FN-7716: stop requiring a Fusion-visible API key for Grok CLI provider

Grok CLI provider readiness now mirrors the Cursor CLI provider: it is derived from the `grok` binary being available rather than requiring a Fusion-visible GROK_API_KEY or ~/.grok/user-settings.json, since the CLI manages its own auth.

- probeGrokBinary now derives `authenticated` from binary availability (readiness) instead of API-key/user-settings presence; key detection surfaces as a non-blocking `apiKeyDetected` hint
- /auth/status treats the grok-cli provider as authenticated when enabled + binary available
- GrokCliProviderCard drops the blocking "Set GROK_API_KEY" state
- Direct xAI streaming path is unchanged and still uses $GROK_API_KEY when present (FN-7711/FN-7714)
- Added changeset for @runfusion/fusion (patch)

Files changed:
$(cat /tmp/diffstat_fn7716.txt)

Fusion-Task-Id: FN-7716

Fusion-Task-Lineage: ac0efc79-2510-465e-9cd2-4938c08989c9

Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>

.changeset/fn-7716-grok-cli-no-api-key.md

@@ -0,0 +1,7 @@
+---
+"@runfusion/fusion": patch
+---
+
+summary: Grok CLI no longer requires a Fusion-visible API key — the CLI's own auth is enough to enable it.
+category: fix
+dev: probeGrokBinary now derives `authenticated` from `grok` binary availability (readiness) instead of GROK_API_KEY/~/.grok/user-settings.json presence, mirroring the Cursor CLI provider; key detection is exposed as a non-blocking `apiKeyDetected` hint. The /auth/status grok-cli provider is authenticated when enabled + binary available; GrokCliProviderCard drops the blocking "Set GROK_API_KEY" state. The direct xAI streaming path still uses $GROK_API_KEY when present (FN-7711/FN-7714 unchanged).

packages/dashboard/app/api/legacy.ts

@@ -1971,7 +1971,10 @@ export interface CursorCliStatus {
 export interface GrokCliStatus {
   binary: {
     available: boolean;
+    /** FNXC:GrokCli 2026-07-09-00:00: FN-7716 — "ready" (binary available), not "key present"; the grok CLI owns auth. */
     authenticated?: boolean;
+    /** FNXC:GrokCli 2026-07-09-00:00: FN-7716 — non-blocking informational hint that Fusion detected a Grok API key. Never gates readiness. */
+    apiKeyDetected?: boolean;
     version?: string;
     binaryPath?: string;
     configuredBinaryPath?: string;

packages/dashboard/app/components/GrokCliProviderCard.css

@@ -18,6 +18,16 @@ status line and binary-path control render flush against the card's left/right/b
   padding: 0 var(--space-md) var(--space-sm);
 }
 
+/*
+FNXC:GrokCli 2026-07-09-00:00:
+FN-7716: the no-Fusion-visible-key hint is informational only (never blocking), so it renders one
+notch quieter than the primary status line via reduced opacity on the shared `.settings-muted` tone
+— no new color token, no hardcoded hex.
+*/
+.grok-cli-provider-card__key-hint {
+  opacity: 0.75;
+}
+
 .grok-cli-binary-path-control {
   display: grid;
   gap: var(--space-xs);

packages/dashboard/app/components/GrokCliProviderCard.tsx

@@ -12,12 +12,14 @@ interface GrokCliProviderCardProps {
 }
 
 /*
-FNXC:GrokCli 2026-07-08-00:00:
+FNXC:GrokCli 2026-07-09-00:00:
-FN-7705: mirrors CursorCliProviderCard.tsx end to end. The one contract
+FN-7716: readiness now mirrors CursorCliProviderCard.tsx exactly — connected
-difference is auth messaging — Grok is API-key auth (GROK_API_KEY env var or
+/ ready state = enabled + binary available, no key requirement. The `grok`
-~/.grok/user-settings.json apiKey), not OAuth/session, so the
+CLI resolves its own credentials (env var, project `.env`, `grok -k`,
-not-authenticated status text references those setting locations instead of
+GROK_BASE_URL, etc.), so Fusion no longer blocks Enable or shows a
-a login flow.
+not-authenticated error solely because it couldn't see a key. Key presence is
+surfaced ONLY as a non-blocking informational hint (`apiKeyDetected`) noting
+that the direct xAI streaming path will use $GROK_API_KEY when present.
 */
 export function GrokCliProviderCard({ authenticated, compact = false, onToggled }: GrokCliProviderCardProps) {
   const { t } = useTranslation("app");
@@ -68,7 +70,7 @@ export function GrokCliProviderCard({ authenticated, compact = false, onToggled
 
