Delegate bounded coding tasks to Grok Build and review diffs

Lets an orchestrating agent hand a bounded coding task to the Grok Build CLI (grok) as a separate implementer, then review what it produced and land it itself. Grok's default permission mode is ask, which blocks on approval prompts in a headless pipe, so the relay always sets autonomy explicitly through one of three profiles: the default writes-capable run pairs --always-approve with --sandbox workspace, scoping writes to the working tree (the skill is explicit that --always-approve alone would approve every tool - writes, shell, network - closer to unrestricted than to a scoped write, and it is the --sandbox workspace pairing that keeps the default safe); --read-only sets --sandbox read-only --permission-mode plan for review/diagnosis, but is explicitly best-effort, not a hard guarantee, since the read-only sandbox restricts out-of-workspace filesystem/network access rather than Grok's own edit tool, and a verified read-only run can still have written the working tree if told to; and --full-access (--always-approve --sandbox off) is an explicit human opt-in for a task that genuinely needs unrestricted tools.

Because the read-only guarantee is soft, the relay automates a reporting tripwire instead of relying on the flag alone: it compares parsed git porcelain and fingerprints the working-tree identity and index entries of paths that were already dirty, reporting readOnlyViolation: true when either signal proves a change, false when coverage was complete and found none, and null when coverage was incomplete (ignored paths, submodule internals, perfect restores, and concurrent-change attribution stay outside it) - the diff itself, not the flag, remains the actual guarantee. Dispatch wraps grok -p and writes a structured result.json to a temp directory so the reviewed repo stays clean; the relay never commits. Rework resumes the previous Grok session with a delta brief via --resume-last rather than restating the whole task.

Use it to delegate a bounded coding task to a separate grok implementer and then review its diff yourself, when the user explicitly asked for delegation to this implementer. Do NOT use it when: the task is small enough to just do inline and delegation overhead isn't worth it; the grok CLI is not installed, not authenticated, or the account lacks Grok Build beta access; or you want to write the code yourself, or only need a review without an actual implementer run.

The brief is the entire task as Grok will see it - no orchestrator chat history, no shared context - so it must state the goal, current state, what to change, what to leave untouched, the project's real gate commands (discovered from CLAUDE.md/AGENTS.md/Makefile, never assumed), and a report contract telling Grok it will not commit. Dispatch:

node "<skill-dir>/scripts/relay.mjs" --brief brief.txt --cd /path/to/repo

Output is result.json with status (including grok_unavailable when the binary is missing), finalMessage (Grok's own report), touchedFiles (the review starting point, regardless of the autonomy profile used), and readOnlyViolation on a --read-only dispatch. Before dispatch, confirm which grok is actually on PATH (command -v grok / grok version) - the relay separately records the version it ran into result.json so a stale binary is visible after the fact.

Wraps the Grok Build CLI (npm i -g @xai-official/grok, or xAI's official installer), authenticated via grok login (or grok login --device-auth on a headless host, or an XAI_API_KEY environment variable) - Grok Build beta access requires an eligible xAI subscription. Requires Node 18+ and git, and can apply a fleet lane's dials from a companion delegate-setup configuration.

Orchestrating agents - designed for Claude Code and Cursor specifically, with other orchestrators treated as designed-for but not yet proven - that need to delegate a scoped coding task to Grok Build under an explicit, correctly-scoped autonomy profile while keeping review-and-commit authority. Adapted from the community amElnagdy/delegate-skills repository under the MIT license; this catalog entry is a docs-only import, since the executable scripts/relay.mjs is not bundled here.