Be honest about which install commands I could not verify

I have no grok CLI on this machine, so `grok plugin marketplace add` is taken from
the docs rather than run. Say so, point at the TUI's Marketplace tab as the route
that does not depend on a subcommand name, and note that the plain clone into
~/.grok/plugins/ needs none of it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.gitignore

@@ -1,4 +1,3 @@
 node_modules/
-dist/
 *.log
 .DS_Store

.grok-plugin/marketplace.json

@@ -0,0 +1,22 @@
+{
+  "name": "grok-glance",
+  "description": "One-entry marketplace: this repo is both the catalog and the plugin, so `grok plugin marketplace add <git-url>` is enough to install it.",
+  "owner": {
+    "name": "grok-glance"
+  },
+  "plugins": [
+    {
+      "name": "grok-glance",
+      "description": "A passkey-guarded web dashboard that lets you glance at what Grok Build is doing from your phone, and approve or deny risky tool calls remotely.",
+      "category": "monitoring",
+      "keywords": [
+        "grok-glance",
+        "glance dashboard",
+        "webauthn passkey",
+        "remote approval",
+        "session monitor"
+      ],
+      "source": { "type": "local", "path": "./" }
+    }
+  ]
+}

README.md

@@ -37,49 +37,69 @@ or drive a session.
 
 ## Requirements
 
-- Node.js 20 or newer, and npm.
+- Node.js 20 or newer. **npm is only needed to develop it** — `dist/` is committed, and the
+  daemon bundle carries its one runtime dependency inside it, so an installed copy never runs
+  a build or an install step.
 - Grok Build.
 - For phone access: [Tailscale](https://tailscale.com/) on both the machine and the phone. See
   [Why Tailscale](#why-tailscale-and-not-just-the-lan-ip) — a LAN IP genuinely cannot work.
 
 ## Install
 
+Grok Build loads plugins straight out of `~/.grok/plugins/`, so the shortest install is a clone:
+
 ```sh
-git clone <this repo> grok-glance
-cd grok-glance
-npm install && npm run build
+git clone <this repo> ~/.grok/plugins/grok-glance
 ```
 
-The build produces `dist/server` (the daemon) and `dist/web` (the dashboard). Both are required;
-the daemon serves the dashboard itself. `hooks/hooks.json` is checked in as-is — nothing about it
-is generated or machine-specific. The shared secret the hook scripts authenticate with lives in
-`~/.grok/glance/hook.secret` (mode 0600) and is created by the daemon on first start; it never
-appears in `hooks.json`.
+That is the whole thing — no `npm install`, no build. Open `/plugins` in Grok Build and enable
+**grok-glance**. On the next session start its `SessionStart` hook boots the daemon in the
+background, and the dashboard is on `http://127.0.0.1:8791`.
 
-Then register the directory with Grok Build. Plugins are installed from a marketplace catalog, so
-for a local checkout the shortest path is a one-entry catalog. Create
-`.grok-plugin/marketplace.json` in a directory that contains your checkout:
+### …or from a marketplace, by URL
 
