@100xprompt/brain 0.0.0-stage → 0.1.1

package/src/gateway/connectors/factory-droid.ts

@@ -0,0 +1,308 @@
+// Gateway connector for Factory Droid (the `droid` CLI): a bring-your-own-key custom model pointed at the gateway's
+// Anthropic Messages endpoint, made Droid's default model.
+//
+// Checked against droid 1.6.0 (npm `droid`, the darwin-arm64 build in ~/.cache/brain-wire/factory-droid; its bundled
+// settings code reports itself as 1.309.0), read from the strings of the compiled binary, and against
+// https://docs.factory.com/cli/byok/overview:
+//   - Custom models live in ~/.factory/settings.json under `customModels` (an array). The legacy ~/.factory/config.json
+//     `custom_models` list is only migrated into settings.json on start; 1.6.0 reads nothing else ("Note: Custom models
+//     are loaded from ~/.factory/settings.json"). The folder is $FACTORY_HOME_OVERRIDE/.factory when that is set.
+//   - An entry is {model, id?, displayName?, baseUrl, apiKey? | apiKeyHelper?, provider, extraHeaders?, maxOutputTokens?,
+//     ...}; provider is "anthropic" (Messages), "openai" (Responses), "generic-chat-completion-api" (Chat Completions) or
+//     "bedrock-converse" (the zod schema `Ro` in the binary).
+//   - `apiKeyHelper` is a shell command whose stdout is the key ("Runs locally when the model is used. Prints a token to
+//     stdout."), run with shell:true, cached for 5 minutes (apiKeyHelperTtlMs, FACTORY_API_KEY_HELPER_TTL_MS). So the key
+//     is read from the brain's key file at run time, never copied, and a new sign-in reaches Droid without a reconnect.
+//   - `extraHeaders` is sent with every request (case-insensitively unique names), so the context-edit header can go.
+//   - A model's id is `custom:<displayName with spaces as ->-<n>` unless the entry names its own `id`; this connector gives
+//     its entry the id `custom:brain-gateway`, so the default stays put whatever else is in the list.
+//   - The default model is `sessionDefaultSettings.model` (older top-level `model` is folded into it on read and only
+//     used when sessionDefaultSettings.model is unset). An id that already resolves to an entry's own id is not rewritten.
+//   - settings.json is JSON with comments: Droid reads // and /* */ comments, but a trailing comma or a duplicate key
+//     makes it drop the whole file (checked with the real CLI: with a trailing comma its custom models are gone and it
+//     asks for a Factory login), and it edits the file in place keeping comments. The core's plain-JSON format would
+//     refuse a file with comments, and a JSON path cannot address one entry of the customModels list, so this file has
+//     its own codec (below): comments and formatting are kept, only the connector's own entry and the default-model value
+//     are touched, and a file Droid itself could not read is left alone.
+//   - Checked for real (scripts/gateway-real/factory-droid.ts): `droid exec` with no -m, no Factory login, sends its
+//     request to <route>/v1/messages with x-api-key from the helper, the context-edit header and the gateway's model.
