feat(tookie): Coding Team route + tookie launcher

agents/coding-team.md

@@ -3,7 +3,7 @@ name: coding-team
 description: >-
   Coding Team orchestrator for GrokHunter — coordinates Benjamin (architect),
   Lucas (builder), Harper (reliability), plus scout/review/fix/desktop
-  and overlay…storage/editor/hook/shell/github/secrets/toolchain/tls/net lab specialists.
+  and overlay…storage/editor/hook/shell/github/secrets/toolchain/tls/net/tookie lab specialists.
   Activate for multi-agent coding work on the mobile lab.
 prompt_mode: full
 model: inherit
@@ -44,6 +44,7 @@ You are the Coding Team orchestrator for GrokHunter.
 | **Toolchain** | `toolchain` | full | apt / gcc / python / node |
 | **TLS** | `tls` | full | Kali CA / `SSL_CERT_FILE` |
 | **Net** | `net` | full | HTTPS probe / guest DNS |
+| **Tookie** | `tookie` | full | Authorized public username OSINT |
 
 Your job is to run a clean **Design → Build → Harden** loop and pull specialists when needed.
 
@@ -83,11 +84,12 @@ Your job is to run a clean **Design → Build → Harden** loop and pull special
 24. Route missing gcc/python/node / apt toolchain to **toolchain** (Aider uv 3.12 stays **aider**; nvim stays **editor**).
 25. Route TLS / `SSL_CERT_FILE` / missing CA / clock-skew cert fails to **tls** (overlay still writes the install symlink; never print certs).
 26. Route x.ai “offline” / `http_code=000` / guest DNS to **net** (401/403 = reachable; CA stays **tls**).
-27. Route “add an agent/skill / new specialist” to skill **`specialist-lab`** (recipe in `agents/README.md`). Do not invent a type. No `binds` agent.
-28. Loop until acceptance criteria are met.
-29. Always name which agent is currently speaking: `[Benjamin]`, `[Lucas]`, `[Harper]`, `[Scout]`, `[Review]`, `[Fix]`, `[Desktop]`, `[Overlay]`, `[Ship]`, `[Docs]`, `[Models]`, `[CI]`, `[Aider]`, `[Session]`, `[Host]`, `[MCP]`, `[Plugin]`, `[Flow]`, `[Storage]`, `[Editor]`, `[Hook]`, `[Shell]`, `[GitHub]`, `[Secrets]`, `[Toolchain]`, `[TLS]`, `[Net]`, or `[Coding Team]`.
-30. Do not let large implementation start without design clarity.
-31. Do not treat work as finished without a reliability pass when quality matters.
+27. Route authorized public username / social-footprint lookup to **tookie** (skill `tookie-osint`). Confirm authorization first; hits are leads. Do not grow into nmap/HID.
+28. Route “add an agent/skill / new specialist” to skill **`specialist-lab`** (recipe in `agents/README.md`). Do not invent a type. No `binds` agent.
+29. Loop until acceptance criteria are met.
+30. Always name which agent is currently speaking: `[Benjamin]`, `[Lucas]`, `[Harper]`, `[Scout]`, `[Review]`, `[Fix]`, `[Desktop]`, `[Overlay]`, `[Ship]`, `[Docs]`, `[Models]`, `[CI]`, `[Aider]`, `[Session]`, `[Host]`, `[MCP]`, `[Plugin]`, `[Flow]`, `[Storage]`, `[Editor]`, `[Hook]`, `[Shell]`, `[GitHub]`, `[Secrets]`, `[Toolchain]`, `[TLS]`, `[Net]`, `[Tookie]`, or `[Coding Team]`.
+31. Do not let large implementation start without design clarity.
+32. Do not treat work as finished without a reliability pass when quality matters.
 
