[tuckcode]

Adds xAI browser sign-in as a preview (ADR-0186, decision 3), with the API key as the fallback. Base is the PR 286 branch.

Real sign-in and chat passed in a native dev build and in a probe.

What was implemented

• provider_oauth/xai.rs runs the device-code grant at auth.x.ai. The system browser opens the approval page.
• The public client id defaults to the shared id. client_ids.xai in oauth-sign-in.json replaces it.
• The token goes only to https://api.x.ai/v1, on the xai Settings row.
• Settings > Connected shows the short code and adds the row after sign-in.
• The picker sends xAI sign-in to Settings > Connected.
• A 403 says the account has no API access and shows "Add an xAI API key" (issue 284, item 4).

Decision: device code, not loopback PKCE

ADR-0186 allows either. Device code is the only flow confirmed live. OpenCode and Hermes also use it. curl to /oauth2/authorize returned 403, and the built-in browser blocks auth.x.ai, so the loopback flow is unverified.

Real sign-in result (2026-11-01)

Atticus approved a live code on a real account. The probe held tokens in memory and revoked them.

Step	Result
Device code, token	200. Scope includes api:access
/oauth2/userinfo	200
GET /v1/models	200, 14 models
POST /v1/chat/completions, grok-4.3	200
POST /v1/responses, grok-4.3	200
Refresh	200, the refresh token rotated
Revoke	200

Native QA

• ✅ Settings > Connected sign-in showed Ready, the email, and 14 models.
• ✅ A grok-4.7 chat replied, with no xAI key in the keychain.
• The test found and fixed a false Ready on the xAI API key row and a false "provider was removed" error.

Not verified

• A real 403. This account has access, so only a mock server covers it.
• That the shared id is the current Grok CLI id. xAI accepted it, but Grok CLI 1.0.70 does not hold it as plain text.

Completion

• QA: pnpm test:coverage passed, 88.88% lines. cargo test passed. The pre-push hook passed. Mock OAuth server only. Live probe and native QA passed.
• Codacy: not run. codacy-cli reported that no configuration file exists. The PR check still runs.
• Localization: none — English only (C18)
• PostHog: account_sign_in_finished with provider and outcome.
• Refactoring: install_usable_sign_in tests now take a lock, because they share one override.
• ADRs: none. Docs: docs/ARCHITECTURE.md, handoff file.
• Demo vault dirt: none.
• C101: a flaky native chat test, recorded in the handoff.

🤖 Generated with Claude Code

[codacy-production]

Not up to standards ⛔

🔴 Issues 10 critical · 1 high

Alerts:
⚠ 11 issues (≤ 0 issues of at least minor severity)

Results:
11 new issues

Category	Results
Security	10 critical 1 high

View in Codacy

🟢 Metrics 152 complexity · 10 duplication

Metric	Results
Complexity	152
Duplication	10

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}