ima2-gen 3.15.1 → 3.16.0

package/lib/grokVideoPoll.js

@@ -13,9 +13,9 @@ export function isRecoverablePollError(err) {
     // A 4xx means the request itself is wrong (bad id, revoked auth) — not transient.
     return typeof status !== "number" || status >= 500 || status === 429;
 }
-export async function pollVideoOnce(ctx, requestId, signal, directApiKey) {
+export async function pollVideoOnce(ctx, requestId, signal, credential) {
     const cfg = videoConfig(ctx);
-    const { url, headers } = videoEndpoint(ctx, `/v1/videos/${requestId}`, directApiKey);
+    const { url, headers } = videoEndpoint(ctx, `/v1/videos/${requestId}`, credential);
     const { combinedSignal, timer } = withTimeoutSignal(signal, cfg.startTimeoutMs);
     try {
         const res = await grokFetchWithRetry(() => fetch(url, { method: "GET", headers, signal: combinedSignal }), { signal: combinedSignal, label: "video-poll" });
@@ -58,7 +58,7 @@ export async function pollVideoUntilDone(ctx, requestId, options) {
             throw grokError("Grok video poll budget exceeded", 504, "GROK_VIDEO_TIMEOUT");
         let poll;
         try {
-            poll = await pollVideoOnce(ctx, requestId, options.signal, options.directApiKey);
+            poll = await pollVideoOnce(ctx, requestId, options.signal, options.credential);
             consecutiveErrors = 0;
         }
         catch (e) { // justified: grokError attaches code/status at runtime

package/lib/grokVideoShared.js

@@ -1,4 +1,4 @@
-import { getGrokProxyUrl } from "./grokRuntime.js";
+import { getGrokEndpoint } from "./grokRuntime.js";
 import { grokError } from "./grokImageCore.js";
 import { GROK_FALLBACK_VIDEO_MODEL } from "./imageModels.js";
 import { DEFAULT_GROK_PLANNER_MODEL } from "../config.js";
@@ -33,18 +33,11 @@ export function videoConfig(ctx) {
         planTotalTimeoutMs: Math.max(configuredPlanTotal, minimumPlanTotal),
     };
 }
-export function videoEndpoint(ctx, path, directApiKey) {
-    if (directApiKey) {
-        const normalizedPath = path.startsWith("/") ? path : `/${path}`;
-        return {
-            url: `https://api.x.ai${normalizedPath}`,
-            headers: { "Content-Type": "application/json", Authorization: `Bearer ${directApiKey}` },
-        };
-    }
-    return {
-        url: getGrokProxyUrl(ctx, path),
-        headers: { "Content-Type": "application/json", Authorization: "Bearer dummy" },
-    };
+/** Same endpoint builder as images; kept under the video name so the poll loop stays a leaf. */
+export function videoEndpoint(_ctx, path, credential) {
+    if (!credential)
+        throw grokError("Grok credential was not resolved before the request", 500, "GROK_CREDENTIAL_UNRESOLVED");
+    return getGrokEndpoint(path, credential);
 }
 export function withTimeoutSignal(signal, timeoutMs) {
     const timeoutController = new AbortController();

package/lib/promptBuilder/router.js

@@ -1,4 +1,5 @@
-import { getGrokEndpoint } from "../grokImageCore.js";
+import { getGrokEndpoint, resolveGrokCredential } from "../grokRuntime.js";
+import { GrokAuthError } from "../xaiAuth.js";
 import { waitForOAuthReady } from "../oauthProxy/runtime.js";
 import { PROMPT_BUILDER_AUTO_ORDER, } from "./constants.js";
 import { promptBuilderError } from "./errors.js";
@@ -13,6 +14,25 @@ function unavailableBackendError(backend) {
         ? "PROMPT_BUILDER_OAUTH_UNAVAILABLE"
         : "PROMPT_BUILDER_GROK_UNAVAILABLE", 503);
 }
+/**
+ * Both Grok lanes now go through the same resolver, so a missing credential surfaces as the
+ * lane's own "unavailable" error instead of a raw auth failure. A refresh that fails against
+ * xAI is a real upstream fault and propagates unchanged.
+ */
+async function grokCredential(ctx, backend) {
+    try {
+        return await resolveGrokCredential(ctx, backend);
+    }
+    catch (error) {
+        if (error instanceof GrokAuthError && error.code === "GROK_AUTH_REQUIRED") {
+            throw unavailableBackendError("grok");
+        }
+        if (error?.code === "GROK_API_KEY_MISSING") {
+            throw unavailableBackendError("grok-api");
+        }
+        throw error;
+    }
+}
 export function selectPromptBuilderBackend(requestedBackend, lanes, allowed = PROMPT_BUILDER_AUTO_ORDER) {
     if (requestedBackend !== "auto") {
         if (lanes[requestedBackend]?.status !== "ready") {
@@ -57,11 +77,7 @@ export async function resolvePromptBuilderTransport(ctx, backend, endpoint) {
                 useOAuthFetch: false,
             };
         }
-        const directApiKey = backend === "grok-api" ? ctx.xaiApiKey : undefined;
-        if (backend === "grok-api" && !directApiKey) {
-            throw unavailableBackendError("grok-api");
-        }
-        const target = getGrokEndpoint(ctx, "/v1/chat/completions", directApiKey);
+        const target = getGrokEndpoint("/v1/chat/completions", await grokCredential(ctx, backend));
         return { ...target, useOAuthFetch: false };
     }
     catch (error) {

