AnyBot/MECHANICS.md

How the original works (and what this rebuild copies)

Original: Grok Bot 0.78.1, an Electron app.

The native main program (decompiled)

Contents/MacOS/Grok Bot (Mach-O arm64, 53 040 bytes, sha256 df5b07de…). Opened with core_target_open, and every function read with native_function_pseudocode:

Address	Function	What it does
0x100000460	entry	Calls 0x1000004c0, then electron::fuses::IsRunAsNodeEnabled(). If the fuse is on and getenv("ELECTRON_RUN_AS_NODE") is a non-empty string, it runs ElectronInitializeICUandStartNode, otherwise ElectronMain.
0x1000004c0	sub_1000004c0	For stdin/stdout/stderr (fd 0, 1, 2): if fstat fails with errno == 9 (EBADF), reopens that stream on /dev/null.
0x1000005bc–0x100000604	import stubs	ElectronInitializeICUandStartNode, ElectronMain, getenv, IsRunAsNodeEnabled, freopen, __error, fstat.

These are all 10 functions in the file (evidence ev_407aa9c3…). native_strings_find for model|grok|provider|chat|bot|theme|api finds 0 strings (evidence ev_1b74b817…), so none of the chat, model or settings behaviour is native code. It lives in the JavaScript inside Contents/Resources/app.asar. The sources below therefore give file + byte offset (@N) + minified function name, the JavaScript equivalent of a function address. Pseudocode evidence: ev_7c151be5… (entry), ev_29ffc0d8… (sub_1000004c0). Bundle map evidence: ev_2bb06b4aef290dafe0a74085416f36482d30fc7ecc476b97f343e324ceb9c9f7 (js_app_map).

Errors, retries and timeouts

From dist/electron-main/main-core.cjs.

Rule	Value	Source
Retry attempts	3	@1082927 D3={name:"gateway-create-agent-retry",maxAttempts:3,…}
Retry delay	starts at 1000 ms, ×2 each time, at most 4000 ms → 1 s, 2 s, 4 s	same object: initialDelayMs:1e3,maxDelayMs:4e3,backoffFactor:2
Connect deadline	15 000 ms	@1082927 $D=15e3 → connectDeadline "gateway-sse-connect" (@1084759 L3)
Stream silence counts as a stall	35 000 ms	@1082927 VD=35e3 → stallWatchdog "gateway-sse-stall", idleMs:VD (@1084759 L3)
Provider overloaded / rate limit	retry	@689060 SAND-E0401 providerOverloaded, retryable:!0
Nothing streamed by the first-token deadline	retry	@689284 SAND-E0402 firstTokenStall, retryable:!0. The deadline itself is server-side: estimated 120 s
Transport reset	retry	@689501 SAND-E0403 streamReset, retryable:!0
Context window overflow	no retry	@689722 SAND-E0404 contextWindowOverflow, retryable:!1
Backend rejected	no retry	@689948 SAND-E0405 backendRejected, retryable:!1
Server-paced retry-after	wait the given delay, then retry	@690623 SAND-E0408 backendCapacityDeferred (30 s cap: estimated)
Silence after output started	cancel; resumed only from a checkpoint	@691348 SAND-E0415 streamIdleStall, so the rebuild never auto-retries once text has appeared
Backend unreachable (refused / DNS)	retry	@692409 SAND-E0418 turnBackendUnreachable, retryable:!0
Rate-limit banner	"Rate limited by model provider, retrying…"	main-app.cjs rate_limited_reconnect_message_config
Error texts	provider_overloaded → wbQwKx; first_token_stall → Ly7/5m "模型未能及時開始回應。請重試。"	index.eager-app @1592250, map YN

How the rebuild applies them: 429, 408, 5xx, 529 and connection failures retry up to 3 tries, waiting 1 s, then 2 s, then 4 s (or the server's Retry-After). The reply shows "…秒後重試（第 n 次，共 3 次）" meanwhile. A 400 that says the prompt is too long stops with a "對話太長了" message, and 401/403/404 stop at once. A reply that goes 35 s silent after it started is stopped, and the partial text is kept.

Models

What	Value	Source
Default model	grok-4.5	main-core.cjs, var Wp="grok-4.5", exported as SAND_DEFAULT_MODEL_ID
Model choice shape	{modelId, maxMode, parameters:[{id,value}]}	main-core.cjs, schema UEe / bh
Model list	fetched from the server, not stored in the app	model_picker_experiments in main-app.cjs names only grok-4.5 and grok-4.6
Setting text	"模型：選擇 Grok Bot 用來思考的模型"	index.eager-app settings map b$.model → ids scu3wk / 2RPCms
Overload message	"模型供應商已超載" / "模型供應商目前負載過高。通常是暫時的。"	zh-TW catalog ids Rdu4z7, wbQwKx

The original only talks to its own cloud service. The rebuild's change, as the person asked: every bot picks its own provider (xAI Grok, OpenAI, Claude, Gemini, OpenRouter, Ollama, or any OpenAI-compatible service) and model. Keys live in Settings → AI 供應商.

Message box

Rule	Value	Source
Send	Enter sends; Shift+Enter adds a new line; Enter is ignored while an input method is composing	index.eager-app @2002346 mwt: e.key==="Enter"&&!e.shiftKey&&!e.nativeEvent.isComposing&&e.preventDefault()
Placeholder	"傳訊息給 {name}" (fallback "想問什麼都可以，或拖入檔案")	index.eager-app function E6t, ids pqr+oY / HOCPPm

Sidebar

From dist/renderer/assets/index.eager-app-D1juOWZp.js.

