@oh-my-pi/pi-ai 16.3.13 → 16.3.15

package/src/providers/openai-codex/request-transformer.ts

@@ -1,19 +1,35 @@
-import type { Effort } from "@oh-my-pi/pi-catalog/effort";
+import { Effort } from "@oh-my-pi/pi-catalog/effort";
 import { supportsAllTurnsReasoningContext, supportsCodexReasoningSummary } from "@oh-my-pi/pi-catalog/identity";
 import { requireSupportedEffort } from "@oh-my-pi/pi-catalog/model-thinking";
-import type { Api, Model } from "../../types";
+import type { Model } from "../../types";
+import { mapOpenAIReasoningEffort } from "../openai-shared";
 
 /** Reasoning replay scope for the Codex Responses API (`reasoning.context`). */
 export type CodexReasoningContext = "auto" | "current_turn" | "all_turns";
 
+/** User-facing effort levels accepted by Codex request options. */
+type CodexCallerEffort = "minimal" | "low" | "medium" | "high" | "xhigh";
+
+/** Caller literal → catalog `Effort` bridge (the enum is nominal). */
+const EFFORT_BY_NAME: Record<CodexCallerEffort, Effort> = {
+	minimal: Effort.Minimal,
+	low: Effort.Low,
+	medium: Effort.Medium,
+	high: Effort.High,
+	xhigh: Effort.XHigh,
+};
+
 export interface ReasoningConfig {
-	effort: "none" | "minimal" | "low" | "medium" | "high" | "xhigh";
+	effort: "none" | "minimal" | "low" | "medium" | "high" | "xhigh" | "max";
 	summary?: "auto" | "concise" | "detailed";
 	context?: CodexReasoningContext;
+	/** Pro reasoning serving mode (gpt-5.6+ catalog pro aliases). */
+	mode?: "pro";
 }
 
 export interface CodexRequestOptions {
-	reasoningEffort?: ReasoningConfig["effort"];
+	/** User-facing effort; the wire-only `max` tier is reached via the model's effort map. */
+	reasoningEffort?: CodexCallerEffort | "none";
 	reasoningSummary?: ReasoningConfig["summary"] | null;
 	/** Explicit `reasoning.context` override; defaults to `all_turns` when unset. The `all_turns` value is gated to gpt-5.4+ Codex models — older ids reject it, so it is suppressed and `context` omitted. */
 	reasoningContext?: CodexReasoningContext;
@@ -80,10 +96,40 @@ export function shouldUseCodexResponsesLite(body: RequestBody, requested: boolea
 	return requested === true && !containsInputImage(body.input);
 }
 
-function getReasoningConfig(model: Model<Api>, options: CodexRequestOptions): ReasoningConfig {
+/**
+ * Clamp a user-facing effort to the model's ladder, then remap to the wire
+ * tier (e.g. GPT-5.6's shifted five-tier scale sends `max` for user `xhigh`).
+ * A mapped value outside the Codex wire vocabulary is a broken compat/model
+ * effort map — fail loudly rather than silently sending a different tier.
+ */
+function mapCodexWireEffort(
+	model: Model<"openai-codex-responses">,
+	effort: CodexCallerEffort,
+): ReasoningConfig["effort"] {
+	const mapped = mapOpenAIReasoningEffort(model, model.compat, requireSupportedEffort(model, EFFORT_BY_NAME[effort]));
+	switch (mapped) {
+		case "none":
+		case "minimal":
+		case "low":
+		case "medium":
+		case "high":
+		case "xhigh":
+		case "max":
+			return mapped;
+		default:
+			throw new Error(
+				`Effort map for ${model.provider}/${model.id} produced invalid Codex reasoning effort "${mapped}"`,
+			);
+	}
+}
+
+function getReasoningConfig(
+	model: Model<"openai-codex-responses">,
+	effort: NonNullable<CodexRequestOptions["reasoningEffort"]>,
+	options: CodexRequestOptions,
+): ReasoningConfig {
 	const config: ReasoningConfig = {
-		effort:
-			options.reasoningEffort === "none" ? "none" : requireSupportedEffort(model, options.reasoningEffort as Effort),
+		effort: effort === "none" ? "none" : mapCodexWireEffort(model, effort),
 	};
 	// `reasoning.summary` is accepted only from gpt-5.4 onward; earlier Codex ids
 	// (gpt-5.1-codex, gpt-5.3-codex, gpt-5.3-codex-spark) reject it with
@@ -216,7 +262,7 @@ function stripImageDetails(input: InputItem[]): void {
 
