviewed result themselves - surfacing Grok's own design decisions rather than absorbing them, and stopping to ask before a run expands past the brief.