Remove shims

CONFIGURATION.md

@@ -15,3 +15,7 @@ Most users do not need these overrides. Only point base URL overrides at endpoin
 | `PI_GROK_CLI_IMAGINE_MODEL` | `grok-imagine-image-quality` | Override the Imagine image model. |
 
 OAuth logins store the effective main API base URL in each account's credentials. Changing or removing `PI_GROK_CLI_BASE_URL` or `GROK_CLI_BASE_URL` does not immediately redirect an already authenticated account; its stored URL remains active until token refresh or re-login. Log in again to apply the change immediately.
+
+Real account credentials are in `~/.pi/grok-cli/accounts.json`. The file uses mode `0600`, and updates use an interprocess lock and an atomic replacement. Pi's own credential store contains only the fixed non-secret marker that connects the `grok-cli` provider.
+
+When `GROK_CLI_OAUTH_TOKEN` is set, it overrides the saved account for requests. Account login is not available until you remove the variable and restart pi. If you use native `/logout` while this variable is set, restart pi so the extension can register the correct login method.

README.md

@@ -16,8 +16,7 @@ Use your X Premium or SuperGrok subscription in [pi](https://pi.dev/) with a cle
 - **Multiple accounts:** Manage accounts and quotas from the terminal or browser dashboard, and automatically continue with another account when quota runs out.
 - **Usage tracking:** Check account limits, remaining credits, and reset times.
 - **Image generation:** Generate images directly or let Grok use the `image_gen` tool.
-- **Vision routing:** Let text-only models understand images through a vision-capable Grok model.
-- **Model-specific tools:** Use Cursor-compatible tool names only where Grok Build and Composer 2.5 need them.
+- **Native image input:** Send images directly to supported Grok models, including Composer 2.5.
 
 > Requires pi 0.80.9 or newer and an xAI/Grok account with access to the selected model. Availability varies by account, plan, region, and xAI rollout. The Grok Build executable is not required.
 >
@@ -53,7 +52,7 @@ Choose **Grok CLI**, then select one of these methods:
 /model grok-cli/grok-composer-2.5-fast
 ```
 
-Composer 2.5 is the recommended starting point for agentic coding. Choose an image-capable model when native image input matters.
+Composer 2.5 is the recommended starting point for agentic coding and supports native image input.
 
 ### 4. Verify account usage
 
@@ -73,12 +72,18 @@ Open the browser dashboard to view accounts and quotas in one place:
 
 Select **Add account** to optionally label the account and start browser login.
 
-Prefer the terminal? Run `/grok-cli-accounts`, choose **＋ Add account**, and press Enter when the login command appears. Device-code login remains available there for headless environments.
+Prefer the terminal? Run `/grok-cli-accounts`, choose **＋ Add account**, and complete the browser or device-code login.
 
 With at least two logged-in accounts, pi-grok-cli can continue an interrupted request with another account when the current account runs out of quota. Recently exhausted accounts are temporarily skipped, and rotation stops when no eligible account remains.
 
 Only add accounts you own or are authorized to access.
 
+Pi shows one **Grok CLI** entry in `/login` and one `grok-cli` provider in `/model`. It does not add provider names such as `grok-cli-2`.
+
+Account selection is per session. The dashboard or `/grok-cli-accounts` sets the account for the current session, and the choice is stored in the session log so it is restored when the session is resumed or reopened. New sessions start with the most recently selected account and keep their own selection once changed. Requests always use the token captured at request start.
+
+Pi and pi-grok-cli keep separate login state. Native `/logout` removes Pi's non-secret connection marker. It does not delete accounts from the dashboard. Run `/login` and choose **Grok CLI** to reconnect the saved accounts. To delete a saved account, use `/grok-cli-accounts`. Account 1 is permanent, but you can log it out.
+
 ## Manage installation
 
 ```bash
@@ -90,47 +95,21 @@ pi remove npm:pi-grok-cli
 
 Models are bundled rather than discovered live. Registered context limits may differ from the limits xAI enforces.
 
