Skip to content

fix(core): make xAI OAuth device-only - #40538

Merged
rekram1-node merged 3 commits into
v2from
xai-device-v2
Aug 5, 2026
Merged

fix(core): make xAI OAuth device-only#40538
rekram1-node merged 3 commits into
v2from
xai-device-v2

Conversation

@rekram1-node

@rekram1-node rekram1-node commented Aug 5, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • replace xAI loopback OAuth with RFC 8628 device authentication
  • expose one SuperGrok subscription method that works locally and remotely
  • migrate existing browser OAuth credentials to the device method without changing token data
  • remove the loopback server, PKCE, CORS, and callback code
  • preserve xAI attribution with referrer=opencode
  • cover method registration and credential migration

Fixes #38784.

Why?

The UX for device only is just as good as the browser one and having the two options is has led to more confusion than we would like. So forcing people to use the device flow seems to be a better solution and is also in line with how some of the other XAI integrations are set up to work.

@rekram1-node rekram1-node changed the title fix(core): use xAI device authentication fix(core): make xAI OAuth device-only Aug 5, 2026
@rekram1-node
rekram1-node merged commit daa998f into v2 Aug 5, 2026
12 checks passed
@rekram1-node
rekram1-node deleted the xai-device-v2 branch August 5, 2026 03:55
github-actions Bot pushed a commit to ReStranger/opencode that referenced this pull request Aug 5, 2026
* upstream/v2: (28 commits)
  refactor(app): gate unsupported v2 capabilities (anomalyco#40381)
  fix(app): show active search details (anomalyco#40597)
  refactor(app): migrate supported v2 APIs (anomalyco#40378)
  fix(app): reconcile v2 session projections (anomalyco#40376)
  refactor(app): own rendering contracts (anomalyco#40375)
  fix(core): make xAI OAuth device-only (anomalyco#40538)
  test(app): migrate e2e fixtures to v2 (anomalyco#40374)
  fix(core): report missing shell workdir (anomalyco#40542)
  fix(ai): restore Responses tool input semantics (anomalyco#40553)
  fix(ai): classify malformed Responses tool calls (anomalyco#40549)
  feat(tui): streamline tab navigation shortcuts (anomalyco#40551)
  fix(ai): preserve Gemini tool finish semantics (anomalyco#40546)
  fix: retry empty incomplete streams (anomalyco#40535)
  fix(app): finish tool call ID rename (anomalyco#40539)
  refactor: rename tool call ID fields
  fix(client): wait for live service contenders (anomalyco#40515)
  chore(core): drop unreachable AI SDK provider packages (anomalyco#40504)
  fix(tui): update tab titles immediately (anomalyco#40318)
  fix(tui): show branch beside directory (anomalyco#40500)
  feat(vcs): publish branch updates (anomalyco#40371)
  ...
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant