dsh-grok-subscription 2.0.3 → 2.0.5

package/lib/index.js

@@ -14,8 +14,10 @@ var TOKEN_AUTH_VALUE = "xai-grok-cli";
 var CLIENT_IDENTIFIER_HEADER = "x-grok-client-identifier";
 var CLIENT_VERSION_HEADER = "x-grok-client-version";
 var CLIENT_IDENTIFIER = "grok-shell";
-var CLIENT_VERSION_FALLBACK = "1.0.5";
+var CLIENT_VERSION_FALLBACK = "99.0.0";
 var API_KEY_SCOPE = "xai::api_key";
+var XAI_OAUTH_ISSUER = "https://auth.x.ai";
+var GROK_OIDC_CLIENT_ID = "b1a00492-073a-47ea-816f-4c329264a828";
 var SESSION_AUTH_MODES = Object.freeze(["oidc", "external", "web_login", "grok"]);
 var API_KEY_AUTH_MODES = Object.freeze(["api_key"]);
 var AUTH_FILE_MAX_BYTES = 1048576;
@@ -37,19 +39,28 @@ var IMAGE_INPUT_MODEL_IDS = Object.freeze([
 var IMPORT_TIMEOUT_MS = 2500;
 var CREDENTIALS_IO_TIMEOUT_MS = 1500;
 var RPC_HANDLER_TIMEOUT_MS = 8e3;
-var LOGIN_START_TIMEOUT_MS = 1e4;
 var LOGIN_HANDLER_TIMEOUT_MS = 2e4;
 
 // src/session.js
-import { existsSync as existsSync3 } from "node:fs";
 import { spawn } from "node:child_process";
-import { join as join3 } from "node:path";
 
 // src/auth-file.js
-import { lstatSync, openSync, readFileSync, closeSync, constants as fsConstants } from "node:fs";
+import { randomBytes } from "node:crypto";
+import {
+  chmodSync,
+  closeSync,
+  constants as fsConstants,
+  lstatSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  renameSync,
+  unlinkSync,
+  writeSync
+} from "node:fs";
 import { homedir } from "node:os";
-import { join } from "node:path";
-var XAI_OAUTH_ISSUER = "https://auth.x.ai";
+import { dirname, join } from "node:path";
+var XAI_OAUTH_ISSUER2 = "https://auth.x.ai";
 function grokHome(env = process.env) {
   const override = typeof env.GROK_HOME === "string" && env.GROK_HOME.trim() ? env.GROK_HOME.trim() : void 0;
   return override ?? join(homedir(), ".grok");
@@ -165,6 +176,9 @@ function sessionFromEntry(scope, entry) {
   return Object.freeze({
     scope,
     accessToken: token,
+    refreshToken: asNonEmptyString(object.refresh_token ?? object.refreshToken),
+    oidcIssuer: asNonEmptyString(object.oidc_issuer ?? object.oidcIssuer),
+    oidcClientId: asNonEmptyString(object.oidc_client_id ?? object.oidcClientId),
     authMode,
     email,
     userId,
@@ -174,8 +188,8 @@ function sessionFromEntry(scope, entry) {
 }
 function preferredScopeScore(scope, entry) {
   const issuer = entry && typeof entry === "object" ? asNonEmptyString(entry.oidc_issuer ?? entry.oidcIssuer) : void 0;
-  if (typeof scope === "string" && scope.startsWith(`${XAI_OAUTH_ISSUER}::`)) return 3;
-  if (issuer === XAI_OAUTH_ISSUER) return 2;
+  if (typeof scope === "string" && scope.startsWith(`${XAI_OAUTH_ISSUER2}::`)) return 3;
+  if (issuer === XAI_OAUTH_ISSUER2) return 2;
   if (SESSION_AUTH_MODES.includes(normalizeAuthMode(entry?.auth_mode ?? entry?.authMode) ?? "")) return 1;
   return 0;
 }
@@ -213,6 +227,91 @@ function readGrokAuthSession(path = authJsonPath(), options = {}) {
   const document = readSecureJsonFile(path, options);
   return parseAuthDocument(document);
 }
+function fileMeta(stat) {
+  return {
+    isSymbolicLink: typeof stat.isSymbolicLink === "function" ? stat.isSymbolicLink() : Boolean(stat.isSymbolicLink),
+    isFile: typeof stat.isFile === "function" ? stat.isFile() : Boolean(stat.isFile),
+    mode: stat.mode,
+    uid: stat.uid,
+    size: stat.size
+  };
+}
+function writeOauthSession(path, fields, options = {}) {
+  if (!asNonEmptyString(fields?.accessToken) || !asNonEmptyString(fields?.issuer) || !asNonEmptyString(fields?.clientId)) {
+    throw new Error("Refusing to store an OAuth session without an access token");
+  }
+  const lstat = options.lstat ?? ((target) => lstatSync(target, { throwIfNoEntry: false }));
+  const existing = lstat(path);
+  let document = {};
+  if (existing) {
+    const meta = fileMeta(existing);
+    if (meta.isSymbolicLink) throw new Error("Refusing to write a symbolic-link Grok auth.json");
+    if (!meta.isFile) throw new Error("Grok auth.json is not a regular file");
+    const platform = options.platform ?? process.platform;
+    const currentUid = options.uid ?? process.getuid?.();
+    if (platform !== "win32" && typeof currentUid === "number" && typeof meta.uid === "number" && meta.uid !== currentUid) {
+      throw new Error("Grok auth.json is not owned by the current user");
+    }
+    if (typeof meta.size === "number" && meta.size > AUTH_FILE_MAX_BYTES) {
+      throw new Error("Grok auth.json is larger than the allowed size");
+    }
+    document = readSecureJsonFile(path, options);
+    if (!document || typeof document !== "object" || Array.isArray(document)) {
+      throw new Error("Grok auth document is not an object");
+    }
+  }
+  const scope = `${fields.issuer}::${fields.clientId}`;
+  const previous = document[scope] && typeof document[scope] === "object" && !Array.isArray(document[scope]) ? document[scope] : {};
+  const next = { ...previous, key: fields.accessToken, auth_mode: "oidc", oidc_issuer: fields.issuer, oidc_client_id: fields.clientId };
