ima2-gen 3.15.1 → 3.16.0

package/lib/xaiAuth.js

@@ -0,0 +1,369 @@
+/**
+ * xAI (Grok) OAuth credential store and refresh client.
+ *
+ * Ported from OpenCodex `src/oauth/xai.ts` (refresh path only) with the D1-D6/D9 fixes
+ * recorded in devlog/_plan/260909_grok_native_oauth/001_opencodex_port_spec.md.
+ *
+ * MUST stay a leaf module: only node:fs, node:crypto, node:os, node:path. No imports from
+ * config, routes, adapters, or the logger — adapters call loadGrokCredentials() synchronously.
+ *
+ * The file on disk (~/.progrok/auth.json) is the single source of truth. There is deliberately
+ * no in-memory credential cache: progrok may refresh the same file from another process, and a
+ * cache would make this module serve a token that was already rotated away.
+ */
+import { randomBytes } from "node:crypto";
+import { mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+export const XAI_OAUTH_ISSUER = "https://auth.x.ai";
+export const XAI_OAUTH_DISCOVERY_URL = `${XAI_OAUTH_ISSUER}/.well-known/openid-configuration`;
+export const XAI_OAUTH_CLIENT_ID = "b1a00492-073a-47ea-816f-4c329264a828";
+export const XAI_OAUTH_SCOPE = "openid profile email offline_access grok-cli:access api:access";
+export const XAI_TOKEN_ENDPOINT_FALLBACK = `${XAI_OAUTH_ISSUER}/oauth2/token`;
+export const XAI_TOKEN_REFRESH_SKEW_MS = 120_000;
+export const XAI_TOKEN_REQUEST_TIMEOUT_MS = 30_000;
+/** progrok's CORS allow-list (dist/index.js:24). Any other host is a poisoned discovery doc. */
+const XAI_TRUSTED_AUTH_HOSTS = new Set(["auth.x.ai", "accounts.x.ai"]);
+const XAI_TOKEN_MAX_ATTEMPTS = 3;
+/** Retry-After is honored as sent (D1), but never long enough to hang a request forever. */
+const RETRY_AFTER_CAP_MS = 60_000;
+const JITTER_CAP_MS = 2_000;
+const FLIGHT_STALE_MS = 120_000;
+const TERMINAL_FAILURE_TTL_MS = 30_000;
+const TERMINAL_OAUTH_ERRORS = new Set(["invalid_grant", "refresh_token_reused", "revoked_token"]);
+const httpStatusForGrokAuthCode = {
+    GROK_AUTH_REQUIRED: 401,
+    GROK_AUTH_REFRESH_FAILED: 502,
+};
+export class GrokAuthError extends Error {
+    code;
+    status;
+    oauthError;
+    constructor(code, message, options) {
+        super(message, options && "cause" in options ? { cause: options.cause } : undefined);
+        this.name = "GrokAuthError";
+        this.code = code;
+        this.status = httpStatusForGrokAuthCode[code];
+        if (options?.oauthError !== undefined)
+            this.oauthError = options.oauthError;
+    }
+}
+export class XaiTokenRequestError extends Error {
+    status;
+    oauthError;
+    constructor(status, oauthError, message = "xAI token request failed", options) {
+        super(message, options && "cause" in options ? { cause: options.cause } : undefined);
+        this.name = "XaiTokenRequestError";
+        if (status !== undefined)
+            this.status = status;
+        if (oauthError !== undefined)
+            this.oauthError = oauthError;
+    }
+}
+// ---------------------------------------------------------------------------
+// Credential file I/O
+// ---------------------------------------------------------------------------
+export function grokAuthFilePath(homeDir = homedir()) {
+    return join(homeDir, ".progrok", "auth.json");
+}
+/** Never throws: a missing, unreadable, or malformed file is simply "not logged in". */
+export function loadGrokCredentials(homeDir) {
+    try {
+        const parsed = JSON.parse(readFileSync(grokAuthFilePath(homeDir), "utf8"));
+        if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed))
+            return null;
+        const record = parsed;
+        if (typeof record.accessToken !== "string" || record.accessToken.length === 0)
+            return null;
+        // Keep the raw record so unknown keys written by progrok survive a round-trip.
