FN-7716: stop requiring a Fusion-visible API key for Grok CLI provider
Grok CLI provider readiness now mirrors the Cursor CLI provider: it is derived from the `grok` binary being available rather than requiring a Fusion-visible GROK_API_KEY or ~/.grok/user-settings.json, since the CLI manages its own auth. - probeGrokBinary now derives `authenticated` from binary availability (readiness) instead of API-key/user-settings presence; key detection surfaces as a non-blocking `apiKeyDetected` hint - /auth/status treats the grok-cli provider as authenticated when enabled + binary available - GrokCliProviderCard drops the blocking "Set GROK_API_KEY" state - Direct xAI streaming path is unchanged and still uses $GROK_API_KEY when present (FN-7711/FN-7714) - Added changeset for @runfusion/fusion (patch) Files changed: $(cat /tmp/diffstat_fn7716.txt) Fusion-Task-Id: FN-7716 Fusion-Task-Lineage: ac0efc79-2510-465e-9cd2-4938c08989c9 Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>
This commit is contained in:
gsxdsm
7
.changeset/fn-7716-grok-cli-no-api-key.md
Normal file
7
.changeset/fn-7716-grok-cli-no-api-key.md
Normal file
@@ -0,0 +1,7 @@
|
||||
---
|
||||
"@runfusion/fusion": patch
|
||||
---
|
||||
|
||||
summary: Grok CLI no longer requires a Fusion-visible API key — the CLI's own auth is enough to enable it.
|
||||
category: fix
|
||||
dev: probeGrokBinary now derives `authenticated` from `grok` binary availability (readiness) instead of GROK_API_KEY/~/.grok/user-settings.json presence, mirroring the Cursor CLI provider; key detection is exposed as a non-blocking `apiKeyDetected` hint. The /auth/status grok-cli provider is authenticated when enabled + binary available; GrokCliProviderCard drops the blocking "Set GROK_API_KEY" state. The direct xAI streaming path still uses $GROK_API_KEY when present (FN-7711/FN-7714 unchanged).
|
||||
@@ -1971,7 +1971,10 @@ export interface CursorCliStatus {
|
||||
export interface GrokCliStatus {
|
||||
binary: {
|
||||
available: boolean;
|
||||
/** FNXC:GrokCli 2026-07-09-00:00: FN-7716 — "ready" (binary available), not "key present"; the grok CLI owns auth. */
|
||||
authenticated?: boolean;
|
||||
/** FNXC:GrokCli 2026-07-09-00:00: FN-7716 — non-blocking informational hint that Fusion detected a Grok API key. Never gates readiness. */
|
||||
apiKeyDetected?: boolean;
|
||||
version?: string;
|
||||
binaryPath?: string;
|
||||
configuredBinaryPath?: string;
|
||||
|
||||
@@ -18,6 +18,16 @@ status line and binary-path control render flush against the card's left/right/b
|
||||
padding: 0 var(--space-md) var(--space-sm);
|
||||
}
|
||||
|
||||
/*
|
||||
FNXC:GrokCli 2026-07-09-00:00:
|
||||
FN-7716: the no-Fusion-visible-key hint is informational only (never blocking), so it renders one
|
||||
notch quieter than the primary status line via reduced opacity on the shared `.settings-muted` tone
|
||||
— no new color token, no hardcoded hex.
|
||||
*/
|
||||
.grok-cli-provider-card__key-hint {
|
||||
opacity: 0.75;
|
||||
}
|
||||
|
||||
.grok-cli-binary-path-control {
|
||||
display: grid;
|
||||
gap: var(--space-xs);
|
||||
|
||||
@@ -12,12 +12,14 @@ interface GrokCliProviderCardProps {
|
||||
}
|
||||
|
||||
/*
|
||||
FNXC:GrokCli 2026-07-08-00:00:
|
||||
FN-7705: mirrors CursorCliProviderCard.tsx end to end. The one contract
|
||||
difference is auth messaging — Grok is API-key auth (GROK_API_KEY env var or
|
||||
~/.grok/user-settings.json apiKey), not OAuth/session, so the
|
||||
not-authenticated status text references those setting locations instead of
|
||||
a login flow.
|
||||
FNXC:GrokCli 2026-07-09-00:00:
|
||||
FN-7716: readiness now mirrors CursorCliProviderCard.tsx exactly — connected
|
||||
/ ready state = enabled + binary available, no key requirement. The `grok`
|
||||
CLI resolves its own credentials (env var, project `.env`, `grok -k`,
|
||||
GROK_BASE_URL, etc.), so Fusion no longer blocks Enable or shows a
|
||||
not-authenticated error solely because it couldn't see a key. Key presence is
|
||||
surfaced ONLY as a non-blocking informational hint (`apiKeyDetected`) noting
|
||||
that the direct xAI streaming path will use $GROK_API_KEY when present.