   const currentlyEnabled = status?.enabled ?? authenticated;
   const binaryAvailable = status?.binary.available ?? false;
-  const apiKeyPresent = status?.binary.authenticated ?? false;
+  const apiKeyDetected = status?.binary.apiKeyDetected ?? false;
   const trimmedBinaryPath = binaryPathInput.trim();
   const savedBinaryPath = status?.binaryPath ?? "";
   const binaryPathChanged = trimmedBinaryPath !== savedBinaryPath;
@@ -154,20 +156,24 @@ export function GrokCliProviderCard({ authenticated, compact = false, onToggled
   );
 
   /*
-  FNXC:GrokCli 2026-07-08-00:00:
+  FNXC:GrokCli 2026-07-09-00:00:
-  Grok is API-key auth (no login flow), so a binary-available-but-no-key
+  FN-7716: the `grok` CLI owns its own authentication, so a binary-available
-  state must guide the operator to GROK_API_KEY / ~/.grok/user-settings.json
+  state is "ready" regardless of whether Fusion detected a key — no blocking
-  rather than a generic "not connected" message.
+  "set GROK_API_KEY" error. When no key was detected, append a subtle,
+  non-blocking hint that the direct xAI streaming path uses $GROK_API_KEY
+  when present; this never gates Enable or the connected/ready state.
   */
   const statusText = !status
     ? t("setup.grokCli.probing", "Probing local CLI…")
     : !status.binary.available
       ? status.binary.reason ?? t("setup.grokCli.binaryNotFound", "`grok` not found on PATH")
-      : !apiKeyPresent
+      : currentlyEnabled
-        ? t("setup.grokCli.noApiKey", "Binary found, but no API key is configured. Set GROK_API_KEY or ~/.grok/user-settings.json.")
+        ? t("setup.grokCli.connected", "Connected{{version}}", { version: status.binary.version ? ` — ${status.binary.version}` : "" })
-        : currentlyEnabled
+        : t("setup.grokCli.detectedPrompt", "Detected. Click Enable to route calls through Grok CLI.");
-          ? t("setup.grokCli.connected", "Connected{{version}}", { version: status.binary.version ? ` — ${status.binary.version}` : "" })
+
-          : t("setup.grokCli.detectedPrompt", "Detected. Click Enable to route calls through Grok CLI.");
+  const apiKeyHint = status?.binary.available && !apiKeyDetected
+    ? t("setup.grokCli.noApiKeyHint", "No Grok API key detected by Fusion; the CLI will use its own credentials. The direct xAI streaming path uses GROK_API_KEY when present.")
+    : null;
 
   if (compact) {
     return (
@@ -182,6 +188,7 @@ export function GrokCliProviderCard({ authenticated, compact = false, onToggled
         </div>
         <div className="grok-cli-provider-card__body" data-testid="grok-cli-provider-card-body">
           <small className="settings-muted">{statusText}</small>
+          {apiKeyHint ? <small className="settings-muted grok-cli-provider-card__key-hint">{apiKeyHint}</small> : null}
           {binaryPathControl}
         </div>
       </div>
@@ -197,6 +204,7 @@ export function GrokCliProviderCard({ authenticated, compact = false, onToggled
         <strong className="onboarding-provider-card__name">{t("setup.grokCli.providerName", "Grok — via Grok CLI")}</strong>
         <span className="onboarding-provider-card__description">{t("setup.grokCli.description", "Route AI calls through your local Grok CLI runtime.")}</span>
         <small className="settings-muted">{statusText}</small>
+        {apiKeyHint ? <small className="settings-muted grok-cli-provider-card__key-hint">{apiKeyHint}</small> : null}
       </div>
       <div className="onboarding-provider-card__actions">{actions}</div>
     </div>

packages/dashboard/app/components/__tests__/GrokCliProviderCard.test.tsx

@@ -13,7 +13,7 @@ vi.mock("../../api", () => ({
 }));
 
 const baseStatus = {
-  binary: { available: true, authenticated: true, version: "1.0.0", binaryPath: "/usr/local/bin/grok", probeDurationMs: 5 },
+  binary: { available: true, authenticated: true, apiKeyDetected: true, version: "1.0.0", binaryPath: "/usr/local/bin/grok", probeDurationMs: 5 },
   enabled: true,
   binaryPath: "/usr/local/bin/grok",
   extension: null,
@@ -21,13 +21,14 @@ const baseStatus = {
 };
 
