fix(auth): install official grok cli

Author: skulidropek

packages/api/src/services/project-auth.ts

@@ -29,6 +29,7 @@ const projectClaudeLabelKey = "CLAUDE_AUTH_LABEL"
 const projectGeminiLabelKey = "GEMINI_AUTH_LABEL"
 const projectGrokLabelKey = "GROK_AUTH_LABEL"
 const defaultGitUser = "x-access-token"
+const grokEnvApiKeyNames: ReadonlyArray<string> = ["GROK_DEPLOYMENT_KEY", "GROK_API_KEY", "XAI_API_KEY"]
 
 const normalizeLabel = (value: string): string => {
   const trimmed = value.trim()
@@ -258,6 +259,12 @@ const grokUserSettingsCredentialMarkers: ReadonlyArray<RegExp> = [
   /"oauth"\s*:\s*\{[\s\S]*?"(?:apiKey|accessToken|access_token|authToken|refreshToken|refresh_token|token)"\s*:\s*"[^"]+"/u
 ]
 
+const grokAuthJsonCredentialMarkers: ReadonlyArray<RegExp> = [
+  /"key"\s*:\s*"[^"]+"/u,
+  /"token"\s*:\s*"[^"]+"/u,
+  /"accessToken"\s*:\s*"[^"]+"/u
+]
+
 const hasGrokUserSettingsCredentials = (
   fs: FileSystem.FileSystem,
   settingsPath: string
@@ -272,6 +279,20 @@ const hasGrokUserSettingsCredentials = (
     return grokUserSettingsCredentialMarkers.some((marker) => marker.test(settingsText))
   })
 
+const hasGrokAuthJsonCredentials = (
+  fs: FileSystem.FileSystem,
+  authJsonPath: string
+): Effect.Effect<boolean, PlatformError> =>
+  Effect.gen(function*(_) {
+    const hasFile = yield* _(hasFileAtPath(fs, authJsonPath))
+    if (!hasFile) {
+      return false
+    }
+
+    const authJsonText = yield* _(fs.readFileString(authJsonPath), Effect.orElseSucceed(() => ""))
+    return grokAuthJsonCredentialMarkers.some((marker) => marker.test(authJsonText))
+  })
+
 const hasGrokAccountCredentials = (
   fs: FileSystem.FileSystem,
   accountPath: string
@@ -282,12 +303,19 @@ const hasGrokAccountCredentials = (
         return Effect.succeed(true)
       }
 
-      return hasApiKeyInEnvFile(fs, `${accountPath}/.env`, "GROK_API_KEY").pipe(
+      return Effect.forEach(grokEnvApiKeyNames, (key) => hasApiKeyInEnvFile(fs, `${accountPath}/.env`, key)).pipe(
+        Effect.map((results) => results.some((result) => result)),
         Effect.flatMap((hasEnvApiKey) => {
           if (hasEnvApiKey) {
             return Effect.succeed(true)
           }
-          return hasGrokUserSettingsCredentials(fs, `${accountPath}/.grok/user-settings.json`)
+          return hasGrokAuthJsonCredentials(fs, `${accountPath}/.grok/auth.json`).pipe(
+            Effect.flatMap((hasAuthJson) =>
+              hasAuthJson
+                ? Effect.succeed(true)
+                : hasGrokUserSettingsCredentials(fs, `${accountPath}/.grok/user-settings.json`)
+            )
+          )
         })
       )
     })

