diff --git a/.changeset/fn-7716-grok-cli-no-api-key.md b/.changeset/fn-7716-grok-cli-no-api-key.md new file mode 100644 index 0000000000..24a235157d --- /dev/null +++ b/.changeset/fn-7716-grok-cli-no-api-key.md @@ -0,0 +1,7 @@ +--- +"@runfusion/fusion": patch +--- + +summary: Grok CLI no longer requires a Fusion-visible API key — the CLI's own auth is enough to enable it. +category: fix +dev: probeGrokBinary now derives `authenticated` from `grok` binary availability (readiness) instead of GROK_API_KEY/~/.grok/user-settings.json presence, mirroring the Cursor CLI provider; key detection is exposed as a non-blocking `apiKeyDetected` hint. The /auth/status grok-cli provider is authenticated when enabled + binary available; GrokCliProviderCard drops the blocking "Set GROK_API_KEY" state. The direct xAI streaming path still uses $GROK_API_KEY when present (FN-7711/FN-7714 unchanged). diff --git a/packages/dashboard/app/api/legacy.ts b/packages/dashboard/app/api/legacy.ts index a6e78980b4..e03418cd01 100644 --- a/packages/dashboard/app/api/legacy.ts +++ b/packages/dashboard/app/api/legacy.ts @@ -1971,7 +1971,10 @@ export interface CursorCliStatus { export interface GrokCliStatus { binary: { available: boolean; + /** FNXC:GrokCli 2026-07-09-00:00: FN-7716 — "ready" (binary available), not "key present"; the grok CLI owns auth. */ authenticated?: boolean; + /** FNXC:GrokCli 2026-07-09-00:00: FN-7716 — non-blocking informational hint that Fusion detected a Grok API key. Never gates readiness. */ + apiKeyDetected?: boolean; version?: string; binaryPath?: string; configuredBinaryPath?: string; diff --git a/packages/dashboard/app/components/GrokCliProviderCard.css b/packages/dashboard/app/components/GrokCliProviderCard.css index a2a809b5ca..f6f595d97b 100644 --- a/packages/dashboard/app/components/GrokCliProviderCard.css +++ b/packages/dashboard/app/components/GrokCliProviderCard.css @@ -18,6 +18,16 @@ status line and binary-path control render flush against the card's left/right/b padding: 0 var(--space-md) var(--space-sm); } +/* +FNXC:GrokCli 2026-07-09-00:00: +FN-7716: the no-Fusion-visible-key hint is informational only (never blocking), so it renders one +notch quieter than the primary status line via reduced opacity on the shared `.settings-muted` tone +— no new color token, no hardcoded hex. +*/ +.grok-cli-provider-card__key-hint { + opacity: 0.75; +} + .grok-cli-binary-path-control { display: grid; gap: var(--space-xs); diff --git a/packages/dashboard/app/components/GrokCliProviderCard.tsx b/packages/dashboard/app/components/GrokCliProviderCard.tsx index a08a2acd0b..247ae64cde 100644 --- a/packages/dashboard/app/components/GrokCliProviderCard.tsx +++ b/packages/dashboard/app/components/GrokCliProviderCard.tsx @@ -12,12 +12,14 @@ interface GrokCliProviderCardProps { } /* -FNXC:GrokCli 2026-07-08-00:00: -FN-7705: mirrors CursorCliProviderCard.tsx end to end. The one contract -difference is auth messaging — Grok is API-key auth (GROK_API_KEY env var or -~/.grok/user-settings.json apiKey), not OAuth/session, so the -not-authenticated status text references those setting locations instead of -a login flow. +FNXC:GrokCli 2026-07-09-00:00: +FN-7716: readiness now mirrors CursorCliProviderCard.tsx exactly — connected +/ ready state = enabled + binary available, no key requirement. The `grok` +CLI resolves its own credentials (env var, project `.env`, `grok -k`, +GROK_BASE_URL, etc.), so Fusion no longer blocks Enable or shows a +not-authenticated error solely because it couldn't see a key. Key presence is +surfaced ONLY as a non-blocking informational hint (`apiKeyDetected`) noting +that the direct xAI streaming path will use $GROK_API_KEY when present. */ export function GrokCliProviderCard({ authenticated, compact = false, onToggled }: GrokCliProviderCardProps) { const { t } = useTranslation("app"); @@ -68,7 +70,7 @@ export function GrokCliProviderCard({ authenticated, compact = false, onToggled const currentlyEnabled = status?.enabled ?? authenticated; const binaryAvailable = status?.binary.available ?? false; - const apiKeyPresent = status?.binary.authenticated ?? false; + const apiKeyDetected = status?.binary.apiKeyDetected ?? false; const trimmedBinaryPath = binaryPathInput.trim(); const savedBinaryPath = status?.binaryPath ?? ""; const binaryPathChanged = trimmedBinaryPath !