@shanepadgett/tau-agent 0.14.0 → 0.16.0

package/extensions/attention/README.md

@@ -4,7 +4,7 @@ Sends a terminal-driven attention notification when Tau is ready for input, fini
 
 ## Behavior
 
-- Emits an attention notification on `agent_end`.
+- Emits an attention notification after the agent settles with no automatic continuation pending.
 - Emits an attention notification on `session_compact`.
 - Emits an attention notification on `session_tree` when it includes a branch summary.
 - Listens for shared event `tau:agent.blocked` when Tau is waiting on user input.

package/extensions/attention/index.ts

@@ -66,7 +66,7 @@ export default function attentionExtension(pi: ExtensionAPI): void {
 
 	onTauEvent(pi, "attention.agent-blocked", "tau:agent.blocked", notify);
 
-	pi.on("agent_end", (_event, ctx) => {
+	pi.on("agent_settled", (_event, ctx) => {
 		if (ctx.mode === "print") return;
 		notify({ title: DEFAULT_TITLE, body: DEFAULT_BODY });
 	});

package/extensions/context/sync.ts

@@ -8,7 +8,6 @@ import { createGitRunner, loadRepoStatus, type GitRunner } from "../../shared/gi
 import { generateToolValidated, resolveCandidates } from "../../shared/model-fallback/index.ts";
 import { loadTauExtensionSettings } from "../../shared/settings/load.ts";
 import { truncAt } from "../../shared/text.ts";
-import { XAI_CHAT_MODEL, XAI_PROVIDER } from "../xai/constants.ts";
 import {
 	contextEntryPaths,
 	isContextEligiblePath,
@@ -32,7 +31,7 @@ const CONTEXT_SYNC_MODELS: ReadonlyArray<{ provider: string; model: string; reas
 	{ provider: "openai-codex", model: "gpt-5.6-terra", reasoning: "medium" },
 	{ provider: "openai-codex", model: "gpt-5.6-sol", reasoning: "low" },
 	{ provider: "anthropic", model: "claude-sonnet-5", reasoning: "low" },
-	{ provider: XAI_PROVIDER, model: XAI_CHAT_MODEL, reasoning: "high" },
+	{ provider: "xai", model: "grok-4.5", reasoning: "high" },
 ];
 
 const SUBMIT_TOOL = {

package/extensions/image-gen/README.md

@@ -2,10 +2,10 @@
 
 `image_gen` generates raster images and edits up to three local raster images with Grok Imagine. It uses `grok-imagine-image-quality` and saves results under `~/.local/share/tau-agent/images/` by default. Pass an explicit path with the expected image extension when the image should be saved in the current repository or another chosen location.
 
-Use `/login` and select xAI (Grok subscription OAuth) before invoking the tool. No xAI API key is used.
+Run `/login xai` and choose either a subscription or API-key login before invoking the tool.
 
 Run `/reload` after installing or changing the extension.
 
 The model invokes `image_gen` with a prompt. For edits, it also supplies one to three local PNG, JPEG, or WebP paths. Successful images up to 12 MiB are returned inline for inspection; larger results remain available at the saved path.
 
-This extension uses xAI's undocumented subscription OAuth access. xAI may change its availability, entitlement rules, or protocol without notice.
+xAI controls model availability and subscription entitlements. A successful login does not guarantee that every account can use Grok Imagine.

package/extensions/image-gen/client.ts

@@ -1,4 +1,4 @@
-import { XAI_API_BASE_URL, XAI_IMAGE_MODEL } from "../xai/constants.ts";
+import { XAI_API_BASE_URL, XAI_IMAGE_MODEL } from "./constants.ts";
 
 const MAX_ERROR_BODY_BYTES = 8192;
 const MAX_ERROR_MESSAGE_LENGTH = 2000;

package/extensions/image-gen/constants.ts

@@ -0,0 +1,3 @@
+export const XAI_PROVIDER = "xai";
+export const XAI_IMAGE_MODEL = "grok-imagine-image-quality";
+export const XAI_API_BASE_URL = "https://api.x.ai/v1";

package/extensions/image-gen/index.ts

@@ -4,8 +4,8 @@ import { link, mkdir, readFile, rm, stat, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { basename, dirname, extname, isAbsolute, join, resolve } from "node:path";
 import { type Static, Type } from "typebox";
-import { XAI_IMAGE_MODEL, XAI_PROVIDER } from "../xai/constants.ts";
 import { detectImageMimeType, editImage, generateImage, type EditImage, type GeneratedImage } from "./client.ts";
+import { XAI_IMAGE_MODEL, XAI_PROVIDER } from "./constants.ts";
 
