sophia-build
sophia-build
Rust coding harness forked from SpaceXAI Grok Build. Used for large autonomous ports and multi-hour tool work: native models drive sophia-build's own edit/shell/MCP/subagent stack under a short coding-agent prompt.
Sophia (Hermes) stays the identity and orchestrator. This TUI can either:
- run native models through sophia-build tools (local / bare-model mode), or
- talk to Sophia's Hermes backend (cloud mode: her SOUL, memory, Hermes-owned tools).
Canonical repo: SourceHut git@git.sr.ht:~krisyotam/sophia-build (FORGE.md).
Contents
- Switching modes: native models vs Hermes
- Quick start
- Authentication
- Models and BYOK
- Remote control (Tailscale)
- Hermes job bridge (worker direction)
- Extensibility
- Privacy
- Build
- Layout
- Docs
- Change log (sophia-build fork)
- Forge
- License
Switching modes: native models vs Hermes
This is the main control surface of the product.
| Native models (local) | Sophia / Hermes (cloud) | |
|---|---|---|
| What runs the brain | Bare model (Kimi, Sonnet, Terra, Opus, Nebius, …) | Hermes agent on the Sophia box |
| Who owns tools | sophia-build (edit, bash, MCP on this machine, subagents, worktrees) | Hermes (her tools, skills, Honcho, SOUL policy) |
| System prompt | Minimalist coding-agent + AGENTS.md / skills |
SOUL, memory, identity, Hermes policy |
| When | Large ports, multi-hour refactors, campaigns | Talk to Sophia; work that should stay "her" |
| How to select | /model <bare-id> or -m <bare-id> |
/model sophia-hermes (or whatever id you configured) |
sophia-build TUI (/model …)
|
+---------------+----------------+
| |
NATIVE MODE HERMES MODE
bare model Sophia backend
| |
tools: this process tools: Hermes on Sophia
prompt: short coding prompt: SOUL + memory
| |
heavy autonomous ports conversation / her world
Switch to a native model
Catalog examples (see default_models.json and /model picker):
/model sonnet-5
/model kimi-k2.7-code
/model terra
/model opus-4.8
CLI:
grok -m kimi-k2.7-code
grok -p "port the auth module" -m sonnet-5 --always-approve
In this mode tools always run where the binary runs (desktop, laptop, or Sophia box if you SSH and run there). Prompt stays thin on purpose: this fork is the heavy tool, not a second SOUL.
Switch to Sophia (Hermes backend)
Point a catalog entry at Hermes' OpenAI-compatible API (Tailscale to the Sophia machine; do not expose the port publicly).
# ~/.grok/config.toml
[models]
# default = "sophia-hermes" # optional: boot in Hermes mode
# default = "kimi-k2.7-code" # or boot in native mode
[model."sophia-hermes"]
model = "sophia" # id Hermes advertises on /v1/models
base_url = "http://100.78.242.77:8642/v1" # Tailscale IP of Sophia box
name = "Sophia (Hermes)"
description = "Live Hermes: SOUL, memory, Hermes-owned tools"
env_key = "HERMES_API_KEY" # same value as API_SERVER_KEY on the box
api_backend = "chat_completions"
context_window = 200000
export HERMES_API_KEY=... # from Sophia ~/.hermes/.env API_SERVER_KEY
Then in the TUI:
/model sophia-hermes
Back to native:
/model kimi-k2.7-code
# or
/model sonnet-5
Same session can switch mid-work with /model. Default for new sessions is whatever [models].default is.
Practical defaults
| Goal | Set |
|---|---|
| Most days coding ports | default = "kimi-k2.7-code" or sonnet-5 |
| Open TUI as Sophia | default = "sophia-hermes" |
| One-off | leave default native; /model sophia-hermes when you need her |
Honest limits today
- Native mode is complete: bare model + full sophia-build tool loop.
- Hermes mode as a model endpoint is usable for chat and Sophia-as-brain when the Hermes API accepts the request shape. True "Hermes owns every tool call and desktop is pure UI" is the hosted-agent direction (ACP / remote tools); until that is finished, treat Hermes mode as backend = Sophia, and native mode as backend = bare model + this harness's tools.
- Hermes hiring this harness (opposite arrow: she launches a headless coding job here) is already implemented: see Hermes job bridge.
Stack roles (do not merge)
| Surface | Role |
|---|---|
| sophia-build | Heavy coding TUI/runtime. Native models + local tools. |
| Hermes (Sophia) | Identity, memory, orchestration, her tools. |
| Pi | Optional scientific/systems surface. Not required here. |
Quick start
git clone git@git.sr.ht:~krisyotam/sophia-build
cd sophia-build
cargo build -p xai-grok-pager-bin --release
./target/release/xai-grok-pager
- Auth (Grok OAuth and/or Codex OAuth and/or API keys).