packages/api/tests/project-auth.test.ts

@@ -130,6 +130,41 @@ describe("project auth service", () => {
 
         expect(snapshot.activeGrokLabel).toBe("default")
         expect(yield* _(fs.readFileString(envProjectPath))).toContain("GROK_AUTH_LABEL=default")
+
+        yield* _(fs.writeFileString(envProjectPath, "# project env\n"))
+        yield* _(fs.remove(path.join(grokDefaultAuth, ".api-key")))
+        yield* _(fs.makeDirectory(path.join(grokDefaultAuth, ".grok"), { recursive: true }))
+        yield* _(fs.writeFileString(path.join(grokDefaultAuth, ".grok", "auth.json"), "{\"scope\":{\"key\":\"xai-oauth\"}}\n"))
+
+        const oauthSnapshot = yield* _(
+          withProjectsRoot(
+            projectsRoot,
+            service.runProjectAuthFlow(project, {
+              flow: "ProjectGrokConnect",
+              label: "default"
+            })
+          )
+        )
+
+        expect(oauthSnapshot.activeGrokLabel).toBe("default")
+        expect(yield* _(fs.readFileString(envProjectPath))).toContain("GROK_AUTH_LABEL=default")
+
+        yield* _(fs.writeFileString(envProjectPath, "# project env\n"))
+        yield* _(fs.remove(path.join(grokDefaultAuth, ".grok"), { recursive: true }))
+        yield* _(fs.writeFileString(path.join(grokDefaultAuth, ".env"), "GROK_DEPLOYMENT_KEY='xai-deploy'\n"))
+
+        const envSnapshot = yield* _(
+          withProjectsRoot(
+            projectsRoot,
+            service.runProjectAuthFlow(project, {
+              flow: "ProjectGrokConnect",
+              label: "default"
+            })
+          )
+        )
+
+        expect(envSnapshot.activeGrokLabel).toBe("default")
+        expect(yield* _(fs.readFileString(envProjectPath))).toContain("GROK_AUTH_LABEL=default")
       })
     ).pipe(Effect.provide(NodeContext.layer)))
 })

packages/app/src/docker-git/cli/parser-auth.ts

@@ -198,7 +198,7 @@ const buildGeminiCommand = (action: string, options: AuthOptions): Either.Either
 // WHY: issue #304 requires docker-git auth grok login/status/logout support
 // QUOTE(ТЗ): "Реализовать поддержку авторизации grok"
 // REF: issue-304
-// SOURCE: https://www.npmjs.com/package/grok-dev
+// SOURCE: https://x.ai/news/grok-build-cli
 // FORMAT THEOREM: forall action: buildGrokCommand(action, opts) = AuthCommand | ParseError
 // PURITY: CORE
 // EFFECT: n/a

packages/app/src/docker-git/frontend-lib/core/auth-domain.ts

@@ -111,7 +111,7 @@ export interface AuthGeminiLogoutCommand {
 // WHY: issue #304 requires Grok login/status/logout profiles with isolated auth storage
 // QUOTE(ТЗ): "Реализовать поддержку авторизации grok"
 // REF: issue-304
-// SOURCE: https://www.npmjs.com/package/grok-dev
+// SOURCE: https://x.ai/news/grok-build-cli
 // FORMAT THEOREM: forall cmd ∈ AuthGrokCommand: cmd.grokAuthPath is valid path
 // PURITY: CORE
 // EFFECT: n/a

packages/app/src/lib/core/auth-domain.ts

@@ -111,7 +111,7 @@ export interface AuthGeminiLogoutCommand {
 // WHY: issue #304 requires Grok login/status/logout profiles with isolated auth storage
 // QUOTE(ТЗ): "Реализовать поддержку авторизации grok"
 // REF: issue-304
-// SOURCE: https://www.npmjs.com/package/grok-dev
+// SOURCE: https://x.ai/news/grok-build-cli
 // FORMAT THEOREM: forall cmd ∈ AuthGrokCommand: cmd.grokAuthPath is valid path
 // PURITY: CORE
 // EFFECT: n/a