+        return record;
+    }
+    catch {
+        return null;
+    }
+}
+/** Atomic 0600 write (tmp + rename); the directory is forced to 0700. */
+export function saveGrokCredentials(creds, homeDir) {
+    const target = grokAuthFilePath(homeDir);
+    const dir = dirname(target);
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const tmp = join(dir, `auth.json.tmp-${randomBytes(6).toString("hex")}`);
+    writeFileSync(tmp, JSON.stringify(creds, null, 2), { mode: 0o600 });
+    renameSync(tmp, target);
+}
+/** Explicit logout only. A refresh failure must never delete the file. */
+export function clearGrokCredentials(homeDir) {
+    rmSync(grokAuthFilePath(homeDir), { force: true });
+}
+// ---------------------------------------------------------------------------
+// Discovery
+// ---------------------------------------------------------------------------
+function requestSignal(signal) {
+    const timeoutSignal = AbortSignal.timeout(XAI_TOKEN_REQUEST_TIMEOUT_MS);
+    return signal ? AbortSignal.any([signal, timeoutSignal]) : timeoutSignal;
+}
+/** D6: exact host allow-list, https only, and no userinfo that fetch could turn into auth. */
+function validateXaiAuthEndpoint(rawUrl) {
+    const parsed = new URL(rawUrl);
+    const host = parsed.hostname.toLowerCase();
+    if (parsed.protocol !== "https:" || parsed.username || parsed.password || !XAI_TRUSTED_AUTH_HOSTS.has(host)) {
+        throw new Error(`xAI OAuth endpoint is not trusted: ${rawUrl}`);
+    }
+    return parsed.toString();
+}
+export async function discoverXaiOAuthEndpoints(signal) {
+    const response = await fetch(XAI_OAUTH_DISCOVERY_URL, {
+        headers: { Accept: "application/json" },
+        signal: requestSignal(signal),
+    });
+    if (!response.ok) {
+        throw new Error(`xAI OAuth discovery failed: ${response.status} ${await response.text()}`);
+    }
+    const payload = (await response.json());
+    if (typeof payload.authorization_endpoint !== "string" || typeof payload.token_endpoint !== "string") {
+        throw new Error("xAI OAuth discovery response missing authorization/token endpoints");
+    }
+    const discovery = {
+        authorizationEndpoint: validateXaiAuthEndpoint(payload.authorization_endpoint),
+        tokenEndpoint: validateXaiAuthEndpoint(payload.token_endpoint),
+    };
+    if (typeof payload.device_authorization_endpoint === "string") {
+        discovery.deviceAuthorizationEndpoint = validateXaiAuthEndpoint(payload.device_authorization_endpoint);
+    }
+    return discovery;
+}
+// ---------------------------------------------------------------------------
+// Token endpoint
+// ---------------------------------------------------------------------------
+function defaultSleep(ms) {
+    return new Promise((resolve) => {
+        setTimeout(resolve, ms);
+    });
+}
+/** D2: RFC 9110 allows delay-seconds (including fractions) and HTTP-date. */
+function parseRetryAfterMs(retryAfter) {
+    const raw = retryAfter?.trim();
+    if (!raw)
+        return undefined;
+    const seconds = Number(raw);
+    if (Number.isFinite(seconds))
+        return Math.max(0, seconds * 1000);
+    const dateMs = Date.parse(raw);
+    if (!Number.isFinite(dateMs))
+        return undefined;
+    return Math.max(0, dateMs - Date.now());
+}
+function retryDelayMs(attempt, retryAfter, random) {
+    const fromHeader = parseRetryAfterMs(retryAfter);
+    // D1: a server instruction wins over local jitter; only the absolute ceiling clamps it.
