@visual-z/xeno 0.3.0 → 0.5.0

package/src/runtime/loop.ts

@@ -25,7 +25,7 @@ import type { Handoff } from "../core/handoff.ts";
 import { boundHandoff, DEFAULT_HANDOFF_TOKENS } from "../core/history.ts";
 import { boundaryPreparation, continuationGuidance } from "../core/continuation.ts";
 import type { FrozenPrefix, Message, ProjectInput } from "../core/project.ts";
-import { projectContext, PROJECTION_VERSION } from "../core/project.ts";
+import { projectContext, PROJECTION_VERSION, toolCallIdentityViolations } from "../core/project.ts";
 import { deriveHandoff, carryForward } from "../core/derive.ts";
 import { latestObservedFileVersion } from "../core/file-precondition.ts";
 import { latestProcessReceipt } from "../core/process-receipt.ts";
@@ -59,7 +59,8 @@ import { branchStatus, processStatus, deriveProcesses, type ProcessObservation }
 import { schedulingWindow } from "../core/scheduling.ts";
 import { estimateTokens, anchoredCount, scaledCounter, type TokenCounter, type Anchor } from "../core/tokens.ts";
 import { isContextOverflow } from "../core/overflow.ts";
-import { completionReview } from "../core/completion-review.ts";
+import { requestCompletion } from "../core/completion-review.ts";
+import { deriveRequestState, type RequestState } from "../core/request-state.ts";
 import { churnReview } from "../core/churn.ts";
 import { deriveBranchReceipt } from "../core/branch-receipt.ts";
 import { skillTools, type Skill } from "../core/skills.ts";
@@ -78,7 +79,7 @@ import { recoverCut } from "../store/recovery.ts";
 import { runHistoryTool } from "./history-tools.ts";
 import { prepareWorkingNote } from "./working-notes.ts";
 import { copyAncestryTo } from "../store/sessions.ts";
-import type { Provider, Turn, StreamDelta } from "./provider.ts";
+import { FailedResponseError, type Provider, type Turn, type StreamDelta } from "./provider.ts";
 import {
   scanWorkspace, diffScans, reconcile, DEFAULT_IGNORE, workspaceVersion,
   type FileSet, type RestoreResult,
@@ -150,6 +151,8 @@ export interface LoopEvent {
   /** branch_start: wall-clock milliseconds, for asserting the stagger. */
   at?: number;
   outcome?: ExecutionOutcome;
+  /** Q23: task evidence is separate from the execution outcome; rebuilt from original receipts. */
+  request?: RequestState;
   progress?: Extract<StreamDelta, { kind: "tool" | "retry" }> | { kind: "output"; text: string; name: string };
 }
 
@@ -331,6 +334,7 @@ type DeferredToolResult = ToolResult & { accept?: () => Promise<LoopEvent[]>; an
 type ToolCall = Extract<AssistantBlock, { type: "tool_use" }>;
 type SessionBrokerReceipt = BrokerReceipt<DeferredToolResult> & { events: LoopEvent[] };
 type PreparedBrokerCall = { run(emit?: (event: LoopEvent) => void): Promise<SessionBrokerReceipt> };
+export type CommittedItem = { node: number; id: string; type: LogEvent["t"] };
 
 export class Session {
   private readonly execOwner = randomUUID();
@@ -349,6 +353,7 @@ export class Session {
   private pendingAdoption: number | null = null;
   private readonly allocatedEventIds = new Set<string>();
   private recordTail: Promise<void> = Promise.resolve();
+  private readonly recordListeners = new Set<(item: CommittedItem) => void>();
   readonly config: SessionConfig;
   /**
    * Replaced by switchModel. Not readonly: a live session can change which
@@ -426,9 +431,17 @@ export class Session {
   }
 
   private async observeEvidence(): Promise<void> {
-    const proof = this.state.events.findLast(event => event.t === "tool_result" && event.effect?.kind === "command");
-    const prior = proof?.t === "tool_result" && proof.effect?.kind === "command" ? proof.effect.workspace_sha256 :
+    let proof = this.state.events.findLast(event => event.t === "tool_result" && event.effect?.kind === "command");
+    let prior = proof?.t === "tool_result" && proof.effect?.kind === "command" ? proof.effect.workspace_sha256 :
       this.state.handoff?.state.completed.at(-1)?.evidence.workspace_sha256;
+    // A short task need not create a completed note. Its last command still
+    // establishes the comparison version when the current segment is empty.
+    if (!proof && this.config.tools.workspace) {
+      const history = await readNodeHistory(this.config.logDir, this.state.node, undefined, "context");
+      if (!history.ok) throw new Error(history.error);
+      proof = history.nodes.flatMap(part => part.events).findLast(event => event.t === "tool_result" && event.effect?.kind === "command");
+      if (proof?.t === "tool_result" && proof.effect?.kind === "command") prior = proof.effect.workspace_sha256;
+    }
     if (proof || prior || this.config.acceptanceContract) await this.config.tools.workspace?.observe(prior);
   }
 