== savedBinaryPath; @@ -154,20 +156,24 @@ export function GrokCliProviderCard({ authenticated, compact = false, onToggled ); /* - FNXC:GrokCli 2026-07-08-00:00: - Grok is API-key auth (no login flow), so a binary-available-but-no-key - state must guide the operator to GROK_API_KEY / ~/.grok/user-settings.json - rather than a generic "not connected" message. + FNXC:GrokCli 2026-07-09-00:00: + FN-7716: the `grok` CLI owns its own authentication, so a binary-available + state is "ready" regardless of whether Fusion detected a key — no blocking + "set GROK_API_KEY" error. When no key was detected, append a subtle, + non-blocking hint that the direct xAI streaming path uses $GROK_API_KEY + when present; this never gates Enable or the connected/ready state. */ const statusText = !status ? t("setup.grokCli.probing", "Probing local CLI…") : !status.binary.available ? status.binary.reason ?? t("setup.grokCli.binaryNotFound", "`grok` not found on PATH") - : !apiKeyPresent - ? t("setup.grokCli.noApiKey", "Binary found, but no API key is configured. Set GROK_API_KEY or ~/.grok/user-settings.json.") - : currentlyEnabled - ? t("setup.grokCli.connected", "Connected{{version}}", { version: status.binary.version ? ` — ${status.binary.version}` : "" }) - : t("setup.grokCli.detectedPrompt", "Detected. Click Enable to route calls through Grok CLI."); + : currentlyEnabled + ? t("setup.grokCli.connected", "Connected{{version}}", { version: status.binary.version ? ` — ${status.binary.version}` : "" }) + : t("setup.grokCli.detectedPrompt", "Detected. Click Enable to route calls through Grok CLI."); + + const apiKeyHint = status?.binary.available && !apiKeyDetected + ? t("setup.grokCli.noApiKeyHint", "No Grok API key detected by Fusion; the CLI will use its own credentials. The direct xAI streaming path uses GROK_API_KEY when present.") + : null; if (compact) { return ( @@ -182,6 +188,7 @@ export function GrokCliProviderCard({ authenticated, compact = false, onToggled
{statusText} + {apiKeyHint ? {apiKeyHint} : null} {binaryPathControl}
@@ -197,6 +204,7 @@ export function GrokCliProviderCard({ authenticated, compact = false, onToggled {t("setup.grokCli.providerName", "Grok — via Grok CLI")} {t("setup.grokCli.description", "Route AI calls through your local Grok CLI runtime.")} {statusText} + {apiKeyHint ? {apiKeyHint} : null}
{actions}
diff --git a/packages/dashboard/app/components/__tests__/GrokCliProviderCard.test.tsx b/packages/dashboard/app/components/__tests__/GrokCliProviderCard.test.tsx index 0e53627a12..0e3d1095fd 100644 --- a/packages/dashboard/app/components/__tests__/GrokCliProviderCard.test.tsx +++ b/packages/dashboard/app/components/__tests__/GrokCliProviderCard.test.tsx @@ -13,7 +13,7 @@ vi.mock("../../api", () => ({ })); const baseStatus = { - binary: { available: true, authenticated: true, version: "1.0.0", binaryPath: "/usr/local/bin/grok", probeDurationMs: 5 }, + binary: { available: true, authenticated: true, apiKeyDetected: true, version: "1.0.0", binaryPath: "/usr/local/bin/grok", probeDurationMs: 5 }, enabled: true, binaryPath: "/usr/local/bin/grok", extension: null, @@ -21,13 +21,14 @@ const baseStatus = { }; /* -FNXC:GrokCli 2026-07-08-00:00: -Regression coverage mirroring CursorCliProviderCard.test.tsx (FN-7695) for FN-7705: the compact +FNXC:GrokCli 2026-07-09-00:00: +FN-7716: regression coverage mirroring CursorCliProviderCard.test.tsx (FN-7695). The compact card's below-header content (status line + binary-path control) must be