ima2-gen 3.15.1 → 3.16.0

package/routes/grok.js

@@ -1,32 +1,38 @@
-import { getGrokProxyBaseUrl, getGrokProxyUrl } from "../lib/grokRuntime.js";
+import { fetchWithGrokAuth, getGrokEndpoint } from "../lib/grokRuntime.js";
+/**
+ * The status probe now asks api.x.ai directly with the stored OAuth session, so it
+ * reports on the credential the generation lane actually uses. There is no local child
+ * to promote or restart, which is why the old probe token and proxy state are gone; the
+ * four status literals stay unchanged because the UI switches on them.
+ */
+function statusFromError(error) {
+    const code = error?.code;
+    if (code === "GROK_AUTH_REQUIRED")
+        return { status: "offline", reason: "login_required" };
+    if (code === "GROK_AUTH_REFRESH_FAILED") {
+        const message = error instanceof Error ? error.message : "token refresh failed";
+        return { status: "error", reason: message };
+    }
+    return { status: "offline" };
+}
 export function registerGrokRoutes(app, ctx) {
     app.get("/api/grok/status", async (_req, res) => {
-        const grokCfg = ctx.config.grokProvider || {};
-        const timeoutMs = grokCfg.statusTimeoutMs || 3000;
-        // Captured BEFORE the await: a response that outlives its child must not be
-        // able to promote a dead proxy back to ready.
-        const token = ctx.grokProxy?.probeToken();
+        const timeoutMs = ctx.config?.grokProvider?.statusTimeoutMs ?? 3000;
         try {
-            const r = await fetch(getGrokProxyUrl(ctx, "/v1/models"), {
-                signal: AbortSignal.timeout(timeoutMs),
+            const r = await fetchWithGrokAuth(ctx, "grok", (credential) => {
+                const { url, headers } = getGrokEndpoint("/v1/models", credential);
+                return fetch(url, { headers, signal: AbortSignal.timeout(timeoutMs) });
             });
             if (r.ok) {
                 const data = await r.json();
-                const models = data?.data?.map((m) => m.id).filter(Boolean) || [];
+                const models = (data?.data ?? []).map((m) => m?.id).filter((id) => typeof id === "string" && id.length > 0);
                 const hasImageModel = models.some((m) => m.startsWith("grok-imagine"));
-                // A live 200 is stronger evidence than stdout parsing, which only
-                // recognizes 127.0.0.1/localhost and so can strand a custom host.
-                if (token)
-                    ctx.grokProxy?.markProbedReady(token, getGrokProxyBaseUrl(ctx));
                 return res.json({ status: hasImageModel ? "ready" : "no_image_model", models });
             }
-            return res.json({ status: "error", reason: `HTTP ${r.status}`, state: ctx.grokProxy?.state });
+            return res.json({ status: "error", reason: `HTTP ${r.status}` });
         }
-        catch {
-            // Deliberately does NOT call ensure(): the UI polls every 10s while not
-            // ready, so self-healing here would spawn a child per poll forever.
-            // Recovery is driven by the login event only.
-            return res.json({ status: "offline", state: ctx.grokProxy?.state });
+        catch (error) {
+            return res.json(statusFromError(error));
         }
     });
 }

package/routes/health.js

@@ -1,5 +1,6 @@
 import { abortJob, listJobs, listTerminalJobs } from "../lib/inflight.js";
 import { errInfo } from "../lib/errInfo.js";
+import { loadGrokCredentials } from "../lib/xaiAuth.js";
 import { requireRuntimeContext } from "../lib/runtimeContext.js";
 export function registerHealthRoutes(app, ctxRaw) {
     const ctx = requireRuntimeContext(ctxRaw);
@@ -15,11 +16,9 @@ export function registerHealthRoutes(app, ctxRaw) {
             url: ctx.oauthUrl,
             status: ctx.oauthReadyState,
         },
-        grok: {
-            configuredPort: Number(ctx.grokPort),
-            actualPort: Number(ctx.grokActualPort || ctx.grokPort),
-            url: ctx.grokUrl,
-        },
+        // Grok has no local endpoint any more: requests go to https://api.x.ai, so
+        // the only runtime fact worth publishing is whether a session exists.
+        grok: { auth: loadGrokCredentials(ctx.grokAuthHomeDir) ? "oauth" : "none" },
     });
     app.get("/api/providers", (_req, res) => {
         res.json({

