feat(installer): add Grok as a supported agent

[ximing]

@colbymchenry — please review this installer target when you have a chance.

Summary

codegraph install now detects and configures Grok (Grok Build TUI / grok CLI) the same way it already does for Claude Code, Cursor, Codex, opencode, and the rest.

codegraph install --target=grok --yes
codegraph install --target=grok --location=local --yes
codegraph install --print-config grok
codegraph uninstall --target=grok

After installing: start a new Grok session, or press r in /mcps. A project-local install only takes effect once Grok trusts the folder (same gate as project hooks / repo-local MCP).

Why

Grok reads MCP servers from TOML ([mcp_servers.<name>] in ~/.grok/config.toml or .grok/config.toml). There was no installer target, so Grok users had to paste config by hand — and CodeGraph never showed up in the interactive agent list.

Design

Grok is a first-class AgentTarget, closest analog Codex (same TOML shape). Adding it is the documented installer pattern: one file in src/installer/targets/ + registry + TargetId + contract tests.

Surface	Global	Local
MCP config	$GROK_HOME/config.toml (default ~/.grok/config.toml)	./.grok/config.toml
Subagent instructions	$GROK_HOME/rules/codegraph.md	./.grok/rules/codegraph.md

MCP block — reuses toml.ts ([mcp_servers.codegraph] with command + args). Sibling tables and [[array_of_tables]] are preserved byte-for-byte. We own the codegraph table exclusively, same contract as Codex.

Instructions — Grok always scans $GROK_HOME/rules/*.md and <dir>/.grok/rules/*.md. It does not load a home-level AGENTS.md, so we write the short #704 marker-fenced block to rules/codegraph.md rather than sharing Codex's AGENTS.md. codegraph uninstall strips only the marked section.

$GROK_HOME — honored (same idea as HERMES_HOME). Tests delete GROK_HOME when they redirect HOME, so they cannot write a developer's real ~/.grok/config.toml.

No --path — unlike Cursor, Grok launches stdio MCP from the workspace cwd. Injecting --path would be wrong here.

No autoAllow / [permission] writes — Grok's [permission] table is user-owned (sibling allow/deny rules). MCP tools can be always-allowed from the first prompt. Touching that table with the narrow TOML splicer would risk wiping user rules.

Local trust note — repo-local MCP is gated on folder trust (~/.grok/trusted_folders.toml). The installer says so instead of reporting silent success.

Compat note — Grok can also pick up Claude/Cursor MCP configs, but native config.toml wins on name conflict. This target writes the native entry so Grok works without those other agents installed.

Tests

• Parameterized installer contract (install / idempotent re-run / uninstall / printConfig) now covers grok via ALL_TARGETS.
• Dedicated cases: rules/codegraph.md Codegraph is only effective in the main agent, and the sub Agent is not effective. Why? #704 block + legacy self-heal, local vs global isolation, sibling [mcp_servers.other] / [models] preservation, $GROK_HOME redirect, printConfig is read-only.
• npx vitest run __tests__/installer-targets.test.ts — 245 passed, 3 skipped.

Docs

README, site getting-started / integrations, CLI --help, and [Unreleased] changelog. Uninstall location picker now lists ~/.grok / ./.grok.

Out of scope

• No version bump (release workflow owns that).
• No permissions auto-allow list.
• Grok already running a session needs a refresh (/mcps → r) or a new session to pick up the server.