/model …for native or Hermes as above.- Optional Nebius BYOK without xAI sub:
export NEBIUS_API_KEY=... TAVILY_API_KEY=... GROK_IMAGE_GEN=0
./deploy/nebius/setup.sh
grok -m kimi-k2.7-code
Authentication
| Method | How |
|---|---|
| Grok OAuth | grok login (auth.x.ai) |
| Codex / OpenAI OAuth | GROK_OAUTH2_PROVIDER=codex grok login --oauth or pick Codex on login screen |
| BYOK | model env_key / api_key; skips forced xAI login when default model has credentials |
| Device code (xAI) | grok login --device-auth |
Both Grok and Codex tokens can live in ~/.grok/auth.json under separate scopes.
Models and BYOK
Shipped roster (native): Sonnet (default), Fable (plan/judge), Opus, Terra, Composer, Grok 4.5, Kimi K2.7 Code (Nebius), Qwen2.5-VL, hidden grok-build compat.
Any OpenAI-compatible endpoint:
[model."my-endpoint"]
model = "provider/model-id"
base_url = "https://api.example.com/v1"
env_key = "MY_API_KEY"
api_backend = "chat_completions"
context_window = 128000
Quote dotted names: [model."kimi-k2.7-code"]. Pin aux models when off xAI (session_summary, image_description as full upstream IDs).
Nebius + Tavily profile: deploy/nebius/.
Remote control (Tailscale)
Phone steers a native-mode session on the host (not Hermes cloud).
/remote
Requires Tailscale on host + phone (same account). URL + QR on the tailnet. Tools stay on the host.
Hermes job bridge (worker direction)
Hermes launches this harness headless (not the TUI talking to her):
prod/hermes-bridge.sh --spec job.json
See 26-hermes-bridge.md.
Extensibility
Not Pi TypeScript extensions. Use:
| Layer | Role |
|---|---|
| Skills | SKILL.md packages |
| Plugins | skills + commands + hooks + MCP |
| Hooks | lifecycle guards |
| MCP | external tools |
| Agents / personas | session and subagent shape |
| Policy packs | sandbox + allowlist profiles |
| AGENTS.md | project rules |
Port Pi skills via [skills] paths = ["~/src/sophia/skills"]. Leave SOUL/Hermes tools on Hermes mode.
Privacy
Default: no bulk repo/trace upload, local-first telemetry off, secret redaction on model-bound reads, session export without xAI share. See 25-privacy.md.
Build
cargo build -p xai-grok-pager-bin --release # target/release/xai-grok-pager
cargo check -p xai-grok-pager-bin
Rust via rust-toolchain.toml. protoc on PATH or bin/protoc. Prefer -p <crate> builds; full workspace is heavy. On disk-limited machines (e.g. Sophia), clean target/ when /home fills.
Root Cargo.toml is generated: edit per-crate manifests only.
Layout
| Path | Role |
|---|---|
crates/codegen/xai-grok-pager* |
TUI, /remote, user guide |
crates/codegen/xai-grok-shell |
Runtime, auth, headless, ACP |
crates/codegen/xai-grok-tools |
Tools |
crates/codegen/xai-grok-models |
Default roster |
prod/hermes-bridge.sh |
Hermes → headless worker |
deploy/nebius/ |
BYOK profile |
wiretest/ |
Egress test helpers |
FORGE.md |
SourceHut vs GitHub |
Docs
Full user guide: crates/codegen/xai-grok-pager/docs/user-guide/
Especially: 02 auth, 04 slash (/remote), 07 MCP, 08–10 skills/plugins/hooks, 11 models, 14 headless, 15 ACP, 25 privacy, 26 Hermes bridge, 28 policy packs.
Change log (sophia-build fork)
Everything since the upstream open-source publish commit (c1b5909). Newest first.
