Switch @lead model to ollama-cloud/kimi-k3:cloud

PR #114 pointed @lead/@ops at xai/grok-4.5 but never gave opencode a
provider config for it — xai is not a built-in like anthropic was, it
needs the same explicit OpenAI-compatible block as ollama/ollama-cloud
(confirmed by the prior, never-merged investigation in PR #110). Without
this, any @lead/@ops run fails immediately on an unresolvable provider.

Adds the xai provider block (baseURL https://api.x.ai/v1, models derived
from agents.json) and passes XAI_API_KEY into the Install-opencode step
(it was already added to the Run-agent step in #114).

.gitea/workflows/agent.yml

@@ -149,6 +149,7 @@ jobs:
           SCRIPTS: ${{ runner.temp }}/agents-scripts
           OLLAMA_URL: ${{ secrets.OLLAMA_URL }}
           OLLAMA_CLOUD_API_KEY: ${{ secrets.OLLAMA_CLOUD_API_KEY }}
+          XAI_API_KEY: ${{ secrets.XAI_API_KEY }}
           NAME: ${{ steps.prep.outputs.name }}
           SKILLS: ${{ steps.prep.outputs.skills }}   # JSON array of skills this agent may load
         run: bash "$SCRIPTS/install-opencode.sh"

.gitea/workflows/scripts/agents.json

@@ -25,7 +25,7 @@
     "desc": "Senior dev — complex, multi-file implementation (GLM-5.2 via Ollama Cloud, text-only)."
   },
   "lead": {
-    "model": "xai/grok-4.5",
+    "model": "ollama-cloud/kimi-k3:cloud",
     "vision": true,
     "mode": "pr",
     "skills": [

.gitea/workflows/scripts/install-opencode.sh

@@ -1,8 +1,8 @@
 #!/usr/bin/env bash
 # Install opencode + provider config (+ Playwright MCP for browser agents).
 #
-# Required env (provided by the workflow step): OLLAMA_URL OLLAMA_CLOUD_API_KEY NAME SKILLS
-#   GITHUB_PATH HOME
+# Required env (provided by the workflow step): OLLAMA_URL OLLAMA_CLOUD_API_KEY XAI_API_KEY
+#   NAME SKILLS GITHUB_PATH HOME
 set -eu
 
 # PIN the opencode version: an unpinned `latest` means a breaking release (CLI flags, or the
@@ -38,19 +38,22 @@ esac
 SKILLS="${SKILLS:-[]}"
 PERM=$(jq -nc --argjson s "$SKILLS" '
   {skill: ( {"*":"deny"} + (reduce $s[] as $k ({}; . + {($k):"allow"})) )}')
-# Two ollama providers: local self-hosted (ornith) + Ollama Cloud (gemma4/kimi-k2.7-code/glm-5.2/minimax-m3).
-# The provider `models:` maps are DERIVED from agents.json (the single source of truth, shared with
-# route.sh) so every model an agent is routed to is always declared in the provider config.
-# `ollama-cloud/` prefix models go to the cloud provider; `ollama/` prefix models go to the local
-# provider. Built-in providers (e.g. `xai/grok-4.5` for @lead/@ops) are not derived here.
+# Three OpenAI-compatible providers: local self-hosted ollama (ornith) + Ollama Cloud
+# (gemma4/kimi-k2.7-code/kimi-k3/glm-5.2/minimax-m3) + xAI (grok-4.5). The provider `models:` maps are
+# DERIVED from agents.json (the single source of truth, shared with route.sh) so every model an
+# agent is routed to is always declared in the provider config. `ollama-cloud/` prefix models go to
+# the cloud provider; `ollama/` prefix models go to the local provider; `xai/` prefix models go to
+# the xAI provider (OpenAI-compatible, https://api.x.ai/v1). No other built-in providers remain.
 # See issue #31.
 AGENTS_JSON="${SCRIPTS:-$(dirname -- "$0")}/agents.json"
 CLOUD_MODELS=$(jq -r '[.[] | .model | select(startswith("ollama-cloud/")) | sub("^ollama-cloud/";"")] | map({(.):{}}) | add // {}' "$AGENTS_JSON")
 LOCAL_MODELS=$(jq -r '[.[] | .model | select(startswith("ollama/")) | sub("^ollama/";"")] | map({(.):{}}) | add // {"ornith:35b":{}}' "$AGENTS_JSON")
-jq -n --argjson mcp "$MCP" --argjson perm "$PERM" --argjson cloud "$CLOUD_MODELS" --argjson local "$LOCAL_MODELS" --arg url "$OLLAMA_URL" --arg ckey "$OLLAMA_CLOUD_API_KEY" '{
+XAI_MODELS=$(jq -r '[.[] | .model | select(startswith("xai/")) | sub("^xai/";"")] | map({(.):{}}) | add // {}' "$AGENTS_JSON")
+jq -n --argjson mcp "$MCP" --argjson perm "$PERM" --argjson cloud "$CLOUD_MODELS" --argjson local "$LOCAL_MODELS" --argjson xai "$XAI_MODELS" --arg url "$OLLAMA_URL" --arg ckey "$OLLAMA_CLOUD_API_KEY" --arg xkey "$XAI_API_KEY" '{
   provider: {
     ollama: {npm:"@ai-sdk/openai-compatible", options:{baseURL:($url+"/v1")}, models:$local},
-    "ollama-cloud": {npm:"@ai-sdk/openai-compatible", options:{baseURL:"https://ollama.com/v1", apiKey:$ckey}, models:$cloud}
+    "ollama-cloud": {npm:"@ai-sdk/openai-compatible", options:{baseURL:"https://ollama.com/v1", apiKey:$ckey}, models:$cloud},
+    xai: {npm:"@ai-sdk/openai-compatible", options:{baseURL:"https://api.x.ai/v1", apiKey:$xkey}, models:$xai}
   },
   permission: $perm,
   mcp: $mcp

