@demicodes/provider-grok-build 0.10.2 → 0.10.3

package/README.md

@@ -5,28 +5,8 @@ stored by the official Grok CLI in `~/.grok/auth.json` (subscription login).
 
 ```ts
 import { createGrokBuildProvider } from '@demicodes/provider-grok-build'
-
-const provider = createGrokBuildProvider()
-// provider.auth, provider.quota, provider.credentials (multi-account pool by default)
 ```
 
-## Auth and credentials
-
-- Default material: `~/.grok/auth.json` (or `$GROK_HOME`); multi-entry map supported.
-- Multi-credential pool under `$DEMI_HOME/credentials/grok-build/`; `importDefault`
-  can snapshot each OIDC entry as its own pool credential.
-- Lifecycle: `beginLogin` → `grok login` → `importDefault` → `setActive`.
-
-Requires a prior login (or `beginLogin`) so vendor material exists before import.
-See [docs/provider-global-credentials.md](../../docs/provider-global-credentials.md).
-
-## Quota
-
-- **probe** (cost: `free`): `/v1/billing` + `/v1/user?include=subscription` on
-  cli-chat-proxy.
-- **observe**: short-window ratelimit headers on chat responses (separate from monthly).
-
-See [docs/provider-quota.md](../../docs/provider-quota.md).
-
-Implements the [`@demicodes/provider`](../provider/README.md) contract. Part of
-[Demi](../../README.md). Apache-2.0.
+Requires a prior `grok login` (or equivalent) so `~/.grok/auth.json` contains an
+OIDC session. Implements the [`@demicodes/provider`](../provider/README.md)
+contract. Part of [Demi](../../README.md). Apache-2.0.

package/dist/index.d.mts

@@ -1,20 +1,6 @@
-import { Provider, ProviderAuthState, ProviderCredentials, ProviderModelList, ProviderQuota, ProviderQuotaProbeResult } from "@demicodes/provider";
-import { FileCredentialPool } from "@demicodes/provider/credentials-pool";
+import { Provider, ProviderAuthState, ProviderModelList, ProviderQuota, ProviderQuotaProbeResult } from "@demicodes/provider";
+
 //#region src/auth.d.ts
-/** One credential entry as written by the Grok CLI (`~/.grok/auth.json`). */
-interface GrokAuthEntry {
-  key?: string;
-  auth_mode?: string;
-  refresh_token?: string;
-  expires_at?: string;
-  oidc_issuer?: string;
-  oidc_client_id?: string;
-  email?: string;
-  first_name?: string;
-  user_id?: string;
-  team_id?: string;
-  [key: string]: unknown;
-}
 interface GrokResolvedAuth {
   accessToken: string;
   refreshToken: string | null;
@@ -33,13 +19,6 @@ interface GrokAuthStore {
 }
 interface FileGrokAuthStoreOptions {
   grokHome?: string;
-  /** Override auth.json path (e.g. demi credential pool entry). */
-  authFile?: string;
-  /**
-   * Prefer this map key when the auth file has multiple OIDC entries.
-   * When unset, uses {@link selectAuthEntry} scoring.
-   */
-  entryKey?: string;
   refresh?: GrokTokenRefresh;
   now?: () => Date;
   lockRetryDelayMs?: number;
@@ -69,10 +48,6 @@ interface GrokBuildProviderOptions {
   authStore?: GrokAuthStore;
   headers?: Record<string, string>;
   fetch?: GrokBuildFetch;
-  /** Demi state root for credential pool (`$DEMI_HOME` / `~/.demi`). */
-  stateDir?: string;
-  /** When true (default if `authStore` unset), attach multi-credential pool. */
-  credentials?: boolean;
 }
 declare function createGrokBuildProvider(options?: GrokBuildProviderOptions): Provider;
 declare function parseGrokBuildProviderConfig(config: unknown): Pick<GrokBuildProviderOptions, 'grokHome' | 'baseUrl' | 'headers'>;
@@ -111,51 +86,4 @@ declare function mapGrokQuotaProbe(user: unknown, billing: unknown, auth?: Pick<
 /** Short-window chat ratelimits — not subscription monthly quota. */
 declare function observeGrokRateLimitHeaders(headers: Headers | undefined): ProviderQuotaProbeResult | null;
 //#endregion
-//#region src/credentials.d.ts
-declare class PoolAwareGrokAuthStore implements GrokAuthStore {
-  private readonly pool;
-  private readonly vendorHome;
-  private readonly fileAuthOptions;
-  constructor(pool: FileCredentialPool, options?: {
-    grokHome?: string;
-    fileAuthOptions?: Omit<FileGrokAuthStoreOptions, 'grokHome' | 'authFile' | 'entryKey'>;
-  });
-  status(): Promise<import("@demicodes/provider").ProviderAuthState>;
-  resolveAuth(options?: {
-    forceRefresh?: boolean;
-  }): Promise<GrokResolvedAuth>;
-  private currentStore;
-}
-declare function openGrokCredentialPool(options?: {
-  stateDir?: string;
-}): FileCredentialPool;
-declare function createGrokBuildCredentials(pool: FileCredentialPool, authStore: GrokAuthStore, options?: {
-  grokHome?: string;
-  quota?: ProviderQuota | null;
-  /** Injectable fetch for the device-code login flow (tests). */