 /*
-FNXC:GrokCli 2026-07-08-00:00:
+FNXC:GrokCli 2026-07-09-00:00:
-Regression coverage mirroring CursorCliProviderCard.test.tsx (FN-7695) for FN-7705: the compact
+FN-7716: regression coverage mirroring CursorCliProviderCard.test.tsx (FN-7695). The compact
 card's below-header content (status line + binary-path control) must be nested inside
 `.grok-cli-provider-card__body` (data-testid="grok-cli-provider-card-body") rather than being a
 bare direct child of `.auth-provider-card`. The non-compact onboarding layout must NOT render
-this wrapper. Additionally covers the API-key-auth-specific "no API key configured" status text
+this wrapper. Also covers the Symptom Verification invariant: binary-available-but-no-key must
-that has no Cursor equivalent (Cursor is OAuth/session, not API-key).
+render a non-blocking ready state (no "Set GROK_API_KEY" blocking copy) with only a subtle
+informational apiKeyDetected hint — the CLI owns its own authentication.
 */
 describe("GrokCliProviderCard", () => {
   beforeEach(() => {
@@ -64,16 +65,34 @@ describe("GrokCliProviderCard", () => {
     expect(body).toContainElement(status);
   });
 
-  it("shows an actionable no-API-key message when the binary is available but no key is configured", async () => {
+  /*
+  FNXC:GrokCli 2026-07-09-00:00:
+  FN-7716 Symptom Verification: BEFORE the fix, binary-available + no-key
+  rendered a blocking "Set GROK_API_KEY" not-authenticated message and the
+  Enable action was effectively meaningless because `authenticated` was
+  false. AFTER the fix, this exact state (`authenticated: true,
+  apiKeyDetected: false`) must render a non-blocking connected/ready state
+  plus only a subtle informational hint — never the blocking copy.
+  */
+  it("shows a non-blocking ready state (not a blocking no-API-key error) when the binary is available but no key is detected", async () => {
     fetchGrokCliStatus.mockResolvedValue({
       ...baseStatus,
-      binary: { ...baseStatus.binary, authenticated: false },
+      binary: { ...baseStatus.binary, authenticated: true, apiKeyDetected: false },
     });
 
-    render(<GrokCliProviderCard authenticated={false} compact />);
+    render(<GrokCliProviderCard authenticated compact />);
 
-    const status = await screen.findByText(/GROK_API_KEY/i);
+    const status = await screen.findByText(/Connected/i);
-    expect(status.textContent).toContain("~/.grok/user-settings.json");
+    expect(status).toBeInTheDocument();
+
+    const hint = await screen.findByText(/No Grok API key detected by Fusion/i);
+    expect(hint.textContent).toContain("GROK_API_KEY");
+
+    expect(screen.queryByText(/Set GROK_API_KEY/i)).not.toBeInTheDocument();
+    expect(screen.queryByText(/Binary found, but no API key is configured/i)).not.toBeInTheDocument();
+
+    const enableButton = screen.queryByRole("button", { name: /Enable/i });
+    expect(enableButton).not.toBeInTheDocument();
   });
 
   it("keeps the body wrapper present when a pathMessage is shown after a failed save", async () => {

packages/dashboard/src/__tests__/routes-auth.test.ts

@@ -2385,10 +2385,11 @@ describe("Droid CLI auth routes", () => {
     expect(probeSpy).not.toHaveBeenCalled();
   });
 
-  it("GET /providers/grok-cli/status returns readiness from toggle and binary", async () => {
+  it("GET /providers/grok-cli/status returns readiness from toggle and binary, passing through apiKeyDetected as informational", async () => {
     vi.spyOn(runtimeProviderProbesModule, "probeGrokCliProvider").mockResolvedValue({
       available: true,
       authenticated: true,
+      apiKeyDetected: false,
       version: "grok 1.0.0",
       probeDurationMs: 8,
     });
@@ -2404,12 +2405,15 @@ describe("Droid CLI auth routes", () => {
     expect(res.body.enabled).toBe(true);
     expect(res.body.binaryPath).toBe("/opt/Grok/grok");
     expect(res.body.binary.available).toBe(true);
+    expect(res.body.binary.authenticated).toBe(true);
+    expect(res.body.binary.apiKeyDetected).toBe(false);
   });
 