README.md

@@ -10,7 +10,7 @@ Shared **AI dev-team** workflow for Gitea Actions, reusable across repos. It giv
 | `@pm` | `ollama-cloud/minimax-m3:cloud` | yes | comment | `gitea-api` | Product manager & orchestrator — plans, picks the dev, hands finished PRs to `@qa`, reports back to the issue creator (autopilot: merges approved PRs itself). Issue thread only; never edits files, never reads the PR diff. |
 | `@junior` | `ollama-cloud/kimi-k2.7-code:cloud` | no | pr | — | Junior dev — small, low-risk changes (mostly YAML/compose/config). Text-only, cannot read images. Defers complex or image tasks to `@senior` or `@lead`. |
 | `@senior` | `ollama-cloud/glm-5.2:cloud` | no | pr | `gitea-api` | Senior dev — complex, multi-file implementation (GLM-5.2 via Ollama Cloud, text-only). |
-| `@lead` | `xai/grok-4.5` | yes | pr | `gitea-api` | Tech lead — the hardest problems, architecture, and final calls. |
+| `@lead` | `ollama-cloud/kimi-k3:cloud` | yes | pr | `gitea-api` | Tech lead — the hardest problems, architecture, and final calls. |
 | `@qa` | `ollama-cloud/minimax-m3:cloud` | yes | comment | `gitea-api` | QA / reviewer — reads the PR diff, drives a headless browser (Playwright) to verify behavior; recommendations on the PR, pass/fail verdict on the issue. Never edits code, never merges. |
 | `@ops` | `xai/grok-4.5` | no | comment | `gitea-admin` | Gitea operator — administers the instance itself (create orgs/users/repos, labels, secrets, scoped per-user tokens, bootstrap repos). Comments only; never edits code. Confirms before destructive actions. |
 | `@intern` | `ollama/ornith:35b` | no | pr | — | Intern — very basic tasks only, routed to the local Ollama model (`ornith:35b`). Text-only, cannot read images. Escalates anything non-trivial to `@junior`, `@senior` or `@lead`. |
@@ -111,8 +111,8 @@ points `$SCRIPTS` at it. Keep the workflow and its scripts moving together on `m
 
 | Secret | For |
 |--------|-----|
-| `XAI_API_KEY` | `@lead`, `@ops` (and any other agent switched to a `xai/…` model) |
-| `OLLAMA_URL`, `OLLAMA_CLOUD_API_KEY` | local ornith / Ollama Cloud (gemma4, kimi-k2.7-code, glm-5.2, minimax-m3) |
+| `XAI_API_KEY` | `@ops` (and any other agent switched to a `xai/…` model) |
+| `OLLAMA_URL`, `OLLAMA_CLOUD_API_KEY` | local ornith / Ollama Cloud (gemma4, kimi-k2.7-code, kimi-k3, glm-5.2, minimax-m3) |
 | `TOKEN_PM`,`TOKEN_SENIOR`,`TOKEN_JUNIOR`,`TOKEN_LEAD`,`TOKEN_QA` | **primary** — each agent's own Gitea-user PAT. The running agent gets *only its own* token (as `SELF_TOKEN`) so it posts, commits and comments as itself, and its `gitea-api` skill acts with its own scopes. Scopes: devs + `TOKEN_PM` carry `write:repository` (`@pm` is the only agent that merges, autopilot only); `TOKEN_QA` is `read:repository` + `write:issue` (reviews, never merges). |
 | `TOKEN_OPS` | `@ops` only — the admin PAT behind the `gitea-admin` skill (create orgs/users/repos, manage labels & secrets, mint scoped tokens). Injected into the agent process only when the agent is `@ops`. |