-  loginFetch?: typeof fetch;
-}): ProviderCredentials;
-//#endregion
-//#region src/device-login.d.ts
-interface GrokDeviceLoginPending {
-  verificationUrl: string;
-  userCode: string;
-  expiresAt: string;
-}
-interface GrokDeviceLoginOptions {
-  signal?: AbortSignal;
-  /** Fires once with the URL + one-time code the user needs. */
-  onPending?: (pending: GrokDeviceLoginPending) => void;
-  fetch?: typeof fetch;
-  issuer?: string;
-  clientId?: string;
-  scope?: string;
-}
-interface GrokDeviceLoginResult {
-  entryKey: string;
-  entry: GrokAuthEntry;
-}
-/** Runs the full device flow and returns a vendor-shaped auth.json entry keyed like the Grok CLI. */
-declare function runGrokDeviceLogin(options?: GrokDeviceLoginOptions): Promise<GrokDeviceLoginResult>;
-//#endregion
-export { type GrokBuildFetch, type GrokBuildProviderOptions, type GrokBuildQuotaOptions, type GrokDeviceLoginOptions, type GrokDeviceLoginPending, type GrokDeviceLoginResult, PoolAwareGrokAuthStore, createGrokBuildCredentials, createGrokBuildProvider, createGrokBuildQuota, grokBuildAuthStatus, grokBuildFallbackModels, listGrokBuildModels, mapGrokQuotaProbe, observeGrokRateLimitHeaders, openGrokCredentialPool, parseGrokBuildProviderConfig, runGrokDeviceLogin };
+export { type GrokBuildFetch, type GrokBuildProviderOptions, type GrokBuildQuotaOptions, createGrokBuildProvider, createGrokBuildQuota, grokBuildAuthStatus, grokBuildFallbackModels, listGrokBuildModels, mapGrokQuotaProbe, observeGrokRateLimitHeaders, parseGrokBuildProviderConfig };

package/dist/index.mjs

@@ -1,19 +1,13 @@
-import { delay, errorCode, errorMessage, isAbortError, isRecord, nonEmptyString, normalizeBaseUrl, numberOrNull, numberOrZero, parseJsonObject, parseJsonOrString, stringOrNull } from "@demicodes/utils";
-import { createProviderQuota, defineProvider, httpRequestFailedEvent, normalizeErrorCode, numberHeader, providerErrorFromUnknown, redactCredentialText, severityFromUsedPercent, toolResultContentToText, usedPercentFromRatio } from "@demicodes/provider";
+import { delay, errorMessage, isAbortError, isRecord, nonEmptyString, normalizeBaseUrl, numberOrNull, numberOrZero, parseJsonObject, parseJsonOrString, stringOrNull } from "@demicodes/utils";
+import { createProviderQuota, defineProvider, httpRequestFailedEvent, normalizeErrorCode, providerErrorFromUnknown, severityFromUsedPercent, usedPercentFromRatio } from "@demicodes/provider";
 import { Buffer } from "node:buffer";
 import { chmod, mkdir, open, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import process from "node:process";
 import { zeroUsage } from "@demicodes/core";
-import { FileCredentialPool, credentialIdFromIdentity } from "@demicodes/provider/credentials-pool";
 import { readFileSync } from "node:fs";
 //#region src/auth.ts
-/** Grok auth.json stores the access token under `key`; redact it alongside the standard fields. */
-const SECRET_FIELD_PATTERNS = ["\\bkey\\b"];
-function redactGrokSecretText(text) {
-	return redactCredentialText(text, SECRET_FIELD_PATTERNS);
-}
 const DEFAULT_TOKEN_ENDPOINT = "https://auth.x.ai/oauth2/token";
 const REFRESH_EXPIRY_SKEW_MS = 300 * 1e3;
 async function grokBuildAuthStatus(options = {}) {
@@ -22,19 +16,17 @@ async function grokBuildAuthStatus(options = {}) {
 var FileGrokAuthStore = class {
 	grokHome;
 	authFile;
-	entryKey;
 	refreshImpl;
 	now;
 	lockRetryDelayMs;
 	lockTimeoutMs;
 	constructor(options = {}) {
 		this.grokHome = options.grokHome ?? defaultGrokHome();
-		this.authFile = options.authFile ?? join(this.grokHome, "auth.json");
-		this.entryKey = nonEmptyString(options.entryKey) ?? null;
+		this.authFile = join(this.grokHome, "auth.json");
 		this.refreshImpl = options.refresh ?? refreshGrokOidcToken;
 		this.now = options.now ?? (() => /* @__PURE__ */ new Date());
 		this.lockRetryDelayMs = options.lockRetryDelayMs ?? 25;
-		this.lockTimeoutMs = options.lockTimeoutMs ?? 3e4;
+		this.lockTimeoutMs = options.lockTimeoutMs ?? 5e3;
 	}
 	async status() {
 		try {
@@ -50,14 +42,14 @@ var FileGrokAuthStore = class {
 			};
 			return {
 				status: "error",
-				message: redactGrokSecretText(error instanceof Error ? error.message : String(error))
+				message: redactSecretText(error instanceof Error ? error.message : String(error))
 			};
 		}
 	}
 	async resolveAuth(options = {}) {
 		const file = await this.readAuthFile();
-		const selected = this.entryKey ? selectAuthEntryByKey(file, this.entryKey) : selectAuthEntry(file);
