@aiwg/cli 2026.9.19 → 2026.9.21

package/dist/src/models/grok-build-models.js

@@ -0,0 +1,356 @@
+/**
+ * Grok Build model/config discovery.
+ *
+ * `grok inspect --json` is authoritative for active config sources. We read only
+ * model-selection fields from those reported files because current InspectReport
+ * versions do not expose effective model values. Secret-bearing fields are reduced
+ * to credential availability or header names and never leave this module.
+ *
+ * @issue #2579
+ */
+import { readFile } from 'node:fs/promises';
+import { homedir, tmpdir } from 'node:os';
+import { resolveGrokHomeResult } from '../providers/grok-build-paths.js';
+import { classifyDiscoveryError, runModelDiscoveryCommand } from './model-discovery.js';
+const MAX_CONFIG_BYTES = 1024 * 1024;
+const PROJECT_ALLOWED = new Set(['mcp_servers', 'plugins', 'permission', 'mcp']);
+function unquote(value) {
+    const text = value.trim();
+    if (text.startsWith('"') && text.endsWith('"')) {
+        try {
+            return JSON.parse(text);
+        }
+        catch {
+            return undefined;
+        }
+    }
+    if (text.startsWith("'") && text.endsWith("'"))
+        return text.slice(1, -1);
+    return undefined;
+}
+function stringArray(value) {
+    const text = value.trim();
+    if (!text.startsWith('[') || !text.endsWith(']'))
+        return undefined;
+    const matches = [...text.matchAll(/"((?:\\.|[^"\\])*)"|'([^']*)'/g)];
+    return matches.map(match => match[1] !== undefined
+        ? JSON.parse(`"${match[1]}"`)
+        : match[2]);
+}
+function tableName(line) {
+    const match = line.match(/^\s*\[([^\]]+)]\s*(?:#.*)?$/);
+    return match?.[1]?.trim();
+}
+function modelAlias(table) {
+    const match = table.match(/^model\.(?:"((?:\\.|[^"\\])*)"|'([^']*)'|([A-Za-z0-9_.-]+))$/);
+    if (!match)
+        return undefined;
+    return match[1] !== undefined ? JSON.parse(`"${match[1]}"`) : (match[2] ?? match[3]);
+}
+function mapKeys(value) {
+    const body = value.trim().replace(/^\{/, '').replace(/}$/, '');
+    return [...body.matchAll(/(?:^|,)\s*(?:"([^"]+)"|'([^']+)'|([A-Za-z0-9_-]+))\s*=/g)]
+        .map(match => match[1] ?? match[2] ?? match[3])
+        .filter(Boolean);
+}
+/** Parse only non-secret fields needed for model discovery. */
+export function parseGrokBuildModelConfig(text, scope) {
+    const parsed = { models: new Map(), projectModelFields: false };
+    let table = '';
+    for (const raw of text.split(/\r?\n/)) {
+        const nextTable = tableName(raw);
+        if (nextTable !== undefined) {
+            table = nextTable;
+            continue;
+        }
+        const match = raw.match(/^\s*([A-Za-z0-9_-]+)\s*=\s*(.*?)\s*(?:#.*)?$/);
+        if (!match)
+            continue;
+        const [, key, value] = match;
+        const top = table.split('.', 1)[0];
+        if (scope === 'project' && !PROJECT_ALLOWED.has(top)) {
+            if (top === 'models' || top === 'model')
+                parsed.projectModelFields = true;
+            continue;
+        }
+        if (table === 'models') {
+            if (key === 'default')
+                parsed.defaultModel = unquote(value);
+            else if (key === 'allowed_models')
+                parsed.allowedModels = stringArray(value);
+            else if (key === 'disabled_models')
+                parsed.disabledModels = stringArray(value);
+            continue;
+        }
+        const alias = modelAlias(table);
+        if (!alias)
+            continue;
+        const model = parsed.models.get(alias) ?? {
+            alias, envKeys: [], hasInlineCredential: false, headerNames: [],
+        };
+        if (key === 'model')
+            model.model = unquote(value);
+        else if (key === 'name')
+            model.name = unquote(value);
+        else if (key === 'base_url' || key === 'api_base_url')
+            model.baseUrl = unquote(value);
+        else if (key === 'env_key')
+            model.envKeys = unquote(value) ? [unquote(value)] : (stringArray(value) ?? []);
+        else if (key === 'api_key')
