84 lines
3.6 KiB
Markdown
84 lines
3.6 KiB
Markdown
---
|
|
name: glance
|
|
description: Set up, inspect, or control grok-glance — the passkey-guarded phone dashboard for this Grok Build session. Use when the user asks to watch a session from their phone, enrol a device, expose the dashboard over Tailscale, or turn remote approve/deny on or off.
|
|
---
|
|
|
|
# grok-glance
|
|
|
|
A local daemon plus web dashboard that shows what Grok Build is doing, readable from a phone
|
|
behind a WebAuthn passkey. It can also pause risky tool calls until someone taps approve.
|
|
|
|
The daemon is started automatically by the `SessionStart` hook. Everything below is done through
|
|
the `glance` CLI at `$GROK_PLUGIN_ROOT/bin/glance`.
|
|
|
|
## First check whether it is even built
|
|
|
|
The plugin ships as TypeScript and must be built once:
|
|
|
|
```sh
|
|
cd "$GROK_PLUGIN_ROOT" && npm install && npm run build
|
|
```
|
|
|
|
`glance status` prints a "not built" error with this same instruction if it is missing. Do not
|
|
attempt to skip the build — the daemon entry point is `dist/server/index.js`.
|
|
|
|
## The commands
|
|
|
|
```sh
|
|
glance status # is it running, which origin, how many devices
|
|
glance up # start the daemon in the background
|
|
glance stop # stop it
|
|
glance logs # last 60 lines of the daemon log
|
|
glance enroll # mint a one-time code + URL for a new phone
|
|
glance set-origin <https-url> # set the public origin and WebAuthn RP ID
|
|
glance devices # list enrolled devices
|
|
glance revoke <id-prefix> # revoke one
|
|
glance approval <off|risky|all> # remote approve/deny policy
|
|
glance sync-hooks # rewrite hook URLs after changing the port
|
|
```
|
|
|
|
## Getting it onto a phone
|
|
|
|
The dashboard listens on `127.0.0.1` only. Passkeys need a real hostname with valid TLS — a bare
|
|
IP can never be a WebAuthn RP ID — so the supported path is Tailscale Serve:
|
|
|
|
```sh
|
|
tailscale serve --bg 127.0.0.1:8791
|
|
tailscale serve status # read the https://<box>.<tailnet>.ts.net URL
|
|
glance set-origin https://<box>.<tailnet>.ts.net
|
|
glance enroll
|
|
```
|
|
|
|
Then open the printed URL on the phone, type the code, and create the passkey. The phone must be
|
|
on the same tailnet.
|
|
|
|
Changing the origin changes the RP ID, which invalidates existing passkeys. Say so before running
|
|
`set-origin` on a working setup.
|
|
|
|
## Remote approve/deny
|
|
|
|
`glance approval risky` makes `Bash`, `Write`, `Edit`, `MultiEdit` and `NotebookEdit` calls pause
|
|
and wait for a tap on the phone. Defaults that matter:
|
|
|
|
- Nothing waits unless a phone is actually watching the dashboard (`requireWatcher`).
|
|
- If nobody answers within 90s the call is **allowed**, not denied. Flip that on the phone's
|
|
settings panel if you want the opposite.
|
|
- Every failure path is fail-open: daemon down, timeout, bad JSON — the tool call proceeds. This
|
|
is a convenience gate, not a security boundary.
|
|
|
|
`glance approval off` (the default) means Grok Build never blocks on the phone.
|
|
|
|
## When something does not work
|
|
|
|
- **"not running"** → `glance up`, then `glance logs`.
|
|
- **Passkey prompt fails with a security error** → the phone is on a hostname the RP ID does not
|
|
cover. Compare `glance status`'s `rp id` with the hostname in the phone's address bar.
|
|
- **Dashboard loads but shows nothing** → hooks are not firing. Check that the port in
|
|
`hooks/hooks.json` matches `~/.grok/glance/config.json`; `glance sync-hooks` fixes it.
|
|
- **Page says "run npm install && npm run build"** → the web bundle is missing; build it.
|
|
|
|
## What it deliberately does not do
|
|
|
|
Read-only plus approve/deny. It cannot send prompts, edit files, run tools, or resume a session.
|
|
Do not tell the user otherwise.
|