|
||||
*/
|
||||
export function GrokCliProviderCard({ authenticated, compact = false, onToggled }: GrokCliProviderCardProps) {
|
||||
const { t } = useTranslation("app");
|
||||
@@ -68,7 +70,7 @@ export function GrokCliProviderCard({ authenticated, compact = false, onToggled
|
||||
|
||||
const currentlyEnabled = status?.enabled ?? authenticated;
|
||||
const binaryAvailable = status?.binary.available ?? false;
|
||||
const apiKeyPresent = status?.binary.authenticated ?? false;
|
||||
const apiKeyDetected = status?.binary.apiKeyDetected ?? false;
|
||||
const trimmedBinaryPath = binaryPathInput.trim();
|
||||
const savedBinaryPath = status?.binaryPath ?? "";
|
||||
const binaryPathChanged = trimmedBinaryPath !== savedBinaryPath;
|
||||
@@ -154,20 +156,24 @@ export function GrokCliProviderCard({ authenticated, compact = false, onToggled
|
||||
);
|
||||
|
||||
/*
|
||||
FNXC:GrokCli 2026-07-08-00:00:
|
||||
Grok is API-key auth (no login flow), so a binary-available-but-no-key
|
||||
state must guide the operator to GROK_API_KEY / ~/.grok/user-settings.json
|
||||
rather than a generic "not connected" message.
|
||||
FNXC:GrokCli 2026-07-09-00:00:
|
||||
FN-7716: the `grok` CLI owns its own authentication, so a binary-available
|
||||
state is "ready" regardless of whether Fusion detected a key — no blocking
|
||||
"set GROK_API_KEY" error. When no key was detected, append a subtle,
|
||||
non-blocking hint that the direct xAI streaming path uses $GROK_API_KEY
|
||||
when present; this never gates Enable or the connected/ready state.
|
||||
*/
|
||||
const statusText = !status
|
||||
? t("setup.grokCli.probing", "Probing local CLI…")
|
||||
: !status.binary.available
|
||||
? status.binary.reason ?? t("setup.grokCli.binaryNotFound", "`grok` not found on PATH")
|
||||
: !apiKeyPresent
|
||||
? t("setup.grokCli.noApiKey", "Binary found, but no API key is configured. Set GROK_API_KEY or ~/.grok/user-settings.json.")
|
||||
: currentlyEnabled
|
||||
? t("setup.grokCli.connected", "Connected{{version}}", { version: status.binary.version ? ` — ${status.binary.version}` : "" })
|
||||
: t("setup.grokCli.detectedPrompt", "Detected. Click Enable to route calls through Grok CLI.");
|
||||
: currentlyEnabled
|
||||
? t("setup.grokCli.connected", "Connected{{version}}", { version: status.binary.version ? ` — ${status.binary.version}` : "" })
|
||||
: t("setup.grokCli.detectedPrompt", "Detected. Click Enable to route calls through Grok CLI.");
|
||||
|
||||
const apiKeyHint = status?.binary.available && !apiKeyDetected
|
||||
? t("setup.grokCli.noApiKeyHint", "No Grok API key detected by Fusion; the CLI will use its own credentials. The direct xAI streaming path uses GROK_API_KEY when present.")
|
||||
: null;
|
||||
|
||||
if (compact) {
|
||||
return (
|
||||
@@ -182,6 +188,7 @@ export function GrokCliProviderCard({ authenticated, compact = false, onToggled
|
||||
</div>
|
||||
<div className="grok-cli-provider-card__body" data-testid="grok-cli-provider-card-body">
|
||||
<small className="settings-muted">{statusText}</small>
|
||||
{apiKeyHint ? <small className="settings-muted grok-cli-provider-card__key-hint">{apiKeyHint}</small> : null}
|
||||
{binaryPathControl}
|
||||
</div>
|
||||
</div>
|
||||
@@ -197,6 +204,7 @@ export function GrokCliProviderCard({ authenticated, compact = false, onToggled
|
||||
<strong className="onboarding-provider-card__name">{t("setup.grokCli.providerName", "Grok — via Grok CLI")}</strong>
|
||||
<span className="onboarding-provider-card__description">{t("setup.grokCli.description", "Route AI calls through your local Grok CLI runtime.")}</span>
|
||||
<small className="settings-muted">{statusText}</small>
|
||||
{apiKeyHint ? <small className="settings-muted grok-cli-provider-card__key-hint">{apiKeyHint}</small> : null}
|
||||
</div>
|
||||
<div className="onboarding-provider-card__actions">{actions}</div>
|
||||
</div>
|
||||
|
||||
@@ -13,7 +13,7 @@ vi.mock("../../api", () => ({
|
||||
}));
|
||||
|
||||
const baseStatus = {
|
||||
binary: { available: true, authenticated: true, version: "1.0.0", binaryPath: "/usr/local/bin/grok", probeDurationMs: 5 },
|
||||
binary: { available: true, authenticated: true, apiKeyDetected: true, version: "1.0.0", binaryPath: "/usr/local/bin/grok", probeDurationMs: 5 },
|
||||
enabled: true,
|
||||
binaryPath: "/usr/local/bin/grok",
|
||||
extension: null,
|
||||
@@ -21,13 +21,14 @@ const baseStatus = {
|
||||
};
|
||||
|
||||
/*
|
||||
FNXC:GrokCli 2026-07-08-00:00:
|
||||
Regression coverage mirroring CursorCliProviderCard.test.tsx (FN-7695) for FN-7705: the compact
|
||||
FNXC:GrokCli 2026-07-09-00:00:
|
||||
FN-7716: regression coverage mirroring CursorCliProviderCard.test.tsx (FN-7695). The compact
|
||||
card's below-header content (status line + binary-path control) must be nested inside
|
||||
`.grok-cli-provider-card__body` (data-testid="grok-cli-provider-card-body") rather than being a
|
||||
bare direct child of `.auth-provider-card`. The non-compact onboarding layout must NOT render
|
||||
this wrapper. Additionally covers the API-key-auth-specific "no API key configured" status text
|
||||
that has no Cursor equivalent (Cursor is OAuth/session, not API-key).