+            model.hasInlineCredential = Boolean(unquote(value));
+        else if (key === 'extra_headers' || key === 'env_http_headers')
+            model.headerNames.push(...mapKeys(value));
+        else if (key === 'hidden')
+            model.hidden = value.trim() === 'true';
+        else if (key === 'context_window')
+            model.contextWindow = Number(value.trim()) || undefined;
+        else if (key === 'supports_backend_search')
+            model.supportsBackendSearch = value.trim() === 'true';
+        else if (key === 'reasoning_efforts')
+            model.reasoningEfforts = stringArray(value);
+        parsed.models.set(alias, model);
+    }
+    return parsed;
+}
+function inspectLayers(report) {
+    const sources = (report.configSources ?? report.config_sources);
+    if (!sources || !Array.isArray(sources.layers))
+        return [];
+    return sources.layers.flatMap((entry, index) => {
+        if (!entry || typeof entry !== 'object')
+            return [];
+        const item = entry;
+        return typeof item.role === 'string' && typeof item.path === 'string'
+            ? [{ role: item.role, path: item.path, ...(typeof item.note === 'string' ? { note: item.note } : {}), precedence: index + 1 }]
+            : [];
+    });
+}
+function inspectModels(report) {
+    const candidates = [report.models, report.modelCatalog, report.model_catalog]
+        .find(Array.isArray);
+    if (!candidates)
+        return [];
+    return candidates.flatMap(entry => {
+        if (typeof entry === 'string')
+            return [{ id: entry, alias: entry }];
+        if (!entry || typeof entry !== 'object')
+            return [];
+        const model = entry;
+        const alias = [model.alias, model.key, model.id].find(value => typeof value === 'string');
+        if (!alias)
+            return [];
+        return [{
+                id: alias,
+                alias,
+                ...(typeof model.name === 'string' ? { displayName: model.name } : {}),
+                ...(model.default === true || model.isDefault === true ? { isDefault: true } : {}),
+                ...(model.hidden === true ? { hidden: true } : {}),
+                ...(Array.isArray(model.reasoningEfforts)
+                    ? { reasoningEfforts: model.reasoningEfforts.filter((item) => typeof item === 'string') }
+                    : {}),
+            }];
+    });
+}
+function setSelected(selected, key, value, layer, constraint) {
+    if (value === undefined)
+        return;
+    selected[key] = { value, source: layer.path, scope: layer.role, precedence: layer.precedence, ...(constraint ? { constraint } : {}) };
+}
+function globMatches(pattern, value) {
+    const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '.*').replace(/\?/g, '.');
+    return new RegExp(`^${escaped}$`).test(value);
+}
+function dedupe(models) {
+    return [...new Map(models.map(model => [model.alias ?? model.id, model])).values()];
+}
+function parseEnvOverlay(env) {
+    let content;
+    try {
+        content = JSON.parse(env.GROK_CONFIG ?? '');
+    }
+    catch {
+        return null;
+    }
+    if (!content || typeof content !== 'object' || Array.isArray(content))
+        return null;
+    const value = content;
+    const parsed = { models: new Map(), projectModelFields: false };
+    const settings = value.models;
+    if (settings && typeof settings === 'object' && !Array.isArray(settings)) {
+        const table = settings;
+        if (typeof table.default === 'string')
+            parsed.defaultModel = table.default;
+        if (Array.isArray(table.allowed_models) && table.allowed_models.every(entry => typeof entry === 'string'))
+            parsed.allowedModels = table.allowed_models;
+        if (Array.isArray(table.disabled_models) && table.disabled_models.every(entry => typeof entry === 'string'))
+            parsed.disabledModels = table.disabled_models;
+    }
+    // The host allowlists env-overlay sections; per-model secrets and model definitions
+    // are intentionally not imported from arbitrary JSON here.