+import { join } from "node:path"
+import { type Codec, type Connector, dirFromEnv, EDIT_HEADER, type Env, type Json, keyPath, modelName, routeUrl, shellQuote } from "../common.ts"
+
+/** The id of the connector's entry in customModels, and the default model value that selects it. */
+export const DROID_MODEL_ID = "custom:brain-gateway"
+const LIST = "customModels"
+
+// ---- JSONC with positions ------------------------------------------------------------------------------------------------
+
+type Node =
+  | { kind: "object"; start: number; end: number; members: Entry[] }
+  | { kind: "array"; start: number; end: number; members: Entry[] }
+  | { kind: "scalar"; start: number; end: number; value: unknown }
+/** One member of an object (key set) or element of an array; `start` is where its key (or value) begins. */
+interface Entry {
+  key?: string
+  start: number
+  value: Node
+  /** Offset of the comma that follows it, when one does. */
+  comma?: number
+}
+
+class JsoncError extends Error {}
+
+/** Parses JSON with comments (as Droid reads it: no trailing commas), keeping where every value is. Throws JsoncError otherwise. */
+function parse(text: string): Node {
+  let i = 0
+  const fail = (why: string): never => {
+    throw new JsoncError(`${why} at offset ${i}`)
+  }
+  const skip = () => {
+    for (;;) {
+      const c = text[i]
+      if (c === " " || c === "\t" || c === "\n" || c === "\r" || c === "") i++
+      else if (c === "/" && text[i + 1] === "/") {
+        while (i < text.length && text[i] !== "\n") i++
+      } else if (c === "/" && text[i + 1] === "*") {
+        const close = text.indexOf("*/", i + 2)
+        if (close < 0) fail("unterminated comment")
+        i = close + 2
+      } else return
+    }
+  }
+  const str = (): string => {
+    const start = i++
+    while (i < text.length && text[i] !== '"') i += text[i] === "\\" ? 2 : 1
+    if (i >= text.length) fail("unterminated string")
+    i++
+    try {
+      return JSON.parse(text.slice(start, i)) as string
+    } catch {
+      return fail("bad string")
+    }
+  }
+  const value = (): Node => {
+    skip()
+    const start = i
+    const c = text[i]
+    if (c === "{" || c === "[") {
+      const close = c === "{" ? "}" : "]"
+      i++
+      const members: Entry[] = []
+      const keys = new Set<string>()
+      skip()
+      while (text[i] !== close) {
+        const at = i
+        let key: string | undefined
+        if (c === "{") {
+          if (text[i] !== '"') fail("expected a quoted key")
+          key = str()
+          if (keys.has(key)) fail(`duplicate key "${key}"`)
+          keys.add(key)
+          skip()
+          if (text[i] !== ":") fail("expected ':'")
+          i++
+        }
+        const v = value()
+        const e: Entry = { start: at, value: v, ...(key !== undefined ? { key } : {}) }
+        members.push(e)
+        skip()
+        if (text[i] === ",") {
+          e.comma = i++
+          skip()
+          if (text[i] === close) fail("a trailing comma (Droid cannot read the file with one)")
+        } else if (text[i] !== close) fail(`expected ',' or '${close}'`)
+      }
+      i++
+      return { kind: c === "{" ? "object" : "array", start, end: i, members }
+    }
+    if (c === '"') {
+      const v = str()
+      return { kind: "scalar", start, end: i, value: v }
+    }
+    const m = /^(?:-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?|true|false|null)/.exec(text.slice(i, i + 400))
+    if (!m) return fail("unexpected character")
+    i += m[0].length
+    return { kind: "scalar", start, end: i, value: JSON.parse(m[0]) }
+  }
+  const root = value()
+  skip()
+  if (i < text.length) fail("unexpected text after the value")
+  return root
+}
+
+/** The plain value of a parsed node. */
+function plain(n: Node): unknown {
+  if (n.kind === "scalar") return n.value
+  if (n.kind === "array") return n.members.map((m) => plain(m.value))
+  return Object.fromEntries(n.members.map((m) => [m.key!, plain(m.value)]))
+}
+
+const member = (o: Node, key: string) => (o.kind === "object" ? o.members.find((m) => m.key === key) : undefined)
+const lineIndent = (text: string, pos: number) => /^[ \t]*/.exec(text.slice(text.lastIndexOf("\n", pos - 1) + 1))![0]
+const indentUnit = (text: string) => /\n([ \t]+)"/.exec(text)?.[1] ?? "  "
+const multiline = (text: string, c: Node & { members: Entry[] }) => text.slice(c.start, c.members[0]?.start ?? c.end).includes("\n")
+
+/** `v` as JSON at a nesting where the enclosing line starts with `indent`. */
+function render(text: string, v: unknown, indent: string, pretty: boolean): string {
+  return pretty ? JSON.stringify(v, null, indentUnit(text)).replace(/\n/g, `\n${indent}`) : JSON.stringify(v)
+}
+
+/** Adds an entry (`"key": value` or an array element) at the end of container `c`, in the container's own layout. */
+function append(text: string, c: Node & { members: Entry[] }, key: string | undefined, v: unknown): string {
+  const head = key === undefined ? "" : `${JSON.stringify(key)}: `
+  const last = c.members[c.members.length - 1]
+  if (!last) {
+    const outer = lineIndent(text, c.start)
+    const inner = outer + indentUnit(text)
+    const entry = `${head}${render(text, v, inner, true)}`
+    // An empty container: `{}` becomes a block holding the entry. One with only comments in it keeps them after it.