Rule	Value	Source
Default width	280 px	@912025 FT={expandedWidth:280,isCollapsed:!1}
Width limits	240–400 px	@914394 sKe: jT(UT(t.expandedWidth,280),240,400); @969523 QJe: Math.max(240,Math.min(400,…))
Folded width	88 px rail	@969523 fD=88
Fold when dragged below	210 px	@969523 JJe=210
Unfold from the rail when dragged to	220 px	@969523 YJe=220
Saved keys	sand.sidebar.width, sand.sidebar.collapsed	@912025 BT
Chat minimum width	424 px	index CSS --sand-chat-min-width:424px (class sand-1fiktjy); window minimum = 240 + 424
Sections	主要 Bot, 已釘選的 Bot, Bot	zh-TW ids V8a0q9, vPVg0Q, ixkTse
Search	"搜尋 Bot"; empty result "沒有相符的 Bot"	ids YjO4Og, 12i8o8

Chat

What	Value	Source
Bubble corner	18 px	index CSS --sand-transcript-prose-bubble-radius:18px
Bubble text	15 px on a 22 px line	--sand-transcript-prose-line-height:22px with --sand-font-size-lg:15px
One-line bubble height	36 px (7 px above and below)	--sand-transcript-prose-one-line-height:36px, --sand-transcript-prose-block-padding:7px
UI text sizes	11/12/13/14/15/17/22/26 px, base 14 px	--sand-font-size-xxs … --sand-font-size-xxxl
Transcript item kinds	user, thinking, assistant-text, tool-call, send-message	index.eager-app function zfn
Thinking label	"思考中"	id AUV+TY
Message actions	複製, 重新傳送, 停止	ids he3ygx, MyjAbr, NnvXp5

Bots

What	Value	Source
Bot fields	名稱, 描述, 頭像 (shape + colour)	ids RFtRvq, NDq8h1, fopc9x
Avatar shapes	26: arch, bean, blob, capsule, cloud, clover, crystal, cylinder, dome, egg, flower, gem, heart, hex, house, leaf, pebble, pumpkin, shield, sparkle, square, squircle, star, tablet, teardrop, wedge	dist/electron-main/menubar-tray/assets/bot-*.png
Rebuild shapes	12 of them, drawn as simple shapes (look estimated)	own drawing

Look (light theme)

From dist/renderer/assets/index-Dh7EWA8t.css, block :root,.sand-1vbcnu7: pane #fff, chrome #fcfcfc, sidebar #f5f5f5, text #1c1c1c, secondary #1c1c1cad, tertiary #1c1c1c8f, hover #1c1c1c0f, active #1c1c1c14, border #1c1c1c1f, user bubble #1c1c1c with white text, agent bubble #1c1c1c0f, focus #1e86fc, accent #1680f3. Bot colours come from --sand-fill-*-bubble-user: red #c82532, orange #d2550a, yellow #c2730b, green #0d9655, cyan #0d9381, blue #126fd4, purple #7442d1, magenta #c82779, brown #86592e.

Settings → 主題: 淺色 / 深色 / 跟隨系統 (ids 1njn7W, pvnfJD, Ea4oxV). 強調色: Bot 顏色 / 黑色 (ids p7v5PZ, THokF3, description eeSkqM).

Dark theme colours weren't found in the stylesheet or the scripts: estimated. Chat column 720 px: estimated. No transcript max-width was found; the 708, 640 and 960 px max-widths in the CSS belong to other views.

Computer tools and the work loop (taken over from the neighbouring deep investigation)

The deep investigation in investigation.cany (findings fnd_5–fnd_12) showed that the original's agent loop runs on a remote "box". The desktop app only hosts a local tool runner (dist/local-exec-daemon/main.cjs) and the permission layer. That session planned its own clean-room harness (plan step 1 "doing", no code written yet). This version builds that plan here, in Rust, with the model loop running locally against whichever provider the bot uses.

Rule	Value	Source
Search deadline	25 000 ms	local-exec-daemon @2983388 Mu.MAIN_TIMEOUT_MS=25e3
Search hard cap	10 000 lines	same, Mu.HARD_MAX_OUTPUT_LINES=1e4
Lines handed to the model	2 000	@2966784 Jut=2e3 (client limit)
Largest file read	8 388 608 bytes (8 MiB)	@2951190 gut
Long command	not killed: moved to the background, read later	@3010873 Mye (stop kind "background", reason TIMEOUT), @3016213 timeoutBehavior===BACKGROUND
Background read-back	read_terminal	@2959283 readTerminalFile
Command output kept	start + end, middle counted	ShellFailure fields output_head, output_tail, elided_chars (@2186946); 6 000 + 6 000 chars estimated
Foreground wait before background	30 s, model may ask up to 600 s	estimated (the original gets it per call from the server)
Permission order	refuse > hidden files > allowed > ask	fnd_8: shouldBlockShellCommand, isShellCommandFullyAllowlisted, cursorignore/repo-block globs, approval callbacks
Chained commands	split on &&, `
"Always allow"	remembered per bot (e.g. "修改檔案", "npm install")	fnd_12 recordLocalToolStandingGrant
Never claim done without a result	in the bot's instructions	fnd_10 design lesson (paraphrased, not copied)
Summarize at	70 % of the context	main-app.cjs client_speculative_summarization_config.tokenUsageThresholdPercentage:70
Extra room mid-task	+5 % (summarize again at 75 % between steps)	same config, tolerancePercentage:5 (how it's applied is our reading)
Context size	128K tokens by default, per bot	estimated
Token estimate	4 Latin chars or 1 Chinese char ≈ 1 token	estimated
Steps per turn	25	estimated
Messages kept word for word	newest 6, cut only before a user message	estimated

Native helpers behind the tools (decompiled)

cursor_proclist.node (Mach-O arm64 bundle, 125 536 bytes, sha256 d5df3fb7…), the original's process scanner. Strings found with native_strings_find (evidence ev_3d585c56…), and functions read with native_function_pseudocode:

Address	Function	Rule taken
0x6748	getDescendantPids(vector<int>, bool)	Breadth-first over children: proc_listpids(6 = PROC_PPID_ONLY, pid, buf, 0x1000), de-duplicated in a hash set, and the loop stops once 0xfff pids are collected, at most 4096 processes (evidence ev_768ea7aa…)
0x3d00	ProclistScanWorker::Execute	Calls getDescendantPids(roots, true) (roots included), then getProcessInformation for each and drops any that fail (evidence ev_6aba01a8…)
0x5234	getProcessInformation(int, ProcessInfo&)	proc_pidinfo(pid, 3 = PIDTBSDINFO, 0x88) for the parent; name via proc_name, else ""; arguments via sysctl KERN_PROCARGS2 only when under 0x40000 bytes; agent tags read from the environment (…CONVERSATION_ID= 0x17 chars, …REQUEST_ID= 0x12 chars); proc_pidinfo(pid, 4 = PIDTASKINFO, 0x60): memoryMB = resident bytes >> 20, cpuTimeMs = (user + system) × timebase.numer / timebase.denom / 1 000 000 (magic-number divide 0x431bde82d7b634db >> 18) (evidence ev_257a505c…)
0x1fdc, 0x6cc0	cursorProclistSystemMemory, getSystemMemoryInfo	Reads kern.memorystatus_vm_pressure_level (not used here)

