@shanepadgett/tau-agent 0.6.0 → 0.7.0

package/extensions/auto-name/index.ts

@@ -87,7 +87,7 @@ async function runAutoName(
 ): Promise<void> {
 	const ui = ctx.ui;
 	try {
-		const candidates = await resolveCandidates(ctx, AUTO_NAME_MODELS);
+		const candidates = await resolveCandidates(ctx, AUTO_NAME_MODELS, true);
 		const result = await generateToolValidated(
 			{ ui, signal: controller.signal },
 			candidates,

package/extensions/commit/commit-plan.ts

@@ -55,7 +55,7 @@ export async function generatePlan(
 	const prompt = buildPlanPrompt(evidence, previousPlan, regenerationNote);
 	return generateToolValidated(
 		ctx,
-		await resolveCandidates(ctx, COMMIT_MODELS),
+		await resolveCandidates(ctx, COMMIT_MODELS, true),
 		prompt,
 		COMMIT_PLAN_TOOL,
 		(input) => commitGroupsFromToolInput(input, evidence.files),
@@ -83,10 +83,17 @@ export async function regenerateMessage(
 ): Promise<string> {
 	const selected = evidence.files.filter((file) => files.includes(file.path));
 	const prompt = buildMessagePrompt(evidence, selected, previousPlan, selectedGroupId, regenerationNote);
-	return generateValidated(ctx, await resolveCandidates(ctx, COMMIT_MODELS), prompt, requireCommitMessage, undefined, {
-		statusKey: "commit",
-		notifyOnFallback: true,
-	});
+	return generateValidated(
+		ctx,
+		await resolveCandidates(ctx, COMMIT_MODELS, true),
+		prompt,
+		requireCommitMessage,
+		undefined,
+		{
+			statusKey: "commit",
+			notifyOnFallback: true,
+		},
+	);
 }
 
 export function requireCommitMessage(rawMessage: string): string {

package/extensions/context/index.ts

@@ -89,39 +89,42 @@ export default function contextExtension(pi: ExtensionAPI): void {
 	});
 
 	pi.registerTool(
-		defineTool<typeof contextSyncParams, ContextSyncDetails>({
+		defineTool<typeof contextSyncParams, ContextSyncDetails | undefined>({
 			name: "context_sync",
 			label: "context_sync",
 			description: "Synchronize repository context from current Git changes.",
 			parameters: contextSyncParams,
-			async execute(_id, _params, _signal, _update, ctx) {
-				return compactResult(await runContextSync(pi, ctx));
+			async execute(_id, _params, _signal, onUpdate, ctx) {
+				return compactResult(
+					await runContextSync(pi, ctx, (status) =>
+						onUpdate?.({ content: [{ type: "text", text: status }], details: undefined }),
+					),
+				);
 			},
 			renderCall(_args, theme, context) {
 				const text = (context.lastComponent as Text | undefined) ?? new Text("", 0, 0);
 				text.setText(theme.fg("toolTitle", "context_sync"));
 				return text;
 			},
-			renderResult(result, _options, theme, context) {
+			renderResult(result, options, theme, context) {
 				const text = (context.lastComponent as Text | undefined) ?? new Text("", 0, 0);
 				const details = result.details;
+				const output = result.content.map((part) => (part.type === "text" ? part.text : "")).join("");
 				text.setText(
-					context.expanded && details
-						? [
-								details.summary,
-								details.reason,
-								...details.changes.map((change) =>
-									change.action === "set-entry"
-										? `${change.action} ${change.tab}/${change.concept}/${change.entry}: ${change.files.join(", ")}`
-										: `${change.action} ${change.tab}/${change.concept}/${change.entry}`,
-								),
-								...details.changedContextFiles,
-							].join("\n")
-						: (details?.summary ??
-								theme.fg(
-									"error",
-									result.content.map((part) => (part.type === "text" ? part.text : "")).join(""),
-								)),
+					options.isPartial
+						? theme.fg("dim", output)
+						: context.expanded && details
+							? [
+									details.summary,
+									details.reason,
+									...details.changes.map((change) =>
+										change.action === "set-entry"
+											? `${change.action} ${change.tab}/${change.concept}/${change.entry}: ${change.files.join(", ")}`
+											: `${change.action} ${change.tab}/${change.concept}/${change.entry}`,
+									),
+									...details.changedContextFiles,
+								].join("\n")
+							: (details?.summary ?? theme.fg("error", output)),
 				);
 				return text;
 			},

package/extensions/context/sync.ts

@@ -1,12 +1,13 @@
 import { createHash } from "node:crypto";
 import { mkdir, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
 import { dirname, extname, join, relative, resolve, sep } from "node:path";
-import { Type, type Tool } from "@earendil-works/pi-ai";
+import { Type, type ThinkingLevel, type Tool } from "@earendil-works/pi-ai";
 import { withFileMutationQueue, type ExtensionAPI, type ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { parse, stringify } from "smol-toml";
 import { createGitRunner, loadRepoStatus, type GitRunner } from "../../shared/git.ts";
 import { generateToolValidated, resolveCandidates } from "../../shared/model-fallback/index.ts";
 import { truncAt } from "../../shared/text.ts";
+import { XAI_CHAT_MODEL, XAI_PROVIDER } from "../xai/constants.ts";
 import {
 	loadContextEntries,
 	normalizeProjectPath,
@@ -22,19 +23,22 @@ const MAX_TOTAL_EVIDENCE = 64_000;
 const MAX_UNTRACKED_BYTES = 12_000;
 const EVIDENCE_CONCURRENCY = 4;
 
+const CONTEXT_SYNC_MODELS: ReadonlyArray<{ provider: string; model: string; reasoning: ThinkingLevel }> = [
+	{ provider: "openai-codex", model: "gpt-5.6-terra", reasoning: "medium" },
+	{ provider: "openai-codex", model: "gpt-5.6-sol", reasoning: "low" },
+	{ provider: "anthropic", model: "claude-sonnet-5", reasoning: "low" },
+	{ provider: XAI_PROVIDER, model: XAI_CHAT_MODEL, reasoning: "high" },
+];
+
 const SUBMIT_TOOL = {
 	name: "submit_context_sync",
 	description: "Submit the desired context catalog changes.",
-	parameters: Type.Union([
-		Type.Object(
-			{ outcome: Type.Literal("no-change"), reason: Type.String({ minLength: 1 }) },
-			{ additionalProperties: false },
-		),
-		Type.Object(
-			{
-				outcome: Type.Literal("apply"),
-				reason: Type.String({ minLength: 1 }),
-				changes: Type.Array(
+	parameters: Type.Object(
+		{
+			outcome: Type.Union([Type.Literal("no-change"), Type.Literal("apply")]),
+			reason: Type.String({ minLength: 1 }),
+			changes: Type.Optional(
+				Type.Array(
 					Type.Union([
 						Type.Object(
 							{
@@ -61,10 +65,10 @@ const SUBMIT_TOOL = {
 					]),
 					{ minItems: 1 },
 				),
-			},
-			{ additionalProperties: false },
-		),
-	]),
+			),
+		},
+		{ additionalProperties: false },
+	),
 } satisfies Tool;
 
 export interface SyncDirtyFile {
@@ -122,8 +126,13 @@ export interface SyncEvidence {
 
 let syncQueue = Promise.resolve();
 
