v1.4.0 - Native Grok Build & Its Own Name

Open Second Brain v1.4.0 - Native Grok Build & Its Own Name

Grok Build now speaks Brain natively: one install command registers the two Open Second Brain MCP servers in grok's own config.toml and writes lifecycle hooks into grok's native hooks directory, so the same memory loop - rules into every answer, sessions captured into the vault - runs inside grok too. And every runtime that joins the loop now logs under its OWN name: a grok session on your VPS writes as grok-vps-agent, opencode on your Mac as opencode-mac-agent, instead of all of them inheriting the single operator identity. In a shared multi-device vault you can finally tell which runtime, on which machine, wrote what.

What ships

• Native Grok Build integration. o2b install --target grok --apply registers the two Open Second Brain MCP servers in ${GROK_HOME:-~/.grok}/config.toml under [mcp_servers.*] (grok's highest-priority MCP source) and writes lifecycle hooks to ${GROK_HOME:-~/.grok}/hooks/open-second-brain.json (grok's native, always-trusted hooks dir). Both use an absolute bun run <repo>/src/cli/main.ts ... command, because grok spawns MCP and hook processes with a restricted PATH that excludes ~/.local/bin - a bare o2b never resolves in a session. Verified against live grok 0.2.45 from a real session debug log, not grok mcp doctor (which runs with the interactive shell PATH and masks the failure): 71 full-server and 5 writer MCP tools registered, with active-context inject, the post-write reminder, session capture, and the stop-log guardrail all dispatched. The integration lives entirely in grok's own config, never the ~/.claude/ namespace. See install/grok.md.
• Each runtime logs under its own name. Every runtime that registers the MCP servers (grok, opencode, openclaw, and Codex via codex mcp add) now attributes its Brain writes to its OWN host-qualified identity rather than the shared operator agent_name. The derivation keeps the host segment of the operator name and substitutes the runtime's own vendor token (claude-vps-agent -> grok-vps-agent / opencode-vps-agent); a name outside the <vendor>-<host>-agent shape is prefixed with <runtime>-, and with no operator name configured the runtime falls back to its bare id. It names no other runtime - the vendor token is always the caller's own, never an enumerated swap table.
• Distinguishable per runtime and per device. Because the host segment is preserved, a Brain synced across a VPS, a dev box, and a Mac can tell the same runtime apart on each machine. The derived name is read from the install payload's operator name, so apply and verify compute the identical value and o2b install --check reports no drift after an apply. For grok, both the config.toml MCP env and every hook command carry the same derived name.
• A grok session adapter. grok stores each session as an ACP updates.jsonl stream under ${GROK_HOME:-~/.grok}/sessions/. A fifth session adapter folds that stream into the Brain through o2b brain import-session (autodetected), coalescing same-role message chunks and mapping tool calls so the brain_feedback replay fires on import.
• One shared hook layer, grok's dialect. grok delivers hook stdin in camelCase (hookEventName / sessionId / toolName / toolInput); the shared hook layer normalizes it into the internal shape, detects the grok runtime, and counts grok's search_replace alongside the Claude tool names as a file-mutating tool, so the post-write reminder fires on grok edits too. Lifecycle events carry no matcher (grok rejects one); PostToolUse keeps it.

Process wins

• A single derivation kernel (deriveRuntimeAgentName) behind the whole identity surface: the install payload path, the grok hooks file, the opencode adapter opt-in, and the openclaw per-turn reminder all route through it, so no call site can drift to a different rule.
• Validated where it actually runs: a real grok 0.2.45 session wrote its lifecycle events under grok-dev-agent, and o2b install --check --target grok came back clean. The earlier "doctor said it works" false positive is explicitly not how this was signed off.
• Quality record: 4,338 tests / 0 fail, TypeScript clean, lint at 0 errors, version synced across all manifests, an independent self-review against main before push, and a clean CodeRabbit pass.

Notes

• The identity change reverses an earlier bare-id scheme (grok, opencode) that could not tell devices apart in a shared vault; the host-qualified scheme is strictly more informative and still never masquerades as another runtime.
• Codex has no o2b adapter (it is wired manually via codex mcp add), so install/codex.md documents how to build the host-qualified VAULT_AGENT_NAME by hand; grok, opencode, and openclaw derive it automatically.
• Release image: the Grok integration in the canonical terminal style (animated GIF in this body; static PNG and the SVG source attached as assets).