Gateway descriptor version 3 rejected by 0.12.4 ("Unsupported Grok Bot gateway descriptor version 3"): please release #143 #149

Since about 10 Oct 2026, after a Grok Bot desktop update on macOS, every gateway command in grok-bot-cli 0.12.4 (the latest on npm) fails:

$ gbot doctor
gateway auth: present
Grok Bot app session: present but unusable: Unsupported Grok Bot gateway descriptor version 3.

What changed in v3

I only looked at structure and field names. The wrapper is the v2 layout, with a savedAtMs added to each entry:

{ "version": 3, "entries": { "<hash>": { "savedAtMs": <number>, "encrypted": "v10…" } } }

The decrypted payload still has baseUrl, token and headers (x-anyrun-network-token). It also adds a vncProxy object (primaryUrl, forkBaseUrl, networkToken), which gbot doesn't use. baseUrl is still https on a Cursor host, so the URL policy passes it unchanged.

Fix

encryptedPayload() in src/core/app-session.js needs to accept version === 3 and read it the same way as v2. The single-entry / AMBIGUOUS_ENTRIES check stays as it is. #143 does exactly this. I applied the same two-line change to the 0.12.4 dist bundles (bin/gbot*.mjs, mcp/mcp-grok-bot-*.mjs). After that, gbot doctor reports Grok Bot app session: usable, and gbot send / gbot thread round trips work again on macOS.

One thing to watch if anyone else patches the published package by hand: scripts/gbot-relay.mjs is checked against the sha256 in agent-bundle.manifest.json at run time. Patching that file without updating the manifest breaks the relay with "Packaged relay worker checksum mismatch". #143 rebuilds the artifact, so it doesn't hit this.

Could #143 be merged and released? #145 includes the same v3 change plus the missing-descriptor fallback (#147), if you'd rather take that one.