package/lib/providers/adapters/grokExecution.js

@@ -1,4 +1,5 @@
 import { planGrokImage } from "../../grokImagePlanner.js";
+import { resolveGrokCredential } from "../../grokRuntime.js";
 import { resolveGrokQualityModel } from "../../imageModels.js";
 import { toGrokReferences } from "../../nodeHelpers.js";
 import { generateViaGrok, editViaGrok } from "./grokOperations.js";
@@ -13,7 +14,7 @@ async function prepareGrokClassic(ctx, request) {
         ? [{ b64: "", url: request.providerUrl, declaredMime: "image/png", detectedMime: "image/png" }, ...request.references]
         : request.references;
     // Keep classic's once-per-batch key and shared plan capture before any image attempt.
-    const grokDirectApiKey = activeProvider === "grok-api" ? ctx.xaiApiKey : undefined;
+    const credential = await resolveGrokCredential(ctx, activeProvider, { signal: request.signal });
     const sharedGrokPlan = await planGrokImage(generationPrompt, ctx, {
         model: resolveGrokQualityModel(imageModel, quality),
         size: effectiveSize,
@@ -21,7 +22,7 @@ async function prepareGrokClassic(ctx, request) {
         requestId,
         referenceCount: grokRefs.length,
         references: grokRefs,
-        directApiKey: grokDirectApiKey,
+        credential,
         backgroundConstraint: request.backgroundConstraint,
         webSearchEnabled,
     });
@@ -35,45 +36,45 @@ async function prepareGrokClassic(ctx, request) {
                 plannedPrompt: sharedGrokPlan?.prompt,
                 webSearchCalls: sharedGrokPlan?.webSearchCalls,
                 references: grokRefs,
-                directApiKey: grokDirectApiKey,
+                credential,
             });
             return { kind: "single", value };
         } };
 }
-function prepareGrokNode(ctx, request) {
-    // The outer execution boundary checks current presence; retries retain this key.
-    const grokDirectApiKey = request.provider === "grok-api" ? ctx.xaiApiKey : undefined;
+async function prepareGrokNode(ctx, request) {
+    // The outer execution boundary checks current presence; retries retain this credential.
+    const credential = await resolveGrokCredential(ctx, request.provider, { signal: request.signal });
     return { execute: async () => {
-            return { kind: "single", value: await executeGrokNode(ctx, request, grokDirectApiKey) };
+            return { kind: "single", value: await executeGrokNode(ctx, request, credential) };
         } };
 }
-async function executeGrokNode(ctx, request, grokDirectApiKey) {
+async function executeGrokNode(ctx, request, credential) {
     const { sourceImage: parentB64, prompt: generationPrompt, references, requestId, signal, options } = request;
     const { model, size, webSearchEnabled } = options;
     const refsForRequest = request.contextMode === "parent-only" ? [] : references;
     return await generateViaGrok(generationPrompt, ctx, {
         model, size, requestId, signal,
         references: toGrokReferences(parentB64, refsForRequest),
-        directApiKey: grokDirectApiKey,
+        credential,
         webSearchEnabled,
     });
 }
 async function executeGrokEdit(ctx, request) {
     const { provider, rawPrompt, sourceImage, signal, requestId, options } = request;
-    const directApiKey = provider === "grok-api" ? ctx.xaiApiKey : undefined;
+    const credential = await resolveGrokCredential(ctx, provider, { signal });
     return await editViaGrok(rawPrompt, sourceImage, ctx, {
         model: resolveGrokQualityModel(options.model, options.quality),
-        size: options.size, signal, requestId, directApiKey,
+        size: options.size, signal, requestId, credential,
     });
 }
 async function executeGrokMultimode(ctx, request, progress) {
     const { provider, prompt, references, signal, requestId, options, maxImages } = request;
-    const directApiKey = provider === "grok-api" ? ctx.xaiApiKey : undefined;
+    const credential = await resolveGrokCredential(ctx, provider, { signal });
     const grokRefs = request.providerUrl
         ? [{ b64: "", url: request.providerUrl }, ...references] : references;
     return await generateMultimodeViaGrok(prompt, ctx, {
         model: resolveGrokQualityModel(options.model, options.quality), maxImages,
-        size: options.size, signal, requestId, references: grokRefs, directApiKey,
+        size: options.size, signal, requestId, references: grokRefs, credential,
         onFinalImage: progress.onFinalImage,
         webSearchEnabled: options.webSearchEnabled,
     });
@@ -81,7 +82,7 @@ async function executeGrokMultimode(ctx, request, progress) {
 export async function prepareGrokExecution(ctx, request, progress = {}) {
     switch (request.surface) {
         case "classic": return await prepareGrokClassic(ctx, request);
-        case "node": return prepareGrokNode(ctx, request);
+        case "node": return await prepareGrokNode(ctx, request);
         case "edit": return { execute: async () => {
                 return { kind: "single", value: await executeGrokEdit(ctx, request) };
             } };