|
||||
this wrapper. Also covers the Symptom Verification invariant: binary-available-but-no-key must
|
||||
render a non-blocking ready state (no "Set GROK_API_KEY" blocking copy) with only a subtle
|
||||
informational apiKeyDetected hint — the CLI owns its own authentication.
|
||||
*/
|
||||
describe("GrokCliProviderCard", () => {
|
||||
beforeEach(() => {
|
||||
@@ -64,16 +65,34 @@ describe("GrokCliProviderCard", () => {
|
||||
expect(body).toContainElement(status);
|
||||
});
|
||||
|
||||
it("shows an actionable no-API-key message when the binary is available but no key is configured", async () => {
|
||||
/*
|
||||
FNXC:GrokCli 2026-07-09-00:00:
|
||||
FN-7716 Symptom Verification: BEFORE the fix, binary-available + no-key
|
||||
rendered a blocking "Set GROK_API_KEY" not-authenticated message and the
|
||||
Enable action was effectively meaningless because `authenticated` was
|
||||
false. AFTER the fix, this exact state (`authenticated: true,
|
||||
apiKeyDetected: false`) must render a non-blocking connected/ready state
|
||||
plus only a subtle informational hint — never the blocking copy.
|
||||
*/
|
||||
it("shows a non-blocking ready state (not a blocking no-API-key error) when the binary is available but no key is detected", async () => {
|
||||
fetchGrokCliStatus.mockResolvedValue({
|
||||
...baseStatus,
|
||||
binary: { ...baseStatus.binary, authenticated: false },
|
||||
binary: { ...baseStatus.binary, authenticated: true, apiKeyDetected: false },
|
||||
});
|
||||
|
||||
render(<GrokCliProviderCard authenticated={false} compact />);
|
||||
render(<GrokCliProviderCard authenticated compact />);
|
||||
|
||||
const status = await screen.findByText(/GROK_API_KEY/i);
|
||||
expect(status.textContent).toContain("~/.grok/user-settings.json");
|
||||
const status = await screen.findByText(/Connected/i);
|
||||
expect(status).toBeInTheDocument();
|
||||
|
||||
const hint = await screen.findByText(/No Grok API key detected by Fusion/i);
|
||||
expect(hint.textContent).toContain("GROK_API_KEY");
|
||||
|
||||
expect(screen.queryByText(/Set GROK_API_KEY/i)).not.toBeInTheDocument();
|
||||
expect(screen.queryByText(/Binary found, but no API key is configured/i)).not.toBeInTheDocument();
|
||||
|
||||
const enableButton = screen.queryByRole("button", { name: /Enable/i });
|
||||
expect(enableButton).not.toBeInTheDocument();
|
||||
});
|
||||
|
||||
it("keeps the body wrapper present when a pathMessage is shown after a failed save", async () => {
|
||||
|
||||
@@ -2385,10 +2385,11 @@ describe("Droid CLI auth routes", () => {
|
||||
expect(probeSpy).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
it("GET /providers/grok-cli/status returns readiness from toggle and binary", async () => {
|
||||
it("GET /providers/grok-cli/status returns readiness from toggle and binary, passing through apiKeyDetected as informational", async () => {
|
||||
vi.spyOn(runtimeProviderProbesModule, "probeGrokCliProvider").mockResolvedValue({
|
||||
available: true,
|
||||
authenticated: true,
|
||||
apiKeyDetected: false,
|
||||
version: "grok 1.0.0",
|
||||
probeDurationMs: 8,
|
||||
});
|
||||
@@ -2404,12 +2405,15 @@ describe("Droid CLI auth routes", () => {
|
||||
expect(res.body.enabled).toBe(true);
|
||||
expect(res.body.binaryPath).toBe("/opt/Grok/grok");
|
||||
expect(res.body.binary.available).toBe(true);
|
||||
expect(res.body.binary.authenticated).toBe(true);
|
||||
expect(res.body.binary.apiKeyDetected).toBe(false);
|
||||
});
|
||||
|
||||
it("GET /auth/status probes Grok CLI with the stored override and requires API-key presence for authenticated:true", async () => {
|
||||
it("GET /auth/status probes Grok CLI with the stored override and derives authenticated:true from toggle+binary availability only", async () => {
