@kenkaiiii/gg-core 5.36.0 → 5.37.0

package/dist/index.cjs

@@ -41,6 +41,7 @@ __export(index_exports, {
   NotLoggedInError: () => NotLoggedInError,
   SubscriptionUsageError: () => SubscriptionUsageError,
   TelegramBot: () => TelegramBot,
+  XAI_OAUTH_KEY: () => XAI_OAUTH_KEY,
   XIAOMI_CREDITS_KEY: () => XIAOMI_CREDITS_KEY,
   clearLocalDiscoveryCache: () => clearLocalDiscoveryCache,
   clearRuntimeModels: () => clearRuntimeModels,
@@ -49,6 +50,8 @@ __export(index_exports, {
   decodeOggOpus: () => decodeOggOpus,
   discoverLocalModels: () => discoverLocalModels,
   downmixToMono: () => downmixToMono,
+  dualAuthProvider: () => dualAuthProvider,
+  dualAuthProviderByOAuthKey: () => dualAuthProviderByOAuthKey,
   endpointRoot: () => endpointRoot,
   fetchSubscriptionUsage: () => fetchSubscriptionUsage,
   findProbedModel: () => findProbedModel,
@@ -73,6 +76,9 @@ __export(index_exports, {
   getSupportedThinkingLevels: () => getSupportedThinkingLevels,
   getToolResultCharLimit: () => getToolResultCharLimit,
   getVideoByteLimit: () => getVideoByteLimit,
+  grokCliBaseUrl: () => grokCliBaseUrl,
+  grokCliHeaders: () => grokCliHeaders,
+  isGrokCliEndpoint: () => isGrokCliEndpoint,
   isKimiCodingEndpoint: () => isKimiCodingEndpoint,
   isLocalModelId: () => isLocalModelId,
   isLoggerOpen: () => isLoggerOpen,
@@ -86,14 +92,18 @@ __export(index_exports, {
   loginGemini: () => loginGemini,
   loginKimi: () => loginKimi,
   loginOpenAI: () => loginOpenAI,
+  loginXai: () => loginXai,
+  oauthStorageKey: () => oauthStorageKey,
   openLog: () => openLog,
   parseLocalModelId: () => parseLocalModelId,
   probeEndpoint: () => probeEndpoint,
+  providerStorageKeys: () => providerStorageKeys,
   readStoredBaseUrlSync: () => readStoredBaseUrlSync,
   refreshAnthropicToken: () => refreshAnthropicToken,
   refreshGeminiToken: () => refreshGeminiToken,
   refreshKimiToken: () => refreshKimiToken,
   refreshOpenAIToken: () => refreshOpenAIToken,
+  refreshXaiToken: () => refreshXaiToken,
   registerLogCleanup: () => registerLogCleanup,
   registerRuntimeModels: () => registerRuntimeModels,
   resample: () => resample,
@@ -896,13 +906,13 @@ var CodeAssistHttpError = class extends Error {
   }
 };
 async function loginGemini(callbacks) {
-  const { clientId, clientSecret } = getGeminiOAuthClientCredentials();
+  const { clientId: clientId2, clientSecret } = getGeminiOAuthClientCredentials();
   const { verifier, challenge } = await generatePKCE();
   const state = import_node_crypto5.default.randomBytes(32).toString("hex");
   const redirectUri = await getLoopbackRedirectUri();
   const url = new URL(AUTHORIZE_URL3);
   url.searchParams.set("response_type", "code");
-  url.searchParams.set("client_id", clientId);
+  url.searchParams.set("client_id", clientId2);
   url.searchParams.set("redirect_uri", redirectUri);
   url.searchParams.set("scope", SCOPE2);
   url.searchParams.set("access_type", "offline");
@@ -927,7 +937,7 @@ async function loginGemini(callbacks) {
     }
     code = parsed.code;
   }
-  const creds = await exchangeGeminiCode(code, verifier, redirectUri, clientId, clientSecret);
+  const creds = await exchangeGeminiCode(code, verifier, redirectUri, clientId2, clientSecret);
   callbacks.onStatus("Setting up Gemini Code Assist access...");
   const projectId = await setupCodeAssistProject(creds.accessToken, callbacks);