-export async function runContextSync(pi: ExtensionAPI, ctx: ExtensionContext): Promise<ContextSyncDetails> {
+export async function runContextSync(
+	pi: ExtensionAPI,
+	ctx: ExtensionContext,
+	onStatus?: (status: string) => void | Promise<void>,
+): Promise<ContextSyncDetails> {
 	if (!ctx.isProjectTrusted()) throw new Error("Context sync requires a trusted project");
+	await onStatus?.("Inspecting repository context");
 	const git = createGitRunner(pi, ctx);
 	const status = await loadRepoStatus(git);
 	if (!status) throw new Error("No Git repository found");
@@ -132,14 +141,15 @@ export async function runContextSync(pi: ExtensionAPI, ctx: ExtensionContext): P
 	const prompt = buildContextSyncPrompt(evidence);
 	const plan = await generateToolValidated(
 		ctx,
-		await resolveCandidates(ctx),
+		await resolveCandidates(ctx, CONTEXT_SYNC_MODELS, false),
 		prompt,
 		SUBMIT_TOOL,
 		(input) => normalizeContextSyncPlan(input, evidence),
 		(error) => `Validation failed: ${error.message}\nCall submit_context_sync once with corrected arguments only.`,
-		{ statusKey: "context-sync", notifyOnFallback: true },
+		{ statusKey: "context-sync", onStatus },
 	);
 	if (plan.outcome === "no-change") return noChange(plan.reason);
+	await onStatus?.("Applying context catalog changes");
 	return withSyncLock(async () => {
 		return applyContextSyncPlan(evidence.root, plan, evidence.entries, async () => {
 			const currentEntries = await loadContextEntries(evidence.root);

package/extensions/image-gen/README.md

@@ -1,11 +1,11 @@
 # Image Generation
 
-`image_gen` generates raster images and edits up to five local raster images with OpenAI Codex. It uses the current `gpt-image-2` model and saves results under `~/.local/share/tau-agent/images/` by default. Pass an explicit PNG path when the image should be saved in the current repository or another chosen location.
+`image_gen` generates raster images and edits up to three local raster images with Grok Imagine. It uses `grok-imagine-image-quality` and saves results under `~/.local/share/tau-agent/images/` by default. Pass an explicit path with the expected image extension when the image should be saved in the current repository or another chosen location.
 
-Use `/login` and select OpenAI Codex before invoking the tool. No `OPENAI_API_KEY` is needed.
+Use `/login` and select xAI (Grok subscription OAuth) before invoking the tool. No xAI API key is used.
 
 Run `/reload` after installing or changing the extension.
 
-The model invokes `image_gen` with a prompt. Size, quality, and background use the Codex automatic settings. For edits, it also supplies one to five local PNG, JPEG, or WebP paths. Successful PNGs up to 12 MiB are returned inline for inspection; larger results remain available at the saved path.
+The model invokes `image_gen` with a prompt. For edits, it also supplies one to three local PNG, JPEG, or WebP paths. Successful images up to 12 MiB are returned inline for inspection; larger results remain available at the saved path.
 
-This extension calls a private Codex backend. OpenAI may change its availability or protocol without notice.
+This extension uses xAI's undocumented subscription OAuth access. xAI may change its availability, entitlement rules, or protocol without notice.

package/extensions/image-gen/client.ts

@@ -1,60 +1,34 @@
-const CODEX_IMAGES_URL = "https://chatgpt.com/backend-api/codex/images";
-const MODEL = "gpt-image-2";
-const PNG_SIGNATURE = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);
+import { XAI_API_BASE_URL, XAI_IMAGE_MODEL } from "../xai/constants.ts";
+
 const MAX_ERROR_BODY_BYTES = 8192;
 const MAX_ERROR_MESSAGE_LENGTH = 2000;
-
-interface FetchResponse {
-	ok: boolean;
-	status: number;
-	body: ReadableStream<Uint8Array> | null;
-	json(): Promise<unknown>;
-}
-
-export interface CodexAuth {
-	token: string;
-	accountId: string;
-}
+const REQUEST_TIMEOUT_MS = 60_000;
+const MAX_ATTEMPTS = 3;
+const RETRY_BASE_DELAY_MS = 500;
 
 export interface EditImage {
 	mimeType: "image/png" | "image/jpeg" | "image/webp";
 	data: string;
 }
 
-interface GeneratedImage {
+export interface GeneratedImage {
 	bytes: Buffer;
 	base64: string;
-	mimeType: "image/png";
+	mimeType: EditImage["mimeType"];
 }
 
-function isRecord(value: unknown): value is Record<string, unknown> {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
+interface HttpResponse {
+	ok: boolean;
+	status: number;
+	body: ReadableStream<Uint8Array> | null;
+	json(): Promise<unknown>;
 }
 
-export function resolveCodexAuth(token: string): CodexAuth {
-	const invalidCredential = () =>
-		new Error("The OpenAI Codex credential does not contain a usable ChatGPT account ID. Run /login again.");
-	const segments = token.split(".");
-	if (segments.length !== 3 || !segments[1]) throw invalidCredential();
-	if (!/^[A-Za-z0-9_-]+$/.test(segments[1]) || segments[1].length % 4 === 1) throw invalidCredential();
-
-	let payload: unknown;
-	try {
-		const decoded = Buffer.from(segments[1], "base64url");
-		if (decoded.toString("base64url") !== segments[1]) throw invalidCredential();
-		payload = JSON.parse(decoded.toString("utf8"));
-	} catch {
-		throw invalidCredential();
-	}
-	if (!isRecord(payload)) throw invalidCredential();
-	const authClaim = payload["https://api.openai.com/auth"];
-	if (!isRecord(authClaim)) throw invalidCredential();
-	const accountId = authClaim.chatgpt_account_id;
-	if (typeof accountId !== "string" || !accountId.trim()) throw invalidCredential();
-	return { token, accountId: accountId.trim() };
+function isRecord(value: unknown): value is Record<string, unknown> {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
-async function readBoundedError(response: FetchResponse): Promise<string> {
+async function boundedError(response: HttpResponse): Promise<string> {
 	if (!response.body) return "";
 	const reader = response.body.getReader();
 	const chunks: Uint8Array[] = [];
@@ -63,8 +37,7 @@ async function readBoundedError(response: FetchResponse): Promise<string> {
 		while (length < MAX_ERROR_BODY_BYTES) {
 			const result = await reader.read();
 			if (result.done) break;
-			const remaining = MAX_ERROR_BODY_BYTES - length;
-			const chunk = result.value.subarray(0, remaining);
+			const chunk = result.value.subarray(0, MAX_ERROR_BODY_BYTES - length);
 			chunks.push(chunk);
 			length += chunk.length;
 			if (chunk.length < result.value.length) break;
@@ -72,23 +45,21 @@ async function readBoundedError(response: FetchResponse): Promise<string> {
 	} finally {
 		await reader.cancel().catch(() => undefined);
 	}
-	const bytes = new Uint8Array(length);
-	let offset = 0;
-	for (const chunk of chunks) {
-		bytes.set(chunk, offset);
-		offset += chunk.length;
-	}
-	return new TextDecoder().decode(bytes);
+	return Buffer.concat(
+		chunks.map((chunk) => Buffer.from(chunk)),
+		length,
+	)
+		.toString()
+		.trim();
 }
 
 function serverErrorMessage(body: string, token: string): string {
-	let message = body.trim();
+	let message = body;
 	try {
-		const parsed: unknown = JSON.parse(message);
-		if (isRecord(parsed)) {
-			const error = parsed.error;
-			if (isRecord(error) && typeof error.message === "string") message = error.message;
-			else if (typeof parsed.message === "string") message = parsed.message;
+		const value: unknown = JSON.parse(body);
+		if (isRecord(value)) {
+			if (isRecord(value.error) && typeof value.error.message === "string") message = value.error.message;
+			else if (typeof value.message === "string") message = value.message;
 		}
 	} catch {
 		// Plain-text error body.
@@ -96,70 +67,117 @@ function serverErrorMessage(body: string, token: string): string {
 	return message.replaceAll(token, "[redacted]").slice(0, MAX_ERROR_MESSAGE_LENGTH).trim();
 }
 