package/lib/providers/adapters/grokMultimodeOperations.js

@@ -1,7 +1,7 @@
 import { errInfo } from "../../errInfo.js";
 import { imageEditPayload, imagePayload, postGrokImages, grokError, downloadGrokImageUrl, } from "../../grokImageCore.js";
 import { planGrokImage } from "../../grokImagePlanner.js";
-import { getGrokProxyBaseUrl } from "../../grokRuntime.js";
+import { resolveGrokCredential } from "../../grokRuntime.js";
 import { logEvent } from "../../logger.js";
 /**
  * Representative-error policy for a multimode run.
@@ -22,6 +22,10 @@ export async function generateMultimodeViaGrok(prompt, ctx, options = {}) {
     const maxGeneratedImages = Math.max(1, Math.trunc(Number(ctx.config.limits?.maxGeneratedImages) || 24));
     const maxImages = Math.min(maxGeneratedImages, Math.max(1, Math.trunc(Number(options.maxImages) || 4)));
     const references = options.references || [];
+    // One credential for the whole batch: a per-item resolve would refresh the OAuth
+    // session mid-run and give items inconsistent bearers.
+    const credential = options.credential
+        ?? await resolveGrokCredential(ctx, "grok", { ...(options.signal ? { signal: options.signal } : {}) });
     const images = [];
     const originalIndexes = [];
     let totalCost = 0;
@@ -38,7 +42,7 @@ export async function generateMultimodeViaGrok(prompt, ctx, options = {}) {
             signal: options.signal,
             requestId: options.requestId,
             references,
-            directApiKey: options.directApiKey,
+            credential,
             webSearchEnabled: options.webSearchEnabled,
         });
         totalWebSearchCalls += plan.webSearchCalls;
@@ -54,13 +58,11 @@ export async function generateMultimodeViaGrok(prompt, ctx, options = {}) {
                 refs: references.length,
                 promptChars: plan.prompt.length,
             });
-            const result = await postGrokImages(ctx, payload, options.signal, endpoint, options.directApiKey);
+            const result = await postGrokImages(ctx, payload, options.signal, endpoint, credential);
             const imgUrl = result.data?.[0]?.url;
             if (imgUrl) {
-                const dl = await downloadGrokImageUrl(imgUrl, options.signal, undefined, {
-                    trustedProxyOrigin: options.directApiKey
-                        ? undefined : new URL(getGrokProxyBaseUrl(ctx)).origin,
-                });
+                // Direct lane: the artifact URL is a public https origin, so no proxy hop is trusted.
+                const dl = await downloadGrokImageUrl(imgUrl, options.signal);
                 const img = { b64: dl.b64, mime: dl.mime, revisedPrompt: plan.prompt, providerUrl: imgUrl };
                 images.push(img);
                 originalIndexes.push(i);

