feat(xai): add xAI Grok provider with OAuth + API key auth + image

Adapted from PR #1286 (mugnimaestra/feat/xai-grok-provider) to match
existing app architecture. Includes:

- OAuth 2.0 with PKCE on loopback port 56121 (Grok Build)
- API key auth path (console.x.ai)
- Token refresh wiring (open-sse + sse tokenRefresh)
- Dashboard OAuth modal with fixed-port flow + manual code fallback
- Provider registry entries (OAuth + API key)
- xAI image generation via OpenAI-compatible adapter
  (grok-2-image-1212 model, no size/quality/style params)

Excludes (intentionally, to match app patterns):
- Custom xAI Responses executor (DefaultExecutor handles /chat/completions)
- xAI-specific translators (app uses OpenAI as intermediate format)
- Image edits (not supported by current imageGenerationCore)
- Video endpoints (app has no video subsystem yet)
- CLI xai-login command

Refs decolua#1286

Co-authored-by: Cursor <cursoragent@cursor.com>

open-sse/config/providerModels.js

@@ -462,6 +462,7 @@ export const PROVIDER_MODELS = {
     { id: "grok-4-fast-reasoning", name: "Grok 4 Fast Reasoning" },
     { id: "grok-code-fast-1", name: "Grok Code Fast" },
     { id: "grok-3", name: "Grok 3" },
+    { id: "grok-2-image-1212", name: "Grok 2 Image", type: "image", params: ["n", "response_format"] },
   ],
   mistral: [
     { id: "mistral-large-latest", name: "Mistral Large 3" },

open-sse/config/providers.js

@@ -272,7 +272,11 @@ export const PROVIDERS = {
   },
   xai: {
     baseUrl: "https://api.x.ai/v1/chat/completions",
-    format: "openai"
+    responsesUrl: "https://api.x.ai/v1/responses",
+    format: "openai",
+    clientId: "b1a00492-073a-47ea-816f-4c329264a828",
+    tokenUrl: "https://auth.x.ai/oauth2/token",
+    refreshUrl: "https://auth.x.ai/oauth2/token"
   },
   mistral: {
     baseUrl: "https://api.mistral.ai/v1/chat/completions",

open-sse/handlers/imageProviders/index.js

@@ -17,6 +17,7 @@ const ADAPTERS = {
   minimax: createOpenAIAdapter("minimax"),
   openrouter: createOpenAIAdapter("openrouter"),
   recraft: createOpenAIAdapter("recraft"),
+  xai: createOpenAIAdapter("xai"),
   gemini,
   codex,
   sdwebui,

open-sse/handlers/imageProviders/openai.js

@@ -5,6 +5,7 @@ const ENDPOINTS = {
   minimax: "https://api.minimaxi.com/v1/images/generations",
   openrouter: "https://openrouter.ai/api/v1/images/generations",
   recraft: "https://external.api.recraft.ai/v1/images/generations",
+  xai: "https://api.x.ai/v1/images/generations",
 };
 
 export default function createOpenAIAdapter(providerId) {
@@ -22,6 +23,12 @@ export default function createOpenAIAdapter(providerId) {
     },
     buildBody: (model, body) => {
       const { prompt, n = 1, size = "1024x1024", quality, style, response_format } = body;
+      // xAI only accepts prompt, model, n, response_format
+      if (providerId === "xai") {
+        const req = { model, prompt, n };
+        if (response_format) req.response_format = response_format;
+        return req;
+      }
       const req = { model, prompt, n, size };
       if (quality) req.quality = quality;
       if (style) req.style = style;

open-sse/services/tokenRefresh.js

@@ -2,6 +2,33 @@ import { PROVIDERS } from "../config/providers.js";
 import { OAUTH_ENDPOINTS, GITHUB_COPILOT, REFRESH_LEAD_MS } from "../config/appConstants.js";
 import { proxyAwareFetch } from "../utils/proxyFetch.js";
 
+// xAI refresh — wraps the class method from src/lib/oauth/services/xai.js so
+// the token-refresh switches below can stay flat (one function per provider).
+let _xaiServiceSingleton = null;
+async function refreshXaiToken(refreshToken, log) {
+  if (!refreshToken) return null;
+  try {
+    if (!_xaiServiceSingleton) {
+      const mod = await import("../../src/lib/oauth/services/xai.js");
+      _xaiServiceSingleton = new mod.XaiService();
+    }
+    const tokens = await _xaiServiceSingleton.refreshAccessToken(refreshToken);
+    return {
+      accessToken: tokens.access_token,
+      refreshToken: tokens.refresh_token || refreshToken,
+      expiresIn: tokens.expires_in,
+      idToken: tokens.id_token,
+    };
+  } catch (e) {
+    log?.warn?.("TOKEN_REFRESH", `xai refresh failed: ${e?.message || e}`);
+    const msg = String(e?.message || "");
+    if (msg.includes("invalid_grant") || msg.includes("invalid_request")) {
+      return { error: "invalid_grant" };
+    }
+    return null;
+  }
+}
+
 // Default token expiry buffer (refresh if expires within 5 minutes)
 export const TOKEN_EXPIRY_BUFFER_MS = 5 * 60 * 1000;
 
@@ -567,6 +594,9 @@ async function _getAccessTokenInternal(provider, credentials, log) {
         log
       );
 
+    case "xai":
+      return await refreshXaiToken(credentials.refreshToken, log);
+
     case "vertex":
     case "vertex-partner": {
       const saJson = parseVertexSaJson(credentials.apiKey);
@@ -611,6 +641,8 @@ export async function refreshTokenByProvider(provider, credentials, log) {
         credentials.providerSpecificData,
         log
       );
+    case "xai":
+      return refreshXaiToken(credentials.refreshToken, log);
     case "vertex":
     case "vertex-partner": {
       const saJson = parseVertexSaJson(credentials.apiKey);
@@ -651,6 +683,7 @@ export function formatProviderCredentials(provider, credentials, log) {
     case "iflow":
     case "openai":
     case "openrouter":
+    case "xai":
       return {
         apiKey: credentials.apiKey,
         accessToken: credentials.accessToken
@@ -798,4 +831,3 @@ export async function refreshWithRetry(refreshFn, maxRetries = 3, log = null) {
   log?.error?.("TOKEN_REFRESH", `All ${maxRetries} retry attempts failed`);
   return null;
 }
-