+export function detectImageMimeType(bytes: Buffer): GeneratedImage["mimeType"] | undefined {
+	if (
+		bytes.length >= 8 &&
+		bytes.subarray(0, 8).equals(Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]))
+	) {
+		return "image/png";
+	}
+	if (bytes.length >= 3 && bytes[0] === 0xff && bytes[1] === 0xd8 && bytes[2] === 0xff) return "image/jpeg";
+	if (
+		bytes.length >= 12 &&
+		bytes.subarray(0, 4).toString("ascii") === "RIFF" &&
+		bytes.subarray(8, 12).toString("ascii") === "WEBP"
+	) {
+		return "image/webp";
+	}
+	return undefined;
+}
+
 function decodeImageResponse(value: unknown): GeneratedImage {
-	if (!isRecord(value) || !Array.isArray(value.data) || value.data.length === 0 || !isRecord(value.data[0])) {
-		throw new Error("OpenAI Codex returned an invalid image response");
+	if (!isRecord(value) || !Array.isArray(value.data) || !isRecord(value.data[0])) {
+		throw new Error("xAI returned an invalid image response");
 	}
 	const encoded = value.data[0].b64_json;
-	if (typeof encoded !== "string" || !encoded.trim()) {
-		throw new Error("OpenAI Codex returned an invalid image response");
-	}
+	if (typeof encoded !== "string" || !encoded.trim()) throw new Error("xAI returned an invalid image response");
 	const base64 = encoded.trim();
 	if (!/^[A-Za-z0-9+/]*={0,2}$/.test(base64) || base64.length % 4 === 1) {
-		throw new Error("OpenAI Codex returned invalid base64 image data");
+		throw new Error("xAI returned invalid base64 image data");
 	}
 	const bytes = Buffer.from(base64, "base64");
 	if (bytes.toString("base64").replace(/=+$/, "") !== base64.replace(/=+$/, "")) {
-		throw new Error("OpenAI Codex returned invalid base64 image data");
-	}
-	if (bytes.length < PNG_SIGNATURE.length || !bytes.subarray(0, PNG_SIGNATURE.length).equals(PNG_SIGNATURE)) {
-		throw new Error("OpenAI Codex returned image data that is not PNG");
+		throw new Error("xAI returned invalid base64 image data");
 	}
-	return { bytes, base64: bytes.toString("base64"), mimeType: "image/png" };
+	const mimeType = detectImageMimeType(bytes);
+	if (!mimeType) throw new Error("xAI returned unsupported image data");
+	return { bytes, base64: bytes.toString("base64"), mimeType };
+}
+
+function retryable(status: number): boolean {
+	return status === 408 || status === 409 || status === 425 || status === 429 || status >= 500;
+}
+
+async function delay(milliseconds: number, signal?: AbortSignal): Promise<void> {
+	await new Promise<void>((resolve, reject) => {
+		const timeout = setTimeout(() => {
+			signal?.removeEventListener("abort", abort);
+			resolve();
+		}, milliseconds);
+		const abort = () => {
+			clearTimeout(timeout);
+			signal?.removeEventListener("abort", abort);
+			reject(signal?.reason ?? new DOMException("Aborted", "AbortError"));
+		};
+		if (signal?.aborted) abort();
+		else signal?.addEventListener("abort", abort, { once: true });
+	});
 }
 
 async function requestImage(
 	operation: "generation" | "edit",
 	body: Record<string, unknown>,
-	auth: CodexAuth,
-	signal: AbortSignal | undefined,
+	token: string,
+	signal?: AbortSignal,
 ): Promise<GeneratedImage> {
 	const route = operation === "generation" ? "generations" : "edits";
-	const response = (await fetch(`${CODEX_IMAGES_URL}/${route}`, {
-		method: "POST",
-		headers: {
-			Authorization: `Bearer ${auth.token}`,
-			"chatgpt-account-id": auth.accountId,
-			originator: "pi",
-			Accept: "application/json",
-			"Content-Type": "application/json",
-		},
-		body: JSON.stringify(body),
-		signal,
-	})) as FetchResponse;
-	if (!response.ok) {
-		const message = serverErrorMessage(await readBoundedError(response), auth.token);
-		throw new Error(`Image ${operation} failed with status ${response.status}${message ? `: ${message}` : ""}`);
-	}
-
-	let value: unknown;
-	try {
-		value = await response.json();
-	} catch {
-		throw new Error("OpenAI Codex returned a non-JSON image response");
+	for (let attempt = 1; attempt <= MAX_ATTEMPTS; attempt++) {
+		const requestSignal = signal
+			? AbortSignal.any([signal, AbortSignal.timeout(REQUEST_TIMEOUT_MS)])
+			: AbortSignal.timeout(REQUEST_TIMEOUT_MS);
+		let response: HttpResponse;
+		try {
+			response = (await fetch(`${XAI_API_BASE_URL}/images/${route}`, {
+				method: "POST",
+				headers: {
+					Accept: "application/json",
+					Authorization: `Bearer ${token}`,
+					"Content-Type": "application/json",
+				},
+				body: JSON.stringify(body),
+				signal: requestSignal,
+			})) as HttpResponse;
+		} catch (error) {
+			if (signal?.aborted) throw signal.reason;
+			if (attempt === MAX_ATTEMPTS) throw error;
+			await delay(RETRY_BASE_DELAY_MS * 2 ** (attempt - 1), signal);
+			continue;
+		}
+		if (response.ok) {
+			let value: unknown;
+			try {
+				value = await response.json();
+			} catch {
+				throw new Error("xAI returned a non-JSON image response");
+			}
+			return decodeImageResponse(value);
+		}
+		const message = serverErrorMessage(await boundedError(response), token);
+		if (!retryable(response.status) || attempt === MAX_ATTEMPTS) {
+			throw new Error(
+				`xAI image ${operation} failed with status ${response.status}${message ? `: ${message}` : ""}`,
+			);
+		}
+		await delay(RETRY_BASE_DELAY_MS * 2 ** (attempt - 1), signal);
 	}
-	return decodeImageResponse(value);
+	throw new Error(`xAI image ${operation} failed`);
 }
 
