fix(provider-grok): Grok health checks no longer start Grok's updater

[bompus]

Problem

T3 checks each Grok instance's health in the background: grok --version, grok models, grok inspect --json (skills) and an ACP initialize. Grok checks for a newer CLI every time it launches, so those probes could start Grok's npm updater with nobody watching. On Windows that showed up as a blank console window (Grok -> npm -> vp) while T3 was idle.

Change

Grok documents GROK_DISABLE_AUTOUPDATER=1 as process-scoped update suppression. Every health probe now runs Grok with that variable set on a copy of the caller's environment, via one helper in packages/provider-grok/src/server/probeEnvironment.ts:

• checkGrokProviderStatus uses it for --version, models and the ACP initialize probe.
• discoverGrokSkills applies it itself, so the per-workspace skill probe the driver runs for each project (snapshotForCwd) is covered too. The original version of this PR missed that path.

Sessions, commit/title text generation and grok update keep the caller's environment unchanged, so normal use and manual updates still update as configured. Auth detection still reads the caller's environment.

Scope and approval

A focused fix for an unwanted side effect of an existing health check. Related: #2537 and the closed #14442. Replaces #16879, which was closed only for a missing model/harness line.

Verification

• apps/server/src/provider/GrokProvider.test.ts: the fake Grok CLI records an update attempt whenever it runs without the flag, and the caller passes GROK_DISABLE_AUTOUPDATER=0. The probe records none, leaves the caller's environment object unchanged, and still reports ready status, auth and models. It fails without the change. 33 passed.
• packages/provider-grok/src/server/skills.test.ts: the direct workspace skill probe spawns with the flag set and the caller's other variables intact. 6 passed.
• vp run typecheck in packages/provider-grok and apps/server, targeted lint and format: clean.
• Two independent review rounds (Claude Opus 5.5 and GPT-6.1 Sol) found no remaining issues.
• Not reproduced on Windows here. The flag and its semantics come from Grok's own docs (~/.grok/docs/user-guide/14-headless-mode.md, "Update Check Suppression") and are present in the installed Grok 1.0.52 binary.

Original work by @bompus, taken over and finished by maintainers.

Claude Opus 5.5 and Claude Fable 5.1 in Claude Code, with review by GPT-6.1 Sol in Codex.

🤖 Generated with Claude Code

[macroscopeapp]

Approvability

Verdict: Approved at d4ffcd9

Macroscope's review found this PR approvable — This is a narrowly scoped, tested bug fix that disables Grok’s unintended startup updater only during health checks while preserving caller environments and normal session/update behavior. It does not change product settings, schemas, deployment, or static-analysis configuration.

^{You can add or adjust custom eligibility rules. Learn more.}

[coderabbitai]

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

⚙️ Run configuration

• Configuration used: Path: .coderabbit.config.ts
• Review profile: CHILL
• Plan: Advanced
• Run ID: 35e86850-229a-4073-af97-3b45ae949c91

📥 Commits

Reviewing files that changed from the base of the PR and between e73ebc7 and 8570d6d.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Path: .coderabbit.config.ts
• Review profile: CHILL
• Plan: Advanced
• Run ID: a12ceeec-e998-4b05-af2e-c99f44818dd1

📥 Commits

Reviewing files that changed from the base of the PR and between 289f3ae and e73ebc7.

📒 Files selected for processing: 4

• packages/provider-grok/src/server/probeEnvironment.ts
• packages/provider-grok/src/server/skills.test.ts
• packages/provider-grok/src/server/skills.ts
• packages/provider-grok/src/server/status.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

📝 Walkthrough

The Grok status and skill probes now disable the auto-updater in a copy of the supplied environment. Tests check that the probes do not change the supplied environment or run the updater during readiness checks.

Changes: Grok probes

Layer / File(s)	Summary
Create probe environment packages/provider-grok/src/server/probeEnvironment.ts	Adds grokProbeEnvironment, which copies the supplied environment and sets GROK_DISABLE_AUTOUPDATER to "1".
Apply probe environment packages/provider-grok/src/server/status.ts, packages/provider-grok/src/server/skills.ts, packages/provider-grok/src/server/skills.test.ts, apps/server/src/provider/GrokProvider.test.ts	Status and skill probes use the copied environment for Grok commands and ACP initialization. Tests check that other environment values are preserved, the caller’s environment remains unchanged, and readiness probing does not attempt an update.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested reviewers: juliusmarminge

Merge Risk: ⚪ Minimal · up to e73eb

Grok health and skill probes suppress automatic updates without changing the environment used by normal sessions or manual updates. No merge-blocking risk remains, so the change is ready to merge.

Security architecture risk: ⚪ Minimal · up to e73eb

The change confines update suppression to background probes without changing executable selection, credentials, permissions, or the caller’s environment. No material security risk was found to be introduced or worsened.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The changed behavior is bounded to Grok probe subprocesses and their inherited environment. Configured binary paths, PATH-based selection, workspace cwd, and existing credentials remain inputs as before; the PR adds no execution principal, network endpoint, secret destination, or permission grant.

Trust Boundaries and Controls

• inferred — The new flag is a cooperative CLI behavior control, not a sandbox or authorization boundary. Existing configured executables still receive the caller’s environment. The change does not increase their authority; it asks probe launches to avoid the updater side effect.

Resilience and Maintainability Implications

• observed — Probe failures remain bounded by existing timeout and scoped execution paths. Skill discovery retains typed spawn, timeout, exit, and decoding failures; status checking retains degraded metadata fallbacks. The override adds no shared mutable environment state requiring cleanup or recovery.

Pre-merge checks: 3 · 1

Failed checks: 1 inconclusive

Check name	Status	Explanation	Resolution
Linked Issues check		The description references related issues and explains why this is a focused obvious-bug fix, but explicit maintainer approval remains unresolved.	Obtain and record explicit maintainer approval for the scope, or confirm that the repository policy exemption for a focused obvious-bug fix applies.

Passed checks: 3 passed

Check name	Status	Explanation
Description check		The description includes all required sections and clearly explains the problem, implementation, scope, approval rationale, focused verification, and known testing limitations.
Out of Scope Changes check		The changes are limited to Grok health-probe environments, related tests, and the shared helper. Normal sessions, authentication detection, and manual updates remain unchanged.
Title check		The title clearly and concisely describes the main change: Grok health checks no longer start the Grok updater.

✨ Finishing Touches: 💡 1

🧪 Generate unit tests (beta)

• Create a new PR

🛠️ Fix failing CI checks: 💡

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[juliusmarminge]

Note

This comment is posted by Julius' dot

The focused tests show health probes suppressing startup updates while normal sessions retain them. The PR and #16879 still leave approval of that behavior unresolved. Can a maintainer confirm whether health checks should always disable Grok's updater under the scope policy? Leaving this open for that decision.

[bompus]

On the approval question: I think this fits the "very small, focused fix for an obvious bug" exception. The change makes the status probe stop starting the CLI's npm updater. It doesn't change the defaults for normal sessions or manual updates.

The evidence is the Windows process chain captured earlier (Grok -> npm -> vp, Grok 1.0.46), which matches the brief blank console popup in #2537. One limit: in an isolated run I could not reproduce the updater launch on the baseline, so the case rests on that earlier capture. A maintainer can confirm whether health checks should always disable the updater.

If you'd rather treat this as a behavior change, say so and I'll move it to an Ideas discussion.

[juliusmarminge]

Note

Claude Opus 5.5 responding on behalf of Julius.

Taking over this one. I will push follow-up commits to this branch on top of yours and merge main in rather than rebasing.