nested inside `.grok-cli-provider-card__body` (data-testid="grok-cli-provider-card-body") rather than being a bare direct child of `.auth-provider-card`. The non-compact onboarding layout must NOT render -this wrapper. Additionally covers the API-key-auth-specific "no API key configured" status text -that has no Cursor equivalent (Cursor is OAuth/session, not API-key). +this wrapper. Also covers the Symptom Verification invariant: binary-available-but-no-key must +render a non-blocking ready state (no "Set GROK_API_KEY" blocking copy) with only a subtle +informational apiKeyDetected hint — the CLI owns its own authentication. */ describe("GrokCliProviderCard", () => { beforeEach(() => { @@ -64,16 +65,34 @@ describe("GrokCliProviderCard", () => { expect(body).toContainElement(status); }); - it("shows an actionable no-API-key message when the binary is available but no key is configured", async () => { + /* + FNXC:GrokCli 2026-07-09-00:00: + FN-7716 Symptom Verification: BEFORE the fix, binary-available + no-key + rendered a blocking "Set GROK_API_KEY" not-authenticated message and the + Enable action was effectively meaningless because `authenticated` was + false. AFTER the fix, this exact state (`authenticated: true, + apiKeyDetected: false`) must render a non-blocking connected/ready state + plus only a subtle informational hint — never the blocking copy. + */ + it("shows a non-blocking ready state (not a blocking no-API-key error) when the binary is available but no key is detected", async () => { fetchGrokCliStatus.mockResolvedValue({ ...baseStatus, - binary: { ...baseStatus.binary, authenticated: false }, + binary: { ...baseStatus.binary, authenticated: true, apiKeyDetected: false }, }); - render(); + render(); - const status = await screen.findByText(/GROK_API_KEY/i); - expect(status.textContent).toContain("~/.grok/user-settings.json"); + const status = await screen.findByText(/Connected/i); + expect(status).toBeInTheDocument(); + + const hint = await screen.findByText(/No Grok API key detected by Fusion/i); + expect(hint.textContent).toContain("GROK_API_KEY"); + + expect(screen.queryByText(/Set GROK_API_KEY/i)).not.toBeInTheDocument(); + expect(screen.queryByText(/Binary found, but no API key is configured/i)).not.toBeInTheDocument(); + + const enableButton = screen.queryByRole("button", { name: /Enable/i }); + expect(enableButton).not.toBeInTheDocument(); }); it("keeps the body wrapper present when a pathMessage is shown after a failed save", async () => { diff --git a/packages/dashboard/src/__tests__/routes-auth.test.ts b/packages/dashboard/src/__tests__/routes-auth.test.ts index c5af40f4d6..00995317a5 100644 --- a/packages/dashboard/src/__tests__/routes-auth.test.ts +++ b/packages/dashboard/src/__tests__/routes-auth.test.ts @@ -2385,10 +2385,11 @@ describe("Droid CLI auth routes", () => { expect(probeSpy).not.toHaveBeenCalled(); }); - it("GET /providers/grok-cli/status returns readiness from toggle and binary", async () => { + it("GET /providers/grok-cli/status returns readiness from toggle and binary, passing through apiKeyDetected as informational", async () => { vi.spyOn(runtimeProviderProbesModule, "probeGrokCliProvider").mockResolvedValue({ available: true, authenticated: true, + apiKeyDetected: false, version: "grok 1.0.0", probeDurationMs: 8, }); @@ -2404,12 +2405,15 @@ describe("Droid CLI auth routes", () => { expect(res.body.enabled).toBe(true); expect(res.body.binaryPath).toBe("/opt/Grok/grok"); expect(res.body.binary.available).toBe(true); + expect(res.body.binary.authenticated).toBe(true); + expect(res.body.binary.apiKeyDetected).toBe(false); }); - it("GET /auth/status probes Grok CLI with the stored override and requires API-key presence for authenticated:true", async () => { + it("GET /auth/status probes Grok CLI with the stored override and derives authenticated:true from toggle+binary availability only", async () => { vi.spyOn(runtimeProviderProbesModule, "probeGrokCliProvider").mockResolvedValue({ available: true, authenticated: true, + apiKeyDetected: true, version: "grok 1.0.0", binaryPath: "/opt/Grok/grok", configuredBinaryPath: "/opt/Grok/grok", @@ -2432,11 +2436,24 @@ describe("Droid CLI auth routes", () => { ); }); - it("GET /auth/status reports grok-cli authenticated:false when the binary is available but no API key is configured", async () => { + /* + FNXC:GrokCli 2026-07-09-00:00: + FN-7716 Symptom Verification: exact reproduction of the original + false-negative at the route layer — `useGrokCli` enabled, binary available, + but no Fusion-visible API key (probe reports `authenticated: false` with a + "GROK_API_KEY is not set" style reason under the OLD probe contract; under + the NEW contract the probe itself now reports `authenticated: true` with + `apiKeyDetected: false`). This test asserts the injected `grok-cli` + `/auth/status` provider is `authenticated: true` in that state (mirroring + Cursor's `cursorEnabled && cursorBinary.available` — no key requirement), + proving the false negative is resolved end-to-end through the route. + */ + it("GET /auth/status reports grok-cli authenticated:true when the binary is available but no API key is detected — proves the original false-negative is resolved", async () => { vi.spyOn(runtimeProviderProbesModule, "probeGrokCliProvider").mockResolvedValue({ available: true, - authenticated: false, - reason: "GROK_API_KEY is not set and ~/.grok/user-settings.json was not found", + authenticated: true, + apiKeyDetected: false, + reason: "No Grok API key detected by Fusion (GROK_API_KEY unset, ~/.grok/user-settings.json not found); the CLI will use its own credentials.", version: "grok 1.0.0", probeDurationMs: 8, }); @@ -2447,6 +2464,29 @@ describe("Droid CLI auth routes", () => { const res = await GET(buildApp(), "/api/auth/status"); + expect(res.status).toBe(200); + expect(res.body.providers).toEqual( + expect.arrayContaining([ + expect.objectContaining({ id: "grok-cli", authenticated: true }), + ]), + ); + }); + + it("GET /auth/status reports grok-cli authenticated:false when the binary is unavailable, regardless of the enabled toggle", async () => { + vi.spyOn(runtimeProviderProbesModule, "probeGrokCliProvider").mockResolvedValue({ + available: false, + authenticated: false, + apiKeyDetected: false, + reason: "grok not found on PATH", + probeDurationMs: 8, + }); + store.getGlobalSettingsStore = vi.fn().mockReturnValue({ + ...createMockGlobalSettingsStore(), + getSettings: vi.fn().mockResolvedValue({ useGrokCli: true }), + }); + + const res = await GET(buildApp(), "/api/auth/status"); + expect(res.status).toBe(200); expect(res.body.providers).toEqual( expect.arrayContaining([ diff --git a/packages/dashboard/src/routes/register-auth-routes.ts b/packages/dashboard/src/routes/register-auth-routes.ts index 8e36d6f881..59476d9fb5 100644 --- a/packages/dashboard/src/routes/register-auth-routes.ts +++ b/packages/dashboard/src/routes/register-auth-routes.ts @@ -684,13 +684,17 @@ export const registerAuthRoutes: ApiRouteRegistrar = (ctx) => { } /* - FNXC:GrokCli 2026-07-08-00:00: - FN-7705: inject the synthetic "Grok — via Grok CLI" provider, mirroring - the cursor-cli injection above. Unlike Cursor (OAuth/session auth, - `authenticated` derived from toggle+binary availability only), Grok is - API-key auth — `authenticated` also requires the probe's own - `authenticated` flag (GROK_API_KEY / ~/.grok/user-settings.json apiKey - presence), per the PROMPT.md contract. + FNXC:GrokCli 2026-07-09-00:00: + FN-7716: inject the synthetic "Grok — via Grok CLI" provider, mirroring + the cursor-cli injection above EXACTLY — `authenticated` derives from + toggle+binary availability only. The `grok` CLI resolves its own + credentials from more sources than Fusion can see (env var, project + `.env`, `GROK_BASE_URL`, `grok -k`, sandbox secrets), so