+    if (fromHeader !== undefined)
+        return Math.min(fromHeader, RETRY_AFTER_CAP_MS);
+    const base = attempt === 1 ? 100 : 250;
+    return Math.min(JITTER_CAP_MS, Math.round(base * (0.75 + random() * 0.5)));
+}
+function isTimeoutError(error) {
+    return error instanceof Error && error.name === "TimeoutError";
+}
+/** D9: always drain the failed body so undici can reuse the socket. */
+async function readTokenError(response) {
+    let raw = "";
+    try {
+        raw = await response.text();
+    }
+    catch {
+        // Body already gone; the status alone still classifies the failure.
+    }
+    let oauthError;
+    let detail = "";
+    try {
+        const body = JSON.parse(raw);
+        if (typeof body.error === "string")
+            oauthError = body.error;
+        if (typeof body.error_description === "string")
+            detail = body.error_description;
+    }
+    catch {
+        // Non-JSON error body.
+    }
+    const suffix = detail ? `: ${detail}` : oauthError ? `: ${oauthError}` : "";
+    return new XaiTokenRequestError(response.status, oauthError, `xAI token request failed: ${response.status}${suffix}`);
+}
+function sendTokenRequest(tokenEndpoint, body, signal) {
+    return fetch(tokenEndpoint, {
+        method: "POST",
+        headers: { Accept: "application/json", "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams(body).toString(),
+        signal: requestSignal(signal),
+    });
+}
+export async function postXaiToken(tokenEndpoint, body, signal, deps = {}) {
+    const sleep = deps.sleep ?? defaultSleep;
+    const random = deps.random ?? Math.random;
+    let last;
+    for (let attempt = 1; attempt <= XAI_TOKEN_MAX_ATTEMPTS; attempt++) {
+        let response;
+        try {
+            response = await sendTokenRequest(tokenEndpoint, body, signal);
+        }
+        catch (error) {
+            // D3: the caller's abort reason can be any value, so trust signal.aborted, not the error type.
+            if (signal?.aborted)
+                throw error;
+            if (isTimeoutError(error)) {
+                throw new XaiTokenRequestError(undefined, undefined, "xAI token request timed out", { cause: error });
+            }
+            last = error;
+            if (attempt === XAI_TOKEN_MAX_ATTEMPTS)
+                break;
+            await sleep(retryDelayMs(attempt, null, random));
+            continue;
+        }
+        if (response.ok)
+            return (await response.json());
+        const error = await readTokenError(response);
+        last = error;
+        if (!(response.status === 429 || response.status >= 500) || attempt === XAI_TOKEN_MAX_ATTEMPTS)
+            throw error;
+        await sleep(retryDelayMs(attempt, response.headers.get("retry-after"), random));
+    }
+    // D4: never rethrow the bare last value — it can be undefined and erases the failure shape.
+    throw new XaiTokenRequestError(undefined, undefined, "xAI token request exhausted retries", { cause: last });
+}
+// ---------------------------------------------------------------------------
+// Refresh
+// ---------------------------------------------------------------------------
+function decodeJwtPayload(token) {
+    const parts = token.split(".");
+    const payload = parts[1];
+    if (parts.length !== 3 || !payload)
+        return undefined;
+    try {
+        return JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Display metadata only: the signature is never verified, so this cannot gate authorization. */
+function getTokenIdentity(accessToken, idToken) {
+    const payload = (idToken ? decodeJwtPayload(idToken) : undefined) ?? decodeJwtPayload(accessToken);
+    const identity = {};
+    if (typeof payload?.sub === "string" && payload.sub.length > 0)
+        identity.accountId = payload.sub;
+    if (typeof payload?.email === "string" && payload.email.length > 0)
+        identity.email = payload.email.toLowerCase();
+    return identity;
+}
+function credentialsFromTokenPayload(payload, refreshFallback, tokenEndpoint, now) {
+    if (typeof payload.access_token !== "string" || payload.access_token.length === 0) {
+        throw new Error("xAI token response did not include an access token");
+    }
+    const refreshToken = typeof payload.refresh_token === "string" && payload.refresh_token.length > 0
+        ? payload.refresh_token
+        : refreshFallback;
+    if (!refreshToken)
+        throw new Error("xAI token response did not include a refresh token");
+    const creds = { accessToken: payload.access_token, refreshToken, tokenEndpoint };
+    // D5: no 3600 fallback. An absent expires_in means "unknown", and 401 becomes the signal —
+    // inventing an hour would let this module hand out a token it already knows nothing about.