-```json
-{
-  "name": "local",
-  "description": "Local plugins",
-  "owner": { "name": "me" },
-  "plugins": [
-    {
-      "name": "grok-glance",
-      "description": "Passkey-guarded phone dashboard for Grok Build.",
-      "category": "monitoring",
-      "source": { "type": "local", "path": "./grok-glance" }
-    }
-  ]
-}
+If you would rather install it the way marketplace plugins are installed — or point several
+machines at one URL — this repo is also its own one-entry marketplace:
+`.grok-plugin/marketplace.json` lists exactly one plugin, sourced from `./`, which is the repo
+root the catalog itself lives in. So the repo's git URL is a complete marketplace, with no commit
+SHA to pin (a self-referencing remote source would have to pin the SHA of the commit that contains
+the pin).
+
+Add it as a marketplace source from the TUI — `/plugins`, Marketplace tab — or from the CLI:
+
+```sh
+grok plugin marketplace add https://your-git-host/you/grok-glance.git
+grok plugin install grok-glance --trust
 ```
 
-…then add that marketplace and install `grok-glance` from Grok Build's `/plugin` interface.
+Configured sources are recorded in `~/.grok/config.toml` under `[[marketplace.sources]]` and in
+`~/.grok/plugins/known_marketplaces.json`; the TUI and `grok plugin marketplace list` read the same
+list. Check `grok plugin marketplace --help` if the subcommand names have moved — the clone above
+does not depend on any of this.
 
-Once installed, the daemon starts by itself: the `SessionStart` hook boots it in the background on
-the first session after installation.
+### Why there is no build step
+
+`dist/` is checked in:
+
+- `dist/server/index.js` — the daemon, bundled to a single dependency-free ESM file. Its only
+  runtime dependency, `@simplewebauthn/server`, is inlined; everything else it uses is the Node
+  standard library. It is *not* minified, so what ships is what you can read.
+- `dist/web/` — the dashboard, already a static bundle, which the daemon serves itself.
+
+The hook scripts under `bin/` were stdlib-only from the start. So a clone has nothing to resolve
+and nothing to compile, which is what makes a bare git URL enough.
+
+Working on it instead? Then you do need the toolchain:
+
+```sh
+npm install
+npm run build        # tsc typechecks, rolldown bundles the server, vite builds the web app
+npm run check:dist   # rebuilds and fails if the committed dist/ is stale
+```
+
+`hooks/hooks.json` is checked in as-is — nothing about it is generated or machine-specific. The
+shared secret the hook scripts authenticate with lives in `~/.grok/glance/hook.secret` (mode 0600)
+and is created by the daemon on first start; it never appears in `hooks.json`.
 
 ## Get it onto your phone
 

bin/glance

@@ -77,7 +77,11 @@ function sessionBreakdown(states) {
 
 function requireBuild() {
   if (!fs.existsSync(SERVER_ENTRY)) {
-    console.error(`grok-glance is not built yet.\n\n  cd ${PLUGIN_ROOT}\n  npm install && npm run build\n`);
+    console.error(
+      `grok-glance: ${SERVER_ENTRY} is missing.\n\n` +
+        `dist/ ships with the plugin, so this checkout is incomplete. Rebuild it:\n\n` +
+        `  cd ${PLUGIN_ROOT}\n  npm install && npm run build\n`,
+    );
     process.exit(1);
   }
 }

bin/glance-up.mjs

@@ -28,9 +28,10 @@ async function ensureDaemon(cfg) {
   if (await isDaemonUp(cfg)) return true;
 
   if (!fs.existsSync(SERVER_ENTRY)) {
-    // Not built yet. Say so once, on stderr, where it is recorded but harmless.
+    // dist/ ships with the plugin, so this means an incomplete checkout. Say so once, on
+    // stderr, where it is recorded but harmless — a hook must never fail a session.
     process.stderr.write(
-      `[grok-glance] not built yet - run \`npm install && npm run build\` in ${PLUGIN_ROOT}\n`,
+      `[grok-glance] dist/ is missing - run \`npm install && npm run build\` in ${PLUGIN_ROOT}\n`,