packages/app/src/lib/core/templates-entrypoint/grok.ts

@@ -5,7 +5,7 @@ import type { TemplateConfig } from "../domain.js"
 // WHY: issue #304 requires Grok auth, Playwright MCP and unrestricted agent permissions
 // QUOTE(ТЗ): "Реализовать поддержку авторизации grok"
 // REF: issue-304
-// SOURCE: https://www.npmjs.com/package/grok-dev
+// SOURCE: https://x.ai/news/grok-build-cli
 // FORMAT THEOREM: renderEntrypointGrokConfig(config) -> valid_bash_script
 // PURITY: CORE
 // INVARIANT: Grok credentials are isolated by GROK_AUTH_LABEL
@@ -18,10 +18,11 @@ const grokAuthRootContainerPath = (sshUser: string): string => `/home/${sshUser}
 // QUOTE(ТЗ): "GitHub Actions ... all CI checks are passing"
 // REF: issue-304-ci
 // SOURCE: n/a
-// FORMAT THEOREM: unset(GROK_API_KEY) -> safe_empty_value(GROK_API_KEY)
+// FORMAT THEOREM: unset(GROK_DEPLOYMENT_KEY) -> safe_empty_value(GROK_DEPLOYMENT_KEY)
 // PURITY: CORE
 // INVARIANT: Optional Grok API credentials never require a bound environment variable
 // COMPLEXITY: O(1)
+const grokDeploymentKeyDefaultExpansion = "${GROK_DEPLOYMENT_KEY:-}"
 const grokApiKeyDefaultExpansion = "${GROK_API_KEY:-}"
 const xaiApiKeyDefaultExpansion = "${XAI_API_KEY:-}"
 
@@ -82,6 +83,10 @@ docker_git_prepare_grok_home_dir
 
 docker_git_link_grok_file "$GROK_CONFIG_DIR/.api-key" "$GROK_HOME_DIR/.api-key"
 docker_git_link_grok_file "$GROK_CONFIG_DIR/.env" "$GROK_HOME_DIR/.env"
+docker_git_link_grok_file "$GROK_SHARED_HOME_DIR/auth.json" "$GROK_HOME_DIR/auth.json"
+docker_git_link_grok_file "$GROK_SHARED_HOME_DIR/config.toml" "$GROK_HOME_DIR/config.toml"
+docker_git_link_grok_file "$GROK_SHARED_HOME_DIR/managed_config.toml" "$GROK_HOME_DIR/managed_config.toml"
+docker_git_link_grok_file "$GROK_SHARED_HOME_DIR/requirements.toml" "$GROK_HOME_DIR/requirements.toml"
 docker_git_link_grok_file "$GROK_SHARED_HOME_DIR/user-settings.json" "$GROK_HOME_DIR/user-settings.json"
 docker_git_link_grok_file "$GROK_SHARED_HOME_DIR/settings.json" "$GROK_HOME_DIR/settings.json"
 
@@ -106,16 +111,29 @@ fi
 
 docker_git_refresh_grok_env() {
   if [[ -f "$GROK_HOME_DIR/.api-key" ]]; then
-    export GROK_API_KEY="$(cat "$GROK_HOME_DIR/.api-key" | tr -d '\r\n')"
+    API_KEY="$(cat "$GROK_HOME_DIR/.api-key" | tr -d '\r\n')"
   elif [[ -f "$GROK_HOME_DIR/.env" ]]; then
-    API_KEY="$(grep "^GROK_API_KEY=" "$GROK_HOME_DIR/.env" | cut -d'=' -f2- | sed "s/^['\"]//;s/['\"]$//")"
-    if [[ -n "$API_KEY" ]]; then
-      export GROK_API_KEY="$API_KEY"
-    fi
+    API_KEY="$(grep -E "^(GROK_DEPLOYMENT_KEY|GROK_API_KEY|XAI_API_KEY)=" "$GROK_HOME_DIR/.env" 2>/dev/null | head -n 1 | cut -d'=' -f2- | sed "s/^['\"]//;s/['\"]$//" || true)"
+  else
+    API_KEY=""
+  fi
+  if [[ -n "$API_KEY" ]]; then
+    export GROK_DEPLOYMENT_KEY="$API_KEY"
+    export GROK_API_KEY="$API_KEY"
+    export XAI_API_KEY="$API_KEY"
+  fi
+  if [[ -n "${grokDeploymentKeyDefaultExpansion}" ]]; then
+    export GROK_API_KEY="${grokDeploymentKeyDefaultExpansion}"
+    export XAI_API_KEY="${grokDeploymentKeyDefaultExpansion}"
   fi
   if [[ -n "${grokApiKeyDefaultExpansion}" ]]; then
+    export GROK_DEPLOYMENT_KEY="${grokApiKeyDefaultExpansion}"
     export XAI_API_KEY="${grokApiKeyDefaultExpansion}"
   fi
+  if [[ -n "${xaiApiKeyDefaultExpansion}" ]]; then
+    export GROK_DEPLOYMENT_KEY="${xaiApiKeyDefaultExpansion}"
+    export GROK_API_KEY="${xaiApiKeyDefaultExpansion}"
+  fi
 }
 