-		if (!selected) throw new GrokAuthError("auth_missing", this.entryKey ? `No Grok OAuth entry "${this.entryKey}" in ${this.authFile}` : `No Grok OAuth session found in ${this.authFile}. Run \`grok login\` first.`);
+		const selected = selectAuthEntry(file);
+		if (!selected) throw new GrokAuthError("auth_missing", `No Grok OAuth session found in ${this.authFile}. Run \`grok login\` first.`);
 		const { entryKey, entry } = selected;
 		const accessToken = nonEmptyString(entry.key);
 		if (!accessToken) throw new GrokAuthError("auth_missing", `Grok auth entry "${entryKey}" has no access token (key)`);
@@ -65,7 +57,7 @@ var FileGrokAuthStore = class {
 		const clientId = nonEmptyString(entry.oidc_client_id) ?? parseClientIdFromEntryKey(entryKey);
 		const issuer = nonEmptyString(entry.oidc_issuer) ?? parseIssuerFromEntryKey(entryKey);
 		const expiresAt = parseExpiresAt(entry.expires_at) ?? parseJwtExpiration(accessToken);
-		if ((options.forceRefresh === true || expiresWithin(expiresAt, this.now(), REFRESH_EXPIRY_SKEW_MS)) && refreshToken && clientId) return this.refreshAndResolve(accessToken, entryKey, {
+		if ((options.forceRefresh === true || expiresWithin(expiresAt, this.now(), REFRESH_EXPIRY_SKEW_MS)) && refreshToken && clientId) return this.refreshAndResolve(file, entryKey, {
 			refreshToken,
 			clientId,
 			tokenEndpoint: tokenEndpointForIssuer(issuer)
@@ -81,7 +73,7 @@ var FileGrokAuthStore = class {
 			authFile: this.authFile
 		};
 	}
-	async refreshAndResolve(staleAccessToken, entryKey, refreshInput) {
+	async refreshAndResolve(_file, entryKey, refreshInput) {
 		return this.withAuthFileLock(async () => {
 			const latest = await this.readAuthFile();
 			const latestEntry = latest[entryKey];
@@ -89,20 +81,6 @@ var FileGrokAuthStore = class {
 			const refreshToken = nonEmptyString(latestEntry.refresh_token) ?? refreshInput.refreshToken;
 			const clientId = nonEmptyString(latestEntry.oidc_client_id) ?? refreshInput.clientId;
 			const issuer = nonEmptyString(latestEntry.oidc_issuer) ?? parseIssuerFromEntryKey(entryKey);
-			const latestAccessToken = nonEmptyString(latestEntry.key);
-			if (latestAccessToken && latestAccessToken !== staleAccessToken) {
-				const latestExpiresAt = parseExpiresAt(latestEntry.expires_at) ?? parseJwtExpiration(latestAccessToken);
-				if (!expiresWithin(latestExpiresAt, this.now(), REFRESH_EXPIRY_SKEW_MS)) return {
-					accessToken: latestAccessToken,
-					refreshToken: nonEmptyString(latestEntry.refresh_token) ?? null,
-					expiresAt: latestExpiresAt,
-					email: stringOrNull(latestEntry.email),
-					issuer,
-					clientId,
-					entryKey,
-					authFile: this.authFile
-				};
-			}
 			const response = await this.refreshImpl({
 				refreshToken,
 				clientId,
@@ -141,8 +119,8 @@ var FileGrokAuthStore = class {
 			return parsed;
 		} catch (error) {
 			if (error instanceof GrokAuthError) throw error;
-			if (errorCode(error) === "ENOENT") throw new GrokAuthError("auth_missing", `Grok auth file not found: ${this.authFile}. Run \`grok login\` first.`);
-			throw new GrokAuthError("auth_invalid", `Failed to read Grok auth file ${this.authFile}: ${redactGrokSecretText(errorMessage(error))}`);
+			if (isNodeError(error) && error.code === "ENOENT") throw new GrokAuthError("auth_missing", `Grok auth file not found: ${this.authFile}. Run \`grok login\` first.`);
+			throw new GrokAuthError("auth_invalid", `Failed to read Grok auth file ${this.authFile}: ${redactSecretText(errorMessage(error))}`);
 		}
 	}
 	async withAuthFileLock(fn) {
@@ -154,10 +132,10 @@ var FileGrokAuthStore = class {
 		while (!handle) try {
 			handle = await open(lockFile, "wx", 384);
 		} catch (error) {
-			if (errorCode(error) !== "EEXIST") throw new GrokAuthError("auth_lock_failed", `Failed to lock Grok auth file: ${redactGrokSecretText(errorMessage(error))}`);
-			const staleIdentity = brokeStaleLock ? null : await fileIdentity(lockFile);
-			if (staleIdentity && await isAbandonedGrokAuthLock(lockFile, this.now())) {
-				if (await removeLockFileIfSame(lockFile, staleIdentity)) brokeStaleLock = true;
+			if (!isNodeError(error) || error.code !== "EEXIST") throw new GrokAuthError("auth_lock_failed", `Failed to lock Grok auth file: ${redactSecretText(errorMessage(error))}`);
+			if (!brokeStaleLock && await isAbandonedGrokAuthLock(lockFile, this.now())) {
+				await rm(lockFile, { force: true }).catch(() => void 0);
+				brokeStaleLock = true;
 				continue;
 			}
 			if (Date.now() - started > this.lockTimeoutMs) throw new GrokAuthError("auth_lock_failed", `Timed out waiting for Grok auth lock ${lockFile}. If no other Grok process is running, delete the lock file and retry.`);
