fix(xai): OAuth hybrid discovery and canonical credential boundary

src/commands/model/model.tsx

@@ -372,7 +372,6 @@ async function getOpenAIDiscoveryRequestOptions(
   options?: { refreshXaiOAuth?: boolean },
 ): Promise<{
   apiKey?: string
-  cacheKey?: string
   baseUrl?: string
   headers?: Record<string, string>
 }> {
@@ -381,14 +380,15 @@ async function getOpenAIDiscoveryRequestOptions(
     baseUrl: process.env.OPENAI_BASE_URL,
   })
 
+  let apiKey = firstUsableCredential(
+    resolveRouteCredentialValue({
+      routeId,
+      baseUrl: request.baseUrl,
+      processEnv: process.env,
+    }),
+  )
   return resolveDiscoveryRequestOptions(routeId ?? 'custom', {
-    apiKey: firstUsableCredential(
-      resolveRouteCredentialValue({
-        routeId,
-        baseUrl: request.baseUrl,
-        processEnv: process.env,
-      }),
-    ),
+    apiKey,
     baseUrl: request.baseUrl,
     headers: parseCustomHeadersEnv(process.env.ANTHROPIC_CUSTOM_HEADERS),
   }, options)

src/integrations/discoveryService.test.ts

@@ -998,6 +998,160 @@ describe('discoverModelsForRoute', () => {
       { id: 'llama-3.3-70b', apiName: 'llama-3.3-70b', label: 'llama-3.3-70b', contextWindow: 131072 },
     ])
   })
+
+  test('does not send stored xAI OAuth credentials to an overridden discovery URL', async () => {
+    const originalXaiKey = process.env.XAI_API_KEY
+    const xaiCredentials = await import('../utils/xaiCredentials.js')
+    const tokenSpy = spyOn(xaiCredentials, 'resolveXaiAccessToken').mockResolvedValue(
+      'oauth-token',
+    )
+    try {
+      delete process.env.XAI_API_KEY
+      let authorization: string | null | undefined
+      setMockFetch(mock((_input: string | URL | Request, init?: RequestInit) => {
+        authorization = new Headers(init?.headers).get('authorization')
+        return Promise.resolve(
+          new Response(JSON.stringify({ data: [] }), {
+            headers: { 'Content-Type': 'application/json' },
+          }),
+        )
+      }) as unknown as typeof globalThis.fetch)
+
+      const { discoverModelsForRoute } = await loadDiscoveryServiceModule()
+      await discoverModelsForRoute('xai', {
+        baseUrl: 'https://proxy.example/v1',
+        forceRefresh: true,
+      })
+
+      expect(tokenSpy).not.toHaveBeenCalled()
+      expect(authorization).not.toBe('Bearer oauth-token')
+    } finally {
+      tokenSpy.mockRestore()
+      if (originalXaiKey === undefined) {
+        delete process.env.XAI_API_KEY
+      } else {
+        process.env.XAI_API_KEY = originalXaiKey
+      }
+    }
+  })
+
+  test('uses the canonical xAI URL for an empty discovery override', async () => {
+    const originalXaiKey = process.env.XAI_API_KEY
+    try {
+      process.env.XAI_API_KEY = 'xai-api-key'
+      let url: string | undefined
+      let authorization: string | null | undefined
+      setMockFetch(mock((input: string | URL | Request, init?: RequestInit) => {
+        url = typeof input === 'string' ? input : input instanceof URL ? input.toString() : input.url
+        authorization = new Headers(init?.headers).get('authorization')
+        return Promise.resolve(
+          new Response(JSON.stringify({ data: [] }), {
+            headers: { 'Content-Type': 'application/json' },
+          }),
+        )
+      }) as unknown as typeof globalThis.fetch)
+
+      const { discoverModelsForRoute } = await loadDiscoveryServiceModule()
+      await discoverModelsForRoute('xai', { baseUrl: '', forceRefresh: true })
+
