feat: add xai-proxy — OAuth PKCE sidecar for xAI SuperGrok

[chaodu-agent]

Summary

Adds xai-proxy, a lightweight Rust single-binary sidecar that:

1. Authenticates with xAI via browser OAuth PKCE or device-code flow
2. Proxies OpenAI-compatible requests to api.x.ai/v1 with the OAuth token injected
3. Auto-refreshes tokens before expiry

This allows any OpenAI-compatible coding agent (OpenCode, Hermes, etc.) to use SuperGrok subscription quota instead of per-token API credits.

Architecture

┌─────────────────────────────────────────────────────────────────────┐
│ Kubernetes Pod                                                      │
│                                                                     │
│  ┌──────────┐    ┌───────────────────────────────┐                  │
│  │  openab  │───►│  opencode acp                 │                  │
│  │          │◄───│  (model: xai/grok-4.3)        │                  │
│  └──────────┘    └───────────┬───────────────────┘                  │
│                              │ POST /v1/chat/completions            │
│                              │ (no auth header)                     │
│                              ▼                                      │
│                  ┌───────────────────────────────┐                  │
│                  │  xai-proxy  :9090             │                  │
│                  │                               │                  │
│                  │  1. Read OAuth token from PVC │                  │
│                  │  2. Inject Authorization hdr  │                  │
│                  │  3. Auto-refresh before expiry│                  │
│                  └───────────┬───────────────────┘                  │
│                              │                                      │
│  PVC (/home/agent)           │                                      │
│    └─ .openab/xai-proxy/     │                                      │
│         tokens.json          │                                      │
└──────────────────────────────┼──────────────────────────────────────┘
                               │ POST https://api.x.ai/v1/chat/completions
                               │ Authorization: Bearer <oauth_token>
                               ▼
                  ┌───────────────────────────────┐
                  │  api.x.ai/v1                  │
                  │  (SuperGrok subscription)     │
                  └───────────────────────────────┘

Usage

# Login (one-time)
xai-proxy login          # browser OAuth PKCE
xai-proxy login-device   # headless/K8s/ECS (device-code flow)

# Start proxy
xai-proxy serve --port 9090

# Custom token path (for K8s PVC persistence)
XAI_PROXY_TOKEN_PATH=/home/agent/.openab/xai-proxy/tokens.json xai-proxy serve

What was tested

• cargo build --release passes on Rust 1.86+
• OAuth device-code flow tested end-to-end
• Deployed as sidecar on OrbStack K8s with opencode acp backend — confirmed Grok 4.3 responses via SuperGrok

Notes

• Client ID is Grok CLI's public OAuth client (same as Hermes Agent, officially supported by xAI)
• Scope: openid profile email offline_access grok-cli:access api:access
• Token stored at ~/.xai-proxy/tokens.json (chmod 600) or custom path via XAI_PROXY_TOKEN_PATH
• Requires rustls crypto provider (ring) — installed automatically at startup

Thread: 1505301662309552260

[github-actions]

⚠️ This PR is missing a Discord Discussion URL in the body.

All PRs must reference a prior Discord discussion to ensure community alignment before implementation.

Please edit the PR description to include a link like:

Discord Discussion URL: https://discord.com/channels/...

This PR will be automatically closed in 3 days if the link is not added.