fix(opencode): default xAI OAuth to device flow

packages/opencode/src/plugin/xai.ts

@@ -552,21 +552,15 @@ export async function XaiAuthPlugin(input: PluginInput, options: XaiAuthPluginOp
           label: "xAI Grok OAuth (SuperGrok Subscription)",
           type: "oauth",
           authorize: async () => {
-            await startOAuthServer()
-            const pkce = await generatePKCE()
-            const state = generateState()
-            const nonce = generateState()
-            const authUrl = buildAuthorizeUrl(pkce, state, nonce, options)
-
-            const callbackPromise = waitForOAuthCallback(pkce, state)
-
+            const device = await requestDeviceCode(options)
+            const browserUrl = device.verification_uri_complete ?? device.verification_uri
             return {
-              url: authUrl,
-              instructions: "Complete authorization in your browser. This window will close automatically.",
+              url: browserUrl,
+              instructions: `Open ${device.verification_uri} on any device and enter code: ${device.user_code}`,
               method: "auto" as const,
               callback: async () => {
                 try {
-                  const tokens = await callbackPromise
+                  const tokens = await pollDeviceCodeToken(device, options)
                   return {
                     type: "success" as const,
                     refresh: tokens.refresh_token,
@@ -575,34 +569,30 @@ export async function XaiAuthPlugin(input: PluginInput, options: XaiAuthPluginOp
                   }
                 } catch (err) {
                   return { type: "failed" as const }
-                } finally {
-                  stopOAuthServer()
                 }
               },
             }
           },
         },
         {
-          // RFC 8628 device-code flow. The CLI prints a verification URL
-          // and a short user_code that the user enters in a browser on
-          // any device. No loopback callback server runs on the CLI host,
-          // so this works on VPS / SSH / Docker / CI / WSL / any
-          // environment where 127.0.0.1:56121 isn't reachable from the
-          // user's browser. Defends the only attack surface (the polling
-          // loop) with the standard authorization_pending / slow_down
-          // backoff and a hard deadline from xAI's `expires_in`.
-          label: "xAI Grok OAuth (Headless / Remote / VPS)",
+          label: "xAI Grok OAuth (Local Callback)",
           type: "oauth",
           authorize: async () => {
-            const device = await requestDeviceCode(options)
-            const browserUrl = device.verification_uri_complete ?? device.verification_uri
+            await startOAuthServer()
+            const pkce = await generatePKCE()
+            const state = generateState()
+            const nonce = generateState()
+            const authUrl = buildAuthorizeUrl(pkce, state, nonce, options)
+
+            const callbackPromise = waitForOAuthCallback(pkce, state)
+
             return {
-              url: browserUrl,
-              instructions: `Open ${device.verification_uri} on any device and enter code: ${device.user_code}`,
+              url: authUrl,
+              instructions: "Complete authorization in your browser. This window will close automatically.",
               method: "auto" as const,
               callback: async () => {
                 try {
-                  const tokens = await pollDeviceCodeToken(device, options)
+                  const tokens = await callbackPromise
                   return {
                     type: "success" as const,
                     refresh: tokens.refresh_token,
@@ -611,6 +601,8 @@ export async function XaiAuthPlugin(input: PluginInput, options: XaiAuthPluginOp
                   }
                 } catch (err) {
                   return { type: "failed" as const }
+                } finally {
+                  stopOAuthServer()
                 }
               },
             }

packages/opencode/test/plugin/xai.test.ts

@@ -111,7 +111,7 @@ describe("plugin.xai", () => {
       ).toEqual({})
       expect(hooks.auth!.methods.map((m) => [m.type, m.label])).toEqual([
         ["oauth", "xAI Grok OAuth (SuperGrok Subscription)"],
-        ["oauth", "xAI Grok OAuth (Headless / Remote / VPS)"],
+        ["oauth", "xAI Grok OAuth (Local Callback)"],
         ["api", "Manually enter API Key"],
       ])
     })
@@ -424,11 +424,11 @@ describe("plugin.xai", () => {
         return new Response("unexpected request", { status: 500 })
       })
       const hooks = await XaiAuthPlugin({} as any, serverOptions(server))
-      const headless = hooks.auth!.methods.find(
+      const oauth = hooks.auth!.methods.find(
         (m): m is Extract<typeof m, { type: "oauth" }> =>
-          m.type === "oauth" && m.label === "xAI Grok OAuth (Headless / Remote / VPS)",
+          m.type === "oauth" && m.label === "xAI Grok OAuth (SuperGrok Subscription)",
       )!
-      const result = await headless.authorize!()
+      const result = await oauth.authorize!()
 
