fix: address PR review comments — agent plugin correctness, shell injection, datetime safety, Pattern 3 parsing

[Copilot]

Applies all outstanding review comments from PR #17 across the plugin, bridge, and agent layers.

src/plugin/index.ts

• Export function made async (required for top-level await import)
• Dynamic import path corrected: ./grok_agent_plugin.js → ./grok_agent_plugin

src/plugin/grok_agent_plugin.ts

• PLUGIN_ROOT fixed: was walking 3 dirs up (past repo root), now 2
• Removed dead api.config?.agentScript path — not in configSchema and additionalProperties: false blocked it anyway
• Task arg: args.push("--", params.task) → args.push("--task", params.task) (positional not accepted by argparse)
• Respects api.config?.pythonPath with "python3" fallback, consistent with index.ts

platforms/claude/commands/grok-swarm-agent.sh

• Same task arg fix: ARGS+=("$TASK") → ARGS+=("--task" "$TASK")

src/agent/grok_agent.py — shell injection

• verify_cmd was run with shell=True and user-controlled input; replaced with shlex.split() + shell=False

src/bridge/grok_bridge.py + skills/grok-refactor/bridge/grok_bridge.py — Pattern 3 parsing

• Previously only checked the line immediately after the language tag; now iterates to the first non-empty line, so blank lines between the fence tag and # filename.ext no longer break file extraction

src/bridge/usage_tracker.py + skills/grok-refactor/bridge/usage_tracker.py — naive datetime crash

• datetime.fromisoformat() returns a naive datetime for hand-edited/legacy records; comparing naive to aware raises TypeError. Now normalizes naive timestamps to UTC before comparison and catches TypeError in the except clause.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.