requiring a + Fusion-visible API key produced false "not authenticated" states for + operators with a fully working CLI. Key presence is exposed only via + `grokBinary.apiKeyDetected` as a non-blocking informational field on the + status route (see GET /providers/grok-cli/status below) — it never + gates this `authenticated` flag. */ if (store) { let grokEnabled = false; @@ -704,7 +708,7 @@ export const registerAuthRoutes: ApiRouteRegistrar = (ctx) => { providers.push({ id: "grok-cli", name: "Grok — via Grok CLI", - authenticated: grokEnabled && grokBinary.available && grokBinary.authenticated === true, + authenticated: grokEnabled && grokBinary.available, type: "cli" as const, }); } diff --git a/plugins/fusion-plugin-grok-runtime/README.md b/plugins/fusion-plugin-grok-runtime/README.md index 71b830e429..513be89425 100644 --- a/plugins/fusion-plugin-grok-runtime/README.md +++ b/plugins/fusion-plugin-grok-runtime/README.md @@ -21,13 +21,20 @@ binary on PATH — Fusion never downloads or bundles the CLI itself. - Provider ID: `grok-cli` - Binary probe: `grok --version` -- **Auth model — API key, not OAuth/session.** Grok has no `status`/`whoami` - subcommand. Authentication is derived from key PRESENCE only: - 1. `GROK_API_KEY` environment variable, or - 2. `~/.grok/user-settings.json` → `{ "apiKey": "..." }` - Base URL defaults to `https://api.x.ai/v1`. A missing/unreadable/malformed - key configuration fails closed to `authenticated: false` with an - actionable reason — never throws. +- **Auth model — the `grok` CLI owns its own authentication; Fusion does + not require a Fusion-visible API key to enable/use it (FN-7716).** Grok + has no `status`/`whoami` subcommand, so Fusion probes binary availability + only and treats a working binary as "ready" (`authenticated: true`). The + CLI itself resolves credentials from more sources than Fusion can see + (`GROK_API_KEY` env var, a project `.env`, `grok -k `, + `GROK_BASE_URL`, sandbox secrets, etc.). Fusion additionally probes two of + those locations — the `GROK_API_KEY` env var and + `~/.grok/user-settings.json` → `{ "apiKey": "..." }` — purely as a + **non-blocking informational hint** (`apiKeyDetected`); it never gates + Enable or the authenticated state, and a missing/unreadable/malformed + settings file degrades gracefully (never throws). The direct xAI + OpenAI-compatible streaming path (base URL `https://api.x.ai/v1`) still + uses `$GROK_API_KEY` when present, independent of the CLI provider. - Model discovery: `grok models` (plain-text output, with pricing hints per the upstream README). The exact line shape is `upstream-pending-verification`, so discovery parses conservatively: the @@ -38,17 +45,20 @@ binary on PATH — Fusion never downloads or bundles the CLI itself. ## Enable via Settings → Authentication -1. Install the `grok` CLI and set `GROK_API_KEY` (or populate - `~/.grok/user-settings.json`). +1. Install the `grok` CLI and authenticate it by any method it supports + (env var, project `.env`, `grok -k`, etc.) — Fusion does not need to see + the key. 2. Open Settings → Authentication in the Fusion dashboard. -3. The "Grok — via Grok CLI" card shows probe status (binary found, API key - present). Click **Enable** once the binary is available. +3. The "Grok — via Grok CLI" card shows probe status. Click **Enable** once + the binary is available; a non-blocking hint appears only if Fusion did + not detect a key, noting the direct xAI streaming path uses + `GROK_API_KEY` when present. 