+    if (!text.slice(c.start + 1, c.end - 1).trim()) return `${text.slice(0, c.start + 1)}\n${inner}${entry}\n${outer}${text.slice(c.end - 1)}`
+    return `${text.slice(0, c.start + 1)}\n${inner}${entry}${text.slice(c.start + 1)}`
+  }
+  const pretty = multiline(text, c)
+  const indent = pretty ? lineIndent(text, last.start) : ""
+  const entry = `${head}${render(text, v, indent, pretty)}`
+  return `${text.slice(0, last.value.end)},${pretty ? `\n${indent}` : " "}${entry}${text.slice(last.value.end)}`
+}
+
+/** Removes entry `at` of container `c` with its separator: the exact inverse of append() for an entry append() added. */
+function remove(text: string, c: Node & { members: Entry[] }, at: number): string {
+  const e = c.members[at]!
+  if (e.comma !== undefined) {
+    const from = at === 0 ? c.start + 1 : c.members[at - 1]!.comma! + 1
+    return text.slice(0, from) + text.slice(e.comma + 1)
+  }
+  if (at > 0) return text.slice(0, c.members[at - 1]!.comma!) + text.slice(e.value.end)
+  const rest = text.slice(c.start + 1, e.start) + text.slice(e.value.end, c.end - 1)
+  return rest.trim() ? text.slice(0, c.start + 1) + text.slice(e.value.end) : text.slice(0, c.start + 1) + text.slice(c.end - 1)
+}
+
+function replace(text: string, c: Node & { members: Entry[] }, e: Entry, v: unknown): string {
+  const pretty = multiline(text, c)
+  return text.slice(0, e.value.start) + render(text, v, pretty ? lineIndent(text, e.start) : "", pretty) + text.slice(e.value.end)
+}
+
+/** The root object of `text` (an empty file reads as an empty object). */
+const rootOf = (text: string) => parse(text.trim() ? text : "{}")
+const baseText = (text: string) => (text.trim() ? text : "{}\n")
+
+/** Sets (or, with undefined, removes) the value at an object path. Objects the removal leaves empty go too (never the root). */
+function setPath(text: string, path: string[], v: unknown): string {
+  text = baseText(text)
+  let node = rootOf(text)
+  for (let d = 0; d < path.length - 1; d++) {
+    const m = member(node, path[d]!)
+    if (!m) {
+      if (v === undefined) return text
+      const nested = path.slice(d + 1).reduceRight<unknown>((acc, k) => ({ [k]: acc }), v)
+      return append(text, node as Node & { members: Entry[] }, path[d]!, nested)
+    }
+    node = m.value
+    if (node.kind !== "object") throw new JsoncError(`${path.slice(0, d + 1).join(".")} is not an object`)
+  }
+  const last = path[path.length - 1]!
+  const obj = node as Node & { members: Entry[] }
+  const at = obj.members.findIndex((m) => m.key === last)
+  if (v !== undefined) return at >= 0 ? replace(text, obj, obj.members[at]!, v) : append(text, obj, last, v)
+  if (at < 0) return text
+  text = remove(text, obj, at)
+  // Drop the objects this left empty, innermost first.