+    if (typeof payload.expires_in === "number" && Number.isFinite(payload.expires_in)) {
+        creds.expiresAt = now() + payload.expires_in * 1000;
+    }
+    if (typeof payload.id_token === "string" && payload.id_token.length > 0)
+        creds.idToken = payload.id_token;
+    const identity = getTokenIdentity(creds.accessToken, creds.idToken);
+    if (identity.accountId !== undefined)
+        creds.accountId = identity.accountId;
+    if (identity.email !== undefined)
+        creds.email = identity.email;
+    return creds;
+}
+export async function refreshXaiToken(refreshToken, opts = {}) {
+    if (!refreshToken)
+        throw new Error("xAI credentials are expired and do not include a refresh token");
+    const raw = opts.tokenEndpoint ?? (await discoverXaiOAuthEndpoints(opts.signal)).tokenEndpoint;
+    const tokenEndpoint = validateXaiAuthEndpoint(raw);
+    const payload = await postXaiToken(tokenEndpoint, { grant_type: "refresh_token", client_id: XAI_OAUTH_CLIENT_ID, refresh_token: refreshToken }, opts.signal, opts.deps);
+    return credentialsFromTokenPayload(payload, refreshToken, tokenEndpoint, opts.deps?.now ?? Date.now);
+}
+let refreshFlight;
+let terminalFailureUntil = 0;
+const LOGIN_REQUIRED_MESSAGE = "Grok login required. Run: ima2 grok login";
+function toGrokAuthError(error, now) {
+    if (error instanceof GrokAuthError)
+        return error;
+    const oauthError = error instanceof XaiTokenRequestError ? error.oauthError : undefined;
+    if (oauthError !== undefined && TERMINAL_OAUTH_ERRORS.has(oauthError)) {
+        // Terminal: block further round-trips for a while, but leave the file alone so the user
+        // keeps their display metadata and a misclassified failure stays recoverable.
+        terminalFailureUntil = now() + TERMINAL_FAILURE_TTL_MS;
+        return new GrokAuthError("GROK_AUTH_REQUIRED", `Grok session is no longer valid. ${LOGIN_REQUIRED_MESSAGE}`, {
+            oauthError,
+            cause: error,
+        });
+    }
+    const detail = error instanceof Error ? error.message : String(error);
+    return new GrokAuthError("GROK_AUTH_REFRESH_FAILED", `Grok token refresh failed: ${detail}`, {
+        ...(oauthError !== undefined ? { oauthError } : {}),
+        cause: error,
+    });
+}
+async function performRefresh(stored, opts) {
+    const now = opts.deps?.now ?? Date.now;
+    try {
+        const fresh = await refreshXaiToken(stored.refreshToken ?? "", {
+            ...(stored.tokenEndpoint !== undefined ? { tokenEndpoint: stored.tokenEndpoint } : {}),
+            ...(opts.signal !== undefined ? { signal: opts.signal } : {}),
+            ...(opts.deps !== undefined ? { deps: opts.deps } : {}),
+        });
+        const merged = { ...stored, ...fresh };
+        // An unknown new expiry must erase the old one rather than inherit a stale deadline.
+        if (fresh.expiresAt === undefined)
+            delete merged.expiresAt;
+        saveGrokCredentials(merged, opts.homeDir);
+        return merged;
+    }
+    catch (error) {
+        throw toGrokAuthError(error, now);
+    }
+}
+function runRefreshFlight(stored, opts) {
+    const now = opts.deps?.now ?? Date.now;
+    const existing = refreshFlight;
+    if (existing && now() - existing.startedAt <= FLIGHT_STALE_MS)
+        return existing.promise;
+    const flight = { startedAt: now(), promise: performRefresh(stored, opts) };
+    // Release only when we are still the current flight, so a slow earlier refresh cannot
+    // clear a newer one (OpenCodex index.ts:537 pattern).