+  if (asNonEmptyString(fields.expiresAt)) next.expires_at = fields.expiresAt;
+  if (asNonEmptyString(fields.refreshToken)) next.refresh_token = fields.refreshToken;
+  if (asNonEmptyString(fields.email)) next.email = fields.email;
+  if (asNonEmptyString(fields.userId)) next.user_id = fields.userId;
+  document[scope] = next;
+  writeSecureJsonFile(path, document, options);
+  return parseAuthDocument(document);
+}
+function writeSecureJsonFile(path, document, options = {}) {
+  const mkdir = options.mkdir ?? ((dir) => mkdirSync(dir, { recursive: true, mode: 448 }));
+  const open = options.open ?? ((target) => openSync(target, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL, 384));
+  const write = options.write ?? ((fd2, payload2) => writeSync(fd2, payload2));
+  const close = options.close ?? closeSync;
+  const rename = options.rename ?? renameSync;
+  const unlink = options.unlink ?? unlinkSync;
+  const chmod = options.chmod ?? chmodSync;
+  mkdir(dirname(path));
+  const tmp = `${path}.${randomBytes(6).toString("hex")}.tmp`;
+  const payload = `${JSON.stringify(document, null, 2)}
+`;
+  const fd = open(tmp);
+  try {
+    write(fd, payload);
+  } catch (error) {
+    try {
+      close(fd);
+    } catch {
+    }
+    try {
+      unlink(tmp);
+    } catch {
+    }
+    throw error;
+  }
+  close(fd);
+  try {
+    rename(tmp, path);
+  } catch (error) {
+    try {
+      unlink(tmp);
+    } catch {
+    }
+    throw error;
+  }
+  try {
+    chmod(path, 384);
+  } catch {
+  }
+}
 function publicSessionView(session) {
   if (!session) {
     return Object.freeze({
@@ -244,19 +343,33 @@ function parseClientVersion(document) {
   }
   return void 0;
 }
+function releaseAtLeast(version, minimum) {
+  const parse = (value) => {
+    const match = /^v?(\d+)\.(\d+)\.(\d+)$/.exec(typeof value === "string" ? value.trim() : "");
+    return match ? [Number(match[1]), Number(match[2]), Number(match[3])] : void 0;
+  };
+  const left = parse(version);
+  const right = parse(minimum);
+  if (!left || !right) return false;
+  for (let index = 0; index < 3; index += 1) {
+    if (left[index] !== right[index]) return left[index] > right[index];
+  }
+  return true;
+}
 function readClientVersion(env = process.env, options = {}) {
   if (typeof env.DSH_GROK_CLIENT_VERSION === "string" && env.DSH_GROK_CLIENT_VERSION.trim()) {
     return env.DSH_GROK_CLIENT_VERSION.trim();
   }
+  const fallback = options.fallback ?? CLIENT_VERSION_FALLBACK;
   const path = options.path ?? versionJsonPath(env);
   const exists = options.exists ?? existsSync;
   const read = options.read ?? ((target) => readFileSync2(target, "utf8"));
-  if (!exists(path)) return CLIENT_VERSION_FALLBACK;
+  if (!exists(path)) return fallback;
   try {
     const parsed = parseClientVersion(JSON.parse(read(path)));
-    return parsed ?? CLIENT_VERSION_FALLBACK;
+    return parsed && releaseAtLeast(parsed, fallback) ? parsed : fallback;
   } catch {
-    return CLIENT_VERSION_FALLBACK;
+    return fallback;
   }
 }
 function fingerprintHeaders(options = {}) {
@@ -829,7 +942,7 @@ async function fetchBillingUsage(accessToken, options = {}) {
 import { existsSync as existsSync2, readFileSync as readFileSync3 } from "node:fs";
 import { createRequire } from "node:module";
 import { homedir as homedir2 } from "node:os";
-import { dirname, join as join2 } from "node:path";
+import { dirname as dirname2, join as join2 } from "node:path";
 import { pathToFileURL } from "node:url";
 function withImportTimeout(promise, ms, message) {
   let timer;
@@ -850,16 +963,16 @@ function hostModuleRoots(env = process.env, argv1 = process.argv[1]) {
   const override = env.DSH_GROK_PEER_ROOT;
   if (typeof override === "string" && override.trim()) push(override.trim());
   if (typeof argv1 === "string" && argv1) {
-    let dir = dirname(argv1);
-    for (let depth = 0; depth < 6 && dir && dir !== dirname(dir); depth++) {
+    let dir = dirname2(argv1);
+    for (let depth = 0; depth < 6 && dir && dir !== dirname2(dir); depth++) {
       push(join2(dir, "node_modules"));
-      dir = dirname(dir);
+      dir = dirname2(dir);
     }
   }
   const prefix = env.NPM_CONFIG_PREFIX;
   if (typeof prefix === "string" && prefix.trim()) push(join2(prefix.trim(), "lib", "node_modules"));
   if (typeof process.execPath === "string" && process.execPath) {
-    push(join2(dirname(process.execPath), "..", "lib", "node_modules"));
+    push(join2(dirname2(process.execPath), "..", "lib", "node_modules"));
   }
   push(join2("/opt/homebrew", "lib", "node_modules"));
   push(join2("/usr/local", "lib", "node_modules"));
@@ -1149,40 +1262,209 @@ async function createGrokBuildAdapter(session, options = {}) {
   };
 }
 
-// src/session.js
-var WINDOWS_EXEC_EXTENSIONS = [".COM", ".EXE", ".BAT", ".CMD"];
-var hasPathSeparator = (value) => value.includes("/") || value.includes("\\");
-function executableNames(bin, platform, env) {
-  if (platform !== "win32") return [bin];
-  const declared = String(env.PATHEXT ?? "").split(";").map((part) => part.trim()).filter(Boolean).map((part) => part.startsWith(".") ? part : `.${part}`);