4. Discovered Grok models (via `grok models`) then merge into the model picker under the `grok-cli` provider id. ## Notes -Do not invent a `grok status`/`whoami` JSON auth contract — Grok is -API-key auth. See `AGENTS.md`'s "External-integration evidence" policy for -why the release/checksum fields above stay at -`upstream-pending-verification`. +Do not invent a `grok status`/`whoami` JSON auth contract — readiness is +derived from binary availability, mirroring the Cursor CLI provider. See +`AGENTS.md`'s "External-integration evidence" policy for why the +release/checksum fields above stay at `upstream-pending-verification`. diff --git a/plugins/fusion-plugin-grok-runtime/src/__tests__/probe.test.ts b/plugins/fusion-plugin-grok-runtime/src/__tests__/probe.test.ts index 289d5bb9b0..87dd7352d0 100644 --- a/plugins/fusion-plugin-grok-runtime/src/__tests__/probe.test.ts +++ b/plugins/fusion-plugin-grok-runtime/src/__tests__/probe.test.ts @@ -16,7 +16,7 @@ describe("probeGrokBinary", () => { delete process.env.GROK_API_KEY; }); - it("reports authenticated:true when GROK_API_KEY is set", async () => { + it("reports authenticated:true and apiKeyDetected:true when GROK_API_KEY is set", async () => { process.env.GROK_API_KEY = "xai-test-key"; vi.mocked(runGrokCommand).mockResolvedValueOnce({ code: 0, stdout: "grok 1.0.0", stderr: "" }); @@ -26,11 +26,12 @@ describe("probeGrokBinary", () => { expect(readFile).not.toHaveBeenCalled(); expect(result.available).toBe(true); expect(result.authenticated).toBe(true); + expect(result.apiKeyDetected).toBe(true); expect(result.version).toBe("grok 1.0.0"); expect(result.reason).toBeUndefined(); }); - it("falls back to ~/.grok/user-settings.json apiKey when GROK_API_KEY is unset", async () => { + it("reports apiKeyDetected:true from ~/.grok/user-settings.json apiKey when GROK_API_KEY is unset", async () => { vi.mocked(runGrokCommand).mockResolvedValueOnce({ code: 0, stdout: "grok 1.0.0", stderr: "" }); vi.mocked(readFile).mockResolvedValueOnce(JSON.stringify({ apiKey: "xai-from-file" })); @@ -38,38 +39,53 @@ describe("probeGrokBinary", () => { expect(result.available).toBe(true); expect(result.authenticated).toBe(true); + expect(result.apiKeyDetected).toBe(true); }); - it("fails closed to authenticated:false with an actionable reason when no key is configured", async () => { + /* + FNXC:GrokCli 2026-07-09-00:00: + FN-7716 Symptom Verification: this is the exact reproduction of the + original false-negative — binary available, no Fusion-visible key + (GROK_API_KEY unset, ~/.grok/user-settings.json unreadable). BEFORE the fix + this asserted `authenticated: false` with a "GROK_API_KEY is not set" + reason. AFTER the fix, readiness is decoupled from key presence: the CLI + is treated as ready (`authenticated: true`) because the binary works, and + the previous key-presence signal now surfaces only as the non-blocking + `apiKeyDetected: false` informational field. + */ + it("reports authenticated:true (readiness) with apiKeyDetected:false when no key is configured — proves the original false-negative is resolved", async () => { vi.mocked(runGrokCommand).mockResolvedValueOnce({ code: 0, stdout: "grok 1.0.0", stderr: "" }); vi.mocked(readFile).mockRejectedValueOnce(new Error("ENOENT")); const result = await probeGrokBinary(); expect(result.available).toBe(true); - expect(result.authenticated).toBe(false); - expect(result.reason).toContain("GROK_API_KEY is not set"); + expect(result.authenticated).toBe(true); + expect(result.apiKeyDetected).toBe(false); + expect(result.reason).toContain("No Grok API key detected by Fusion"); }); - it("fails closed to authenticated:false on malformed ~/.grok/user-settings.json", async () => { + it("reports apiKeyDetected:false on malformed ~/.grok/user-settings.json without blocking authenticated", async () => { vi.mocked(runGrokCommand).mockResolvedValueOnce({ code: 0, stdout: "grok 1.0.0", stderr: "" }); vi.mocked(readFile).mockResolvedValueOnce("not json at all"); const result = await probeGrokBinary(); expect(result.available).toBe(true); - expect(result.authenticated).toBe(false); + expect(result.authenticated).toBe(true); + expect(result.apiKeyDetected).toBe(false); expect(result.reason).toContain("malformed JSON"); }); - it("fails closed to authenticated:false when the settings file has no non-empty