 export async function transformRequestBody(
 	body: RequestBody,
-	model: Model<Api>,
+	model: Model<"openai-codex-responses">,
 	options: CodexRequestOptions = {},
 	prompt?: { developerMessages: string[] },
 ): Promise<RequestBody> {
@@ -300,7 +346,7 @@ export async function transformRequestBody(
 	}
 
 	if (options.reasoningEffort !== undefined) {
-		const reasoningConfig = getReasoningConfig(model, options);
+		const reasoningConfig = getReasoningConfig(model, options.reasoningEffort, options);
 		body.reasoning = {
 			...body.reasoning,
 			...reasoningConfig,
@@ -323,6 +369,12 @@ export async function transformRequestBody(
 	} else {
 		delete body.reasoning;
 	}
+	// Catalog pro aliases (`gpt-5.6-*-pro`): applied after the effort branch so
+	// the mode is sent even when no effort is set (the branch above deletes
+	// `body.reasoning` in that case) — mode and effort are independent fields.
+	if (model.reasoningMode) {
+		body.reasoning = { ...body.reasoning, mode: model.reasoningMode };
+	}
 
 	body.text = {
 		...body.text,

package/src/providers/openai-codex-responses.ts

@@ -99,7 +99,7 @@ import {
 	finalizeToolCallArgumentsDone,
 	isOpenAIResponsesProgressEvent,
 	mapOpenAIResponsesStopReason,
-	normalizeOpenAIResponsesPromptCacheKey,
+	normalizeOpenAIPromptCacheKey,
 	populateResponsesUsageFromResponse,
 	promoteResponsesToolUseStopReason,
 } from "./openai-shared";
@@ -898,8 +898,8 @@ async function buildCodexRequestContext(
 	const accountId = getCodexAccountId(apiKey);
 	const baseUrl = model.baseUrl || CODEX_BASE_URL;
 	const url = resolveCodexResponsesUrl(baseUrl);
-	const promptCacheKey = normalizeOpenAIResponsesPromptCacheKey(options?.promptCacheKey ?? options?.sessionId);
-	const transportSessionId = normalizeOpenAIResponsesPromptCacheKey(options?.sessionId);
+	const promptCacheKey = normalizeOpenAIPromptCacheKey(options?.promptCacheKey ?? options?.sessionId);
+	const transportSessionId = normalizeOpenAIPromptCacheKey(options?.sessionId);
 	const transformedBody = await buildTransformedCodexRequestBody(model, context, options, promptCacheKey);
 
 	const requestHeaders = { ...(model.headers ?? {}), ...(options?.headers ?? {}) };
@@ -946,10 +946,10 @@ export async function buildTransformedCodexRequestBody(
 	model: Model<"openai-codex-responses">,
 	context: Context,
 	options: OpenAICodexResponsesOptions | undefined,
-	promptCacheKey = normalizeOpenAIResponsesPromptCacheKey(options?.promptCacheKey ?? options?.sessionId),
+	promptCacheKey = normalizeOpenAIPromptCacheKey(options?.promptCacheKey ?? options?.sessionId),
 ): Promise<RequestBody> {
 	const params: RequestBody = {
-		model: model.id,
+		model: model.requestModelId ?? model.id,
 		input: convertMessages(model, context),
 		stream: true,
 		prompt_cache_key: promptCacheKey,
@@ -2139,7 +2139,7 @@ export async function prewarmOpenAICodexResponses(
 	const accountId = getCodexAccountId(apiKey);
 	const baseUrl = model.baseUrl || CODEX_BASE_URL;
 	const url = resolveCodexResponsesUrl(baseUrl);
-	const transportSessionId = normalizeOpenAIResponsesPromptCacheKey(options?.sessionId);
+	const transportSessionId = normalizeOpenAIPromptCacheKey(options?.sessionId);
 	const promptCacheKey = transportSessionId;
 	const providerSessionState = getCodexProviderSessionState(options?.providerSessionState);
 	const responsesLite = options?.responsesLite === true;
@@ -2283,7 +2283,7 @@ function getCodexWebSocketStateForPublicSession(
 ): CodexWebSocketSessionState | undefined {
 	const baseUrl = options?.baseUrl || model.baseUrl || CODEX_BASE_URL;
 	const providerSessionState = getCodexProviderSessionState(options?.providerSessionState);
-	const normalizedSessionId = normalizeOpenAIResponsesPromptCacheKey(options?.sessionId);
+	const normalizedSessionId = normalizeOpenAIPromptCacheKey(options?.sessionId);
 	const publicSessionKey = normalizedSessionId ? `${baseUrl}:${model.id}:${normalizedSessionId}` : undefined;
 	const privateSessionKey = publicSessionKey
 		? providerSessionState?.webSocketPublicToPrivate.get(publicSessionKey)

