fix(grok): Refresh expired CLI tokens

[euxaristia]

Summary

Refresh expired Grok CLI OAuth tokens automatically so Grok remains visible in limits without manually launching the interactive CLI. The previous probes were static or unsupported and could not refresh authentication.

Fixes #22

Changes

pkg/credentials/credentials.go

• Replace the static version check and invalid auth command with the authenticated grok models probe.
• Continue through refresh candidates until a valid token is available.

pkg/credentials/credentials_test.go

• Verify Grok uses the authenticated models probe.

Test plan

• gofmt -w pkg/credentials/credentials.go pkg/credentials/credentials_test.go
• go test ./...
• go vet ./...
• go build ./...
• Run grok models and verify it reports the authenticated account and available models.

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 23 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: d9c764a2-7661-48b2-b21f-238b5fb876da

📥 Commits

Reviewing files that changed from the base of the PR and between 2f49ff7 and 150462c.

📒 Files selected for processing (2)

• pkg/credentials/credentials.go
• pkg/credentials/credentials_test.go

📝 Walkthrough

Walkthrough

The Grok credential flow now probes authentication with grok models. The headless refresh flow checks token validity after each CLI candidate and continues until it finds a usable token.

Changes

Grok token refresh

Layer / File(s)	Summary
Authenticated Grok probe pkg/credentials/credentials.go, pkg/credentials/credentials_test.go	Grok now uses one grok models candidate. A test verifies the candidate command.
Candidate token validation pkg/credentials/credentials.go	The refresh flow checks token validity after each CLI attempt and tries the next candidate when the token remains unusable.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• euxaristia/limits#14: Both changes use authenticated models commands for CLI credential probing and token refresh.

Poem

A rabbit checked the token trail,
grok models passed the auth detail.
If one attempt fails,
The next path prevails,
And fresh credentials fill the pail. 🐇

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the Grok CLI token refresh fix, which matches the main change.
Description check	✅ Passed	The description explains the Grok token refresh problem, implementation changes, tests, and expected behaviour.
Linked Issues check	✅ Passed	The changes replace invalid probes with authenticated grok models execution and continue until a valid refreshed token is detected, meeting issue #22.
Out of Scope Changes check	✅ Passed	The changes are limited to Grok credential probing, token refresh handling, and focused test coverage required by issue #22.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

---

_{Comment @coderabbitai help to get the list of available commands.}

[euxaristia]

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.

[euxaristia]

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.

[coderabbitai]

🧹 Nitpick comments (1)

pkg/credentials/credentials.go (1)

654-656: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win

Add a regression test for candidate validation.

The new loop is the core token-refresh change. The added test verifies only the candidate list. It does not verify that the code checks IsTokenWorking after each candidate, continues after an unusable token, or stops after a valid token.

Add a unit or integration test with two candidates and controlled CLI and token results.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/credentials/credentials.go` around lines 654 - 656, Add a regression test
covering the candidate-validation loop around IsTokenWorking in the token
refresh flow: configure two candidates with controlled CLI/token results so the
first is unusable and the second is valid, then assert both are checked,
processing continues after the first failure, and the loop stops successfully
after the valid candidate.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@pkg/credentials/credentials.go`:
- Around line 654-656: Add a regression test covering the candidate-validation
loop around IsTokenWorking in the token refresh flow: configure two candidates
with controlled CLI/token results so the first is unusable and the second is
valid, then assert both are checked, processing continues after the first
failure, and the loop stops successfully after the valid candidate.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: eebaa660-7029-4ce2-a6ad-2186e911cdd3

📥 Commits

Reviewing files that changed from the base of the PR and between 2f49ff7 and ca29158.

📒 Files selected for processing (2)

• pkg/credentials/credentials.go
• pkg/credentials/credentials_test.go

[euxaristia]

@coderabbitai full review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

---

Your included review limit is currently reached under our Fair Usage Limits Policy. Your recent PR review activity is in the 95th percentile or higher among CodeRabbit users, so adaptive limits apply. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 16 minutes.

[euxaristia]

Addressed the review feedback in 150462c:

• Added TestForceRefreshViaCliHeadlessCandidateValidation, which builds a fake claude executable that models both candidates: the first (auth status) runs but leaves the token expired, the second (--version) writes a fresh token. The test asserts the loop re-checks IsTokenWorking after each candidate, continues past the unusable one, stops after the valid one, and records the invocation order via a call log.

Local verification: go vet ./... and go test ./... pass. The CI jobs on this PR did not run: GitHub Actions reports "The job was not started because recent account payments have failed or your spending limit needs to be increased."

[euxaristia]

@coderabbitai full review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

---

Your included review limit is currently reached under our Fair Usage Limits Policy. Your recent PR review activity is in the 95th percentile or higher among CodeRabbit users, so adaptive limits apply. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 23 minutes.