feat(ai): SuperGrok OAuth device login

[valtterivalo]

Adds SuperGrok / X Premium device OAuth on the existing xai provider. Tokens refresh automatically. Default xAI model is grok-4.5.

/login → xAI SuperGrok, then use built-in xAI models against api.x.ai.

---

Note

Medium Risk
Introduces OAuth token acquisition and refresh against xAI’s auth endpoints and changes the default xAI model, which affects auth handling and out-of-the-box model selection without touching core inference paths.

Overview
Adds SuperGrok / X Premium subscription auth for the existing xai provider via OAuth device login (open verification URL, enter user code, poll until authorized). loginXai, refreshXaiToken, and xaiOAuthProvider are exported from prime-agent-ai/oauth and registered alongside the other built-in OAuth providers so /login and getOAuthApiKey can use the same xai auth slot as API keys.

The device flow polls auth.x.ai with authorization_pending / slow_down handling, rejects non-HTTPS verification URLs, and refreshes access tokens while preserving the refresh token when the issuer does not rotate it. Vitest coverage exercises polling, URL hardening, refresh, and registry wiring.

Docs and changelogs in packages/ai and packages/coding-agent document the new login path. The coding-agent default xAI model changes from grok-4.20-0309-reasoning to grok-4.5.

^{Reviewed by Cursor Bugbot for commit c2c3b54. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Add xAI SuperGrok OAuth device login flow to the xAI provider

• Implements OAuth 2.0 device authorization flow in packages/ai/src/utils/oauth/xai.ts, supporting polling with authorization_pending, slow_down backoff, access_denied, and expired_token error handling.
• Adds loginXai and refreshXaiToken functions and registers xaiOAuthProvider in the built-in OAuth provider registry so getOAuthProvider('xai') resolves to it.
• Changes the default xAI model in packages/coding-agent/src/core/model-resolver.ts from grok-4.20-0309-reasoning to grok-4.5.
• Behavioral Change: non-HTTPS verification URIs returned in device responses are now rejected with an error.

^{Macroscope summarized c2c3b54.}