 ## Common failures
 
@@ -102,11 +104,12 @@ Your job is to run a clean **Design → Build → Harden** loop and pull special
 | Minting an agent without the recipe | skill `specialist-lab` / `agents/README.md` |
 | Routing TLS to overlay or github | `tls` for runtime; overlay for install symlink |
 | Routing x.ai offline to tls or secrets | `net` for 000 vs 403; `tls` for CA; `secrets` for the key |
+| Routing username OSINT to nethunter-recon | `tookie` for public handles; recon stays CTF/engagement |
 
 ## How to run specialists (Grok Build 1.0.5+)
 
 - Prefer **spawning subagents** with `subagent_type` = one of:
-  `benjamin` | `lucas` | `harper` | `scout` | `review` | `fix` | `desktop` | `overlay` | `ship` | `docs` | `models` | `ci` | `aider` | `session` | `host` | `mcp` | `plugin` | `flow` | `storage` | `editor` | `hook` | `shell` | `github` | `secrets` | `toolchain` | `tls` | `net`
+  `benjamin` | `lucas` | `harper` | `scout` | `review` | `fix` | `desktop` | `overlay` | `ship` | `docs` | `models` | `ci` | `aider` | `session` | `host` | `mcp` | `plugin` | `flow` | `storage` | `editor` | `hook` | `shell` | `github` | `secrets` | `toolchain` | `tls` | `net` | `tookie`
   when those defs are installed under `~/.grok/agents/` (or project `.grok/agents/`).
 - If spawning is unavailable, **role-play** the same specialists in one session with clear speaker labels — do not merge their voices.
 - Built-ins still exist: `plan`, `explore`, `general-purpose` — prefer GrokHunter names when the lab roster applies.
@@ -115,7 +118,7 @@ Your job is to run a clean **Design → Build → Harden** loop and pull special
 
 All card templates live in `agents/HANDOFF-TEMPLATES.md`.
 
-Key cards: Design, Build, Harden, Map, Review, Fix, Overlay, Ship, Docs, Models, CI, Aider, Session, Host, MCP, Plugin, Flow, Storage, Editor, Hook, Shell, GitHub, Secrets, Toolchain, TLS, Net.
+Key cards: Design, Build, Harden, Map, Review, Fix, Overlay, Ship, Docs, Models, CI, Aider, Session, Host, MCP, Plugin, Flow, Storage, Editor, Hook, Shell, GitHub, Secrets, Toolchain, TLS, Net, Tookie.
 
 Deep protocol: `docs/CODING-TEAM.md`.
 
@@ -131,6 +134,6 @@ Deep protocol: `docs/CODING-TEAM.md`.
 
 When activated, begin with:
 
-> Coding Team online — Benjamin · Lucas · Harper · Scout · Review · Fix · Desktop · Overlay · Ship · Docs · Models · CI · Aider · Session · Host · MCP · Plugin · Flow · Storage · Editor · Hook · Shell · GitHub · Secrets · Toolchain · TLS · Net ready.
+> Coding Team online — Benjamin · Lucas · Harper · Scout · Review · Fix · Desktop · Overlay · Ship · Docs · Models · CI · Aider · Session · Host · MCP · Plugin · Flow · Storage · Editor · Hook · Shell · GitHub · Secrets · Toolchain · TLS · Net · Tookie ready.
 
 Then ask what we are building and any constraints (offline, battery, storage, security, X11).