-  it("GET /auth/status probes Grok CLI with the stored override and requires API-key presence for authenticated:true", async () => {
+  it("GET /auth/status probes Grok CLI with the stored override and derives authenticated:true from toggle+binary availability only", async () => {
     vi.spyOn(runtimeProviderProbesModule, "probeGrokCliProvider").mockResolvedValue({
       available: true,
       authenticated: true,
+      apiKeyDetected: true,
       version: "grok 1.0.0",
       binaryPath: "/opt/Grok/grok",
       configuredBinaryPath: "/opt/Grok/grok",
@@ -2432,11 +2436,24 @@ describe("Droid CLI auth routes", () => {
     );
   });
 
-  it("GET /auth/status reports grok-cli authenticated:false when the binary is available but no API key is configured", async () => {
+  /*
+  FNXC:GrokCli 2026-07-09-00:00:
+  FN-7716 Symptom Verification: exact reproduction of the original
+  false-negative at the route layer — `useGrokCli` enabled, binary available,
+  but no Fusion-visible API key (probe reports `authenticated: false` with a
+  "GROK_API_KEY is not set" style reason under the OLD probe contract; under
+  the NEW contract the probe itself now reports `authenticated: true` with
+  `apiKeyDetected: false`). This test asserts the injected `grok-cli`
+  `/auth/status` provider is `authenticated: true` in that state (mirroring
+  Cursor's `cursorEnabled && cursorBinary.available` — no key requirement),
+  proving the false negative is resolved end-to-end through the route.
+  */
+  it("GET /auth/status reports grok-cli authenticated:true when the binary is available but no API key is detected — proves the original false-negative is resolved", async () => {
     vi.spyOn(runtimeProviderProbesModule, "probeGrokCliProvider").mockResolvedValue({
       available: true,
-      authenticated: false,
+      authenticated: true,
-      reason: "GROK_API_KEY is not set and ~/.grok/user-settings.json was not found",
+      apiKeyDetected: false,
+      reason: "No Grok API key detected by Fusion (GROK_API_KEY unset, ~/.grok/user-settings.json not found); the CLI will use its own credentials.",
       version: "grok 1.0.0",
       probeDurationMs: 8,
     });
@@ -2447,6 +2464,29 @@ describe("Droid CLI auth routes", () => {
 
     const res = await GET(buildApp(), "/api/auth/status");
 
+    expect(res.status).toBe(200);
+    expect(res.body.providers).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({ id: "grok-cli", authenticated: true }),
+      ]),
+    );
+  });
+
+  it("GET /auth/status reports grok-cli authenticated:false when the binary is unavailable, regardless of the enabled toggle", async () => {
+    vi.spyOn(runtimeProviderProbesModule, "probeGrokCliProvider").mockResolvedValue({
+      available: false,
+      authenticated: false,
+      apiKeyDetected: false,
+      reason: "grok not found on PATH",
+      probeDurationMs: 8,
+    });
+    store.getGlobalSettingsStore = vi.fn().mockReturnValue({
+      ...createMockGlobalSettingsStore(),
+      getSettings: vi.fn().mockResolvedValue({ useGrokCli: true }),
+    });
+
+    const res = await GET(buildApp(), "/api/auth/status");
+
     expect(res.status).toBe(200);
     expect(res.body.providers).toEqual(
       expect.arrayContaining([

packages/dashboard/src/routes/register-auth-routes.ts

@@ -684,13 +684,17 @@ export const registerAuthRoutes: ApiRouteRegistrar = (ctx) => {
       }
 