+    flight.promise = flight.promise.finally(() => {
+        if (refreshFlight === flight)
+            refreshFlight = undefined;
+    });
+    refreshFlight = flight;
+    return flight.promise;
+}
+export async function getGrokAccessToken(opts = {}) {
+    const now = opts.deps?.now ?? Date.now;
+    if (now() < terminalFailureUntil) {
+        throw new GrokAuthError("GROK_AUTH_REQUIRED", `Grok session is no longer valid. ${LOGIN_REQUIRED_MESSAGE}`);
+    }
+    const stored = loadGrokCredentials(opts.homeDir);
+    if (!stored)
+        throw new GrokAuthError("GROK_AUTH_REQUIRED", LOGIN_REQUIRED_MESSAGE);
+    if (opts.rejectedAccessToken !== undefined && stored.accessToken !== opts.rejectedAccessToken) {
+        return stored.accessToken;
+    }
+    const expiring = stored.expiresAt !== undefined && now() + XAI_TOKEN_REFRESH_SKEW_MS >= stored.expiresAt;
+    if (!opts.forceRefresh && !expiring)
+        return stored.accessToken;
+    if (!stored.refreshToken) {
+        throw new GrokAuthError("GROK_AUTH_REQUIRED", `Grok session expired and cannot be refreshed. ${LOGIN_REQUIRED_MESSAGE}`);
+    }
+    const fresh = await runRefreshFlight(stored, opts);
+    return fresh.accessToken;
+}
+/** Test-only: clears the single-flight slot and the terminal-failure negative cache. */
+export function __resetGrokAuthStateForTest() {
+    refreshFlight = undefined;
+    terminalFailureUntil = 0;
+}

package/lib/xaiDeviceLogin.js

@@ -0,0 +1,157 @@
+/**
+ * Stateless xAI (Grok) OAuth device-code login.
+ *
+ * routes/auth.ts keeps its own device-code flow because it is bound to the GUI session Map
+ * and its cleanup timers (030 wp4, audit item 6). This module is the CLI-side twin: one call,
+ * no module state, no timers left behind, and the only shared surface is lib/xaiAuth.ts.
+ *
+ * MUST stay a leaf module: only lib/xaiAuth.js. No config, routes, or adapters.
+ */
+import { XAI_OAUTH_CLIENT_ID, XAI_OAUTH_SCOPE, discoverXaiOAuthEndpoints, saveGrokCredentials, } from "./xaiAuth.js";
+const DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+/** RFC 8628 floor: never poll faster than this even if the server asks for less. */
+const MIN_POLL_INTERVAL_SECONDS = 5;
+const SLOW_DOWN_STEP_MS = 5_000;
+const DEVICE_REQUEST_TIMEOUT_MS = 15_000;
+const TOKEN_REQUEST_TIMEOUT_MS = 10_000;
+function defaultSleep(ms) {
+    return new Promise((resolve) => {
+        setTimeout(resolve, ms);
+    });
+}
+function requestSignal(signal, timeoutMs) {
+    const timeoutSignal = AbortSignal.timeout(timeoutMs);
+    return signal ? AbortSignal.any([signal, timeoutSignal]) : timeoutSignal;
+}
+function formEncoded(body) {
+    return {
+        method: "POST",
+        headers: { Accept: "application/json", "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams(body).toString(),
+    };
+}
+async function requestDeviceCode(endpoint, deps) {
+    const response = await deps.doFetch(endpoint, {
+        ...formEncoded({ client_id: XAI_OAUTH_CLIENT_ID, scope: XAI_OAUTH_SCOPE }),
+        signal: requestSignal(deps.signal, DEVICE_REQUEST_TIMEOUT_MS),
+    });
+    if (!response.ok) {
+        throw new Error(`xAI device code request failed: ${response.status} ${await response.text()}`);
+    }
+    const body = (await response.json());
+    const verification = typeof body.verification_uri_complete === "string" && body.verification_uri_complete
+        ? body.verification_uri_complete
+        : body.verification_uri;
+    if (typeof body.device_code !== "string" || typeof body.user_code !== "string" || typeof verification !== "string") {