package/lib/providers/adapters/grokOperations.js

@@ -1,15 +1,27 @@
 import { logEvent } from "../../logger.js";
 import { detectImageMimeFromB64 } from "../../refs.js";
 import { mapSizeToGrokImageParams } from "../../grokSizeMapper.js";
-import { getGrokProxyBaseUrl } from "../../grokRuntime.js";
+import { resolveGrokCredential } from "../../grokRuntime.js";
 import { planGrokImage } from "../../grokImagePlanner.js";
 import { grokError, imagePayload, imageEditPayload, postGrokImages, downloadGrokImageUrl, } from "../../grokImageCore.js";
+/**
+ * Execution resolves the credential once per request and threads it down. Legacy direct
+ * callers (lib/grokImageAdapter, lib/agentImageVideoGen) omit it, and for them the OAuth
+ * `grok` lane is the correct default: the api-key lane is only ever reached by passing a
+ * credential explicitly.
+ */
+async function requireCredential(ctx, options) {
+    if (options.credential)
+        return options.credential;
+    return await resolveGrokCredential(ctx, "grok", { ...(options.signal ? { signal: options.signal } : {}) });
+}
 export async function generateViaGrok(prompt, ctx, options = {}) {
     const model = options.model || ctx.config.grokProvider?.defaultImageModel || "grok-imagine-image-quality";
     const references = options.references || [];
+    const credential = await requireCredential(ctx, options);
     const plan = options.plannedPrompt
         ? { prompt: options.plannedPrompt, model, webSearchCalls: options.webSearchCalls ?? 1 }
-        : await planGrokImage(prompt, ctx, { ...options, referenceCount: references.length, directApiKey: options.directApiKey, webSearchEnabled: options.webSearchEnabled });
+        : await planGrokImage(prompt, ctx, { ...options, referenceCount: references.length, credential, webSearchEnabled: options.webSearchEnabled });
     const hasReferences = references.length > 0;
     const payload = hasReferences
         ? imageEditPayload(model, plan.prompt, references, options.size)
@@ -23,15 +35,13 @@ export async function generateViaGrok(prompt, ctx, options = {}) {
         size: options.size,
         refs: references.length,
     });
-    const result = await postGrokImages(ctx, payload, options.signal, endpoint, options.directApiKey);
+    const result = await postGrokImages(ctx, payload, options.signal, endpoint, credential);
     const imageUrl = result.data?.[0]?.url;
     if (!imageUrl) {
         throw grokError("Grok returned no image URL", 502, "GROK_EMPTY_RESPONSE");
     }
-    const downloaded = await downloadGrokImageUrl(imageUrl, options.signal, undefined, {
-        trustedProxyOrigin: options.directApiKey
-            ? undefined : new URL(getGrokProxyBaseUrl(ctx)).origin,
-    });
+    // Direct lane: the artifact URL is a public https origin, so no proxy hop is trusted.
+    const downloaded = await downloadGrokImageUrl(imageUrl, options.signal);
     const usage = result.usage ? { grok_cost_usd_ticks: result.usage.cost_in_usd_ticks ?? 0 } : null;
     logEvent("grok", "generate:done", {
         requestId: options.requestId,
@@ -48,15 +58,12 @@ export async function editViaGrok(prompt, imageB64, ctx, options = {}) {
     const imageUrl = imageB64.startsWith("data:") ? imageB64 : `data:${detectedInputMime};base64,${imageB64}`;
     const payload = { model, prompt, n: 1, response_format: "url", image: { type: "image_url", url: imageUrl }, ...mapSizeToGrokImageParams(options.size) };
     logEvent("grok", "edit:start", { requestId: options.requestId, model, promptChars: prompt.length });
-    const result = await postGrokImages(ctx, payload, options.signal, "/v1/images/edits", options.directApiKey);
+    const result = await postGrokImages(ctx, payload, options.signal, "/v1/images/edits", await requireCredential(ctx, options));
     const editResultUrl = result.data?.[0]?.url;
     if (!editResultUrl) {
         throw grokError("Grok edit returned no image URL", 502, "GROK_EMPTY_RESPONSE");
     }
-    const downloaded = await downloadGrokImageUrl(editResultUrl, options.signal, undefined, {
-        trustedProxyOrigin: options.directApiKey
-            ? undefined : new URL(getGrokProxyBaseUrl(ctx)).origin,
-    });
+    const downloaded = await downloadGrokImageUrl(editResultUrl, options.signal);
     const usage = result.usage ? { grok_cost_usd_ticks: result.usage.cost_in_usd_ticks ?? 0 } : null;
     logEvent("grok", "edit:done", { requestId: options.requestId, model, b64Len: downloaded.b64.length });
     return { b64: downloaded.b64, providerUrl: editResultUrl, usage, webSearchCalls: 0, mime: downloaded.mime, revisedPrompt: result.data[0]?.revised_prompt || prompt };