package/src/providers/openai-completions.ts

@@ -82,6 +82,7 @@ import {
 	createInitialResponsesAssistantMessage,
 	createOpenAIStrictToolsState,
 	disableStrictToolsForScope,
+	getOpenAIPromptCacheKey,
 	getOpenAIStrictToolsScope,
 	isCompiledGrammarTooLargeStrictError,
 	isOpenRouterAnthropicModel,
@@ -616,6 +617,7 @@ const streamOpenAICompletionsOnce = (
 				apiKey,
 				options?.headers,
 				options?.initiatorOverride,
+				getOpenAIPromptCacheKey(options),
 			);
 			const premiumRequestsTotal = copilotPremiumRequests;
 			let appliedStrictTools = false;
@@ -1359,6 +1361,7 @@ function createRequestSetup(
 	apiKey?: string,
 	extraHeaders?: Record<string, string>,
 	initiatorOverride?: MessageAttribution,
+	promptCacheSessionId?: string,
 ): OpenAIRequestSetup & { baseUrl: string } {
 	const apiVersion = $env.AZURE_OPENAI_API_VERSION || "2024-10-21";
 	const deploymentName = parseAzureDeploymentNameMap($env.AZURE_OPENAI_DEPLOYMENT_NAME_MAP).get(model.id) ?? model.id;
@@ -1366,6 +1369,7 @@ function createRequestSetup(
 		apiKey,
 		extraHeaders,
 		initiatorOverride,
+		promptCacheSessionId,
 		messages: context.messages,
 		defaultBaseUrl: "https://api.openai.com/v1",
 		// Provider auth/header overlay: Kimi-code hosts require shared client
@@ -1413,7 +1417,11 @@ function buildParams(
 	context: Context,
 	options: OpenAICompletionsOptions | undefined,
 	toolStrictModeOverride?: ToolStrictModeOverride,
-): { params: OpenAICompletionsParams; toolStrictMode: AppliedToolStrictMode; strictToolsApplied: boolean } {
+): {
+	params: OpenAICompletionsParams;
+	toolStrictMode: AppliedToolStrictMode;
+	strictToolsApplied: boolean;
+} {
 	const initialPolicy = resolveOpenAICompatForRequest(model, options);
 	const initialCompat = initialPolicy.compat as ResolvedOpenAICompat;
 

package/src/providers/openai-responses-wire.ts

@@ -6318,6 +6318,13 @@ export interface Reasoning {
 	 * - `xhigh` is supported for all models after `gpt-5.1-codex-max`.
 	 */
 	effort?: ReasoningEffort | null;
+	/**
+	 * **gpt-5.6 and later models only**
+	 *
+	 * Reasoning serving mode. `pro` routes the request to the pro reasoning
+	 * path (more compute per response); omit for the standard path.
+	 */
+	mode?: "pro" | null;
 	/**
 	 * @deprecated **Deprecated:** use `summary` instead.
 	 *