@@ -867,6 +880,11 @@ export class Session {
     });
   }
 
+  /** Q24: publish identities only after durable append, including non-model user actions. */
+  subscribeRecords(listener: (item: CommittedItem) => void): () => void {
+    this.recordListeners.add(listener); return () => { this.recordListeners.delete(listener); };
+  }
+
   private async record(event: LogEvent): Promise<void> {
     // D8: runtime callers may retain mutable results. The in-memory projection
     // must own the same JSON value that was appended, independent of later edits.
@@ -876,6 +894,9 @@ export class Session {
       this.state.events.push(event);
       if (this.stall !== null) this.stall = advanceStall(this.stall, [{ node: this.state.node, event }]);
       if (this.recovery !== null) this.recovery = advanceRecovery(this.recovery, [event], path => resolve(this.config.tools.root, path));
+      for (const listener of this.recordListeners) {
+        try { listener({ node: this.state.node, id: event.id, type: event.t }); } catch { /* observers never own the append */ }
+      }
     });
     this.recordTail = saved.catch(() => {});
     await saved;
@@ -963,6 +984,14 @@ export class Session {
     return (await this.currentHandoff()).acceptance;
   }
 
+  async requestState(): Promise<RequestState | undefined> {
+    // Use the same idle workspace/target observation boundary as /acceptance.
+    if (!this.running) await this.acceptanceState();
+    const history = await readNodeHistory(this.config.logDir, this.state.node, undefined, "context");
+    if (!history.ok) throw new Error(history.error);
+    return deriveRequestState(history.nodes);
+  }
+
   /** Only called at paired, owned boundaries; probes never enter a pending model tool exchange. */
   private async refreshRuntimeTargets(): Promise<void> {
     const state = (await this.currentHandoff()).acceptance;
@@ -1103,6 +1132,7 @@ export class Session {
     userText: UserInput,
     signal?: AbortSignal,
     pull?: (phase: Phase) => Promise<UserInput | null>,
+    requestId?: string,
   ): AsyncGenerator<LoopEvent> {
     if (this.cleanup || this.closing) throw new Error("session is draining or disposed");
     const owned = this.execution.begin(signal);
@@ -1110,7 +1140,7 @@ export class Session {
     this.turnTools = savedTools;
     this.config.tools = { ...savedTools };
     this.installSkillResources();
-    const events = this.run(userText, owned.signal, pull);
+    const events = this.run(userText, owned.signal, pull, requestId);
     let terminal = false;
     let exhausted = false;
     try {
@@ -1123,13 +1153,16 @@ export class Session {
             t: "outcome", id: this.clock.nextId(), at: this.clock.now(),
             reason: item.value.reason ?? item.value.outcome.reason, outcome: item.value.outcome,
           });
+          const request = await this.requestState();
+          if (request) item.value.request = request;
         }
         yield item.value;
       }
       if (!terminal) {
         const outcome = executionOutcome("snapshot_failed");
         await this.record({ t: "outcome", id: this.clock.nextId(), at: this.clock.now(), reason: "workspace snapshot failed", outcome });
-        yield { kind: "done", reason: "stopped: workspace snapshot failed", outcome };
+        const request = await this.requestState();
+        yield { kind: "done", reason: "stopped: workspace snapshot failed", outcome, ...(request ? { request } : {}) };
       }
     } catch (error) {
       // Raw provider exceptions can contain credentials; persist only the execution fact.
@@ -1157,6 +1190,7 @@ export class Session {
     userText: UserInput,
     signal?: AbortSignal,
     pull?: (phase: Phase) => Promise<UserInput | null>,
+    requestId?: string,
   ): AsyncGenerator<LoopEvent> {
     // A crash after a discovery receipt but before its cut is recovered from that same receipt.
     if (!signal?.aborted) await this.applyDiscoveredTools();
@@ -1170,9 +1204,8 @@ export class Session {
       if (this.isHalfRound()) throw new Error("Cannot change image transmission while tool results are pending");
       await this.performCut("model_checkpoint");
     }
-    await this.record({
-      t: "user", id: this.clock.nextId(), at: this.clock.now(), ...userInputData(userText, blocked),
-    });
+    const request = requestId ?? this.clock.nextId();
+    await this.record({ t: "user", id: request, at: this.clock.now(), ...userInputData(userText, blocked) });
     if (this.config.acceptanceContract) await this.record({ t: "acceptance_contract", id: this.clock.nextId(), at: this.clock.now(),
       request: this.state.events.at(-1)!.id, contract: this.config.acceptanceContract });
     // Idle changes belong to the new prompt. Recording them before `user`
@@ -1245,6 +1278,8 @@ export class Session {
         try {
           result = yield* this.awaitProvider(projected.messages, signal);
         } catch (error) {
+          // D11: retain a typed response receipt once, without anchoring rejected content or trusting arbitrary error fields.
+          if (error instanceof FailedResponseError && error.usage !== undefined) this.state.usage.push({ ...error.usage });
           if (signal?.aborted) {
             yield* this.closeInterrupted(completedThisTurn);
             return;
@@ -1270,6 +1305,14 @@ export class Session {
 