How the rebuild applies it (app tools.rs descendants, tree_stats, kill_tree): every command is tagged with ANYBOT_CONVERSATION_ID (the bot) and ANYBOT_REQUEST_ID (the tool call). These are our own names for the original's vendor-prefixed tags. Pressing stop, or quitting, ends the command and everything it started (up to 4096 processes, newest first), not just the shell. read_terminal reports process count, CPU seconds and memory MB with the formulas above (via ps).

sand-op-launcher (universal Mach-O, 136 368 bytes, sha256 1337d620…). Strings in evidence ev_7d29f77e…; _main read with native_function_pseudocode (evidence ev_8006d51c…):

• It verifies the 1Password CLI's code signature (SecStaticCodeCheckValidity against identifier "com.1password.op" … OU 2BUA8C4S2C), and re-checks the file before execve ("changed before launch").
• It accepts only exact argument shapes (item move, item list, vault list/create, account list, service-account create, --version); anything else is refused ("unsupported invocation").
• It applies the sandbox profile (version 1)(allow default)(deny file-read* (with no-report) (subpath (param "ONEPASSWORD_GROUP_CONTAINER"))).
• It builds a fresh environment (OP_CACHE=false, OP_BIOMETRIC_UNLOCK_ENABLED=true, OP_LOAD_DESKTOP_APP_SETTINGS=false).

How the rebuild applies it (app tools.rs build_command): on macOS every command runs under sandbox-exec with the same profile pattern, extended to deny reading and writing the app's own data folder (where API keys are saved), ~/.ssh, ~/.gnupg, ~/Library/Keychains, ~/.aws and ~/.config/gcloud. Paths are resolved first, because the sandbox matches real paths. The provider API-key variables are removed from the command's environment, and the app's data folder is also on the never-read list for file tools.

Read-only commands that run without asking: ls, pwd, cat, head, tail, wc, echo, rg, grep, find, file, stat, du, df, date, which, tree, sort, uniq, diff, git status/diff/log/show (own list). Always refused: sudo, su, rm -rf /, rm -rf ~, mkfs, dd, shutdown, reboot, diskutil erase. Never read or written: .git internals, .ssh, .gnupg, Keychains, .env files, *.pem, *.key, id_rsa/id_ed25519, .netrc.

Turns, permission hand-over, computers and app control

What counts as one turn

Rule	Value	Source
A turn starts with	a person's message, or a "wake" (a routine or other trigger firing)	main-app.cjs @3100283 w3n/P3n: turn counter n+=1 only for kind human or wake (SimulatedMsgReason.SUBSCRIPTION → wake)
A message sent while it works	steers the running turn and is not a new turn	same, P3n: e.turnSteer===!0 ? null (steer messages don't count)
Turn outcomes	success, cancelled, error	node-agent-coordinator wl=["success","cancelled","error"], read back by k6 as {turnId, outcome, settledAtMs}
Bot is idle only when	not running, no helper tasks running, not waiting for the person, no computer hand-off pending	node-agent-coordinator ZF: !isRunning && hasRunningSubagents!==true && awaiting===undefined && boxHandoff===undefined

Rebuild (app agent.rs, app.rs): a message typed during a turn goes into the turn's steer queue and reaches the model at its next step. If the model has just finished, the turn keeps going. Anything that arrives after the turn has settled starts the next turn. Each turn records {turn id, outcome, settled time}: stop is cancelled, a failure or stall is error, otherwise success.

Computers

Rule	Value	Source
Default place to work	the bot's own computer ("Bot 的電腦", yGkA3X)	settings map b$.computers / y$.botComputer
This Mac	only after the person turns on "允許 Grok Bot 在這台電腦上執行任務，而不只是在它自己的電腦上"	setting local-execution, ids fuUvu2 / Hd1KB+
Approvals name the machine	"允許 Grok Bot 在 {targetMachineDisplay} 上使用 {app} 嗎？", "請在 {targetMachineDisplay} 上回應"	ids eQViQE / ykDLyL
Taking over the bot's computer	"接管" (take over), then hand back	id yqwjpd; renderer handBack/handBackForeverBox @2601598 (not rebuilt; see below)

Rebuild: "Bot 的電腦" is a sealed folder per bot (~/AnyBot 工作區/bot-N). Its commands run under the macOS sandbox with nothing else in the home folder readable or writable, like a separate machine, so it works there without asking. "你的電腦" is this Mac with the layered permission rules, and only after the setting is on. Other computers are added in Settings → 電腦 and reached over SSH (read-only commands run directly, others ask). Every tool has a computer choice, so "在我的 Mac 上…" picks this Mac.

Permission hand-over

Rule	Value	Source
Rule choices	先詢問 / 每次詢問 / 一律允許 / 永不允許	ids 4YjKLA, 6CTZeX, NoKBgy, wvd4WD
Auto-review	"依照自訂規則審核 Bot 的操作", two lists: 「無需詢問直接允許」(continue automatically) and 「一律詢問」(stop and ask)	ids 9yhl+F, geCUKn/JOecNC, 1YRRmk/Pca/iV
Conflicts	"規則衝突時，「先詢問」優先"; built-in safety checks always apply	ids NFRGrQ, n9YiIv
Standing grants	"always allow" remembered (machine-scoped in the original)	fnd_12 recordLocalToolStandingGrant

Rebuild: built-in refusals run first. For an action that would ask, auto-review (when on) asks the model to match it against the two rule lists, and an "always ask" match wins. "Allow" continues without a card, and the result notes which rule matched. Otherwise the approval card names the computer.