   return {
@@ -936,11 +946,11 @@ async function loginGemini(callbacks) {
   };
 }
 async function refreshGeminiToken(refreshToken) {
-  const { clientId, clientSecret } = getGeminiOAuthClientCredentials();
+  const { clientId: clientId2, clientSecret } = getGeminiOAuthClientCredentials();
   const data = await postTokenRequest2({
     grant_type: "refresh_token",
     refresh_token: refreshToken,
-    client_id: clientId,
+    client_id: clientId2,
     client_secret: clientSecret
   });
   return {
@@ -950,9 +960,9 @@ async function refreshGeminiToken(refreshToken) {
   };
 }
 function getGeminiOAuthClientCredentials() {
-  const clientId = process.env[CLIENT_ID_ENV]?.trim() || DEFAULT_CLIENT_ID;
+  const clientId2 = process.env[CLIENT_ID_ENV]?.trim() || DEFAULT_CLIENT_ID;
   const clientSecret = process.env[CLIENT_SECRET_ENV]?.trim() || DEFAULT_CLIENT_SECRET;
-  return { clientId, clientSecret };
+  return { clientId: clientId2, clientSecret };
 }
 async function getLoopbackRedirectUri() {
   return new Promise((resolve, reject) => {
@@ -1031,10 +1041,10 @@ async function loginWithServer2(authUrl, redirectUri, expectedState, callbacks)
     });
   });
 }
-async function exchangeGeminiCode(code, verifier, redirectUri, clientId, clientSecret) {
+async function exchangeGeminiCode(code, verifier, redirectUri, clientId2, clientSecret) {
   const data = await postTokenRequest2({
     grant_type: "authorization_code",
-    client_id: clientId,
+    client_id: clientId2,
     client_secret: clientSecret,
     code,
     redirect_uri: redirectUri,
@@ -1225,6 +1235,204 @@ function codeAssistHeaders(accessToken) {
   };
 }
 
+// src/oauth/xai.ts
+var DEFAULT_CLIENT_ID2 = "b1a00492-073a-47ea-816f-4c329264a828";
+var DEFAULT_ISSUER = "https://auth.x.ai";
+var DEFAULT_CLI_BASE_URL = "https://cli-chat-proxy.grok.com/v1";
+var OAUTH_SCOPE = "openid profile email offline_access grok-cli:access api:access";
+var DEFAULT_GROK_CLI_VERSION = "0.2.101";
+var DEVICE_TIMEOUT_FALLBACK_MS = 10 * 60 * 1e3;
+var DEFAULT_TOKEN_LIFETIME_SECONDS = 3600;
+function issuer() {
+  return (process.env.XAI_OAUTH_ISSUER ?? DEFAULT_ISSUER).replace(/\/+$/, "");
+}
+function clientId() {
+  return process.env.XAI_OAUTH_CLIENT_ID ?? DEFAULT_CLIENT_ID2;
+}
+function grokCliBaseUrl() {
+  return (process.env.XAI_CLI_BASE_URL ?? DEFAULT_CLI_BASE_URL).replace(/\/+$/, "");
+}
+function grokCliVersion() {
+  const raw = process.env.GROK_CLI_VERSION ?? DEFAULT_GROK_CLI_VERSION;
+  const cleaned = raw.replace(/[^\u0020-\u007E]/g, "").trim();
+  return cleaned.length > 0 ? cleaned : DEFAULT_GROK_CLI_VERSION;
+}
+function grokCliHeaders(modelId) {
+  return {
+    "X-XAI-Token-Auth": "xai-grok-cli",
+    "x-grok-client-version": grokCliVersion(),
+    "x-grok-client-identifier": "ggcoder",
+    ...modelId ? { "x-grok-model-override": modelId } : {}
+  };
+}
+function isGrokCliEndpoint(baseUrl) {
+  if (typeof baseUrl !== "string" || baseUrl.length === 0) return false;
+  const normalized = baseUrl.replace(/\/+$/, "");
+  return normalized === grokCliBaseUrl() || /(^|\.)grok\.com/i.test(normalized);
+}
+async function postForm2(endpoint, params) {
+  const response = await fetch(`${issuer()}${endpoint}`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded",
+      Accept: "application/json",
+      "User-Agent": `grok-cli/${grokCliVersion()}`
+    },
+    body: new URLSearchParams(params).toString()
+  });
+  let data = {};
+  try {
+    const parsed = await response.json();
+    if (parsed && typeof parsed === "object") data = parsed;
+  } catch {
+  }
+  return { status: response.status, data };
+}
+function errorDetail2(data) {
+  const desc = data.error_description ?? data.message ?? data.error;
+  return typeof desc === "string" && desc.length > 0 ? desc : "unknown error";
+}
+function jwtExpirySeconds(token) {
+  const payload = token.split(".")[1];
+  if (!payload) return void 0;
+  try {
+    const json = Buffer.from(payload.replace(/-/g, "+").replace(/_/g, "/"), "base64").toString(
+      "utf-8"
+    );
+    const claims = JSON.parse(json);
+    if (!claims || typeof claims !== "object") return void 0;
+    const exp = claims.exp;
+    return typeof exp === "number" && Number.isFinite(exp) && exp > 0 ? exp : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function credsFromTokenResponse2(data, opts) {
+  const accessToken = data.access_token;
+  const responseRefreshToken = data.refresh_token;
+  if (typeof accessToken !== "string" || accessToken.length === 0) {
+    throw new Error("Grok OAuth response missing access_token.");
+  }
+  const refreshToken = typeof responseRefreshToken === "string" && responseRefreshToken.length > 0 ? responseRefreshToken : opts?.fallbackRefreshToken ?? "";
+  if (refreshToken.length === 0) {
+    throw new Error(
+      "Grok OAuth response missing refresh_token \u2014 the offline_access scope was not granted."
+    );
+  }
+  const responseExpiresIn = Number(data.expires_in);
+  let expiresIn;
+  if (Number.isFinite(responseExpiresIn) && responseExpiresIn > 0) {
+    expiresIn = responseExpiresIn;
+  } else {
+    const exp = jwtExpirySeconds(accessToken);
+    const fromJwt = exp !== void 0 ? exp - Math.floor(Date.now() / 1e3) : 0;
+    expiresIn = fromJwt > 0 ? fromJwt : DEFAULT_TOKEN_LIFETIME_SECONDS;
+  }
+  return {
+    accessToken,
+    refreshToken,
+    expiresAt: Date.now() + expiresIn * 1e3,
+    expiresIn,
+    baseUrl: grokCliBaseUrl()
+  };
+}
+async function requestDeviceAuthorization2() {
+  const { status, data } = await postForm2("/oauth2/device/code", {
+    client_id: clientId(),
+    scope: OAUTH_SCOPE
+  });
+  if (status !== 200) {
+    throw new Error(`Grok device authorization failed (${status}): ${errorDetail2(data)}`);
+  }
+  const userCode = data.user_code;
+  const deviceCode = data.device_code;
+  const verificationUriComplete = data.verification_uri_complete;
+  if (typeof userCode !== "string" || typeof deviceCode !== "string") {
+    throw new Error("Grok device authorization response missing user_code/device_code.");
+  }
+  return {
+    userCode,
+    deviceCode,
+    verificationUri: typeof data.verification_uri === "string" ? data.verification_uri : "",
+    verificationUriComplete: typeof verificationUriComplete === "string" ? verificationUriComplete : "",
+    interval: Number(data.interval ?? 5) || 5,
+    // RFC 8628 §3.2: the server states how long the device code lives. Honor it
+    // rather than imposing our own budget — polling a code we know is dead only
+    // burns requests, and a longer local window would keep a user waiting past
+    // the point the code can ever succeed.