 const MAX_INPUT_BYTES = 50 * 1024 * 1024;
 const MAX_INLINE_BYTES = 12 * 1024 * 1024;
@@ -41,7 +41,7 @@ export default function imageGenExtension(pi: ExtensionAPI): void {
 			name: "image_gen",
 			label: "Image Generation",
 			description:
-				"Generate a requested raster image or AI-edit existing images with the xAI Grok subscription OAuth login. Omit referenced_image_paths to generate; pass one to three local paths to edit or compose. Omit path to use Tau's external image store; pass path only when the user explicitly requests a repository file or other destination. Returns the image for inspection.",
+				"Generate a requested raster image or AI-edit existing images with configured xAI authentication. Omit referenced_image_paths to generate; pass one to three local paths to edit or compose. Omit path to use Tau's external image store; pass path only when the user explicitly requests a repository file or other destination. Returns the image for inspection.",
 			parameters: imageGenSchema,
 			async execute(_toolCallId, params: ImageGenParams, signal, onUpdate, ctx) {
 				signal?.throwIfAborted();
@@ -63,7 +63,7 @@ export default function imageGenExtension(pi: ExtensionAPI): void {
 
 				const token = await ctx.modelRegistry.getApiKeyForProvider(XAI_PROVIDER);
 				if (!token) {
-					throw new Error("xAI OAuth is unavailable. Run /login and select xAI (Grok subscription OAuth).");
+					throw new Error("xAI authentication is unavailable. Run /login xai and choose a login method.");
 				}
 				const images: EditImage[] = [];
 				for (const path of params.referenced_image_paths ?? []) {

package/extensions/patch/README.md

@@ -1,6 +1,6 @@
 # patch
 
-Replaces the built-in `edit` and `write` tools with one multi-file patch tool. The agent applies structured patches to create, edit, move, and delete files while this extension is active.
+Replaces the built-in `edit` and `write` tools with one multi-file patch tool. The agent applies structured patches to create, edit, move, and delete files while this extension is active. For xAI and Grok models, Tau disables `patch` and leaves `edit` and `write` active because those models are unreliable with the patch format.
 
 ## What it does
 

package/extensions/patch/index.ts

@@ -135,6 +135,19 @@ export default function patchExtension(pi: ExtensionAPI): void {
 	const rowState = createToolRowStateStore(pi, "patch.tool-row-state");
 	pi.registerTool(createPatchTool(rowState));
 
+	function configureMutationTools(model: { provider: string; id: string } | undefined): void {
+		const active = new Set(pi.getActiveTools());
+		const usesGrok = model?.provider.toLowerCase() === "xai" || model?.id.toLowerCase().includes("grok") === true;
+		if (usesGrok) {
+			active.delete("patch");
+			for (const tool of SUPPRESSED_TOOLS) active.add(tool);
+		} else {
+			active.add("patch");
+			for (const tool of SUPPRESSED_TOOLS) active.delete(tool);
+		}
+		pi.setActiveTools([...active]);
+	}
+
 	// AgentToolResult has no isError field, so execute returns are always treated as success.
 	// Override via tool_result to flag partial/failed patches as errors for the model and UI.
 	pi.on("tool_result", async (event, ctx) => {
@@ -160,11 +173,12 @@ export default function patchExtension(pi: ExtensionAPI): void {
 		return { isError: true };
 	});
 
-	pi.on("session_start", () => {
+	pi.on("session_start", (_event, ctx) => {
 		rowState.clear();
-		const active = new Set(pi.getActiveTools());
-		active.add("patch");
-		for (const tool of SUPPRESSED_TOOLS) active.delete(tool);
-		pi.setActiveTools([...active]);
+		configureMutationTools(ctx.model);
+	});
+
+	pi.on("model_select", (event) => {
+		configureMutationTools(event.model);
 	});
 }

package/extensions/run-summary/README.md

@@ -1,5 +1,5 @@
 # Run Summary
 
-Run Summary adds a compact marker after each agent run. It shows wall time, direct run cost, delegated subagent cost, and their combined total.
+Run Summary adds a compact marker after the agent settles with no automatic continuation pending. It shows wall time, direct run cost, delegated subagent cost, and their combined total across the full continuation chain.
 