package/src/providers/openai-responses.ts

@@ -76,7 +76,7 @@ import {
 	createInitialResponsesAssistantMessage,
 	createOpenAIStrictToolsState,
 	disableStrictToolsForScope,
-	getOpenAIResponsesPromptCacheKey,
+	getOpenAIPromptCacheKey,
 	getOpenAIResponsesRoutingSessionId,
 	getOpenAIStrictToolsScope,
 	getOpenRouterResponsesSessionId,
@@ -390,7 +390,7 @@ const streamOpenAIResponsesOnce = (
 			// stable prompt-cache key independently. Side-channel calls use this to
 			// avoid perturbing provider conversation state without cold-starting the cache.
 			const routingSessionId = getOpenAIResponsesRoutingSessionId(options);
-			const promptCacheSessionId = getOpenAIResponsesPromptCacheKey(options);
+			const promptCacheSessionId = getOpenAIPromptCacheKey(options);
 			const apiKey = options?.apiKey || getEnvApiKey(model.provider) || "";
 			const { headers, copilotPremiumRequests, baseUrl } = resolveOpenAIRequestSetup(model, {
 				apiKey,
@@ -818,7 +818,7 @@ export function buildParams(
 	}
 
 	const cacheRetention = resolveCacheRetention(options?.cacheRetention);
-	const promptCacheKey = getOpenAIResponsesPromptCacheKey(options);
+	const promptCacheKey = getOpenAIPromptCacheKey(options);
 	const modelId = applyWireModelIdTransform(
 		model.requestModelId ?? model.id,
 		model.compat.wireModelIdMode,
@@ -904,6 +904,13 @@ export function buildParams(
 			model.thinking?.effortMap?.[effort as NonNullable<OpenAIResponsesOptions["reasoning"]>] ??
 			effort,
 	});
+	// Catalog pro aliases (`gpt-5.6-*-pro`): merge AFTER the compat policy so the
+	// mode survives every policy branch (disabled/omitted effort included) while
+	// keeping whatever effort/summary the policy produced — mode and effort are
+	// independent wire fields.
+	if (model.reasoningMode) {
+		params.reasoning = { ...params.reasoning, mode: model.reasoningMode };
+	}
 
 	applyOpenAIGatewayRouting(params, model.compat);
 

package/src/providers/openai-shared.ts

@@ -123,7 +123,8 @@ export interface OpenAIRequestSetupModel extends OpenAIModelIdentity {
 	compat?: Pick<ResolvedOpenAISharedCompat, "promptCacheSessionHeader">;
 }
 
-export interface OpenAIResponsesCacheOptions {
+/** Cache identity controls shared by OpenAI-family transports. */
+export interface OpenAICacheOptions {
 	cacheRetention?: CacheRetention;
 	sessionId?: string;
 	promptCacheKey?: string;
@@ -175,6 +176,14 @@ function applyCoreWeaveProjectHeader(headers: Record<string, string>): void {
 	}
 }
 
+function setHeaderIfAbsent(headers: Record<string, string>, name: string, value: string): void {
+	const normalizedName = name.toLowerCase();
+	for (const existingName in headers) {
+		if (existingName.toLowerCase() === normalizedName) return;
+	}
+	headers[name] = value;
+}
+
 export function resolveOpenAIRequestSetup(
 	model: OpenAIRequestSetupModel,
 	options: OpenAIRequestSetupOptions,
@@ -257,11 +266,11 @@ export function resolveOpenAIRequestSetup(
 	}
 
 	if (options.openAISessionId && model.provider === "openai") {
-		headers.session_id ??= options.openAISessionId;
-		headers["x-client-request-id"] ??= options.openAISessionId;
+		setHeaderIfAbsent(headers, "session_id", options.openAISessionId);
+		setHeaderIfAbsent(headers, "x-client-request-id", options.openAISessionId);
 	}
 	if (options.promptCacheSessionId && model.compat?.promptCacheSessionHeader) {
-		headers[model.compat.promptCacheSessionHeader] ??= options.promptCacheSessionId;
+		setHeaderIfAbsent(headers, model.compat.promptCacheSessionHeader, options.promptCacheSessionId);
 	}
 
 	if (options.defaultBaseUrl !== undefined) {
@@ -368,7 +377,8 @@ export function calculateOpenAIUsageAccounting(accounting: OpenAIUsageAccounting
 	};
 }
 