+        throw new Error("xAI device code response is missing device_code/user_code/verification_uri");
+    }
+    return {
+        deviceCode: body.device_code,
+        userCode: body.user_code,
+        verificationUrl: verification,
+        expiresIn: typeof body.expires_in === "number" && Number.isFinite(body.expires_in) ? body.expires_in : 600,
+        intervalSeconds: typeof body.interval === "number" && Number.isFinite(body.interval) ? body.interval : MIN_POLL_INTERVAL_SECONDS,
+    };
+}
+async function pollTokenOnce(tokenEndpoint, deviceCode, deps) {
+    const response = await deps.doFetch(tokenEndpoint, {
+        ...formEncoded({ grant_type: DEVICE_CODE_GRANT, client_id: XAI_OAUTH_CLIENT_ID, device_code: deviceCode }),
+        signal: requestSignal(deps.signal, TOKEN_REQUEST_TIMEOUT_MS),
+    });
+    if (response.ok)
+        return { kind: "token", payload: (await response.json()) };
+    const raw = await response.text();
+    let oauthError;
+    try {
+        const parsed = JSON.parse(raw);
+        if (typeof parsed.error === "string")
+            oauthError = parsed.error;
+    }
+    catch {
+        // Non-JSON error body; the status alone classifies the failure.
+    }
+    if (oauthError === "authorization_pending")
+        return { kind: "pending" };
+    if (oauthError === "slow_down")
+        return { kind: "slow_down" };
+    throw new Error(`xAI device login failed: ${oauthError ?? `HTTP ${response.status}`}`);
+}
+/**
+ * Elapsed time is the larger of wall time and the time we asked to sleep, so an injected
+ * no-op sleep still walks the clock to expires_in instead of spinning forever.
+ */
+async function pollUntilAuthorized(tokenEndpoint, grant, deps) {
+    const startedAt = Date.now();
+    const deadlineMs = grant.expiresIn * 1000;
+    let intervalMs = Math.max(grant.intervalSeconds, MIN_POLL_INTERVAL_SECONDS) * 1000;
+    let sleptMs = 0;
+    while (Math.max(Date.now() - startedAt, sleptMs) < deadlineMs) {
+        await deps.sleep(intervalMs);
+        sleptMs += intervalMs;
+        if (deps.signal?.aborted)
+            throw new Error("xAI device login was aborted");
+        const outcome = await pollTokenOnce(tokenEndpoint, grant.deviceCode, deps);
+        if (outcome.kind === "token")
+            return outcome.payload;
+        if (outcome.kind === "slow_down")
+            intervalMs += SLOW_DOWN_STEP_MS;
+    }
+    throw new Error("xAI device login expired before it was approved");
+}
+/** Display metadata only: the id_token signature is never verified here. */
+function emailFromIdToken(idToken) {
+    const segment = idToken.split(".")[1];
+    if (!segment)
+        return undefined;
+    try {
+        const payload = JSON.parse(Buffer.from(segment, "base64url").toString("utf8"));
+        if (typeof payload.email !== "string" || payload.email.length === 0)
+            return undefined;
+        return payload.email.toLowerCase();
+    }
+    catch {
+        return undefined;
+    }
+}
+function credentialsFromDeviceToken(payload, tokenEndpoint) {
+    if (typeof payload.access_token !== "string" || payload.access_token.length === 0) {
+        throw new Error("xAI token response did not include an access token");
+    }
+    const creds = { accessToken: payload.access_token, tokenEndpoint };
+    if (typeof payload.refresh_token === "string" && payload.refresh_token.length > 0) {
+        creds.refreshToken = payload.refresh_token;
+    }
+    // Same rule as lib/xaiAuth.ts (D5): an absent expires_in means "unknown", never one hour.