 The marker is stored as a display-only session entry. It does not enter model context or trigger another agent turn.

package/extensions/run-summary/index.ts

@@ -13,6 +13,8 @@ interface RunSummary {
 
 export default function runSummaryExtension(pi: ExtensionAPI): void {
 	let startedAt: number | undefined;
+	let runCost = 0;
+	let subagentCost = 0;
 
 	pi.registerEntryRenderer<RunSummary>(ENTRY_TYPE, (entry, _options, theme) => {
 		const summary = readRunSummary(entry.data);
@@ -32,18 +34,15 @@ export default function runSummaryExtension(pi: ExtensionAPI): void {
 
 	pi.on("session_start", () => {
 		startedAt = undefined;
+		runCost = 0;
+		subagentCost = 0;
 	});
 
 	pi.on("agent_start", () => {
-		startedAt = performance.now();
+		startedAt ??= performance.now();
 	});
 
 	pi.on("agent_end", (event) => {
-		if (startedAt === undefined) return;
-		const wallMs = Math.max(0, performance.now() - startedAt);
-		startedAt = undefined;
-		let runCost = 0;
-		let subagentCost = 0;
 		for (const message of event.messages) {
 			if (message.role === "assistant") {
 				runCost += finiteNonNegative((message as AssistantMessage).usage.cost.total);
@@ -52,12 +51,20 @@ export default function runSummaryExtension(pi: ExtensionAPI): void {
 			if (message.role !== "toolResult" || message.toolName !== "subagent") continue;
 			subagentCost += readSubagentCost(message.details);
 		}
+	});
+
+	pi.on("agent_settled", () => {
+		if (startedAt === undefined) return;
+		const wallMs = Math.max(0, performance.now() - startedAt);
+		startedAt = undefined;
 		pi.appendEntry<RunSummary>(ENTRY_TYPE, {
 			wallMs,
 			runCost,
 			subagentCost,
 			totalCost: runCost + subagentCost,
 		});
+		runCost = 0;
+		subagentCost = 0;
 	});
 }
 

package/extensions/silent-command-runner/index.ts

@@ -80,6 +80,8 @@ export default function silentCommandRunnerExtension(pi: ExtensionAPI): void {
 	let turnPaths = new Set<string>();
 	let run: Promise<void> | undefined;
 	let abortController: AbortController | undefined;
+	let lastRunAborted = false;
+	let chainActive = false;
 
 	pi.registerMessageRenderer<FailureDetails>(MESSAGE_TYPE, (message, { expanded }, theme) =>
 		renderFailure(asFailureDetails(message.details), expanded, theme),
@@ -89,6 +91,8 @@ export default function silentCommandRunnerExtension(pi: ExtensionAPI): void {
 		settings = normalizeSettings(await loadTauExtensionSettings(ctx, silentCommandRunnerSettings));
 		turnStart = Date.now();
 		turnPaths = new Set();
+		lastRunAborted = false;
+		chainActive = false;
 	});
 
 	pi.on("before_agent_start", async (event, ctx) => {
@@ -98,6 +102,9 @@ export default function silentCommandRunnerExtension(pi: ExtensionAPI): void {
 	});
 
 	pi.on("agent_start", async (_event, ctx) => {
+		lastRunAborted = false;
+		if (chainActive) return;
+		chainActive = true;
 		turnStart = Date.now();
 		if (!settings.enabled || settings.commands.length === 0) {
 			turnPaths = new Set();
@@ -107,8 +114,13 @@ export default function silentCommandRunnerExtension(pi: ExtensionAPI): void {
 		turnPaths = new Set(await walkFiles(projectRoot));
 	});
 
-	pi.on("agent_end", async (event, ctx) => {
-		if (hasAbortedAssistantMessage(event.messages)) return;
+	pi.on("agent_end", (event) => {
+		lastRunAborted = hasAbortedAssistantMessage(event.messages);
+	});
+
+	pi.on("agent_settled", async (_event, ctx) => {
+		chainActive = false;
+		if (lastRunAborted) return;
 		if (run) return;
 		run = runChangedCommands(ctx.cwd, turnStart, ctx.ui.notify)
 			.catch((error: unknown) => {
@@ -125,6 +137,8 @@ export default function silentCommandRunnerExtension(pi: ExtensionAPI): void {
 		abortController = undefined;
 		run = undefined;
 		turnPaths = new Set();
+		lastRunAborted = false;
+		chainActive = false;
 	});
 
 	async function runChangedCommands(

package/extensions/subagent/run.ts

@@ -232,7 +232,6 @@ export async function createSubagentThread(options: {
 			cwd: ctx.cwd,
 			model,
 			thinkingLevel: thinkingLevel as "off" | "minimal" | "low" | "medium" | "high" | "xhigh" | "max",
-			modelRegistry: ctx.modelRegistry,
 			tools: definition.tools,
 			excludeTools: ["subagent"],
 			resourceLoader,

package/extensions/tau-help/help.md

@@ -44,11 +44,7 @@ Adds `/ideas` to log rough ideas or open the ideas browser.
 
