[apoapostolov]

Summary

Adds a bespoke QuotaFetcher for the grok-web provider (grok.com SSO/cookie connections). Surfaces the weekly credit-usage percentage from xAI billing in Health → Limits & Quotas, and enables quota-aware preflight switching between grok-web connections.

Closes #6444.

Implementation

New file: open-sse/services/grokQuotaFetcher.ts

Uses the same billing API already proven in production by pi-grok-usage and hermes-grok-usage:

Endpoint: GET https://cli-chat-proxy.grok.com/v1/billing?format=credits

Auth: OIDC tokens from ~/.grok/auth.json (local Grok CLI login from grok login), with automatic refresh via auth.x.ai/.well-known/openid-configuration → token endpoint.

Response mapped to QuotaInfo:

• Single weekly window with percentUsed = creditUsagePercent / 100
• resetAt from currentPeriod.end (ISO timestamp)
• Product-level breakdown, on-demand/prepaid balances available via UsageSnapshot (not exposed in preflight but parseable)

Key design decisions:

• Reads auth from local CLI (not connection accessToken) because grok-web uses SSO cookies but the billing endpoint requires Bearer tokens — both represent the same xAI account
• 60s cache TTL matching codexQuotaFetcher
• GROK_AUTH_PATH env var override for testing
• Fail-open: returns null without blocking requests when no local auth exists

Modified: src/sse/handlers/chat.ts

Imports registerGrokWebQuotaFetcher and calls it before registerGenericQuotaFetchers() so the bespoke fetcher takes precedence over the generic path (which can't resolve grok OIDC auth from cookie-based connections).

New test file: tests/unit/grok-quota-fetcher.test.ts

5 tests covering:

1. Missing auth → returns null
2. Successful fetch with header verification (Authorization, x-grok-client-mode)
3. 401-triggered token refresh with retry
4. 60s cache TTL
5. Preflight integration via registerGrokWebQuotaFetcher()

Future Work

• SuperGrok / X Premium+ OAuth (xai-oauth provider): Once that provider exists, it can reuse the same billing endpoint with its own OIDC token path. The getGrokBilling() core logic is separated from the auth resolution so it can be imported by a future grok-cli fetcher.
• grok-web cookie-to-token path: If grokTlsClient.ts cookies can be exchanged for an OIDC token that hits the same billing endpoint, the fetcher can be extended to extract tokens from the cookie connection itself (no CLI dependency). Currently the dependency on ~/.grok/auth.json is documented in the file header.

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[diegosouzapw]

Thanks, @apoapostolov! 🙏 Merged — weekly quota tracking for grok-web SSO. Rebased onto the current release tip, rebaselined chat.ts (own-growth). grok-quota-fetcher tests green.