@@ -167,9 +145,8 @@ var FileGrokAuthStore = class {
 			await writeFile(lockFile, `${process.pid}:${Math.floor(this.now().getTime() / 1e3)}`, { mode: 384 });
 			return await fn();
 		} finally {
-			const ownedIdentity = await handle.stat().then(toFileIdentity).catch(() => null);
 			await handle.close().catch(() => void 0);
-			if (ownedIdentity) await removeLockFileIfSame(lockFile, ownedIdentity);
+			await rm(lockFile, { force: true }).catch(() => void 0);
 		}
 	}
 };
@@ -204,16 +181,6 @@ function selectAuthEntry(file) {
 	candidates.sort((a, b) => b.score - a.score || a.entryKey.localeCompare(b.entryKey));
 	return candidates[0] ?? null;
 }
-function selectAuthEntryByKey(file, entryKey) {
-	const value = file[entryKey];
-	if (!isRecord(value)) return null;
-	const entry = value;
-	if (!nonEmptyString(entry.key)) return null;
-	return {
-		entryKey,
-		entry
-	};
-}
 async function refreshGrokOidcToken(input, signal) {
 	const body = new URLSearchParams({
 		grant_type: "refresh_token",
@@ -232,6 +199,9 @@ async function refreshGrokOidcToken(input, signal) {
 	if (!response.ok) throw new GrokAuthError("auth_refresh_failed", `Grok token refresh failed with HTTP ${response.status}`);
 	return await response.json();
 }
+function redactSecretText(text) {
+	return text.replace(/Bearer\s+[A-Za-z0-9._~+/=-]+/g, "Bearer [REDACTED]").replace(/(access_token|refresh_token|id_token|\bkey\b)["'=:\s]+[A-Za-z0-9._~+/=-]+/gi, "$1=[REDACTED]");
+}
 function parseJwtExpiration(jwt) {
 	const exp = decodeJwtPayload(jwt)?.exp;
 	return typeof exp === "number" ? /* @__PURE__ */ new Date(exp * 1e3) : null;
@@ -277,7 +247,10 @@ function decodeJwtPayload(jwt) {
 		return null;
 	}
 }
-/** Grok CLI lock format is `pid:unix_seconds`. A valid live PID always owns its lock. */
+function isNodeError(error) {
+	return error instanceof Error && "code" in error;
+}
+/** Grok CLI lock format is `pid:unix_seconds`. Steal only when the owner is dead or very stale. */
 async function isAbandonedGrokAuthLock(lockFile, now, maxAgeMs = 3e4) {
 	try {
 		const raw = (await readFile(lockFile, "utf8")).trim();
@@ -285,7 +258,7 @@ async function isAbandonedGrokAuthLock(lockFile, now, maxAgeMs = 3e4) {
 		if (match) {
 			const pid = Number(match[1]);
 			const tsSec = Number(match[2]);
-			if (Number.isFinite(pid) && pid > 0) return !isProcessAlive(pid);
+			if (Number.isFinite(pid) && pid > 0 && !isProcessAlive(pid)) return true;
 			if (Number.isFinite(tsSec) && now.getTime() - tsSec * 1e3 > maxAgeMs) return true;
 			return false;
 		}
@@ -295,26 +268,12 @@ async function isAbandonedGrokAuthLock(lockFile, now, maxAgeMs = 3e4) {
 		return true;
 	}
 }
-function toFileIdentity(info) {
-	return {
-		dev: info.dev,
-		ino: info.ino
-	};
-}
-async function fileIdentity(path) {
-	return stat(path).then(toFileIdentity).catch(() => null);
-}
-async function removeLockFileIfSame(lockFile, expected) {
-	const current = await fileIdentity(lockFile);
-	if (!current || current.dev !== expected.dev || current.ino !== expected.ino) return false;
-	return rm(lockFile).then(() => true).catch(() => false);
-}
 function isProcessAlive(pid) {
 	try {
 		process.kill(pid, 0);
 		return true;
 	} catch (error) {
-		if (errorCode(error) === "EPERM") return true;
+		if (isNodeError(error) && error.code === "EPERM") return true;
 		return false;
 	}
 }
@@ -344,52 +303,53 @@ async function* mapGrokChatCompletionStream(events, signal) {
 			yield { type: "abort" };
 			return;
 		}
-		const data = event.data;
-		if (data === "[DONE]") {
-			yield* flushToolCalls(toolCalls);
-			yield {
-				type: "response",
-				usage
-			};
-			return;
-		}
-		const chunk = parseJsonObject(data);
-		if (!chunk) continue;
-		const error = isRecord(chunk.error) ? chunk.error : null;
-		if (error) {
-			const message = stringOrNull(error.message) ?? "Grok Build stream error";
-			yield {
-				type: "error",
-				message,
-				code: normalizeErrorCode(stringOrNull(error.code) ?? stringOrNull(error.type), message)
-			};
-			return;
-		}
-		if (isRecord(chunk.usage)) usage = grokUsage(chunk.usage);
-		const choices = Array.isArray(chunk.choices) ? chunk.choices : [];
-		for (const choice of choices) {
-			if (!isRecord(choice)) continue;
-			const delta = isRecord(choice.delta) ? choice.delta : null;
-			if (delta) {
-				const reasoning = stringOrNull(delta.reasoning_content);
-				if (reasoning) {
-					if (!thinkingStarted) {
-						thinkingStarted = true;
-						yield { type: "thinking_start" };
+		for (const data of event.data) {
+			if (data === "[DONE]") {
