Skip to content

docs: recommend native xAI OAuth, move xai-proxy to refarch#884

Closed
chaodu-agent wants to merge 2 commits into
mainfrom
docs/native-xai-oauth
Closed

docs: recommend native xAI OAuth, move xai-proxy to refarch#884
chaodu-agent wants to merge 2 commits into
mainfrom
docs/native-xai-oauth

Conversation

@chaodu-agent
Copy link
Copy Markdown
Collaborator

@chaodu-agent chaodu-agent commented May 21, 2026

Summary

OpenCode ≥1.15.0 now has native xAI OAuth (browser + device-code flow), making the xai-proxy sidecar no longer required for OpenCode deployments.

Changes

  • docs/refarch/sidecar-proxy.md — New reference architecture doc explaining the xai-proxy sidecar pattern (for agents without native OAuth)
  • docs/xai-proxy.md — Rewritten to recommend native OAuth as the primary approach; xai-proxy documented as legacy/alternative with link to refarch
  • Dockerfile.opencode — Bumped from opencode-ai@1.14.31 → 1.15.6 (includes native xAI OAuth support)

What was tested

  • Verified opencode-ai@1.15.6 is the latest published version on npm
  • Confirmed OpenCode docs list native xAI OAuth (browser + device-code) as supported auth method

Notes

  • xai-proxy sidecar remains available for non-OpenCode agents (Hermes, custom) or multi-container token sharing
  • No code changes to xai-proxy itself

docs: recommend native xAI OAuth, move xai-proxy to refarch
a388dec 
- Add docs/refarch/sidecar-proxy.md explaining the xai-proxy sidecar
  architecture for agents without native OAuth support
- Rewrite docs/xai-proxy.md to recommend OpenCode's built-in xAI OAuth
  (device-code + browser) as the primary approach
- Bump Dockerfile.opencode from opencode-ai@1.14.31 to 1.15.6 (includes
  native xAI OAuth support)
@chaodu-agent chaodu-agent requested a review from thepagent as a code owner May 21, 2026 11:26
@github-actions github-actions Bot added pending-screening closing-soon PR missing Discord Discussion URL — will auto-close in 3 days labels May 21, 2026
@github-actions
Copy link
Copy Markdown

github-actions Bot commented May 21, 2026

⚠️ This PR is missing a Discord Discussion URL in the body.

All PRs must reference a prior Discord discussion to ensure community alignment before implementation.

Please edit the PR description to include a link like:

Discord Discussion URL: https://discord.com/channels/...

This PR will be automatically closed in 3 days if the link is not added.

@chaodu-agent chaodu-agent requested review from a team and pahud May 21, 2026 11:32
@shaun-agent
Copy link
Copy Markdown
Contributor

shaun-agent commented May 21, 2026 •
edited
Loading

OpenAB PR Screening

This is auto-generated by the OpenAB project-screening flow for context collection and reviewer handoff.
Click 👍 if you find this useful. Human review will be done within 24 hours. We appreciate your support and contribution 🙏

Screening report screening complete.

comment: #884 (comment)
project action: moved item PVTI_lADOEFbZWM4BUUALzgtaf14 in openabdev/1 from Incoming to PR-Screening

Intent

PR #884 updates OpenAB xAI/OpenCode deployment guidance now that OpenCode 1.15.x supports native xAI OAuth. The operator-visible problem is that current docs still imply the xai-proxy sidecar is the normal path for OpenCode, adding avoidable deployment complexity.

Feat

Docs/release-work with one deployment image bump. It rewrites docs/xai-proxy.md, adds docs/refarch/sidecar-proxy.md, and bumps Dockerfile.opencode from opencode-ai@1.14.31 to 1.15.6.

Who It Serves

Primary beneficiary: deployers. Secondary: maintainers and agent runtime operators.

Rewritten Prompt

Update OpenAB documentation and the OpenCode image so xAI auth guidance matches OpenCode 1.15.x. Make native xAI OAuth the recommended path for OpenCode deployments, preserve xai-proxy as a legacy/alternative reference architecture, and validate the docs explain when to use native OAuth versus proxy auth.

Merge Pitch

Low code risk, but the Dockerfile bump is runtime-sensitive. Reviewers should verify opencode-ai@1.15.6, non-interactive/container auth expectations, and whether existing xai-proxy users still have a clear path.

Best-Practice Comparison

OpenClaw and Hermes scheduling patterns mostly do not apply. This is auth documentation and a package bump, not scheduling, persistence, delivery routing, retries, daemon ticks, locking, or run logs.

Implementation Options

  1. Conservative: docs only, split Dockerfile bump.
  2. Balanced: docs plus pinned image bump with reviewer verification.
  3. Ambitious: migration guide plus release note.

Comparison Table

Option Speed Complexity Reliability Maintainability User Impact Fit
Conservative High Low High Medium Medium Good if decoupling runtime changes
Balanced Medium Medium Medium High High Best fit if verified
Ambitious Low Medium-High High High High Better as follow-up

Recommendation

Use the balanced path. Keep the PR together if Masami or Pahud can verify the OpenCode 1.15.6 native xAI OAuth claim and container auth notes. Otherwise split the Dockerfile bump and merge docs first.

@chaodu-agent
Copy link
Copy Markdown
Collaborator Author

chaodu-agent commented May 21, 2026

Superseded by #891 which renames xai-proxy → openab-auth-proxy and makes it provider-generic. The docs changes from this PR are incorporated there.

@chaodu-agent chaodu-agent mentioned this pull request May 21, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@thepagent thepagent Awaiting requested review from thepagent thepagent is a code owner

@pahud pahud Awaiting requested review from pahud

Assignees

No one assigned

Labels

closing-soon PR missing Discord Discussion URL — will auto-close in 3 days

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@chaodu-agent @shaun-agent @thepagent