 docker_git_refresh_grok_env`
@@ -177,13 +195,16 @@ printf "export GROK_HOME=%q\n" "${config.grokHome}" >> "$GROK_PROFILE"
 printf "alias grok='/usr/local/bin/grok-wrapper'\n" >> "$GROK_PROFILE"
 cat <<'EOF' >> "$GROK_PROFILE"
 if [[ -f "$GROK_HOME/.api-key" ]]; then
-  export GROK_API_KEY="$(cat "$GROK_HOME/.api-key" | tr -d '\r\n')"
-  export XAI_API_KEY="${grokApiKeyDefaultExpansion}"
+  API_KEY="$(cat "$GROK_HOME/.api-key" | tr -d '\r\n')"
+  export GROK_DEPLOYMENT_KEY="$API_KEY"
+  export GROK_API_KEY="$API_KEY"
+  export XAI_API_KEY="$API_KEY"
 fi
 EOF
 chmod 0644 "$GROK_PROFILE" || true
 
 docker_git_upsert_ssh_env "GROK_AUTH_LABEL" "$GROK_AUTH_LABEL"
+docker_git_upsert_ssh_env "GROK_DEPLOYMENT_KEY" "${grokDeploymentKeyDefaultExpansion}"
 docker_git_upsert_ssh_env "GROK_API_KEY" "${grokApiKeyDefaultExpansion}"
 docker_git_upsert_ssh_env "XAI_API_KEY" "${xaiApiKeyDefaultExpansion}"`
 

packages/app/src/lib/core/templates/dockerfile.ts

@@ -87,8 +87,11 @@ RUN mkdir -p /usr/local/nvm \
 RUN printf "export NVM_DIR=/usr/local/nvm\\n[ -s /usr/local/nvm/nvm.sh ] && . /usr/local/nvm/nvm.sh\\n" \
   > /etc/profile.d/nvm.sh && chmod 0644 /etc/profile.d/nvm.sh`
 
+const grokCliInstallScriptUrl = "https://x.ai/cli/install.sh"
+const grokCliVersion = "0.1.211"
+
 const renderDockerfileBunPrelude = (config: TemplateConfig): string =>
-  `# Tooling: Bun + Codex CLI (bun) + oh-my-opencode (npm + platform binary) + Claude Code CLI (npm) + Grok CLI (npm)
+  `# Tooling: Bun + Codex CLI (bun) + oh-my-opencode (npm + platform binary) + Claude Code CLI (npm) + Grok CLI (xAI installer)
 ENV TERM=xterm-256color
 RUN set -eu; \
   for attempt in 1 2 3 4 5; do \
@@ -119,7 +122,14 @@ RUN npm install -g @anthropic-ai/claude-code@latest
 RUN claude --version
 RUN npm install -g @google/gemini-cli@latest --force
 RUN gemini --version
-RUN npm install -g grok-dev@1.1.7
+RUN set -eu; \
+  curl -fsSL --retry 5 --retry-all-errors --retry-delay 2 ${grokCliInstallScriptUrl} -o /tmp/grok-install.sh; \
+  HOME=/tmp/grok-install-home GROK_BIN_DIR=/usr/local/bin bash /tmp/grok-install.sh ${grokCliVersion}; \
+  install -m 0755 "$(readlink -f /usr/local/bin/grok)" /usr/local/bin/grok.real; \
+  install -m 0755 "$(readlink -f /usr/local/bin/agent)" /usr/local/bin/agent.real; \
+  mv -f /usr/local/bin/grok.real /usr/local/bin/grok; \
+  mv -f /usr/local/bin/agent.real /usr/local/bin/agent; \
+  rm -rf /tmp/grok-install.sh /tmp/grok-install-home
 RUN grok --version`
 
