Add Grok API and OAuth support - #413
Conversation
|
@codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
馃挕 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b0c4b7cc7e
鈩癸笍 About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 馃憤.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| suffix=".tmp", | ||
| ) | ||
| tmp_path = Path(raw_tmp_path) | ||
| os.fchmod(fd, 0o600) |
There was a problem hiding this comment.
On Windows, os.fchmod is unavailable, so every call that persists an API key or OAuth credential raises AttributeError before writing the temporary file. This affects the shared store now used by Grok, OpenAI, Anthropic, and Gemini authentication; use a portable permission operation or guard the Unix-only call as the later chmod calls are guarded.
Useful? React with 馃憤聽/ 馃憥.
| if provider_is_fixed: | ||
| provider_configured = _configure_provider_model( |
There was a problem hiding this comment.
When the command supplies only --provider for a family with one auth mode, such as ollama, minimax, or zai, this newly enters _configure_provider_model directly with provider_is_fixed=True and model_is_fixed=False. Selecting Back at the model prompt resets only the model, while the fixed family remains selected, so the inner loop immediately displays the same model prompt again and the user cannot return to the top-level menu without aborting the command.
Useful? React with 馃憤聽/ 馃憥.
1 participant
Summary
grokprovider family with public xAI API-key support (XAI) and MobileRun-owned subscription OAuth (grok_oauth)grok-4.5through the Responses API with a pinned 500,000-token context window, function calling,store=false, streamed usage extraction, and Grok-compatible sampling/structured-output handlingapiKeys.xai/XAI_API_KEY, provider aliases, configure-wizard flows, CLI help, documentation, and a skipped-by-default Android 16 Portal E2E gateAPI-key behavior
XAIsends only to the pinned public endpointhttps://api.x.ai/v1; generic endpoint overrides are discarded so the bearer key cannot be redirected. The adapter retains validatedtemperatureandtop_p, strips unsupported controls, pins the model and context metadata, supports text/image/tool/structured/streaming Responses operations, and records normal and completed-stream usage.OAuth behavior and credential isolation
MobileRun performs its own xAI browser PKCE or device-code authorization and stores only its own
grokOauthslot in the shared platformauth-profiles.json. It does not read, import, execute, or modify the Grok CLI or its credential file.OAuth inference is pinned to
https://cli-chat-proxy.grok.com/v1with the observed compatibility headers. ID tokens are verified for signature, issuer, audience, expiry, and nonce. Refresh is coordinated across threads/processes, retries only replay-safe transient operations, preserves rotated refresh tokens, and retries one rejected inference exactly once before exposing stream events. There is no OAuth-to-API-key fallback.The live gates verified that
~/.grok/auth.jsonretained the same existence, SHA-256, and mtime before and after all provider and Android tests. Saved logs, screenshots, UI trees, results, and trajectories passed recursive secret scanning.Compatibility risk
The public API-key path uses xAI's documented API. The OAuth path interoperates with the observed public Grok Build OAuth client and subscription proxy contract, which xAI does not document as a stable third-party integration. It may require re-login or a compatibility update if xAI changes or revokes that contract; the implementation pins the observed contract and fails closed.
Validation
Automated checks:
569 passed, 4 skipped, 3 subtests passedgit diff --checkcleanLive public xAI API gate:
Live Grok OAuth gates:
grokOauthAndroid 16 Portal E2E
All scenarios used only
emulator-5558, Android 16 / API 36, the required AVD/snapshot, Portal-required TCP control, publicmobilerun_core.Mobilerunharness actions/evidence, and independent ADB diagnostics/assertions. Each restored the clean snapshot first. The host emulator returned an all-black restored framebuffer, so the gate recorded that readiness failure, used the specified same-AVD no-wipe cold-boot fallback, and reran setup, both pings, doctor, Portal/accessibility checks, and evidence collection.XAIAPI keyXAIAPI keygrok_oauthgrok_oauth