 ## image-gen
 
-Gives the agent an image-generation tool using the configured image service. Generated images are saved for inspection.
-
-## xai
-
-Adds Grok 4.5 and Grok Imagine through an xAI Grok subscription OAuth login. Run `/login` and select xAI before use.
+Gives the agent a Grok Imagine generation and editing tool. Run `/login xai` and choose a subscription or API-key login before use. Generated images are saved for inspection.
 
 ## manage-sessions
 
@@ -56,7 +52,7 @@ Adds `/manage-sessions` to browse saved sessions and `/sweep` to archive or dele
 
 ## patch
 
-Replaces separate edit/write operations with one multi-file `patch` tool. It can create, rewrite, edit, move, and delete files in one structured call. Fewer tool calls means fewer turns, and each avoided turn prevents the full chat context from being sent again.
+Replaces separate edit/write operations with one multi-file `patch` tool. It can create, rewrite, edit, move, and delete files in one structured call. Fewer tool calls means fewer turns, and each avoided turn prevents the full chat context from being sent again. Tau keeps `patch` disabled and uses `edit` and `write` for xAI and Grok models.
 
 ## publish
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@shanepadgett/tau-agent",
-	"version": "0.14.0",
+	"version": "0.16.0",
 	"description": "Tau is a custom agentic harness built with pi extensions",
 	"type": "module",
 	"license": "MIT",
@@ -28,7 +28,7 @@
 		"README.md"
 	],
 	"dependencies": {
-		"@shanepadgett/tau-tui": "0.14.0",
+		"@shanepadgett/tau-tui": "0.16.0",
 		"@toon-format/toon": "2.3.0",
 		"smol-toml": "1.7.0"
 	},

package/extensions/xai/README.md

@@ -1,7 +0,0 @@
-# xAI OAuth
-
-Adds Grok 4.5 using an xAI Grok subscription login. Run `/login`, select **xAI (Grok subscription OAuth)**, then authorize xAI in the browser. An existing official Grok CLI login can also be reused.
-
-The same login powers Tau's `image_gen` tool through Grok Imagine. No xAI API key is used.
-
-This integration uses xAI's undocumented subscription OAuth access. xAI may change its availability, entitlement rules, or protocol without notice.

package/extensions/xai/auth.ts

@@ -1,40 +0,0 @@
-import type { OAuthCredentials } from "@earendil-works/pi-ai";
-import { readFile } from "node:fs/promises";
-import { homedir } from "node:os";
-import { join } from "node:path";
-import { XAI_OAUTH_CLIENT_ID, XAI_OAUTH_ISSUER } from "./constants.ts";
-
-function expiry(value: unknown): number | undefined {
-	if (typeof value === "number" && Number.isInteger(value) && value >= 1_000_000_000_000) return value;
-	if (typeof value !== "string") return undefined;
-	const parsed = Date.parse(value);
-	return Number.isFinite(parsed) ? parsed : undefined;
-}
-
-export function parseGrokCredentials(value: unknown): OAuthCredentials | undefined {
-	if (typeof value !== "object" || value === null || Array.isArray(value)) return undefined;
-	const entry = (value as Record<string, unknown>)[`${XAI_OAUTH_ISSUER}::${XAI_OAUTH_CLIENT_ID}`];
-	if (typeof entry !== "object" || entry === null || Array.isArray(entry)) return undefined;
-	const record = entry as Record<string, unknown>;
-	const expires = expiry(record.expires_at);
-	if (
-		typeof record.key !== "string" ||
-		!record.key ||
-		typeof record.refresh_token !== "string" ||
-		!record.refresh_token ||
-		record.oidc_issuer !== XAI_OAUTH_ISSUER ||
-		record.oidc_client_id !== XAI_OAUTH_CLIENT_ID ||
-		expires === undefined
-	) {
-		return undefined;
-	}
-	return { access: record.key, refresh: record.refresh_token, expires };
-}
-
-export async function readGrokCredentials(): Promise<OAuthCredentials | undefined> {
-	try {
-		return parseGrokCredentials(JSON.parse(await readFile(join(homedir(), ".grok", "auth.json"), "utf8")));
-	} catch {
-		return undefined;
-	}
-}