|
||||
vi.spyOn(runtimeProviderProbesModule, "probeGrokCliProvider").mockResolvedValue({
|
||||
available: true,
|
||||
authenticated: true,
|
||||
apiKeyDetected: true,
|
||||
version: "grok 1.0.0",
|
||||
binaryPath: "/opt/Grok/grok",
|
||||
configuredBinaryPath: "/opt/Grok/grok",
|
||||
@@ -2432,11 +2436,24 @@ describe("Droid CLI auth routes", () => {
|
||||
);
|
||||
});
|
||||
|
||||
it("GET /auth/status reports grok-cli authenticated:false when the binary is available but no API key is configured", async () => {
|
||||
/*
|
||||
FNXC:GrokCli 2026-07-09-00:00:
|
||||
FN-7716 Symptom Verification: exact reproduction of the original
|
||||
false-negative at the route layer — `useGrokCli` enabled, binary available,
|
||||
but no Fusion-visible API key (probe reports `authenticated: false` with a
|
||||
"GROK_API_KEY is not set" style reason under the OLD probe contract; under
|
||||
the NEW contract the probe itself now reports `authenticated: true` with
|
||||
`apiKeyDetected: false`). This test asserts the injected `grok-cli`
|
||||
`/auth/status` provider is `authenticated: true` in that state (mirroring
|
||||
Cursor's `cursorEnabled && cursorBinary.available` — no key requirement),
|
||||
proving the false negative is resolved end-to-end through the route.
|
||||
*/
|
||||
it("GET /auth/status reports grok-cli authenticated:true when the binary is available but no API key is detected — proves the original false-negative is resolved", async () => {
|
||||
vi.spyOn(runtimeProviderProbesModule, "probeGrokCliProvider").mockResolvedValue({
|
||||
available: true,
|
||||
authenticated: false,
|
||||
reason: "GROK_API_KEY is not set and ~/.grok/user-settings.json was not found",
|
||||
authenticated: true,
|
||||
apiKeyDetected: false,
|
||||
reason: "No Grok API key detected by Fusion (GROK_API_KEY unset, ~/.grok/user-settings.json not found); the CLI will use its own credentials.",
|
||||
version: "grok 1.0.0",
|
||||
probeDurationMs: 8,
|
||||
});
|
||||
@@ -2447,6 +2464,29 @@ describe("Droid CLI auth routes", () => {
|
||||
|
||||
const res = await GET(buildApp(), "/api/auth/status");
|
||||
|
||||
expect(res.status).toBe(200);
|
||||
expect(res.body.providers).toEqual(
|
||||
expect.arrayContaining([
|
||||
expect.objectContaining({ id: "grok-cli", authenticated: true }),
|
||||
]),
|
||||
);
|
||||
});
|
||||
|
||||
it("GET /auth/status reports grok-cli authenticated:false when the binary is unavailable, regardless of the enabled toggle", async () => {
|
||||
vi.spyOn(runtimeProviderProbesModule, "probeGrokCliProvider").mockResolvedValue({
|
||||
available: false,
|
||||
authenticated: false,
|
||||
apiKeyDetected: false,
|
||||
reason: "grok not found on PATH",
|
||||
probeDurationMs: 8,
|
||||
});
|
||||
store.getGlobalSettingsStore = vi.fn().mockReturnValue({
|
||||
...createMockGlobalSettingsStore(),
|
||||
getSettings: vi.fn().mockResolvedValue({ useGrokCli: true }),
|
||||
});
|
||||
|
||||
const res = await GET(buildApp(), "/api/auth/status");
|
||||
|
||||
expect(res.status).toBe(200);
|
||||
expect(res.body.providers).toEqual(
|
||||
expect.arrayContaining([
|
||||
|
||||
@@ -684,13 +684,17 @@ export const registerAuthRoutes: ApiRouteRegistrar = (ctx) => {
|
||||
}
|
||||
|
||||
/*
|
||||
FNXC:GrokCli 2026-07-08-00:00:
|
||||
FN-7705: inject the synthetic "Grok — via Grok CLI" provider, mirroring
|
||||
the cursor-cli injection above. Unlike Cursor (OAuth/session auth,
|
||||
`authenticated` derived from toggle+binary availability only), Grok is
|
||||
API-key auth — `authenticated` also requires the probe's own
|
||||
`authenticated` flag (GROK_API_KEY / ~/.grok/user-settings.json apiKey
|
||||
presence), per the PROMPT.md contract.
