Adds Grok Build as a supported coding agent CLI, and fixes Windows protection for Git Bash style /c/... paths that previously slipped past checks their C:/... spelling would have blocked.
Added
- Added Grok Build support: install the PreToolUse hook with
cc-safety-net install --grok-build(remove it withuninstall --grok-build), or run the adapter directly withcc-safety-net hook --grok-build/-gb. The hook config is written to~/.grok/hooks/cc-safety-net.json, honorsGROK_HOME, and install and uninstall preserve any other hook entries in that file. Note that Grok Build hooks are fail-open by design, so only an explicit deny blocks a tool call; seeSECURITY.mdfor the limits. (#92) - Added Grok Build to
cc-safety-net doctor, which reports the hook as configured and warns when the managed entry has drifted, such as a coverage-narrowingmatcher, a handlertypeother thancommand, or a changed timeout. (#92) - Added secret protection for Grok Build credentials and config files:
~/.grok/auth.json,~/.grok/mcp_credentials.json,~/.grok/config.toml,~/.grok/managed_config.toml,~/.grok/requirements.toml,<project>/.grok/config.toml,/etc/grok/managed_config.toml, and/etc/grok/requirements.toml. (#92)
Fixed
- Fixed Windows handling of MSYS and Git Bash path spellings such as
/c/Users/..., which were previously read as paths on the current drive. Recursivermclassification, protected policy path checks, secret-file protection, andHOMEandCC_SAFETY_NET_HOMEresolution now normalize these to the nativeC:/...form first, so a destructive command written in the/c/form is treated the same as itsC:/form. (#91)