-export function normalizeOpenAIResponsesPromptCacheKey(sessionId: string | undefined): string | undefined {
+/** Normalize a cache identity to the wire limit accepted by OpenAI-family providers. */
+export function normalizeOpenAIPromptCacheKey(sessionId: string | undefined): string | undefined {
 	return normalizeOpenAIStableId(sessionId, 64, "pc_");
 }
 
@@ -376,20 +386,21 @@ export function normalizeOpenRouterResponsesSessionId(sessionId: string | undefi
 	return normalizeOpenAIStableId(sessionId, 256, "session_");
 }
 
-export function getOpenAIResponsesPromptCacheKey(options: OpenAIResponsesCacheOptions | undefined): string | undefined {
+/** Resolve a prompt-cache identity, falling back to the provider session unless caching is disabled. */
+export function getOpenAIPromptCacheKey(options: OpenAICacheOptions | undefined): string | undefined {
 	if (resolveCacheRetention(options?.cacheRetention) === "none") return undefined;
-	return normalizeOpenAIResponsesPromptCacheKey(options?.promptCacheKey ?? options?.sessionId);
+	return normalizeOpenAIPromptCacheKey(options?.promptCacheKey ?? options?.sessionId);
 }
 
 export function getOpenAIResponsesRoutingSessionId(
-	options: Pick<OpenAIResponsesCacheOptions, "cacheRetention" | "sessionId"> | undefined,
+	options: Pick<OpenAICacheOptions, "cacheRetention" | "sessionId"> | undefined,
 ): string | undefined {
 	if (resolveCacheRetention(options?.cacheRetention) === "none") return undefined;
-	return normalizeOpenAIResponsesPromptCacheKey(options?.sessionId);
+	return normalizeOpenAIPromptCacheKey(options?.sessionId);
 }
 
 export function getOpenRouterResponsesSessionId(
-	options: Pick<OpenAIResponsesCacheOptions, "cacheRetention" | "sessionId"> | undefined,
+	options: Pick<OpenAICacheOptions, "cacheRetention" | "sessionId"> | undefined,
 ): string | undefined {
 	if (resolveCacheRetention(options?.cacheRetention) === "none") return undefined;
 	return normalizeOpenRouterResponsesSessionId(options?.sessionId);
@@ -695,13 +706,19 @@ export interface OpenAICompatPolicy {
 	};
 }
 
-function mapOpenAIReasoningEffort(
+/**
+ * Map a user-facing effort to the provider wire value: explicit compat
+ * override first, then the model's baked `thinking.effortMap`, else identity.
+ * Shared by the chat-completions/Responses policy resolver and the Codex
+ * request transformer.
+ */
+export function mapOpenAIReasoningEffort(
 	model: Pick<Model, "thinking">,
-	compat: OpenAICompatPolicyCompat,
+	compat: { reasoningEffortMap?: Partial<Record<Effort, string>> } | undefined,
 	effort: string,
 ): string {
 	const level = effort as Effort;
-	return compat.reasoningEffortMap?.[level] ?? model.thinking?.effortMap?.[level] ?? effort;
+	return compat?.reasoningEffortMap?.[level] ?? model.thinking?.effortMap?.[level] ?? effort;
 }
 
 function isImplicitDisableWhenNotRequested(disableMode: OpenAIReasoningDisableMode): boolean {

package/src/registry/oauth/__tests__/xai-oauth.test.ts

@@ -1,5 +1,5 @@
 import { afterEach, describe, expect, it, vi } from "bun:test";
-import { isXAIAccessTokenExpiring, refreshXAIOAuthToken, validateXAIEndpoint, XAIOAuthFlow } from "../xai-oauth";
+import { isXAIAccessTokenExpiring, loginXAIOAuth, refreshXAIOAuthToken, validateXAIEndpoint } from "../xai-oauth";
 
 afterEach(() => {
 	vi.restoreAllMocks();
@@ -11,6 +11,76 @@ function jwtWithExp(exp: number): string {
 	return `${header}.${payload}.sig`;
 }
 
+const DISCOVERY_URL = "https://auth.x.ai/.well-known/openid-configuration";
+const DEVICE_CODE_URL = "https://auth.x.ai/oauth2/device/code";
+const TOKEN_ENDPOINT = "https://auth.x.ai/oauth2/token";
+const CLIENT_ID = "b1a00492-073a-47ea-816f-4c329264a828";
+const SCOPE = "openid profile email offline_access grok-cli:access api:access";
+
+const DEVICE_AUTHORIZATION = {
+	device_code: "device-code-123",
+	user_code: "ABCD-EFGH",
+	verification_uri: "https://auth.x.ai/activate",
+	verification_uri_complete: "https://auth.x.ai/activate?user_code=ABCD-EFGH",
+	expires_in: 600,
+	interval: 1,
+};
+
+type RecordedRequest = {
+	url: string;
+	init: RequestInit | undefined;
+};
+
+type TokenResponse = {
+	body: unknown;
+	status?: number;
+};
+
+function jsonResponse(body: unknown, status: number = 200): Response {
+	return new Response(JSON.stringify(body), {
+		status,
+		headers: { "Content-Type": "application/json" },
+	});
+}
+
+function createDeviceFlowFetch(tokenResponses: readonly TokenResponse[]) {
+	const requests: RecordedRequest[] = [];
+	let tokenResponseIndex = 0;
+	const fetchMock = vi.fn(async (input: string | URL | Request, init?: RequestInit) => {
+		const url = typeof input === "string" ? input : input instanceof Request ? input.url : input.toString();
+		requests.push({ url, init });
+
+		if (url === DISCOVERY_URL) {
+			return jsonResponse({ token_endpoint: TOKEN_ENDPOINT });
+		}
+		if (url === DEVICE_CODE_URL) {
+			return jsonResponse(DEVICE_AUTHORIZATION);
+		}
+		if (url === TOKEN_ENDPOINT) {
+			const tokenResponse = tokenResponses[tokenResponseIndex];
+			tokenResponseIndex += 1;
+			if (!tokenResponse) {
+				throw new Error(`Unexpected xAI token poll ${tokenResponseIndex}`);
+			}
+			return jsonResponse(tokenResponse.body, tokenResponse.status);
+		}
+		throw new Error(`Unexpected xAI OAuth request: ${url}`);
+	});
+
+	return {
+		fetchMock: fetchMock as unknown as typeof fetch,
+		requests,
+	};
+}
+
+function requestForm(request: RecordedRequest | undefined): URLSearchParams {
+	const body = request?.init?.body;
+	if (!(body instanceof URLSearchParams)) {
+		throw new Error("Expected an application/x-www-form-urlencoded request body");
+	}
+	return body;
+}
+
 describe("isXAIAccessTokenExpiring", () => {
 	it("returns false for an empty string", () => {
 		expect(isXAIAccessTokenExpiring("")).toBe(false);
@@ -63,97 +133,138 @@ describe("refreshXAIOAuthToken", () => {
 	});
 });
 
-describe("XAIOAuthFlow", () => {
-	it("pins the redirect URI to xAI's allowlisted loopback port", () => {
-		const flow = new XAIOAuthFlow({});
-
-		expect(flow.redirectUri).toBe("http://127.0.0.1:56121/callback");
-	});
-
-	it("uses pasted-code login without starting a callback server", async () => {
-		const serveSpy = vi.spyOn(Bun, "serve").mockImplementation(() => {
-			throw new Error("callback server should not start");
-		});
-		let authUrl = "";
-		let tokenRequestBody = "";
-		const progress: string[] = [];
-		const fetchMock = vi.fn(async (input: string | URL | Request, init?: RequestInit) => {
-			const url = typeof input === "string" ? input : input instanceof Request ? input.url : input.toString();
-			if (url.includes("/.well-known/openid-configuration")) {
-				return new Response(
-					JSON.stringify({
-						authorization_endpoint: "https://auth.x.ai/oauth/authorize",
-						token_endpoint: "https://auth.x.ai/oauth/token",
-					}),
-					{ status: 200, headers: { "Content-Type": "application/json" } },
-				);
-			}
-			tokenRequestBody = init?.body instanceof URLSearchParams ? init.body.toString() : String(init?.body ?? "");
-			return new Response(
-				JSON.stringify({
+describe("loginXAIOAuth", () => {
+	it("performs the RFC 8628 device flow and returns the issued credentials", async () => {
+		const now = 1_800_000_000_000;
+		vi.spyOn(Date, "now").mockReturnValue(now);
+		const { fetchMock, requests } = createDeviceFlowFetch([
+			{
+				body: {
 					access_token: "access-token",
 					refresh_token: "refresh-token",
 					expires_in: 3600,
-				}),
-				{ status: 200, headers: { "Content-Type": "application/json" } },
-			);
+				},
+			},
+		]);
+		const authEvents: Array<{ url: string; instructions?: string }> = [];
+		const progress: string[] = [];
+		const onAuth = vi.fn((info: { url: string; instructions?: string }) => {
+			authEvents.push(info);
+		});
+		const onProgress = vi.fn((message: string) => {
+			progress.push(message);
+		});
+		const onManualCodeInput = vi.fn(async () => {
+			throw new Error("device authorization must not request a pasted code");
 		});
 
