fix(web): stop rendering healthy ready providers as auth failures

apps/web/src/components/settings/providerStatus.test.ts

@@ -0,0 +1,96 @@
+import { ProviderDriverKind, ProviderInstanceId, type ServerProvider } from "@t3tools/contracts";
+import { describe, expect, it } from "vite-plus/test";
+
+import { getProviderSummary } from "./providerStatus";
+
+function provider(input: {
+  status?: ServerProvider["status"];
+  enabled?: boolean;
+  installed?: boolean;
+  authStatus?: ServerProvider["auth"]["status"];
+  message?: string;
+}): ServerProvider {
+  return {
+    instanceId: ProviderInstanceId.make("grok"),
+    driver: ProviderDriverKind.make("grok"),
+    enabled: input.enabled ?? true,
+    installed: input.installed ?? true,
+    version: null,
+    status: input.status ?? "ready",
+    auth: { status: input.authStatus ?? "unknown" },
+    checkedAt: "2026-01-01T00:00:00.000Z",
+    ...(input.message ? { message: input.message } : {}),
+    models: [],
+    slashCommands: [],
+    skills: [],
+  };
+}
+
+describe("getProviderSummary", () => {
+  it("shows a waiting summary before the first probe reports", () => {
+    expect(getProviderSummary(undefined)).toEqual({
+      headline: "Checking provider status",
+      detail: "Waiting for the server to report installation and authentication details.",
+    });
+  });
+
+  it("prefers the server message for a disabled provider", () => {
+    const summary = getProviderSummary(
+      provider({
+        status: "disabled",
+        enabled: false,
+        message: "Grok is disabled in T3 Code settings.",
+      }),
+    );
+    expect(summary.headline).toBe("Disabled");
+    expect(summary.detail).toBe("Grok is disabled in T3 Code settings.");
+  });
+
+  it("reports a missing CLI as not found", () => {
+    const summary = getProviderSummary(provider({ installed: false }));
+    expect(summary.headline).toBe("Not found");
+    expect(summary.detail).toBe("CLI not detected on PATH.");
+  });
+
+  it("prefers the server message once authenticated", () => {
+    const summary = getProviderSummary(
+      provider({ authStatus: "authenticated", message: "Signed in via CLI." }),
+    );
+    expect(summary.headline).toBe("Authenticated");
+    expect(summary.detail).toBe("Signed in via CLI.");
+  });
+
+  it("reports an unauthenticated provider without inventing detail", () => {
+    const summary = getProviderSummary(provider({ authStatus: "unauthenticated" }));
+    expect(summary.headline).toBe("Not authenticated");
+    expect(summary.detail).toBeNull();
+  });
+
+  it("flags a warning status as needing attention", () => {
+    const summary = getProviderSummary(provider({ status: "warning" }));
+    expect(summary.headline).toBe("Needs attention");
+    expect(summary.detail).toBe(
+      "The provider is installed, but the server could not fully verify it.",
+    );
+  });
+
+  it("flags an error status as unavailable", () => {
+    const summary = getProviderSummary(provider({ status: "error" }));
+    expect(summary.headline).toBe("Unavailable");
+    expect(summary.detail).toBe("The provider failed its startup checks.");
+  });
+
+  it("renders a ready provider with unverified auth neutrally instead of as an auth failure", () => {
+    // Grok's probe never verifies auth; a fully healthy check must not read
+    // like an error. Regression test for pingdotgg/t3code#7932.
+    const summary = getProviderSummary(provider({}));
+    expect(summary.headline).toBe("Available");
+    expect(summary.detail).toBeNull();
+  });
+
+  it("still shows the server message for a ready provider when one exists", () => {
+    const summary = getProviderSummary(provider({ message: "Installed and ready." }));
+    expect(summary.headline).toBe("Available");
+    expect(summary.detail).toBe("Installed and ready.");
+  });
+});

apps/web/src/components/settings/providerStatus.ts

@@ -27,6 +27,10 @@ export type ProviderStatusKey = keyof typeof PROVIDER_STATUS_STYLES;
  * falls back to generic phrasing when the server has not yet reported any
  * state — which happens before the first probe or when an instance names a
  * driver this build does not ship.
+ *
+ * A ready snapshot whose probe could not verify authentication (e.g. Grok,
+ * which has no auth check today) is healthy; render it neutrally instead of
+ * phrasing "unknown" as an auth failure.
  */
 export function getProviderSummary(provider: ServerProvider | undefined) {
   if (!provider) {
@@ -76,7 +80,7 @@ export function getProviderSummary(provider: ServerProvider | undefined) {
   }
   return {
     headline: "Available",
-    detail: provider.message ?? "Installed and ready, but authentication could not be verified.",
+    detail: provider.message ?? null,
   };
 }