-export function generateImage(
-	prompt: string,
-	auth: CodexAuth,
-	signal: AbortSignal | undefined,
-): Promise<GeneratedImage> {
+export function generateImage(prompt: string, token: string, signal?: AbortSignal): Promise<GeneratedImage> {
 	return requestImage(
 		"generation",
-		{ prompt, model: MODEL, background: "auto", quality: "auto", size: "auto" },
-		auth,
+		{ model: XAI_IMAGE_MODEL, prompt, n: 1, resolution: "1k", response_format: "b64_json" },
+		token,
 		signal,
 	);
 }
@@ -167,20 +185,21 @@ export function generateImage(
 export function editImage(
 	prompt: string,
 	images: readonly EditImage[],
-	auth: CodexAuth,
-	signal: AbortSignal | undefined,
+	token: string,
+	signal?: AbortSignal,
 ): Promise<GeneratedImage> {
+	const references = images.map((image) => ({ url: `data:${image.mimeType};base64,${image.data}` }));
 	return requestImage(
 		"edit",
 		{
-			images: images.map((image) => ({ image_url: `data:${image.mimeType};base64,${image.data}` })),
+			model: XAI_IMAGE_MODEL,
 			prompt,
-			model: MODEL,
-			background: "auto",
-			quality: "auto",
-			size: "auto",
+			n: 1,
+			resolution: "1k",
+			response_format: "b64_json",
+			...(references.length === 1 ? { image: references[0] } : { images: references }),
 		},
-		auth,
+		token,
 		signal,
 	);
 }

package/extensions/image-gen/index.ts

@@ -2,22 +2,21 @@ import { defineTool, withFileMutationQueue, type ExtensionAPI } from "@earendil-
 import { randomUUID } from "node:crypto";
 import { link, mkdir, readFile, rm, stat, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
-import { basename, dirname, isAbsolute, join, resolve } from "node:path";
+import { basename, dirname, extname, isAbsolute, join, resolve } from "node:path";
 import { type Static, Type } from "typebox";
-import { editImage, generateImage, resolveCodexAuth, type EditImage } from "./client.ts";
+import { XAI_IMAGE_MODEL, XAI_PROVIDER } from "../xai/constants.ts";
+import { detectImageMimeType, editImage, generateImage, type EditImage, type GeneratedImage } from "./client.ts";
 
-const MODEL = "gpt-image-2";
 const MAX_INPUT_BYTES = 50 * 1024 * 1024;
 const MAX_INLINE_BYTES = 12 * 1024 * 1024;
-const PNG_SIGNATURE = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);
 
 const imageGenSchema = Type.Object(
 	{
 		prompt: Type.String({ minLength: 1 }),
 		path: Type.Optional(
-			Type.String({ description: "Explicit PNG destination path; defaults to Tau's external image store" }),
+			Type.String({ description: "Explicit image destination path; defaults to Tau's external image store" }),
 		),
-		referenced_image_paths: Type.Optional(Type.Array(Type.String({ minLength: 1 }), { minItems: 1, maxItems: 5 })),
+		referenced_image_paths: Type.Optional(Type.Array(Type.String({ minLength: 1 }), { minItems: 1, maxItems: 3 })),
 	},
 	{ additionalProperties: false },
 );
@@ -26,23 +25,14 @@ type ImageGenParams = Static<typeof imageGenSchema>;
 
 interface ImageGenDetails {
 	path: string;
-	model: typeof MODEL;
+	model: typeof XAI_IMAGE_MODEL;
 	operation: "generate" | "edit";
 }
 
-function detectImageMimeType(bytes: Buffer): EditImage["mimeType"] | undefined {
-	if (bytes.length >= PNG_SIGNATURE.length && bytes.subarray(0, PNG_SIGNATURE.length).equals(PNG_SIGNATURE)) {
-		return "image/png";
-	}
-	if (bytes.length >= 3 && bytes[0] === 0xff && bytes[1] === 0xd8 && bytes[2] === 0xff) return "image/jpeg";
-	if (
-		bytes.length >= 12 &&
-		bytes.subarray(0, 4).toString("ascii") === "RIFF" &&
-		bytes.subarray(8, 12).toString("ascii") === "WEBP"
-	) {
-		return "image/webp";
-	}
-	return undefined;
+function outputExtension(image: GeneratedImage): string {
+	if (image.mimeType === "image/png") return ".png";
+	if (image.mimeType === "image/webp") return ".webp";
+	return ".jpg";
 }
 
 export default function imageGenExtension(pi: ExtensionAPI): void {
@@ -51,12 +41,12 @@ export default function imageGenExtension(pi: ExtensionAPI): void {
 			name: "image_gen",
 			label: "Image Generation",
 			description:
-				"Generate a new raster image from a prompt, or edit one to five local raster images. Uses the existing OpenAI Codex OAuth login, saves a PNG under Tau's external image store unless an explicit path is provided, and returns the image for inspection.",
-			promptSnippet: "Generate or edit raster images with OpenAI Codex",
+				"Generate a new raster image from a prompt, or edit one to three local raster images. Uses the xAI Grok subscription OAuth login, saves the result under Tau's external image store unless an explicit path is provided, and returns the image for inspection.",
+			promptSnippet: "Generate or edit raster images with Grok Imagine",
 			promptGuidelines: [
 				"Use image_gen when the user asks for a generated raster image or an AI edit of local raster images.",
 				"Omit referenced_image_paths when image_gen should create a new image.",
-				"Pass one to five local paths in referenced_image_paths when image_gen should edit or compose existing images.",
+				"Pass one to three local paths in referenced_image_paths when image_gen should edit or compose existing images.",
 				"Omit path for temporary external storage. Pass path only when the user wants the generated image saved in their repository or another explicit location.",
 			],
 			parameters: imageGenSchema,
@@ -66,18 +56,22 @@ export default function imageGenExtension(pi: ExtensionAPI): void {
 				if (!prompt) throw new Error("Image prompt cannot be empty");
 				const requestedPath = params.path?.startsWith("@") ? params.path.slice(1) : params.path;
 				if (requestedPath !== undefined && !requestedPath.trim()) throw new Error("Image path cannot be empty");
-				const absolutePath = requestedPath
+				const requestedAbsolutePath = requestedPath
 					? isAbsolute(requestedPath)
 						? requestedPath
 						: resolve(ctx.cwd, requestedPath)
-					: join(homedir(), ".local", "share", "tau-agent", "images", `image-${randomUUID()}.png`);
-				if (!absolutePath.toLowerCase().endsWith(".png")) throw new Error("Image path must end in .png");
+					: undefined;
+				if (
+					requestedAbsolutePath &&
+					![".jpg", ".jpeg", ".png", ".webp"].includes(extname(requestedAbsolutePath).toLowerCase())
+				) {
+					throw new Error("Image path must end in .jpg, .jpeg, .png, or .webp");
+				}
 
