rdmsm4x-changelog-20260927-1833-grok-onboarding-audit-cursor-cli-fix

rdmsm4x - audit - grok onboarding verified cursor cli fixed - claude - TASK-20260927-68 - fleet - 20260927-1833

Summary: Rich asked (2026-09-27 18:21 EDT) to make sure grok/grok-bot/etc are fully onboarded to the same standard being built for Hermes (TASK-20260927-67). Audited all 6 hosts: grok (Build CLI) and Grok Bot were already fully onboarded (done in TASK-20260926-14, DEC-20260926-01, TASK-20260926-19). Found and fixed one real gap in a comparison sweep of other agent CLIs: cursor-cli's Intel build was missing its bundled node binary on both Intel hosts.

Scope

Hosts: rdmsm4x, rdmbair13m5, rdmbair15m5, jdmbair13m5, rdmpw3265m, rdmpw3275m (all 6).

Checklist applied (from TASK-20260927-67 / Hermes standard)

Identity markers (agent_msg.zsh, bin/ticket / spoke proxy, prepare-commit-msg)
Bus works (agent_msg.zsh whoami resolves under the harness's env marker)
ticket CLI works (detect_agent / spoke proxy)
Instructions entry point the harness reads
FLEET.md section 3 row
Heartbeat/agentstatus visibility
Installed via Homebrew where a cask/formula exists
Version current across hosts

Result

Grok Build CLI (cask grok-build, v1.0.41) and Grok Bot (cask grok-bot, v0.61.0): 8/8 PASS on all 6 hosts, already onboarded before this audit ran. No changes needed for grok/grok-bot itself.

Comparison sweep: codex (0.157.1), agy (1.2.12), GitHub Copilot CLI (copilot-cli, 1.0.88) — no gaps, already installed fleet-wide. Cursor CLI (cursor-cli) — gap found: the Intel Caskroom (rdmpw3265m, rdmpw3275m) was missing its bundled node runtime binary (/usr/local/Caskroom/cursor-cli/2026.09.26-dd393fe/dist-package/node absent), so cursor-agent failed outright on both Intel hosts.

Files touched / commands run

ssh [email protected] 'brew reinstall --cask cursor-cli'
ssh [email protected] 'brew reinstall --cask cursor-cli'

No source files edited; no secrets touched. Audit script (scratchpad, not durable): grok_audit.zsh, run locally and piped over SSH to all 5 spokes.

Verification evidence

Before: ls .../dist-package/node -> No such file or directory (both Intel hosts).
After: ls .../dist-package/node -> present, 148353856 bytes, both hosts (matches the working binary size already present on the Apple Silicon hosts).
Residual (not fixed, not a grok/onboarding gap): cursor-agent --version still cannot complete headlessly over SSH on any spoke — Intel hosts time out, Apple Silicon hosts report "Your macOS login keychain is locked." This is the known FileVault/no-console-login trap (memory: filevault-ssh-denies-until-console-login, tmux-session-cannot-sign-use-aqua-launchagent), not something a reinstall or env var can fix remotely.

Backup / undo

brew reinstall --cask cursor-cli is a normal Homebrew cask reinstall; undo with brew uninstall --cask cursor-cli && brew install --cask cursor-cli if ever needed. No other state changed.

Outstanding owner actions

Needs Rich (console/physical only): log in at the console (or Screen Sharing) once on each of rdmbair13m5, rdmbair15m5, jdmbair13m5, rdmpw3265m, rdmpw3275m to unlock the login keychain for richh, so cursor-agent can run headlessly over SSH on those hosts. Does not block grok/grok-bot, which needed no fixes.

Coordination

Bus thread 20260927-182239-0213AF5E with claude@rdmsm4x/f45ce440 (owner of the live Hermes onboarding, TASK-20260927-67): confirmed no scope overlap; f45ce440 kept the Hermes spoke rollout, handed this session the grok/cursor-agent/copilot comparison. Full audit: ~/dev/fleet/ops/grok-onboarding/AUDIT.md. Ticket: TASK-20260927-68 (resolved).