+    expiresInMs: (Number(data.expires_in) || 0) > 0 ? Number(data.expires_in) * 1e3 : DEVICE_TIMEOUT_FALLBACK_MS
+  };
+}
+async function pollDeviceToken2(deviceCode) {
+  const { status, data } = await postForm2("/oauth2/token", {
+    client_id: clientId(),
+    device_code: deviceCode,
+    grant_type: "urn:ietf:params:oauth:grant-type:device_code"
+  });
+  if (status === 200 && typeof data.access_token === "string") {
+    return { kind: "success", creds: credsFromTokenResponse2(data) };
+  }
+  if (status >= 500) {
+    throw new Error(`Grok token polling server error (${status}): ${errorDetail2(data)}`);
+  }
+  const errorCode = typeof data.error === "string" ? data.error : "unknown_error";
+  switch (errorCode) {
+    case "authorization_pending":
+      return { kind: "pending" };
+    case "slow_down":
+      return { kind: "slow_down" };
+    case "expired_token":
+      return { kind: "expired" };
+    case "access_denied":
+      return { kind: "denied" };
+    default:
+      throw new Error(`Grok token polling failed (${status}): ${errorDetail2(data)}`);
+  }
+}
+function sleep2(ms) {
+  return new Promise((resolve) => {
+    setTimeout(resolve, ms);
+  });
+}
+async function loginXai(callbacks) {
+  const auth = await requestDeviceAuthorization2();
+  callbacks.onStatus(
+    `Visit ${auth.verificationUri || auth.verificationUriComplete} and enter code: ${auth.userCode}`
+  );
+  callbacks.onOpenUrl(auth.verificationUriComplete || auth.verificationUri);
+  callbacks.onStatus("Waiting for you to authorize in the browser...");
+  const deadline = Date.now() + auth.expiresInMs;
+  let interval = Math.max(auth.interval, 1);
+  while (Date.now() < deadline) {
+    const remaining = deadline - Date.now();
+    await sleep2(Math.min(interval * 1e3, remaining));
+    const result = await pollDeviceToken2(auth.deviceCode);
+    if (result.kind === "success") return result.creds;
+    if (result.kind === "denied") {
+      throw new Error("Grok authorization was denied.");
+    }
+    if (result.kind === "expired") {
+      throw new Error("Grok device code expired. Please run login again.");
+    }
+    if (result.kind === "slow_down") {
+      interval += 5;
+    }
+  }
+  throw new Error("Grok login timed out. Please run login again.");
+}
+async function refreshXaiToken(refreshToken) {
+  const { status, data } = await postForm2("/oauth2/token", {
+    client_id: clientId(),
+    grant_type: "refresh_token",
+    refresh_token: refreshToken
+  });
+  if (status === 200 && typeof data.access_token === "string") {
+    return credsFromTokenResponse2(data, { fallbackRefreshToken: refreshToken });
+  }
+  const errorCode = typeof data.error === "string" ? data.error : "";
+  throw new Error(`Grok token refresh failed (${status}): ${errorCode || errorDetail2(data)}`);
+}
+
 // src/file-lock.ts
 var import_promises2 = __toESM(require("fs/promises"), 1);
 var import_promises3 = require("timers/promises");
@@ -1289,18 +1497,49 @@ function isAlive(pid) {
 
 // src/auth-storage.ts
 var MOONSHOT_OAUTH_KEY = "moonshot-oauth";
+var XAI_OAUTH_KEY = "xai-oauth";
+var DUAL_AUTH_PROVIDERS = [
+  {
+    provider: "moonshot",
+    oauthKey: MOONSHOT_OAUTH_KEY,
+    oauthLabel: "Kimi OAuth",
+    apiKeyLabel: "Moonshot API key",
+    restoreHint: 'Run "ggcoder login" and choose Kimi OAuth to restore OAuth auth.'
+  },
+  {
+    provider: "xai",
+    oauthKey: XAI_OAUTH_KEY,
+    oauthLabel: "Grok OAuth",
+    apiKeyLabel: "xAI API key",
+    restoreHint: 'Run "ggcoder login" and choose Grok OAuth to restore OAuth auth.'
