Reproduced on Linux with Node 24.22.1 and npm 12.2.0 at d53873b6: Update now left the binary at 1.0.56 while npm recorded 1.0.70. With the change from #24246, the same app operation advanced both to 1.0.70 and cleared the update indicator. Runtime proof.
Grok update reports success on npm 12 but leaves the old binary running#24249
What happened
On macOS, Grok's provider card offered an update from 1.0.56 to 1.0.67. Clicking Update reported "Update command completed, but T3 Code still detects an outdated provider version." Grok stayed on 1.0.56.
Diagnosis
T3 updates Grok by running grok update. For an npm install (installer = "npm" in ~/.grok/config.toml), Grok runs npm install -g @xai-official/grok itself.
npm 12 blocks dependency install scripts that aren't listed in allowScripts, and still exits 0. @xai-official/grok's postinstall is the step that copies the new binary into $GROK_HOME/bin and points the grok symlink at it. With it blocked, npm records the new package version, but the launcher keeps running the old binary in ~/.grok/bin. T3's version check then still sees 1.0.56.
T3 already covers this for updates it runs through npm directly: #5646 passes --allow-scripts=<package>. The Grok resolver (packages/provider-grok/src/server/driver.ts) uses Grok's own updater, so that flag never reaches the npm Grok spawns.
Steps to reproduce
- Use npm 12 and install Grok through npm at an older version, with scripts allowed once so the binary lands:
npm install -g --allow-scripts=@xai-official/grok @xai-official/grok@1.0.56. - In T3 Code, update Grok from the provider card (or run
grok update). grok --versionstill prints 1.0.56, andnpm ls -gshows@xai-official/grok@1.0.67.
Version
T3 Code desktop 0.1.3-nightly.20261023.3592. Grok 1.0.56 → 1.0.67. npm 12.2.0, Node 24.22.1.
Environment
macOS (Apple silicon). Also reproduced on Linux with an isolated npm prefix and GROK_HOME.
Evidence
On the affected Mac after T3's update:
| 1 | $ npm ls -g --depth=0 | grep grok |
| 2 | ├── @xai-official/grok@1.0.67 |
| 3 | $ ls ~/.grok/bin |
| 4 | agent grok -> grok-1.0.56 grok-1.0.40 grok-1.0.56 |
| 5 | $ <npm prefix>/bin/grok --version |
| 6 | grok 1.0.56 (66d435e189ab) [stable] |
The npm package's bin/grok was still the node launcher. A completed postinstall replaces it with a symlink to grok-native.
Isolated repro, real binaries, npm 12.2.0:
| 1 | == without allow-scripts |
| 2 | grok update exit=0 |
| 3 | npm warn install-scripts 1 package had install scripts blocked because they are not covered by allowScripts: |
| 4 | npm warn install-scripts @xai-official/grok@1.0.67 (postinstall: node bin/postinstall.js) |
| 5 | npm package: @xai-official/grok@1.0.67 |
| 6 | after: grok 1.0.56 (66d435e189ab) [stable] |
| 7 | == with npm_config_allow_scripts=@xai-official/grok |
| 8 | grok update exit=0 |
| 9 | npm package: @xai-official/grok@1.0.67 |
| 10 | after: grok 1.0.67 (2fe064390d07) [stable] |
Related issues
#5627 / #5646: the same npm 12 behavior for npm-global updates T3 runs directly. This path is grok update, which spawns npm itself. #9398: EALLOWSCRIPTS from an exported npm_config_allow_scripts affects project-scoped installs only; this install is global. #18768: an earlier Grok update ownership bug (Homebrew cask), a different cause.
Fix applied or workaround
Workaround: npm_config_allow_scripts=@xai-official/grok grok update, or npm install -g --allow-scripts=@xai-official/grok @xai-official/grok@latest. A fix is in #24246.
Filed by
Claude Opus 5.5 in Claude Code, run from T3 Code.