Skip to content

feat(detector): detect Grok Build, Kimi Code, Muse Code, Hermes Agent, Oh My Pi - #204

Closed
raysubham wants to merge 1 commit into
step-security:mainfrom
raysubham:feature/ai-agent-wave2
Closed

feat(detector): detect Grok Build, Kimi Code, Muse Code, Hermes Agent, Oh My Pi#204
raysubham wants to merge 1 commit into
step-security:mainfrom
raysubham:feature/ai-agent-wave2

Conversation

@raysubham

Copy link
Copy Markdown
Contributor

Summary

Adds five AI agent CLIs to the ladder-backed AI-CLI detector: grok-build (xAI), kimi-code (Moonshot), muse-code (Meta), hermes-agent (Nous Research), oh-my-pi (Stencil). All five share their binary name with an unrelated tool, so each follows the PR #182 pattern: resolveVerified walks candidates and an accept closure proves identity per install channel before a row is reported.

  • Identity channels: npm manifest, vendor install dir (~/.grok, ~/.kimi-code, ~/.omp), Homebrew keg or cask, winget, pacman manifest, mise install tree, uv/pipx venv (Kimi legacy, Hermes).
  • Versions come only from on-disk evidence: package manifests, versioned filenames, dist-info directory names, the Muse .muse-version sidecar (64-byte cap), Homebrew and mise path segments. StaticVersionOnly on all five; winget channels report unknown.
  • Never executed, never reads agent state: no config.toml, .env, auth.json, settings.json, sessions, credentials, or logs. Every path goes through the TCC candidate guard.
  • Skills: global roots (~/.grok/skills, ~/.kimi-code/skills, ~/.config/muse/skills, ~/.hermes/skills or %LOCALAPPDATA%\hermes\skills, ~/.omp/agent/skills, ~/.omp/agent/managed-skills), project roots and marker dirs (.grok, .kimi-code, .hermes, .omp). Hermes nested <category>/<skill>/SKILL.md layout yields a two-level root_rel_path.
  • versionmeta.isVersionLike exported as IsVersionLike; no other versionmeta change.

Test plan

  • go build ./..., go vet ./..., gofmt -l internal/ clean
  • go test ./internal/detector/... ./internal/versionmeta/... (per-agent accept/reject cases, Windows cases, TCC guard decoys, glob budget, skills census rows, nested Hermes fixture)
  • dmg-mac and dmg-linux live scan: all five rows reported; negative pass drops muse-code/hermes-agent on linux, mac keeps them via Homebrew; ~/Documents/bin/grok decoy skipped with no TCC access; 58 hermes_user skills
  • dmg-windows live scan (Grok same-size copy rule, Hermes %LOCALAPPDATA% venv) — pending

Release gate

agent-api agentSkillSourceToAgent entries for the ten new skill sources must deploy before this ships.

…, Oh My Pi

Add five AI agent CLIs to the ladder-backed detector. Each shares its
binary name with an unrelated tool, so identity is proven per install
channel (npm manifest, vendor install dir, Homebrew keg or cask, winget,
pacman, mise, uv/pipx venv) before a row is reported. Versions come only
from on-disk evidence: package manifests, versioned filenames, dist-info
directory names, the Muse .muse-version sidecar, or Homebrew and mise
path segments. Nothing is executed and no agent config, auth, session,
or log file is read.

Register the matching skills roots and project marker directories, and
export versionmeta.IsVersionLike for the filename and dist-info checks.
@raysubham raysubham closed this Sep 5, 2026
@raysubham
raysubham deleted the feature/ai-agent-wave2 branch September 5, 2026 18:40
@raysubham

Copy link
Copy Markdown
Contributor Author

Superseded by #205 after the head branch was renamed to feature/ai-agent-detection.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant