fix(deploy): map grok/xai models to the xai provider for credential matching

[willwashburn]

Problem

Deploying a grok persona to cloud fails to recognize a connected xAI credential. Even after relay cloud connect xai succeeds, the deploy reports:

grok credentials are not connected. Choose harness source (plan/byok/oauth) [plan]

…and accepting the default plan then fails on workspaces without relay-managed grok:

cloud managed provider credentials failed: 403 {"error":"Forbidden"}

Choosing oauth doesn't help either — it re-launches a browser connect and polls for a credential row that never matches, so the deploy loops.

Root cause

deriveModelProvider special-cases anthropic/openai/google/openrouter via token matching, but has no grok/xai case. A grok persona declares model: "grok-build", which falls through to the generic model.split(/[/:]/) and resolves to the literal provider key "grok-build".

The credential relay cloud connect xai stores is keyed harness: "grok" (modelProvider "xai"):

{ "harness": "grok", "modelProvider": "xai", "authType": "provider_oauth", "status": "connected", "isActive": true }

"grok-build" matches neither "grok" nor "xai", so hasConnectedHarness returns false → the probe says "not connected" → re-prompt / loop.

Fix

Mirror the existing provider/alias pattern (anthropic→claude, openai→codex, openrouter→opencode):

• deriveModelProvider: map grok/xai/x-ai models → provider "xai"
• harnessAliasForModelProvider: alias "xai" → "grok"

So deriveModelProvider("grok-build") → "xai", the match targets become {"xai", "grok"}, and the connected harness: "grok" entry is recognized. The oauth deploy then proceeds without a browser reconnect or the plan-path 403.

Grok remains harness-only for ctx.llm (same as codex/opencode subscriptions) — the persona runs through the grok harness via harness.run, so no ctx.llm credential selection is stamped, which is expected.

Test

Adds a regression test: a grok persona (model: "grok-build") with a credential connected under harness: "grok" resolves silently and deploys, with no browser reconnect. Verified it fails without the fix (grok OAuth credentials are not connected) and passes with it.

# tests 188
# pass 188
# fail 0

🤖 Generated with Claude Code

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

[coderabbitai]

Caution

Review failed

Pull request was closed or merged during review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 594dbc13-1d6e-4733-8017-2128bae14db5

📥 Commits

Reviewing files that changed from the base of the PR and between 25a5b5f and fb5cc21.

📒 Files selected for processing (2)

• packages/deploy/src/modes/cloud.test.ts
• packages/deploy/src/modes/cloud/index.ts

---

📝 Walkthrough

Walkthrough

Adds XAI provider support to the cloud deployment mode: deriveModelProvider now maps grok, xai, and x-ai model strings to the canonical xai provider, and harnessAliasForModelProvider maps xai back to the grok harness alias. A regression test validates the connected cloud-agent probe skips re-authentication for grok personas.

Changes

XAI/Grok provider alias and connected-probe test

Layer / File(s)	Summary
xai provider token and harness alias mapping packages/deploy/src/modes/cloud/index.ts	deriveModelProvider adds a match for grok, xai, and x-ai resolving to xai; harnessAliasForModelProvider adds an xai case returning the grok harness alias.
Grok connected-probe regression test packages/deploy/src/modes/cloud.test.ts	New test stubs /api/v1/cloud-agents with a connected grok entry, deploys with a grok-build model persona, and asserts success with no /cli/auth call.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Possibly related PRs

• AgentWorkforce/workforce#228: Both PRs exercise the cloud OAuth connected cloud-agent credential probe flow, with the related PR covering connected/selection behavior in subscription credential flow tests.

Poem

🐇 A model named Grok came to deploy one day,
The harness said "xai" — now it knows the way!
No browser auth needed, the probe checks out clean,
The alias maps perfectly, neat and serene.
Hop hop, little Grok, you belong in this fleet! 🚀

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title directly and clearly describes the main change: mapping grok/xai models to the xai provider for credential matching, which is the core fix addressed in this PR.
Description check	✅ Passed	The description is comprehensive and well-related to the changeset, explaining the problem, root cause, fix, and testing in detail.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/deploy-grok-xai-provider-derivation

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}