+  }
+];
+function dualAuthProvider(provider) {
+  return DUAL_AUTH_PROVIDERS.find((entry) => entry.provider === provider);
+}
+function dualAuthProviderByOAuthKey(storageKey) {
+  return DUAL_AUTH_PROVIDERS.find((entry) => entry.oauthKey === storageKey);
+}
+function oauthStorageKey(provider) {
+  return dualAuthProvider(provider)?.oauthKey;
+}
+function providerStorageKeys(provider) {
+  const dual = dualAuthProvider(provider);
+  return dual ? [dual.oauthKey, dual.provider] : [provider];
+}
 var XIAOMI_CREDITS_KEY = "xiaomi-credits";
 var LOCAL_AUTH_KEY_PREFIX = "local:";
 var LOCAL_CREDENTIAL_LIFETIME_MS = 100 * 365 * 24 * 60 * 60 * 1e3;
 function activeBaseUrlEntry(data, provider) {
-  if (provider === "moonshot") {
-    const oauth = data[MOONSHOT_OAUTH_KEY];
+  const dual = dualAuthProvider(provider);
+  if (dual) {
+    const oauth = data[dual.oauthKey];
     if (oauth) {
       const exhaustedUntil = oauth.usageExhaustedUntil ?? 0;
-      if (Date.now() < exhaustedUntil && data["moonshot"]) return data["moonshot"];
+      if (Date.now() < exhaustedUntil && data[dual.provider]) return data[dual.provider];
       return oauth;
     }
-    return data["moonshot"];
+    return data[dual.provider];
   }
   return data[provider];
 }
@@ -1335,6 +1574,16 @@ var AuthStorage = class {
   data = {};
   filePath;
   loaded = false;
+  /**
+   * mtime+size of the file as of the cached snapshot (`size: -1` = no file).
+   * auth.json is shared: the desktop app writes API keys and disconnects
+   * NATIVELY (so they work with no daemon running), and every window/process has
+   * its own AuthStorage. A load-once cache therefore goes stale — the sidecar
+   * would keep listing models for a provider just disconnected, and hide the
+   * ones just connected, until the daemon restarted.
+   */
+  snapshotMtimeMs = 0;
+  snapshotSize = -1;
   /** Per-provider lock to serialize concurrent refresh calls. */
   refreshLocks = /* @__PURE__ */ new Map();
   constructor(filePath) {
@@ -1346,12 +1595,12 @@ var AuthStorage = class {
   }
   /** List provider keys with stored credentials. */
   async listProviders() {
-    await this.ensureLoaded();
+    await this.ensureFresh();
     return Object.keys(this.data);
   }
   /** True if credentials exist for `provider`. */
   async hasCredentials(provider) {
-    await this.ensureLoaded();
+    await this.ensureFresh();
     return Boolean(this.data[provider]);
   }
   /**
@@ -1362,18 +1611,19 @@ var AuthStorage = class {
    * instead of re-deriving the same order.
    */
   async pickStorageKey(keys) {
-    await this.ensureLoaded();
+    await this.ensureFresh();
     return keys.find((key) => Boolean(this.data[key]));
   }
   /**
-   * True if the user has any usable auth for the logical provider. For
-   * `moonshot` this is satisfied by either the Kimi OAuth credential or the
-   * Moonshot API key.
+   * True if the user has any usable auth for the logical provider. For a
+   * dual-auth provider (Kimi/Grok) either the OAuth credential or the API key
+   * satisfies it.
    */
   async hasProviderAuth(provider) {
-    await this.ensureLoaded();
-    if (provider === "moonshot") {
-      return Boolean(this.data[MOONSHOT_OAUTH_KEY] || this.data["moonshot"]);
+    await this.ensureFresh();
+    const dual = dualAuthProvider(provider);
+    if (dual) {
+      return Boolean(this.data[dual.oauthKey] || this.data[dual.provider]);
     }
     if (provider === "xiaomi") {
       return Boolean(this.data["xiaomi"] || this.data[XIAOMI_CREDITS_KEY]);
@@ -1407,14 +1657,16 @@ var AuthStorage = class {
   }
   /**
    * True if the active credential for `provider` is a static API key with no
-   * refresh mechanism. For `moonshot` this is only true when the Kimi OAuth
-   * credential is absent (a present OAuth credential is refreshable).