-		const flow = new XAIOAuthFlow({
-			fetch: fetchMock as unknown as typeof fetch,
-			onAuth: info => {
-				authUrl = info.url;
-			},
-			onManualCodeInput: async () => {
-				const parsed = new URL(authUrl);
-				const redirectUri = parsed.searchParams.get("redirect_uri") ?? "";
-				const state = parsed.searchParams.get("state") ?? "";
-				return `${redirectUri}?code=code-xyz&state=${encodeURIComponent(state)}`;
-			},
-			onProgress: message => progress.push(message),
+		const credentials = await loginXAIOAuth({
+			fetch: fetchMock,
+			onAuth,
+			onProgress,
+			onManualCodeInput,
 		});
 
-		const credentials = await flow.login();
-		const authorizeUrl = new URL(authUrl);
-		const tokenParams = new URLSearchParams(tokenRequestBody);
+		expect(requests.map(request => request.url)).toEqual([DISCOVERY_URL, DEVICE_CODE_URL, TOKEN_ENDPOINT]);
 
-		expect(serveSpy).not.toHaveBeenCalled();
-		expect(authorizeUrl.searchParams.get("redirect_uri")).toBe("http://127.0.0.1:56121/callback");
-		expect(progress).toContain("Waiting for pasted authorization code...");
-		expect(tokenParams.get("code")).toBe("code-xyz");
-		expect(credentials.access).toBe("access-token");
-		expect(credentials.refresh).toBe("refresh-token");
-	});
-});
+		const discoveryRequest = requests[0];
+		expect(discoveryRequest?.init?.method).toBe("GET");
+		expect(new Headers(discoveryRequest?.init?.headers).get("Accept")).toBe("application/json");
 
-describe("XAIOAuthFlow.exchangeToken", () => {
-	it("rejects when the token-exchange response is missing access_token", async () => {
-		const fetchMock = vi.fn(async (input: string | URL) => {
-			const url = typeof input === "string" ? input : input.toString();
-			if (url.includes("/.well-known/openid-configuration")) {
-				return new Response(
-					JSON.stringify({
-						authorization_endpoint: "https://auth.x.ai/oauth/authorize",
-						token_endpoint: "https://auth.x.ai/oauth/token",
-					}),
-					{ status: 200, headers: { "Content-Type": "application/json" } },
-				);
-			}
-			// Token-exchange response deliberately omits `access_token` to exercise
-			// the missing-token rejection path. The value of `refresh_token` here is
-			// a literal test marker, not a real secret — the test verifies
-			// exchangeToken throws before any token would be persisted.
-			return new Response(JSON.stringify({ refresh_token: "stub-refresh-token-for-test-only" }), {
-				status: 200,
-				headers: { "Content-Type": "application/json" },
-			});
+		const deviceRequest = requests[1];
+		expect(deviceRequest?.init?.method).toBe("POST");
+		const deviceHeaders = new Headers(deviceRequest?.init?.headers);
+		expect(deviceHeaders.get("Content-Type")).toBe("application/x-www-form-urlencoded");
+		expect(deviceHeaders.get("Accept")).toBe("application/json");
+		const deviceForm = requestForm(deviceRequest);
+		expect([...deviceForm.keys()].sort()).toEqual(["client_id", "scope"]);
+		expect(Object.fromEntries(deviceForm)).toEqual({
+			client_id: CLIENT_ID,
+			scope: SCOPE,
 		});
 
-		const flow = new XAIOAuthFlow({ fetch: fetchMock as unknown as typeof fetch });
-		await flow.generateAuthUrl("state-abc", "http://127.0.0.1:56121/callback");
+		const tokenRequest = requests[2];
+		expect(tokenRequest?.init?.method).toBe("POST");
+		const tokenHeaders = new Headers(tokenRequest?.init?.headers);
+		expect(tokenHeaders.get("Content-Type")).toBe("application/x-www-form-urlencoded");
+		expect(tokenHeaders.get("Accept")).toBe("application/json");
+		const tokenForm = requestForm(tokenRequest);
+		expect([...tokenForm.keys()].sort()).toEqual(["client_id", "device_code", "grant_type"]);
+		expect(Object.fromEntries(tokenForm)).toEqual({
+			grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+			client_id: CLIENT_ID,
+			device_code: DEVICE_AUTHORIZATION.device_code,
+		});
+
+		expect(authEvents).toEqual([
+			{
+				url: DEVICE_AUTHORIZATION.verification_uri_complete,
+				instructions: `Enter code: ${DEVICE_AUTHORIZATION.user_code}`,
+			},
+		]);
+		expect(authEvents[0]?.instructions).not.toMatch(/hermes/i);
+		expect(onManualCodeInput).not.toHaveBeenCalled();
+		expect(progress).toEqual(["Waiting for xAI device authorization..."]);
+		expect(credentials).toEqual({
+			access: "access-token",
+			refresh: "refresh-token",
+			expires: now + 3_300_000,
+		});
+	});
+
+	it("continues through authorization_pending and slow_down responses", async () => {
+		const sleepSpy = vi.spyOn(Bun, "sleep").mockResolvedValue(undefined);
+		const { fetchMock, requests } = createDeviceFlowFetch([
+			{ status: 400, body: { error: "authorization_pending" } },
+			{ status: 400, body: { error: "slow_down" } },
+			{
+				body: {
+					access_token: "eventual-access-token",
+					refresh_token: "eventual-refresh-token",
+					expires_in: 3600,
+				},
+			},
+		]);
+
+		const credentials = await loginXAIOAuth({ fetch: fetchMock });
+
+		const tokenRequests = requests.filter(request => request.url === TOKEN_ENDPOINT);
+		expect(tokenRequests).toHaveLength(3);
+		expect(tokenRequests.map(request => Object.fromEntries(requestForm(request)))).toEqual([
+			{
+				grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+				client_id: CLIENT_ID,
+				device_code: DEVICE_AUTHORIZATION.device_code,
+			},
+			{
+				grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+				client_id: CLIENT_ID,
+				device_code: DEVICE_AUTHORIZATION.device_code,
+			},
+			{
+				grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+				client_id: CLIENT_ID,
+				device_code: DEVICE_AUTHORIZATION.device_code,
+			},
+		]);
+		expect(sleepSpy.mock.calls).toEqual([[1000], [6000]]);
+		expect(credentials.access).toBe("eventual-access-token");
+		expect(credentials.refresh).toBe("eventual-refresh-token");
+	});
+
+	it("rejects a token response that omits access_token", async () => {
+		const { fetchMock, requests } = createDeviceFlowFetch([
+			{
+				body: {
+					refresh_token: "refresh-token",
+					expires_in: 3600,
+				},
+			},
+		]);
 
-		await expect(flow.exchangeToken("code-xyz", "state-abc", "http://127.0.0.1:56121/callback")).rejects.toThrow(
-			/access_token/,
+		await expect(loginXAIOAuth({ fetch: fetchMock })).rejects.toThrow(
+			/xAI device-code token response missing access_token/,
 		);
+		expect(requests.filter(request => request.url === TOKEN_ENDPOINT)).toHaveLength(1);
 	});
 });