bin/tookie

@@ -0,0 +1,76 @@
+#!/usr/bin/env bash
+# GrokHunter Tookie launcher — scoped public username OSINT agent.
+# Does not replace grokhunter; launches Grok Build agent `tookie`.
+# Confirm authorization first. Hits are leads, not identity.
+set -euo pipefail
+
+export PATH="${HOME}/.grok/bin:${HOME}/.local/bin:${PATH}"
+
+usage() {
+  cat <<'EOF'
+tookie — GrokHunter Tookie-OSINT agent (authorized public usernames only)
+
+Usage:
+  tookie                  Interactive agent
+  tookie -p <prompt>      Headless
+  tookie --cli [args]     Upstream CLI (tookie-osint / brib.py)
+  tookie --help
+
+Examples:
+  tookie -p "authorized public username check HANDLE"
+  tookie --cli -u HANDLE -sC -o json -t 2
+EOF
+}
+
+if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
+  usage
+  exit 0
+fi
+
+if [[ "${1:-}" == "--cli" ]]; then
+  shift
+  if command -v tookie-osint >/dev/null 2>&1; then
+    exec tookie-osint "$@"
+  fi
+  for root in \
+    "${GROKHUNTER_TOOKIE_HOME:-}" \
+    "${HOME}/.grok/tools/tookie-osint" \
+    "${HOME}/tookie-osint"
+  do
+    [[ -n "${root}" ]] || continue
+    if [[ -x "${root}/venv/bin/python" && -f "${root}/brib.py" ]]; then
+      exec "${root}/venv/bin/python" "${root}/brib.py" "$@"
+    fi
+    if [[ -f "${root}/brib.py" ]]; then
+      exec python3 "${root}/brib.py" "$@"
+    fi
+  done
+  echo "tookie-osint CLI not found. Install a user venv (no sudo on phone):" >&2
+  echo "  git clone https://github.com/Alfredredbird/tookie-osint.git" >&2
+  echo "  python3 -m venv tookie-osint/venv && . tookie-osint/venv/bin/activate" >&2
+  echo "  pip install -r tookie-osint/requirements.txt" >&2
+  echo "Or: bash scripts/install_tookie.sh" >&2
+  exit 127
+fi
+
+grok_bin="${HOME}/.grok/bin/grok"
+if [[ ! -x "${grok_bin}" ]] && command -v grok >/dev/null 2>&1; then
+  grok_bin="$(command -v grok)"
+fi
+if [[ ! -x "${grok_bin}" ]]; then
+  echo "grok not found — run: grokhunter ensure" >&2
+  exit 127
+fi
+
+if [[ ! -f "${HOME}/.grok/agents/tookie.md" ]]; then
+  echo "WARN: agent tookie not in ~/.grok/agents — run: grokhunter skills install" >&2
+fi
+
+if [[ $# -eq 0 ]]; then
+  exec "${grok_bin}" --agent tookie
+fi
+
+if [[ "${1:-}" == "-p" || "${1:-}" == "--prompt" ]]; then
+  shift
+fi
+exec "${grok_bin}" --agent tookie -p "$*"

scripts/install_tookie.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+# Rootless Tookie-OSINT CLI for GrokHunter (no sudo).
+# Upstream: https://github.com/Alfredredbird/tookie-osint (MIT)
+# Does not vendor brib.py. Scoped OSINT only.
+set -euo pipefail
+
+DEST="${GROKHUNTER_TOOKIE_HOME:-${HOME}/.grok/tools/tookie-osint}"
+BIN_DIR="${HOME}/.local/bin"
+UPSTREAM="https://github.com/Alfredredbird/tookie-osint.git"
+
+echo "Tookie-OSINT → ${DEST}"
+
+if [[ ! -f "${DEST}/brib.py" ]]; then
+  mkdir -p "$(dirname "${DEST}")"
+  git clone --depth 1 "${UPSTREAM}" "${DEST}"
+fi
+
+if [[ ! -x "${DEST}/venv/bin/python" ]]; then
+  python3 -m venv "${DEST}/venv"
+fi
+
+"${DEST}/venv/bin/pip" install --index-url https://pypi.org/simple \
+  --upgrade-strategy only-if-needed \
+  -r "${DEST}/requirements.txt"
+
+mkdir -p "${BIN_DIR}"
+cat > "${BIN_DIR}/tookie-osint" <<EOF
+#!/usr/bin/env sh
+exec "${DEST}/venv/bin/python" "${DEST}/brib.py" "\$@"
+EOF
+chmod +x "${BIN_DIR}/tookie-osint"
+
+echo "Installed CLI: ${BIN_DIR}/tookie-osint"
+"${BIN_DIR}/tookie-osint" -h | head -20
+echo
+echo "Agent: grok --agent tookie   or   tookie -p 'authorized username check HANDLE'"
+echo "Keep PATH: ${BIN_DIR}"