+   * refresh mechanism. For a dual-auth provider this is only true when its OAuth
+   * credential is absent or sidelined (a live OAuth credential is refreshable).
    */
   async isStaticApiKey(provider) {
-    await this.ensureLoaded();
-    if (provider === "moonshot" && this.data[MOONSHOT_OAUTH_KEY]) {
-      const exhaustedUntil = this.data[MOONSHOT_OAUTH_KEY].usageExhaustedUntil ?? 0;
-      const apiKeyActive = Date.now() < exhaustedUntil && Boolean(this.data["moonshot"]);
+    await this.ensureFresh();
+    const dual = dualAuthProvider(provider);
+    const oauthCreds = dual ? this.data[dual.oauthKey] : void 0;
+    if (dual && oauthCreds) {
+      const exhaustedUntil = oauthCreds.usageExhaustedUntil ?? 0;
+      const apiKeyActive = Date.now() < exhaustedUntil && Boolean(this.data[dual.provider]);
       if (!apiKeyActive) return false;
     }
     return STATIC_API_KEY_PROVIDERS.has(provider);
@@ -1422,26 +1674,30 @@ var AuthStorage = class {
   /**
    * The base URL on the credential that is active right now, if any.
    * Synchronous — call only after load()/resolveCredentials() populated the
-   * snapshot. For `moonshot` this is the Kimi For Coding URL whenever the
-   * OAuth entry is the one resolveCredentials would serve (i.e. not currently
-   * usage-exhausted with an API key configured).
+   * snapshot. For a dual-auth provider this is the subscription endpoint (Kimi
+   * For Coding, the Grok CLI proxy) whenever the OAuth entry is the one
+   * resolveCredentials would serve (i.e. not currently usage-exhausted with an
+   * API key configured).
    */
   getStoredBaseUrl(provider) {
     return activeBaseUrlEntry(this.data, provider)?.baseUrl;
   }
   async load() {
+    const first = !this.loaded;
     await withFileLock(this.filePath, async () => {
       try {
         const content = await import_promises4.default.readFile(this.filePath, "utf-8");
         this.data = JSON.parse(content);
-        log("INFO", "auth", `Loaded credentials from ${this.filePath}`, {
-          providers: Object.keys(this.data).join(",") || "(none)"
-        });
+        if (first) {
+          log("INFO", "auth", `Loaded credentials from ${this.filePath}`, {
+            providers: Object.keys(this.data).join(",") || "(none)"
+          });
+        }
       } catch (err) {
         this.data = {};
         const code = err.code;
         if (code === "ENOENT") {
-          log("INFO", "auth", `No auth file found at ${this.filePath} (first run)`);
+          if (first) log("INFO", "auth", `No auth file found at ${this.filePath} (first run)`);
         } else {
           log(
             "ERROR",
@@ -1453,10 +1709,50 @@ var AuthStorage = class {
       }
     });
     this.loaded = true;
+    await this.rememberSnapshot();
   }
   async ensureLoaded() {
     if (!this.loaded) await this.load();
   }
+  /**
+   * Like {@link ensureLoaded}, but re-reads when the file changed since this
+   * snapshot — a cheap stat, not a re-parse. Used by the "what is connected?"
+   * readers, which must reflect writes made by another window, the CLI, or the
+   * desktop app's native (daemon-free) API-key and disconnect paths.
+   *
+   * Deliberately NOT used by {@link resolveCredentials}: that path compares the
+   * caller's snapshot against the latest file to detect a concurrent re-login,
+   * and silently refreshing this instance's view first would destroy the
+   * evidence that the token it just had rejected has already been replaced.