Asking for permission when it's needed (pop-up)

The original asks on the spot and names the machine ("允許 Grok Bot 在 {targetMachineDisplay} 上使用 {app} 嗎？", eQViQE; "請在 {targetMachineDisplay} 上回應", ykDLyL). The rebuild never lets a step fail quietly for lack of permission:

• Computer tools are always offered to the model. If they're off for this bot, the step asks "允許 {bot} 使用電腦工具嗎？": 允許這一次 / 一律允許這個 Bot 使用電腦 (turns the bot's tools on) / 拒絕.
• If the step targets 你的電腦 while 在這台電腦上執行 is off, it asks "允許 {bot} 在你的電腦上執行任務嗎？" (wording from Hd1KB+): 允許這一次 / 一律允許 (turns the setting on) / 拒絕.
• Every request, including single actions, shows as a centred pop-up over a dimmed window, even when another bot's chat is open. The Dock icon bounces (RequestUserAttention) when AnyBot isn't in front. "稍後再決定" hides the pop-up; the chat card, the header pill "● 需要你允許" (click to reopen) and the sidebar's highlighted "需要你允許" stay until answered.
• The bot is told to just call the tool and let the app ask, rather than telling the person to change settings. Tested by missing_permission_pops_up_and_continues.

Notifications when you're away (decompiled)

sand_notification_settings.node (Mach-O arm64, 102 368 bytes, sha256 6b2b9fa3…). Strings in evidence ev_a3c3cb3d…, functions read with native_function_pseudocode:

Address	Function	Rule taken
0x35b4	getNotificationSettings(NotificationSettingsInfo&)	Only on macOS ≥ 10.14 (__isPlatformVersionAtLeast(1,10,14,0)) and only inside a real .app bundle (bundlePath must end in ".app"). Asks UNUserNotificationCenter and waits on a semaphore for at most 3 s (dispatch_time(0, 0xb2d05e00) ns). authorizationStatus 0..4 → notDetermined/denied/authorized/provisional/ephemeral, otherwise "unknown"; alertSetting 0..2 → notSupported/disabled/enabled, otherwise "unknown" (evidence ev_7feb06d3…)
0x3898	its completion block	Stores authorizationStatus and alertSetting, then signals the semaphore (evidence ev_32393aac…)
0x2de8	NotificationSettingsWorker::OnOK	Resolves {platform:"darwin", setting, alertSetting} (evidence ev_ec969729…)

From main-app.cjs:

Rule	Value	Source
Permission mapping	authorized/provisional/ephemeral → granted, denied → denied, notDetermined → undetermined	@3183391 hBt, mur
Banners allowed	only when authorized and alerts enabled	fBt
You count as present	signed in, screen not locked, not idle, window alive	K4
Idle after	90 s without input	Z_e=9e4 (10 min cBt=10*6e4 while a phone push is being held)
Presence re-checked every	10 s	uBt=1e4
Setting text	"Bot 完成任務或等你處理時通知你"	id ttdOeI

Rebuild (notify.rs): presence = window in front and input within 90 s (idle read from macOS HIDIdleTime every 10 s). When you're not present and a bot needs permission, or finishes a turn, a macOS banner appears with a sound, on top of the pop-up and the Dock bounce (Settings → 一般 → 通知, on by default). A build-folder app isn't a .app bundle, so, as the original's module shows, it can't read its own notification permission. Banners go through macOS's display notification instead, which may need allowing once under System Settings → Notifications. The 3 s settings read and the permission mapping aren't used for that reason.

直接操作 (work like Grok Bot without a stream of questions)

Why the original rarely asks: it does most work on its own cloud computer and browser ("Bot 的電腦"), so nothing on the Mac needs permission. Working on the Mac is one switch (local-execution, Hd1KB+), after which auto-review checks actions instead of the person ("讓 Grok Bot 在你的電腦上開啟 檔案和執行任務。自動審核仍會先檢查所有操作", ENHi8c; hrkSSQ). Per-app grants are remembered (recordLocalToolStandingGrant, listComputerUseAllowedApps, fnd_12).

Rebuild: Settings → 電腦 → ⚡ 直接操作, or the "⚡ 全部允許，之後直接操作" link on any request.

• One switch turns on 在這台電腦上執行, every bot's computer tools and auto-review. Running turns stop asking at once, and other bots' waiting "may I use the computer" requests are answered yes.
• Actions that would ask go ahead with the note "直接操作模式：已自動允許". The only exceptions are actions that match an "always ask" rule (checked by the model, as in auto-review). The default rules are own wording: 刪除檔案或資料夾 / 付款、購買或轉帳 / 用我的帳號發文、留言，或傳訊息給別人.
• Still blocked: the built-in refusals (sudo, mkfs, rm -rf /…), secret files and AnyBot's own data (sandbox), as in the original ("內建的安全檢查一律有效", n9YiIv).
• macOS's own one-time prompt to let AnyBot control a browser can't be skipped by any app.
• Tested by direct_mode_asks_nothing_but_still_blocks_danger.

Admin locks (decompiled). sand_notification_settings.node managedPolicyValueSync at 0x1870 (evidence ev_86419910…) takes (productName, valueName), both of which must be strings (napi type 4), otherwise it throws "managed_policy_value_sync(productName, valueName)". On macOS it then returns null: it reads nothing on a Mac. The app side (main-core.cjs @727949, EZ/TZ/Ak/mZ/gZ) reads policy from macOS user defaults (systemPreferences.getUserDefault(key, "string"), which MDM profiles can force), from ~/.cursor/policy.json on Linux, and from the native call on Windows. Missing or blank values mean unmanaged, a valid value means pinned, and anything else is invalid (its URLs must be plain https origins).

Rebuild (policy.rs): the same three kinds for two switches, read from macOS defaults domain com.anybot.AnyBot (AllowDirectMode, AllowLocalExecution; Linux: ~/.anybot/policy.json):

• unmanaged lets the person decide; pinned true/false fixes it; invalid locks it off (fail safe).
• A locked switch is greyed out with "🔒 由你的管理員設定，無法變更". The ⚡ link is hidden.
• A locked "你的電腦" is refused at once instead of asking. Locks are re-read each time Settings opens.
• Example: defaults write com.anybot.AnyBot AllowDirectMode false.

Websites and the person's browser

The original reaches sites through its own browser (its old Chrome login copy is retired, see below). The rebuild (web.rs) gives every bot:

• web_fetch: public pages as text (20 s timeout, 3 MB read, 20 000 characters to the model: estimated). No permission needed.