+				yield* flushToolCalls(toolCalls);
+				yield {
+					type: "response",
+					usage
+				};
+				return;
+			}
+			const chunk = parseJsonObject(data);
+			if (!chunk) continue;
+			const error = isRecord(chunk.error) ? chunk.error : null;
+			if (error) {
+				const message = stringOrNull(error.message) ?? "Grok Build stream error";
+				yield {
+					type: "error",
+					message,
+					code: normalizeErrorCode(stringOrNull(error.code) ?? stringOrNull(error.type), message)
+				};
+				return;
+			}
+			if (isRecord(chunk.usage)) usage = grokUsage(chunk.usage);
+			const choices = Array.isArray(chunk.choices) ? chunk.choices : [];
+			for (const choice of choices) {
+				if (!isRecord(choice)) continue;
+				const delta = isRecord(choice.delta) ? choice.delta : null;
+				if (delta) {
+					const reasoning = stringOrNull(delta.reasoning_content);
+					if (reasoning) {
+						if (!thinkingStarted) {
+							thinkingStarted = true;
+							yield { type: "thinking_start" };
+						}
+						yield {
+							type: "thinking_delta",
+							text: reasoning
+						};
 					}
-					yield {
-						type: "thinking_delta",
-						text: reasoning
+					const content = stringOrNull(delta.content);
+					if (content) yield {
+						type: "text_delta",
+						text: content
 					};
+					if (Array.isArray(delta.tool_calls)) collectToolCalls(delta.tool_calls, toolCalls);
 				}
-				const content = stringOrNull(delta.content);
-				if (content) yield {
-					type: "text_delta",
-					text: content
-				};
-				if (Array.isArray(delta.tool_calls)) collectToolCalls(delta.tool_calls, toolCalls);
+				if (choice.finish_reason === "tool_calls") yield* flushToolCalls(toolCalls);
 			}
-			if (choice.finish_reason === "tool_calls") yield* flushToolCalls(toolCalls);
 		}
 	}
 	yield* flushToolCalls(toolCalls);
@@ -404,15 +364,15 @@ async function* readServerSentEvents(body, signal) {
 	const decoder = new TextDecoder();
 	let buffer = "";
 	let eventName = null;
-	let dataLines = [];
+	let data = [];
 	const flush = function* () {
-		if (dataLines.length === 0) return;
+		if (data.length === 0) return;
 		yield {
 			event: eventName,
-			data: dataLines.join("\n")
+			data
 		};
 		eventName = null;
-		dataLines = [];
+		data = [];
 	};
 	try {
 		while (true) {
@@ -427,14 +387,14 @@ async function* readServerSentEvents(body, signal) {
 				const line = raw.endsWith("\r") ? raw.slice(0, -1) : raw;
 				if (line === "") yield* flush();
 				else if (line.startsWith("event:")) eventName = line.slice(6).trim();
-				else if (line.startsWith("data:")) dataLines.push(line.slice(5).trimStart());
+				else if (line.startsWith("data:")) data.push(line.slice(5).trimStart());
 				newline = buffer.indexOf("\n");
 			}
 		}
 		buffer += decoder.decode();
 		if (buffer) {
 			const line = buffer.endsWith("\r") ? buffer.slice(0, -1) : buffer;
-			if (line.startsWith("data:")) dataLines.push(line.slice(5).trimStart());
+			if (line.startsWith("data:")) data.push(line.slice(5).trimStart());
 			else if (line.startsWith("event:")) eventName = line.slice(6).trim();
 		}
 		yield* flush();
@@ -516,10 +476,6 @@ function userContentToParts(content) {
 		type: "text",
 		text: `[document:${block.source.fileName} ${block.source.mediaType}]`
 	});
-	else if (block.type === "video") parts.push({
-		type: "text",
-		text: `[video:${block.source.type === "url" ? block.source.url : block.source.mediaType}]`
-	});
 	else if (block.source.type === "url") parts.push({
 		type: "image_url",
 		image_url: {
@@ -537,6 +493,9 @@ function userContentToParts(content) {
 	if (parts.every((part) => part.type === "text")) return parts.map((part) => part.text).join("\n");
 	return parts;
 }
+function toolResultContentToText(output) {
+	return output.map((block) => block.type === "text" ? block.text : `[image:${block.source.mediaType}]`).join("\n");
+}
 function toolToGrokTool(tool) {
 	return {
 		type: "function",
@@ -598,280 +557,6 @@ function grokUsage(usage) {
 		cacheWriteTokens: 0
 	};
 }
-//#endregion
-//#region src/device-login.ts
-const GROK_ISSUER = "https://auth.x.ai";
-const GROK_CLI_CLIENT_ID = "b1a00492-073a-47ea-816f-4c329264a828";
-const GROK_LOGIN_SCOPE = "openid profile email offline_access grok-cli:access";
-const GROK_LOGIN_FALLBACK_INTERVAL_S = 5;
-const GROK_LOGIN_FALLBACK_EXPIRES_S = 900;
-async function postForm(fetchImpl, url, params, signal) {
-	return fetchImpl(url, {
-		method: "POST",
-		headers: { "content-type": "application/x-www-form-urlencoded" },
-		body: new URLSearchParams(params).toString(),
-		signal
-	});