+   */
+  async ensureFresh() {
+    if (!this.loaded) {
+      await this.load();
+      return;
+    }
+    let changed;
+    try {
+      const stat = await import_promises4.default.stat(this.filePath);
+      changed = stat.mtimeMs !== this.snapshotMtimeMs || stat.size !== this.snapshotSize;
+    } catch {
+      changed = this.snapshotSize !== -1;
+    }
+    if (changed) await this.load();
+  }
+  /**
+   * Record the file identity behind the current snapshot, so {@link ensureLoaded}
+   * can tell "someone else wrote" from "this is our own write".
+   */
+  async rememberSnapshot() {
+    try {
+      const stat = await import_promises4.default.stat(this.filePath);
+      this.snapshotMtimeMs = stat.mtimeMs;
+      this.snapshotSize = stat.size;
+    } catch {
+      this.snapshotMtimeMs = 0;
+      this.snapshotSize = -1;
+    }
+  }
   /**
    * Apply one provider-scoped mutation to the latest on-disk snapshot.
    * AuthStorage instances live in every app session/process, so writing this
@@ -1472,14 +1768,16 @@ var AuthStorage = class {
       await atomicWriteFile(this.filePath, JSON.stringify(latest, null, 2));
       this.data = latest;
     });
+    await this.rememberSnapshot();
   }
   async reloadLatest() {
     await withFileLock(this.filePath, async () => {
       this.data = await readAuthData(this.filePath);
     });
+    await this.rememberSnapshot();
   }
   async getCredentials(provider) {
-    await this.ensureLoaded();
+    await this.ensureFresh();
     return this.data[provider];
   }
   async setCredentials(provider, creds) {
@@ -1497,7 +1795,7 @@ var AuthStorage = class {
    * `resetsAt` (unix SECONDS, from the provider's rate-limit response) or a
    * 15-minute default when no reset time is known. While the mark is in the
    * future, `resolveCredentials("moonshot")` serves the Moonshot API key
-   * instead of the Kimi OAuth credential (when both are configured) — OAuth
+   * instead of the subscription OAuth credential (when both are configured) — OAuth
    * stays the preferred credential and is retried automatically once the mark
    * lapses. Persisted to auth.json so a restart (or another gg-app window)
    * doesn't burn a request rediscovering the same exhausted window. No-op if
@@ -1534,7 +1832,7 @@ var AuthStorage = class {
    */
   async resolveCredentials(provider, opts) {
     await this.ensureLoaded();
-    const directStorageKeys = opts?.storageKeys && !(opts.storageKeys.length === 1 && opts.storageKeys[0] === provider) ? opts.storageKeys : provider === "moonshot" ? [MOONSHOT_OAUTH_KEY, "moonshot"] : [provider];
+    const directStorageKeys = opts?.storageKeys && !(opts.storageKeys.length === 1 && opts.storageKeys[0] === provider) ? opts.storageKeys : providerStorageKeys(provider);
     if (!directStorageKeys.some((key) => Boolean(this.data[key]))) {
       await this.reloadLatest();
     }
@@ -1545,28 +1843,30 @@ var AuthStorage = class {
       }
       throw new NotLoggedInError(provider);
     }
-    if (provider === "moonshot" && this.data[MOONSHOT_OAUTH_KEY]) {
-      const exhaustedUntil = this.data[MOONSHOT_OAUTH_KEY].usageExhaustedUntil ?? 0;
-      if (Date.now() < exhaustedUntil && this.data["moonshot"]) {
+    const dual = dualAuthProvider(provider);
+    const dualOAuthCreds = dual ? this.data[dual.oauthKey] : void 0;
+    if (dual && dualOAuthCreds) {
+      const exhaustedUntil = dualOAuthCreds.usageExhaustedUntil ?? 0;
+      if (Date.now() < exhaustedUntil && this.data[dual.provider]) {
         log(
           "WARN",
           "auth",
-          `Kimi OAuth usage window is exhausted \u2014 using the Moonshot API key until ${new Date(exhaustedUntil).toISOString()} (OAuth resumes automatically).`
+          `${dual.oauthLabel} usage window is exhausted \u2014 using the ${dual.apiKeyLabel} until ${new Date(exhaustedUntil).toISOString()} (OAuth resumes automatically).`
         );
-        return this.data["moonshot"];
+        return this.data[dual.provider];
       }
       try {
-        return await this.resolveCredentials(MOONSHOT_OAUTH_KEY, {
+        return await this.resolveCredentials(dual.oauthKey, {
           ...opts?.forceRefresh ? { forceRefresh: true } : {}
         });
       } catch (err) {
-        if (err instanceof NotLoggedInError && this.data["moonshot"]) {
+        if (err instanceof NotLoggedInError && this.data[dual.provider]) {
           log(
             "WARN",
             "auth",
-            'Kimi OAuth credential is no longer valid \u2014 falling back to the Moonshot API key. Run "ggcoder login" and choose Kimi OAuth to restore OAuth auth.'
