# grok-bot-bin

Unofficial Arch / CachyOS package of the official [Grok Bot](https://cursor.com/download/bot) `.deb`. Temporary until upstream packages for Arch.

Not affiliated with Cursor / SpaceXAI. The app binary is unchanged; this only repacks it for `pacman`.

## Install (build locally)

This tree packages **0.39.0** (`pkgver` / `pkgrel=2` in `PKGBUILD`). `makepkg -si` from git tip builds that version even before a release tag exists.

```bash
git clone https://git.s1d3sw1ped.com/s1d3sw1ped/grok-bot-bin.git
cd grok-bot-bin
makepkg -si
```

With an AUR helper against this git URL:

```bash
paru -S grok-bot-bin --aururl https://git.s1d3sw1ped.com
# or:
yay -S grok-bot-bin  # after cloning locally / using a custom AUR mirror
```

Simplest reliable path on CachyOS today:

```bash
makepkg -si
```

## Install from a release package

`pacman -U` installs whatever `.pkg.tar.zst` is attached on [Releases](https://git.s1d3sw1ped.com/s1d3sw1ped/grok-bot-bin/releases), which lags git tip until the bump is tagged (see Updating). After `v0.39.0` is tagged, CI (`build.yml`) attaches `grok-bot-bin-0.39.0-1-x86_64.pkg.tar.zst`. Until a new tag's asset exists, use `makepkg -si` for git-tip `pkgver`.

```bash
curl -LO 'https://git.s1d3sw1ped.com/s1d3sw1ped/grok-bot-bin/releases/download/v0.39.0/grok-bot-bin-0.39.0-1-x86_64.pkg.tar.zst'
sudo pacman -U grok-bot-bin-0.39.0-1-x86_64.pkg.tar.zst
```

Download first, then `pacman -U` the local file (`LocalFileSigLevel = Optional`). Do not pass the remote URL straight to pacman if signatures are required.

## Custom pacman repo (optional)

After CI publishes a repo database under Releases (or Packages), add to `/etc/pacman.conf`:

```ini
[grok-bot]
SigLevel = Optional TrustAll
Server = https://git.s1d3sw1ped.com/s1d3sw1ped/grok-bot-bin/releases/latest/download
```

Exact `Server=` URL may change once the first repo DB lands; `makepkg -si` works regardless.

## Updating

Stay-current path when Cursor's linux-x64 Grok Bot feed moves. `PKGBUILD` is currently **0.39.0** (pkgrel 2). One updater: `./scripts/update.sh`.

### Scheduled bump (Gitea Actions)

`.gitea/workflows/update.yml` runs daily (`cron: '17 6 * * *'`) and on `workflow_dispatch`. It:

1. Runs `./scripts/update.sh` against the live Cursor linux-x64 feed.
2. If `pkgver` changed, commits `PKGBUILD` and `.SRCINFO` as eva.
3. Pushes branch `chore/bump-$pkgver` (force-with-lease if that version is re-run). It does **not** push `master` or create a tag.
4. Opens a PR into `master` via the Gitea API (or reuses an open PR from that head). Title: `pkgbuild: Bump grok-bot-bin to $pkgver`.

`master` and tags stay protected; the bump job must not push those refs. A no-op is only “already at this `pkgver`” (exit 0). Branch push or PR create/reuse failures fail the job.

After that PR merges, `.gitea/workflows/tag-release.yml` (push to `master`, or `workflow_dispatch`) reads `pkgver` from `PKGBUILD`. If tag `v$pkgver` is missing, it creates and pushes it for the master commit; if the tag already exists, it is a no-op. Pushing only that tag does not re-run the PKGBUILD bump.

The tag triggers `.gitea/workflows/build.yml`, which builds the Arch package and attaches `grok-bot-bin-$pkgver-$pkgrel-x86_64.pkg.tar.zst` to the Gitea release. An upstream bump resets `pkgrel` to 1, so 0.39.0 → tag `v0.39.0`.

If the script cannot parse the feed, the `.deb` download fails, or `curl` / `python3` / `sha256sum` is missing, the job fails (it is not a silent “up to date”). `jq` is optional; without it the script parses the feed with `python3`. The workflow still `apt-get install`s `jq` for the run.

Scheduled jobs run on the default branch (`master`). Bump PRs target `master` so merge can tag. Product PRs still land on `develop` (see CONTRIBUTING).

### Manual force path

When you do not want to wait for cron:

```bash
# requires curl, python3, sha256sum; jq optional
./scripts/update.sh
```

If the feed is newer, that rewrites `PKGBUILD` and `.SRCINFO`. Commit and open a PR into `master` (same as the scheduled job); after merge, `tag-release.yml` creates `v<pkgver>`. Or tag yourself after merge:

```bash
git add PKGBUILD .SRCINFO
git commit -m "pkgbuild: Bump grok-bot-bin to <pkgver>"
git push origin "HEAD:chore/bump-<pkgver>"  # then open a PR into master
# After merge, tag-release.yml creates v<pkgver>. To tag yourself:
git tag "v<pkgver>"            # e.g. v0.39.0
git push origin "v<pkgver>"
makepkg -si                    # install from this tree without waiting for the release asset
```

Install the new version with `makepkg -si`, or (once CI publishes the asset) `pacman -U` from Releases as in the example above.

## Notes

- `/usr/bin/grok-bot` (and `sand`) is a launch shim: unless `GROK_BOT_NO_UPDATE=1`, it checks the latest Gitea release and may `pacman -U` a newer `.pkg.tar.zst` before exec'ing `/opt/Grok Bot/…`. Network/API failures still launch the installed binary.
- Auto-update privilege order: `sudo -n` (passwordless, e.g. lab NOPASSWD) → `pkexec` / polkit when launched from the desktop (no TTY, `DISPLAY` or `WAYLAND_DISPLAY` set) → interactive `sudo` when stdin is a TTY. Cancel or deny still launches the installed binary. Passwordless sudo is **not** the default.
- Desktop / CachyOS: `polkit` (provides `pkexec`) and a session polkit authentication agent (usually already running with KDE / GNOME / Hyprland / etc.) are required for the graphical password prompt. The package installs `/usr/lib/grok-bot-bin/pkexec-pacman-u` and `com.s1d3sw1ped.grok-bot-bin.update` (`auth_admin`, not NOPASSWD). `polkit` is an optdepend.
- If the app menu still launches an old binary without updating, run `/usr/bin/grok-bot` once from a terminal, or `sudo pacman -U` the newer `.pkg.tar.zst` from Releases — the menu must call the PATH shim, not `/opt/Grok Bot/…`.
- Upstream Linux builds still have no in-app updater for the Electron app itself; `scripts/update.sh` (cron or manual) is the packaging bump from Cursor's feed.
- `chrome-sandbox` is left non-setuid because the install path contains a space; user namespaces cover sandboxing on CachyOS.