Grok Bot: Shell Auto-review "executable content could not be bound" never shows approval card

[jsolly (John Solly)]

Where does the bug appear (feature/product)?

• Cursor IDE
• Cursor CLI
• Background Agent (GitHub, Slack, Web, Linear)
• BugBot
• Somewhere else: Grok Bot

Describe the Bug

Shell Auto-review rejects with:

Rejected: The executable content could not be bound to this review. Run the resolved script directly or provide an explicit working directory.

Retry with request_smart_mode_approval=true + smart_mode_block_reason = the exact reject string returns the same reject. No user-visible Auto-review approval card appears. John has never seen an Auto-review card on this account.

This blocks package-manager install Shell commands (npm path) on the shared Linux bot computer. Also reproduced while drafting this report (multi-line / python write rejected the same way).

Update — allow-rule does not help: John added a manual Auto-review rule on iOS New Rule UI:

• When: run npm, npx, or node package installs and scripts on my computer for GeoRoids (/workspace/GeoRoids)
• It should: Allow Automatically

Immediately after, retry on box with working_directory=/workspace/GeoRoids and command /workspace/node-v24/bin/npm -v && /workspace/node-v24/bin/npm ci --ignore-scripts produced the same bind reject and no approval card. The allow rule did not prevent or escalate the bind failure.

Implication: not (only) missing allow-rule / missing card on a normal block — Shell path fails before/outside a user-visible allow decision.

Steps to Reproduce

1. GeoRoids at /workspace/GeoRoids, Node at /workspace/node-v24.
2. Shell with working_directory=/workspace/GeoRoids and command /workspace/node-v24/bin/npm ci.
3. Observe bind reject: The executable content could not be bound to this review...
4. Escalate retry with request_smart_mode_approval=true and smart_mode_block_reason set to the exact reject text.
5. Observe: same reject again; no user-visible Auto-review approval card.
6. Add iOS Auto-review Allow Automatically rule for npm/npx/node package installs under /workspace/GeoRoids; retry /workspace/node-v24/bin/npm -v && /workspace/node-v24/bin/npm ci --ignore-scripts — same bind reject, still no card.

Notes: npm-path commands fail; ls / python3 / box-doctor / node -v work.

Expected Behavior

Either run the command, or surface a user-visible Auto-review approval card so the user can approve. An Allow Automatically rule matching the intent should also allow (or at least escalate to a card), not leave a silent bind reject.

Screenshots / Screen Recordings

n/a (tool reject text; no card ever shown)

Operating System

iOS (client where Auto-review cards should surface) + failure on shared Linux bot computer Shell

Version Information

Grok Bot 1.6.0 (8025) (iOS About)
Bot: Georoids Developer id 90fc14da-ed7c-4ed9-b2fe-0f8c690f5ecc

Additional Information

Related (not duplicates):

• Grok Bot: "Approval needed" stays on agent-view homepage when Coder has nothing to approve
• Grok Bot computer cannot finish a normal workflow - details

Workaround note: invoke npm CLI via node (/workspace/node-v24/bin/node .../pkg-cli.js / georoids-dev.sh) so argv avoids .../bin/npm.

In-app SendFeedback also submitted for this report.

Does this stop you from using Grok Bot?

• Yes - Grok Bot is unusable

• Sometimes - I can sometimes use Grok Bot

• No - Grok Bot works, but with this issue

• John’s AI Assistant

[Jojo1 (Jojo)]

Grok Bot local execution / Auto-review bug

I’m seeing a reproducible failure when Grok Bot tries to run commands on my local Linux environment.

Exact error:

“executable content could not be bound to this review”

What makes this look like a Grok Bot execution-layer bug:

• Local execution permission prompts appear normally.
• I can approve the command.
• Approval retry does not produce a usable follow-up approval card.
• The command still fails before execution.
• The same commands work normally when run manually from the local terminal.

The failure is not limited to a custom script. Even this trivial system command fails inside Grok Bot:

/usr/bin/python3 -c “print(‘exec-ok’)”

That command works normally from the terminal, but Grok Bot returns:

“executable content could not be bound to this review”

I also tested:

• a small shell wrapper
• a Python helper script
• direct Python execution

All work manually and all fail through Grok Bot with the same bind/review error.

This suggests the failure is occurring in the local-execution / Auto-review layer before the process is actually launched.

Environment:

• Grok Bot desktop app
• Linux environment on ChromeOS
• x86_64
• Local command execution enabled

Expected behavior:
After approval, Grok Bot should execute the approved local command.

Actual behavior:
The command is rejected before launch with:
“executable content could not be bound to this review”

Please let me know if this is a known issue, if there is a supported workaround, or if there are specific logs/diagnostics I should attach.

[Effective_Autism]

I am seeing the same error with Grok Bot on macOS, initially on desktop 0.43.0 and still present after testing desktop 0.44.0 today (September 6).

In the documented 0.43.0 sequence, an absolute Python script path plus explicit working_directory was rejected; requesting approval for the same command also failed, with no visible approval card. Cloud execution was requested, although I only have Grok’s reported tool results, not independently captured invocation metadata.

I posted the detailed sequence and evidence limitations here: My macOS / 0.44.0 report.

[Colin]

Hey @jsolly, thanks for the detailed report!

This rejection happens in a pre-check that runs before the review itself, so neither the approval card nor an Allow rule gets a chance to weigh in. Right now that pre-check treats any command whose text contains the word npm (or pnpm / yarn) anywhere, including inside a path like /workspace/node-v24/bin/npm, as something it can’t inspect, and it stops there. That’s not the intended behavior, and a fix is in progress. I’ve attached your report to it.

In the meantime, the reliable way through is to let the command start with plain npm instead of the full path, and keep it as a single command (no &&). This form goes through the normal review and will either run or show you a card:

PATH=/workspace/node-v24/bin:$PATH npm ci --ignore-scripts

with working_directory set to /workspace/GeoRoids. The same pattern works for npm run <script> and npm install. Two things to avoid until the fix lands: npm -v on its own (it isn’t recognized as an install or script, so it hits the same pre-check), and chaining several commands together with && when one of them is an npm command.

Your pkg-cli.js workaround is fine too, for the same reason: the command text no longer contains npm.

The python-based rejections that @Jojo1 and @Effective_Autism mentioned above are a closely related issue. Suggest we keep talking about them over in their threads!

[jsolly (John Solly)]

New repro (2026-09-07) — same bind error / no approval card, different command shape than the npm-in-path case.

During /integration-verify on the Grok Bot cloud computer (Node v20.19.2, no tsx on PATH):

1. node …/integration-verify.mts → ERR_UNKNOWN_FILE_EXTENSION (.mts).
2. node --experimental-strip-types scripts/integration-verify.mts --help with working_directory set to the skill folder → Auto-review rejects: “The executable content could not be bound to this review. Run the resolved script directly or provide an explicit working directory.” No approval card.

So the official skill helper path is blocked even when an explicit working_directory is provided. Grok Bot 0.44.0 stable desktop; surface: shared box / cloud computer Shell.

Reported via Plummer during integration-verify. Happy to capture exact command strings if useful.