+    return parsed;
+}
+async function readLayer(layer) {
+    if (layer.path.startsWith('$') || layer.path.includes('(inline)'))
+        return null;
+    try {
+        const text = await readFile(layer.path, 'utf8');
+        if (Buffer.byteLength(text) > MAX_CONFIG_BYTES)
+            return null;
+        return parseGrokBuildModelConfig(text, layer.role === 'project' ? 'project' : layer.role);
+    }
+    catch {
+        return null;
+    }
+}
+export async function discoverGrokBuildModels(options = {}) {
+    const command = options.command ?? 'grok';
+    const runner = options.runner ?? runModelDiscoveryCommand;
+    const cwd = options.cwd ?? tmpdir();
+    const env = options.env ?? process.env;
+    const observedAt = new Date().toISOString();
+    const base = {
+        provider: 'grok-build', source: 'native', observedAt,
+        accountScope: 'local-runtime', models: [],
+    };
+    let report = options.inspectReport;
+    let runtimeVersion;
+    if (!report) {
+        const [version, result] = await Promise.all([
+            runner(command, ['--version'], { cwd, timeoutMs: 5_000, env }),
+            runner(command, ['inspect', '--json'], { cwd, timeoutMs: 15_000, env }),
+        ]);
+        runtimeVersion = version.exitCode === 0 ? version.stdout.trim().split(/\r?\n/, 1)[0] : undefined;
+        if (result.exitCode !== 0) {
+            // Native stderr can include arbitrary headers, API keys and endpoint URLs.
+            // Classify it, but never echo untrusted command output into audit/receipts.
+            const detail = result.stderr || result.stdout;
+            return { ...base, ...(runtimeVersion ? { runtimeVersion } : {}),
+                errorKind: result.exitCode === 124 ? 'timeout' : classifyDiscoveryError(detail),
+                error: `Grok Build inspect failed (exit ${result.exitCode}); check CLI version, config layers and credentials locally.` };
+        }
+        try {
+            const parsed = JSON.parse(result.stdout);
+            if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+                throw new Error('object expected');
+            report = parsed;
+        }
+        catch {
+            return { ...base, ...(runtimeVersion ? { runtimeVersion } : {}), errorKind: 'invalid-output',
+                error: 'Grok Build inspect returned an unsupported JSON shape; update Grok Build or AIWG.' };
+        }
+    }
+    const layers = inspectLayers(report);
+    if (layers.length === 0 && !Object.keys(report).some(key => ['models', 'modelCatalog', 'model_catalog'].includes(key))) {
+        return { ...base, ...(runtimeVersion ? { runtimeVersion } : {}), errorKind: 'invalid-output',
+            error: 'Grok Build inspect JSON omitted configSources; update Grok Build or AIWG.' };
+    }
+    const diagnostics = [];
+    const selected = {};
+    const constraints = [];
+    const discovered = inspectModels(report);
+    const parsedByLayer = await Promise.all(layers.map(layer => layer.role === 'env_overlay'
+        && layer.path.includes('(inline)') ? parseEnvOverlay(env) : readLayer(layer)));
+    let requirementsDefault;
+    let requirementsAllowed;
+    for (let i = 0; i < layers.length; i++) {
+        const layer = layers[i];
+        const parsed = parsedByLayer[i];
+        if (!parsed)
+            continue;
+        if (parsed.projectModelFields)
+            diagnostics.push(`${layer.path}: ignored model settings because Grok Build project scope does not allow them`);
+        const requirement = /requirements|mdm/i.test(layer.role);
+        setSelected(selected, 'models.default', parsed.defaultModel, layer, requirement ? 'pin' : undefined);
+        setSelected(selected, 'models.allowed_models', parsed.allowedModels, layer, requirement ? 'allowlist' : undefined);
+        setSelected(selected, 'models.disabled_models', parsed.disabledModels, layer);
+        if (requirement && parsed.defaultModel)
+            requirementsDefault = selected['models.default'];