package/routes/models.js

@@ -11,6 +11,7 @@ import { deriveModels, deriveProviderIds, getProviderSurfaceSupport } from "../l
 import { PROVIDER_SURFACES } from "../lib/providers/surfaceSupport.js";
 import { listWorkflows } from "../lib/comfyWorkflowStore.js";
 import { probeComfyOrigins } from "../lib/comfyImageAdapter.js";
+import { loadGrokCredentials } from "../lib/xaiAuth.js";
 import { requireRuntimeContext, } from "../lib/runtimeContext.js";
 const MCP_LANES = new Set(["runway", "higgsfield"]);
 const MCP_PROVIDER_FALLBACKS = listProviders([])
@@ -55,37 +56,22 @@ function oauthLane(ctx, image) {
 function apiLane(ctx, image) {
     return lane(ctx.hasApiKey ? { status: "ready" } : { status: "key-missing", reason: "OpenAI API key missing" }, { image: ctx.config.apiProvider.defaultImageModel }, { image, video: [] });
 }
-const UNPROBED_GROK_REASON = "configured proxy endpoint; live session not probed";
 /**
- * Lane status follows the supervisor instead of the mere existence of a URL
- * string, so /api/models and /api/grok/status can no longer disagree.
+ * Lane status follows the stored xAI credential, the same file every Grok
+ * request reads, so /api/models and /api/grok/status cannot disagree.
  *
- * Transient states (starting/backoff/re-armed) keep the legacy optimistic
- * answer on purpose: flickering the lane during a few hundred ms of boot or a
- * bounded retry is noise, not honesty. Only settled-bad states go disconnected.
+ * An expired access token still counts as ready when a refresh token is on
+ * disk: lib/xaiAuth.ts refreshes it on the next request, so reporting the lane
+ * disconnected would be a failure the user never sees.
  */
 function grokLaneState(ctx) {
-    if (!ctx.grokUrl)
-        return { status: "disconnected", reason: "Grok proxy not configured" };
-    switch (ctx.grokProxy?.state) {
-        case "ready":
-            return { status: "ready" };
-        case "starting":
-            return { status: "ready", reason: UNPROBED_GROK_REASON };
-        case "backoff":
-            return { status: "disconnected", reason: "Grok proxy restarting" };
-        case "gave-up-retryable":
-            return { status: "ready", reason: UNPROBED_GROK_REASON };
-        case "waiting-for-login":
-            return { status: "disconnected", reason: "Grok login required" };
-        case "gave-up":
-            return { status: "disconnected", reason: "Grok proxy failed to start" };
-        case "stopped":
-            return { status: "disconnected", reason: "Grok proxy stopped" };
-        default:
-            // No supervisor (autoStart off, or a test context): legacy contract.
-            return { status: "ready", reason: UNPROBED_GROK_REASON };
+    const creds = loadGrokCredentials(ctx.grokAuthHomeDir);
+    if (!creds)
+        return { status: "disconnected", reason: "Grok login required" };
+    if (creds.expiresAt !== undefined && Date.now() >= creds.expiresAt && !creds.refreshToken) {
+        return { status: "disconnected", reason: "Grok session expired" };
     }
+    return { status: "ready" };
 }
 function grokLane(ctx, provider = "grok") {
     const state = grokLaneState(ctx);

package/routes/quota.js

@@ -87,11 +87,12 @@ function readGrokTokenCandidates(homeDir = homedir()) {
     }
     catch { }
     try {
+        // Same file lib/xaiAuth.ts owns; spelled out so quota keeps its narrow node:fs surface.
         const auth = JSON.parse(readFileSync(join(homeDir, ".progrok", "auth.json"), "utf8"));
         if (typeof auth.accessToken === "string" && auth.accessToken.trim()) {
             candidates.push({
                 token: auth.accessToken,
-                source: "progrok:auth-json",
+                source: "ima2:grok-auth-json",
                 email: null,
                 authMode: null,
                 issuer: null,