+  for (let d = path.length - 1; d >= 1; d--) {
+    let parent = rootOf(text)
+    for (const k of path.slice(0, d - 1)) parent = member(parent, k)!.value
+    const i = (parent as Node & { members: Entry[] }).members.findIndex((m) => m.key === path[d - 1])
+    const child = (parent as Node & { members: Entry[] }).members[i]!.value
+    if (child.kind !== "object" || child.members.length) break
+    text = remove(text, parent as Node & { members: Entry[] }, i)
+  }
+  return text
+}
+
+/** Sets (or removes) the customModels entry whose `id` is `id`. The list goes when the removal leaves it empty. */
+function setListEntry(text: string, id: string, v: unknown): string {
+  text = baseText(text)
+  const root = rootOf(text) as Node & { members: Entry[] }
+  const listAt = root.members.findIndex((m) => m.key === LIST)
+  if (listAt < 0) return v === undefined ? text : append(text, root, LIST, [v])
+  const list = root.members[listAt]!.value
+  if (list.kind !== "array") throw new JsoncError(`${LIST} is not a list`)
+  const at = list.members.findIndex((m) => (plain(m.value) as Json | null)?.id === id)
+  if (v !== undefined) return at >= 0 ? replace(text, list, list.members[at]!, v) : append(text, list, undefined, v)
+  if (at < 0) return text
+  text = remove(text, list, at)
+  const after = (rootOf(text) as Node & { members: Entry[] }).members[listAt]!.value
+  return after.kind === "array" && !after.members.length ? remove(text, rootOf(text) as Node & { members: Entry[] }, listAt) : text
+}
+
+/** `customModels/<id>` addresses one entry of the list (by its id); any other key is an object path ("a/b"). */
+const listKey = (key: string) => (key.startsWith(`${LIST}/`) ? key.slice(LIST.length + 1) : undefined)
+
+/**
+ * Droid's settings.json: JSON with comments, edited in place. Everything outside the connector's keys stays byte for byte,
+ * so a disconnect gives back the file as it was (an empty `customModels: []` or `sessionDefaultSettings: {}` that only held
+ * the connector's values goes with them, as the core does for JSON).
+ */
+export const droidSettings: Codec = {
+  check(text) {
+    if (!text.trim()) return undefined
+    let root: Node
+    try {
+      root = parse(text)
+    } catch (e) {
+      return `it is not valid JSON with comments (${(e as Error).message}); left as it is`
+    }
+    if (root.kind !== "object") return "it is not a JSON object; left as it is"
+    const list = member(root, LIST)
+    if (list && list.value.kind !== "array") return `its ${LIST} is not a list; left as it is`
+    const defaults = member(root, "sessionDefaultSettings")
+    if (defaults && defaults.value.kind !== "object") return "its sessionDefaultSettings is not an object; left as it is"
+    return undefined
+  },
+  get(text, key) {
+    if (!text.trim()) return undefined
+    const root = plain(parse(text)) as Json
+    const id = listKey(key)
+    if (id === undefined) return key.split("/").reduce<unknown>((o, k) => (o && typeof o === "object" && !Array.isArray(o) ? (o as Json)[k] : undefined), root)
+    const list = root[LIST]
+    return Array.isArray(list) ? list.find((m) => m && typeof m === "object" && m.id === id) : undefined
+  },
+  set(text, key, value) {
+    const id = listKey(key)
+    return id === undefined ? setPath(text, key.split("/"), value) : setListEntry(text, id, value)
+  },
+}
+
+const factoryDir = (home: string, env: Env) => join(dirFromEnv(env, "FACTORY_HOME_OVERRIDE", home), ".factory")
+
+export const connectors: Connector[] = [
+  {
+    id: "factory-droid",
