feat: add Grok SuperGrok paste and source picker - #3014
Merged
Conversation
Keep Auto-only remapping for selected SuperGrok accounts so CLI/web stay authoritative. Prefer GROK_OAUTH_TOKEN over a valid auth.json so a selected pasted bearer cannot display the local grok login account.
Project Cookie: token accounts into the Grok settings snapshot so Auto and Web fetches use the selected header instead of a configured or browser cookie.
Preserve the existing Grok Auto fallback: CLI, then browser cookies, then OAuth. Selected pasted bearers and explicit SuperGrok OAuth still use the OAuth path only.
Auto is CLI, then SuperGrok OAuth CLI-proxy, then browser cookies. A failed Auto proxy no longer falls through to bearer gRPC, so cookies still run next. Explicit SuperGrok OAuth keeps proxy-then-gRPC.
Auto is now CLI, SuperGrok OAuth CLI-proxy, browser cookies, then bearer gRPC. Explicit SuperGrok OAuth stays cookie-free proxy-then-gRPC.
# Conflicts: # CHANGELOG.md
Co-authored-by: Oleksiy Akimov <o.akimov@akimov-inc.com>
|
🦞👀 Pull request received. I will update this pull request when review starts. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2f888f8456
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
Comment on lines
+22
to
+24
| return GrokCredentialRouting.resolve( | ||
| tokenAccountToken: account.token, | ||
| manualCookieHeader: nil).sourceMode ?? base |
There was a problem hiding this comment.
When a selected token is deliberately rejected, such as an xai- management key, GrokCredentialRouting.resolve returns .none and this fallback retains .auto. The Auto pipeline can then fetch through the Grok CLI, auth.json, or configured browser cookies and publish that unrelated usage under the selected token account. A non-nil but unrecognized selected account should produce a credential error instead of falling back to other accounts.
Useful? React with 👍 / 👎.
clawsweeper
Bot
added
merge-risk: 🚨 auth-provider
|
Codex review: needs changes before merge. Reviewed August 17, 2026, 1:05 PM ET / 17:05 UTC. ClawSweeper reviewWhat this changesAdds a Grok source picker and supports pasted SuperGrok bearer or grok.com cookie token accounts for usage fetching. Merge readiness⛔ Blocked by patch quality or review findings - 3 items remain Keep open: the current head has a P2 credential-routing defect where a selected rejected Grok management key falls back to unrelated Auto credentials. Priority: P2 Review scores
Verification
How this fits togetherCodexBar turns Grok settings and a selected token account into a credential-specific usage-fetch pipeline. That pipeline supplies account and usage data to the menu-bar provider card. flowchart LR
A[Grok settings] --> C[Selected token account]
B[Saved credentials] --> C
C --> D[Credential classifier]
D --> E[OAuth usage path]
D --> F[Cookie usage path]
D --> G[Auto fallback pipeline]
E --> H[Menu-bar usage card]
F --> H
G --> H
Before merge
Findings
Agent review detailsSecurityNone. Review metrics
Root-cause clusterRelationship: Members:
Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything. Merge-risk optionsMaintainer options:
Copy recommended automerge instructionTechnical reviewBest possible solution: Fail closed for any selected Grok token that is neither a supported bearer nor a valid cookie, while preserving valid bearer and cookie routing. Do we have a high-confidence way to reproduce the issue? Yes, from source: select an Is this the best way to solve the issue? No. The patch recognizes management keys as unsupported but does not enforce that rejection at source selection; a fail-closed selected-account path is the narrower fix. Full review comments:
Overall correctness: patch is incorrect AGENTS.md: found and applied where relevant. Codex review notes: model internal, reasoning high; reviewed against 716a326daf00. LabelsLabel changes:
Label justifications:
EvidenceAcceptance criteria:
What I checked:
Likely related people:
Rating scale
Overall follows the weaker of proof and patch quality. Workflow
|
This was referenced Aug 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Supersedes #3010 while preserving @oakimov's commits and credit.
xai-management keys.mainand retains the full0.52.1 — Unreleasedchangelog union.CI failure root causes
ProviderCredentialCharacterizationTestsdid not include Grok in its expected token-account catalog. Grok is now registered under its declaredGROK_OAUTH_TOKENenvironment injection contract; provider-owned routing still projects cookie-shaped accounts into Grok web settings at fetch time.ProviderArchitectureGatekeeperTestsstill pointed at pre-refresh line numbers and anchors inUsageStore+TokenAccounts.swift. All exact suppressions and allowlisted cluster fingerprints now target the current source without weakening the gate.Verification
swiftformat Sources Testsswiftlint --strictmake checkswift test --filter 'ProviderCredentialCharacterization|ProviderArchitectureGatekeeper|Grok'— 156 tests passedThanks @oakimov for the original implementation and review iterations.