
Security News
GPT-6 Astra Attempts Supply Chain Attacks Against Open Source Maintainers in Testing
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.
@ramarivera/pi-grok-build
Advanced tools
Pi coding-agent extension providing a Grok Build provider backed by the local grok CLI.
pi-grok-build/grok-buildgrok models outputpi -ppi --mode json -ppi --mode rpc JSONL stdin/stdout eventsgrok -p ... --output-format streaming-jsongrok agent ... stdiogrok_inspect, grok_models, grok_run, grok_sessions, and grok_memory diagnostic toolsgrok from PATH only. It does not search ~/.grok/bin or any private install path.best-of-n are out of provider scope.~/.grok.npm install @ramarivera/pi-grok-build
Then add to your Pi agent settings:
{
"packages": ["@ramarivera/pi-grok-build"]
}
Make sure the Pi runtime shell can find grok:
grok --version
grok models
If grok is missing or unauthenticated, provider calls fail fast with a Pi-visible stream error.
Default provider mode is ACP through Grok's stdio JSON-RPC surface:
PI_GROK_BUILD_MODE=acp
The older one-shot streaming JSON path remains available as an explicit fallback:
PI_GROK_BUILD_MODE=jsonl
PI_GROK_BUILD_INTEGRATION_MODE is accepted as a compatibility alias, but PI_GROK_BUILD_MODE wins.
See docs/integration-modes.md for the tradeoffs and ACP limitations.
If XAI_API_KEY, GROK_CODE_XAI_API_KEY, or a valid local Grok CLI cached auth token is available, the extension registers xAI Imagine tools:
grok_imagine_imagegrok_imagine_videogrok_imagine_video_statusWithout xAI REST auth, these tools are intentionally not registered so Pi does not advertise a fake media surface.
See docs/media-tools.md for endpoint evidence, shipped behavior, and verification status.
Provider failures are surfaced as Pi stream error events. Structured pino diagnostics are opt-in:
PI_GROK_BUILD_LOG_LEVEL=silent|error|warn|info|debug|trace
PI_GROK_BUILD_DEBUG=1
Prompt-bearing Grok argv fields are redacted before logging. Tests assert behavior and structured outputs, not log text.
See docs/diagnostics.md for the full behavior.
CI-safe deterministic suite:
npm run test:ci
Formatting/lint/typecheck gate:
npm run format:check
npm run lint
npm run check
Manual real Grok/Pi suite on a machine where grok and pi are installed/authenticated:
PATH="$HOME/.grok/bin:$PATH" npm run test:e2e
Opt-in xAI media smoke, which can incur API usage:
PI_GROK_BUILD_RUN_MEDIA_E2E=1 XAI_API_KEY=... npm run test:e2e:grok -- test/e2e/manual/xai-media.e2e.test.ts
See docs/testing.md for suite boundaries.
Do not claim this extension is ready for release just because test:ci passes. Before release, follow docs/release-checklist.md, including real Pi runtime smoke for text and JSON modes and any required live xAI media smoke if media tools are part of the release claim.
FAQs
Pi extension providing Grok Build / Grok CLI integration.
We found that @ramarivera/pi-grok-build demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.

Product
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.

Security News
pnpm 12 rewrites the package manager in Rust, cutting install times by up to 90% while preserving pnpm 11 workflows and lockfiles.