+      expect(url).toBe('https://api.x.ai/v1/models')
+      expect(authorization).toBe('Bearer xai-api-key')
+    } finally {
+      if (originalXaiKey === undefined) {
+        delete process.env.XAI_API_KEY
+      } else {
+        process.env.XAI_API_KEY = originalXaiKey
+      }
+    }
+  })
+
+  test('does not refresh xAI OAuth credentials when nonessential traffic is disabled', async () => {
+    const xaiCredentials = await import('../utils/xaiCredentials.js')
+    const tokenSpy = spyOn(xaiCredentials, 'resolveXaiAccessToken').mockResolvedValue(
+      'oauth-token',
+    )
+    try {
+      process.env.CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC = '1'
+      const { discoverModelsForRoute } = await loadDiscoveryServiceModule()
+
+      const result = await discoverModelsForRoute('xai', { forceRefresh: true })
+
+      expect(tokenSpy).not.toHaveBeenCalled()
+      expect(result?.source).toBe('static')
+    } finally {
+      tokenSpy.mockRestore()
+    }
+  })
+
+  test('uses the stored OAuth token to read a fresh xAI discovery cache before refreshing', async () => {
+    const xaiCredentials = await import('../utils/xaiCredentials.js')
+    const readSpy = spyOn(xaiCredentials, 'readXaiCredentialsAsync').mockResolvedValue(
+      {
+        accessToken: 'cached-oauth-token',
+        refreshToken: 'refresh-token',
+        tokenEndpoint: 'https://auth.x.ai/oauth/token',
+      },
+    )
+    const refreshSpy = spyOn(xaiCredentials, 'resolveXaiAccessToken').mockResolvedValue(
+      'refreshed-oauth-token',
+    )
+    try {
+      const { discoverModelsForRoute, getDiscoveryCacheKey } =
+        await loadDiscoveryServiceModule()
+      await setCachedModels(
+        getDiscoveryCacheKey('xai', {
+          baseUrl: 'https://api.x.ai/v1',
+          apiKey: 'cached-oauth-token',
+          cacheKey: 'refresh-token',
+        }),
+        { models: [{ id: 'cached-grok', apiName: 'cached-grok', label: 'cached-grok' }] },
+      )
+
+      const result = await discoverModelsForRoute('xai')
+
+      expect(result?.source).toBe('cache')
+      expect(refreshSpy).not.toHaveBeenCalled()
+    } finally {
+      readSpy.mockRestore()
+      refreshSpy.mockRestore()
+    }
+  })
+
+  test('does not send xAI credentials to an insecure xAI URL', async () => {
+    const originalXaiKey = process.env.XAI_API_KEY
+    const xaiCredentials = await import('../utils/xaiCredentials.js')
+    const tokenSpy = spyOn(xaiCredentials, 'resolveXaiAccessToken').mockResolvedValue(
+      'oauth-token',
+    )
+    try {
+      process.env.XAI_API_KEY = 'xai-api-key'
+      let authorization: string | null | undefined
+      setMockFetch(mock((_input: string | URL | Request, init?: RequestInit) => {
+        authorization = new Headers(init?.headers).get('authorization')
+        return Promise.resolve(
+          new Response(JSON.stringify({ data: [] }), {
+            headers: { 'Content-Type': 'application/json' },
+          }),
+        )
+      }) as unknown as typeof globalThis.fetch)
+
+      const { discoverModelsForRoute } = await loadDiscoveryServiceModule()
+      await discoverModelsForRoute('xai', {
+        baseUrl: 'http://api.x.ai/v1',
+        forceRefresh: true,
+      })
+
+      expect(tokenSpy).not.toHaveBeenCalled()
+      expect(authorization).toBeNull()
+    } finally {
+      tokenSpy.mockRestore()
+      if (originalXaiKey === undefined) {
+        delete process.env.XAI_API_KEY
+      } else {
+        process.env.XAI_API_KEY = originalXaiKey
+      }
+    }
+  })
 })
 