-  const extensions = declared.length > 0 ? declared : WINDOWS_EXEC_EXTENSIONS;
-  return [bin, ...extensions.map((extension) => `${bin}${extension}`)];
-}
-function firstExisting(names, exists) {
-  for (const name2 of names) if (exists(name2)) return name2;
+// src/oauth.js
+var OAUTH_SCOPES = "openid profile email offline_access api:access grok-cli:access";
+var OAUTH_BODY_LIMIT = 64 * 1024;
+var OAUTH_ERROR_LIMIT = 180;
+function collapse(value) {
+  return String(value ?? "").replace(/\s+/gu, " ").trim().slice(0, OAUTH_ERROR_LIMIT);
+}
+function oauthError(body, status) {
+  const code = collapse(body?.error) || "request_failed";
+  const description = collapse(body?.error_description);
+  if (description && description !== code) return `${code}: ${description} (HTTP ${status})`;
+  return `${code} (HTTP ${status})`;
+}
+async function readOauthBody(response) {
+  const status = typeof response.status === "number" ? response.status : 0;
+  const declared = Number(response.headers?.get?.("content-length"));
+  if (Number.isFinite(declared) && declared > OAUTH_BODY_LIMIT) {
+    throw new Error(`OAuth response exceeded ${OAUTH_BODY_LIMIT} bytes (HTTP ${status})`);
+  }
+  let text;
+  try {
+    text = await readResponseText(response);
+  } catch (error) {
+    throw new Error(`OAuth response could not be read (HTTP ${status})`, { cause: error });
+  }
+  if (typeof text !== "string" || text.length > OAUTH_BODY_LIMIT) {
+    throw new Error(`OAuth response exceeded ${OAUTH_BODY_LIMIT} bytes (HTTP ${status})`);
+  }
+  try {
+    return JSON.parse(text);
+  } catch {
+    throw new Error(`OAuth endpoint returned HTTP ${status} with a non-JSON body`);
+  }
+}
+function timeoutSignal(ms) {
+  if (typeof AbortSignal !== "undefined" && typeof AbortSignal.timeout === "function") {
+    return AbortSignal.timeout(ms);
+  }
   return void 0;
 }
-function pathEntry(dir, platform) {
-  return platform === "win32" && dir.length > 1 && dir.startsWith('"') && dir.endsWith('"') ? dir.slice(1, -1) : dir;
+async function postForm(url, params, fetchImpl) {
+  const response = await fetchImpl(url, {
+    method: "POST",
+    headers: {
+      accept: "application/json",
+      "content-type": "application/x-www-form-urlencoded"
+    },
+    body: new URLSearchParams(params).toString(),
+    signal: timeoutSignal(CLI_REFRESH_TIMEOUT_MS)
+  });
+  const body = await readOauthBody(response);
+  return { status: typeof response.status === "number" ? response.status : 0, body };
+}
+function isXaiHttpsUrl(value) {
+  try {
+    const url = new URL(value);
+    const host = url.hostname.toLowerCase();
+    return url.protocol === "https:" && !url.username && !url.password && (host === "x.ai" || host.endsWith(".x.ai"));
+  } catch {
+    return false;
+  }
+}
+function endpointOnIssuer(value, issuer, field) {
+  let url;
+  let issuerUrl;
+  try {
+    url = new URL(value);
+    issuerUrl = new URL(issuer);
+  } catch {
+    throw new Error(`OIDC discovery returned an invalid ${field}`);
+  }
+  if (url.protocol !== "https:" || issuerUrl.protocol !== "https:") {
+    throw new Error(`OIDC discovery returned a non-HTTPS ${field}`);
+  }
+  if (url.username || url.password) throw new Error(`OIDC discovery returned credentials in ${field}`);
+  if (url.origin !== issuerUrl.origin) throw new Error(`OIDC discovery ${field} does not match the issuer`);
+  return url.toString();
+}
+function fallbackOauthEndpoints(issuer = XAI_OAUTH_ISSUER) {
+  const base = String(issuer).replace(/\/+$/u, "");
+  return {
+    deviceAuthorizationEndpoint: `${base}/oauth2/device/code`,
+    tokenEndpoint: `${base}/oauth2/token`
+  };
+}
+async function discoverOauthEndpoints(issuer = XAI_OAUTH_ISSUER, options = {}) {
+  const fetchImpl = options.fetch ?? fetch;
+  const base = String(issuer).replace(/\/+$/u, "");
+  try {
+    const response = await fetchImpl(`${base}/.well-known/openid-configuration`, {
+      headers: { accept: "application/json" },
+      signal: timeoutSignal(CLI_REFRESH_TIMEOUT_MS)
+    });
+    const body = await readOauthBody(response);
+    const status = typeof response.status === "number" ? response.status : 0;
+    if (status < 200 || status >= 300) throw new Error(`OIDC discovery failed (HTTP ${status})`);
+    const discovered = typeof body?.issuer === "string" ? body.issuer.replace(/\/+$/u, "") : "";
+    if (discovered !== base) throw new Error("OIDC discovery issuer does not match the requested issuer");
+    return {
+      deviceAuthorizationEndpoint: endpointOnIssuer(body.device_authorization_endpoint, base, "device_authorization_endpoint"),
+      tokenEndpoint: endpointOnIssuer(body.token_endpoint, base, "token_endpoint")
+    };
+  } catch {
+    return fallbackOauthEndpoints(base);
+  }
+}
+function clockMs(now) {
+  if (typeof now === "function") return now();
+  if (typeof now === "number" && Number.isFinite(now)) return now;
+  return Date.now();
 }
-function resolveGrokBin(env = process.env, exists = existsSync3, platform = process.platform) {