|
||||
FNXC:GrokCli 2026-07-09-00:00:
|
||||
FN-7716: inject the synthetic "Grok — via Grok CLI" provider, mirroring
|
||||
the cursor-cli injection above EXACTLY — `authenticated` derives from
|
||||
toggle+binary availability only. The `grok` CLI resolves its own
|
||||
credentials from more sources than Fusion can see (env var, project
|
||||
`.env`, `GROK_BASE_URL`, `grok -k`, sandbox secrets), so requiring a
|
||||
Fusion-visible API key produced false "not authenticated" states for
|
||||
operators with a fully working CLI. Key presence is exposed only via
|
||||
`grokBinary.apiKeyDetected` as a non-blocking informational field on the
|
||||
status route (see GET /providers/grok-cli/status below) — it never
|
||||
gates this `authenticated` flag.
|
||||
*/
|
||||
if (store) {
|
||||
let grokEnabled = false;
|
||||
@@ -704,7 +708,7 @@ export const registerAuthRoutes: ApiRouteRegistrar = (ctx) => {
|
||||
providers.push({
|
||||
id: "grok-cli",
|
||||
name: "Grok — via Grok CLI",
|
||||
authenticated: grokEnabled && grokBinary.available && grokBinary.authenticated === true,
|
||||
authenticated: grokEnabled && grokBinary.available,
|
||||
type: "cli" as const,
|
||||
});
|
||||
}
|
||||
|
||||
@@ -21,13 +21,20 @@ binary on PATH — Fusion never downloads or bundles the CLI itself.
|
||||
|
||||
- Provider ID: `grok-cli`
|
||||
- Binary probe: `grok --version`
|
||||
- **Auth model — API key, not OAuth/session.** Grok has no `status`/`whoami`
|
||||
subcommand. Authentication is derived from key PRESENCE only:
|
||||
1. `GROK_API_KEY` environment variable, or
|
||||
2. `~/.grok/user-settings.json` → `{ "apiKey": "..." }`
|
||||
Base URL defaults to `https://api.x.ai/v1`. A missing/unreadable/malformed
|
||||
key configuration fails closed to `authenticated: false` with an
|
||||
actionable reason — never throws.
|
||||
- **Auth model — the `grok` CLI owns its own authentication; Fusion does
|
||||
not require a Fusion-visible API key to enable/use it (FN-7716).** Grok
|
||||
has no `status`/`whoami` subcommand, so Fusion probes binary availability
|
||||
only and treats a working binary as "ready" (`authenticated: true`). The
|
||||
CLI itself resolves credentials from more sources than Fusion can see
|
||||
(`GROK_API_KEY` env var, a project `.env`, `grok -k <key>`,
|
||||
`GROK_BASE_URL`, sandbox secrets, etc.). Fusion additionally probes two of
|
||||
those locations — the `GROK_API_KEY` env var and
|
||||
`~/.grok/user-settings.json` → `{ "apiKey": "..." }` — purely as a
|
||||
**non-blocking informational hint** (`apiKeyDetected`); it never gates
|
||||
Enable or the authenticated state, and a missing/unreadable/malformed
|
||||
settings file degrades gracefully (never throws). The direct xAI
|
||||
OpenAI-compatible streaming path (base URL `https://api.x.ai/v1`) still
|
||||
uses `$GROK_API_KEY` when present, independent of the CLI provider.
|
||||
- Model discovery: `grok models` (plain-text output, with pricing hints per
|
||||
the upstream README). The exact line shape is
|
||||
`upstream-pending-verification`, so discovery parses conservatively: the
|
||||
@@ -38,17 +45,20 @@ binary on PATH — Fusion never downloads or bundles the CLI itself.
|
||||
|
||||
## Enable via Settings → Authentication
|
||||
|
||||
1. Install the `grok` CLI and set `GROK_API_KEY` (or populate
|
||||
`~/.grok/user-settings.json`).
|
||||
1. Install the `grok` CLI and authenticate it by any method it supports
|
||||
(env var, project `.env`, `grok -k`, etc.) — Fusion does not need to see
|
||||
the key.
|
||||
2. Open Settings → Authentication in the Fusion dashboard.
|
||||
3. The "Grok — via Grok CLI" card shows probe status (binary found, API key
|
||||
present). Click **Enable** once the binary is available.
|
||||
3. The "Grok — via Grok CLI" card shows probe status. Click **Enable** once
|
||||
the binary is available; a non-blocking hint appears only if Fusion did
|
||||
not detect a key, noting the direct xAI streaming path uses
|
||||
`GROK_API_KEY` when present.
|
||||
4. Discovered Grok models (via `grok models`) then merge into the model
|
||||
picker under the `grok-cli` provider id.
|
||||
|
||||
## Notes
|
||||
|
||||
Do not invent a `grok status`/`whoami` JSON auth contract — Grok is
|
||||
API-key auth. See `AGENTS.md`'s "External-integration evidence" policy for
|
||||
why the release/checksum fields above stay at
|
||||
`upstream-pending-verification`.