+    if (typeof payload.expires_in === "number" && Number.isFinite(payload.expires_in)) {
+        creds.expiresAt = Date.now() + payload.expires_in * 1000;
+    }
+    if (typeof payload.id_token === "string" && payload.id_token.length > 0) {
+        creds.idToken = payload.id_token;
+        const email = emailFromIdToken(payload.id_token);
+        if (email !== undefined)
+            creds.email = email;
+    }
+    return creds;
+}
+/**
+ * Runs one complete device-code login and writes the session with saveGrokCredentials().
+ * Rejects on discovery failure, a missing device_authorization_endpoint, a terminal OAuth
+ * error, an abort, or expiry. Nothing is written unless a token actually came back.
+ */
+export async function runXaiDeviceLogin(opts) {
+    const deps = {
+        doFetch: opts.fetchImpl ?? ((...args) => fetch(...args)),
+        sleep: opts.sleep ?? defaultSleep,
+        signal: opts.signal,
+    };
+    const discovery = await discoverXaiOAuthEndpoints(opts.signal);
+    const deviceEndpoint = discovery.deviceAuthorizationEndpoint;
+    if (!deviceEndpoint)
+        throw new Error("xAI does not expose device_authorization_endpoint");
+    const grant = await requestDeviceCode(deviceEndpoint, deps);
+    opts.onUserCode({ userCode: grant.userCode, verificationUrl: grant.verificationUrl, expiresIn: grant.expiresIn });
+    const payload = await pollUntilAuthorized(discovery.tokenEndpoint, grant, deps);
+    const creds = credentialsFromDeviceToken(payload, discovery.tokenEndpoint);
+    saveGrokCredentials(creds, opts.homeDir);
+    return creds;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ima2-gen",
-  "version": "3.15.1",
+  "version": "3.16.0",
   "packageManager": "npm@11.18.0",
   "description": "Local-first visual generation runtime and studio for people and coding agents, with reproducible image and video workflows across multiple providers.",
   "type": "module",
@@ -99,7 +99,6 @@
     "google-auth-library": "^11.0.1",
     "openai": "^7.4.0",
     "openai-oauth": "file:vendor/openai-oauth-1.0.2-ima2.1.tgz",
-    "progrok": "file:vendor/progrok-0.2.0.tgz",
     "sharp": "^0.35.3",
     "trash": "^10.1.1",
     "ulid": "^3.0.2",
@@ -109,7 +108,6 @@
     "fast-uri": "3.1.7"
   },
   "bundleDependencies": [
-    "progrok",
     "openai-oauth",
     "zod"
   ],
@@ -127,5 +125,5 @@
     "typescript": "^5.9.3",
     "yaml": "2.9.0"
   },
-  "gitHead": "11900764a59e74146c9008ed296a23d3fc0ac06a"
+  "gitHead": "7fa7d426d92813caeeff667a458b781237029df0"
 }

package/routes/auth.js

@@ -1,13 +1,8 @@
 import { spawn } from "node:child_process";
 import { randomBytes } from "node:crypto";
-import { writeFileSync, renameSync, mkdirSync, existsSync } from "node:fs";
-import { homedir } from "node:os";
-import { join } from "node:path";
 import { codexFileLoginArgs, detectCodexAuth } from "../lib/codexDetect.js";
 import { packageCliCommand } from "../lib/packageCli.js";
-const GROK_CLIENT_ID = "b1a00492-073a-47ea-816f-4c329264a828";
-const GROK_SCOPE = "openid profile email offline_access grok-cli:access api:access";
-const GROK_TOKEN_URL = "https://auth.x.ai/oauth2/token";
+import { XAI_OAUTH_CLIENT_ID as GROK_CLIENT_ID, XAI_OAUTH_SCOPE as GROK_SCOPE, XAI_TOKEN_ENDPOINT_FALLBACK as GROK_TOKEN_URL, loadGrokCredentials, saveGrokCredentials, } from "../lib/xaiAuth.js";
 const CODEX_DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
 const MAX_CONCURRENT_SESSIONS = 20;
 const sessions = new Map();
@@ -28,9 +23,9 @@ function stripAnsi(s) {
     return s.replace(/\x1B\[[0-9;]*m/g, "");
 }
 function saveGrokTokens(tokens) {
-    const dir = join(homedir(), ".progrok");
-    if (!existsSync(dir))
-        mkdirSync(dir, { recursive: true, mode: 0o700 });
+    if (typeof tokens.access_token !== "string" || tokens.access_token.length === 0) {
+        throw new Error("xAI token response did not include an access token");
+    }
     let email;
     if (typeof tokens.id_token === "string") {
         try {
@@ -42,23 +37,20 @@ function saveGrokTokens(tokens) {
         }
         catch { /* ignore */ }
     }
+    // Merge over the existing file so a field only progrok writes (idToken) survives a
+    // fresh login; the atomic 0600 write itself lives in lib/xaiAuth.ts.