-				const token = await ctx.modelRegistry.getApiKeyForProvider("openai-codex");
+				const token = await ctx.modelRegistry.getApiKeyForProvider(XAI_PROVIDER);
 				if (!token) {
-					throw new Error("OpenAI Codex OAuth is unavailable. Run /login and select OpenAI Codex.");
+					throw new Error("xAI OAuth is unavailable. Run /login and select xAI (Grok subscription OAuth).");
 				}
-				const auth = resolveCodexAuth(token);
 				const images: EditImage[] = [];
 				for (const path of params.referenced_image_paths ?? []) {
 					const rawPath = path.startsWith("@") ? path.slice(1) : path;
@@ -101,22 +95,37 @@ export default function imageGenExtension(pi: ExtensionAPI): void {
 							type: "text",
 							text:
 								operation === "generate"
-									? `Generating image with ${MODEL}...`
-									: `Editing image with ${MODEL}...`,
+									? `Generating image with ${XAI_IMAGE_MODEL}...`
+									: `Editing image with ${XAI_IMAGE_MODEL}...`,
 						},
 					],
 					details: undefined,
 				});
 				const generated =
 					operation === "generate"
-						? await generateImage(prompt, auth, signal)
-						: await editImage(prompt, images, auth, signal);
+						? await generateImage(prompt, token, signal)
+						: await editImage(prompt, images, token, signal);
 				signal?.throwIfAborted();
+				const generatedExtension = outputExtension(generated);
+				if (requestedAbsolutePath) {
+					const requestedExtension = extname(requestedAbsolutePath).toLowerCase();
+					const matches =
+						requestedExtension === generatedExtension ||
+						(generatedExtension === ".jpg" && requestedExtension === ".jpeg");
+					if (!matches)
+						throw new Error(`xAI returned ${generated.mimeType}; destination must end in ${generatedExtension}`);
+				}
+				const absolutePath =
+					requestedAbsolutePath ??
+					join(homedir(), ".local", "share", "tau-agent", "images", `image-${randomUUID()}${generatedExtension}`);
 
 				const outputDirectory = dirname(absolutePath);
 				await withFileMutationQueue(absolutePath, async () => {
 					await mkdir(outputDirectory, { recursive: true });
-					const temporaryPath = join(outputDirectory, `.${basename(absolutePath)}.${randomUUID()}.tmp.png`);
+					const temporaryPath = join(
+						outputDirectory,
+						`.${basename(absolutePath)}.${randomUUID()}.tmp${generatedExtension}`,
+					);
 					try {
 						await writeFile(temporaryPath, generated.bytes, { flag: "wx" });
 						signal?.throwIfAborted();
@@ -127,7 +136,7 @@ export default function imageGenExtension(pi: ExtensionAPI): void {
 				});
 
 				const verb = operation === "generate" ? "Generated" : "Edited";
-				const details: ImageGenDetails = { path: absolutePath, model: MODEL, operation };
+				const details: ImageGenDetails = { path: absolutePath, model: XAI_IMAGE_MODEL, operation };
 				if (generated.bytes.length > MAX_INLINE_BYTES) {
 					return {
 						content: [

package/extensions/tau-help/help.md

@@ -46,6 +46,10 @@ Adds `/ideas` to log rough ideas or open the ideas browser.
 
 Gives the agent an image-generation tool using the configured image service. Generated images are saved for inspection.
 
+## xai
+
+Adds Grok 4.5 and Grok Imagine through an xAI Grok subscription OAuth login. Run `/login` and select xAI before use.
+
 ## manage-sessions
 
 Adds `/manage-sessions` to browse saved sessions and `/sweep` to archive or delete the current session after starting a new one.

package/extensions/xai/README.md

@@ -0,0 +1,7 @@
+# xAI OAuth
+
+Adds Grok 4.5 using an xAI Grok subscription login. Run `/login`, select **xAI (Grok subscription OAuth)**, then authorize xAI in the browser. An existing official Grok CLI login can also be reused.
+
+The same login powers Tau's `image_gen` tool through Grok Imagine. No xAI API key is used.
+
+This integration uses xAI's undocumented subscription OAuth access. xAI may change its availability, entitlement rules, or protocol without notice.

package/extensions/xai/auth.ts

@@ -0,0 +1,40 @@
+import type { OAuthCredentials } from "@earendil-works/pi-ai";
+import { readFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { XAI_OAUTH_CLIENT_ID, XAI_OAUTH_ISSUER } from "./constants.ts";
+
+function expiry(value: unknown): number | undefined {
+	if (typeof value === "number" && Number.isInteger(value) && value >= 1_000_000_000_000) return value;
+	if (typeof value !== "string") return undefined;
+	const parsed = Date.parse(value);
+	return Number.isFinite(parsed) ? parsed : undefined;
+}
+
+export function parseGrokCredentials(value: unknown): OAuthCredentials | undefined {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return undefined;
+	const entry = (value as Record<string, unknown>)[`${XAI_OAUTH_ISSUER}::${XAI_OAUTH_CLIENT_ID}`];
+	if (typeof entry !== "object" || entry === null || Array.isArray(entry)) return undefined;
+	const record = entry as Record<string, unknown>;
+	const expires = expiry(record.expires_at);
+	if (
+		typeof record.key !== "string" ||
+		!record.key ||
+		typeof record.refresh_token !== "string" ||
+		!record.refresh_token ||
+		record.oidc_issuer !== XAI_OAUTH_ISSUER ||
+		record.oidc_client_id !== XAI_OAUTH_CLIENT_ID ||
+		expires === undefined
+	) {
+		return undefined;
+	}
+	return { access: record.key, refresh: record.refresh_token, expires };
+}
+
+export async function readGrokCredentials(): Promise<OAuthCredentials | undefined> {
+	try {
+		return parseGrokCredentials(JSON.parse(await readFile(join(homedir(), ".grok", "auth.json"), "utf8")));
+	} catch {
+		return undefined;
+	}
+}

package/extensions/xai/constants.ts

@@ -0,0 +1,11 @@
+export const XAI_PROVIDER = "xai-oauth";
+export const XAI_CHAT_MODEL = "grok-4.5";
+export const XAI_IMAGE_MODEL = "grok-imagine-image-quality";
+export const XAI_API_BASE_URL = "https://api.x.ai/v1";
+
+export const XAI_OAUTH_ISSUER = "https://auth.x.ai";
+export const XAI_OAUTH_CLIENT_ID = "b1a00492-073a-47ea-816f-4c329264a828";
+export const XAI_OAUTH_SCOPE = "openid profile email offline_access grok-cli:access api:access";
+export const XAI_OAUTH_CALLBACK_HOST = "127.0.0.1";
+export const XAI_OAUTH_CALLBACK_PORT = 56121;
+export const XAI_OAUTH_CALLBACK_PATH = "/callback";

package/extensions/xai/index.ts

@@ -0,0 +1,38 @@
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import { XAI_API_BASE_URL, XAI_CHAT_MODEL, XAI_PROVIDER } from "./constants.ts";
+import { xaiOAuth } from "./oauth.ts";
+import { rewriteXaiPayload } from "./payload.ts";
+
+export default function xaiExtension(pi: ExtensionAPI): void {
+	pi.registerProvider(XAI_PROVIDER, {
+		name: "xAI (Grok subscription OAuth)",
+		baseUrl: XAI_API_BASE_URL,
+		api: "openai-responses",
+		authHeader: true,
+		oauth: xaiOAuth,
+		models: [
+			{
+				id: XAI_CHAT_MODEL,
+				name: "Grok 4.5",
+				reasoning: true,
+				input: ["text", "image"],
+				cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+				contextWindow: 500_000,
+				maxTokens: 131_072,
+				thinkingLevelMap: {
+					off: null,
+					minimal: "low",
+					low: "low",
+					medium: "medium",
+					high: "high",
+					xhigh: null,
+					max: null,
+				},
+			},
+		],
+	});
+	pi.on("before_provider_request", (event, ctx) => {
+		if (ctx.model?.provider !== XAI_PROVIDER) return;
+		return rewriteXaiPayload(event.payload);
+	});
+}