 describe('probeRouteReadiness', () => {

src/integrations/discoveryService.ts

@@ -32,13 +32,13 @@ import {
 } from '../utils/providerDiscovery.js'
 import { firstUsableCredential, hasInvalidCredentialPlaceholder } from '../services/api/credentialPool.js'
 import { parseCustomHeadersEnv } from '../utils/providerCustomHeaders.js'
-import { resolveAimlapiAttributionHeaders } from './aimlapi/config.js'
-import { isEssentialTrafficOnly } from '../utils/privacyLevel.js'
 import {
   getXaiDiscoveryCacheIdentity,
   readXaiCredentialsAsync,
   resolveXaiAccessToken,
 } from '../utils/xaiCredentials.js'
+import { resolveAimlapiAttributionHeaders } from './aimlapi/config.js'
+import { isEssentialTrafficOnly } from '../utils/privacyLevel.js'
 
 export type RouteDiscoveryResult = {
   routeId: string
@@ -124,10 +124,10 @@ const FNV1A_128_OFFSET_BASIS = 0x6c62272e07bb014262b821756295c58dn
 const FNV1A_128_PRIME = 0x0000000001000000000000000000013bn
 
 function fingerprintDiscoveryCachePartition(value: unknown): string {
-  // Discovery results can be account-specific. This only needs a stable,
-  // opaque local cache namespace; it is not password storage, authentication,
-  // integrity protection, or a security boundary. Keep raw credentials out of
-  // the cache key without retaining them in a process-wide memoization cache.
+  // Cache partitions need a stable opaque namespace, not password hashing or
+  // an authentication boundary. This runs while preparing every request, so
+  // keep it constant-time with respect to credential-stretching work and do
+  // not retain the serialized value in a process-wide memoization cache.
   let fingerprint = FNV1A_128_OFFSET_BASIS
   const serialized = JSON.stringify(value) ?? ''
 
@@ -167,7 +167,11 @@ function getRouteBaseUrl(
   routeId: string,
   options?: { baseUrl?: string },
 ): string | undefined {
-  return options?.baseUrl ?? getRouteDescriptor(routeId)?.defaultBaseUrl
+  const configuredBaseUrl = options?.baseUrl?.trim()
+  if (configuredBaseUrl) {
+    return configuredBaseUrl
+  }
+  return getRouteDescriptor(routeId)?.defaultBaseUrl
 }
 
 function getRouteDiscoveryApiKey(
@@ -189,6 +193,10 @@ function getRouteDiscoveryApiKey(
     return undefined
   }
 
+  if (routeId === 'xai' && !isCanonicalXaiInferenceBaseUrl(baseUrl)) {
+    return undefined
+  }
+
   if (hasInvalidCredentialPlaceholder(options?.apiKey)) {
     return undefined
   }
@@ -208,12 +216,7 @@ function getRouteDiscoveryApiKey(
 }
 
 export async function resolveDiscoveryRequestOptions<
-  T extends {
-    apiKey?: string
-    cacheKey?: string
-    baseUrl?: string
-    headers?: Record<string, string>
-  },
+  T extends { apiKey?: string; cacheKey?: string; baseUrl?: string; headers?: Record<string, string> },
 >(
   routeId: string,
   options?: T,
@@ -223,11 +226,17 @@ export async function resolveDiscoveryRequestOptions<
   if (getRouteDiscoveryApiKey(routeId, next) || routeId !== 'xai') {
     return next
   }
-
-  if (!isCanonicalXaiInferenceBaseUrl(getRouteBaseUrl(routeId, next))) {
+  const baseUrl = getRouteBaseUrl(routeId, next)
+  // Route identity selects a catalog, but it must never authorize sending a
+  // stored OAuth credential to an overridden endpoint. The xAI OAuth token is
+  // valid only for xAI's API host.
+  if (!isCanonicalXaiInferenceBaseUrl(baseUrl)) {
     return next
   }
-
+  // Cache lookup uses the currently stored credential identity.
+  // Refresh only when a network discovery request is actually necessary: a
+  // refresh rotates the token and would otherwise turn a fresh cache entry
+  // into an avoidable miss.
   let credentials = await readXaiCredentialsAsync()
   const cacheOnly =
     shouldSkipNonessentialDiscoveryTraffic() ||
@@ -236,14 +245,12 @@ export async function resolveDiscoveryRequestOptions<
     cacheOnly ? credentials?.accessToken : await resolveXaiAccessToken(),
   )
   if (!cacheOnly) {
-    // A refresh can rotate the refresh token. Re-read the persisted blob so
-    // discovery writes under the same stable identity subsequent readers use.
     credentials = (await readXaiCredentialsAsync()) ?? credentials
   }
   if (token) {
     next.apiKey = token
-    // The access token can rotate while the OAuth account does not. Keep the
-    // cache partition tied to a stable account identity, not a bearer token.
+    // Access tokens rotate, while refresh tokens and account IDs identify the
+    // same OAuth account. Keep cache partitions stable across token refreshes.
     next.cacheKey = getXaiDiscoveryCacheIdentity(credentials) ?? token
   }
   return next
@@ -418,9 +425,6 @@ export async function discoverModelsForRoute(
   }
 