       /*
-      FNXC:GrokCli 2026-07-08-00:00:
+      FNXC:GrokCli 2026-07-09-00:00:
-      FN-7705: inject the synthetic "Grok — via Grok CLI" provider, mirroring
+      FN-7716: inject the synthetic "Grok — via Grok CLI" provider, mirroring
-      the cursor-cli injection above. Unlike Cursor (OAuth/session auth,
+      the cursor-cli injection above EXACTLY — `authenticated` derives from
-      `authenticated` derived from toggle+binary availability only), Grok is
+      toggle+binary availability only. The `grok` CLI resolves its own
-      API-key auth — `authenticated` also requires the probe's own
+      credentials from more sources than Fusion can see (env var, project
-      `authenticated` flag (GROK_API_KEY / ~/.grok/user-settings.json apiKey
+      `.env`, `GROK_BASE_URL`, `grok -k`, sandbox secrets), so requiring a
-      presence), per the PROMPT.md contract.
+      Fusion-visible API key produced false "not authenticated" states for
+      operators with a fully working CLI. Key presence is exposed only via
+      `grokBinary.apiKeyDetected` as a non-blocking informational field on the
+      status route (see GET /providers/grok-cli/status below) — it never
+      gates this `authenticated` flag.
       */
       if (store) {
         let grokEnabled = false;
@@ -704,7 +708,7 @@ export const registerAuthRoutes: ApiRouteRegistrar = (ctx) => {
         providers.push({
           id: "grok-cli",
           name: "Grok — via Grok CLI",
-          authenticated: grokEnabled && grokBinary.available && grokBinary.authenticated === true,
+          authenticated: grokEnabled && grokBinary.available,
           type: "cli" as const,
         });
       }

plugins/fusion-plugin-grok-runtime/README.md

@@ -21,13 +21,20 @@ binary on PATH — Fusion never downloads or bundles the CLI itself.
 
 - Provider ID: `grok-cli`
 - Binary probe: `grok --version`
-- **Auth model — API key, not OAuth/session.** Grok has no `status`/`whoami`
+- **Auth model — the `grok` CLI owns its own authentication; Fusion does
-  subcommand. Authentication is derived from key PRESENCE only:
+  not require a Fusion-visible API key to enable/use it (FN-7716).** Grok
-  1. `GROK_API_KEY` environment variable, or
+  has no `status`/`whoami` subcommand, so Fusion probes binary availability
-  2. `~/.grok/user-settings.json` → `{ "apiKey": "..." }`
+  only and treats a working binary as "ready" (`authenticated: true`). The
-  Base URL defaults to `https://api.x.ai/v1`. A missing/unreadable/malformed
+  CLI itself resolves credentials from more sources than Fusion can see
-  key configuration fails closed to `authenticated: false` with an
+  (`GROK_API_KEY` env var, a project `.env`, `grok -k <key>`,
-  actionable reason — never throws.
+  `GROK_BASE_URL`, sandbox secrets, etc.). Fusion additionally probes two of
+  those locations — the `GROK_API_KEY` env var and
+  `~/.grok/user-settings.json` → `{ "apiKey": "..." }` — purely as a
+  **non-blocking informational hint** (`apiKeyDetected`); it never gates
+  Enable or the authenticated state, and a missing/unreadable/malformed
+  settings file degrades gracefully (never throws). The direct xAI
+  OpenAI-compatible streaming path (base URL `https://api.x.ai/v1`) still
+  uses `$GROK_API_KEY` when present, independent of the CLI provider.
 - Model discovery: `grok models` (plain-text output, with pricing hints per
   the upstream README). The exact line shape is
   `upstream-pending-verification`, so discovery parses conservatively: the
@@ -38,17 +45,20 @@ binary on PATH — Fusion never downloads or bundles the CLI itself.
 
 ## Enable via Settings → Authentication
 
-1. Install the `grok` CLI and set `GROK_API_KEY` (or populate
+1. Install the `grok` CLI and authenticate it by any method it supports
-   `~/.grok/user-settings.json`).
+   (env var, project `.env`, `grok -k`, etc.) — Fusion does not need to see
+   the key.
 2. Open Settings → Authentication in the Fusion dashboard.
-3. The "Grok — via Grok CLI" card shows probe status (binary found, API key
+3. The "Grok — via Grok CLI" card shows probe status. Click **Enable** once
-   present). Click **Enable** once the binary is available.
+   the binary is available; a non-blocking hint appears only if Fusion did
+   not detect a key, noting the direct xAI streaming path uses
+   `GROK_API_KEY` when present.
 4. Discovered Grok models (via `grok models`) then merge into the model
    picker under the `grok-cli` provider id.
 