-}
-async function jsonBody(response, what) {
-	const body = await response.json().catch(() => null);
-	if (!isRecord(body)) throw new GrokAuthError("auth_invalid", `${what} response is not a JSON object`);
-	return body;
-}
-async function requestDeviceCode(fetchImpl, issuer, clientId, scope, signal) {
-	const response = await postForm(fetchImpl, `${issuer}/oauth2/device/code`, {
-		client_id: clientId,
-		scope
-	}, signal);
-	if (!response.ok) throw new GrokAuthError("auth_invalid", `Grok device code request failed with HTTP ${response.status}`);
-	const body = await jsonBody(response, "Grok device code");
-	const deviceCode = nonEmptyString(body.device_code);
-	const userCode = nonEmptyString(body.user_code);
-	const verificationUrl = nonEmptyString(body.verification_uri_complete) ?? nonEmptyString(body.verification_uri);
-	if (!deviceCode || !userCode || !verificationUrl) throw new GrokAuthError("auth_invalid", "Grok device code response is missing device_code, user_code, or verification_uri");
-	const interval = Number(body.interval);
-	const expiresIn = Number(body.expires_in);
-	return {
-		deviceCode,
-		userCode,
-		verificationUrl,
-		intervalSeconds: Number.isFinite(interval) && interval >= 0 ? interval : GROK_LOGIN_FALLBACK_INTERVAL_S,
-		expiresAt: Date.now() + (Number.isFinite(expiresIn) && expiresIn > 0 ? expiresIn : GROK_LOGIN_FALLBACK_EXPIRES_S) * 1e3
-	};
-}
-async function pollForTokens(fetchImpl, issuer, clientId, device, signal) {
-	let intervalSeconds = device.intervalSeconds;
-	for (;;) {
-		signal?.throwIfAborted();
-		const response = await postForm(fetchImpl, `${issuer}/oauth2/token`, {
-			grant_type: "urn:ietf:params:oauth:grant-type:device_code",
-			device_code: device.deviceCode,
-			client_id: clientId
-		}, signal);
-		const body = await jsonBody(response, "Grok device token");
-		if (response.ok) {
-			const accessToken = nonEmptyString(body.access_token);
-			if (!accessToken) throw new GrokAuthError("auth_invalid", "Grok token response is missing access_token");
-			const expiresIn = Number(body.expires_in);
-			return {
-				accessToken,
-				refreshToken: nonEmptyString(body.refresh_token) ?? null,
-				expiresIn: Number.isFinite(expiresIn) && expiresIn > 0 ? expiresIn : null
-			};
-		}
-		const error = nonEmptyString(body.error);
-		if (error === "slow_down") intervalSeconds += 5;
-		else if (error !== "authorization_pending") throw new GrokAuthError("auth_invalid", `Grok device login failed: ${error ?? `HTTP ${response.status}`}`);
-		if (Date.now() >= device.expiresAt) throw new GrokAuthError("auth_invalid", "Grok device login timed out before the user confirmed");
-		await delay(intervalSeconds * 1e3);
-	}
-}
-async function fetchUserinfo(fetchImpl, issuer, accessToken, signal) {
-	const response = await fetchImpl(`${issuer}/oauth2/userinfo`, {
-		headers: { authorization: `Bearer ${accessToken}` },
-		signal
-	});
-	if (!response.ok) return {};
-	const body = await response.json().catch(() => null);
-	return isRecord(body) ? body : {};
-}
-/** Runs the full device flow and returns a vendor-shaped auth.json entry keyed like the Grok CLI. */
-async function runGrokDeviceLogin(options = {}) {
-	const fetchImpl = options.fetch ?? fetch;
-	const issuer = (options.issuer ?? GROK_ISSUER).replace(/\/+$/, "");
-	const clientId = options.clientId ?? GROK_CLI_CLIENT_ID;
-	const device = await requestDeviceCode(fetchImpl, issuer, clientId, options.scope ?? GROK_LOGIN_SCOPE, options.signal);
-	options.onPending?.({
-		verificationUrl: device.verificationUrl,
-		userCode: device.userCode,
-		expiresAt: new Date(device.expiresAt).toISOString()
-	});
-	const tokens = await pollForTokens(fetchImpl, issuer, clientId, device, options.signal);
-	const userinfo = await fetchUserinfo(fetchImpl, issuer, tokens.accessToken, options.signal);
-	const entry = {
-		key: tokens.accessToken,
-		auth_mode: "oidc",
-		...tokens.refreshToken ? { refresh_token: tokens.refreshToken } : {},
-		...tokens.expiresIn ? { expires_at: new Date(Date.now() + tokens.expiresIn * 1e3).toISOString() } : {},
-		oidc_issuer: issuer,
-		oidc_client_id: clientId,
-		...nonEmptyString(userinfo.email) ? { email: nonEmptyString(userinfo.email) } : {},
-		...nonEmptyString(userinfo.given_name) ? { first_name: nonEmptyString(userinfo.given_name) } : {},
-		...nonEmptyString(userinfo.sub) ? { user_id: nonEmptyString(userinfo.sub) } : {}
-	};
-	return {
-		entryKey: `${issuer}::${clientId}`,
-		entry
-	};
-}
-//#endregion
-//#region src/credentials.ts
-var PoolAwareGrokAuthStore = class {
-	pool;