     const data = {
+        ...(loadGrokCredentials() ?? {}),
         accessToken: tokens.access_token,
-        refreshToken: tokens.refresh_token,
-        expiresAt: typeof tokens.expires_in === "number" ? Date.now() + tokens.expires_in * 1000 : undefined,
+        ...(typeof tokens.refresh_token === "string" ? { refreshToken: tokens.refresh_token } : {}),
+        ...(typeof tokens.expires_in === "number" ? { expiresAt: Date.now() + tokens.expires_in * 1000 } : {}),
         tokenEndpoint: GROK_TOKEN_URL,
+        ...(typeof tokens.id_token === "string" ? { idToken: tokens.id_token } : {}),
+        ...(email ? { email } : {}),
     };
-    if (email)
-        data.email = email;
-    // Atomic write: temp file (0600) + rename, so concurrent completions or a crash
-    // mid-flush can never truncate/corrupt the only credential file. Rename also
-    // guarantees final perms are 0600 even if a looser-perm file pre-existed.
-    const target = join(dir, "auth.json");
-    const tmp = join(dir, `auth.json.tmp-${randomBytes(6).toString("hex")}`);
-    writeFileSync(tmp, JSON.stringify(data, null, 2), { mode: 0o600 });
-    renameSync(tmp, target);
+    saveGrokCredentials(data);
 }
-async function startGrokDeviceCode(onCredentialsSaved) {
+async function startGrokDeviceCode() {
     const discovery = await fetch("https://auth.x.ai/.well-known/openid-configuration", { signal: AbortSignal.timeout(10000) });
     const disc = await discovery.json();
     if (!disc.device_authorization_endpoint)
@@ -107,9 +99,6 @@ async function startGrokDeviceCode(onCredentialsSaved) {
             if (tokenRes.ok) {
                 const tokens = await tokenRes.json();
                 saveGrokTokens(tokens);
-                // progrok checks credentials only at startup, so a proxy that gave up
-                // before login stays dead until something tells it the world changed.
-                onCredentialsSaved?.();
                 session.status = "complete";
                 cleanup(id);
                 return;
@@ -218,7 +207,10 @@ function startCodexDeviceCode() {
         }, 30000);
     });
 }
-export function registerAuthRoutes(app, ctx) {
+/** `_ctx` is accepted only to keep the registration signature uniform in
+ *  routes/index.ts; the device-code flow writes credentials to disk and no
+ *  longer notifies any in-process supervisor. */
+export function registerAuthRoutes(app, _ctx) {
     app.post("/api/auth/switch", async (req, res) => {
         const provider = req.body?.provider;
         if (provider !== "grok" && provider !== "codex") {
@@ -229,7 +221,7 @@ export function registerAuthRoutes(app, ctx) {
         }
         try {
             const result = provider === "grok"
-                ? await startGrokDeviceCode(() => ctx?.grokProxy?.notifyCredentialsChanged())
+                ? await startGrokDeviceCode()
                 : await startCodexDeviceCode();
             res.json(result);
         }