Feature request: xAI Grok (SuperGrok) subscription OAuth login — implementation ready (was PR #1681)

[mddinizbh]

Problem

/login supports subscription-based OAuth for Anthropic (Claude Pro/Max), GitHub Copilot, and OpenAI (ChatGPT Plus/Pro), but xai only accepts an API key. SuperGrok subscribers have no way to use their subscription with Prime Agent — today we work around it by copying the OAuth access token out of opencode's auth.json into an api_key credential and hand-rolling a refresh script.

Proposed feature

A built-in xai OAuth provider ("xAI Grok (SuperGrok Subscription)") so /login treats Grok subscriptions like the other subscription providers: browser sign-in, automatic refresh before expiry, /logout, auth status — all through the existing OAuthProviderInterface registry.

Implementation details (validated against the real endpoints):

• Authorization code + PKCE against auth.x.ai using the shared Grok CLI OAuth client and its registered loopback redirect (127.0.0.1:56121/callback) — the same client opencode uses, so it works today without registering a new OAuth app.
• Device authorization grant fallback when the callback port can't be bound (another Grok client running) or on headless/remote machines: verification URL + user code through the existing onAuth dialog.
• Refresh with rotation: xAI rotates the refresh token on every refresh; refreshXaiToken returns the new one so AuthStorage persists it, matching the other providers.
• Manual paste fallback racing the browser callback, same UX as the OpenAI Codex flow.

Registration is one entry in BUILT_IN_OAUTH_PROVIDERS; the xai model provider (base URL api.x.ai/v1, openai-completions) already accepts the OAuth access token as a Bearer token, so no other packages change.

Work already done

PR #1681 (closed by the vouched-contributor policy, understood). The branch feat/xai-grok-oauth-login on my fork carries the full change:

• packages/ai/src/utils/oauth/xai.ts following the conventions of openai-codex.ts / anthropic.ts
• unit tests (packages/ai/test/xai-oauth.test.ts) — passing
• changelog fragment (packages/ai/.changes/feat-xai-grok-oauth-login.md)
• clean on biome check --error-on-warnings and tsgo --noEmit (pre-commit hooks passed)
• validated end-to-end: seeded an expiring credential, the runtime refreshed it through the new provider (refresh token rotated as expected), and a live completion through xai/grok-code-fast-1 succeeded using only the OAuth access token

Full disclosure: this work was agent-authored (Prime Agent + IPython tooling), driven and verified end-to-end by me. Per CONTRIBUTING.md I take responsibility for how it interacts with the project and am happy to walk through any part of it, adjust the design, or rework the implementation to maintainer feedback.

Ask

1. Is a built-in SuperGrok OAuth provider something that fits the roadmap?
2. If yes, is the shared Grok CLI OAuth client acceptable (vs. registering a Prime Agent-specific client), and would maintainers invite the implementation from Add xAI Grok (SuperGrok) OAuth login provider #1681?

I'd also like to grow into a trusted contributor over time — happy to start with issue investigation, testing, or docs wherever it's useful.

[andrueandersoncs]

I need this too, thanks for the implementation