     );
     return false;
   }

commands/glance.md

@@ -12,8 +12,9 @@ If no argument was given, treat it as `status`.
 Then:
 
 1. Run `node "$GROK_PLUGIN_ROOT/bin/glance" $ARGUMENTS`.
-2. If it says the plugin is not built, run `npm install && npm run build` in `$GROK_PLUGIN_ROOT`
-   (this takes a minute or two) and try again.
+2. The plugin ships prebuilt, so this should just work. If it does say the plugin is not built,
+   `dist/` is missing from the checkout: run `npm install && npm run build` in
+   `$GROK_PLUGIN_ROOT` (a minute or two) and try again.
 3. Report what came back. For `enroll`, show the URL and the code verbatim — the user needs to
    type them on their phone, so do not paraphrase or reformat them.
 4. If the output mentions that no public origin is configured, explain the Tailscale Serve setup:

dist/web/icon.svg

@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" width="64" height="64">
+  <rect width="64" height="64" rx="14" fill="#09090b" />
+  <circle cx="32" cy="32" r="15" fill="none" stroke="#fafafa" stroke-width="3.5" />
+  <circle cx="32" cy="32" r="5.5" fill="#fafafa" />
+  <path d="M32 9v5M32 50v5M9 32h5M50 32h5" stroke="#71717a" stroke-width="3.5" stroke-linecap="round" />
+</svg>

dist/web/index.html

@@ -0,0 +1,22 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <!-- viewport-fit=cover so the sticky header sits under the notch rather than beside it. -->
+    <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover" />
+    <meta name="color-scheme" content="light dark" />
+    <meta name="theme-color" content="#fafafa" media="(prefers-color-scheme: light)" />
+    <meta name="theme-color" content="#09090b" media="(prefers-color-scheme: dark)" />
+    <title>grok-glance</title>
+    <link rel="icon" type="image/svg+xml" href="/icon.svg" />
+    <link rel="apple-touch-icon" href="/icon.svg" />
+    <link rel="manifest" href="/manifest.webmanifest" />
+    <meta name="apple-mobile-web-app-capable" content="yes" />
+    <meta name="apple-mobile-web-app-title" content="glance" />
+    <script type="module" crossorigin src="/assets/index-D-dJ5pn0.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-BZSiLyex.css">
+  </head>
+  <body>
+    <div id="root"></div>
+  </body>
+</html>

dist/web/manifest.webmanifest

@@ -0,0 +1,19 @@
+{
+  "name": "grok-glance",
+  "short_name": "glance",
+  "description": "Glance at what Grok Build is doing.",
+  "start_url": "/",
+  "scope": "/",
+  "display": "standalone",
+  "orientation": "portrait",
+  "background_color": "#09090b",
+  "theme_color": "#09090b",
+  "icons": [
+    {
+      "src": "/icon.svg",
+      "sizes": "any",
+      "type": "image/svg+xml",
+      "purpose": "any"
+    }
+  ]
+}

package-lock.json

@@ -21,6 +21,7 @@
         "@types/react": "^19.0.0",
         "@types/react-dom": "^19.0.0",
         "@vitejs/plugin-react": "6.0.2",
+        "rolldown": "1.0.3",
         "tailwind-variants": "3.3.0",
         "tailwindcss": "4.3.1",
         "typescript": "5.6.3",

package.json

@@ -9,11 +9,12 @@
   },
   "scripts": {
     "build": "npm run build:server && npm run build:web",
-    "build:server": "tsc -p tsconfig.server.json",
+    "build:server": "tsc -p tsconfig.server.json && rolldown server/src/index.ts -o dist/server/index.js -f esm -p node",
     "build:web": "tsc -p tsconfig.web.json && vite build",
     "dev": "vite",
     "start": "node dist/server/index.js",
-    "glance": "node bin/glance"
+    "glance": "node bin/glance",
+    "check:dist": "npm run build && test -z \"$(git status --porcelain dist)\""
   },
   "dependencies": {
     "@heroui/react": "3.2.4",
@@ -29,6 +30,7 @@
     "@types/react": "^19.0.0",
     "@types/react-dom": "^19.0.0",
     "@vitejs/plugin-react": "6.0.2",
+    "rolldown": "1.0.3",
     "tailwind-variants": "3.3.0",