-	vendorHome;
-	fileAuthOptions;
-	constructor(pool, options = {}) {
-		this.pool = pool;
-		this.vendorHome = options.grokHome ?? defaultGrokHome();
-		this.fileAuthOptions = options.fileAuthOptions ?? {};
-	}
-	async status() {
-		return this.currentStore().then((s) => s.status());
-	}
-	async resolveAuth(options) {
-		return this.currentStore().then((s) => s.resolveAuth(options));
-	}
-	async currentStore() {
-		await this.pool.ensureActivePointer();
-		const activeId = await this.pool.getActiveId();
-		if (activeId) {
-			const entryKey = (await this.pool.readMeta(activeId))?.identityKey ?? void 0;
-			return new FileGrokAuthStore({
-				...this.fileAuthOptions,
-				authFile: this.pool.secretPath(activeId),
-				grokHome: this.pool.entryDir(activeId),
-				entryKey
-			});
-		}
-		return new FileGrokAuthStore({
-			...this.fileAuthOptions,
-			grokHome: this.vendorHome
-		});
-	}
-};
-function openGrokCredentialPool(options = {}) {
-	return new FileCredentialPool({
-		stateDir: options.stateDir,
-		providerKey: "grok-build",
-		secretFileName: "auth.json"
-	});
-}
-function createGrokBuildCredentials(pool, authStore, options = {}) {
-	const vendorHome = options.grokHome ?? defaultGrokHome();
-	const capability = () => ({
-		mode: "supported",
-		canBeginLogin: true,
-		canImportDefault: true,
-		canAdd: true,
-		multi: true
-	});
-	const getActive = async () => {
-		await pool.ensureActivePointer();
-		return {
-			credentialId: await pool.getActiveId(),
-			status: await authStore.status()
-		};
-	};
-	const setActive = async (credentialId) => {
-		await pool.setActiveId(credentialId);
-		options.quota?.clearLatest?.();
-		return getActive();
-	};
-	const importEntry = async (entryKey, entry, source) => {
-		const label = nonEmptyString(entry.email) ?? entryKey;
-		const identityKey = entryKey;
-		const id = (await pool.findByIdentityKey(identityKey))?.id ?? credentialIdFromIdentity(identityKey, label);
-		const file = { [entryKey]: entry };
-		const meta = {
-			id,
-			label,
-			detail: nonEmptyString(entry.auth_mode) ?? "oidc",
-			updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-			source,
-			identityKey
-		};
-		await pool.writeEntry(meta, `${JSON.stringify(file, null, 2)}\n`);
-		if (!await pool.getActiveId()) await pool.setActiveId(id);
-		options.quota?.clearLatest?.();
-		return {
-			id: meta.id,
-			label: meta.label,
-			detail: meta.detail,
-			updatedAt: meta.updatedAt
-		};
-	};
-	const importFromAuthJsonText = async (text, source) => {
-		let file;
-		try {
-			file = JSON.parse(text);
-		} catch {
-			throw new GrokAuthError("auth_invalid", "Grok auth material is not valid JSON");
-		}
-		if (!isRecord(file)) throw new GrokAuthError("auth_invalid", "Grok auth material is not an object");
-		const imported = [];
-		for (const [entryKey, value] of Object.entries(file)) {
-			if (!isRecord(value)) continue;
-			const entry = value;
-			if (!nonEmptyString(entry.key)) continue;
-			imported.push(await importEntry(entryKey, entry, source));
-		}
-		if (imported.length === 0) throw new GrokAuthError("auth_missing", "No Grok OAuth entries with access tokens found to import");
-		return imported;
-	};
-	return {
-		capability,
-		list: () => pool.list(),
-		getActive,
-		setActive,
-		beginLogin: async (loginOptions) => {
-			try {
-				const { entryKey, entry } = await runGrokDeviceLogin({
-					signal: loginOptions?.signal,
-					onPending: loginOptions?.onPending,
-					fetch: options.loginFetch
-				});
-				return {
-					status: "completed",
-					credentialId: (await importEntry(entryKey, entry, "login:device")).id
-				};
-			} catch (error) {
-				if (loginOptions?.signal?.aborted) return { status: "cancelled" };
-				return {
-					status: "failed",
-					message: errorMessage(error)
-				};
-			}
-		},
-		importDefault: async () => {
-			const authFile = join(vendorHome, "auth.json");
-			let text;
-			try {
-				text = await readFile(authFile, "utf8");
-			} catch {
-				throw new GrokAuthError("auth_missing", `No Grok auth at ${authFile}. Run grok login or beginLogin first.`);
-			}
-			const all = await importFromAuthJsonText(text, `vendor:${authFile}`);
-			const preferred = selectAuthEntry(JSON.parse(text));
-			if (preferred) {
-				const byKey = (await pool.listMeta()).find((m) => m.identityKey === preferred.entryKey);
-				if (byKey) {
-					await pool.setActiveId(byKey.id);
-					options.quota?.clearLatest?.();
-					return {
-						id: byKey.id,
-						label: byKey.label,
-						detail: byKey.detail,
-						updatedAt: byKey.updatedAt
-					};
-				}
