dsh-subagent-grok

DSH needs a trustworthy backend when delegating subagent tasks. dsh-subagent-grok plugs a locally authenticated Grok CLI into DSH as the default one-shot subagent provider, so you can reuse Grok's own local authentication without setting up a remote service or an API gateway.

Each delegation runs a single grok -p --output-format json command in the parent session's working directory and returns structured JSON. On the safety side, the default command pairs --always-approve with Grok's built-in workspace sandbox, confining file writes to the parent working directory, Grok's state directory, and temporary paths; loosening that boundary requires explicitly toggling both sandbox off and allowUnconfined true, a deliberate double safeguard that keeps the bundled defaults at least-privilege. The plugin never initiates a login, never reads or writes an API key, and surfaces a clear failed delegation when the CLI is missing, authentication is stale, output is not valid JSON, input is non-text, or the prompt is empty.

A good fit for developers who have already authenticated Grok CLI locally, want to route DSH subagent work to the Grok model, and care about keeping file-system writes within a well-defined boundary.