 // CHANGE: install RTK as a real command-output optimizer in generated containers.

packages/app/src/lib/usecases/auth-grok-helpers.ts

@@ -22,7 +22,8 @@ export const grokImageName = "docker-git-auth-grok:latest"
 export const grokImageDir = ".docker-git/.orch/auth/grok/.image"
 export const grokContainerHomeDir = "/grok-home"
 export const grokCredentialsDir = ".grok"
-export const grokDevPackageSpec = "grok-dev@1.1.7"
+export const grokCliInstallScriptUrl = "https://x.ai/cli/install.sh"
+export const grokCliVersion = "0.1.211"
 
 export type GrokAccountContext = {
   readonly accountLabel: string
@@ -41,27 +42,34 @@ export const grokEnvFilePath = (accountPath: string): string => `${accountPath}/
 export const grokCredentialsPath = (accountPath: string): string => `${accountPath}/${grokCredentialsDir}`
 export const grokUserSettingsPath = (accountPath: string): string =>
   `${grokCredentialsPath(accountPath)}/user-settings.json`
+export const grokAuthJsonPath = (accountPath: string): string => `${grokCredentialsPath(accountPath)}/auth.json`
+
+const grokEnvApiKeyNames: ReadonlyArray<string> = ["GROK_DEPLOYMENT_KEY", "GROK_API_KEY", "XAI_API_KEY"]
 
 // CHANGE: render Dockerfile for Grok CLI authentication image
 // WHY: Grok browser/OAuth auth must run in an isolated shell that persists ~/.grok
 // QUOTE(ТЗ): "Signing in with Grok..."
 // REF: issue-304
-// SOURCE: https://www.npmjs.com/package/grok-dev
+// SOURCE: https://x.ai/news/grok-build-cli
 // FORMAT THEOREM: renderGrokDockerfile() -> valid_dockerfile
 // PURITY: CORE
 // EFFECT: n/a
-// INVARIANT: image includes Node.js and a grok executable
+// INVARIANT: image includes the official xAI grok executable
 // COMPLEXITY: O(1)
 export const renderGrokDockerfile = (): string =>
   String.raw`FROM ubuntu:24.04
 ENV DEBIAN_FRONTEND=noninteractive
 RUN apt-get update \
   && apt-get install -y --no-install-recommends ca-certificates curl bsdutils \
   && rm -rf /var/lib/apt/lists/*
-RUN curl -fsSL https://deb.nodesource.com/setup_24.x | bash - \
-  && apt-get install -y --no-install-recommends nodejs \
-  && rm -rf /var/lib/apt/lists/*
-RUN npm install -g ${grokDevPackageSpec}
+RUN set -eu; \
+  curl -fsSL --retry 5 --retry-all-errors --retry-delay 2 ${grokCliInstallScriptUrl} -o /tmp/grok-install.sh; \
+  HOME=/tmp/grok-install-home GROK_BIN_DIR=/usr/local/bin bash /tmp/grok-install.sh ${grokCliVersion}; \
+  install -m 0755 "$(readlink -f /usr/local/bin/grok)" /usr/local/bin/grok.real; \
+  install -m 0755 "$(readlink -f /usr/local/bin/agent)" /usr/local/bin/agent.real; \
+  mv -f /usr/local/bin/grok.real /usr/local/bin/grok; \
+  mv -f /usr/local/bin/agent.real /usr/local/bin/agent; \
+  rm -rf /tmp/grok-install.sh /tmp/grok-install-home
 RUN grok --version
 `
 