package/routes/video.js

@@ -11,6 +11,7 @@ import { logEvent, logError } from "../lib/logger.js";
 import { parseBackgroundPreset, backgroundPromptSuffix, backgroundPlannerConstraint } from "../lib/backgroundPresets.js";
 import { invalidateHistoryIndex } from "../lib/historyIndex.js";
 import { generateVideoViaGrok } from "../lib/grokVideoAdapter.js";
+import { resolveGrokCredential } from "../lib/grokRuntime.js";
 import { generateVideoViaComfy } from "../lib/comfyImageAdapter.js";
 import { getVideoSeriesChain } from "../lib/videoSeriesChain.js";
 import { ACTIVE_VIDEO_PROMPT_GUIDANCE, appendVideoContinuityEntry, lineageFromVideoMetadata, normalizeVideoContinuityLineage, readVideoSidecar, requireActiveVideoPrompt, safeGeneratedVideoFilename, } from "../lib/videoContinuity.js";
@@ -506,7 +507,11 @@ export function registerVideoRoutes(app, ctxRaw) {
                 + (elementNotesFragment ? `\n${elementNotesFragment}` : "")
                 + (backgroundPreset ? ` ${backgroundPromptSuffix(backgroundPreset, "video")}` : "");
             const plannerModel = typeof req.body?.plannerModel === "string" ? req.body.plannerModel.trim() : undefined;
-            const directApiKey = provider === "grok-api" ? ctx.xaiApiKey : undefined;
+            // `provider` comes off the untyped body; the comfy branch already returned, so the
+            // only values left are the two Grok lanes. Narrow explicitly so the lane the
+            // credential is resolved for is a real GrokLane rather than an `any` passthrough.
+            const lane = provider === "grok-api" ? "grok-api" : "grok";
+            const credential = await resolveGrokCredential(ctx, lane, { signal: cancelController.signal });
             const result = await generateVideoViaGrok(effectivePrompt, ctx, {
                 model: modelCheck.model,
                 mode,
@@ -520,7 +525,7 @@ export function registerVideoRoutes(app, ctxRaw) {
                 requestId,
                 continuityLineage: parentLineage,
                 plannerModel: plannerModel || undefined,
-                directApiKey,
+                credential,
                 onEvent,
                 storyboardActive,
                 backgroundConstraint: backgroundPreset ? backgroundPlannerConstraint(backgroundPreset) : undefined,