     "tailwindcss": "4.3.1",
     "typescript": "5.6.3",

server/src/index.ts

@@ -18,7 +18,6 @@ import http from "node:http";
 import crypto from "node:crypto";
 import { URL } from "node:url";
 import {
-  DEFAULT_PORT,
   VERSION,
   deriveRpId,
   ensureHome,
@@ -564,8 +563,9 @@ server.listen(cfg.port, cfg.host, () => {
   console.log(`[glance] state: ${paths.home}`);
   console.log(`[glance] origin: ${cfg.origin ?? "(none set - see README)"} rpId: ${cfg.rpId ?? "localhost"}`);
   console.log(`[glance] accepts assertions from: ${expectedOrigins(cfg).join(", ")}`);
-  if (!webBuildExists()) console.log("[glance] web app not built yet: npm install && npm run build");
-  if (cfg.port !== DEFAULT_PORT) console.log(`[glance] note: non-default port, run \`glance sync-hooks\``);
+  // dist/ is committed, so this only fires for a developer who deleted it. Nothing warns about a
+  // non-default port any more: the hook scripts read config.json themselves.
+  if (!webBuildExists()) console.log("[glance] web app missing from dist/: npm install && npm run build");
 });
 
 server.on("error", (err) => {

server/src/static.ts

@@ -32,7 +32,7 @@ export function webBuildExists(): boolean {
 export function serveStatic(urlPath: string, res: ServerResponse): void {
   if (!webBuildExists()) {
     res.writeHead(503, { ...SECURITY_HEADERS, "content-type": "text/plain; charset=utf-8" });
-    res.end("grok-glance: web app not built yet. Run `npm install && npm run build`.\n");
+    res.end("grok-glance: dist/web is missing. Run `npm install && npm run build`.\n");
     return;
   }
 

skills/glance/SKILL.md

@@ -14,16 +14,12 @@ same dashboard — no per-session setup.
 The daemon is started automatically by the `SessionStart` hook. Everything below is done through
 the `glance` CLI at `$GROK_PLUGIN_ROOT/bin/glance`.
 
-## First check whether it is even built
+## No build step
 
-The plugin ships as TypeScript and must be built once:
-
-```sh
-cd "$GROK_PLUGIN_ROOT" && npm install && npm run build
-```
-
-`glance status` prints a "not built" error with this same instruction if it is missing. Do not
-attempt to skip the build — the daemon entry point is `dist/server/index.js`.
+The plugin ships prebuilt: `dist/` is committed, and the daemon is a single dependency-free
+bundle. A clone is ready to run. Only reach for `npm install && npm run build` in
+`$GROK_PLUGIN_ROOT` if `glance status` actually says it is not built, which means `dist/` was
+deleted from the checkout.
 
 ## The commands
 
@@ -99,7 +95,8 @@ and wait for a tap on the phone. Defaults that matter:
   secret in `$GLANCE_HOME/hook.secret` no longer matches the one the daemon loaded (events are being
   dropped with a 403); `glance stop && glance up` fixes that. Otherwise check that
   `hooks/hooks.json` exists and that the plugin is registered with Grok Build.
-- **Page says "run npm install && npm run build"** → the web bundle is missing; build it.
+- **Page says "run npm install && npm run build"** → `dist/web` is missing from the checkout,
+  which should not happen in a clone. Re-clone, or build it.
 - **Only one agent shows up** → the others were started before the plugin was installed, or in an
   environment where the hooks are not registered. A session appears on its next hook event; nothing
   can be back-filled for one that already ran.

tsconfig.server.json

@@ -5,8 +5,7 @@
     "module": "NodeNext",
     "moduleResolution": "NodeNext",
     "types": ["node"],
-    "outDir": "dist/server",
-    "rootDir": "server/src",
+    "noEmit": true,
     "strict": true,
     "noUnusedLocals": true,
     "noUnusedParameters": true,
@@ -15,8 +14,7 @@
     "skipLibCheck": true,
     "esModuleInterop": true,
     "forceConsistentCasingInFileNames": true,
-    "declaration": false,
-    "sourceMap": true
+    "declaration": false
   },
   "include": ["server/src"]
 }