 ## Notes
 
-Do not invent a `grok status`/`whoami` JSON auth contract — Grok is
+Do not invent a `grok status`/`whoami` JSON auth contract — readiness is
-API-key auth. See `AGENTS.md`'s "External-integration evidence" policy for
+derived from binary availability, mirroring the Cursor CLI provider. See
-why the release/checksum fields above stay at
+`AGENTS.md`'s "External-integration evidence" policy for why the
-`upstream-pending-verification`.
+release/checksum fields above stay at `upstream-pending-verification`.

plugins/fusion-plugin-grok-runtime/src/__tests__/probe.test.ts

@@ -16,7 +16,7 @@ describe("probeGrokBinary", () => {
     delete process.env.GROK_API_KEY;
   });
 
-  it("reports authenticated:true when GROK_API_KEY is set", async () => {
+  it("reports authenticated:true and apiKeyDetected:true when GROK_API_KEY is set", async () => {
     process.env.GROK_API_KEY = "xai-test-key";
     vi.mocked(runGrokCommand).mockResolvedValueOnce({ code: 0, stdout: "grok 1.0.0", stderr: "" });
 
@@ -26,11 +26,12 @@ describe("probeGrokBinary", () => {
     expect(readFile).not.toHaveBeenCalled();
     expect(result.available).toBe(true);
     expect(result.authenticated).toBe(true);
+    expect(result.apiKeyDetected).toBe(true);
     expect(result.version).toBe("grok 1.0.0");
     expect(result.reason).toBeUndefined();
   });
 
-  it("falls back to ~/.grok/user-settings.json apiKey when GROK_API_KEY is unset", async () => {
+  it("reports apiKeyDetected:true from ~/.grok/user-settings.json apiKey when GROK_API_KEY is unset", async () => {
     vi.mocked(runGrokCommand).mockResolvedValueOnce({ code: 0, stdout: "grok 1.0.0", stderr: "" });
     vi.mocked(readFile).mockResolvedValueOnce(JSON.stringify({ apiKey: "xai-from-file" }));
 
@@ -38,38 +39,53 @@ describe("probeGrokBinary", () => {
 
     expect(result.available).toBe(true);
     expect(result.authenticated).toBe(true);
+    expect(result.apiKeyDetected).toBe(true);
   });
 
-  it("fails closed to authenticated:false with an actionable reason when no key is configured", async () => {
+  /*
+  FNXC:GrokCli 2026-07-09-00:00:
+  FN-7716 Symptom Verification: this is the exact reproduction of the
+  original false-negative — binary available, no Fusion-visible key
+  (GROK_API_KEY unset, ~/.grok/user-settings.json unreadable). BEFORE the fix
+  this asserted `authenticated: false` with a "GROK_API_KEY is not set"
+  reason. AFTER the fix, readiness is decoupled from key presence: the CLI
+  is treated as ready (`authenticated: true`) because the binary works, and
+  the previous key-presence signal now surfaces only as the non-blocking
+  `apiKeyDetected: false` informational field.
+  */
+  it("reports authenticated:true (readiness) with apiKeyDetected:false when no key is configured — proves the original false-negative is resolved", async () => {
     vi.mocked(runGrokCommand).mockResolvedValueOnce({ code: 0, stdout: "grok 1.0.0", stderr: "" });
     vi.mocked(readFile).mockRejectedValueOnce(new Error("ENOENT"));
 
     const result = await probeGrokBinary();
 
     expect(result.available).toBe(true);
-    expect(result.authenticated).toBe(false);
+    expect(result.authenticated).toBe(true);
-    expect(result.reason).toContain("GROK_API_KEY is not set");
+    expect(result.apiKeyDetected).toBe(false);
+    expect(result.reason).toContain("No Grok API key detected by Fusion");
   });
 
-  it("fails closed to authenticated:false on malformed ~/.grok/user-settings.json", async () => {
+  it("reports apiKeyDetected:false on malformed ~/.grok/user-settings.json without blocking authenticated", async () => {
     vi.mocked(runGrokCommand).mockResolvedValueOnce({ code: 0, stdout: "grok 1.0.0", stderr: "" });
     vi.mocked(readFile).mockResolvedValueOnce("not json at all");
 
     const result = await probeGrokBinary();
 
     expect(result.available).toBe(true);
-    expect(result.authenticated).toBe(false);
+    expect(result.authenticated).toBe(true);
+    expect(result.apiKeyDetected).toBe(false);
     expect(result.reason).toContain("malformed JSON");
   });
 