package/routes/videoExtended.js

@@ -2,7 +2,7 @@ import { basename, join } from "node:path";
 import { mkdir, readFile, unlink, writeFile } from "node:fs/promises";
 import { randomBytes } from "node:crypto";
 import { requireRuntimeContext } from "../lib/runtimeContext.js";
-import { getGrokProxyUrl } from "../lib/grokRuntime.js";
+import { fetchWithGrokAuth, getGrokEndpoint, resolveGrokCredential } from "../lib/grokRuntime.js";
 import { logEvent, logError } from "../lib/logger.js";
 import { downloadVideo, generateVideoViaGrok, pollVideoUntilDone } from "../lib/grokVideoAdapter.js";
 import { invalidateHistoryIndex } from "../lib/historyIndex.js";
@@ -54,8 +54,13 @@ function motionSelection(value, parent) {
     const ids = [...new Set(raw)];
     return { ids, fragment: ids.map((id) => getMotionFragment(id, "grok")).filter(Boolean).join(", ") };
 }
-function videoProxyUrl(ctx, path) {
-    return { url: getGrokProxyUrl(ctx, path), headers: { "Content-Type": "application/json", Authorization: "Bearer dummy" } };
+/**
+ * These handlers take the lane from the request body, which is untyped. Anything that is
+ * not the explicit API-key lane runs on the OAuth session, the same default the rest of
+ * the video surface uses.
+ */
+function videoLane(body) {
+    return body?.provider === "grok-api" ? "grok-api" : "grok";
 }
 function routeError(message, status = 400) {
     return Object.assign(new Error(message), { status });
@@ -166,6 +171,17 @@ function extractOutputText(data) {
     }
     return texts.join("\n").trim();
 }
+/**
+ * The frame analysis call is a single request with nothing downstream, so it resolves its
+ * credential through fetchWithGrokAuth: an expired OAuth bearer is refreshed once and the
+ * request replayed, which costs nothing because a 401 arrives before any work is billed.
+ */
+async function requestFrameAnalysis(ctx, lane, body, signal) {
+    return fetchWithGrokAuth(ctx, lane, (credential) => {
+        const { url, headers } = getGrokEndpoint("/v1/responses", credential);
+        return fetch(url, { method: "POST", headers, body: JSON.stringify(body), signal });
+    }, { signal });
+}
 export function registerVideoExtendedRoutes(app, ctxRaw, dependencies = {}) {
     const ctx = requireRuntimeContext(ctxRaw);
     const extractFrame = dependencies.extractFrame ?? ((dir, filename, position, options) => extractGeneratedVideoFrameB64(dir, filename, position, options));
@@ -184,7 +200,9 @@ export function registerVideoExtendedRoutes(app, ctxRaw, dependencies = {}) {
                 return res.status(400).json({ error: "videoUrl required" });
             const validModel = validateEditModel(model);
             const signal = requestSignal(req, res, envDeadline("IMA2_VIDEO_EDIT_TIMEOUT_MS", 10 * 60_000));
-            const { url, headers } = videoProxyUrl(ctx, "/v1/videos/edits");
+            // Resolved once and carried into the poll loop so the whole edit runs on one bearer.
+            const credential = await resolveGrokCredential(ctx, videoLane(req.body), { signal });
+            const { url, headers } = getGrokEndpoint("/v1/videos/edits", credential);
             const video = await resolveVideoInput(ctx, videoUrl);
             const apiRes = await fetch(url, { method: "POST", headers, body: JSON.stringify({ model: validModel, prompt, video }), signal });
             if (!apiRes.ok) {
@@ -195,7 +213,7 @@ export function registerVideoExtendedRoutes(app, ctxRaw, dependencies = {}) {
             if (!request_id)
                 return res.status(502).json({ error: "No request_id in response" });
             logEvent("video", "edit:start", { requestId: request_id, model: validModel });
-            const result = await pollVideoUntilDone(ctx, request_id, { signal });
+            const result = await pollVideoUntilDone(ctx, request_id, { signal, credential });
             if (result.respectModeration === false)
                 return res.status(502).json({ error: "Grok video blocked by moderation" });
             if (!result.videoUrl)