-| Model ID | Registered context | Reasoning | Input | Coding tools |
-| --- | ---: | --- | --- | --- |
-| `grok-composer-2.5-fast` | 200K | no | text; vision routing available | Cursor-compatible names |
-| `grok-build` | 500K | yes | text + image | Cursor-compatible names |
-| `grok-4.3` | 1M | yes | text + image | native pi names |
-| `grok-4.5` | 500K | yes | text + image | native pi names |
-| `grok-4.20-0309-reasoning` | 2M | yes | text + image | native pi names |
-| `grok-4.20-0309-non-reasoning` | 2M | no | text + image | native pi names |
-| `grok-4.20-multi-agent-0309` | 2M | yes | text + image | native pi names |
-
-## Coding tools and media
-
-### Coding tool compatibility
-
-Grok Build and Composer 2.5 use Cursor-compatible tool names. All other models and providers use pi's native tools.
-
-| Compatibility tools | Implementation |
-| --- | --- |
-| `Read`, `Write`, `Edit`, `Grep`, `LS`, `Shell` | Delegate execution and rendering to pi's native tools. |
-| `StrReplace` | Preserves Cursor's literal replace-all behavior. |
-| `Glob` | Preserves Cursor's newest-first path ordering. |
-| `Delete` | Provides the file-deletion operation expected by these models. |
-| `WebSearch` | Optionally replaces an active `web_search` tool when pi-web-access is installed. |
-
-pi applies `--tools` and `--exclude-tools` by exact name. For compatible models, use names such as `--tools Read,Grep` or `--exclude-tools Grep`. `--no-tools` disables all tools.
+| Model ID | Registered context | Reasoning | Input |
+| --- | ---: | --- | --- |
+| `grok-composer-2.5-fast` | 200K | no | text + image |
+| `grok-build` | 500K | yes | text + image |
+| `grok-4.3` | 1M | yes | text + image |
+| `grok-4.5` | 500K | yes | text + image |
+| `grok-4.20-0309-reasoning` | 2M | yes | text + image |
+| `grok-4.20-0309-non-reasoning` | 2M | no | text + image |
+| `grok-4.20-multi-agent-0309` | 2M | yes | text + image |
 
-Install pi-web-access 0.13.0 or newer to add optional `WebSearch` support:
-
-```bash
-pi install npm:pi-web-access@^0.13.0
-```
-
-Restart pi or run `/reload` after installing it in an existing session. Other models and providers retain the native `web_search` tool.
-
-### Vision routing for text-only models
-
-When a text-only model reads an image, pi-grok-cli describes it with an image-capable Grok model (`grok-build` by default) and passes back the description. Routing is enabled by default for up to four images, caches descriptions locally, and is bypassed for models that support images natively.
+## Media
 
 ### Grok Imagine image generation
 
-Run `/grok-cli-imagine <prompt>` to generate and preview a JPEG, or let any active model call the `image_gen` tool. Images use the current or most recently selected Grok account and are saved under the current session unless you request another path.
+Run `/grok-cli-imagine <prompt>` to generate and preview a JPEG, or let any active model call the `image_gen` tool. Images use the current session's selected Grok account and are saved under the current session unless you request another path.
 
 `image_gen` is enabled by default across providers. Use `/grok-cli-imagine:tool [on|off|status]` to manage model access without disabling the direct command.
 
@@ -142,22 +121,24 @@ Run `/grok-cli-imagine <prompt>` to generate and preview a JPEG, or let any acti
 | `/grok-cli-usage` | Fetch current quota, update its cache, and show cached data if refresh fails. |
 | `/grok-cli-imagine <prompt>` | Generate and preview an image. Supports `--aspect`, `--out`, and `--resolution 1k`. |
 | `/grok-cli-imagine:tool [on\|off\|status]` | Toggle, set, or report persistent model-callable `image_gen` availability. |
-| `/grok-cli-vision` | Toggle vision routing on or off. |
-| `/grok-cli-vision:status` | Show vision state, describer model, configuration path, and cache statistics. |
-| `/grok-cli-vision:cache-clear` | Remove all cached image descriptions. |
 
 ## Configuration
 
 Extension-owned data is grouped under `~/.pi/grok-cli/`:
 
 ```text
 ~/.pi/grok-cli/
+├── accounts.json
 ├── config.json
-├── vision-cache.json
+├── config.v2.backup.json
 └── quota-cache.json
 ```
 
-`config.json` stores settings and account labels. The cache files store derived vision descriptions and quota responses. None contain OAuth tokens; pi stores credentials separately. Legacy settings are migrated automatically.
+`accounts.json` stores account labels and OAuth credentials. It uses file mode `0600`. `config.json` stores non-account settings. `quota-cache.json` stores quota responses. `config.v2.backup.json` is an exact backup that is created only when the extension migrates an older multi-account configuration. Pi stores only a fixed, non-secret marker for the `grok-cli` provider.
+
+When you update from a release that used `grok-cli-N` providers, the extension copies known OAuth credentials to `accounts.json` and rewrites global and project model settings to `grok-cli`. Run `/login` once and choose **Grok CLI** to install Pi's marker. The old alias credentials can remain in Pi's `/logout` list. Remove those old alias entries after you confirm that the new accounts work. Do not remove the main `Grok CLI` entry unless you want to disconnect it.
+
+The extension does not replace saved session files because Pi can append to them from another process without a shared file lock. This prevents session data loss. When you resume an old session that selected `grok-cli-N`, Pi can show a model fallback warning. Select the required `grok-cli/<model>` once in that session.
 
