openclaw - 💡(How to fix) Fix xAI OAuth: refresh token stored but not used for auto-renewal (manual re-auth required every ~6h)

Summary

OpenClaw stores both access and refresh tokens for xAI OAuth authentication, but does not silently auto-renew the access token when it expires. This requires a full OAuth re-authentication (browser + SSH tunnel) every ~6 hours.

Environment

• OpenClaw version: 2026.5.22 (a374c3a)
• OS: Linux VPS (headless, no GUI)
• Provider: xai
• Auth method: OAuth (openclaw models auth login --provider xai)
• Model: xai/grok-4.3 (SuperGrok subscription)

Steps to Reproduce

1. Run openclaw models auth login --provider xai with SSH tunnel (-L 56121:127.0.0.1:56121)
2. Complete OAuth flow in browser; auth profile is saved successfully
3. Wait ~6 hours (access token expiry window)
4. Attempt to use any xAI/Grok model
5. Request fails; openclaw models auth list shows token expiry warning

Expected Behavior

OpenClaw silently refreshes the access token using the stored refresh token, with no user interaction required — similar to how other OAuth providers (e.g., Google Meet, Chutes) work.

Actual Behavior

No auto-refresh occurs. Full OAuth re-authentication required:

• Run openclaw models auth login --provider xai on VPS
• Open SSH tunnel from local machine: ssh -N -L 56121:127.0.0.1:56121 <vps>
• Complete browser OAuth flow again

This is especially disruptive on a headless server where xAI/Grok is used in scheduled/automated workflows (cron jobs, sub-agents).

Additional Context

• The refresh token is present in ~/.openclaw/agents/main/agent/auth-profiles.json
• Access token lifetime is ~6 hours
• The xAI OAuth provider doc (plugins/reference/xai.md) does not document a cacheTtlMinutes or refresh config
• Using a static API key from console.x.ai is not viable for SuperGrok subscribers (subscription vs. pay-per-token)
• Workaround via cron to manually call the refresh endpoint + edit auth-profiles.json is fragile

Request

Please implement silent OAuth token refresh for the xAI provider using the stored refresh token, consistent with the behavior already present for other OAuth providers (e.g., Google Meet, Chutes).