         const previous = this.state.usage.at(-1);
         this.state.usage.push(result.usage);
+        // Q24: an adapter may finish after abort. Keep measured usage, but cancellation
+        // owns termination and a late response cannot enter context or execute tools.
+        if (signal?.aborted) {
+          yield { kind: "usage", usage: result.usage, ok: true };
+          yield { kind: "discard" };
+          yield* this.closeInterrupted(completedThisTurn);
+          return;
+        }
         const promptTokens =
           result.usage.input_tokens +
           result.usage.cache_creation_input_tokens +
@@ -1308,6 +1351,15 @@ export class Session {
           };
         }
 
+        // D5: ambiguous IDs cannot be persisted or paired safely. Keep sampled
+        // usage, but stop before observer hooks or any tool effect can run.
+        const identityViolations = toolCallIdentityViolations(result.blocks);
+        if (identityViolations.length > 0) {
+          yield { kind: "done", outcome: executionOutcome("provider_error"),
+            reason: `stopped: invalid provider tool call identity (${identityViolations.map(violation => `${violation.code}: ${violation.detail}`).join("; ")})` };
+          return;
+        }
+
         await this.record({
           t: "assistant", id: this.clock.nextId(), at: this.clock.now(), blocks: result.blocks, stop_reason: result.stopReason,
           replay_key: providerReplayKey(this.provider.config.spec),
@@ -1330,7 +1382,7 @@ export class Session {
           }
           const extra = await this.pullSteering(pull);
           if (extra !== null) {
-            await this.record({ t: "user", id: this.clock.nextId(), at: this.clock.now(), ...userInputData(extra, blocked) });
+            await this.record({ t: "user", id: this.clock.nextId(), at: this.clock.now(), request, ...userInputData(extra, blocked) });
             continue;
           }
           const history = await readNodeHistory(this.config.logDir, this.state.node, undefined, "context");
@@ -1353,24 +1405,25 @@ export class Session {
           const extra = await this.pullSteering(pull);
           if (extra !== null) {
             await this.record({
-              t: "user", id: this.clock.nextId(), at: this.clock.now(), ...userInputData(extra, blocked),
+              t: "user", id: this.clock.nextId(), at: this.clock.now(), request, ...userInputData(extra, blocked),
             });
             continue;
           }
           if (this.config.acceptanceContract) await this.refreshRuntimeTargets();
-          const acceptance = this.config.acceptanceContract ? await this.acceptanceState() : undefined;
-          const review = this.config.guidance === false || this.config.harnessReviews === false ? null
-            : completionReview(this.state.events, this.config.maxTurns - turn - 1, {
+          const state = await this.requestState();
+          const decision = !state || this.config.guidance === false || this.config.harnessReviews === false ? { action: "finish" as const }
+            : requestCompletion(state, this.config.maxTurns - turn - 1, {
               ...(this.config.guidanceVersion === 1 ? { taskAware: true } : {}),
               ...(this.config.strictVerification ? { strictVerification: true } : {}),
-              ...(acceptance ? { acceptance } : {}),
             });
-          if (review) {
-            await this.record({ t: "guidance", id: this.clock.nextId(), at: this.clock.now(), ...review });
+          if (decision.action === "continue") {
             if (yield* this.maybeCut(counter, true)) {
               yield { kind: "done", reason: "stopped: no verifiable progress", outcome: executionOutcome("no_progress") };
               return;
             }
+            // Q23: a notice appended before a cut can disappear from the next
+            // projection. Append at the destination so the provider sees it once.
+            await this.record({ t: "guidance", id: this.clock.nextId(), at: this.clock.now(), ...decision.guidance });
             continue;
           }
           const stopped = yield* this.maybeCut(counter, false);
@@ -1450,7 +1503,7 @@ export class Session {
         const extra = await this.pullSteering(pull);
         if (extra !== null) {
           await this.record({
-            t: "user", id: this.clock.nextId(), at: this.clock.now(), ...userInputData(extra, blocked),
+            t: "user", id: this.clock.nextId(), at: this.clock.now(), request, ...userInputData(extra, blocked),
           });
         }
       }