@@ -337,7 +355,8 @@ export function registerVideoExtendedRoutes(app, ctxRaw, dependencies = {}) {
                 return res.status(400).json({ error: `duration must be an integer between ${MIN_VIDEO_DURATION} and ${MAX_VIDEO_DURATION}` });
             }
             const signal = requestSignal(req, res, envDeadline("IMA2_VIDEO_EXTEND_TIMEOUT_MS", 10 * 60_000));
-            const { url, headers } = videoProxyUrl(ctx, "/v1/videos/extensions");
+            const credential = await resolveGrokCredential(ctx, videoLane(req.body), { signal });
+            const { url, headers } = getGrokEndpoint("/v1/videos/extensions", credential);
             const video = await resolveVideoInput(ctx, videoUrl);
             const apiRes = await fetch(url, { method: "POST", headers, body: JSON.stringify({ model: validModel, prompt, duration: dur, video }), signal });
             if (!apiRes.ok) {
@@ -347,7 +366,7 @@ export function registerVideoExtendedRoutes(app, ctxRaw, dependencies = {}) {
             const { request_id } = (await apiRes.json());
             if (!request_id)
                 return res.status(502).json({ error: "No request_id in response" });
-            const result = await pollVideoUntilDone(ctx, request_id, { signal });
+            const result = await pollVideoUntilDone(ctx, request_id, { signal, credential });
             if (result.respectModeration === false)
                 return res.status(502).json({ error: "Grok video blocked by moderation" });
             if (!result.videoUrl)
@@ -442,23 +461,17 @@ export function registerVideoExtendedRoutes(app, ctxRaw, dependencies = {}) {
                 const first = (await readFile(firstFrame)).toString("base64");
                 const last = (await readFile(lastFrame)).toString("base64");
                 const plannerModel = ctx.config.grokProvider.plannerModel || DEFAULT_GROK_PLANNER_MODEL;
-                const { url, headers } = videoProxyUrl(ctx, "/v1/responses");
-                const apiRes = await fetch(url, {
-                    method: "POST",
-                    headers,
-                    body: JSON.stringify({
-                        model: plannerModel,
-                        input: [{
-                                role: "user",
-                                content: [
-                                    { type: "input_image", image_url: `data:image/png;base64,${first}`, detail: "high" },
-                                    { type: "input_image", image_url: `data:image/png;base64,${last}`, detail: "high" },
-                                    { type: "input_text", text: "Analyze these first and last frames from a video for recreation. Infer likely motion between them. Include shot type, camera movement, lighting, color palette, subjects, motion direction/speed, mood, and audio/sound prompt suggestions. Be specific and cinematic." },
-                                ],
-                            }],
-                    }),
-                    signal,
-                });
+                const apiRes = await requestFrameAnalysis(ctx, videoLane(req.body), {
+                    model: plannerModel,
+                    input: [{
+                            role: "user",
+                            content: [
+                                { type: "input_image", image_url: `data:image/png;base64,${first}`, detail: "high" },
+                                { type: "input_image", image_url: `data:image/png;base64,${last}`, detail: "high" },
+                                { type: "input_text", text: "Analyze these first and last frames from a video for recreation. Infer likely motion between them. Include shot type, camera movement, lighting, color palette, subjects, motion direction/speed, mood, and audio/sound prompt suggestions. Be specific and cinematic." },
+                            ],
+                        }],
+                }, signal);
                 if (!apiRes.ok) {
                     const t = await apiRes.text();
                     return res.status(apiRes.status).json({ error: t });