-  const override = typeof env.DSH_GROK_BIN === "string" && env.DSH_GROK_BIN.trim() ? env.DSH_GROK_BIN.trim() : void 0;
-  if (override !== void 0) {
-    if (!hasPathSeparator(override)) return override;
-    return firstExisting(executableNames(override, platform, env), exists) ?? override;
+function expiresAtFrom(body, accessToken, nowMs) {
+  if (typeof body?.expires_in === "number" && Number.isFinite(body.expires_in) && body.expires_in > 0) {
+    return new Date(nowMs + body.expires_in * 1e3).toISOString();
   }
-  const local = join3(grokHome(env), "bin", "grok");
-  const installed = firstExisting(executableNames(local, platform, env), exists);
-  if (installed !== void 0) return installed;
-  return "grok";
+  const exp = jwtExpiryMs(accessToken);
+  return typeof exp === "number" ? new Date(exp).toISOString() : void 0;
+}
+function jwtExpiryMs(token) {
+  const parts = typeof token === "string" ? token.split(".") : [];
+  if (parts.length < 2) return void 0;
+  try {
+    const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+    if (typeof payload?.exp === "number" && Number.isFinite(payload.exp)) return payload.exp * 1e3;
+  } catch {
+    return void 0;
+  }
+  return void 0;
+}
+async function requestDeviceAuthorization(options = {}) {
+  const fetchImpl = options.fetch ?? fetch;
+  const clientId = options.clientId ?? GROK_OIDC_CLIENT_ID;
+  const scopes = options.scopes ?? OAUTH_SCOPES;
+  const endpoint = options.endpoint;
+  if (!isXaiHttpsUrl(endpoint)) throw new Error("Refusing to request a device code from a non-x.ai endpoint");
+  const { status, body } = await postForm(endpoint, {
+    client_id: clientId,
+    scope: scopes
+  }, fetchImpl);
+  if (body?.error || status < 200 || status >= 300) {
+    throw new Error(`Could not start device sign-in: ${oauthError(body, status)}`);
+  }
+  const deviceCode = typeof body?.device_code === "string" ? body.device_code : "";
+  const userCode = typeof body?.user_code === "string" ? body.user_code : "";
+  const verificationUri = typeof body?.verification_uri === "string" ? body.verification_uri : void 0;
+  const verificationUriComplete = typeof body?.verification_uri_complete === "string" ? body.verification_uri_complete : void 0;
+  if (!deviceCode || !userCode) throw new Error("Device sign-in returned no user code");
+  return {
+    deviceCode,
+    userCode,
+    verificationUri,
+    verificationUriComplete,
+    expiresIn: typeof body?.expires_in === "number" ? body.expires_in : void 0,
+    interval: typeof body?.interval === "number" ? body.interval : void 0
+  };
 }
-function grokCliAvailable(env = process.env, exists = existsSync3, platform = process.platform) {
-  const bin = resolveGrokBin(env, exists, platform);
-  if (hasPathSeparator(bin)) return exists(bin);
-  const delimiter = platform === "win32" ? ";" : ":";
-  const names = executableNames(bin, platform, env);
-  return String(env.PATH ?? "").split(delimiter).some((dir) => dir && names.some((name2) => exists(join3(pathEntry(dir, platform), name2))));
+async function exchangeDeviceCode(options = {}) {
+  const fetchImpl = options.fetch ?? fetch;
+  const clientId = options.clientId ?? GROK_OIDC_CLIENT_ID;
+  const endpoint = options.endpoint;
+  if (!isXaiHttpsUrl(endpoint)) return { kind: "stop", error: "refusing a non-x.ai token endpoint" };
+  const { status, body } = await postForm(endpoint, {
+    grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+    client_id: clientId,
+    device_code: options.deviceCode
+  }, fetchImpl);
+  return classifyTokenResponse(body, status, clockMs(options.now));
+}
+async function refreshOauthToken(options = {}) {
+  const fetchImpl = options.fetch ?? fetch;
+  const endpoint = options.endpoint;
+  if (!isXaiHttpsUrl(endpoint)) throw new Error("Refusing to refresh a token at a non-x.ai endpoint");
+  const { status, body } = await postForm(endpoint, {
+    grant_type: "refresh_token",
+    client_id: options.clientId ?? GROK_OIDC_CLIENT_ID,
+    refresh_token: options.refreshToken
+  }, fetchImpl);
+  const result = classifyTokenResponse(body, status, clockMs(options.now));
+  if (result.kind !== "ok") throw new Error(`Could not refresh the session: ${result.error ?? "unknown"}`);
+  return result;
+}
+function classifyTokenResponse(body, status, nowMs) {
+  const error = typeof body?.error === "string" ? body.error : "";
+  if (error === "authorization_pending") return { kind: "pending" };
+  if (error === "slow_down") return { kind: "slow_down" };
+  if (error) return { kind: "stop", error: oauthError(body, status) };
+  const accessToken = typeof body?.access_token === "string" ? body.access_token : "";
+  if (!accessToken || status < 200 || status >= 300) {
+    return { kind: "stop", error: oauthError(body, status) };
+  }
+  const refreshToken = typeof body?.refresh_token === "string" && body.refresh_token ? body.refresh_token : void 0;
+  return {
+    kind: "ok",
+    accessToken,
+    refreshToken,
+    expiresIn: typeof body?.expires_in === "number" ? body.expires_in : void 0,
