fix(xai): handle Grok paste flow and tiny screenshots by OndrejDrapalik · Pull Request #36781 · NousResearch/hermes-agent

OndrejDrapalik · 2026-06-01T13:03:09Z

Summary

This tightens two xAI-specific failure paths that still show up after the existing manual-paste work:

hermes model / default loopback xAI OAuth now accepts the Grok Build code while Hermes is still waiting for the local callback, instead of requiring the user to wait for timeout or restart with --manual-paste.
The timeout fallback now treats a bare Grok Build code as a manual paste path, matching the already-merged --manual-paste behavior from fix(xai-oauth): accept bare-code manual paste (state=None) (#26923) #33880.
The xAI credential reuse prompt now uses the same radio-list terminal UI as provider/model selection instead of a one-off numbered prompt.
computer_use now omits provider-invalid tiny screenshots (<8x8) and returns the text/AX/SOM payload instead of sending an image xAI rejects with HTTP 400.

Existing upstream work checked

Builds on fix(xai-oauth): accept bare-code manual paste (state=None) (#26923) #33880 and docs(xai-oauth): note bare-code manual-paste form (#33917) #34459, which already handled/documented bare-code paste for explicit --manual-paste.
Keeps fix(xai-oauth): accept bare-code manual paste (state=None) (#26923) #33880's loopback state protection: real callbacks still require state; only manual code paste paths may omit it.
X Premium+ (affiliate/gifted) account fails OAuth — receives SuperGrok Heavy build code #28068 is a separate xAI entitlement/tier issue and is not addressed here.

Changes

hermes_cli/auth.py — add nonblocking stdin polling while waiting for the xAI loopback callback; mark stdin/manual timeout paste paths so missing state is accepted only for those manual-code cases.
hermes_cli/main.py — add a reusable auth credential choice helper backed by the existing curses radio selector, and use it for xAI OAuth credentials.
tools/computer_use/tool.py — parse PNG/JPEG dimensions from base64 and fall back to text when the screenshot is below provider minimum dimensions.
Tests cover ready-stdin code paste, timeout bare-code fallback, xAI credential prompt reauth/cancel/fallback, and tiny image fallback.

Validation

venv/bin/python -m py_compile hermes_cli/auth.py hermes_cli/main.py tools/computer_use/tool.py
git diff --check origin/main...HEAD
venv/bin/python -m pytest tests/hermes_cli/test_xai_model_flow.py tests/hermes_cli/test_auth_manual_paste.py tests/hermes_cli/test_xai_oauth_pkce_token_exchange.py tests/hermes_cli/test_auth_xai_oauth_provider.py tests/tools/test_computer_use.py::TestCaptureResponse tests/tools/test_computer_use_capture_routing.py -q — 153 passed
Live smoke: hermes -z 'Reply with exactly: pr-smoke-ok' returned pr-smoke-ok through xAI OAuth.

Visuals

No rendered web UI changed. The only visible change is terminal UI: the existing xAI credential prompt now uses the standard Hermes radio picker. A screenshot of the Grok Build code page plus the terminal prompt would be useful evidence, but is not required for reviewing the code path.

mxnstrexgl

🤖 Automated PR Review

Security Scan

✓ No hardcoded secrets, injection sinks, unsafe deserialization, or dependency red flags found by this automated scan.

Code Quality

✓ No blocking code-quality issues found by this automated scan.

Summary

Status: APPROVE — security findings: 0, quality suggestions: 0.

Automated review; raw diff content intentionally omitted.

…ot guard xAI's consent page renders the authorization code in-page instead of redirecting to the loopback callback, so the listener just hangs and the manual-paste flow demands a callback URL that never contains the token. - auth.py: poll stdin non-blockingly while waiting for the xAI loopback callback; accept a pasted bare Grok Build code and substitute the locally generated state (PKCE code_verifier still binds the exchange). No need to wait for timeout or re-run with --manual-paste. - computer_use: parse PNG/JPEG dimensions from base64 and fall back to the text/AX/SOM payload when the screenshot is below the provider minimum (8x8), which xAI rejects with HTTP 400. - model_setup_flows.py: xAI credential reuse prompt uses the standard radio picker via a shared _prompt_auth_credentials_choice helper. - main.py: thread a title through _prompt_provider_choice; re-home the helper import (flows live in model_setup_flows.py post-decomposition). Salvaged from #36781 onto current main (contributor's main.py edits re-homed to model_setup_flows.py, where the flows were extracted since the PR opened).

Maps the salvaged #36781 commit author email to the GitHub login so the release attribution + CI author check resolve.

teknium1 · 2026-06-10T06:21:42Z

Merged via #43331. Your commit was cherry-picked onto current main with your authorship preserved in git log (commit on main authored by you via rebase-merge).

Adaptation notes: since this PR was opened, the _model_flow_* wizards were extracted out of main.py into hermes_cli/model_setup_flows.py, so your main.py edits were re-homed there. Your new _prompt_auth_credentials_choice radio prompt was also widened to the sibling OpenAI Codex and Anthropic credential-reuse prompts that shared the same numbered-menu pattern. The core auth.py loopback-wait fix and the computer_use tiny-screenshot guard landed exactly as you wrote them.

Thanks for the fix — this resolves the reported Grok Build code hang.

…ot guard xAI's consent page renders the authorization code in-page instead of redirecting to the loopback callback, so the listener just hangs and the manual-paste flow demands a callback URL that never contains the token. - auth.py: poll stdin non-blockingly while waiting for the xAI loopback callback; accept a pasted bare Grok Build code and substitute the locally generated state (PKCE code_verifier still binds the exchange). No need to wait for timeout or re-run with --manual-paste. - computer_use: parse PNG/JPEG dimensions from base64 and fall back to the text/AX/SOM payload when the screenshot is below the provider minimum (8x8), which xAI rejects with HTTP 400. - model_setup_flows.py: xAI credential reuse prompt uses the standard radio picker via a shared _prompt_auth_credentials_choice helper. - main.py: thread a title through _prompt_provider_choice; re-home the helper import (flows live in model_setup_flows.py post-decomposition). Salvaged from NousResearch#36781 onto current main (contributor's main.py edits re-homed to model_setup_flows.py, where the flows were extracted since the PR opened).

Maps the salvaged NousResearch#36781 commit author email to the GitHub login so the release attribution + CI author check resolve.