|
||||
Do not invent a `grok status`/`whoami` JSON auth contract — readiness is
|
||||
derived from binary availability, mirroring the Cursor CLI provider. See
|
||||
`AGENTS.md`'s "External-integration evidence" policy for why the
|
||||
release/checksum fields above stay at `upstream-pending-verification`.
|
||||
|
||||
@@ -16,7 +16,7 @@ describe("probeGrokBinary", () => {
|
||||
delete process.env.GROK_API_KEY;
|
||||
});
|
||||
|
||||
it("reports authenticated:true when GROK_API_KEY is set", async () => {
|
||||
it("reports authenticated:true and apiKeyDetected:true when GROK_API_KEY is set", async () => {
|
||||
process.env.GROK_API_KEY = "xai-test-key";
|
||||
vi.mocked(runGrokCommand).mockResolvedValueOnce({ code: 0, stdout: "grok 1.0.0", stderr: "" });
|
||||
|
||||
@@ -26,11 +26,12 @@ describe("probeGrokBinary", () => {
|
||||
expect(readFile).not.toHaveBeenCalled();
|
||||
expect(result.available).toBe(true);
|
||||
expect(result.authenticated).toBe(true);
|
||||
expect(result.apiKeyDetected).toBe(true);
|
||||
expect(result.version).toBe("grok 1.0.0");
|
||||
expect(result.reason).toBeUndefined();
|
||||
});
|
||||
|
||||
it("falls back to ~/.grok/user-settings.json apiKey when GROK_API_KEY is unset", async () => {
|
||||
it("reports apiKeyDetected:true from ~/.grok/user-settings.json apiKey when GROK_API_KEY is unset", async () => {
|
||||
vi.mocked(runGrokCommand).mockResolvedValueOnce({ code: 0, stdout: "grok 1.0.0", stderr: "" });
|
||||
vi.mocked(readFile).mockResolvedValueOnce(JSON.stringify({ apiKey: "xai-from-file" }));
|
||||
|
||||
@@ -38,38 +39,53 @@ describe("probeGrokBinary", () => {
|
||||
|
||||
expect(result.available).toBe(true);
|
||||
expect(result.authenticated).toBe(true);
|
||||
expect(result.apiKeyDetected).toBe(true);
|
||||
});
|
||||
|
||||
it("fails closed to authenticated:false with an actionable reason when no key is configured", async () => {
|
||||
/*
|
||||
FNXC:GrokCli 2026-07-09-00:00:
|
||||
FN-7716 Symptom Verification: this is the exact reproduction of the
|
||||
original false-negative — binary available, no Fusion-visible key
|
||||
(GROK_API_KEY unset, ~/.grok/user-settings.json unreadable). BEFORE the fix
|
||||
this asserted `authenticated: false` with a "GROK_API_KEY is not set"
|
||||
reason. AFTER the fix, readiness is decoupled from key presence: the CLI
|
||||
is treated as ready (`authenticated: true`) because the binary works, and
|
||||
the previous key-presence signal now surfaces only as the non-blocking
|
||||
`apiKeyDetected: false` informational field.
|
||||
*/
|
||||
it("reports authenticated:true (readiness) with apiKeyDetected:false when no key is configured — proves the original false-negative is resolved", async () => {
|
||||
vi.mocked(runGrokCommand).mockResolvedValueOnce({ code: 0, stdout: "grok 1.0.0", stderr: "" });
|
||||
vi.mocked(readFile).mockRejectedValueOnce(new Error("ENOENT"));
|
||||
|
||||
const result = await probeGrokBinary();
|
||||
|
||||
expect(result.available).toBe(true);
|
||||
expect(result.authenticated).toBe(false);
|
||||
expect(result.reason).toContain("GROK_API_KEY is not set");
|
||||
expect(result.authenticated).toBe(true);
|
||||
expect(result.apiKeyDetected).toBe(false);
|
||||
expect(result.reason).toContain("No Grok API key detected by Fusion");
|
||||
});
|
||||
|
||||
it("fails closed to authenticated:false on malformed ~/.grok/user-settings.json", async () => {
|
||||
it("reports apiKeyDetected:false on malformed ~/.grok/user-settings.json without blocking authenticated", async () => {
|
||||
vi.mocked(runGrokCommand).mockResolvedValueOnce({ code: 0, stdout: "grok 1.0.0", stderr: "" });
|
||||
vi.mocked(readFile).mockResolvedValueOnce("not json at all");
|
||||
|
||||
const result = await probeGrokBinary();
|
||||
|
||||
expect(result.available).toBe(true);
|
||||
expect(result.authenticated).toBe(false);
|
||||
expect(result.authenticated).toBe(true);
|
||||
expect(result.apiKeyDetected).toBe(false);
|
||||
expect(result.reason).toContain("malformed JSON");
|
||||
});
|
||||
|
||||