+    expiresAt: expiresAtFrom(body, accessToken, nowMs),
+    issuer: XAI_OAUTH_ISSUER,
+    clientId: GROK_OIDC_CLIENT_ID
+  };
 }
+
+// src/session.js
 function openExternal(url, options = {}) {
   const spawnFn = options.spawn ?? spawn;
   const platform = options.platform ?? process.platform;
@@ -1206,127 +1488,59 @@ function openExternal(url, options = {}) {
     child.unref?.();
   });
 }
-var LOGIN_URL_PATTERN = /https?:\/\/[^\s<>"'`\\]+/u;
-var DEVICE_CODE_PATTERN = /\b([A-Z0-9]{4}-[A-Z0-9]{4})\b/u;
-async function spawnGrokLogin(options = {}) {
-  const spawnFn = options.spawn ?? spawn;
-  const bin = resolveGrokBin(options.env, options.exists);
-  const args = options.device ? ["login", "--device-auth"] : ["login"];
-  const startTimeoutMs = typeof options.startTimeoutMs === "number" && options.startTimeoutMs > 0 ? options.startTimeoutMs : LOGIN_START_TIMEOUT_MS;
-  const openUrl = options.openUrl ?? ((url) => openExternal(url, { spawn: options.openSpawn }));
-  return new Promise((resolve, reject) => {
-    let child;
-    try {
-      child = spawnFn(bin, args, {
-        stdio: options.stdio ?? ["ignore", "pipe", "pipe"],
-        env: options.env ?? process.env
-      });
-    } catch (error) {
-      reject(new Error(`Could not start grok CLI (${bin})`, { cause: error }));
-      return;
-    }
-    let settled = false;
-    let loginUrl;
-    let userCode;
-    let buffer = "";
-    let timer;
-    const succeed = (value) => {
-      if (settled) return;
-      settled = true;
-      if (timer) clearTimeout(timer);
-      resolve(value);
-    };
-    const scan = (text) => {
-      if (text) buffer = `${buffer}${text}`.slice(-8192);
-      if (!userCode) {
-        const code = DEVICE_CODE_PATTERN.exec(buffer);
-        if (code) userCode = code[1];
-      }
-      if (loginUrl) return;
-      const match = LOGIN_URL_PATTERN.exec(buffer);
-      if (!match) return;
-      loginUrl = match[0];
-      try {
-        void openUrl(loginUrl);
-      } catch {
-      }
-      succeed({ ok: true, pending: true, loginUrl, userCode, child });
-    };
-    const piped = Boolean(child.stdout && child.stderr);
-    if (piped) {
-      child.stdout.on("data", (chunk) => scan(String(chunk)));
-      child.stderr.on("data", (chunk) => scan(String(chunk)));
-      timer = setTimeout(() => {
-        succeed({
-          ok: true,
-          pending: true,
-          loginUrl,
-          userCode,
-          child,
-          warning: `grok login printed no sign-in URL within ${startTimeoutMs}ms`
-        });
-      }, startTimeoutMs);
-    }
-    child.on("error", (error) => {
-      if (settled) return;
-      settled = true;
-      if (timer) clearTimeout(timer);
-      reject(new Error(`Could not start grok CLI (${bin})`, { cause: error }));
-    });
-    child.on("exit", (code, signal) => {
-      if (settled) return;
-      settled = true;
-      if (timer) clearTimeout(timer);
-      if (code === 0) resolve({ ok: true, pending: false, loginUrl, userCode, child });
-      else reject(new Error(signal ? `grok login terminated by ${signal}` : `grok login exited with code ${code ?? "unknown"}`));
-    });
+function defaultSleep(ms) {
+  return new Promise((resolve) => {
+    const timer = setTimeout(resolve, ms);
+    if (typeof timer.unref === "function") timer.unref();
   });
 }
-async function spawnGrokRefresh(options = {}) {
-  const spawnFn = options.spawn ?? spawn;
-  const bin = resolveGrokBin(options.env, options.exists);
-  const timeoutMs = typeof options.timeoutMs === "number" && options.timeoutMs > 0 ? options.timeoutMs : CLI_REFRESH_TIMEOUT_MS;
-  return new Promise((resolve, reject) => {
-    let child;
-    try {
-      child = spawnFn(bin, ["models"], {
-        stdio: options.stdio ?? "ignore",
-        env: options.env ?? process.env
-      });
-    } catch (error) {
-      reject(new Error(`Could not start grok CLI (${bin})`, { cause: error }));
-      return;
-    }
-    let settled = false;
-    const timer = setTimeout(() => {
-      if (settled) return;
-      settled = true;
-      try {
-        child.kill("SIGKILL");
-      } catch {
-      }
-      resolve({ ok: false, reason: "timeout" });
-    }, timeoutMs);
-    child.on("error", (error) => {
-      if (settled) return;
-      settled = true;
-      clearTimeout(timer);
-      reject(new Error(`Could not run grok CLI (${bin})`, { cause: error }));
-    });
-    child.on("exit", (code) => {
-      if (settled) return;
-      settled = true;
-      clearTimeout(timer);
-      resolve({ ok: true, code });
-    });
-  });
+function issuerOf(session) {
+  if (typeof session?.oidcIssuer === "string" && session.oidcIssuer.startsWith("https://")) return session.oidcIssuer;
+  const scope = typeof session?.scope === "string" ? session.scope : "";
+  const issuer = scope.split("::")[0];
+  if (issuer?.startsWith("https://")) return issuer;
+  return XAI_OAUTH_ISSUER;
+}
+function clientIdOf(session) {
+  if (typeof session?.oidcClientId === "string" && session.oidcClientId) return session.oidcClientId;