+        if (requirement && parsed.allowedModels)
+            requirementsAllowed = selected['models.allowed_models'];
+        if (requirement && parsed.defaultModel)
+            constraints.push({ key: 'models.default', source: layer.path, precedence: layer.precedence, kind: 'pin' });
+        if (requirement && parsed.allowedModels)
+            constraints.push({ key: 'models.allowed_models', source: layer.path, precedence: layer.precedence, kind: 'allowlist' });
+        for (const model of parsed.models.values()) {
+            setSelected(selected, `model.${model.alias}.alias`, model.alias, layer);
+            setSelected(selected, `model.${model.alias}.model`, model.model, layer);
+            setSelected(selected, `model.${model.alias}.name`, model.name, layer);
+            setSelected(selected, `model.${model.alias}.context_window`, model.contextWindow, layer);
+            setSelected(selected, `model.${model.alias}.supports_backend_search`, model.supportsBackendSearch, layer);
+            const credentialState = model.hasInlineCredential
+                || model.envKeys.some(key => Boolean(env[key])) ? 'available'
+                : model.envKeys.length > 0 ? 'unavailable' : 'session';
+            discovered.push({
+                id: model.alias,
+                alias: model.alias,
+                ...(model.model ? { apiModelId: model.model } : {}),
+                ...(model.name ? { displayName: model.name } : {}),
+                ...(model.hidden !== undefined ? { hidden: model.hidden } : {}),
+                ...(model.reasoningEfforts ? { reasoningEfforts: model.reasoningEfforts } : {}),
+                capabilities: [
+                    ...(model.contextWindow ? [`context:${model.contextWindow}`] : []),
+                    ...(model.supportsBackendSearch ? ['backend-search'] : []),
+                    ...(model.baseUrl ? ['custom-endpoint'] : []),
+                    ...model.headerNames.map(name => `header:${name}`),
+                ],
+                credentialState,
+            });
+        }
+    }
+    const homeResult = resolveGrokHomeResult(env, env.HOME ?? env.USERPROFILE ?? homedir());
+    if (!homeResult.ok)
+        diagnostics.push(homeResult.message);
+    const envDefault = env.GROK_DEFAULT_MODEL?.trim();
+    if (envDefault && !requirementsDefault) {
+        const layer = { role: 'environment', path: 'GROK_DEFAULT_MODEL', precedence: layers.length + 1 };
+        setSelected(selected, 'models.default', envDefault, layer);
+    }
+    if (requirementsDefault)
+        selected['models.default'] = requirementsDefault;
+    if (requirementsAllowed)
+        selected['models.allowed_models'] = requirementsAllowed;
+    let models = dedupe(discovered);
+    const defaultAlias = selected['models.default']?.value;
+    if (typeof defaultAlias === 'string' && !models.some(model => (model.alias ?? model.id) === defaultAlias)) {
+        models.push({ id: defaultAlias, alias: defaultAlias, credentialState: 'session' });
+    }
+    const disabled = selected['models.disabled_models']?.value;
+    if (Array.isArray(disabled))
+        models = models.filter(model => !disabled.includes(model.alias ?? model.id));
+    const allowed = selected['models.allowed_models']?.value;
+    if (Array.isArray(allowed) && allowed.length > 0) {
+        models = models.filter(model => allowed.some(pattern => globMatches(pattern, model.alias ?? model.id)));
+    }
+    models = models.map(model => ({ ...model, isDefault: (model.alias ?? model.id) === defaultAlias }));
+    if (models.some(model => model.credentialState === 'unavailable')) {
+        diagnostics.push('One or more configured models lack their named credential environment variable; secret values were not read into output.');
+    }
+    return {
+        ...base,
+        ...(runtimeVersion ? { runtimeVersion } : {}),
+        models,
+        policy: {
+            layers: layers.map(layer => ({ scope: layer.role, source: layer.path, precedence: layer.precedence,
