xAI OAuth: concurrent opencode processes revoke each other's refresh token #37059

Description

With xAI SuperGrok OAuth, running multiple opencode processes (or opencode + Grok CLI sharing the same OAuth client) races on the stored refresh token.

xAI rotates refresh tokens. Process A refreshes successfully and invalidates the old token; process B still holds the old refresh value and gets:

xAI token refresh failed (400): {"error":"invalid_grant","error_description":"Refresh token has been revoked"}

In-process single-flight already exists in packages/opencode/src/plugin/xai.ts, but there is no cross-process coordination on auth.json. The code even comments this as a known cross-process limitation.

Plugins

None required (built-in xAI OAuth).

OpenCode version

1.18.1

Steps to reproduce

1. /connect xAI Grok OAuth (SuperGrok).
2. Start several opencode processes against the same machine/user home (shared ~/.local/share/opencode/auth.json).
3. Wait until the access token is near expiry (~6h, or force by advancing system time / waiting for skew window).
4. Trigger LLM calls in more than one process around the same time.
5. Observe invalid_grant / "Refresh token has been revoked" in one or more sessions.

Screenshot and/or share link

Log excerpt:

level=ERROR message="stream error" providerID=xai modelID=grok-4.5
error="xAI token refresh failed (400): {\"error\":\"invalid_grant\",\"error_description\":\"Refresh token has been revoked\"}"

Operating System

Linux (Ubuntu, x86_64)

Terminal

CLI / multiple concurrent sessions