package/extensions/xai/constants.ts

@@ -1,11 +0,0 @@
-export const XAI_PROVIDER = "xai-oauth";
-export const XAI_CHAT_MODEL = "grok-4.5";
-export const XAI_IMAGE_MODEL = "grok-imagine-image-quality";
-export const XAI_API_BASE_URL = "https://api.x.ai/v1";
-
-export const XAI_OAUTH_ISSUER = "https://auth.x.ai";
-export const XAI_OAUTH_CLIENT_ID = "b1a00492-073a-47ea-816f-4c329264a828";
-export const XAI_OAUTH_SCOPE = "openid profile email offline_access grok-cli:access api:access";
-export const XAI_OAUTH_CALLBACK_HOST = "127.0.0.1";
-export const XAI_OAUTH_CALLBACK_PORT = 56121;
-export const XAI_OAUTH_CALLBACK_PATH = "/callback";

package/extensions/xai/index.ts

@@ -1,38 +0,0 @@
-import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
-import { XAI_API_BASE_URL, XAI_CHAT_MODEL, XAI_PROVIDER } from "./constants.ts";
-import { xaiOAuth } from "./oauth.ts";
-import { rewriteXaiPayload } from "./payload.ts";
-
-export default function xaiExtension(pi: ExtensionAPI): void {
-	pi.registerProvider(XAI_PROVIDER, {
-		name: "xAI (Grok subscription OAuth)",
-		baseUrl: XAI_API_BASE_URL,
-		api: "openai-responses",
-		authHeader: true,
-		oauth: xaiOAuth,
-		models: [
-			{
-				id: XAI_CHAT_MODEL,
-				name: "Grok 4.5",
-				reasoning: true,
-				input: ["text", "image"],
-				cost: { input: 2, output: 6, cacheRead: 0.5, cacheWrite: 0 },
-				contextWindow: 500_000,
-				maxTokens: 131_072,
-				thinkingLevelMap: {
-					off: null,
-					minimal: "low",
-					low: "low",
-					medium: "medium",
-					high: "high",
-					xhigh: null,
-					max: null,
-				},
-			},
-		],
-	});
-	pi.on("before_provider_request", (event, ctx) => {
-		if (ctx.model?.provider !== XAI_PROVIDER) return;
-		return rewriteXaiPayload(event.payload);
-	});
-}