it("fails closed to authenticated:false when the settings file has no non-empty apiKey", async () => {
|
||||
it("reports apiKeyDetected:false when the settings file has no non-empty apiKey", async () => {
|
||||
vi.mocked(runGrokCommand).mockResolvedValueOnce({ code: 0, stdout: "grok 1.0.0", stderr: "" });
|
||||
vi.mocked(readFile).mockResolvedValueOnce(JSON.stringify({ apiKey: "" }));
|
||||
|
||||
const result = await probeGrokBinary();
|
||||
|
||||
expect(result.available).toBe(true);
|
||||
expect(result.authenticated).toBe(false);
|
||||
expect(result.authenticated).toBe(true);
|
||||
expect(result.apiKeyDetected).toBe(false);
|
||||
expect(result.reason).toContain("no non-empty apiKey field");
|
||||
});
|
||||
|
||||
@@ -83,13 +99,14 @@ describe("probeGrokBinary", () => {
|
||||
expect(runGrokCommand).toHaveBeenCalledWith("grok", ["--version"], 3000);
|
||||
});
|
||||
|
||||
it("reports binary unavailable with actionable diagnostics when the candidate fails", async () => {
|
||||
it("reports binary unavailable with authenticated:false and actionable diagnostics when the candidate fails", async () => {
|
||||
vi.mocked(runGrokCommand).mockResolvedValueOnce({ code: 127, stdout: "", stderr: "spawn error: ENOENT: grok" });
|
||||
|
||||
const result = await probeGrokBinary();
|
||||
|
||||
expect(result.available).toBe(false);
|
||||
expect(result.authenticated).toBe(false);
|
||||
expect(result.apiKeyDetected).toBe(false);
|
||||
expect(result.reason).toContain("not found");
|
||||
expect(result.reason).toContain("grok: spawn error: ENOENT");
|
||||
});
|
||||
@@ -105,6 +122,7 @@ describe("probeGrokBinary", () => {
|
||||
expect(runGrokCommand).toHaveBeenNthCalledWith(1, "/missing/grok", ["--version"], 3000);
|
||||
expect(runGrokCommand).toHaveBeenNthCalledWith(2, "grok", ["--version"], 3000);
|
||||
expect(result.available).toBe(true);
|
||||
expect(result.authenticated).toBe(true);
|
||||
expect(result.binaryPath).toBe("grok");
|
||||
expect(result.usingConfiguredBinaryPath).toBe(false);
|
||||
expect(result.diagnostics?.[0]).toContain("/missing/grok: spawn error: ENOENT");
|
||||
|
||||
@@ -25,22 +25,25 @@ function summarizeFailure(binary: string, stdout: string, stderr: string): strin
|
||||
}
|
||||
|
||||
/*
|
||||
FNXC:GrokCli 2026-07-08-00:00:
|
||||
Grok is API-key auth, NOT an OAuth/session CLI like Cursor — there is no
|
||||
`grok status --format json` (or `whoami`) subcommand to probe. Auth is a Grok
|
||||
API key supplied via the `GROK_API_KEY` env var OR `~/.grok/user-settings.json`
|
||||
`{ "apiKey": ... }` (per the upstream README, verified 2026-07-08). We derive
|
||||
`authenticated` from key PRESENCE only — env var first, then the settings
|
||||
file — and fail closed to `authenticated: false` with an actionable reason on
|
||||
a missing key or an unreadable/malformed settings file. Never throw: a
|
||||
missing/corrupt `~/.grok/user-settings.json` must degrade gracefully, not
|
||||
crash the probe. Do NOT invent a status subcommand for Grok (AGENTS.md /
|
||||
PROMPT.md "Do NOT").
|
||||
FNXC:GrokCli 2026-07-09-00:00:
|
||||
FN-7716: the `grok` CLI resolves its OWN credentials from more sources than
|
||||
Fusion can inspect (project `.env`, `GROK_BASE_URL`, `grok -k`, sandbox
|
||||
secrets), on top of the two locations Fusion checks below (`GROK_API_KEY` env
|
||||
var, `~/.grok/user-settings.json` `{ apiKey }`). Requiring Fusion to see a key
|
||||
before treating the provider as "authenticated" produced false negatives for
|
||||
operators whose CLI was fully authenticated via a method Fusion doesn't
|
||||
check. Key presence is therefore surfaced ONLY as a non-blocking informational
|
||||
signal (`apiKeyDetected`) consumed by `probeGrokBinary` below — it never gates
|
||||
readiness/`authenticated`, which now derives solely from binary availability,
|
||||
mirroring the Cursor CLI provider (`authenticated: cursorEnabled &&
|
||||
cursorBinary.available`). Never throw: a missing/corrupt
|
||||
`~/.grok/user-settings.json` must degrade gracefully, not crash the probe. Do
|
||||
NOT invent a status subcommand for Grok (AGENTS.md / PROMPT.md "Do NOT").