package/src/runtime/model.ts

@@ -19,6 +19,7 @@
 import type { ProviderApi } from "./provider-protocols.ts";
 import { SOURCE_MODELS } from "./model-data.ts";
 import { mergeCatalogs } from "../core/catalog-merge.ts";
+import { GROK_PROVIDER, GROK_BASE_URL } from "./oauth.ts";
 export type Api = ProviderApi;
 
 /** How hard the model should think. Capability and wire vocabulary are mapped per model. */
@@ -440,6 +441,14 @@ export const CURATED_CATALOG: readonly ModelSpec[] = [
   DEEPSEEK_V4_PRO,
   DEEPSEEK_FLASH,
 
+  {
+    id: "grok-build", name: "Grok Build", provider: GROK_PROVIDER, baseUrl: GROK_BASE_URL,
+    api: "openai-completions", driver: "pi", input: ["text"],
+    // The official proxy alias has no published effort/price contract. Do not copy API model rates.
+    reasoning: false,
+    nativeCompat: { supportsDeveloperRole: false, supportsReasoningEffort: false, maxTokensField: "max_tokens" },
+  },
+
   completionsModel({
     id: "grok-4.6",
   // Input modalities from the existing models.dev catalog source, 2026-09-30.

package/src/runtime/native-eval.ts

@@ -21,13 +21,14 @@ export async function nativeWire(request: Request): Promise<Record<string, unkno
   return JSON.parse(new TextDecoder().decode(body)) as Record<string, unknown>;
 }
 /** Running the same serializer with a local fetch prevents a second, approximate wire builder. */
-export async function nativePayload(config: ProviderConfig, frozen: FrozenPrefix, messages: Message[]): Promise<Record<string, unknown>> {
+export async function nativePayload(config: ProviderConfig, frozen: FrozenPrefix, messages: Message[], sessionId?: string): Promise<Record<string, unknown>> {
   let payload: Record<string, unknown> | undefined;
   const capture = (async (input: RequestInfo | URL, init?: RequestInit) => {
     payload = await nativeWire(new Request(input, init));
     return new Response(null, { status: 400 });
   }) as typeof fetch;
-  const provider = new PiProvider(config, NATIVE_EVAL_TEST_KEY, { oauth: true, effects: noEffects, fetch: capture, retry: { maxRetries: 0, maxRetryDelayMs: 0 } });
+  const provider = new PiProvider(config, NATIVE_EVAL_TEST_KEY, { oauth: true, effects: noEffects, fetch: capture,
+    ...(sessionId ? { sessionId } : {}), retry: { maxRetries: 0, maxRetryDelayMs: 0 } });
   await provider.send(frozen, messages, 0).catch(() => {});
   if (!payload) throw Error("native offline wire was not produced");
   return payload;
@@ -67,6 +68,7 @@ export function nativeResponseTap(body: ReadableStream<Uint8Array>, terminal: (r
 export function nativeEvalTransport(options: {
   config: ProviderConfig; key: string; price: BenchmarkPrice; ledger: ComparisonLedger; maxRequests: number;
   fetch?: typeof fetch;
+  sessionId?: string;
   record: (row: GatewayRecord) => Promise<void>;
   wire: (payload: Record<string, unknown>, request: number) => Promise<void>;
   response: (receipt: NativeResponse, request: number) => Promise<void>;
@@ -105,7 +107,8 @@ export function nativeEvalTransport(options: {
       state.terminal = terminal; await options.response(terminal, row.request);
     }), { status: response.status, headers: response.headers });
   }) as typeof fetch;
-  const actual = new PiProvider(config, options.key, { oauth: true, effects: noEffects, fetch: observedFetch, retry: { maxRetries: 0, maxRetryDelayMs: 0 } });
+  const actual = new PiProvider(config, options.key, { oauth: true, effects: noEffects, fetch: observedFetch,
+    ...(options.sessionId ? { sessionId: options.sessionId } : {}), retry: { maxRetries: 0, maxRetryDelayMs: 0 } });
   const provider: Provider = { config, async send(frozen, messages, node, signal, onDelta) {
     if (active) throw Error("native eval model requests must be sequential");
     active = true; current = undefined;