package/lib/providers/execution/admission.js

@@ -1,9 +1,25 @@
 import { getProviderSurfaceSupport } from "../derive.js";
+import { loadGrokCredentials } from "../../xaiAuth.js";
+/**
+ * Both Grok lanes are admitted the same way: the api-key lane needs XAI_API_KEY, and the
+ * OAuth lane needs a stored xAI session. loadGrokCredentials is synchronous and never
+ * throws, so this stays a cheap presence check — expiry and refresh belong to
+ * resolveGrokCredential at the actual request.
+ */
 function directKeyFailure(ctx, provider) {
-    if (provider !== "grok-api" || (typeof ctx.xaiApiKey === "string" && ctx.xaiApiKey.trim()))
-        return null;
-    return { status: 401, code: "GROK_API_KEY_MISSING",
-        message: "Grok API key is required for grok-api image generation" };
+    if (provider === "grok-api") {
+        if (typeof ctx.xaiApiKey === "string" && ctx.xaiApiKey.trim())
+            return null;
+        return { status: 401, code: "GROK_API_KEY_MISSING",
+            message: "Grok API key is required for grok-api image generation" };
+    }
+    if (provider === "grok") {
+        if (loadGrokCredentials(ctx.grokAuthHomeDir))
+            return null;
+        return { status: 401, code: "GROK_AUTH_REQUIRED",
+            message: "Grok login required. Run: ima2 grok login" };
+    }
+    return null;
 }
 export function checkImageExecutionAdmission(ctx, input) {
     const missingKey = directKeyFailure(ctx, input.provider);

package/lib/providers/registry.js

@@ -62,7 +62,7 @@ export const REGISTRY = [
         id: "grok",
         surfaces: ["generate", "edit", "multimode", "node", "video"],
         vendor: "xai",
-        credentials: [{ kind: "oauth-proxy", envVars: ["IMA2_GROK_PROXY_HOST", "IMA2_GROK_PROXY_PORT"], configKey: "grokProvider" }],
+        credentials: [{ kind: "oauth", authFile: "~/.progrok/auth.json" }],
         models: [
             { id: "grok-imagine-image-2.0", kind: "image", supports: EDIT },
             { id: "grok-imagine-image", kind: "image", supports: EDIT },

package/lib/runtimeContext.js

@@ -25,15 +25,6 @@ export function requireRuntimeContext(ctx) {
     }
     if (target.hasApiKey === undefined)
         target.hasApiKey = false;
-    if (target.grokPort === undefined) {
-        target.grokPort = target.config.grokProvider?.proxyPort ?? 18645;
-    }
-    if (target.grokUrl === undefined) {
-        const grokCfg = target.config.grokProvider;
-        const host = grokCfg?.proxyHost ?? "127.0.0.1";
-        const port = target.grokActualPort ?? target.grokPort ?? grokCfg?.proxyPort ?? 18645;
-        target.grokUrl = `http://${host}:${port}/v1`;
-    }
     if (target.oauthPort === undefined) {
         target.oauthPort = target.config.oauth?.proxyPort ?? 11782;
     }
@@ -128,9 +119,6 @@ export function createTestRuntimeContext(over = {}) {
         apiKeySource: undefined,
         adminNonce: "",
         config: {},
-        grokActualPort: undefined,
-        grokPort: 18645,
-        grokUrl: "http://127.0.0.1:18645/v1",
         hasApiKey: false,
         oauthActualPort: undefined,
         oauthPort: 11782,

package/lib/videoExtendI2vOperation.js

@@ -1,3 +1,4 @@
+import { resolveGrokCredential } from "./grokRuntime.js";
 import { appendVideoContinuityEntry, lineageFromVideoMetadata } from "./videoContinuity.js";
 import { deriveChildVideoLineage } from "./videoLineage.js";
 import { invalidateHistoryIndex } from "./historyIndex.js";
@@ -34,11 +35,14 @@ export async function runLastFrameI2v(task) {
             });
         };
         const compiledPrompt = motion.fragment ? `${prompt}\n\nCamera motion: ${motion.fragment}.` : prompt;
+        // Resolved before the generate call so a missing key or an expired session fails here,
+        // as a normal job error, instead of midway through the provider request.
+        const credential = await resolveGrokCredential(ctx, provider, { signal: cancelController.signal });
         const result = await generateVideo(compiledPrompt, ctx, {
             model, mode: "image-to-video", duration, resolution, aspectRatio,
             sourceImage, sourceMime: "image/png", signal: cancelController.signal,
             requestId, continuityLineage: parentContinuity,
-            directApiKey: provider === "grok-api" ? ctx.xaiApiKey ?? undefined : undefined,
+            credential,
             onEvent,
         });
         if (cancelController.signal.aborted)