apiKey", async () => { + it("reports apiKeyDetected:false when the settings file has no non-empty apiKey", async () => { vi.mocked(runGrokCommand).mockResolvedValueOnce({ code: 0, stdout: "grok 1.0.0", stderr: "" }); vi.mocked(readFile).mockResolvedValueOnce(JSON.stringify({ apiKey: "" })); const result = await probeGrokBinary(); expect(result.available).toBe(true); - expect(result.authenticated).toBe(false); + expect(result.authenticated).toBe(true); + expect(result.apiKeyDetected).toBe(false); expect(result.reason).toContain("no non-empty apiKey field"); }); @@ -83,13 +99,14 @@ describe("probeGrokBinary", () => { expect(runGrokCommand).toHaveBeenCalledWith("grok", ["--version"], 3000); }); - it("reports binary unavailable with actionable diagnostics when the candidate fails", async () => { + it("reports binary unavailable with authenticated:false and actionable diagnostics when the candidate fails", async () => { vi.mocked(runGrokCommand).mockResolvedValueOnce({ code: 127, stdout: "", stderr: "spawn error: ENOENT: grok" }); const result = await probeGrokBinary(); expect(result.available).toBe(false); expect(result.authenticated).toBe(false); + expect(result.apiKeyDetected).toBe(false); expect(result.reason).toContain("not found"); expect(result.reason).toContain("grok: spawn error: ENOENT"); }); @@ -105,6 +122,7 @@ describe("probeGrokBinary", () => { expect(runGrokCommand).toHaveBeenNthCalledWith(1, "/missing/grok", ["--version"], 3000); expect(runGrokCommand).toHaveBeenNthCalledWith(2, "grok", ["--version"], 3000); expect(result.available).toBe(true); + expect(result.authenticated).toBe(true); expect(result.binaryPath).toBe("grok"); expect(result.usingConfiguredBinaryPath).toBe(false); expect(result.diagnostics?.[0]).toContain("/missing/grok: spawn error: ENOENT"); diff --git a/plugins/fusion-plugin-grok-runtime/src/probe.ts b/plugins/fusion-plugin-grok-runtime/src/probe.ts index 1f64f70824..28b9cfe8c2 100644 --- a/plugins/fusion-plugin-grok-runtime/src/probe.ts +++ b/plugins/fusion-plugin-grok-runtime/src/probe.ts @@ -25,22 +25,25 @@ function summarizeFailure(binary: string, stdout: string, stderr: string): strin } /* -FNXC:GrokCli 2026-07-08-00:00: -Grok is API-key auth, NOT an OAuth/session CLI like Cursor — there is no -`grok status --format json` (or `whoami`) subcommand to probe. Auth is a Grok -API key supplied via the `GROK_API_KEY` env var OR `~/.grok/user-settings.json` -`{ "apiKey": ... }` (per the upstream README, verified 2026-07-08). We derive -`authenticated` from key PRESENCE only — env var first, then the settings -file — and fail closed to `authenticated: false` with an actionable reason on -a missing key or an unreadable/malformed settings file. Never throw: a -missing/corrupt `~/.grok/user-settings.json` must degrade gracefully, not -crash the probe. Do NOT invent a status subcommand for Grok (AGENTS.md / -PROMPT.md "Do NOT"). +FNXC:GrokCli 2026-07-09-00:00: +FN-7716: the `grok` CLI resolves its OWN credentials from more sources than +Fusion can inspect (project `.env`, `GROK_BASE_URL`, `grok -k`, sandbox +secrets), on top of the two locations Fusion checks below (`GROK_API_KEY` env +var, `~/.grok/user-settings.json` `{ apiKey }`). Requiring Fusion to see a key +before treating the provider as "authenticated" produced false negatives for +operators whose CLI was fully authenticated via a method Fusion doesn't +check. Key presence is therefore surfaced ONLY as a non-blocking informational +signal (`apiKeyDetected`) consumed by `probeGrokBinary` below — it never gates +readiness/`authenticated`, which now derives solely from binary availability, +mirroring the Cursor CLI provider (`authenticated: cursorEnabled && +cursorBinary.available`). Never throw: a missing/corrupt +`~/.grok/user-settings.json` must degrade gracefully, not crash the probe. Do +NOT invent a status subcommand for Grok (AGENTS.md / PROMPT.md "Do NOT"). */ -async