ima2-gen 3.16.0 → 3.16.1

package/CHANGELOG.md

@@ -26,6 +26,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - **Windows installer npm handling** — compose global npm lockfile path with nested `Join-Path` calls for PowerShell 5.1 compatibility; wrap npm invocations in `Invoke-Npm` with `Continue` error action preference so stderr warnings do not abort the installer (#110, #111).
 
+## [3.16.1] - 2026-09-17
+
+### Fixed
+
+- **`ima2 grok` subcommands ignored `--help`** (#244) — `grok login`, `grok status`, and `grok logout` were dispatched before their arguments were parsed, so `ima2 grok login --help` started a real xAI device-code flow and sat polling instead of printing anything, and `ima2 grok logout --help` deleted `~/.progrok/auth.json` before any help text appeared. Each subcommand now answers `--help`/`-h` with its own usage before doing anything observable, and rejects options it does not accept.
+
+### Changed
+
+- **Dependencies** — `@openai/codex` 0.153.2 to 0.153.4; the UI development group moves `@playwright/test` 1.62.1 to 1.63.0 and `@types/react-dom` 19.2.5 to 19.2.7.
+
 ## [3.16.0] - 2026-09-09
 
 ### Removed

package/bin/commands/grok.js

@@ -29,13 +29,53 @@ const HELP = `
     ima2 grok login uses a running 'ima2 serve' when one is available so the
     CLI and the web UI share one login; otherwise it runs the flow directly.
 `;
-const SPEC = {
+const LOGIN_HELP = `
+  ima2 grok login
+
+  Log in to xAI with the OAuth device-code flow. Prints a verification URL and a
+  user code, then waits for the approval. Uses a running 'ima2 serve' when one
+  answers so the CLI and the web UI share a single session.
+
+  Options:
+    -h, --help             Show this help
+`;
+const STATUS_HELP = `
+  ima2 grok status [--json] [--probe]
+
+  Show the stored xAI OAuth session: account, expiry, and whether a refresh
+  token is present.
+
+  Options:
+        --json             Print the status as one JSON object
+        --probe            Call /v1/models and list the visible grok-imagine models
+    -h, --help             Show this help
+`;
+const LOGOUT_HELP = `
+  ima2 grok logout
+
+  Remove the stored xAI OAuth session from ~/.progrok/auth.json. The progrok CLI
+  shares that file, so this logs both out.
+
+  Options:
+    -h, --help             Show this help
+`;
+/** login and logout take no options of their own; only help is valid. */
+const HELP_ONLY_SPEC = {
+    flags: {
+        help: { short: "h", type: "boolean" },
+    },
+};
+const STATUS_SPEC = {
     flags: {
         json: { type: "boolean" },
         probe: { type: "boolean" },
         help: { short: "h", type: "boolean" },
     },
 };
+function rejectUnknownFlags(args) {
+    if (args._unknown?.length)
+        die(2, `unknown option: ${args._unknown[0]}`);
+}
 const POLL_INTERVAL_MS = 3_000;
 function sleep(ms) {
     return new Promise((resolve) => {
@@ -83,7 +123,16 @@ async function loginViaServer(base) {
     }
     throw new Error("xAI device login expired before it was approved");
 }
-async function loginCmd() {
+async function loginCmd(argv) {
+    // Help is answered before anything observable happens. Until 3.16.1 this
+    // function started server discovery and a real device-code flow for
+    // 'ima2 grok login --help' (#244).
+    const args = parseArgs(argv, HELP_ONLY_SPEC);
+    if (args.help) {
+        out(LOGIN_HELP);
+        return;
+    }
+    rejectUnknownFlags(args);
     let server = null;
     try {
         server = await findRunningServer({ includeEnv: false });
@@ -128,7 +177,12 @@ async function probeResult() {
     }
 }
 async function statusCmd(argv) {
-    const args = parseArgs(argv, SPEC);
+    const args = parseArgs(argv, STATUS_SPEC);
+    if (args.help) {
+        out(STATUS_HELP);
+        return;
+    }
+    rejectUnknownFlags(args);
     const creds = loadGrokCredentials();
     const probe = args.probe === true && creds !== null ? await probeResult() : undefined;
     if (args.json) {
@@ -150,6 +204,18 @@ async function statusCmd(argv) {
     const ids = probe.imagineModels ?? [];
     out(ids.length ? `  imagine models: ${ids.join(", ")}` : color.yellow("  no grok-imagine model is visible to this session"));
 }
+function logoutCmd(argv) {
+    // Same reason as loginCmd: 'ima2 grok logout --help' used to delete the
+    // stored session before anyone read the help text (#244).
+    const args = parseArgs(argv, HELP_ONLY_SPEC);
+    if (args.help) {
+        out(LOGOUT_HELP);
+        return;
+    }
+    rejectUnknownFlags(args);
+    clearGrokCredentials();
+    out(color.green("✓ ") + "Removed the stored Grok OAuth session");
+}
 export default async function grokCmd(argv) {
     const sub = argv[0];
     if (!sub || sub === "--help" || sub === "-h") {
@@ -158,13 +224,10 @@ export default async function grokCmd(argv) {
     }
     const rest = argv.slice(1);
     if (sub === "login")
-        return loginCmd();
+        return loginCmd(rest);
     if (sub === "status")
         return statusCmd(rest);
-    if (sub === "logout") {
-        clearGrokCredentials();
-        out(color.green("✓ ") + "Removed the stored Grok OAuth session");
-        return;
-    }
+    if (sub === "logout")
+        return logoutCmd(rest);
     die(2, `unknown subcommand '${sub}'. Run 'ima2 grok --help'.`);
 }

package/lib/xaiAuth.js

@@ -2,7 +2,7 @@
  * xAI (Grok) OAuth credential store and refresh client.
  *
  * Ported from OpenCodex `src/oauth/xai.ts` (refresh path only) with the D1-D6/D9 fixes
- * recorded in devlog/_plan/260909_grok_native_oauth/001_opencodex_port_spec.md.
+ * recorded in devlog/_fin/260909_grok_native_oauth/001_opencodex_port_spec.md.
  *
  * MUST stay a leaf module: only node:fs, node:crypto, node:os, node:path. No imports from
  * config, routes, adapters, or the logger — adapters call loadGrokCredentials() synchronously.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ima2-gen",
-  "version": "3.16.0",
+  "version": "3.16.1",
   "packageManager": "npm@11.18.0",
   "description": "Local-first visual generation runtime and studio for people and coding agents, with reproducible image and video workflows across multiple providers.",
   "type": "module",
@@ -92,7 +92,7 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "1.30.0",
     "@neplex/vectorizer": "0.1.0",
-    "@openai/codex": "0.153.2",
+    "@openai/codex": "0.153.4",
     "better-sqlite3": "^13.0.3",
     "dotenv": "^17.4.2",
     "express": "^5.1.0",
@@ -125,5 +125,5 @@
     "typescript": "^5.9.3",
     "yaml": "2.9.0"
   },
-  "gitHead": "7fa7d426d92813caeeff667a458b781237029df0"
+  "gitHead": "5f33e44a7886580330ee03ea58a71a4d842014e5"
 }