+                policyConstraint: /requirements|mdm/i.test(layer.role) })),
+            selected,
+            constraints,
+            diagnostics,
+        },
+        ...(models.length === 0 ? { errorKind: 'invalid-output',
+            error: 'Grok Build exposed no model aliases. Configure [models].default or [model.<alias>] in $GROK_HOME/config.toml; AIWG will not fabricate an xAI model ID.' } : {}),
+    };
+}
+/** Resolve aliases only from the observed catalog. Exact API model ids are never synthesized. */
+export function resolveGrokBuildRoleModel(catalog, role, mappings = {}, explicit) {
+    const available = new Set(catalog.models.map(model => model.alias ?? model.id));
+    const requested = explicit ?? mappings[role];
+    if (requested) {
+        if (available.has(requested))
+            return { role, model: requested, source: explicit ? 'explicit' : 'project-policy' };
+        return { role, source: 'unresolved', diagnostic: `Grok Build model alias "${requested}" is unavailable for ${role}; choose an alias reported by grok inspect/config discovery. No xAI model ID was substituted.` };
+    }
+    if (available.size === 1)
+        return { role, model: [...available][0], source: 'single-model-fallback' };
+    return { role, source: 'unresolved', diagnostic: `Grok Build ${role} role has no mapping and ${available.size} models are available; configure an explicit alias in models.json. No xAI model ID was guessed.` };
+}
+//# sourceMappingURL=grok-build-models.js.map

package/dist/src/models/index.js

@@ -18,5 +18,6 @@ export { ConfigLoader } from './config-loader.js';
 export { ModelResolver } from './resolver.js';
 // Export provider-neutral runtime tier routing primitive
 export { routeModelTier } from './router.js';
+export { discoverGrokBuildModels, parseGrokBuildModelConfig, resolveGrokBuildRoleModel, } from './grok-build-models.js';
 export { compileModelPolicy, loadProviderModelCapabilities, loadProviderModelCatalog, renderCodexAgentToml, resetModelPolicyCachesForTests, validateCanonicalModelPolicy, validateUserProjectModelConfig, } from './provider-policy.js';
 //# sourceMappingURL=index.js.map

package/dist/src/models/model-capabilities.v1.json

@@ -228,6 +228,19 @@
       "sourceUrl": "https://github.com/jmagly/aiwg/blob/main/docs/architecture/adr-grokbot-provider-target.md",
       "verifiedAt": "2026-09-15"
     },
+    "grok-build": {
+      "agent": "inherited",
+      "skill": "inherited",
+      "globalChild": "native",
+      "identifierSyntax": "Provider-local alias from grok inspect and $GROK_HOME config; distinct from API model id",
+      "inheritance": "Agent and skill roles resolve through the session model unless a validated Grok Build alias is selected",
+      "invalidPinFallback": "Report the unavailable alias; use the sole discovered model only when exactly one is available",
+      "configTarget": "$GROK_HOME/config.toml [models] and [model.<alias>] (read-only discovery)",
+      "artifactFormat": "Grok Build model alias",
+      "verification": "grok inspect --json plus bounded parsing of model fields from reported config layers",
+      "sourceUrl": "https://docs.x.ai/build/settings",
+      "verifiedAt": "2026-09-21"
+    },
     "hermes": {
       "agent": "global-only",
       "skill": "unsupported",
@@ -253,6 +266,27 @@
       "verification": "Parse against OpenHuman definition schema",
       "sourceUrl": "https://github.com/tinyhumansai/openhuman/blob/main/src/openhuman/agent/harness/definition.rs",
       "verifiedAt": "2026-07-20"
+    },
+    "muse": {
+      "agent": "unsupported",
+      "skill": "unsupported",
+      "globalChild": "informational",
+      "identifierSyntax": "Meta provider catalog model_id (Muse Code 1.4.0: muse-spark-1.3 current, muse-spark-1.3-contributor default, muse-spark-1.2, muse-spark-1.2-contributor), passed as muse exec --model",
+      "inheritance": "The session model comes from --model, else settings.json `model`, else the provider catalog default; per-agent and per-skill pins are not verified",