+    label: "Factory Droid",
+    file: (home, env) => join(factoryDir(home, env), "settings.json"),
+    probe: [".factory"],
+    authHeader: "x-api-key",
+    edits: (home, s, env) => [
+      {
+        path: join(factoryDir(home, env), "settings.json"),
+        format: "custom",
+        codec: droidSettings,
+        values: {
+          [`${LIST}/${DROID_MODEL_ID}`]: {
+            model: s.model,
+            id: DROID_MODEL_ID,
+            displayName: modelName(s.model),
+            baseUrl: routeUrl(s),
+            provider: "anthropic",
+            apiKeyHelper: `cat ${shellQuote(keyPath(home))}`,
+            ...(s.contextEdit ? { extraHeaders: { [EDIT_HEADER]: "on" } } : {}),
+          },
+          "sessionDefaultSettings/model": DROID_MODEL_ID,
+        },
+      },
+    ],
+    notes: [
+      "Droid now starts on the gateway's model (a custom model in ~/.factory/settings.json, made the default); your own models stay in its /model picker.",
+      "Droid reads the key from the brain's key file when it needs one (apiKeyHelper, re-read every 5 minutes), so a new sign-in reaches it without reconnecting.",
+    ],
+  },
+]

package/src/gateway/connectors/goose.ts

@@ -0,0 +1,79 @@
+// Gateway connector for Goose (block/goose; checked against goose 1.57.0, the binary in ~/.cache/brain-wire/goose).
+//
+// How Goose is pointed at the gateway: a custom ("declarative") provider plus Goose's default provider and model.
+//   <config>/custom_providers/brain-gateway.json   a provider of its own, engine "openai" (OpenAI Chat Completions):
+//       base_url <route>/v1 (Goose appends chat/completions to a URL ending in a version segment), the gateway's model
+//       in `models`, `headers` { x-100x-context-edit: on }, and `auth.command` /bin/cat <keyPath>: Goose runs that
+//       command for the key (no shell, stdout trimmed, cached for refresh_interval seconds) and sends it as Bearer.
+//       So the key is never copied: a new sign-in reaches Goose by itself.
+//   <config>/config.yaml   GOOSE_PROVIDER: brain-gateway, GOOSE_MODEL: <model> (top-level keys; the rest is left alone).
+// <config> is ~/.config/goose (etcetera's XDG strategy, also on macOS), $XDG_CONFIG_HOME/goose, or $GOOSE_PATH_ROOT/config.
+//
+// Evidence (goose v1.57.0, https://github.com/block/goose/tree/v1.57.0):
+//   crates/goose-providers/src/declarative.rs   DeclarativeProviderConfig { name, engine, display_name, description,
+//       api_key_env (default ""), base_url, models, headers, supports_streaming, requires_auth, base_path, auth, ... };
+//       AuthConfig { command, args, refresh_interval (default 3600), timeout_seconds, cwd }; validate_auth(): api_key_env
+//       and auth.command are mutually exclusive; load_custom_providers(dir) reads every *.json in the folder.
+//   crates/goose/src/config/declarative_providers.rs   custom_providers_dir() = Paths::config_dir().join("custom_providers").
+//   crates/goose-providers/src/openai.rs   from_declarative_config(): host from base_url, derive_base_path(): a path ending
+//       in a version segment gets "/chat/completions"; `headers` are added to every request.
+//   crates/goose/src/providers/command_auth.rs   runs auth.command directly, `.trim()`s stdout, empty output is an error.
+//   crates/goose/src/config/paths.rs   GOOSE_PATH_ROOT (absolute) -> <root>/config, else etcetera choose_app_strategy.
+//   The binary's strings list the same field names (`strings goose | grep api_key_env`), and the real-tool check
+//   (scripts/gateway-real/goose.ts) runs this exact setup.
