feat(ai): xAI subscription OAuth login (SuperGrok / X Premium)

[MingTeer]

Summary

Port of pi-mono's xAI subscription OAuth (5220aba61 #6651, a01baaaea #6734, b0bd0ff9d, xAI parts of fed6009cc), adapted to this repo's structure (utils/oauth, runtime model routing via modifyModels).

• Added xAI device-code OAuth login ("xAI (SuperGrok / X Premium)" in /login) alongside XAI_API_KEY: https-validated verification links (prefilled user code when verification_uri_complete is provided), token refresh 5 minutes before expiry, RFC 8628 interval-0 tolerance, clean cancellation.
• When a subscription credential is active, grok-4.5 and grok-4.6 route through the OpenAI Responses API (low/medium/high reasoning effort, encrypted reasoning content); API key credentials and other models keep OpenAI Completions unchanged. The model selector shows only subscription-usable models.
• Trimmed obsolete xAI models (grok-4.20 variants, grok-code-fast-1) from catalog generation; grok-4.6 is now included and is the default xAI model.
• Footer stays empty by default but now shows a muted label while the current model runs on a known subscription credential (anthropic, github-copilot, openai-codex, xai marked isSubscription).
• The catalog regeneration commit also updates two google test references from gemini-2.0-flash to gemini-2.5-flash; models.dev no longer lists gemini-2.0-flash, so the regenerated catalog cannot type-check the old references.

Testing

• New test/xai-oauth.test.ts (15 tests) and test/xai-responses.test.ts (5 tests), mocked fetch, no network: device-code request shape, poll pending/slow_down/success/timeout/cancel, refresh incl. non-rotated refresh token, https rejection, prefill preference, interval-0 fallback; routing matrix and /responses request shape.
• Existing OAuth provider tests pass unchanged (25/25 with the new suites).
• npm run check clean (biome, tsgo, installer, browser-smoke).
• Verified end-to-end with a real SuperGrok account: /login browser authorization and grok-4.6 conversation.

Note

Add xAI subscription OAuth login (SuperGrok / X Premium) via device-code flow

• Adds a new xaiOAuthProvider in xai.ts implementing the full OAuth device-code flow: device authorization request, polling for tokens, refresh, and model shaping restricted to grok-4.5 and grok-4.6.
• Adds an isSubscription flag to the OAuthProviderInterface and marks xAI, Anthropic, GitHub Copilot, and OpenAI Codex providers accordingly; the interactive TUI footer displays a subscription label when the active model uses a subscription provider.
• Routes xAI subscription models through the OpenAI Responses API and requests reasoning.encrypted_content in the include field for reasoning-capable xAI models.
• Changes the default xAI model from grok-4.20-0309-reasoning to grok-4.6 and removes grok-code-fast-1 and grok-4.20 variants from the generated model catalog.
• Behavioral Change: xAI API key auth continues to work, but subscription credentials now route grok-4.5/grok-4.6 exclusively through /responses with a different auth header.

^{Macroscope summarized 7abadda.}

[jonaowen]

This is not safe to merge yet. I found five concrete credential/routing and device-flow blockers at exact head 7abadda7608fdb2d80767df90443a9d1fb6dc0b2:

1. Runtime routing follows stored OAuth rather than the credential actually used. Model construction applies the OAuth modifyModels view when auth storage contains xAI OAuth, but a runtime --api-key override takes precedence only later. Stored OAuth plus --api-key therefore still filters xAI models, changes grok-4.5/4.6 to /responses, and can display the subscription footer even though the request uses an API key. Please bind model shaping and UI labeling to the effective request credential. Add an integration test with stored xAI OAuth plus --model xai/grok-4.6 --api-key ...; it must remain openai-completions, use /chat/completions, and show no subscription label. Cover stale OAuth plus an effective non-OAuth fallback too.

2. xaiOAuthProvider.modifyModels() spreads the incoming model and preserves its baseUrl while upgrading the credential to the broader subscription bearer. A pre-existing xAI custom model/proxy URL can therefore receive the subscription access token after login. Subscription routing must pin or strictly validate the official https://api.x.ai/v1 origin. Add a test with an eligible xAI model whose input baseUrl is https://attacker.invalid/v1 and prove the OAuth token can only target the official /responses endpoint (or the model is rejected).

3. The stated malicious-response defense for browser URLs only checks https:. Both verification_uri and verification_uri_complete accept arbitrary HTTPS origins, so a response can send the user/code to a phishing origin. Pin an explicit allowed xAI origin set and test that a legitimate base URI plus a cross-origin complete URI is rejected before onAuth, as is a cross-origin base URI.

4. Device expiry does not bound an in-flight token poll. The deadline is checked before/after options.poll(), but the fetch receives only the user cancellation signal. A stalled request can therefore keep login alive indefinitely beyond expires_in. Combine cancellation with a deadline abort for each poll (and use finite request limits for initial device authorization/refresh), then fake-timer test a 2-second code with a fetch that settles only on abort: it must reject at expiry and the fetch signal must be aborted.

5. slow_down can reduce the current interval: a positive server interval replaces the accumulated client interval. For example, 5s -> slow_down without interval gives 10s, then slow_down {interval:1} drops to 1s, contrary to RFC 8628's cumulative +5s requirement. Use at least max(current + 5s, server minimum) and test that sequence; the next poll must be no earlier than 15 seconds later.