# pi-xai-oauth

Pi package: use **Grok Build OAuth** for xAI models — **no API key**, **no second login**.

## Design (copy systray-ai)

[`systray-ai/pi_auth_sync.py`](../../../systray-ai/pi_auth_sync.py) for Codex:

> pi's provider uses the **same OAuth client** as the CLI; credentials are **derived** from the CLI auth file. Every switch re-derives from the CLI copy.

This package does the same for Grok:

| Role | Path |
|------|------|
| Source of truth | `~/.grok/auth.json` (`grok login`) |
| Pi mirror | `~/.pi/agent/auth.json` → key `xai-oauth` |
| Derive | **copy** access + refresh + JWT `exp` |
| Token endpoint | **never** called by this package |

**Why never refresh here:** xAI refresh tokens rotate/revoke the previous one. Dual refresh (Pi + Grok CLI) kills the only session. Systray can dual-refresh Codex because OpenAI rotation is non-destructive; **xAI is not**.

## Install

```bash
pi install /home/user/Projects/mega-plan-harness/packages/pi-xai-oauth
```

## Login / re-sync (local only)

Interactive:

```
/login xai-oauth
```

Headless derive (still **no network**):

```bash
node packages/pi-xai-oauth/import-from-grok.mjs
```

Requires a non-expired access JWT in `~/.grok/auth.json`. If expired, refresh **only** via Grok CLI (`grok` / `grok login`), then re-derive.

## Use

```bash
pi -p --provider xai-oauth --model grok-code-fast-1 "hello"
```

## Models (only these two)

| Id | Display |
|----|---------|
| `grok-4.5` | Grok 4.5 |
| `grok-composer-2.5-fast` | Composer 2.5 |

Nothing else is registered.

## Safety

- Do **not** add device-code login against the Grok CLI client id (second session).
- Do **not** call `https://auth.x.ai/oauth2/token` from this package.
- Override paths: `GROK_AUTH_FILE`, `PI_AUTH_FILE`.