|
||||
*/
|
||||
async function probeGrokApiKeyPresence(): Promise<{ authenticated: boolean; reason?: string }> {
|
||||
async function probeGrokApiKeyPresence(): Promise<{ detected: boolean; reason?: string }> {
|
||||
const envKey = process.env.GROK_API_KEY;
|
||||
if (typeof envKey === "string" && envKey.trim().length > 0) {
|
||||
return { authenticated: true };
|
||||
return { detected: true };
|
||||
}
|
||||
|
||||
const settingsPath = join(homedir(), ".grok", "user-settings.json");
|
||||
@@ -48,17 +51,17 @@ async function probeGrokApiKeyPresence(): Promise<{ authenticated: boolean; reas
|
||||
try {
|
||||
raw = await readFile(settingsPath, "utf-8");
|
||||
} catch {
|
||||
return { authenticated: false, reason: "GROK_API_KEY is not set and ~/.grok/user-settings.json was not found" };
|
||||
return { detected: false, reason: "No Grok API key detected by Fusion (GROK_API_KEY unset, ~/.grok/user-settings.json not found); the CLI will use its own credentials." };
|
||||
}
|
||||
|
||||
try {
|
||||
const parsed = JSON.parse(raw) as { apiKey?: unknown };
|
||||
if (typeof parsed?.apiKey === "string" && parsed.apiKey.trim().length > 0) {
|
||||
return { authenticated: true };
|
||||
return { detected: true };
|
||||
}
|
||||
return { authenticated: false, reason: "~/.grok/user-settings.json has no non-empty apiKey field" };
|
||||
return { detected: false, reason: "No Grok API key detected by Fusion (~/.grok/user-settings.json has no non-empty apiKey field); the CLI will use its own credentials." };
|
||||
} catch {
|
||||
return { authenticated: false, reason: "~/.grok/user-settings.json is malformed JSON" };
|
||||
return { detected: false, reason: "No Grok API key detected by Fusion (~/.grok/user-settings.json is malformed JSON); the CLI will use its own credentials." };
|
||||
}
|
||||
}
|
||||
|
||||
@@ -81,13 +84,15 @@ export async function probeGrokBinary(options?: { timeoutMs?: number; binaryPath
|
||||
probeDurationMs: Date.now() - startedAt,
|
||||
};
|
||||
if (version.code === 0) {
|
||||
const auth = await probeGrokApiKeyPresence();
|
||||
// FNXC:GrokCli 2026-07-09-00:00: readiness = binary available; the CLI owns auth (FN-7716).
|
||||
const keyPresence = await probeGrokApiKeyPresence();
|
||||
return {
|
||||
available: true,
|
||||
authenticated: auth.authenticated,
|
||||
authenticated: true,
|
||||
apiKeyDetected: keyPresence.detected,
|
||||
...common,
|
||||
version: version.stdout.trim() || undefined,
|
||||
reason: auth.authenticated ? undefined : auth.reason,
|
||||
reason: keyPresence.detected ? undefined : keyPresence.reason,
|
||||
};
|
||||
}
|
||||
}
|
||||
@@ -98,6 +103,7 @@ export async function probeGrokBinary(options?: { timeoutMs?: number; binaryPath
|
||||
return {
|
||||
available: false,
|
||||
authenticated: false,
|
||||
apiKeyDetected: false,
|
||||
configuredBinaryPath,
|
||||
usingConfiguredBinaryPath: false,
|
||||
diagnostics: failureDetails.length > 0 ? failureDetails : undefined,
|
||||
|
||||
@@ -1,6 +1,25 @@
|
||||
export interface GrokBinaryStatus {
|
||||
available: boolean;
|
||||
/**
|
||||
* FNXC:GrokCli 2026-07-09-00:00:
|
||||
* FN-7716: means "Grok CLI runtime ready" (the `grok` binary is available
|
||||
* on PATH or at a configured path) — NOT "a Fusion-visible API key was
|
||||
* found". The `grok` CLI owns its own authentication (env var, project
|
||||
* `.env`, `grok -k`, etc.); Fusion no longer requires visibility into a
|
||||
* key to treat the provider as authenticated. See `apiKeyDetected` for the
|
||||
* non-blocking informational key-presence signal.
|
||||
*/
|
||||
authenticated?: boolean;
|
||||
/**
|
||||
* FNXC:GrokCli 2026-07-09-00:00:
|
||||
* FN-7716: non-blocking informational hint only — true when Fusion itself
|
||||
* detected a Grok API key (GROK_API_KEY env var or
|
||||
* ~/.grok/user-settings.json `apiKey`). Never gates `authenticated` or
|
||||
* enable/disable; the direct xAI OpenAI-compatible streaming path
|
||||
* (FN-7711/FN-7714) uses $GROK_API_KEY when present regardless of this CLI
|
||||
* probe.
|
||||
*/
|
||||
apiKeyDetected?: boolean;
|
||||
binaryPath?: string;
|
||||
binaryName?: string;
|
||||
configuredBinaryPath?: string;
|
||||
|
||||
Reference in New Issue
Block a user