package/src/runtime/oauth.ts

@@ -15,9 +15,10 @@
 
 import { createServer, type Server } from "node:http";
 import { pollDeviceCode } from "./oauth-device.ts";
+import { parseDeviceAuthorization, parseOAuthTokens } from "../core/oauth-fields.ts";
 
 /** Matches package.json. Sent as User-Agent so the server can see who we are (D18). */
-export const XENO_VERSION = "0.3.0";
+export const XENO_VERSION = "0.5.0";
 
 /**
  * Minutes subtracted from server expiry so a request issued at the edge
@@ -33,6 +34,7 @@ export const SUBSCRIPTION_OPTIONS = [
   { id: "claude-pro", provider: "anthropic", label: "Claude Pro/Max" },
   { id: "codex", provider: "openai-codex", label: "ChatGPT Plus/Pro (Codex)" },
   { id: "github-copilot", provider: "github-copilot", label: "GitHub Copilot" },
+  { id: "grok", provider: "xai-grok", label: "Grok (official account)" },
 ] as const;
 
 export type SubscriptionId = (typeof SUBSCRIPTION_OPTIONS)[number]["id"];
@@ -101,12 +103,83 @@ export const OPENAI_REDIRECT_URI = `http://localhost:${OPENAI_CALLBACK_PORT}${OP
 const OPENAI_SCOPE = "openid profile email offline_access";
 const OPENAI_JWT_CLAIM = "https://api.openai.com/auth";
 