• browser_open: opens a link in the person's own browser on this Mac (Chrome, Arc, Edge, Brave, Chromium or Safari, whichever is open), where they're already logged in, and waits 4 s (estimated).

• browser_read: title, address and visible text of the current tab, via AppleScript. It asks first (grant 「讀取瀏覽器分頁」).

• Both browser tools count as working on 你的電腦, so the computer pop-ups apply when those are off. macOS asks itself the first time AnyBot controls a browser. If that's refused (-1743), the app opens System Settings → 隱私權與安全性 → 自動化 and says what to switch on. If page text is blocked, it says which menu item to turn on (Chrome: 檢視 → 開發人員 → 允許來自 Apple 事件的 JavaScript).

• Which browser (decompiled). sand_window_capture.node (Mach-O arm64, 128 064 bytes, sha256 f2b48533…; strings in evidence ev_6c197ec3…):

  Address	Function	Rule taken
  0x52c0	listWindows()	CGWindowListCopyWindowInfo(0x11, 0): on-screen windows only (0x1) without desktop elements (0x10), front to back. A window is kept only if its alpha > 0 and its bounds have width > 0 and height > 0. Each entry records window id, owner pid, layer, bounds and owner name (evidence ev_fbc46bcb…)
  0x5258	screenCaptureAccess()	macOS ≥ 14 (__isPlatformVersionAtLeast(1,14,0,0)), else 2 = unsupported; otherwise CGPreflightScreenCaptureAccess() ^ 1 (0 = granted, 1 = not granted) (evidence ev_e0e9c7c2…)
  0x651c	statusForError(NSError*)	error code −3801 (the user declined capture) → status 2 "denied"; any other → 5 "failed" (evidence ev_7c417898…)

  Rebuild: browser_read/browser_open read the same front-to-back window list (through macOS's own JavaScript bridge) with the same filter, plus layer 0 for ordinary app windows (ours), and use the browser whose window is closest to the front, the tab the person is actually looking at. If no browser window is visible they fall back to the first open browser, then Chrome, then Safari. Screen capture itself isn't rebuilt: reading the page text needs no screenshot.

• The bot is told not to say it has no tools, and to try these first. Checked against xAI grok-4.7: "幫我看一下我的threads 看一下我的帳號" now gives browser_open(threads.net) + browser_read.

AnyBot's own browser (replaces driving the person's browser)

Grok Bot never asks the person to change browser settings because it browses in its own browser (its Chromium-based browser and webviews on the bot's computer). Driving the person's Chrome through AppleScript, the first approach here, needed Chrome's "允許來自 Apple 事件的 JavaScript" plus a macOS Automation prompt.

Copying logins from Chrome: retired in the original, not rebuilt.

• Native main program (Grok Bot Mach-O, opened with core_target_open): searching its strings for browser / chrome / cdp / devtools / remote / port / debug finds 0 strings (evidence ev_3dc3f004…), so no browser or cookie logic lives in native code; it's all in the JavaScript.
• The renderer still has the old approval card (chunk-view @3041: 「{botName} 想要使用你現有的登入」, 「從你電腦上的 Chrome 複製 Cookie…」, 檢視網站 / 允許一次 / 一律允許 / 拒絕, sites grouped by Chrome profile), but the error catalogue in main-core.cjs and index.eager-app (domain chrome-import, codes SAND-E0801 … SAND-E0812: cookieApprovalNoMachine … chromeCookieImportFailed) marks every one "retired: the agent-prompted cookie sync that raised it was removed" / "retired: the Chrome cookie import that raised it was removed", and the inject was behind a gate (sand_import_chrome_cookies, SAND-E0811).
• So the shipping original no longer copies Chrome cookies. The rebuild matches that: nothing is copied, and the bot is told never to offer it. (Also: this Mac's Chrome/Brave data folders refuse reads without Full Disk Access, "Operation not permitted", so it couldn't work quietly anyway.) The person logs in once in AnyBot's own browser window instead.

Rebuild (botbrowser.rs): AnyBot starts a separate Chrome-family profile (Chrome, Brave, Edge or Chromium, whichever is installed) as its own browser window, with logins kept in …/AnyBot/browser. It talks to it over Chrome's DevTools protocol on local port 9333 (estimated, overridable for tests):

• browser_open: starts the window (waits up to 20 s, estimated) or adds a tab (PUT /json/new?url).
• browser_read: picks the first real page tab (/json/list) and reads {title, location.href, document.body.innerText} with Runtime.evaluate (20 s limit, estimated).
• No browser setting, no Automation prompt, no "your computer" question: it's the bot's browser. The person logs in to a site in that window once; a short page mentioning 登入 / log in gets a note asking them to.
• The bot is told never to send the person to browser menus. The AppleScript path remains only as a fallback when no Chrome-family browser is installed (Safari only).
• Checked live against a hidden Chrome: example.com was read as "標題：Example Domain".

Browser profiles (設定檔)

Grok Bot lets the person use any Chrome profile because on "your computer" it drives the real screen through its Computer Use helper app (local-exec-daemon: Grok Bot Computer Use, co.anysphere.grok-bot-computer-use, CUGrokBotService): it clicks in their normal Chrome like a person would. The original has no browser-profile code of its own (no --profile-directory, Local State or info_cache anywhere; profileDisplayName only on the retired login-copy card). AnyBot doesn't control the screen, and its own browser couldn't see the person's Chrome profiles (macOS refuses other apps …/Google/Chrome/Local State: "Operation not permitted"). So (rebuild, estimated rules):

• AnyBot's browser has its own profiles: 「預設」 (the existing …/AnyBot/browser folder, logins kept) plus any added ones in …/AnyBot/browser-profiles/<name>. Each is its own window with its own logins.
• Names: 1–30 characters, no / or :, not starting with .; matched ignoring case.
• 「預設」 keeps port 9333; added profiles start with port 0, so Chrome picks a free port and writes it to DevToolsActivePort in the profile folder, which AnyBot reads back (checked live: Chrome 156 wrote 62337 and answered on it).
• The profile in use is remembered in …/AnyBot/browser-profile.txt.
• Bot tools: browser_profiles (list / add / use, no permission needed: it's the bot's browser), and an optional profile on browser_open / browser_read (opening in a profile makes it the one in use). The bot is told to use these when the person says profile / 設定檔 / another account.
• Settings → 電腦 → 「AnyBot 瀏覽器設定檔」: pick the one in use, 「開啟視窗」 to log in, 「新增設定檔」. Removing a profile isn't offered (it would delete its logins).

