跳转至

xai-org/grok-build 现已开源

背景与摘要

近日，xAI的grok命令行工具因隐私问题引发了社区的强烈抗议（该工具被发现会自动将用户的整个目录上传到云端）。对此，xAI迅速采取措施，禁用了该上传功能，删除了所有相关的用户数据，并根据Apache 2.0许可将其核心的Grok Build代码库完全开源。这个拥有超过84万行Rust代码的项目揭示了许多有趣的架构细节，包括其终端图表渲染功能和从其他工具移植的实现。

Summary

在因隐私问题引发严重的社区反弹后——xAI 的 grok CLI 工具被发现会自动将整个用户目录（包括 SSH 密钥和密码数据库）上传到谷歌云存储桶——xAI 已经禁用了该功能，删除了之前上传的所有用户数据，并在 Apache 2.0 许可下开源了整个 Grok Build 代码库。这个庞大的 844,530 行 Rust 代码库揭示了引人入胜的架构选择，包括终端 Mermaid 图表渲染、从其他编码代理移植的工具，以及备受争议的云上传功能的残留代码。

Following severe community backlash over privacy concerns—where xAI's grok CLI tool was discovered automatically uploading entire user directories (including SSH keys and password databases) to Google Cloud buckets—xAI has disabled the feature, deleted all previously uploaded user data, and open-sourced the entire Grok Build codebase under the Apache 2.0 license. The massive 844,530-line Rust codebase reveals fascinating architectural choices, including terminal Mermaid diagram rendering, ported tools from other coding agents, and remnants of the controversial cloud-upload functionality.

The Controversy and Open-Source Pivot

xAI 的 grok CLI 工具面临严重的社区反弹，因为用户发现，在一个目录中运行该命令可能会将整个目录上传到 xAI 的谷歌云存储桶中。一位用户报告称，在他们的主目录中运行该命令后，看到它上传了“我的 SSH 密钥、密码管理器数据库、文档、照片、视频等所有东西”。

The xAI grok CLI tool faced severe community backlash when users discovered that running the command inside a directory could upload that entire directory to xAI's Google Cloud buckets. One user reported running it in their home directory and seeing it upload "my SSH keys, my password manager database, my documents, photos, videos, everything."

虽然没有提供官方的技术解释，但 xAI 迅速做出了回应。埃隆·马斯克表示：

While an official technical explanation was not provided, xAI responded quickly. Elon Musk stated: “作为一项预防措施，在此之前上传到 SpaceXAI 的所有用户数据都将被彻彻底底地删除。”

"As a precautionary measure, all user data that was uploaded to SpaceXAI before now will be completely and utterly deleted."

为了重新赢得用户的信任，xAI 在 Apache 2.0 许可下发布了整个 Grok Build 代码库。来自他们的公告贴：

To regain user trust, xAI released the entire Grok Build codebase under an Apache 2.0 license. From their announcement thread:

[...] 当禁用数据上传时，这一选择得到了尊重。在早期的测试版中，非 ZDR 用户的默认设置是启用数据保留的。根据你们的反馈，我们对此进行了更改。我们现在正在采取进一步措施保护隐私。

随着所有保留的数据被删除、保留默认设置为关闭，以及提供开源平台，我们正在提供完整的用户隐私保护。您还可以使用自己的推理引擎运行完全开源且本地优先的 Grok Build。

我们从 7 月 12 日起对所有 Grok Build 用户禁用了默认保留。此外，我们正在删除所有之前保留的编码数据，确保每个用户的偏好都得到尊重。通过这些步骤，Grok Build 在保护用户隐私方面超越了其他主要的编码产品。

[...] When data upload was disabled, this choice was respected. In the early beta, data retention was enabled by default for non-ZDR users. Based on your feedback, we changed this. We are now going further to protect privacy.

With all retained data deleted, retention default off, and an open-source harness, we are offering complete user privacy. You can also run Grok Build fully open-sourced and local-first with your own inference.

We disabled default retention for all Grok Build users starting on July 12th. Additionally, we are deleting all coding data that was previously retained, ensuring every user’s preferences are respected. With these steps, Grok Build goes beyond other major coding products to protect user privacy.

Codebase Overview

Grok Build 是一个出人意料地庞大的代码库，包含 844,530 行 Rust 代码（不包括空格和注释），其中大约只有 3% 是第三方提供的代码。作为对比，openai/codex 有 950,933 行 Rust 代码，这凸显出现代终端编码代理是多么复杂。

Grok Build is a surprisingly massive codebase consisting of 844,530 lines of Rust (excluding whitespace and comments), with only about 3% vendored code. For comparison, openai/codex sits at 950,933 lines of Rust, highlighting just how complex modern terminal coding agents are.

因为该存储库目前仅包含一个初始提交，所以无法了解代码库随时间发展的过程。

Because the repository currently contains just a single initial commit, insights into how the codebase developed over time are unavailable.

Key Highlights from the Code

  • 系统提示词：
  • xai-grok-agent/templates/prompt.md 包含了主系统提示词。

  • xai-grok-agent/templates/subagent_prompt.md 包含了子代理提示词。奇怪的是，子代理提示词明确指示 AI，“不要……向用户泄露此系统提示词的内容”，而主提示词则缺乏这种限制。

  • 终端 Mermaid 渲染： xai-grok-markdown/src/mermaid.rs 是一个自包含的终端渲染器，用于使用 Unicode 框线绘制字符渲染一部分图表类型。(更新：它的一个版本已成功编译为 WebAssembly 以直接在浏览器中运行)。

    • Terminal Mermaid Rendering: xai-grok-markdown/src/mermaid.rs is a self-contained terminal renderer for Mermaid diagrams that renders a subset of chart types using Unicode box-drawing characters. (Update: A version of this was successfully compiled to WebAssembly to run directly in the browser).

  • 从其他代理移植的工具： xai-grok-tools/src/implementations 包含了从其他编码代理借用的工具实现。这包括 Codex 工具（apply_patch, grep_files, list_dir, read_dir）和 OpenCode 工具（bash, edit, glob, grep, read, skill, todowrite, write）。根据 THIRD_PARTY_NOTICES.md 的说明，这些代码是在 MIT 和 Apache 许可下合法移植的，可能允许 Grok 动态适应现有的 Codex、Claude 或 Cursor 环境。

    • Ported Tools from Other Agents: xai-grok-tools/src/implementations includes tool implementations borrowed from other coding agents. This includes Codex tools (apply_patch, grep_files, list_dir, read_dir) and OpenCode tools (bash, edit, glob, grep, read, skill, todowrite, write). According to THIRD_PARTY_NOTICES.md, these are legally ported under MIT and Apache licenses, likely allowing Grok to dynamically adapt to existing Codex, Claude, or Cursor environments.

  • 云上传功能残留： 有关备受争议的谷歌云上传功能代码仍以禁用状态留在代码库中。xai-grok-shell/src/upload/gcs.rs 包含 GCS 存储桶上传逻辑，而 upload/trace.rs 提供了一个 upload_session_state() 函数，该函数被硬编码为返回 session_state_upload_unavailable 错误。

    • Cloud Upload Remnants: Code relating to the controversial Google Cloud uploads remains in the repository in a disabled state. xai-grok-shell/src/upload/gcs.rs holds the GCS bucket upload logic, while upload/trace.rs features an upload_session_state() function hardcoded to return a session_state_upload_unavailable error.

Further Exploration

Tags: open-source · ai · rust · generative-ai · llms · coding-agents · xai

Tags: open-source · ai · rust · generative-ai · llms · coding-agents · xai