   const ttlMs = getDiscoveryCacheTtlMs(routeId)
-  // Cache-only reads must not refresh an OAuth token: discovery can be
-  // disabled by privacy policy, and a refresh can rotate the bearer before a
-  // fresh cached result is checked.
   const cachedOptions = await resolveDiscoveryRequestOptions(routeId, options, {
     refreshXaiOAuth: false,
   })

src/integrations/routeMetadata.test.ts

@@ -91,6 +91,16 @@ test('isLongcatBaseUrl requires the documented HTTPS OpenAI API path', () => {
   expect(isLongcatBaseUrl('https://api.longcat.chat.evil.test/openai/v1')).toBe(false)
 })
 
+test('resolveActiveRouteIdFromEnv retains xAI identity for a retargeted proxy URL', () => {
+  expect(
+    resolveActiveRouteIdFromEnv({
+      CLAUDE_CODE_USE_OPENAI: '1',
+      OPENAI_BASE_URL: 'https://proxy.example/v1',
+      CLAUDE_CODE_PROVIDER_ROUTE_ID: 'xai',
+    }),
+  ).toBe('xai')
+})
+
 test('resolveActiveRouteIdFromEnv keeps generic OpenAI credentials ahead of env-only LongCat', () => {
   expect(resolveActiveRouteIdFromEnv({
     OPENAI_API_KEY: 'generic-key',

src/integrations/routeMetadata.ts

@@ -276,11 +276,20 @@ export function isXaiBaseUrl(value: string | undefined): boolean {
   }
 }
 
+/**
+ * xAI-specific credentials may only be sent to the documented HTTPS API
+ * origin. Route identity is intentionally more permissive because profiles
+ * can be retargeted, but a retargeted route must not carry a xAI credential.
+ */
 export function isCanonicalXaiInferenceBaseUrl(value: string | undefined): boolean {
   if (!value?.trim()) return true
   try {
-    const parsed = new URL(value)
-    return parsed.protocol === 'https:' && parsed.hostname.toLowerCase() === 'api.x.ai'
+    const url = new URL(value)
+    return (
+      url.protocol === 'https:' &&
+      url.hostname.toLowerCase() === 'api.x.ai' &&
+      (url.port === '' || url.port === '443')
+    )
   } catch {
     return false
   }
@@ -1023,6 +1032,14 @@ export function resolveRouteCredentialValue(
     return undefined
   }
 
+  if (
+    routeId === 'xai' &&
+    options?.baseUrl !== undefined &&
+    !isCanonicalXaiInferenceBaseUrl(options.baseUrl)
+  ) {
+    return undefined
+  }
+
   return getRouteCredentialValue(routeId, processEnv)
 }
 
@@ -1242,6 +1259,17 @@ export function resolveActiveRouteIdFromEnv(
       return matchedRoute
     }
 
+    const retainedRouteId = processEnv.CLAUDE_CODE_PROVIDER_ROUTE_ID?.trim()
+    // Only xAI needs this env stamp to survive a proxy URL. ApiSmart's
+    // dedicated key never rides OPENAI_API_KEY after persist/relaunch, and
+    // it has no OAuth injector keyed off route id. xAI still must keep
+    // identity so OAuth stays off the proxy and XAI_API_KEY values can be
+    // filtered from generic pools. Host matching already returned above
+    // when the URL is canonical.
+    if (retainedRouteId === 'xai') {
+      return 'xai'
+    }
+
     if (options?.activeProfileProvider) {
       const route = resolveProfileRoute(options.activeProfileProvider)
       if (