grok v0.2.14 — the areas nobody had opened
The first audit left a list of areas it had never opened. This is that list, audited the same way: six areas, 18 findings, two independent checks each, Grok on the ones that mattered.
Ten reached cross-verification and two survived both. That thinness is the honest result — it is what a repository looks like after its serious defects have just been fixed.
The documents promised more than the code did
The plugin's own absolute principle says the server does not log credentials; the logging design spec says "No credentials, ever." In practice only the two xAI billing keys were masked. Measured: a Bearer JWT, an AWS secret, a GitHub personal access token and a bare password: line pasted into a delegation prompt were all written verbatim into ~/.grok-build/history.jsonl — and replayed back to Claude by /grok:usage and /grok:status.
Redaction now covers the common shapes. But the more important repair is to the sentences: the principle scopes itself to the credentials the server holds, states that your prompt preview is outside it, and says plainly that pattern matching is mitigation rather than a guarantee.
And no user-facing document mentioned the log at all. Both READMEs and /grok:usage now say what it records, that it is replayed into later sessions, and that deleting it is safe.
A first attempt at that fix was wrong, and was caught
Grok's adversarial pass ran 45 realistic prompts through the broadened redaction and found 19 of them mangled — api_key: required, DATABASE_URL: string, Bearer authentication-middleware. A history that eats ordinary task descriptions is worse than no history. The rule is now two-tier, separators and quotes survive, and all 19 are pinned as a regression corpus.
A gate that could not protect what it guarded
The packaging test checked that each tool name appeared somewhere in the bundle — and the routing module embeds those names as advice literals. Exactly the three tools the approval hook gates were the three the gate could not see. Deleting an entire tool registration and rebuilding left the whole suite green. It now checks the actual registration calls, as an exact set.
Smaller, measured
/grok:cli now declares when it truncated output instead of silently returning the last 4 KB of an 81 KB document — which is why /grok:inspect could never do what its own instructions said. A non-existent working directory is refused before spawning, rather than surfacing as "check your grok install". The shell-injection ban now covers every source file instead of one. And the orchestrator docs no longer tell consumers to re-call the planning tool after their human approval gate, which never delegated.
Recorded, but refuted
Floating CI action tags, non-strict status checks, the whole-file history read (measured at 3.6% of what the status call already waits on), and "four releases shipped untagged" — which died to its own reproduction command sorting version tags as strings.
Verified at this commit: npm ci, 352 tests passed / 1 skipped (up from 304), typecheck clean, both committed bundles rebuild byte-identical.
Full detail: docs/releases/v0.2.14.md