@@ -127,12 +135,15 @@ const readApiKeyFromEnvFile = (
     const envContent = yield* _(fs.readFileString(envFilePath), Effect.orElseSucceed(() => ""))
     for (const line of envContent.split("\n")) {
       const trimmed = line.trim()
-      if (!trimmed.startsWith("GROK_API_KEY=")) {
-        continue
-      }
-      const value = trimmed.slice("GROK_API_KEY=".length).replaceAll(/^['"]|['"]$/g, "").trim()
-      if (value.length > 0) {
-        return value
+      for (const key of grokEnvApiKeyNames) {
+        const prefix = `${key}=`
+        if (!trimmed.startsWith(prefix)) {
+          continue
+        }
+        const value = trimmed.slice(prefix.length).replaceAll(/^['"]|['"]$/g, "").trim()
+        if (value.length > 0) {
+          return value
+        }
       }
     }
     return null
@@ -165,6 +176,13 @@ export const hasGrokCredentials = (
     if (apiKey !== null) {
       return true
     }
+    const hasAuthJson = yield* _(isRegularFile(fs, grokAuthJsonPath(accountPath)))
+    if (hasAuthJson) {
+      const authJson = yield* _(fs.readFileString(grokAuthJsonPath(accountPath)), Effect.orElseSucceed(() => ""))
+      if (hasGrokAuthJsonCredentials(authJson)) {
+        return true
+      }
+    }
     const hasUserSettings = yield* _(isRegularFile(fs, grokUserSettingsPath(accountPath)))
     if (!hasUserSettings) {
       return false
@@ -184,6 +202,15 @@ const grokUserSettingsCredentialMarkers: ReadonlyArray<RegExp> = [
 const hasGrokUserSettingsCredentials = (content: string): boolean =>
   grokUserSettingsCredentialMarkers.some((marker) => marker.test(content))
 
+const grokAuthJsonCredentialMarkers: ReadonlyArray<RegExp> = [
+  /"key"\s*:\s*"[^"]+"/u,
+  /"token"\s*:\s*"[^"]+"/u,
+  /"accessToken"\s*:\s*"[^"]+"/u
+]
+
+const hasGrokAuthJsonCredentials = (content: string): boolean =>
+  grokAuthJsonCredentialMarkers.some((marker) => marker.test(content))
+
 export const resolveGrokAuthMethod = (
   fs: FileSystem.FileSystem,
   accountPath: string

packages/app/src/lib/usecases/auth-grok-logout.ts

@@ -12,7 +12,7 @@ import { autoSyncState } from "./state-repo.js"
 // WHY: allow revoking Grok CLI access deterministically
 // QUOTE(ТЗ): "Реализовать поддержку авторизации grok"
 // REF: issue-304
-// SOURCE: https://www.npmjs.com/package/grok-dev
+// SOURCE: https://x.ai/news/grok-build-cli
 // FORMAT THEOREM: forall cmd: authGrokLogout(cmd) -> credentials_cleared(cmd)
 // PURITY: SHELL
 // EFFECT: Effect<void, PlatformError | CommandFailedError, GrokRuntime>

packages/app/src/lib/usecases/auth-grok-oauth.ts

@@ -10,7 +10,7 @@ import { AuthError, CommandFailedError } from "../shell/errors.js"
 // WHY: issue #304 expects `grok login` style URL handoff and callback paste support
 // QUOTE(ТЗ): "Paste the URL here if it doesn't connect"
 // REF: issue-304
-// SOURCE: https://www.npmjs.com/package/grok-dev
+// SOURCE: https://x.ai/news/grok-build-cli
 // FORMAT THEOREM: forall cmd: runGrokOauthLogin(cmd) -> grok_credentials_stored | error
 // PURITY: SHELL
 // EFFECT: Effect<void, AuthError | CommandFailedError | PlatformError, CommandExecutor>