「你的瀏覽器」: reading the person's own Chrome, any profile (decompiled)

How Grok Bot reads the person's real Chrome in whatever profile is open: its Computer Use helper (Helpers/Grok Bot Computer Use.app/Contents/MacOS/CUGrokBotService, Mach-O fat, sha256 1004a8cb…) turns on Chrome's accessibility tree and reads the screen's elements. Strings: com.google.Chrome, com.google.Chrome., Google Chrome Framework.framework (evidence ev_75dff652…), AXManualAccessibility / AXEnhancedUserInterface (ev_bef6c29e…), the 3 framework names (ev_a8cda95a…). Functions read:

Address	Function	Rule taken
0x1000a1b6c	CURendererApp.isRenderer(bundleIdentifier:executablePath:)	renderer if bundle id == com.github.Electron or == com.google.Chrome, or has prefix com.google.Chrome., or the executable path contains /Electron.app/Contents/MacOS/Electron, else isRendererBundle (evidence ev_4973f594…)
0x1000a19ec	CURendererApp.isRendererBundle(atPath:)	<bundle>/Contents/Frameworks/<name> exists for one of 3 names: Electron Framework.framework, Chromium Embedded Framework.framework, Google Chrome Framework.framework (evidence ev_f0dc9836…)
0x1000a1cdc	CURendererApp.isRenderer(NSRunningApplication)	takes the running app's bundle id, bundle URL path and executable URL path, then calls the rule above (evidence ev_179b4f10…)
0x1000a1554	CURendererAccessibility.writeFlags(on:)	AXUIElementSetAttributeValue(app, "AXManualAccessibility", on) then (app, "AXEnhancedUserInterface", on); result from both error codes (evidence ev_f661d29e…)

Rebuild (axread.rs), used by the profile choice 「你的瀏覽器」 (aliases 我的 Chrome, 你的 Chrome…):

• Same renderer rule (is_renderer, constants copied as written) and the same two flags, in order, on the person's browser before reading. Safari etc. need no flags.
• macOS asks once for 輔助使用 (AXIsProcessTrustedWithOptions with the prompt). If it's off, AnyBot opens 系統設定 → 隱私權與安全性 → 輔助使用 and says to switch on AnyBot. No browser setting is needed.
• Reads the focused window → first AXWebArea → text of AXStaticText (AXValue), one line per group; title AXTitle, address AXURL. Up to 20 000 elements, depth 80, 5 tries 0.7 s apart while Chrome builds the tree, 2 s per answer (all estimated).
• The person's browser process is told apart from AnyBot's own window by its arguments (AnyBot's runs with --user-data-dir=…/AnyBot/browser; helper processes carry --type=).
• browser_open on 「你的瀏覽器」 starts the browser's own executable with the link, so Chrome hands it to the person's running window (their normal profile) instead of AnyBot's window.
• It counts as using 你的電腦: the computer pop-ups apply and reading asks first (「讀取你瀏覽器目前 分頁」), like before. Switching Chrome profiles is done by the person in Chrome; the bot reads the window in front.
• Not checked live yet: this test process isn't allowed 輔助使用 (trusted=false).

Talking to the bot runs the app

Routines are made in chat ("例行任務是這個 Bot 依排程重複執行的任務。請在聊天中請它設定一個。", ZJmAzX), and the primary bot can coordinate other bots (mQQ/Uq). App tools in the rebuild (appctl.rs): list_routines, create_routine, update_routine, delete_routine (asks first, wording VAgxC4), run_routine_now, list_bots, create_bot, update_bot (provider, model, name, pin, default computer), message_bot (wakes another bot), list_computers, update_settings (theme, accent, time zone). Turning on "在這台電腦上執行" stays person-only.

Routine schedules

Shape from index.eager-app @1508626 (Prt, Irt): {frequency: daily|weekly|monthly|yearly, interval, daysOfWeek: MO..SU (yA), monthDay | weekdayOfMonth {week, day}, month, time "HH:MM", timezone}. Descriptions use the original's zh-TW strings: 每天 / 每{n} 天 / 每個工作日 / 每週的{days} / 每月{d}日 / 每月的{week}{day} / 每年{date}, then "{repeats} {time}" and "（{zone}）" when not the person's time zone. "Every weekday" means exactly MO–FR (isEveryWeekday, WORKWEEK). Next-run rules (ours): intervals count from the creation date; a month day past the month's end runs on the last day; summer-time gaps take the earliest valid time. A routine that comes due while the bot is busy waits until it is idle.

Screen control on 你的電腦 (computer use)

The original's local daemon (local-exec-daemon main.cjs) drives its Computer Use helper with these tools; the rebuild (computer.rs) uses the same names and arguments: computer_use_screenshot {}, computer_use_click {method: coordinate, x, y, button, count, modifier_keys}, computer_use_scroll {x, y, direction, amount, modifier_keys}, computer_use_mouse_move {x, y}, computer_use_drag {button, path, modifier_keys}, computer_use_typing {value}, computer_use_press_key {key, hold_duration_ms} (main.cjs @2860904).

• Screenshot size, zct (main.cjs): long edge fitted to 1024 (Gct); if the short edge is under 8 (Hs) nothing is resized; after scaling, an edge under 8 is raised so the short edge is 8. Largest image 1 048 576 bytes (mg = 1024*1024). JPEG is tried at quality 85, 70, 55 ($3r) and the first that fits is used, else the smallest one if it's under the cap (j3r).

• Rebuild: screencapture -x -m of the main screen, fitted and encoded by those rules, sent to the model as a picture (Claude: inside the tool result; OpenAI-style: one user message with the pictures right after the run of tool results). Only the newest 3 screenshots are sent; older ones say 「較早的截圖已省略」 (estimated). Screenshots aren't saved with the chat.

• Coordinates are pixels of the latest screenshot; AnyBot turns them into screen points with the screen size (CGDisplayBounds) ÷ picture size. Shortcuts like cmd+shift+t use the US key codes.