 ### Common environment variables
 
@@ -179,11 +160,12 @@ See [Advanced configuration](./CONFIGURATION.md) for OAuth, callback, endpoint,
 | Authentication returns HTTP 401 or 403 | Run `/login` again and confirm the account can access the selected model. Replace an expired `GROK_CLI_OAUTH_TOKEN` if using an external token. |
 | A listed model is unavailable | Availability can differ by account or region, and the catalog is bundled rather than discovered live. Try another model or update the extension. |
 | Account rotation does not start | Confirm at least two accounts are logged in. Rotation responds only to Grok Build's final balance-exhausted error, not authentication failures, rate limits, or similar messages. |
-| Images are not being described | Run `/grok-cli-vision:status`, confirm routing is on, and verify Grok authentication. Native image-capable models bypass routing by design. |
+| A migrated account cannot send requests | Run `/login` once, choose **Grok CLI**, and restart pi if the model list does not update. |
+| The dashboard says Pi is disconnected | Run `/login` and choose **Grok CLI**. Saved dashboard accounts remain available. |
 
 ## Security and data flow
 
-Enabled tools run with your system permissions and can modify files or execute commands. Prompts, model context, tool data, and routed images are sent to the configured xAI endpoints.
+Enabled tools run with your system permissions and can modify files or execute commands. Prompts, model context, tool data, and native image inputs are sent to the configured xAI endpoints.
 
 See [SECURITY.md](./SECURITY.md) for trust boundaries and private vulnerability reporting. Never include tokens, authorization codes, callback URLs, prompts, or private project data in public issues.
 

SECURITY.md

@@ -18,15 +18,13 @@ The maintainer aims to acknowledge a complete report within 7 calendar days and
 
 ## Security boundaries
 
-- pi-grok-cli and its tools run with the user's operating-system permissions. File and shell tools can access any path those permissions allow, including paths outside the workspace, and can execute commands when the model invokes them.
+- pi-grok-cli runs with the user's operating-system permissions. Image generation can write to session storage, temporary storage, or a user-requested output path.
 - OAuth credentials returned by this extension are stored and refreshed by pi. pi-grok-cli does not read or modify Grok Build credentials.
 - Browser OAuth starts a temporary callback server on `127.0.0.1:56122` by default and falls back to an ephemeral port. `PI_GROK_CLI_CALLBACK_HOST` can bind it to another interface. The server validates the callback path and OAuth state and closes after login. Treat complete callback URLs and authorization codes as sensitive.
 - `/grok-cli-accounts gui` starts a temporary account-management server bound only to an OS-assigned `127.0.0.1` port. A random capability URL bootstraps a session cookie; subsequent mutations require same-origin and CSRF validation. The page receives account labels, status, and quota data. It never receives stored OAuth credentials, callback URLs, or environment-token values; a manually entered one-time authorization code is handled transiently during login and is never returned by `/api/state`. Treat the private dashboard URL as sensitive and do not share it while the server is running.
 - Prompts, conversation context, tool definitions, tool results, and native image inputs are sent to the configured Grok CLI proxy.
-- Images handled by vision routing are sent to the configured describer model. The local vision cache stores descriptions and hashes, not raw images.
 - Grok Imagine sends the selected account's bearer token, generation prompt, and options to `https://api.x.ai/v1` or `PI_GROK_CLI_IMAGINE_BASE_URL`. Generated JPEGs and PNG previews are saved under session storage, a requested output path, or temporary storage.
 - Monthly and weekly quota totals and reset timestamps are cached per account in `~/.pi/grok-cli/quota-cache.json` with file mode `0600`. The cache does not contain OAuth tokens.
-- Optional web search is delegated to `pi-web-access` and the providers configured there.
 - A configured main API base URL override is trusted with bearer tokens, prompts, conversation data, tool results, images, and billing queries. An Imagine base URL override is trusted with the bearer token and generation request described above.
 
 Expected provider behavior, account-specific model availability, subscription quotas, model-generated content, a model choosing an enabled local tool, and changes made after a user deliberately configures an untrusted endpoint are generally out of scope unless pi-grok-cli violates a documented boundary or exposes data beyond that configuration.

knip.json

@@ -1,5 +1,5 @@
 {
   "entry": ["src/shared/backup_worker.ts"],
   "project": ["**/*.ts", "!**/*.d.ts", "!.release-tools/**"],
-  "ignoreDependencies": ["ignore", "lint-staged", "minimatch"]
+  "ignoreDependencies": ["lint-staged"]
 }

package.json

@@ -10,7 +10,6 @@
     "grok-cli",
     "oauth",
     "xai-oauth",
-    "vision",
     "multimodal"
   ],
   "type": "module",
@@ -56,13 +55,7 @@
   "peerDependencies": {
     "@earendil-works/pi-ai": ">=0.80.9",
     "@earendil-works/pi-coding-agent": ">=0.80.9",
-    "@earendil-works/pi-tui": ">=0.80.9",
-    "pi-web-access": ">=0.13.0"
-  },
-  "peerDependenciesMeta": {
-    "pi-web-access": {
-      "optional": true
-    }
+    "@earendil-works/pi-tui": ">=0.80.9"
   },
   "devDependencies": {
     "@biomejs/biome": "2.4.16",
@@ -84,9 +77,5 @@
     "*": [
       "biome check --write --no-errors-on-unmatched"
     ]
-  },
-  "dependencies": {
-    "ignore": "7.0.5",
-    "minimatch": "10.2.5"
   }
 }