+import { isAbsolute, join, resolve } from "node:path"
+import { type Connector, EDIT_HEADER, type Env, keyPath, modelName, routeUrl, yamlTopLevel } from "../common.ts"
+
+/** The provider id (the custom provider's file name and `name`, and GOOSE_PROVIDER), as Codex and OpenCode name it. */
+export const GOOSE_PROVIDER = "brain-gateway"
+/** The context window Goose is told (it compacts the conversation near it): the Gemini Flash models' 1,048,576 tokens. */
+const CONTEXT_LIMIT = 1_048_576
+
+/** Goose's config folder, found the way Goose finds it. XDG_CONFIG_HOME describes the real home, so it counts only there. */
+export function gooseDir(home: string, env: Env): string {
+  const root = env.GOOSE_PATH_ROOT
+  if (root && isAbsolute(root)) return join(root, "config")
+  const xdg = env.XDG_CONFIG_HOME
+  if (xdg && isAbsolute(xdg) && env.HOME && resolve(home) === resolve(env.HOME)) return join(xdg, "goose")
+  return join(home, ".config", "goose")
+}
+
+export const connectors: Connector[] = [
+  {
+    id: "goose",
+    label: "Goose",
+    file: (home, env) => join(gooseDir(home, env), "config.yaml"),
+    // ~/.local/state/goose holds its logs from the first run, ~/.local/share/goose its sessions.
+    probe: [".config/goose", ".local/share/goose", ".local/state/goose"],
+    authHeader: "authorization",
+    edits: (home, s, env) => [
+      {
+        path: join(gooseDir(home, env), "custom_providers", `${GOOSE_PROVIDER}.json`),
+        format: "json",
+        values: {
+          name: GOOSE_PROVIDER,
+          engine: "openai",
+          display_name: "100xprompt gateway",
+          description: `${modelName(s.model)} through the 100xprompt gateway (set up by brain gateway connect --tool goose)`,
+          base_url: `${routeUrl(s)}/v1`,
+          models: [{ name: s.model, context_limit: CONTEXT_LIMIT }],
+          ...(s.contextEdit ? { headers: { [EDIT_HEADER]: "on" } } : {}),
+          supports_streaming: true,
+          requires_auth: true,
+          // Re-read every 5 minutes, so a running Goose picks up a new sign-in too.
+          auth: { command: "/bin/cat", args: [keyPath(home)], refresh_interval: 300 },
+        },
+      },
+      {
+        path: join(gooseDir(home, env), "config.yaml"),
+        format: "custom",
+        codec: yamlTopLevel,
+        values: { GOOSE_PROVIDER, GOOSE_MODEL: s.model },
+      },
+    ],
+    notes: [
+      "Goose now uses its own provider brain-gateway (custom_providers/brain-gateway.json), which reads the key from the brain's key file when it needs it; nothing goes into the keychain.",
+      "GOOSE_PROVIDER or GOOSE_MODEL exported in your shell take precedence over config.yaml: unset them for Goose.",
+    ],
+  },
+]

package/src/gateway/connectors/grok-cli.ts

@@ -0,0 +1,82 @@
+// Gateway connector for the Grok CLI: xAI's `grok` ("Grok Build", the closed-source binary whose sessions brain reads as
+// grok-cli), checked against grok 0.2.103 (`grok --version`: the copy installed on the author's machine) with the manual
+// it ships (written to $GROK_HOME/docs/user-guide/ on first run) and https://docs.x.ai/build/settings.
+//
+// How Grok reaches a custom endpoint (docs/user-guide/11-custom-models.md):
+//   - <GROK_HOME or ~/.grok>/config.toml takes custom models as [model.<id>] tables (lines 74-90): model (the id sent),
+//     base_url, name (shown in the model picker), api_key, env_key, api_backend ("chat_completions", the default, posts to
+//     <base_url>/chat/completions; also "responses" and "messages", lines 56-66), context_window, and extra_headers, "sent
+//     verbatim with every request" (lines 68, 89). [models] default picks the model new sessions start with (lines 45-52).
+//     A project's .grok/config.toml cannot set models: it contributes only MCP servers, plugins and permission rules
+//     (05-configuration.md:308).