package/extensions/xai/oauth.ts

@@ -0,0 +1,342 @@
+import type { OAuthCredentials, OAuthLoginCallbacks } from "@earendil-works/pi-ai";
+import { createHash, randomBytes } from "node:crypto";
+import { createServer, type Server } from "node:http";
+import { readGrokCredentials } from "./auth.ts";
+import {
+	XAI_OAUTH_CALLBACK_HOST,
+	XAI_OAUTH_CALLBACK_PATH,
+	XAI_OAUTH_CALLBACK_PORT,
+	XAI_OAUTH_CLIENT_ID,
+	XAI_OAUTH_ISSUER,
+	XAI_OAUTH_SCOPE,
+} from "./constants.ts";
+
+const DISCOVERY_URL = `${XAI_OAUTH_ISSUER}/.well-known/openid-configuration`;
+const REQUEST_TIMEOUT_MS = 30_000;
+const LOGIN_TIMEOUT_MS = 180_000;
+const REFRESH_SKEW_MS = 120_000;
+
+interface Discovery {
+	authorization_endpoint: string;
+	token_endpoint: string;
+}
+
+interface TokenPayload {
+	access_token?: unknown;
+	refresh_token?: unknown;
+	id_token?: unknown;
+	expires_in?: unknown;
+	token_type?: unknown;
+}
+
+interface HttpResponse {
+	ok: boolean;
+	status: number;
+	body: { cancel(): Promise<void> } | null;
+	json(): Promise<unknown>;
+}
+
+interface CallbackResult {
+	code?: string;
+	error?: string;
+	errorDescription?: string;
+}
+
+function validatedEndpoint(value: unknown, field: string): string {
+	if (typeof value !== "string") throw new Error(`xAI OAuth discovery omitted ${field}`);
+	const url = new URL(value);
+	const host = url.hostname.toLowerCase();
+	if (url.protocol !== "https:" || (host !== "x.ai" && !host.endsWith(".x.ai"))) {
+		throw new Error(`xAI OAuth discovery returned an unexpected ${field}`);
+	}
+	return url.toString();
+}
+
+function requestSignal(parent?: AbortSignal): AbortSignal {
+	const timeout = AbortSignal.timeout(REQUEST_TIMEOUT_MS);
+	return parent ? AbortSignal.any([parent, timeout]) : timeout;
+}
+
+async function discover(signal?: AbortSignal): Promise<Discovery> {
+	const response = (await fetch(DISCOVERY_URL, {
+		headers: { Accept: "application/json" },
+		signal: requestSignal(signal),
+	})) as HttpResponse;
+	if (!response.ok) throw new Error(`xAI OAuth discovery failed with status ${response.status}`);
+	const value: unknown = await response.json();
+	if (typeof value !== "object" || value === null || Array.isArray(value)) {
+		throw new Error("xAI OAuth discovery returned invalid JSON");
+	}
+	const record = value as Record<string, unknown>;
+	return {
+		authorization_endpoint: validatedEndpoint(record.authorization_endpoint, "authorization_endpoint"),
+		token_endpoint: validatedEndpoint(record.token_endpoint, "token_endpoint"),
+	};
+}
+
+async function tokenRequest(endpoint: string, body: URLSearchParams, signal?: AbortSignal): Promise<TokenPayload> {
+	const response = (await fetch(validatedEndpoint(endpoint, "token_endpoint"), {
+		method: "POST",
+		headers: { Accept: "application/json", "Content-Type": "application/x-www-form-urlencoded" },
+		body,
+		signal: requestSignal(signal),
+	})) as HttpResponse;
+	if (!response.ok) {
+		await response.body?.cancel().catch(() => undefined);
+		throw new Error(`xAI OAuth token request failed with status ${response.status}`);
+	}
+	return (await response.json()) as TokenPayload;
+}
+
+function jwtClaims(token: string): Record<string, unknown> {
+	const segments = token.split(".");
+	if (segments.length !== 3 || !segments[1]) throw new Error("xAI OAuth returned an invalid ID token");
+	try {
+		const value: unknown = JSON.parse(Buffer.from(segments[1], "base64url").toString("utf8"));
+		if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error();
+		return value as Record<string, unknown>;
+	} catch {
+		throw new Error("xAI OAuth returned an invalid ID token");
+	}
+}
+
+function credentials(payload: TokenPayload, endpoint: string, fallbackRefresh = "", nonce?: string): OAuthCredentials {
+	if (typeof payload.access_token !== "string" || !payload.access_token) {
+		throw new Error("xAI OAuth token response omitted the access token");
+	}
+	const refresh =
+		typeof payload.refresh_token === "string" && payload.refresh_token ? payload.refresh_token : fallbackRefresh;
+	if (!refresh) throw new Error("xAI OAuth token response omitted the refresh token");
+	if (nonce !== undefined) {
+		if (typeof payload.id_token !== "string" || !payload.id_token)
+			throw new Error("xAI OAuth token response omitted the ID token");
+		const claims = jwtClaims(payload.id_token);
+		const audience = claims.aud;
+		const validAudience =
+			audience === XAI_OAUTH_CLIENT_ID || (Array.isArray(audience) && audience.includes(XAI_OAUTH_CLIENT_ID));
+		if (claims.iss !== XAI_OAUTH_ISSUER || !validAudience || claims.nonce !== nonce) {
+			throw new Error("xAI OAuth ID token validation failed");
+		}
+		if (typeof claims.exp !== "number" || claims.exp * 1000 <= Date.now()) {
+			throw new Error("xAI OAuth returned an expired ID token");
+		}
+	}
+	const expiresIn = typeof payload.expires_in === "number" && payload.expires_in > 0 ? payload.expires_in : 3600;
+	return {
+		access: payload.access_token,
+		refresh,
+		expires: Date.now() + expiresIn * 1000 - REFRESH_SKEW_MS,
+		tokenEndpoint: endpoint,
+	};
+}
+
+async function closeServer(server: Server): Promise<void> {
+	if (!server.listening) return;
+	await new Promise<void>((resolve) => server.close(() => resolve()));
+}
+
+async function callbackServer(expectedState: string): Promise<{
+	redirectUri: string;
+	wait(signal?: AbortSignal): Promise<CallbackResult>;
+	acceptManual(input: string): string | undefined;
+	close(): Promise<void>;
+}> {
+	let settle: ((result: CallbackResult) => void) | undefined;
+	let reject: ((error: Error) => void) | undefined;
+	let settled = false;
+	const result = new Promise<CallbackResult>((resolve, rejectResult) => {
+		settle = resolve;
+		reject = rejectResult;
+	});
+	const accept = (value: CallbackResult) => {
+		if (settled) return;
+		settled = true;
+		settle?.(value);
+	};
+	const parse = (params: URLSearchParams): CallbackResult | undefined => {
+		if (params.get("state") !== expectedState) return undefined;
+		const code = params.get("code") || undefined;
+		const error = params.get("error") || undefined;
+		if (!code && !error) return undefined;
+		return { code, error, errorDescription: params.get("error_description") || undefined };
+	};
+	const server = createServer((request, response) => {
+		const origin = request.headers.origin;