+  const scope = typeof session?.scope === "string" ? session.scope : "";
+  const clientId = scope.split("::")[1];
+  return clientId || GROK_OIDC_CLIENT_ID;
 }
 async function defaultRenewSession(options = {}) {
   const env = options.env ?? process.env;
-  if (!grokCliAvailable(env)) return void 0;
-  await spawnGrokRefresh({ env });
-  const parsed = (options.readAuth ?? readGrokAuthSession)();
-  return parsed?.session;
+  const path = options.authPath ?? authJsonPath(env);
+  const read = options.readAuth ?? (() => readGrokAuthSession(path));
+  let parsed;
+  try {
+    parsed = read();
+  } catch {
+    return void 0;
+  }
+  const current = parsed?.session;
+  if (!current?.refreshToken) return void 0;
+  const issuer = issuerOf(current);
+  const clientId = clientIdOf(current);
+  const fetchImpl = options.fetch ?? fetch;
+  const endpoints = options.endpoints ?? await discoverOauthEndpoints(issuer, { fetch: fetchImpl });
+  const nowMs = typeof options.now === "function" ? options.now() : Date.now();
+  const tokens = await refreshOauthToken({
+    endpoint: endpoints.tokenEndpoint,
+    clientId,
+    refreshToken: current.refreshToken,
+    fetch: fetchImpl,
+    now: () => nowMs
+  });
+  const written = writeOauthSession(path, {
+    issuer,
+    clientId,
+    accessToken: tokens.accessToken,
+    refreshToken: tokens.refreshToken || current.refreshToken,
+    expiresAt: tokens.expiresAt ?? current.expiresAt,
+    email: current.email,
+    userId: current.userId
+  });
+  return written.session;
 }
 async function defaultCredentialRefOf() {
   try {
@@ -1363,9 +1577,21 @@ function createSessionService({
   storeTokenTimeoutMs = STORE_TOKEN_TIMEOUT_MS,
   credentialsIoTimeoutMs = CREDENTIALS_IO_TIMEOUT_MS,
   credentialRefOf = defaultCredentialRefOf,
-  renewSession = defaultRenewSession,
+  renewSession,
+  fetch: fetchImpl,
+  authPath,
+  env,
+  oauthEndpoints,
   now = () => Date.now()
 } = {}) {
+  const renew = renewSession ?? (() => defaultRenewSession({
+    readAuth,
+    fetch: fetchImpl,
+    authPath,
+    env,
+    endpoints: oauthEndpoints,
+    now
+  }));
   let catalog = { models: [], source: "signed-out", error: void 0 };
   let lastPublic = publicSessionView(void 0);
   let lastUsage = unavailable("Not fetched yet");
@@ -1404,7 +1630,7 @@ function createSessionService({
     if (renewalInFlight) return renewalInFlight;
     renewalInFlight = (async () => {
       try {
-        const session = await renewSession();
+        const session = await renew();
         const token = adoptSession(session);
         if (token) notifyCatalogChange();
         return token;
@@ -1544,7 +1770,7 @@ function createSessionService({
           );
         });
       });
-      const message = parsed.reason === "api-key-only" ? "Found an API-key entry only. Sign in with SuperGrok / X Premium via grok login." : "No Grok Build subscription session in auth.json. Run grok login first.";
+      const message = parsed.reason === "api-key-only" ? "Found an API-key entry only. Sign in with a SuperGrok / X Premium account." : "No Grok Build subscription session in auth.json. Sign in from Settings first.";
       notifyCatalogChange();
       return { ok: false, error: message, account: lastPublic, catalog, usage: lastUsage };
     }
@@ -1566,15 +1792,16 @@ function createSessionService({
     kickBackgroundUsageRefresh();
     return { ok: true, account: lastPublic, catalog, usage: lastUsage };
   };
+  const snapshot = () => ({ account: lastPublic, catalog, usage: lastUsage, authPath: authPath ?? authJsonPath(env) });
   const status = async () => {
     if (typeof memoryAccessToken === "string" && memoryAccessToken.length > 0 || lastPublic.signedIn === true) {
-      return { account: lastPublic, catalog, usage: lastUsage, cliAvailable: grokCliAvailable(), authPath: authJsonPath() };
+      return snapshot();
     }
     try {
       const parsed = readAuth();
       if (parsed.session) {
         adoptSession(parsed.session);
-        return { account: lastPublic, catalog, usage: lastUsage, cliAvailable: grokCliAvailable(), authPath: authJsonPath() };
+        return snapshot();
       }
     } catch (error) {
       logger?.warn?.(
@@ -1593,36 +1820,95 @@ function createSessionService({
       lastPublic = publicSessionView(void 0);
       catalog = { models: [], source: "signed-out", error: void 0 };
       lastUsage = unavailable("Not signed in");
-      return { account: lastPublic, catalog, usage: lastUsage, cliAvailable: grokCliAvailable(), authPath: authJsonPath() };
+      return snapshot();
     }
     memoryAccessToken = token;
     lastPublic = Object.freeze({ signedIn: true, maskedAccount: "\u2022\u2022\u2022\u2022", authMode: "oidc", source: "dsh-credentials" });
-    return { account: lastPublic, catalog, usage: lastUsage, cliAvailable: grokCliAvailable(), authPath: authJsonPath() };
+    return snapshot();
   };
-  const login = async (options) => {
-    const started = await spawnGrokLogin(options);