+      "invalidPinFallback": "muse exits 1 with run.terminal.failed (\"model `<id>` does not exist or you lack access\"); never falls back to another model",
+      "configTarget": "$XDG_CONFIG_HOME/muse/settings.json `model` (read-only; AIWG never writes it)",
+      "artifactFormat": "Meta provider model id (session-level only)",
+      "verification": "muse exec --json --model <id> emits run.model.configured with model_id; observed muse-spark-1.3 and muse-spark-1.3-contributor in native session logs on Muse Code 1.4.0",
+      "sourceUrl": "https://github.com/jmagly/aiwg/blob/main/docs/architecture/adr-muse-provider-target.md",
+      "verifiedAt": "2026-09-25",
+      "effortValues": [
+        "minimal",
+        "low",
+        "medium",
+        "high",
+        "xhigh",
+        "max"
+      ]
     }
   }
 }

package/dist/src/models/model-catalog.v1.json

@@ -1,7 +1,7 @@
 {
   "$schema": "../../../schemas/models/model-catalog.v1.schema.json",
   "version": "1.0.0",
-  "refreshedAt": "2026-07-20",
+  "refreshedAt": "2026-09-21",
   "staleAfterDays": 90,
   "providers": {
     "antigravity": {
@@ -28,12 +28,12 @@
     "claude": {
       "roles": {
         "reasoning": {
-          "id": "claude-opus-4-7",
+          "id": "claude-opus-5",
           "status": "active",
           "observed": false
         },
         "coding": {
-          "id": "claude-sonnet-4-6",
+          "id": "claude-sonnet-5",
           "status": "active",
           "observed": false
         },
@@ -43,29 +43,29 @@
           "observed": false
         }
       },
-      "sourceUrl": "https://docs.anthropic.com/en/docs/about-claude/models/overview",
-      "verifiedAt": "2026-07-20"
+      "sourceUrl": "https://platform.claude.com/docs/en/about-claude/models/overview",
+      "verifiedAt": "2026-09-21"
     },
     "codex": {
       "roles": {
         "reasoning": {
-          "id": "gpt-5.4",
+          "id": "gpt-5.6-sol",
           "status": "active",
           "observed": true
         },
         "coding": {
-          "id": "gpt-5.5",
+          "id": "gpt-5.6-terra",
           "status": "active",
           "observed": true
         },
         "efficiency": {
-          "id": "gpt-5.4-mini",
+          "id": "gpt-5.6-luna",
           "status": "active",
           "observed": true
         }
       },
-      "sourceUrl": "https://learn.chatgpt.com/docs/agent-configuration/subagents",
-      "verifiedAt": "2026-07-20"
+      "sourceUrl": "https://learn.chatgpt.com/docs/models",
+      "verifiedAt": "2026-09-21"
     },
     "copilot": {
       "roles": {
@@ -133,12 +133,12 @@
     "opencode": {
       "roles": {
         "reasoning": {
-          "id": "anthropic/claude-opus-4-7",
+          "id": "anthropic/claude-opus-5",
           "status": "unverified",
           "observed": false
         },
         "coding": {
-          "id": "anthropic/claude-sonnet-4-6",
+          "id": "anthropic/claude-sonnet-5",
           "status": "unverified",
           "observed": false
         },
@@ -149,7 +149,7 @@
         }
       },
       "sourceUrl": "https://opencode.ai/docs/models",
-      "verifiedAt": "2026-07-20"
+      "verifiedAt": "2026-09-21"
     },
     "omp": {
       "roles": {
@@ -298,6 +298,27 @@
       "sourceUrl": "https://github.com/jmagly/aiwg/blob/main/docs/architecture/adr-grokbot-provider-target.md",
       "verifiedAt": "2026-09-15"
     },
+    "grok-build": {
+      "roles": {
+        "reasoning": {
+          "id": "configured/reasoning",
+          "status": "unverified",
+          "observed": false
+        },
+        "coding": {
+          "id": "configured/coding",
+          "status": "unverified",
+          "observed": false
+        },
+        "efficiency": {
+          "id": "configured/efficiency",
+          "status": "unverified",
+          "observed": false
+        }
+      },
+      "sourceUrl": "https://docs.x.ai/build/settings",
+      "verifiedAt": "2026-09-21"
+    },
     "hermes": {
       "roles": {