-			}
-			return all[0];
-		},
-		add: async (input) => {
-			if (typeof input.authJsonText === "string") return (await importFromAuthJsonText(input.authJsonText, "add:authJsonText"))[0];
-			if (typeof input.authFile === "string") {
-				const text = await readFile(input.authFile, "utf8");
-				return (await importFromAuthJsonText(text, `add:authFile:${input.authFile}`))[0];
-			}
-			if (typeof input.entryKey === "string" && isRecord(input.entry)) return importEntry(input.entryKey, input.entry, "add:entry");
-			throw new Error("Grok credentials.add expects authJsonText, authFile, or { entryKey, entry }");
-		},
-		remove: async (credentialId) => {
-			await pool.remove(credentialId);
-			options.quota?.clearLatest?.();
-		}
-	};
-}
 const GROK_CLI_TOKEN_AUTH = "xai-grok-cli";
 const GROK_CLIENT_SURFACE = "grok-build";
 function buildGrokBuildHeaders(auth, request, options) {
@@ -1173,6 +858,12 @@ function moneyVal(value) {
 	if (isRecord(value) && typeof value.val === "number" && Number.isFinite(value.val)) return value.val;
 	return null;
 }
+function numberHeader(headers, name) {
+	const raw = headers.get(name);
+	if (raw == null || raw === "") return null;
+	const n = Number(raw);
+	return Number.isFinite(n) ? n : null;
+}
 //#endregion
 //#region src/provider.ts
 var GrokBuildProvider = class {
@@ -1225,7 +916,6 @@ var GrokBuildProvider = class {
 					});
 				} catch {}
 				if (response.status === 401 && !forceRefresh) {
-					await response.body?.cancel().catch(() => {});
 					forceRefresh = true;
 					continue;
 				}
@@ -1249,9 +939,7 @@ var GrokBuildProvider = class {
 function createGrokBuildProvider(options = {}) {
 	const id = options.id ?? "grok-build";
 	const displayName = options.displayName ?? "Grok Build";
-	const enableCredentials = options.credentials ?? options.authStore === void 0;
-	const pool = !options.authStore && enableCredentials ? openGrokCredentialPool({ stateDir: options.stateDir }) : null;
-	const authStore = options.authStore ?? (pool ? new PoolAwareGrokAuthStore(pool, { grokHome: options.grokHome }) : new FileGrokAuthStore({ grokHome: options.grokHome }));
+	const authStore = options.authStore ?? new FileGrokAuthStore({ grokHome: options.grokHome });
 	const baseUrl = normalizeBaseUrl(options.baseUrl ?? "https://cli-chat-proxy.grok.com/v1");
 	const fetchImpl = options.fetch ?? fetch;
 	const quota = createGrokBuildQuota({
@@ -1262,10 +950,6 @@ function createGrokBuildProvider(options = {}) {
 		authStore,
 		fetch: fetchImpl
 	});
-	const credentialsApi = pool ? createGrokBuildCredentials(pool, authStore, {
-		grokHome: options.grokHome,
-		quota
-	}) : void 0;
 	const runtimeOptions = {
 		baseUrl,
 		grokHome: options.grokHome,
@@ -1280,10 +964,9 @@ function createGrokBuildProvider(options = {}) {
 		displayName,
 		auth: { status: () => authStore.status() },
 		quota,
-		...credentialsApi ? { credentials: credentialsApi } : {},
 		state: () => ({
 			status: "ready",
-			message: credentialsApi ? "Uses Grok CLI OAuth + demi credential pool via cli-chat-proxy" : "Uses Grok CLI OAuth session (~/.grok/auth.json) via cli-chat-proxy"
+			message: "Uses Grok CLI OAuth session (~/.grok/auth.json) via cli-chat-proxy"
 		}),
 		listModels: () => listGrokBuildModels({
 			providerId: id,
@@ -1324,4 +1007,4 @@ function chatCompletionsUrl(baseUrl) {
 	return normalized.endsWith("/chat/completions") ? normalized : `${normalized}/chat/completions`;
 }
 //#endregion
-export { PoolAwareGrokAuthStore, createGrokBuildCredentials, createGrokBuildProvider, createGrokBuildQuota, grokBuildAuthStatus, grokBuildFallbackModels, listGrokBuildModels, mapGrokQuotaProbe, observeGrokRateLimitHeaders, openGrokCredentialPool, parseGrokBuildProviderConfig, runGrokDeviceLogin };
+export { createGrokBuildProvider, createGrokBuildQuota, grokBuildAuthStatus, grokBuildFallbackModels, listGrokBuildModels, mapGrokQuotaProbe, observeGrokRateLimitHeaders, parseGrokBuildProviderConfig };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@demicodes/provider-grok-build",
   "description": "Grok Build provider adapter for Demi (reuses ~/.grok OAuth session).",
-  "version": "0.10.2",
+  "version": "0.10.3",
   "private": false,
   "type": "module",
   "exports": {
@@ -11,9 +11,9 @@
     }
   },
   "dependencies": {
-    "@demicodes/core": "^0.10.2",
-    "@demicodes/provider": "^0.10.2",
-    "@demicodes/utils": "^0.10.2"
+    "@demicodes/core": "^0.10.3",
+    "@demicodes/provider": "^0.10.3",
+    "@demicodes/utils": "^0.10.3"
   },
   "license": "Apache-2.0",
   "main": "./dist/index.mjs",