+		if (origin === "https://accounts.x.ai" || origin === "https://auth.x.ai") {
+			response.setHeader("Access-Control-Allow-Origin", origin);
+			response.setHeader("Access-Control-Allow-Methods", "GET, OPTIONS");
+			response.setHeader("Access-Control-Allow-Headers", "Content-Type");
+			response.setHeader("Access-Control-Allow-Private-Network", "true");
+			response.setHeader("Vary", "Origin");
+		}
+		if (request.method === "OPTIONS") {
+			response.writeHead(204).end();
+			return;
+		}
+		const url = new URL(request.url ?? "/", `http://${XAI_OAUTH_CALLBACK_HOST}`);
+		if (request.method !== "GET" || url.pathname !== XAI_OAUTH_CALLBACK_PATH) {
+			response.writeHead(404).end("Not found");
+			return;
+		}
+		const parsed = parse(url.searchParams);
+		if (!parsed) {
+			response.writeHead(400, { "Content-Type": "text/plain; charset=utf-8" }).end("Invalid OAuth callback");
+			return;
+		}
+		response
+			.writeHead(parsed.error ? 400 : 200, { "Content-Type": "text/html; charset=utf-8" })
+			.end("<html><body><h1>xAI authorization received.</h1>You can close this tab.</body></html>", () =>
+				accept(parsed),
+			);
+	});
+	const listen = (port: number) =>
+		new Promise<number>((resolve, rejectListen) => {
+			server.once("error", rejectListen);
+			server.listen(port, XAI_OAUTH_CALLBACK_HOST, () => {
+				server.removeListener("error", rejectListen);
+				const address = server.address();
+				if (!address || typeof address === "string") rejectListen(new Error("Could not determine callback port"));
+				else resolve(address.port);
+			});
+		});
+	let port: number;
+	try {
+		port = await listen(XAI_OAUTH_CALLBACK_PORT);
+	} catch {
+		port = await listen(0);
+	}
+	return {
+		redirectUri: `http://${XAI_OAUTH_CALLBACK_HOST}:${port}${XAI_OAUTH_CALLBACK_PATH}`,
+		acceptManual(input) {
+			try {
+				const value = input.trim();
+				const url = value.startsWith("http")
+					? new URL(value)
+					: new URL(`http://${XAI_OAUTH_CALLBACK_HOST}${XAI_OAUTH_CALLBACK_PATH}?${value.replace(/^\?/, "")}`);
+				if (url.pathname !== XAI_OAUTH_CALLBACK_PATH) return "Callback URL path was not recognized";
+				const parsed = parse(url.searchParams);
+				if (!parsed) return "Callback state did not match";
+				accept(parsed);
+				return undefined;
+			} catch {
+				return "Callback URL was invalid";
+			}
+		},
+		async wait(signal) {
+			const timeout = setTimeout(() => {
+				if (!settled) {
+					settled = true;
+					reject?.(new Error("Timed out waiting for xAI OAuth callback"));
+				}
+			}, LOGIN_TIMEOUT_MS);
+			const onAbort = () => {
+				if (!settled) {
+					settled = true;
+					reject?.(new Error("xAI OAuth login was cancelled"));
+				}
+			};
+			signal?.addEventListener("abort", onAbort, { once: true });
+			try {
+				return await result;
+			} finally {
+				clearTimeout(timeout);
+				signal?.removeEventListener("abort", onAbort);
+				await closeServer(server);
+			}
+		},
+		close: () => closeServer(server),
+	};
+}
+
+async function refreshXaiCredentials(value: OAuthCredentials): Promise<OAuthCredentials> {
+	if (!value.refresh) throw new Error("xAI OAuth credential cannot be refreshed; run /login again");
+	const endpoint =
+		typeof value.tokenEndpoint === "string" && value.tokenEndpoint
+			? validatedEndpoint(value.tokenEndpoint, "token_endpoint")
+			: (await discover()).token_endpoint;
+	const payload = await tokenRequest(
+		endpoint,
+		new URLSearchParams({
+			grant_type: "refresh_token",
+			client_id: XAI_OAUTH_CLIENT_ID,
+			refresh_token: value.refresh,
+		}),
+	);
+	return credentials(payload, endpoint, value.refresh);
+}
+
+export const xaiOAuth = {
+	name: "xAI (Grok subscription)",
+	usesCallbackServer: true,
+	async login(callbacks: OAuthLoginCallbacks): Promise<OAuthCredentials> {
+		const existing = await readGrokCredentials();
+		if (existing) {
+			const method = await callbacks.onSelect({
+				message: "Select xAI login method:",
+				options: [
+					{ id: "browser", label: "Browser login" },
+					{ id: "existing", label: "Use existing Grok CLI login" },
+				],
+			});
+			if (!method) throw new Error("Login cancelled");
+			if (method === "existing") {
+				if (existing.expires > Date.now()) return existing;
+				try {
+					return await refreshXaiCredentials(existing);
+				} catch {
+					callbacks.onProgress?.("The existing Grok CLI login could not be refreshed. Starting browser login.");
+				}
+			}
+		}
+		const discovery = await discover(callbacks.signal);
+		const verifier = randomBytes(32).toString("base64url");
+		const challenge = createHash("sha256").update(verifier).digest("base64url");
+		const state = randomBytes(24).toString("base64url");
+		const nonce = randomBytes(24).toString("base64url");
+		const callback = await callbackServer(state);
+		try {
+			const url = new URL(discovery.authorization_endpoint);
+			url.search = new URLSearchParams({
+				response_type: "code",
+				client_id: XAI_OAUTH_CLIENT_ID,
+				redirect_uri: callback.redirectUri,
+				scope: XAI_OAUTH_SCOPE,
+				code_challenge: challenge,
+				code_challenge_method: "S256",
+				state,
+				nonce,
+			}).toString();
+			callbacks.onAuth({ url: url.toString(), instructions: "Authorize xAI in your browser, then return to Tau." });
+			if (callbacks.onManualCodeInput) {
+				void callbacks
+					.onManualCodeInput()
+					.then((input) => {
+						const error = callback.acceptManual(input);
+						if (error) callbacks.onProgress?.(`Ignored pasted callback: ${error}`);
+					})
+					.catch(() => undefined);
+			}
+			const result = await callback.wait(callbacks.signal);
+			if (result.error) throw new Error(`xAI authorization failed: ${result.errorDescription ?? result.error}`);
+			if (!result.code) throw new Error("xAI authorization did not return a code");
+			const payload = await tokenRequest(
+				discovery.token_endpoint,
+				new URLSearchParams({
+					grant_type: "authorization_code",
+					client_id: XAI_OAUTH_CLIENT_ID,
+					code: result.code,
+					redirect_uri: callback.redirectUri,
+					code_verifier: verifier,
+				}),
+				callbacks.signal,
+			);
+			return credentials(payload, discovery.token_endpoint, "", nonce);
+		} finally {
+			await callback.close();
+		}
+	},
+	refreshToken: refreshXaiCredentials,
+	getApiKey(value: OAuthCredentials): string {
+		return value.access;
+	},
+};