-  it("fails closed to authenticated:false when the settings file has no non-empty apiKey", async () => {
+  it("reports apiKeyDetected:false when the settings file has no non-empty apiKey", async () => {
     vi.mocked(runGrokCommand).mockResolvedValueOnce({ code: 0, stdout: "grok 1.0.0", stderr: "" });
     vi.mocked(readFile).mockResolvedValueOnce(JSON.stringify({ apiKey: "" }));
 
     const result = await probeGrokBinary();
 
     expect(result.available).toBe(true);
-    expect(result.authenticated).toBe(false);
+    expect(result.authenticated).toBe(true);
+    expect(result.apiKeyDetected).toBe(false);
     expect(result.reason).toContain("no non-empty apiKey field");
   });
 
@@ -83,13 +99,14 @@ describe("probeGrokBinary", () => {
     expect(runGrokCommand).toHaveBeenCalledWith("grok", ["--version"], 3000);
   });
 
-  it("reports binary unavailable with actionable diagnostics when the candidate fails", async () => {
+  it("reports binary unavailable with authenticated:false and actionable diagnostics when the candidate fails", async () => {
     vi.mocked(runGrokCommand).mockResolvedValueOnce({ code: 127, stdout: "", stderr: "spawn error: ENOENT: grok" });
 
     const result = await probeGrokBinary();
 
     expect(result.available).toBe(false);
     expect(result.authenticated).toBe(false);
+    expect(result.apiKeyDetected).toBe(false);
     expect(result.reason).toContain("not found");
     expect(result.reason).toContain("grok: spawn error: ENOENT");
   });
@@ -105,6 +122,7 @@ describe("probeGrokBinary", () => {
     expect(runGrokCommand).toHaveBeenNthCalledWith(1, "/missing/grok", ["--version"], 3000);
     expect(runGrokCommand).toHaveBeenNthCalledWith(2, "grok", ["--version"], 3000);
     expect(result.available).toBe(true);
+    expect(result.authenticated).toBe(true);
     expect(result.binaryPath).toBe("grok");
     expect(result.usingConfiguredBinaryPath).toBe(false);
     expect(result.diagnostics?.[0]).toContain("/missing/grok: spawn error: ENOENT");

plugins/fusion-plugin-grok-runtime/src/probe.ts

@@ -25,22 +25,25 @@ function summarizeFailure(binary: string, stdout: string, stderr: string): strin
 }
 
 /*
-FNXC:GrokCli 2026-07-08-00:00:
+FNXC:GrokCli 2026-07-09-00:00:
-Grok is API-key auth, NOT an OAuth/session CLI like Cursor — there is no
+FN-7716: the `grok` CLI resolves its OWN credentials from more sources than
-`grok status --format json` (or `whoami`) subcommand to probe. Auth is a Grok
+Fusion can inspect (project `.env`, `GROK_BASE_URL`, `grok -k`, sandbox
-API key supplied via the `GROK_API_KEY` env var OR `~/.grok/user-settings.json`
+secrets), on top of the two locations Fusion checks below (`GROK_API_KEY` env
-`{ "apiKey": ... }` (per the upstream README, verified 2026-07-08). We derive
+var, `~/.grok/user-settings.json` `{ apiKey }`). Requiring Fusion to see a key
-`authenticated` from key PRESENCE only — env var first, then the settings
+before treating the provider as "authenticated" produced false negatives for
-file — and fail closed to `authenticated: false` with an actionable reason on
+operators whose CLI was fully authenticated via a method Fusion doesn't
-a missing key or an unreadable/malformed settings file. Never throw: a
+check. Key presence is therefore surfaced ONLY as a non-blocking informational
-missing/corrupt `~/.grok/user-settings.json` must degrade gracefully, not
+signal (`apiKeyDetected`) consumed by `probeGrokBinary` below — it never gates
-crash the probe. Do NOT invent a status subcommand for Grok (AGENTS.md /
+readiness/`authenticated`, which now derives solely from binary availability,
-PROMPT.md "Do NOT").
+mirroring the Cursor CLI provider (`authenticated: cursorEnabled &&
+cursorBinary.available`). Never throw: a missing/corrupt
+`~/.grok/user-settings.json` must degrade gracefully, not crash the probe. Do
+NOT invent a status subcommand for Grok (AGENTS.md / PROMPT.md "Do NOT").
 */
-async function probeGrokApiKeyPresence(): Promise<{ authenticated: boolean; reason?: string }> {
+async function probeGrokApiKeyPresence(): Promise<{ detected: boolean; reason?: string }> {
   const envKey = process.env.GROK_API_KEY;
   if (typeof envKey === "string" && envKey.trim().length > 0) {
-    return { authenticated: true };
+    return { detected: true };
   }
 