package/extensions/xai/oauth.ts

@@ -1,342 +0,0 @@
-import type { OAuthCredentials, OAuthLoginCallbacks } from "@earendil-works/pi-ai";
-import { createHash, randomBytes } from "node:crypto";
-import { createServer, type Server } from "node:http";
-import { readGrokCredentials } from "./auth.ts";
-import {
-	XAI_OAUTH_CALLBACK_HOST,
-	XAI_OAUTH_CALLBACK_PATH,
-	XAI_OAUTH_CALLBACK_PORT,
-	XAI_OAUTH_CLIENT_ID,
-	XAI_OAUTH_ISSUER,
-	XAI_OAUTH_SCOPE,
-} from "./constants.ts";
-
-const DISCOVERY_URL = `${XAI_OAUTH_ISSUER}/.well-known/openid-configuration`;
-const REQUEST_TIMEOUT_MS = 30_000;
-const LOGIN_TIMEOUT_MS = 180_000;
-const REFRESH_SKEW_MS = 120_000;
-
-interface Discovery {
-	authorization_endpoint: string;
-	token_endpoint: string;
-}
-
-interface TokenPayload {
-	access_token?: unknown;
-	refresh_token?: unknown;
-	id_token?: unknown;
-	expires_in?: unknown;
-	token_type?: unknown;
-}
-
-interface HttpResponse {
-	ok: boolean;
-	status: number;
-	body: { cancel(): Promise<void> } | null;
-	json(): Promise<unknown>;
-}
-
-interface CallbackResult {
-	code?: string;
-	error?: string;
-	errorDescription?: string;
-}
-
-function validatedEndpoint(value: unknown, field: string): string {
-	if (typeof value !== "string") throw new Error(`xAI OAuth discovery omitted ${field}`);
-	const url = new URL(value);
-	const host = url.hostname.toLowerCase();
-	if (url.protocol !== "https:" || (host !== "x.ai" && !host.endsWith(".x.ai"))) {
-		throw new Error(`xAI OAuth discovery returned an unexpected ${field}`);
-	}
-	return url.toString();
-}
-
-function requestSignal(parent?: AbortSignal): AbortSignal {
-	const timeout = AbortSignal.timeout(REQUEST_TIMEOUT_MS);
-	return parent ? AbortSignal.any([parent, timeout]) : timeout;
-}
-
-async function discover(signal?: AbortSignal): Promise<Discovery> {
-	const response = (await fetch(DISCOVERY_URL, {
-		headers: { Accept: "application/json" },
-		signal: requestSignal(signal),
-	})) as HttpResponse;
-	if (!response.ok) throw new Error(`xAI OAuth discovery failed with status ${response.status}`);
-	const value: unknown = await response.json();
-	if (typeof value !== "object" || value === null || Array.isArray(value)) {
-		throw new Error("xAI OAuth discovery returned invalid JSON");
-	}
-	const record = value as Record<string, unknown>;
-	return {
-		authorization_endpoint: validatedEndpoint(record.authorization_endpoint, "authorization_endpoint"),
-		token_endpoint: validatedEndpoint(record.token_endpoint, "token_endpoint"),
-	};
-}
-
-async function tokenRequest(endpoint: string, body: URLSearchParams, signal?: AbortSignal): Promise<TokenPayload> {
-	const response = (await fetch(validatedEndpoint(endpoint, "token_endpoint"), {
-		method: "POST",
-		headers: { Accept: "application/json", "Content-Type": "application/x-www-form-urlencoded" },
-		body,
-		signal: requestSignal(signal),
-	})) as HttpResponse;
-	if (!response.ok) {
-		await response.body?.cancel().catch(() => undefined);
-		throw new Error(`xAI OAuth token request failed with status ${response.status}`);
-	}
-	return (await response.json()) as TokenPayload;
-}
-
-function jwtClaims(token: string): Record<string, unknown> {
-	const segments = token.split(".");
-	if (segments.length !== 3 || !segments[1]) throw new Error("xAI OAuth returned an invalid ID token");
-	try {
-		const value: unknown = JSON.parse(Buffer.from(segments[1], "base64url").toString("utf8"));
-		if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error();
-		return value as Record<string, unknown>;
-	} catch {
-		throw new Error("xAI OAuth returned an invalid ID token");
-	}
-}
-
-function credentials(payload: TokenPayload, endpoint: string, fallbackRefresh = "", nonce?: string): OAuthCredentials {
-	if (typeof payload.access_token !== "string" || !payload.access_token) {
-		throw new Error("xAI OAuth token response omitted the access token");
-	}
-	const refresh =
-		typeof payload.refresh_token === "string" && payload.refresh_token ? payload.refresh_token : fallbackRefresh;
-	if (!refresh) throw new Error("xAI OAuth token response omitted the refresh token");
-	if (nonce !== undefined) {
-		if (typeof payload.id_token !== "string" || !payload.id_token)
-			throw new Error("xAI OAuth token response omitted the ID token");
-		const claims = jwtClaims(payload.id_token);
-		const audience = claims.aud;
-		const validAudience =
-			audience === XAI_OAUTH_CLIENT_ID || (Array.isArray(audience) && audience.includes(XAI_OAUTH_CLIENT_ID));
-		if (claims.iss !== XAI_OAUTH_ISSUER || !validAudience || claims.nonce !== nonce) {
-			throw new Error("xAI OAuth ID token validation failed");
-		}
-		if (typeof claims.exp !== "number" || claims.exp * 1000 <= Date.now()) {
-			throw new Error("xAI OAuth returned an expired ID token");
-		}
-	}
-	const expiresIn = typeof payload.expires_in === "number" && payload.expires_in > 0 ? payload.expires_in : 3600;
-	return {
-		access: payload.access_token,
-		refresh,
-		expires: Date.now() + expiresIn * 1000 - REFRESH_SKEW_MS,
-		tokenEndpoint: endpoint,
-	};
-}
-
-async function closeServer(server: Server): Promise<void> {
-	if (!server.listening) return;
-	await new Promise<void>((resolve) => server.close(() => resolve()));
-}
-
-async function callbackServer(expectedState: string): Promise<{
-	redirectUri: string;
-	wait(signal?: AbortSignal): Promise<CallbackResult>;
-	acceptManual(input: string): string | undefined;
-	close(): Promise<void>;
-}> {
-	let settle: ((result: CallbackResult) => void) | undefined;
-	let reject: ((error: Error) => void) | undefined;
-	let settled = false;
-	const result = new Promise<CallbackResult>((resolve, rejectResult) => {
-		settle = resolve;
-		reject = rejectResult;
-	});
-	const accept = (value: CallbackResult) => {
-		if (settled) return;
-		settled = true;
-		settle?.(value);
-	};
-	const parse = (params: URLSearchParams): CallbackResult | undefined => {
-		if (params.get("state") !== expectedState) return undefined;
-		const code = params.get("code") || undefined;
-		const error = params.get("error") || undefined;
-		if (!code && !error) return undefined;
-		return { code, error, errorDescription: params.get("error_description") || undefined };
-	};
-	const server = createServer((request, response) => {
-		const origin = request.headers.origin;