• Mouse and keyboard timing, decompiled from CUGrokBotService (evidence ids after each):

  Address	Function	Rule taken
  0x100010120	CUActuator.click(pid:screenPoint:windowBounds:…button:count:holdSeconds:)	event source CGEventSourceCreate(1) (HID system state) with CGEventSourceSetLocalEventsSuppressionInterval(0); press → hold → release where hold = holdSeconds > 0 ? holdSeconds : 0.03; count clicks with 0.08 s between them; error "Could not create click event"; background windows get a window-local click (fields 91/92 = window id, "skylight-no-raise") (ev_f3077201…)
  0x100010a24	CUActuator.typeCharacters(pid:text:)	empty text → "value is required and must be a non-empty string"; same event source, then postChunks (ev_77b2182b…)
  0x1000beb00	CUTypedCharacters.utf16Chunks	chunks of at most 20 UTF-16 units (buffer 0x14; a new chunk when the next character would reach 21), never splitting a character (ev_0dce1c89…)
  0x1000beebc	CUTypedCharacters.postChunks	each chunk: CGEventCreateKeyboardEvent(src, 0x80 = 128, down/up) + CGEventKeyboardSetUnicodeString, flags 0; down → 0.035 s → up; 0.02 s between chunks; error "Could not create character keyboard event" (ev_714c5253…)
  0x100031764	CUCompanionToolService.handlePressKey	presses a list of keys in order: each down → 0.035 s → up, 0.02 s between keys; result "Pressed {keys joined by spaces}."; error "Could not create keyboard event" (ev_730d67a4…)

  | 0x10008c34c | CURemoteEventPoster.drag(path:button:steps:holdSeconds:flags:) | fewer than 2 points → "Drag path requires at least two points."; mouse down at the first point (click state 1), then if hold > 0 sleep it in 10 000 µs slices, then for every segment post steps dragged events at start + delta × i / steps (i = 1…steps, steps at least 1), then mouse up at the last point (ev_f0d60f2e…) | | 0x10009dee4 | CURemoteToolService.handleDrag (closure) | calls drag with steps 6 and holdSeconds 0.04; result "Dragged from (%.0f, %.0f) to (%.0f, %.0f) with left/right/middle button." (ev_65c07c1e…) | | strings | handleScroll / handleDrag | "direction must be up, down, left, or right.", "amount must be an integer.", "path must be an array of at least two {x,y} points in model coordinates.", "Could not create scroll event" (ev_0b3df00c…) |

  Drag in the rebuild: same press, 0.04 s hold, 6 interpolated steps per segment, release at the end, and the reply 「已從 (x, y) 拖曳到 (x, y)（左鍵）」. Scroll refuses a non-integer amount.

  Address	Function	Rule taken
  0x10009e200	CURemoteToolService.handleScroll	direction is lowercased and must be up/down/left/right; amount must be an integer, default 3, kept to 1…20 (max(amount,1), min(…,20)); distance = (amount + amount) << 3 = amount × 16 pixels; down and right are negative; x and y "must be provided together", and without them the current pointer position is used ("Could not read the current cursor position."); needs Accessibility and Screen Recording (ev_98625ed7…)
  0x10009e998	handleScroll closure	posts a mouse-moved event (type 5) at the spot, then CGEventCreateScrollWheelEvent2(src, units 0 = pixel, wheels 2, vertical, horizontal, 0) at the same spot with the modifier flags; result "Scrolled {direction} x{amount}." (ev_ee9d8372…)

  Rebuild scroll: the same default, range, 16-pixel steps in pixel units, the both-or-neither x/y rule (no screenshot needed when scrolling where the pointer is), and 「已捲動 down ×3。」. Rebuild: the same event source, the same holds and gaps, the same chunking on key 128, and a key press may be several keys separated by spaces (cmd+a delete). hold_duration_ms replaces the 0.035 s hold (at most 5 s, estimated). Window-local background clicks (clicking without bringing the window forward) aren't rebuilt: AnyBot clicks where the pointer is, like a person. Pauses between mouse-move and drag steps are 8 ms (estimated).

• Permissions: macOS asks once for 螢幕與系統錄音 (screenshots, CGPreflightScreenCaptureAccess like screenCaptureAccess() @0x5258) and once for 輔助使用 (mouse and keyboard); if off, AnyBot opens the right System Settings pane and says what to switch on. In AnyBot, looking at the screen asks once (grant 「看你的螢幕畫面」) and using the mouse/keyboard asks once (「操作你的滑鼠和鍵盤」), both with "always allow"; 直接操作 skips the questions except for "一律詢問" rules. It always counts as 你的電腦, so the computer pop-ups and admin locks apply.

• Needs a model that can see pictures.

• Not checked live: this test process has neither permission.

Still different from the original

• "接管" (take over the bot's computer) is not rebuilt: the bot's computer here is a sealed folder, not a cloud machine with a screen. Screen control works on 你的電腦 only.
• Routine triggers from events (GitHub, PagerDuty, Sentry: GITHUB_EVENT_KINDS etc.) are not rebuilt; only time schedules.
• The look still uses the estimated layout: the signed-in original's window hasn't been captured.

Restarting and recovering

From the native main program (decompiled again for this feature)

Contents/MacOS/Grok Bot. native_strings_find for relaunch|restart|ELECTRON|dev/null|crash finds two strings (evidence ev_6af348eb…), and both lead to these functions:

Address	Function	Rule taken
0x1000004c0	sub_1000004c0	Before anything else, for fd 0/1/2: if fstat fails with errno == 9 (EBADF), freopen("/dev/null", …), so a copy started without terminal streams still has valid ones (evidence ev_29ffc0d8…)
0x100000460	entry	Calls 0x1000004c0, then a set ELECTRON_RUN_AS_NODE (fuse on, non-empty) changes how the program starts (ElectronInitializeICUandStartNode instead of ElectronMain) (evidence ev_7c151be5…)