2026-07-16 — Docs and dual backend story
| Commit | What |
|---|---|
5428217 |
README: dual-mode architecture (native vs Hermes), stack roles, ops guides. |
| (this revision) | README focused on how to switch native models vs Hermes; full change log below. |
2026-07-16 — Codex OAuth real endpoints
| Commit | What |
|---|---|
41d7697 |
Codex/OpenAI OAuth wired for real use: public client id app_EMoamEEZ73f0CkXaXp7hrann, loopback http://localhost:1455/auth/callback, authorize extras, codex.oauth authenticate path with separate auth.json scope. Grok OAuth unchanged and still default. Docs for both logins. |
2026-07-16 — Tailscale /remote + Nebius BYOK
| Commit | What |
|---|---|
57e0b23 |
/remote: Tailscale dual-input (QR + HTTP UI), port of daniel-farina/grok-build. Slash /remote /rc /remote-control, remote server, transcript fan-out, dual prompt path. |
Nebius / OpenAI-compatible BYOK: deploy/nebius/ (config, setup, env.example) from shivaylamba/grok-build-nebius. Catalog entries kimi-k2.7-code, qwen2.5-vl. Custom-models docs (dotted TOML, aux model pins, Tavily MCP). |
Verified on Sophia box: cargo check, remote_registered unit test, models lists Kimi + Qwen.
2026-07 — Compile/test on Sophia + test seams
| Commit | What |
|---|---|
307bb6f |
Cargo.lock sync after Sophia box test run. |
d7f42a6 |
Test support: Game::any_held gate for gboom. |
98f52a7 |
Pager-render seams behind test-support for cross-crate pager tests. |
b68f494 |
EnvVarGuard available for shell-base test re-export. |
9ebb879 |
signed_policy test seam (test-seam feature). |
cff8e1f |
Cross-crate test helpers restored (pager minimal, memory mocks, workspace for_test, shell env). |
49a7550 |
Compile/test fixes from real cargo check on Sophia (policy pack imports, wire-tests toml parse, path imports). Wire privacy guards + secrets/claude-bridge tests green. |
2026-07 — Policy packs + forge policy
| Commit | What |
|---|---|
3c7a335 |
Policy packs: trusted-internal, untrusted-PR, read-only-review; custom [policy-pack.*]; --policy-pack / GROK_POLICY_PACK; secret-path denies; network posture on sandbox. |
Roster: explicit hidden fields on every default model entry (deser safety). |
|
FORGE.md: SourceHut canonical; GitHub krisyotam/grok-build frozen archive only. |
2026-07 — Privacy (Part 1) + models/bridges (Part 2 core)
| Commit | What |
|---|---|
0869c0e |
Privacy: model-bound secret redaction (read_file + config); local session export (grok export); local-first auth (no forced grok.com when keys/endpoints present); Sentry/telemetry features default-off; wire-tests crate + wiretest/ mitm harness. |
Models: roster Sonnet default, Fable, Opus, Terra, Composer, Grok 4.5; grok-build hidden. |
|
Auth registry: xAI, Codex, Google, GitHub, Anthropic Console descriptors; GROK_OAUTH2_PROVIDER. |
|
Claude bridge crate (local claude binary, no Anthropic key in-tree). |
|
Hermes bridge: prod/hermes-bridge.sh + user guide 26. |
|
| Docs 11, 25–29 (privacy, Hermes, large ops, policy packs, plan-verify). | |
546bd23 |
Trace/artifact upload compile-time kill (trace-upload feature default-off); local-only telemetry posture (Part 1.1 + 1.6 core). |
Upstream base
| Commit | What |
|---|---|
c1b5909 |
Upstream: "Publish harness and TUI open-source" (fork point). |
Feature map (what you get vs stock Grok Build)
| Area | Status |
|---|---|
| Privacy: no bulk upload by default | Done |
| Secret redaction on reads | Done |
| Local session export | Done |
| Local-first / BYOK auth | Done |
| Custom model roster + Nebius profile | Done |
| Grok OAuth + Codex OAuth | Done (Codex real client) |
| Claude local bridge | Done |
| Hermes → headless worker bridge | Done |
TUI → Hermes as /model backend |
Config pattern documented; switch with /model |
First-class /local /cloud slash |
Not yet (use /model) |
| Hosted agent (Hermes owns tools, UI only) | Roadmap |
Tailscale /remote dual input |
Done |
| Policy packs | Done |
Pi extensions/ load |
Not planned; port to skills/plugins/hooks/MCP |
Forge
| Remote | Role |
|---|---|
origin → git.sr.ht:~krisyotam/sophia-build |
Canonical; push all work here |
github → krisyotam/grok-build |
Frozen fork-point archive; do not push sophia-build history |
See FORGE.md. Upstream does not take external PRs (CONTRIBUTING.md).
Credits for absorbed work:
/remote: daniel-farina/grok-build- Nebius profile pattern: shivaylamba/grok-build-nebius
License
Apache-2.0 first-party (LICENSE). Third-party: THIRD-PARTY-NOTICES, tools crate notices, third_party/NOTICE.
Switching in one line: /model kimi-k2.7-code (or sonnet/terra/…) for native tools; /model sophia-hermes for Sophia's Hermes backend. Same TUI, different brain and tool owner.