-		if (origin === "https://accounts.x.ai" || origin === "https://auth.x.ai") {
-			response.setHeader("Access-Control-Allow-Origin", origin);
-			response.setHeader("Access-Control-Allow-Methods", "GET, OPTIONS");
-			response.setHeader("Access-Control-Allow-Headers", "Content-Type");
-			response.setHeader("Access-Control-Allow-Private-Network", "true");
-			response.setHeader("Vary", "Origin");
-		}
-		if (request.method === "OPTIONS") {
-			response.writeHead(204).end();
-			return;
-		}
-		const url = new URL(request.url ?? "/", `http://${XAI_OAUTH_CALLBACK_HOST}`);
-		if (request.method !== "GET" || url.pathname !== XAI_OAUTH_CALLBACK_PATH) {
-			response.writeHead(404).end("Not found");
-			return;
-		}
-		const parsed = parse(url.searchParams);
-		if (!parsed) {
-			response.writeHead(400, { "Content-Type": "text/plain; charset=utf-8" }).end("Invalid OAuth callback");
-			return;
-		}
-		response
-			.writeHead(parsed.error ? 400 : 200, { "Content-Type": "text/html; charset=utf-8" })
-			.end("<html><body><h1>xAI authorization received.</h1>You can close this tab.</body></html>", () =>
-				accept(parsed),
-			);
-	});
-	const listen = (port: number) =>
-		new Promise<number>((resolve, rejectListen) => {
-			server.once("error", rejectListen);
-			server.listen(port, XAI_OAUTH_CALLBACK_HOST, () => {
-				server.removeListener("error", rejectListen);
-				const address = server.address();
-				if (!address || typeof address === "string") rejectListen(new Error("Could not determine callback port"));
-				else resolve(address.port);
-			});
-		});
-	let port: number;
-	try {
-		port = await listen(XAI_OAUTH_CALLBACK_PORT);
-	} catch {
-		port = await listen(0);
-	}
-	return {
-		redirectUri: `http://${XAI_OAUTH_CALLBACK_HOST}:${port}${XAI_OAUTH_CALLBACK_PATH}`,
-		acceptManual(input) {
-			try {
-				const value = input.trim();
-				const url = value.startsWith("http")
-					? new URL(value)
-					: new URL(`http://${XAI_OAUTH_CALLBACK_HOST}${XAI_OAUTH_CALLBACK_PATH}?${value.replace(/^\?/, "")}`);
-				if (url.pathname !== XAI_OAUTH_CALLBACK_PATH) return "Callback URL path was not recognized";
-				const parsed = parse(url.searchParams);
-				if (!parsed) return "Callback state did not match";
-				accept(parsed);
-				return undefined;
-			} catch {
-				return "Callback URL was invalid";
-			}
-		},
-		async wait(signal) {
-			const timeout = setTimeout(() => {
-				if (!settled) {
-					settled = true;
-					reject?.(new Error("Timed out waiting for xAI OAuth callback"));
-				}
-			}, LOGIN_TIMEOUT_MS);
-			const onAbort = () => {
-				if (!settled) {
-					settled = true;
-					reject?.(new Error("xAI OAuth login was cancelled"));
-				}
-			};
-			signal?.addEventListener("abort", onAbort, { once: true });
-			try {
-				return await result;
-			} finally {
-				clearTimeout(timeout);
-				signal?.removeEventListener("abort", onAbort);
-				await closeServer(server);
-			}
-		},
-		close: () => closeServer(server),
-	};
-}
-
-async function refreshXaiCredentials(value: OAuthCredentials): Promise<OAuthCredentials> {
-	if (!value.refresh) throw new Error("xAI OAuth credential cannot be refreshed; run /login again");
-	const endpoint =
-		typeof value.tokenEndpoint === "string" && value.tokenEndpoint
-			? validatedEndpoint(value.tokenEndpoint, "token_endpoint")
-			: (await discover()).token_endpoint;
-	const payload = await tokenRequest(
-		endpoint,
-		new URLSearchParams({
-			grant_type: "refresh_token",
-			client_id: XAI_OAUTH_CLIENT_ID,
-			refresh_token: value.refresh,
-		}),
-	);
-	return credentials(payload, endpoint, value.refresh);
-}
-
-export const xaiOAuth = {
-	name: "xAI (Grok subscription)",
-	usesCallbackServer: true,
-	async login(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials> {
-		const existing = await readGrokCredentials();
-		if (existing) {
-			const method = await callbacks.onSelect({
-				message: "Select xAI login method:",
-				options: [
-					{ id: "browser", label: "Browser login" },
-					{ id: "existing", label: "Use existing Grok CLI login" },
-				],
-			});
-			if (!method) throw new Error("Login cancelled");
-			if (method === "existing") {
-				if (existing.expires > Date.now()) return existing;
-				try {
-					return await refreshXaiCredentials(existing);
-				} catch {
-					callbacks.onProgress?.("The existing Grok CLI login could not be refreshed. Starting browser login.");
-				}
-			}
-		}
-		const discovery = await discover(callbacks.signal);
-		const verifier = randomBytes(32).toString("base64url");
-		const challenge = createHash("sha256").update(verifier).digest("base64url");
-		const state = randomBytes(24).toString("base64url");
-		const nonce = randomBytes(24).toString("base64url");
-		const callback = await callbackServer(state);
-		try {
-			const url = new URL(discovery.authorization_endpoint);
-			url.search = new URLSearchParams({
-				response_type: "code",
-				client_id: XAI_OAUTH_CLIENT_ID,
-				redirect_uri: callback.redirectUri,
-				scope: XAI_OAUTH_SCOPE,
-				code_challenge: challenge,
-				code_challenge_method: "S256",
-				state,
-				nonce,
-			}).toString();
-			callbacks.onAuth({ url: url.toString(), instructions: "Authorize xAI in your browser, then return to Tau." });
-			if (callbacks.onManualCodeInput) {
-				void callbacks
-					.onManualCodeInput()
-					.then((input) => {
-						const error = callback.acceptManual(input);
-						if (error) callbacks.onProgress?.(`Ignored pasted callback: ${error}`);
-					})
-					.catch(() => undefined);
-			}
-			const result = await callback.wait(callbacks.signal);
-			if (result.error) throw new Error(`xAI authorization failed: ${result.errorDescription ?? result.error}`);
-			if (!result.code) throw new Error("xAI authorization did not return a code");
-			const payload = await tokenRequest(
-				discovery.token_endpoint,
-				new URLSearchParams({
-					grant_type: "authorization_code",
-					client_id: XAI_OAUTH_CLIENT_ID,
-					code: result.code,
-					redirect_uri: callback.redirectUri,
-					code_verifier: verifier,
-				}),
-				callbacks.signal,
-			);
-			return credentials(payload, discovery.token_endpoint, "", nonce);
-		} finally {
-			await callback.close();
-		}
-	},
-	refreshToken: refreshXaiCredentials,
-	getApiKey(value: OAuthCredentials): string {
-		return value.access;
-	},
-};