         "reasoning": {
@@ -339,6 +360,27 @@
       },
       "sourceUrl": "https://github.com/tinyhumansai/openhuman/blob/main/src/openhuman/agent/harness/definition.rs",
       "verifiedAt": "2026-07-20"
+    },
+    "muse": {
+      "roles": {
+        "reasoning": {
+          "id": "muse-spark-1.3",
+          "status": "active",
+          "observed": true
+        },
+        "coding": {
+          "id": "muse-spark-1.3",
+          "status": "active",
+          "observed": true
+        },
+        "efficiency": {
+          "id": "muse-spark-1.3",
+          "status": "active",
+          "observed": true
+        }
+      },
+      "sourceUrl": "https://dev.meta.ai/docs/models",
+      "verifiedAt": "2026-09-25"
     }
   }
 }

package/dist/src/models/model-discovery.js

@@ -46,6 +46,13 @@ export const PROVIDER_DISCOVERY_DECISIONS = {
         reason: 'Grok Bot is a desktop multi-agent runtime with no verified non-interactive model-list command; AIWG does not invent xAI/Grok API enumeration as Grok Bot entitlement.',
         documentation: 'https://github.com/jmagly/aiwg/blob/main/docs/architecture/adr-grokbot-provider-target.md',
     },
+    'grok-build': {
+        provider: 'grok-build',
+        status: 'native',
+        interface: 'grok inspect --json plus bounded model fields from reported config sources',
+        reason: 'Inspect is the authority for active configuration layers; current releases require reading only model-selection fields from those files.',
+        documentation: 'https://docs.x.ai/build/settings',
+    },
     hermes: {
         provider: 'hermes',
         status: 'unsupported',
@@ -53,6 +60,13 @@ export const PROVIDER_DISCOVERY_DECISIONS = {
         reason: 'hermes model is interactive; the optional API server /v1/models endpoint requires a separately running service and represents that service rather than local CLI entitlement.',
         documentation: 'https://hermes-agent.nousresearch.com/docs/reference/cli-commands',
     },
+    muse: {
+        provider: 'muse',
+        status: 'unsupported',
+        interface: null,
+        reason: 'Muse Code is a terminal/CI coding agent with no verified non-interactive model-list command; AIWG does not invent Meta Model API enumeration as Muse Code entitlement.',
+        documentation: 'https://github.com/jmagly/aiwg/blob/main/docs/architecture/adr-muse-provider-target.md',
+    },
     opencode: {
         provider: 'opencode',
         status: 'native',
@@ -110,6 +124,15 @@ export function classifyDiscoveryError(message) {
         return 'timeout';
     return 'command';
 }
+const SECRET_ASSIGNMENT = /((?:api[_-]?key|authorization|token|secret|password|cookie|extra_headers?)\s*[=:]\s*)([^\s,}\]]+)/gi;
+const BEARER_SECRET = /(bearer\s+)[A-Za-z0-9._~+/=-]+/gi;
+/** Keep native diagnostics useful without ever echoing credential material. */
+export function redactModelDiscoveryText(value) {
+    return value
+        .replace(SECRET_ASSIGNMENT, '$1[REDACTED]')
+        .replace(BEARER_SECRET, '$1[REDACTED]')
+        .slice(0, 4096);
+}
 export const runModelDiscoveryCommand = (command, args, options = {}) => new Promise(resolveCommand => {
     const child = spawn(command, args, {
         cwd: options.cwd,
@@ -298,16 +321,25 @@ function isFresh(catalog, now, ttlMs, signature) {
     const age = now.getTime() - Date.parse(fetchedAt);
     return Number.isFinite(age) && age >= 0 && age <= ttlMs;
 }
+/** Tier families by name, anchored on separators so `solution` or `lunar` do not match. */
+const FLAGSHIP_FAMILY = /(?:^|[/:._-])(?:fable|astra)(?:$|[/:._[-]|\d)/i;
+const PREMIUM_FAMILY = /(?:^|[/:._-])(?:opus|sol)(?:$|[/:._[-]|\d)/i;
+const STANDARD_FAMILY = /(?:^|[/:._-])(?:sonnet|terra)(?:$|[/:._[-]|\d)/i;
 export function selectRoleModels(models) {
-    const visible = models.filter(model => !model.hidden);
+    // Flagship families are user-elected only (epic #2642): discovery never
+    // assigns them to a role, even when the provider marks one as its default.