From the app code

Rule	Value	Source
Relaunch helper	detached shell, all output ignored: spawn(shell, ["-c", script, "grok-bot-relaunch", pid, app, …args], {detached:true, stdio:"ignore"})	main-app.cjs @3195964 Pur
Wait before starting	while kill -0 "$pid" 2>/dev/null; do sleep 0.2; done; exec "$app" "$@": the new copy starts only after the old one exited, polled every 0.2 s	same, PBt
Inherited files	closes fds > 2 first (rEe, Linux /proc only)	same
Button while it happens	"正在重新啟動…" (Restarting…)	renderer ljn → id fvg2KT
Bot's computer stuck	"Grok Bot 的電腦卡住時，從你上次儲存的快照重新啟動它"; recovering keeps files and logins, removes installed apps and packages	ids O+wR5I, ixKoax

How the rebuild applies them

• 重新啟動 AnyBot (Settings → 一般): stops running turns as cancelled and background commands, saves, then starts a detached /bin/sh helper. The helper waits for this copy's pid to disappear, checking every 0.2 s, and then starts the app, so the two copies never overlap and the last save can't be overwritten. Its input and output go to /dev/null. Start-up switches (ANYBOT_SHOT_VIEW, the per-command tags, ELECTRON_RUN_AS_NODE) are removed so the new copy opens normally. The button reads "正在重新啟動…" while it happens. Tested by relaunch_waits_for_the_old_copy.
• 重新啟動這個 Bot (⋯ menu): ends the bot's turn as cancelled, stops its background commands and everything they started (by its conversation tag), and marks half-finished replies as interrupted. Chats and the files on its computer are kept. The snapshot "recover" step isn't rebuilt: the bot's computer here is a folder, not a machine image.
• Interrupted turns on load: a reply that was still streaming when the app closed is saved empty and can't continue. On load it becomes "（這次的回應被中斷了…）" with an error settlement, so "重新產生" appears. A message with no reply shows "重新傳送" (MyjAbr).

Versions and updating

Native main program: native_strings_find for version|update|0.78|x.y.z in Contents/MacOS/Grok Bot finds 0 strings (evidence ev_df0e0f59…). The version (0.78.1) lives only in Info.plist (CFBundleShortVersionString), and all update logic is in main-app.cjs.

Rule	Value	Source
First check after launch	30 s	main-app.cjs @3372407 bhr=3e4 (initialCheckDelayMs)
Then every	1 h + random 0–5 min	khr=3600*1e3, Ihr=300*1e3, nextPeriodicDelayMs = interval + floor(random·jitter)
Apply by itself only when	auto-update on and update ready and (screen locked or screensaver running) and idle ≥ 600 s and no agent work	@3365216 uQt, phr, pQt=600, uhr (confirmed-idle)
Auto-update default	on	getAutoUpdateWhenIdle?.() ?? true
Screen locked	powerMonitor.getSystemIdleState(1) === "locked"	Aj/Cle
Screensaver running	pgrep -x ScreenSaverEngine (2 s timeout)	NRn, DRn
Labels	"重新啟動以更新" (FzpXvM), "正在重新啟動…" (fvg2KT), "在你離開時自動更新用戶端" (4vprnG)	catalogs

Rebuild: the version shown is the program file's build time (sidebar footer, Settings → 一般 → 版本). A newer build on disk shows the sidebar button "⬆ 重新啟動以更新（time）". Noticing it is a file check every 10 s (estimated; it's local and cheap). Switching by itself follows the original's schedule: first try 30 s after start, then hourly plus jitter, and only when the screen is locked or the screensaver is running (ioreg session flag / pgrep -x ScreenSaverEngine), idle ≥ 600 s, and no bot is working or waiting for you. It uses the same wait-then-start relaunch helper. Setting: 在你離開時 自動更新用戶端 (on by default). Tested by update_applies_only_when_truly_away.

Left out of this version

Done since this list was first written: routines (例行任務), screen control on 你的電腦, AnyBot's own browser with profiles, reading the person's own Chrome, removing an added browser profile. Still left out: Slack/Telegram/WhatsApp/email messaging, team bots and sharing, payments (these need the original's cloud service and accounts), routines started by events (GitHub, PagerDuty, Sentry need webhooks into that cloud), "接管" of a cloud bot computer, voice input, file attachments, and the exact signed-in window layout and dark-theme colours (never captured).

Look check (full pass over every screen)

• One font for everything: PingFang TC Regular (macOS system asset, found under /System/Library/AssetsV2/com_apple_MobileAsset_Font*/…/PingFang.ttc, face 2), falling back to Hiragino Sans GB. Before, English came from egui's own font and Chinese from a fallback, on different baselines and sizes. egui's fonts stay behind it only for missing symbols.
• That font's 「·」 already has space on both sides, so separators are written without extra spaces.
• Sidebar names and previews end in "…" before the status dot instead of being cut mid-letter.
• A step's copy/model line only shows under the bot's final words, so a tool's result sits right under the step that asked for it.
• Settings and Bot 設定 stop 80 px short of the window height (estimated) and scroll inside; the provider list is 200 px wide (estimated) so 「自訂（OpenAI 相容）」 fits on one line; all avatar shapes fit on one row; the model list button says 「選擇」.
• Decompile note: the native main program (Grok Bot, Mach-O 53 040 bytes, sha256 df5b07de…) is only Electron's launcher: a search for font / width / height / title finds 0 strings (evidence ev_7cf8e974…). The look lives in the renderer styles (index-Dh7EWA8t.css), read here:
  • Type scale --sand-font-size-*: xxs 11, xs 12, sm 13, base 14, lg 15, xl 17, xxl 22, xxxl 26 px; --sand-line-height-*: 16, 16, 18, 20, 22, 24, 28, 32 px.
  • --cursor-font-family-sans: -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif, which on a zh-TW Mac means SF for Latin and PingFang for Chinese. --cursor-font-family-mono: ui-monospace, SFMono-Regular, Menlo, Monaco, Consolas, ….
  • Rebuild: body/buttons 14 (base), small 12 (xs), headings and window titles 17 (xl), code 13 (sm) on 18 px lines, chat text 15 (lg) on 22 px lines, Markdown headings 17 on 24 px lines; code in SF Mono (/System/Library/Fonts/SFNSMono.ttf, then Menlo). Text stays in PingFang TC for both scripts, which matches -apple-system's Chinese and is close to SF for Latin (egui can't line up two fonts' baselines the way the browser does).