package/extensions/xai/payload.ts

@@ -1,68 +0,0 @@
-function isRecord(value: unknown): value is Record<string, unknown> {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-
-function contentText(value: unknown): string {
-	if (typeof value === "string") return value;
-	if (!Array.isArray(value)) return "";
-	return value
-		.map((part) => {
-			if (!isRecord(part)) return "";
-			return typeof part.text === "string" ? part.text : "";
-		})
-		.filter(Boolean)
-		.join("\n");
-}
-
-function normalizeToolOutput(item: Record<string, unknown>): unknown[] {
-	if (item.type !== "function_call_output" || !Array.isArray(item.output)) return [item];
-	const images = item.output.filter((part) => isRecord(part) && part.type === "input_image");
-	if (images.length === 0) return [item];
-	const text = contentText(item.output) || "(tool returned image output)";
-	return [
-		{ ...item, output: text },
-		{
-			role: "user",
-			content: [
-				{ type: "input_text", text: "The previous tool result included image output. Use the attached image." },
-				...images,
-			],
-		},
-	];
-}
-
-export function rewriteXaiPayload(value: unknown): unknown {
-	if (!isRecord(value)) return value;
-	const body = { ...value };
-	delete body.prompt_cache_retention;
-	if (isRecord(body.reasoning)) {
-		const effort = body.reasoning.effort;
-		body.reasoning =
-			typeof effort === "string" && effort !== "none"
-				? { effort: effort === "minimal" ? "low" : effort }
-				: undefined;
-	}
-	if (Array.isArray(body.input)) {
-		const instructions: string[] = [];
-		const input: unknown[] = [];
-		for (const raw of body.input) {
-			if (!isRecord(raw)) {
-				input.push(raw);
-				continue;
-			}
-			if ((raw.role === "developer" || raw.role === "system") && input.length === 0) {
-				const text = contentText(raw.content).trim();
-				if (text) instructions.push(text);
-				continue;
-			}
-			input.push(...normalizeToolOutput(raw));
-		}
-		body.input = input;
-		if (instructions.length > 0) {
-			body.instructions = [typeof body.instructions === "string" ? body.instructions : "", ...instructions]
-				.filter(Boolean)
-				.join("\n\n");
-		}
-	}
-	return body;
-}