       expect(result.method).toBe("auto")
       expect(result.url).toBe("https://x.ai/device?user_code=ABCD-1234")
@@ -448,11 +448,11 @@ describe("plugin.xai", () => {
         }
         return new Response("unexpected request", { status: 500 })
       })
-      const headless = (await XaiAuthPlugin({} as any, serverOptions(server))).auth!.methods.find(
+      const oauth = (await XaiAuthPlugin({} as any, serverOptions(server))).auth!.methods.find(
         (m): m is Extract<typeof m, { type: "oauth" }> =>
-          m.type === "oauth" && m.label === "xAI Grok OAuth (Headless / Remote / VPS)",
+          m.type === "oauth" && m.label === "xAI Grok OAuth (SuperGrok Subscription)",
       )!
-      expect((await headless.authorize!()).url).toBe("https://x.ai/device")
+      expect((await oauth.authorize!()).url).toBe("https://x.ai/device")
     })
 
     test("requestDeviceCode posts form body, validates fields, and surfaces endpoint errors", async () => {
@@ -610,11 +610,11 @@ describe("plugin.xai", () => {
         }
         return Response.json({ error: "access_denied" }, { status: 400 })
       })
-      const headless = (await XaiAuthPlugin({} as any, serverOptions(server))).auth!.methods.find(
+      const oauth = (await XaiAuthPlugin({} as any, serverOptions(server))).auth!.methods.find(
         (m): m is Extract<typeof m, { type: "oauth" }> =>
-          m.type === "oauth" && m.label === "xAI Grok OAuth (Headless / Remote / VPS)",
+          m.type === "oauth" && m.label === "xAI Grok OAuth (SuperGrok Subscription)",
       )!
-      expect(await ((await headless.authorize!()) as any).callback()).toEqual({ type: "failed" })
+      expect(await ((await oauth.authorize!()) as any).callback()).toEqual({ type: "failed" })
     })
   })
 })

packages/web/src/content/docs/providers.mdx

@@ -2244,9 +2244,9 @@ Some useful routing options:
 
 ### xAI
 
-Three ways to authenticate: a SuperGrok subscription via browser OAuth, the same SuperGrok subscription via a headless device-code flow (for VPS / SSH / Docker), or a pay-as-you-go API key from the xAI console.
+Three ways to authenticate: a SuperGrok subscription via device-code OAuth, the same SuperGrok subscription via a local callback, or a pay-as-you-go API key from the xAI console.
 
-#### Option A — SuperGrok OAuth (browser login)
+#### Option A — SuperGrok OAuth
 
 1. Run the `/connect` command and search for **xAI**.
 
@@ -2254,9 +2254,11 @@ Three ways to authenticate: a SuperGrok subscription via browser OAuth, the same
    /connect
    ```
 
-2. Select **xAI Grok OAuth (SuperGrok Subscription)**. OpenCode opens xAI's consent screen in your browser and waits for the callback on `http://127.0.0.1:56121/callback`.
+2. Select **xAI Grok OAuth (SuperGrok Subscription)**. OpenCode prints a verification URL and a short user code.
 
-3. Run the `/models` command to select a Grok model.
+3. Open the URL, enter the code, and approve the consent screen. OpenCode polls xAI's token endpoint and stores the resulting OAuth tokens once you approve.
+
+4. Run the `/models` command to select a Grok model.
 
    ```txt
    /models
@@ -2264,23 +2266,17 @@ Three ways to authenticate: a SuperGrok subscription via browser OAuth, the same
 
 OpenCode refreshes the OAuth access token automatically. Any Grok or X Premium plan that includes Grok API access works; you do not need a separate `XAI_API_KEY`.
 
-#### Option B — SuperGrok device-code (headless / remote server / VPS)
+#### Option B — SuperGrok local callback
 
-Use this when OpenCode is running somewhere a browser can't reach the loopback redirect: a VPS, a remote dev box over SSH, inside Docker, in CI, etc. No callback port is opened on the host running OpenCode — instead xAI hands the CLI a short code that you type into a browser on any other device (laptop, phone, …).
+Use this only if you prefer a local browser callback and the browser can reach OpenCode on the same machine.
 
-1. Run the `/connect` command on the remote host and search for **xAI**.
+1. Run the `/connect` command and search for **xAI**.
 
    ```txt
    /connect
    ```
 
-2. Select **xAI Grok OAuth (Headless / Remote / VPS)**. OpenCode prints a verification URL and a short user code.
-
-   ```txt
-   Open https://x.ai/device on any device and enter code: ABCD-1234
-   ```
-
-3. Open the URL on a device that has a browser (your laptop or phone), enter the code, and approve the consent screen. OpenCode polls xAI's token endpoint and stores the resulting OAuth tokens once you approve. Token refresh works the same as Option A.
+2. Select **xAI Grok OAuth (Local Callback)**. OpenCode opens xAI's consent screen and waits for the callback on `http://127.0.0.1:56121/callback`. Token refresh works the same as Option A.
 
 #### Option C — API key