-    const extra = {
-      ...started.loginUrl === void 0 ? {} : { loginUrl: started.loginUrl },
-      ...started.userCode === void 0 ? {} : { userCode: started.userCode },
-      ...started.warning === void 0 ? {} : { warning: started.warning }
-    };
-    if (started.pending) {
-      started.child?.once?.("exit", (code) => {
-        if (code !== 0) return;
-        scheduleDeferred(() => {
-          void pull().catch((error) => {
-            logger?.warn?.(
-              "Grok subscription login sync failed: %s",
-              error instanceof Error ? error.message : "unknown"
-            );
-          });
-        });
+  let loginEpoch = 0;
+  const login = async (loginOptions) => {
+    const epoch = ++loginEpoch;
+    const fetchLogin = loginOptions?.fetch ?? fetchImpl ?? fetch;
+    const path = loginOptions?.authPath ?? authPath ?? authJsonPath(env);
+    const sleep = loginOptions?.sleep ?? defaultSleep;
+    const openUrl = loginOptions?.openUrl ?? ((url) => openExternal(url, { spawn: loginOptions?.openSpawn }));
+    const clock = () => typeof loginOptions?.now === "function" ? loginOptions.now() : now();
+    let endpoints;
+    let device;
+    try {
+      endpoints = loginOptions?.endpoints ?? oauthEndpoints ?? await discoverOauthEndpoints(XAI_OAUTH_ISSUER, { fetch: fetchLogin });
+      device = await requestDeviceAuthorization({
+        endpoint: endpoints.deviceAuthorizationEndpoint,
+        fetch: fetchLogin
       });
-      return { ok: true, pending: true, ...extra, ...await status() };
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Could not start sign-in";
+      return { ok: false, error: message, ...await status() };
     }
-    return { ...await pull(), pending: false, ...extra };
+    const loginUrl = device.verificationUriComplete || device.verificationUri;
+    if (!isXaiHttpsUrl(loginUrl) || !device.userCode || !device.deviceCode) {
+      return { ok: false, error: "Sign-in did not return a verification link.", ...await status() };
+    }
+    try {
+      void openUrl(loginUrl);
+    } catch {
+    }
+    const deadline = clock() + (typeof device.expiresIn === "number" && device.expiresIn > 0 ? device.expiresIn : 900) * 1e3;
+    let interval = Number.isFinite(device.interval) && device.interval >= 0 ? device.interval : 5;
+    const poll = async () => {
+      try {
+        while (epoch === loginEpoch) {
+          if (clock() >= deadline) {
+            logger?.warn?.("Grok subscription sign-in timed out before authorization");
+            return;
+          }
+          await sleep(interval * 1e3);
+          if (epoch !== loginEpoch) return;
+          const result = await exchangeDeviceCode({
+            endpoint: endpoints.tokenEndpoint,
+            deviceCode: device.deviceCode,
+            fetch: fetchLogin,
+            now: clock
+          });
+          if (epoch !== loginEpoch) return;
+          if (result.kind === "pending") continue;
+          if (result.kind === "slow_down") {
+            interval += 5;
+            continue;
+          }
+          if (result.kind !== "ok") {
+            logger?.warn?.("Grok subscription sign-in stopped: %s", result.error ?? "unknown");
+            return;
+          }
+          writeOauthSession(path, {
+            issuer: result.issuer,
+            clientId: result.clientId,
+            accessToken: result.accessToken,
+            refreshToken: result.refreshToken,
+            expiresAt: result.expiresAt
+          });
+          if (epoch !== loginEpoch) return;
+          await pull();
+          return;
+        }
+      } catch (error) {
+        logger?.warn?.(
+          "Grok subscription sign-in failed: %s",
+          error instanceof Error ? error.message : "unknown"
+        );
+      } finally {
+        try {
+          loginOptions?.onSettled?.();
+        } catch {
+        }
+      }
+    };
+    void poll();
+    return { ok: true, pending: true, loginUrl, userCode: device.userCode, ...await status() };
   };
   const logout = async () => {
+    loginEpoch += 1;
     memoryAccessToken = void 0;
     memorySessionTouched = true;
     await clearToken().catch((error) => {
@@ -1645,7 +1931,7 @@ function createSessionService({
     login,
     logout,
     currentToken: readStoredToken,
-    /** Force a CLI-backed renewal; used when the provider answers 401. */
+    /** Force a refresh-token renewal; used when the provider answers 401. */
     refreshToken: () => renewAccessToken(),
     models: () => catalog.models,
     catalog: () => catalog,
@@ -1656,10 +1942,10 @@ function createSessionService({
 
 // src/plugin-version.js
 import { spawn as spawn2 } from "node:child_process";
-import { existsSync as existsSync4 } from "node:fs";
+import { existsSync as existsSync3 } from "node:fs";
 import { readdir, readFile, realpath } from "node:fs/promises";
 import { homedir as homedir3 } from "node:os";
-import { join as join4 } from "node:path";
+import { join as join3 } from "node:path";
 import { fileURLToPath } from "node:url";
 var PACKAGE_NAME = PLUGIN_ID;
 var NPM_REGISTRY_LATEST_URL = `https://registry.npmjs.org/${PACKAGE_NAME}/latest`;
@@ -1703,7 +1989,7 @@ var readManifest = async (path) => {
 };
 async function confirmInstalled({ profileDir, expected, settleDelayMs, attempts = 3 }) {
   for (let attempt = 1; attempt <= attempts; attempt += 1) {
-    const installed = (await readManifest(join4(profileDir, "node_modules", PACKAGE_NAME, "package.json")))?.version;
+    const installed = (await readManifest(join3(profileDir, "node_modules", PACKAGE_NAME, "package.json")))?.version;
     if (installed === expected) return;
     if (attempt < attempts) await new Promise((resolve) => {
       setTimeout(resolve, settleDelayMs);
@@ -1720,20 +2006,20 @@ async function findInstall({ dshHome, ownPackageJsonUrl }) {
   }
   let entries = [];
   try {
-    entries = await readdir(join4(dshHome, "profiles"), { withFileTypes: true });
+    entries = await readdir(join3(dshHome, "profiles"), { withFileTypes: true });
   } catch {
     entries = [];
   }
   const declared = [];
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
-    const profileDir = join4(dshHome, "profiles", entry.name);
-    const spec = (await readManifest(join4(profileDir, "package.json")))?.dependencies?.[PACKAGE_NAME];
+    const profileDir = join3(dshHome, "profiles", entry.name);
+    const spec = (await readManifest(join3(profileDir, "package.json")))?.dependencies?.[PACKAGE_NAME];
     if (typeof spec !== "string") continue;
     declared.push({ profile: entry.name, spec });
     if (ownReal === void 0) continue;
     try {
-      const installed = await realpath(join4(profileDir, "node_modules", PACKAGE_NAME, "package.json"));
+      const installed = await realpath(join3(profileDir, "node_modules", PACKAGE_NAME, "package.json"));
       if (installed === ownReal) return { kind: classifySpec(spec), profile: entry.name };
     } catch {
     }
@@ -1741,9 +2027,9 @@ async function findInstall({ dshHome, ownPackageJsonUrl }) {
   if (declared.length === 1) return { kind: classifySpec(declared[0].spec), profile: declared[0].profile };
   return { kind: "unknown" };
 }
-var isExistingPath = (value) => typeof value === "string" && value !== "" && existsSync4(value);
+var isExistingPath = (value) => typeof value === "string" && value !== "" && existsSync3(value);
 var PNPM_SCRIPT = /[\\/]pnpm\.(?:mjs|cjs|js)$/u;
-var dshRuntimeRoot = (value) => isExistingPath(value) && existsSync4(join4(value, "node_modules", "@deepseek-ai", "dsh", "package.json")) ? value : void 0;
+var dshRuntimeRoot = (value) => isExistingPath(value) && existsSync3(join3(value, "node_modules", "@deepseek-ai", "dsh", "package.json")) ? value : void 0;
 function resolvePnpm({ argv } = {}) {
   const entries = Array.isArray(argv) ? argv : [];
   for (const entry of entries) {
@@ -1752,8 +2038,8 @@ function resolvePnpm({ argv } = {}) {
   for (const entry of entries) {
     const root = dshRuntimeRoot(entry);
     if (root === void 0) continue;
-    const script = join4(root, "..", "pnpm", "bin", "pnpm.mjs");
-    if (existsSync4(script)) return script;
+    const script = join3(root, "..", "pnpm", "bin", "pnpm.mjs");
+    if (existsSync3(script)) return script;
   }
   return void 0;
 }
@@ -1826,15 +2112,15 @@ function createGrokPluginManager({
 } = {}) {
   if (typeof fetchImpl !== "function") throw new Error("Grok plugin manager requires fetch");
   if (typeof runCommand !== "function") throw new Error("Grok plugin manager requires runCommand");
-  const dshHome = typeof env.DSH_HOME === "string" && env.DSH_HOME !== "" ? env.DSH_HOME : join4(homedir3(), ".dsh");
+  const dshHome = typeof env.DSH_HOME === "string" && env.DSH_HOME !== "" ? env.DSH_HOME : join3(homedir3(), ".dsh");
   const launcher = resolveLauncher({ argv, execPath });
   let cached;
   let inFlight;
   let generation = 0;
   let updating = false;
   const fetchLatest = async (signal) => {
-    const timeoutSignal = AbortSignal.timeout(timeoutMs);
-    const requestSignal = signal === void 0 ? timeoutSignal : AbortSignal.any([signal, timeoutSignal]);
+    const timeoutSignal2 = AbortSignal.timeout(timeoutMs);
+    const requestSignal = signal === void 0 ? timeoutSignal2 : AbortSignal.any([signal, timeoutSignal2]);
     let response;
     try {
       response = await fetchImpl(registryUrl, {
@@ -1916,7 +2202,7 @@ function createGrokPluginManager({
           throw new Error("Grok plugin update could not find the owning profile");
         }
         const latest = await fetchLatest(signal);
-        const profileDir = join4(dshHome, "profiles", install.profile);
+        const profileDir = join3(dshHome, "profiles", install.profile);
         let result;
         try {
           result = await runCommand({
@@ -1982,7 +2268,10 @@ function stripSecrets(value) {
   delete next.accessToken;
   delete next.token;
   delete next.refresh;
+  delete next.refreshToken;
   delete next.refresh_token;
+  delete next.deviceCode;
+  delete next.device_code;
   delete next.key;
   if (next.catalog) {
     next.catalog = {