+            `${dual.oauthLabel} credential is no longer valid \u2014 falling back to the ${dual.apiKeyLabel}. ${dual.restoreHint}`
           );
-          return this.data["moonshot"];
+          return this.data[dual.provider];
         }
         throw err;
       }
@@ -1595,7 +1895,7 @@ var AuthStorage = class {
         this.data = latest;
         return latestCreds;
       }
-      const refreshFn = provider === "anthropic" ? refreshAnthropicToken : provider === "gemini" ? refreshGeminiToken : provider === MOONSHOT_OAUTH_KEY ? refreshKimiToken : refreshOpenAIToken;
+      const refreshFn = provider === "anthropic" ? refreshAnthropicToken : provider === "gemini" ? refreshGeminiToken : provider === MOONSHOT_OAUTH_KEY ? refreshKimiToken : provider === XAI_OAUTH_KEY ? refreshXaiToken : refreshOpenAIToken;
       let refreshed;
       try {
         refreshed = await refreshFn(latestCreds.refreshToken);
@@ -2828,7 +3128,7 @@ var TelegramBot = class {
       } catch (err) {
         if (!this.running) break;
         console.error(`[telegram] Poll error: ${err instanceof Error ? err.message : err}`);
-        await sleep2(3e3);
+        await sleep3(3e3);
       }
     }
   }
@@ -2998,7 +3298,7 @@ function splitMessage(text) {
   }
   return chunks;
 }
-function sleep2(ms) {
+function sleep3(ms) {
   return new Promise((r) => setTimeout(r, ms));
 }
 
@@ -3263,6 +3563,7 @@ function createAutoUpdater(config) {
   NotLoggedInError,
   SubscriptionUsageError,
   TelegramBot,
+  XAI_OAUTH_KEY,
   XIAOMI_CREDITS_KEY,
   clearLocalDiscoveryCache,
   clearRuntimeModels,
@@ -3271,6 +3572,8 @@ function createAutoUpdater(config) {
   decodeOggOpus,
   discoverLocalModels,
   downmixToMono,
+  dualAuthProvider,
+  dualAuthProviderByOAuthKey,
   endpointRoot,
   fetchSubscriptionUsage,
   findProbedModel,
@@ -3295,6 +3598,9 @@ function createAutoUpdater(config) {
   getSupportedThinkingLevels,
   getToolResultCharLimit,
   getVideoByteLimit,
+  grokCliBaseUrl,
+  grokCliHeaders,
+  isGrokCliEndpoint,
   isKimiCodingEndpoint,
   isLocalModelId,
   isLoggerOpen,
@@ -3308,14 +3614,18 @@ function createAutoUpdater(config) {
   loginGemini,
   loginKimi,
   loginOpenAI,
+  loginXai,
+  oauthStorageKey,
   openLog,
   parseLocalModelId,
   probeEndpoint,
+  providerStorageKeys,
   readStoredBaseUrlSync,
   refreshAnthropicToken,
   refreshGeminiToken,
   refreshKimiToken,
   refreshOpenAIToken,
+  refreshXaiToken,
   registerLogCleanup,
   registerRuntimeModels,
   resample,