+// Official Grok Build config.rs / device_code.rs, verified 2026-10-07.
+// This is the public first-party client, with xeno attribution retained (D18).
+const GROK_CLIENT_ID = "b1a00492-073a-47ea-816f-4c329264a828";
+const GROK_AUTH_ORIGIN = "https://auth.x.ai";
+const GROK_TOKEN_URL = `${GROK_AUTH_ORIGIN}/oauth2/token`;
+// Only inference and refresh scopes: xeno does not store remote conversations/workspaces.
+const GROK_SCOPE = "openid profile email offline_access grok-cli:access api:access";
+export const GROK_PROVIDER = "xai-grok";
+export const GROK_BASE_URL = "https://cli-chat-proxy.grok.com/v1";
+/** Official HTTP timeout: issuer requests cannot keep a cancelled or expired grant hanging indefinitely. */
+const GROK_REQUEST_TIMEOUT_MS = 15_000;
+
+async function grokPost(url: string, fields: Record<string, string>, effects: Pick<RefreshEffects, "fetch" | "signal">): Promise<{ status: number; json: unknown }> {
+  const timeout = AbortSignal.timeout(GROK_REQUEST_TIMEOUT_MS);
+  const signal = effects.signal ? AbortSignal.any([effects.signal, timeout]) : timeout;
+  try {
+    const response = await effects.fetch(url, { method: "POST", redirect: "error", signal,
+      headers: { "Content-Type": "application/x-www-form-urlencoded", Accept: "application/json", "User-Agent": `xeno/${XENO_VERSION}` },
+      body: new URLSearchParams(fields) });
+    let json: unknown;
+    try { json = await response.json(); } catch { json = undefined; }
+    return { status: response.status, json };
+  } catch {
+    // Network errors can include request details; never expose a credential-bearing body.
+    throw new Error(effects.signal?.aborted ? "Login cancelled" : "Grok authentication request failed");
+  }
+}
+
+export async function loginGrok(interaction: OAuthInteraction, sleep?: Parameters<typeof pollDeviceCode>[0]["sleep"]): Promise<OAuthCredential> {
+  const started = await grokPost(`${GROK_AUTH_ORIGIN}/oauth2/device/code`,
+    { client_id: GROK_CLIENT_ID, scope: GROK_SCOPE, referrer: "xeno" }, interaction);
+  if (started.status < 200 || started.status >= 300) throw new Error(`Grok device code request failed (HTTP ${started.status})`);
+  const device = parseDeviceAuthorization(started.json, [GROK_AUTH_ORIGIN, "https://accounts.x.ai"]);
+  if (!device) throw new Error("Grok device code response was incomplete or untrusted");
+  interaction.signal.throwIfAborted();
+  const url = device.verificationUriComplete ?? device.verificationUri;
+  interaction.notify(`Open ${url}\nand enter code: ${device.userCode}`);
+  tryOpen(url, interaction.openBrowser);
+  return pollDeviceCode<OAuthCredential>({
+    expiresInSeconds: device.expiresIn, waitBeforeFirstPoll: true, signal: interaction.signal,
+    ...(device.interval !== undefined ? { intervalSeconds: device.interval } : {}), ...(sleep ? { sleep } : {}),
+    poll: async () => {
+      const got = await grokPost(GROK_TOKEN_URL,
+        { client_id: GROK_CLIENT_ID, device_code: device.deviceCode, grant_type: "urn:ietf:params:oauth:grant-type:device_code" }, interaction);
+      const body = asRecord(got.json);
+      // RFC 8628 errors use HTTP 400; they are polling states, never completed logins.
+      if (got.status === 400 && body?.["error"] === "authorization_pending") return { status: "pending" };
+      if (got.status === 400 && body?.["error"] === "slow_down") return { status: "slow_down" };
+      if (got.status < 200 || got.status >= 300) return { status: "failed", message: `Grok device login failed (HTTP ${got.status})` };
+      const fields = parseOAuthTokens(got.json);
+      if (!fields) return { status: "failed", message: "Grok token response was incomplete" };
+      interaction.signal.throwIfAborted();
+      return { status: "complete", value: { type: "oauth", access: fields.access, refresh: fields.refresh,
+        expires: expiryFromExpiresIn(fields.expiresIn, (interaction.now ?? Date.now)()) } };
+    },
+  });
+}
+
+async function refreshGrok(refresh: string, effects: RefreshEffects): Promise<{ ok: true; credential: OAuthCredential } | { ok: false; reason: string }> {
+  try {
+    const got = await grokPost(GROK_TOKEN_URL, { client_id: GROK_CLIENT_ID, grant_type: "refresh_token", refresh_token: refresh }, effects);
+    if (effects.signal?.aborted) return { ok: false, reason: "Login cancelled" };
+    if (got.status < 200 || got.status >= 300) return { ok: false, reason: `HTTP ${got.status}` };
+    const fields = parseOAuthTokens(got.json, refresh);
+    if (!fields) return { ok: false, reason: "unexpected body" };
+    return { ok: true, credential: { type: "oauth", access: fields.access, refresh: fields.refresh,
+      expires: expiryFromExpiresIn(fields.expiresIn, effects.now()) } };
+  } catch { return { ok: false, reason: "Grok token refresh failed" }; }
+}
+
 export function isSubscriptionLogin(id: string): boolean {
-  return SUBSCRIPTION_OPTIONS.some((o) => o.id === id);
+  return subscriptionById(id) !== undefined;
 }
 
 export function subscriptionById(id: string): (typeof SUBSCRIPTION_OPTIONS)[number] | undefined {
-  return SUBSCRIPTION_OPTIONS.find((o) => o.id === id);
+  // Separate account providers accept their catalog identity too; anthropic still means an API key.
+  return SUBSCRIPTION_OPTIONS.find(o => o.id === id || (o.provider === id && o.provider !== "anthropic"));
 }
 
 export function expiryFromExpiresIn(expiresIn: number, now: number): number {
@@ -505,6 +578,8 @@ export async function refreshOAuthCredential(
       return refreshOpenAI(credential.refresh, opts);
     case "github-copilot":
       return refreshCopilot(credential.refresh, opts, credential.enterpriseUrl);
+    case GROK_PROVIDER:
+      return refreshGrok(credential.refresh, opts);
     default:
       return { ok: false, reason: `no oauth refresh for ${provider}` };
   }
@@ -752,6 +827,8 @@ export async function loginSubscription(
       return { provider: "openai-codex", credential: await loginOpenAICodex(interaction) };
     case "github-copilot":
       return { provider: "github-copilot", credential: await loginGitHubCopilot(interaction) };
+    case "grok":
+      return { provider: GROK_PROVIDER, credential: await loginGrok(interaction) };
     default: {
       const never: never = id;
       throw new Error(`unknown subscription login: ${String(never)}`);