package/extensions/xai/payload.ts

@@ -0,0 +1,68 @@
+function isRecord(value: unknown): value is Record<string, unknown> {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function contentText(value: unknown): string {
+	if (typeof value === "string") return value;
+	if (!Array.isArray(value)) return "";
+	return value
+		.map((part) => {
+			if (!isRecord(part)) return "";
+			return typeof part.text === "string" ? part.text : "";
+		})
+		.filter(Boolean)
+		.join("\n");
+}
+
+function normalizeToolOutput(item: Record<string, unknown>): unknown[] {
+	if (item.type !== "function_call_output" || !Array.isArray(item.output)) return [item];
+	const images = item.output.filter((part) => isRecord(part) && part.type === "input_image");
+	if (images.length === 0) return [item];
+	const text = contentText(item.output) || "(tool returned image output)";
+	return [
+		{ ...item, output: text },
+		{
+			role: "user",
+			content: [
+				{ type: "input_text", text: "The previous tool result included image output. Use the attached image." },
+				...images,
+			],
+		},
+	];
+}
+
+export function rewriteXaiPayload(value: unknown): unknown {
+	if (!isRecord(value)) return value;
+	const body = { ...value };
+	delete body.prompt_cache_retention;
+	if (isRecord(body.reasoning)) {
+		const effort = body.reasoning.effort;
+		body.reasoning =
+			typeof effort === "string" && effort !== "none"
+				? { effort: effort === "minimal" ? "low" : effort }
+				: undefined;
+	}
+	if (Array.isArray(body.input)) {
+		const instructions: string[] = [];
+		const input: unknown[] = [];
+		for (const raw of body.input) {
+			if (!isRecord(raw)) {
+				input.push(raw);
+				continue;
+			}
+			if ((raw.role === "developer" || raw.role === "system") && input.length === 0) {
+				const text = contentText(raw.content).trim();
+				if (text) instructions.push(text);
+				continue;
+			}
+			input.push(...normalizeToolOutput(raw));
+		}
+		body.input = input;
+		if (instructions.length > 0) {
+			body.instructions = [typeof body.instructions === "string" ? body.instructions : "", ...instructions]
+				.filter(Boolean)
+				.join("\n\n");
+		}
+	}
+	return body;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@shanepadgett/tau-agent",
-	"version": "0.6.0",
+	"version": "0.7.0",
 	"description": "Tau is a custom agentic harness built with pi extensions",
 	"type": "module",
 	"license": "MIT",
@@ -28,7 +28,7 @@
 		"README.md"
 	],
 	"dependencies": {
-		"@shanepadgett/tau-tui": "0.6.0",
+		"@shanepadgett/tau-tui": "0.7.0",
 		"@toon-format/toon": "2.3.0",
 		"smol-toml": "1.7.0"
 	},

package/shared/model-fallback/index.ts

@@ -10,21 +10,23 @@ const MAX_ATTEMPTS = 5;
 const MAX_TOOL_ATTEMPTS = 2;
 const SEVEN_DAYS_MS = 604_800_000;
 
-const PREFERRED_MODELS: ReadonlyArray<{ provider: string; model: string; reasoning: ThinkingLevel }> = [
-	{ provider: "openrouter", model: "cohere/north-mini-code:free", reasoning: "high" },
-	{ provider: "github-copilot", model: "gemini-3.5-flash", reasoning: "high" },
-	{ provider: "openai-codex", model: "gpt-5.4-mini", reasoning: "high" },
-	{ provider: "anthropic", model: "claude-haiku-4-5", reasoning: "high" },
-];
-
 interface GenerationContext {
 	ui: ExtensionContext["ui"];
 	signal: AbortSignal | undefined;
+	sessionManager?: { getSessionId(): string };
+}
+
+interface ModelFallbackOptions {
+	statusKey?: string;
+	notifyOnFallback?: boolean;
+	maxAttempts?: number;
+	onStatus?: (status: string) => void | Promise<void>;
 }
 
 export async function resolveCandidates(
 	ctx: Pick<ExtensionContext, "modelRegistry" | "model" | "cwd" | "isProjectTrusted">,
-	preferredModels: ReadonlyArray<{ provider: string; model: string; reasoning: ThinkingLevel }> = PREFERRED_MODELS,
+	preferredModels: ReadonlyArray<{ provider: string; model: string; reasoning: ThinkingLevel }>,
+	includeParentModel: boolean,
 ): Promise<ModelCandidate[]> {
 	const settings = await loadTauExtensionSettings(ctx, modelFallbackSettings);
 	const candidates: ModelCandidate[] = [];
@@ -47,7 +49,7 @@ export async function resolveCandidates(
 		const model = ctx.modelRegistry.find(preferred.provider, preferred.model);
 		if (model) await add(model, preferred.reasoning);
 	}
-	if (ctx.model) await add(ctx.model, undefined);
+	if (includeParentModel && ctx.model) await add(ctx.model, undefined);
 
 	if (candidates.length === 0) throw new Error("No authenticated model available for generation.");
 	return candidates;
@@ -59,7 +61,7 @@ export async function generateValidated<T>(
 	prompt: string,
 	validate: (text: string) => T,
 	correctionPrompt?: (error: Error, text: string) => string,
-	options?: { statusKey?: string; notifyOnFallback?: boolean },
+	options?: ModelFallbackOptions,
 ): Promise<T> {
 	return withModelFallback(ctx, candidates, options, (candidate) =>
 		requestValidated(ctx, candidate, prompt, validate, correctionPrompt),
@@ -73,7 +75,7 @@ export async function generateToolValidated<T>(
 	tool: Tool,
 	validate: (input: unknown) => T,
 	correctionPrompt?: (error: Error, output: string) => string,
-	options?: { statusKey?: string; notifyOnFallback?: boolean; maxAttempts?: number },
+	options?: ModelFallbackOptions,
 ): Promise<T> {
 	return withModelFallback(ctx, candidates, options, (candidate) =>
 		requestToolValidated(
@@ -91,7 +93,7 @@ export async function generateToolValidated<T>(
 async function withModelFallback<T>(
 	ctx: GenerationContext,
 	candidates: readonly ModelCandidate[],
-	options: { statusKey?: string; notifyOnFallback?: boolean } | undefined,
+	options: ModelFallbackOptions | undefined,
 	request: (candidate: ModelCandidate) => Promise<T>,
 ): Promise<T> {
 	const failures: string[] = [];
@@ -101,6 +103,7 @@ async function withModelFallback<T>(
 	for (const [index, candidate] of candidates.entries()) {
 		const label = `${candidate.model.provider}/${candidate.model.id}`;
 		if (statusKey) ctx.ui.setStatus(statusKey, `generating (${label})`);
+		await options?.onStatus?.(`Generating with ${label}`);
 
 		try {
 			return await request(candidate);
@@ -109,6 +112,7 @@ async function withModelFallback<T>(
 			if (shouldCooldownProvider(error)) await markProviderUnavailable(candidate.model.provider);
 			const message = errorText(error);
 			failures.push(`- ${label}: ${message}`);
+			if (index < candidates.length - 1) await options?.onStatus?.(`Model failed (${label}); trying next model`);
 			if (index < candidates.length - 1 && notifyOnFallback) {
 				ctx.ui.notify(`Model failed (${label}): ${message}\nTrying next model.`, "info");
 			}
@@ -209,6 +213,7 @@ function completeCandidate(
 		headers: candidate.headers,
 		signal: ctx.signal,
 		reasoning: candidate.reasoning,
+		sessionId: ctx.sessionManager?.getSessionId(),
 	});
 }