package/server.js

@@ -7,7 +7,6 @@ import { dirname, join } from "path";
 import { fileURLToPath, pathToFileURL } from "url";
 import { onShutdown } from "./bin/lib/platform.js";
 import { ensureDefaultSession } from "./lib/sessionStore.js";
-import { startGrokProxy } from "./lib/grokProxyLauncher.js";
 import { startOAuthProxy } from "./lib/oauthLauncher.js";
 import { migrateGeneratedStorage } from "./lib/storageMigration.js";
 import { purgeStaleJobs } from "./lib/inflight.js";
@@ -26,6 +25,7 @@ import { stopAgentQueueWorker } from "./lib/agentQueueWorker.js";
 import { reapCardNewsJobs } from "./lib/cardNewsJobStore.js";
 import { reapTerminalJobs } from "./lib/inflight.js";
 import { errInfo } from "./lib/errInfo.js";
+import { loadGrokCredentials } from "./lib/xaiAuth.js";
 import { cleanupExpiredMcpTempReferences, MCP_TEMP_REFERENCE_JSON_BODY_LIMIT_BYTES, MCP_TEMP_REFERENCE_SWEEP_INTERVAL_MS, } from "./lib/mcpTempReferenceStore.js";
 const rootDir = dirname(fileURLToPath(import.meta.url));
 async function loadApiKey() {
@@ -285,14 +285,13 @@ function runtimeHostUrl(host) {
 }
 /**
  * Pure payload builder, exported so the liveness contract is testable without
- * booting a server or spawning a real progrok child.
+ * booting a server.
  *
- * The grok section only carries an endpoint while a supervised child is actually
- * listening. Publishing `actualPort`/`url` for a dead child is a claim the file
- * cannot back up, so those go null and `configuredPort` stays for diagnostics.
+ * The grok section carries an auth fact rather than an endpoint: requests go
+ * straight to https://api.x.ai, so the only thing a consumer can act on is
+ * whether this machine holds an xAI OAuth session.
  */
 export function buildAdvertisePayload(ctx) {
-    const grokLive = ctx.grokProxyLive === true;
     return {
         port: Number(ctx.serverActualPort || ctx.config.server.port),
         url: ctx.serverUrl,
@@ -311,12 +310,7 @@ export function buildAdvertisePayload(ctx) {
             url: ctx.oauthUrl,
             status: ctx.oauthReadyState,
         },
-        grok: {
-            configuredPort: Number(ctx.grokPort),
-            actualPort: grokLive ? Number(ctx.grokActualPort || ctx.grokPort) : null,
-            url: grokLive ? ctx.grokUrl : null,
-            live: grokLive,
-        },
+        grok: { auth: loadGrokCredentials(ctx.grokAuthHomeDir) ? "oauth" : "none" },
     };
 }
 function advertise(ctx) {
@@ -366,7 +360,6 @@ export async function createRuntimeContext(overrides = {}) {
     const apiKey = loadedKey.apiKey;
     const openai = overrides.openai ?? await createOpenAI(apiKey);
     const oauthPort = config.oauth.proxyPort;
-    const grokPort = config.grokProvider.proxyPort;
     let resolveOAuthReady = () => { };
     const oauthReadyPromise = new Promise((resolve) => {
         resolveOAuthReady = resolve;
@@ -377,9 +370,6 @@ export async function createRuntimeContext(overrides = {}) {
         serverConfiguredPort: config.server.port,
         serverActualPort: undefined,
         serverUrl: `http://${runtimeHostUrl(config.server.host)}:${config.server.port}`,
-        grokPort,
-        grokActualPort: grokPort,
-        grokUrl: `http://${config.grokProvider.proxyHost}:${grokPort}/v1`,
         oauthPort,
         oauthActualPort: oauthPort,
         oauthUrl: `http://127.0.0.1:${oauthPort}`,
@@ -411,14 +401,6 @@ export async function createRuntimeContext(overrides = {}) {
         hasVertexKey: !!loadedVertexKey.json,
         geminiAuthMode,
         oauthReadyPromise: oauthReadyPromise,
-        markGrokProxyPort: ({ url, port } = {}) => {
-            if (port)
-                ctx.grokActualPort = port;
-            if (url)
-                ctx.grokUrl = url;
-            else if (port)
-                ctx.grokUrl = `http://${ctx.config.grokProvider.proxyHost}:${port}/v1`;
-        },
         markOAuthReady: ({ url, port } = {}) => {
             if (url)
                 ctx.oauthUrl = url;
@@ -473,31 +455,6 @@ export async function startServer(overrides = {}) {
     if (overrides.oauthChild !== undefined || !ctx.config.oauth.autoStart) {
         ctx.markOAuthReady({ url: ctx.oauthUrl, port: ctx.oauthPort });
     }
-    const grokChild = ctx.config.grokProvider.autoStart
-        ? await startGrokProxy({
-            host: ctx.config.grokProvider.proxyHost,
-            port: ctx.config.grokProvider.proxyPort,
-            restartDelayMs: ctx.config.grokProvider.restartDelayMs,
-            onPortSelected: ({ url, port }) => {
-                ctx.markGrokProxyPort({ url, port });
-                // Port selection is an intent to bind, not a successful bind.
-                ctx.grokProxyLive = false;
-                advertise(ctx);
-            },
-            onReady: ({ url, port }) => {
-                ctx.markGrokProxyPort({ url, port });
-                ctx.grokProxyLive = true;
-                advertise(ctx);
-            },
-            onExit: () => {
-                // Without this the advertise file keeps publishing the port of a child
-                // that is already gone.
-                ctx.grokProxyLive = false;
-                advertise(ctx);
-            },
-        })
-        : null;
-    ctx.grokProxy = grokChild ?? undefined;
     let server;
     let reapTimer;
     let tempReferenceReapTimer;
@@ -511,14 +468,6 @@ export async function startServer(overrides = {}) {
             oauthChild?.kill?.();
         }
         catch { }
-        try {
-            grokChild?.stop?.();
-        }
-        catch { }
-        try {
-            grokChild?.kill?.();
-        }
-        catch { }
         stopAgentQueueWorker();
         clearInterval(reapTimer);
         if (tempReferenceReapTimer)
@@ -550,7 +499,7 @@ export async function startServer(overrides = {}) {
         console.warn(`[mcp.restore] code=${String(error?.message ?? error).split(":")[0]}`);
     });
     console.log(`Image Gen running at ${ctx.serverUrl}`);
-    console.log(`Provider policy: GPT OAuth, API-key Responses, and Grok Images providers. GPT OAuth proxy port ${ctx.oauthPort}; Grok proxy port ${ctx.grokActualPort || ctx.grokPort}.`);
+    console.log(`Provider policy: GPT OAuth, API-key Responses, and Grok (xAI OAuth or API key) providers. GPT OAuth proxy port ${ctx.oauthPort}.`);
     advertise(ctx);
     try {
         const s = ensureDefaultSession();

package/skills/ima2/SKILL.md

@@ -85,8 +85,8 @@ Use request-level overrides only for that one call:
 ima2 gen "cinematic mountain" --model oauth/gpt-5.5 --reasoning-effort high
 ```
 
-Use Grok when the request should run through bundled progrok, mandatory xAI Web
-Search, planner pass (default: `grok-4.3`), and xAI Images API:
+Use Grok when the request should run through the stored xAI OAuth session,
+mandatory xAI Web Search, planner pass (default: `grok-4.3`), and xAI Images API:
 
 ```bash
 ima2 grok login