feat(xai): report SuperGrok subscription usage#5903
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1e58fd459b
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| function assertGrpcStatus(status: string | null | undefined, message?: string | null): void { | ||
| if (status === null || status === undefined || status === "" || status === "0") return; | ||
| throw new Error(`Grok billing RPC failed with status ${status}${message ? `: ${message}` : ""}`); |
There was a problem hiding this comment.
When an HTTP 200 response contains a valid data frame but the gRPC-Web trailer is truncated or stripped by a proxy, status is absent and this branch treats it exactly like status 0. The parser then publishes the payload as successful even though the RPC never reported successful completion, bypassing the existing last-known-good failure behavior. Require an explicit zero status from either the HTTP headers or trailer frame before accepting a framed response.
Useful? React with 👍 / 👎.
roboomp
added
auth
roboomp
left a comment
roboomp
left a comment
There was a problem hiding this comment.
review:p3 — #4874 already targets the same xai-oauth usage feature; maintainers should choose one endpoint and wire contract rather than merge competing default providers.
Blocking: the parser prefers legacy billing_period_end over current_period.end, producing a stale reset when both differ. Public exports also need repo-standard API docs.
Verification: the focused 6-test suite, packages/ai check, and both affected packages' type checks pass.
Thanks for the focused implementation and defensive gRPC handling.
| const preferredReset = resetCandidates | ||
| .filter(field => samePath(field.path, [1, 5, 1])) |
There was a problem hiding this comment.
blocking — This prefers the legacy GrokCreditsConfig.billing_period_end.seconds path. In the current Grok protobuf descriptor, the live period is config.current_period.end.seconds, i.e. [1, 8, 3, 1]; Grok's own UI reads currentPeriod. When both fields differ, this parser returns [1, 5, 1] and reports the stale reset. I reproduced that with legacy end 2000000000 and current-period end 2010000000: parseGrokUsageResponse() returned 2000000000000. Please prefer [1, 8, 3, 1] and add a regression where the legacy and current fields disagree.
| nextOrder: number; | ||
| } | ||
|
|
||
| export interface GrokUsageSnapshot { |
There was a problem hiding this comment.
should-fix — GrokUsageSnapshot is a new public package export (@oh-my-pi/pi-ai/usage/xai) but has no API documentation. The same applies to the exported parseGrokUsageResponse and xaiOAuthUsageProvider below. Repo convention requires every public symbol to document what it represents and why callers use it; please add concise doc comments or keep parser-only internals non-public.
2 participants
What
xai-oauthusage reporting toomp usagethrough Grok's billing RPC.Why
SuperGrok OAuth accounts currently disappear from aggregate usage output because OMP has no usage provider for
xai-oauth. The authenticated Grok billing surface exposes the current credit percentage and reset time.Testing
bun test test/xai-usage.test.tsinpackages/ai— 6 passed, 0 failedbun run check:typesinpackages/aibun run check:typesinpackages/coding-agentbun run dev usage --provider xai-oauth --redact --json— live OAuth account returnedGrok Creditsusage and reset timestampbun checkpassesRisk
The Grok billing RPC and protobuf schema are undocumented. Parsing is bounded and defensive; HTTP, gRPC, and parse failures flow through AuthStorage's existing last-known-good behavior.
AI Review Report
A focused reviewer identified that trailer-only gRPC-web failures could lose their definitive status. The parser now validates trailers before requiring a data frame, with regression coverage for trailer-only authentication failures.
Security Audit
grok.combilling endpoint.xaiAPI-key credentials; onlyxai-oauthis registered.