+//   - Session titles are written by a helper model, [models] session_summary (env GROK_SESSION_SUMMARY_MODEL; both names
+//     are in the binary's config schema, not in the manual). Left unset, Grok sent that request to the default model's
+//     endpoint, here the gateway, but for xAI's "grok-build" (seen with the real binary against the stand-in gateway), so
+//     it is pointed at the gateway's model too, as Claude Code's small-model setting is.
+//   - The key (lines 92-99): the model's api_key, else the variables named by env_key, else the person's Grok sign-in, else
+//     XAI_API_KEY. There is no key-file or key-command option for a model, and Grok reads no .env file, so the key is
+//     copied into the model's table (holdsKey: config.toml is made 0600). `[auth] auth_provider_command` does run a
+//     command for a token, but that token becomes the session token every model without a key of its own uses, xAI's
+//     included, in place of the person's Grok sign-in (02-authentication.md:246-256), so it is not used.
+//
+// Not this connector: the open-source superagent-ai/grok-cli (GitHub), a different tool that keeps
+// ~/.grok/user-settings.json (apiKey, baseURL, defaultModel). Brain's grok-cli sessions are xAI's (src/adapters/grok-cli).
+//
+// config.toml is edited with the comment-keeping TOML codec from the Mistral Vibe connector: [models] default and
+// session_summary and the [model."100xprompt"] table, nothing else; every other line stays as it was.
+import { join } from "node:path"
+import { dirFromEnv, EDIT_HEADER, type Connector, modelName, readKey, routeUrl } from "../common.ts"
+import { type TomlTarget, tomlCodec } from "./mistral-vibe.ts"
+
+/** The [model.<id>] table brain adds; `grok -m 100xprompt` and /model pick it, the picker shows its name. */
+const ID = "100xprompt"
+
+const grokHome = (home: string, env: Record<string, string | undefined>) => dirFromEnv(env, "GROK_HOME", join(home, ".grok"))
+
+const grokTarget = (key: string): TomlTarget => {
+  const [head, ...rest] = key.split("/")
+  if (head === "models" && rest.length === 1) return { kind: "key", table: ["models"], key: rest[0]! }
+  if (head === "model" && rest.length) return { kind: "table", path: ["model", rest.join("/")] }
+  return { kind: "key", table: [], key }
+}
+
+export const grokToml = tomlCodec(grokTarget, [
+  ["models/default", ID],
+  ["models/session_summary", ID],
+  [`model/${ID}`, { model: "model-id", name: "100xprompt Pro", base_url: "https://gateway.example/flash/v1", api_backend: "chat_completions", api_key: "k", extra_headers: { [EDIT_HEADER]: "on" } }],
+])
+
+export const connectors: Connector[] = [
+  {
+    id: "grok-cli",
+    label: "Grok CLI",
+    file: (home, env) => join(grokHome(home, env), "config.toml"),
+    probe: [".grok"],
+    authHeader: "authorization",
+    edits: (home, s, env) => [
+      {
+        path: join(grokHome(home, env), "config.toml"),
+        format: "custom",
+        codec: grokToml,
+        holdsKey: true,
+        secretKeys: [`model/${ID}`],
+        values: {
+          "models/default": ID,
+          "models/session_summary": ID,
+          [`model/${ID}`]: {
+            model: s.model,
+            name: modelName(s.model),
+            base_url: `${routeUrl(s)}/v1`,
+            api_backend: "chat_completions",
+            api_key: readKey(home),
+            ...(s.contextEdit ? { extra_headers: { [EDIT_HEADER]: "on" } } : {}),
+          },
+        },
+      },
+    ],
+    notes: [
+      "Grok CLI takes a custom model's key only in its config.toml or from an environment variable: the key is kept in config.toml, so that file is now readable by you only (0600).",
+      "New Grok sessions start on the gateway's model, which also writes their titles; /model or grok -m still picks Grok's own models, which keep using your Grok sign-in.",
+    ],
+  },
+]