   const settingsPath = join(homedir(), ".grok", "user-settings.json");
@@ -48,17 +51,17 @@ async function probeGrokApiKeyPresence(): Promise<{ authenticated: boolean; reas
   try {
     raw = await readFile(settingsPath, "utf-8");
   } catch {
-    return { authenticated: false, reason: "GROK_API_KEY is not set and ~/.grok/user-settings.json was not found" };
+    return { detected: false, reason: "No Grok API key detected by Fusion (GROK_API_KEY unset, ~/.grok/user-settings.json not found); the CLI will use its own credentials." };
   }
 
   try {
     const parsed = JSON.parse(raw) as { apiKey?: unknown };
     if (typeof parsed?.apiKey === "string" && parsed.apiKey.trim().length > 0) {
-      return { authenticated: true };
+      return { detected: true };
     }
-    return { authenticated: false, reason: "~/.grok/user-settings.json has no non-empty apiKey field" };
+    return { detected: false, reason: "No Grok API key detected by Fusion (~/.grok/user-settings.json has no non-empty apiKey field); the CLI will use its own credentials." };
   } catch {
-    return { authenticated: false, reason: "~/.grok/user-settings.json is malformed JSON" };
+    return { detected: false, reason: "No Grok API key detected by Fusion (~/.grok/user-settings.json is malformed JSON); the CLI will use its own credentials." };
   }
 }
 
@@ -81,13 +84,15 @@ export async function probeGrokBinary(options?: { timeoutMs?: number; binaryPath
       probeDurationMs: Date.now() - startedAt,
     };
     if (version.code === 0) {
-      const auth = await probeGrokApiKeyPresence();
+      // FNXC:GrokCli 2026-07-09-00:00: readiness = binary available; the CLI owns auth (FN-7716).
+      const keyPresence = await probeGrokApiKeyPresence();
       return {
         available: true,
-        authenticated: auth.authenticated,
+        authenticated: true,
+        apiKeyDetected: keyPresence.detected,
         ...common,
         version: version.stdout.trim() || undefined,
-        reason: auth.authenticated ? undefined : auth.reason,
+        reason: keyPresence.detected ? undefined : keyPresence.reason,
       };
     }
   }
@@ -98,6 +103,7 @@ export async function probeGrokBinary(options?: { timeoutMs?: number; binaryPath
   return {
     available: false,
     authenticated: false,
+    apiKeyDetected: false,
     configuredBinaryPath,
     usingConfiguredBinaryPath: false,
     diagnostics: failureDetails.length > 0 ? failureDetails : undefined,

plugins/fusion-plugin-grok-runtime/src/types.ts

@@ -1,6 +1,25 @@
 export interface GrokBinaryStatus {
   available: boolean;
+  /**
+   * FNXC:GrokCli 2026-07-09-00:00:
+   * FN-7716: means "Grok CLI runtime ready" (the `grok` binary is available
+   * on PATH or at a configured path) — NOT "a Fusion-visible API key was
+   * found". The `grok` CLI owns its own authentication (env var, project
+   * `.env`, `grok -k`, etc.); Fusion no longer requires visibility into a
+   * key to treat the provider as authenticated. See `apiKeyDetected` for the
+   * non-blocking informational key-presence signal.
+   */
   authenticated?: boolean;
+  /**
+   * FNXC:GrokCli 2026-07-09-00:00:
+   * FN-7716: non-blocking informational hint only — true when Fusion itself
+   * detected a Grok API key (GROK_API_KEY env var or
+   * ~/.grok/user-settings.json `apiKey`). Never gates `authenticated` or
+   * enable/disable; the direct xAI OpenAI-compatible streaming path
+   * (FN-7711/FN-7714) uses $GROK_API_KEY when present regardless of this CLI
+   * probe.
+   */
+  apiKeyDetected?: boolean;
   binaryPath?: string;
   binaryName?: string;
   configuredBinaryPath?: string;