function probeGrokApiKeyPresence(): Promise<{ authenticated: boolean; reason?: string }> { +async function probeGrokApiKeyPresence(): Promise<{ detected: boolean; reason?: string }> { const envKey = process.env.GROK_API_KEY; if (typeof envKey === "string" && envKey.trim().length > 0) { - return { authenticated: true }; + return { detected: true }; } const settingsPath = join(homedir(), ".grok", "user-settings.json"); @@ -48,17 +51,17 @@ async function probeGrokApiKeyPresence(): Promise<{ authenticated: boolean; reas try { raw = await readFile(settingsPath, "utf-8"); } catch { - return { authenticated: false, reason: "GROK_API_KEY is not set and ~/.grok/user-settings.json was not found" }; + return { detected: false, reason: "No Grok API key detected by Fusion (GROK_API_KEY unset, ~/.grok/user-settings.json not found); the CLI will use its own credentials." }; } try { const parsed = JSON.parse(raw) as { apiKey?: unknown }; if (typeof parsed?.apiKey === "string" && parsed.apiKey.trim().length > 0) { - return { authenticated: true }; + return { detected: true }; } - return { authenticated: false, reason: "~/.grok/user-settings.json has no non-empty apiKey field" }; + return { detected: false, reason: "No Grok API key detected by Fusion (~/.grok/user-settings.json has no non-empty apiKey field); the CLI will use its own credentials." }; } catch { - return { authenticated: false, reason: "~/.grok/user-settings.json is malformed JSON" }; + return { detected: false, reason: "No Grok API key detected by Fusion (~/.grok/user-settings.json is malformed JSON); the CLI will use its own credentials." }; } } @@ -81,13 +84,15 @@ export async function probeGrokBinary(options?: { timeoutMs?: number; binaryPath probeDurationMs: Date.now() - startedAt, }; if (version.code === 0) { - const auth = await probeGrokApiKeyPresence(); + // FNXC:GrokCli 2026-07-09-00:00: readiness = binary available; the CLI owns auth (FN-7716). + const keyPresence = await probeGrokApiKeyPresence(); return { available: true, - authenticated: auth.authenticated, + authenticated: true, + apiKeyDetected: keyPresence.detected, ...common, version: version.stdout.trim() || undefined, - reason: auth.authenticated ? undefined : auth.reason, + reason: keyPresence.detected ? undefined : keyPresence.reason, }; } } @@ -98,6 +103,7 @@ export async function probeGrokBinary(options?: { timeoutMs?: number; binaryPath return { available: false, authenticated: false, + apiKeyDetected: false, configuredBinaryPath, usingConfiguredBinaryPath: false, diagnostics: failureDetails.length > 0 ? failureDetails : undefined, diff --git a/plugins/fusion-plugin-grok-runtime/src/types.ts b/plugins/fusion-plugin-grok-runtime/src/types.ts index 2defb78e57..a2e13f53a9 100644 --- a/plugins/fusion-plugin-grok-runtime/src/types.ts +++ b/plugins/fusion-plugin-grok-runtime/src/types.ts @@ -1,6 +1,25 @@ export interface GrokBinaryStatus { available: boolean; + /** + * FNXC:GrokCli 2026-07-09-00:00: + * FN-7716: means "Grok CLI runtime ready" (the `grok` binary is available + * on PATH or at a configured path) — NOT "a Fusion-visible API key was + * found". The `grok` CLI owns its own authentication (env var, project + * `.env`, `grok -k`, etc.); Fusion no longer requires visibility into a + * key to treat the provider as authenticated. See `apiKeyDetected` for the + * non-blocking informational key-presence signal. + */ authenticated?: boolean; + /** + * FNXC:GrokCli 2026-07-09-00:00: + * FN-7716: non-blocking informational hint only — true when Fusion itself + * detected a Grok API key (GROK_API_KEY env var or + * ~/.grok/user-settings.json `apiKey`). Never gates `authenticated` or + * enable/disable; the direct xAI OpenAI-compatible streaming path + * (FN-7711/FN-7714) uses $GROK_API_KEY when present regardless of this CLI + * probe. + */ + apiKeyDetected?: boolean; binaryPath?: string; binaryName?: string; configuredBinaryPath?: string;