+    const visible = models.filter(model => !model.hidden && !FLAGSHIP_FAMILY.test(model.id));
     if (visible.length === 0)
         return {};
-    const coding = visible.find(model => model.isDefault)
+    const coding = visible.find(model => STANDARD_FAMILY.test(model.id))
+        ?? visible.find(model => model.isDefault && !PREMIUM_FAMILY.test(model.id))
+        ?? visible.find(model => model.isDefault)
         ?? visible.find(model => /(?:codex|code|sonnet|gpt)/i.test(model.id))
         ?? visible[0];
-    const efficiency = visible.find(model => /(?:mini|spark|haiku|light|flash)/i.test(model.id))
+    const efficiency = visible.find(model => /(?:mini|spark|haiku|light|flash|luna)/i.test(model.id))
         ?? [...visible].sort((a, b) => (a.reasoningEfforts?.length ?? 0) - (b.reasoningEfforts?.length ?? 0))[0];
-    const reasoningCandidates = visible.filter(model => /(?:opus|reason|ultra|max|pro(?:[-_/]|$))/i.test(model.id));
+    const premium = visible.filter(model => PREMIUM_FAMILY.test(model.id));
+    const reasoningCandidates = premium.length > 0 ? premium : visible.filter(model => /(?:opus|reason|ultra|max|pro(?:[-_/]|$))/i.test(model.id));
     const reasoning = [...(reasoningCandidates.length > 0 ? reasoningCandidates : visible)].sort((a, b) => {
         const effortDelta = (b.reasoningEfforts?.length ?? 0) - (a.reasoningEfforts?.length ?? 0);
         if (effortDelta !== 0)
@@ -462,7 +494,7 @@ export async function resolveDynamicModelCatalog(options) {
                 : undefined,
         };
     }
-    if (!options.allowNetwork) {
+    if (!options.allowNetwork && !options.nativeDiscoverers) {
         return {
             ...staticCatalog,
             discovery: {
@@ -503,6 +535,10 @@ export async function resolveDynamicModelCatalog(options) {
         openclaw: () => discoverOpenClawModels(),
         pi: () => discoverPiModels(),
         omp: () => discoverOmpModels(process.env.AIWG_OMP_BIN || 'omp', runModelDiscoveryCommand, options.omp),
+        'grok-build': async () => {
+            const { discoverGrokBuildModels } = await import('./grok-build-models.js');
+            return discoverGrokBuildModels(options.grokBuild);
+        },
     };
     const providerDiscovery = {};
     for (const provider of available) {

package/dist/src/models/provider-policy.js

@@ -26,8 +26,8 @@ function requireModelResource(filename) {
 const capabilityData = requireModelResource('model-capabilities.v1.json');
 const catalogData = requireModelResource('model-catalog.v1.json');
 const ProviderSchema = z.enum([
-    'antigravity', 'claude', 'codex', 'copilot', 'cursor', 'deepseek-harness', 'factory', 'grokbot', 'hermes',
-    'opencode', 'openclaw', 'openhuman', 'omp', 'pi', 'warp', 'windsurf',
+    'antigravity', 'claude', 'codex', 'copilot', 'cursor', 'deepseek-harness', 'factory', 'grokbot', 'grok-build', 'hermes',
+    'muse', 'opencode', 'openclaw', 'openhuman', 'omp', 'pi', 'warp', 'windsurf',
 ]);
 const OutcomeSchema = z.enum([
     'native', 'compiled', 'inherited', 'global-only', 'informational', 'unsupported',
@@ -160,6 +160,7 @@ function fieldNames(provider) {
         case 'copilot':
         case 'cursor':
         case 'opencode': return { model: 'model' };
+        case 'grok-build': return { model: 'model', effort: 'effort' };
         case 'omp': return { model: 'model', effort: 'thinkingLevel' };
         case 'pi': return { model: 'model', effort: 'thinking' };
         case 'openhuman': return { model: 'model_hint' };