Feature request: xAI Grok SuperGrok / Premium+ OAuth login (was PR #1932)

[ziliangpeng]

Problem

/login already supports subscription OAuth for ChatGPT Plus/Pro, Claude Pro/Max, and GitHub Copilot. The built-in xai provider still only accepts XAI_API_KEY. SuperGrok / Premium+ users cannot authenticate with their subscription.

Proposal

Add a built-in xai OAuth provider so /login → xAI (Grok SuperGrok / Premium+) uses RFC 8628 device authorization against auth.x.ai. No local callback server, so it works over SSH and other headless setups. The access token is used as the Bearer token for the existing openai-completions client at https://api.x.ai/v1.

This is auth only: no model-catalog changes, no reasoning-effort changes, and no unrelated extensions.

Details:

• Refresh follows xAI's refresh-token rotation
• Stored expiry is skewed so long-lived tokens refresh up to an hour early, while short-lived JWTs do not refresh on every call
• HTTP 403 is reported as a subscription-tier gate; the user must /logout first because stored OAuth credentials take priority over XAI_API_KEY
• Uses the public grok-cli client id, because xAI does not offer per-app OAuth registration for CLI tools

Implementation already on a branch

PR (auto-closed by the vouched-author gate): #1932

Branch, rebased onto current main: https://github.com/ziliangpeng/prime-agent/tree/feat/xai-oauth

Compare: main...ziliangpeng:feat/xai-oauth

One commit, seven files, +813 / −4:

• packages/ai/src/utils/oauth/xai.ts
• packages/ai/src/utils/oauth/index.ts
• packages/ai/test/xai-oauth.test.ts (18 tests)
• packages/coding-agent/src/modes/interactive/auth-flows.ts
• packages/coding-agent/docs/providers.md
• changelog fragments for packages/ai and packages/coding-agent

Validation on that branch:

• npm test --workspace @earendil-works/pi-ai -- test/xai-oauth.test.ts — 18/18
• Existing Copilot / Anthropic / Codex OAuth tests still pass
• Pre-commit: biome, tsgo --noEmit, installer render, browser smoke

I have been using this OAuth path locally against live api.x.ai (device login, token refresh, Grok 4.6 completions).

Ask

1. Does a built-in SuperGrok / Premium+ OAuth login fit the roadmap?
2. If yes, would a maintainer invite the implementation from PR feat(ai): add xAI Grok OAuth login via device code flow #1932 / ziliangpeng:feat/xai-oauth, and vouch ziliangpeng so the contribution gate can accept the PR?

I can keep the branch rebased on main and adjust the design if needed.