Repository navigation
feat(TrifolaKit): add Grok SuperGrok plan usage to Quota and MCP - #13
Conversation
…dows (#5) A GrokQuotaProvider on the ClaudeQuota network pattern: reads the OAuth token from ~/.grok/auth.json (OIDC/SuperGrok scope, legacy fallback), fetches grok.com's GetGrokCreditsConfig billing endpoint, and parses the gRPC-web protobuf for used-% + reset. Consent-gated (grokQuotaAccessEnabled, default off), wired into the MCP quota_windows block and the Quota screen alongside Claude and Codex, with an honest error taxonomy (no login / expired / rejected / offline / unparseable) and no five-hour window Grok doesn't have. The bearer token never leaves the request's Authorization header. Wire format derived from CodexBar (MIT, © Peter Steinberger); implemented trifola-native with an injectable transport so tests never hit the network. Co-Authored-By: Grok 4.5 <grok@x.ai>
Non-author review noted the gRPC-web/protobuf parser is bounded only by construction. Add explicit hostile-input cases (truncated frame, absurd 0xFFFFFFFF length, over-deep nesting, never-terminating varint, noise) — each must return a .failure, never crash or hang, since the parser eats an attacker-influenceable remote response. Co-Authored-By: Grok 4.5 <grok@x.ai>
|
Warning Review limit reached
Next review available in: 27 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthroughThis PR adds Grok/SuperGrok as a third consent-gated quota provider. It introduces credential loading from ChangesGrok Quota Provider
Estimated code review effort: 4 (Complex) | ~60 minutes Possibly related issues
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/ARCHITECTURE.md`:
- Around line 99-102: Update the SuperGrok plan usage description near the
billing endpoint flow to state that the fetch may issue an initial POST plus one
retry on failure, rather than saying it POSTs once. Preserve the existing
consent, token confinement, and injectable transport details.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 9a86670a-3683-485a-a2fd-61348c199088
📒 Files selected for processing (15)
CHANGELOG.mdREADME.mdSources/Trifola/QuotaSection.swiftSources/Trifola/Render.swiftSources/Trifola/SettingsWindow.swiftSources/Trifola/main.swiftSources/TrifolaKit/ClaudeQuota.swiftSources/TrifolaKit/GrokQuota.swiftSources/TrifolaKit/MCPServer.swiftSources/TrifolaKit/Settings.swiftTests/TrifolaKitTests/GrokQuotaTests.swiftTests/TrifolaKitTests/MCPServerTests.swiftTests/TrifolaKitTests/QuotaConsentTests.swiftTests/TrifolaKitTests/SettingsTests.swiftdocs/ARCHITECTURE.md
1 participant
Intent
Add Grok SuperGrok plan usage to trifola's Quota screen and MCP quota_windows as a third provider (#5), following the existing ClaudeQuota network pattern: read the OAuth bearer token from ~/.grok/auth.json (OIDC/SuperGrok scope, legacy fallback), fetch grok.com's GetGrokCreditsConfig gRPC-web billing endpoint, and parse the protobuf for used-percent + reset time. Consent-gated (grokQuotaAccessEnabled, default off), honest error taxonomy, injectable HTTP transport so tests never hit the network, and the bearer token must never be logged/printed/persisted outside the request Authorization header. No change to Claude/Codex quota behavior.
What Changed
GrokQuota) that reads the OAuth bearer from~/.grok/auth.json(OIDC/SuperGrok scope with legacy fallback), POSTs to grok.com’s GetGrokCreditsConfig gRPC-web billing endpoint, and parses used-percent plus reset time from the protobuf response, with an injectable HTTP transport and redacted credential types so the token never leaves the requestAuthorizationheader.quota_windows(alongside Claude and Codex), behindgrokQuotaAccessEnabled(default off / “Show Grok usage”), with honest unavailable statuses when consent, credentials, or the endpoint fail, and no change to Claude/Codex quota behavior.Risk Assessment
Testing
Exercised Grok credential parse, gRPC-web billing parse, consent-gated fetch, MCP quota_windows third provider, and headless Quota UI renders; all focused suites passed and reviewer-visible PNG plus MCP JSON artifacts confirm SuperGrok usage without live network or token leakage.
/var/folders/nc/j5wdfhws2q56jzdcj_jkdvww0000gn/T/no-mistakes-evidence/01KY1D3J1EJYRAP8745BXQYB16/quota-dark.png)/var/folders/nc/j5wdfhws2q56jzdcj_jkdvww0000gn/T/no-mistakes-evidence/01KY1D3J1EJYRAP8745BXQYB16/quota-light.png)/var/folders/nc/j5wdfhws2q56jzdcj_jkdvww0000gn/T/no-mistakes-evidence/01KY1D3J1EJYRAP8745BXQYB16/parity/quota-section-dark.png)/var/folders/nc/j5wdfhws2q56jzdcj_jkdvww0000gn/T/no-mistakes-evidence/01KY1D3J1EJYRAP8745BXQYB16/parity/quota-section-light.png)Evidence: MCP quota_windows end-user transcript (claude + codex + grok SuperGrok)
MCP tool: quota_windows [claude] available=True status=ok — Session (5h) 91%, Weekly 58% [codex] available=True status=ok — 5 hour 37.5%, Weekly 62.25% [grok] available=True status=ok — SuperGrok 42.5% used, reset_runway=11d Consent gate (default): grokQuotaAccessEnabled=false Consent-off status: consent not granted in trifola Settings Token redaction: GrokQuotaCredentials(token: <redacted>, ...)Evidence: MCP quota_windows structured evidence (intent checks + full payload + error taxonomy)
Evidence: Raw MCP evidence dump (JSON-RPC reply included)
Evidence: Focused test run summary
Pipeline
Updates from git push no-mistakes
✅ **intent** - passed
✅ No issues found.
✅ **Rebase** - passed
✅ No issues found.
Sources/TrifolaKit/MCPServer.swift:140- grokQuotaFetchTimeout is 18s, but GrokQuotaFetcher.fetch uses a 15s per-request timeout and retries once on timeout/408/502/503/504/deadline (up to ~30s). Claude deliberately sets quotaFetchTimeout (35) past its ~30s request timeout; Grok does not. On a transient timeout, blockingGrokQuotaFetch will return "grok quota fetch timed out" while the detached retry is still in flight, so MCP quota_windows can report unavailable even when the retry would succeed. Raise grokQuotaFetchTimeout to ≥ ~32–35s (and update the ≤60 budget test), or stop retrying under the MCP bridge / shrink per-attempt timeout so 2×request + margin fits the wait.Sources/TrifolaKit/GrokQuota.swift:246- grpcWebDataFrames returns [] (discarding already-parsed frames) when trailing incomplete header bytes remain after valid frames (guard index + 5 <= bytes.count else { return [] }). Trailer parsing usesbreakinstead. Uncommon for clean gRPC-web bodies, but a 1–4 byte trailer pad would fail a otherwise-valid SuperGrok payload. Preferbreak/return frameson short remainder.Sources/TrifolaKit/GrokQuota.swift:196- Used-% is recovered only from fixed32 (wire type 5) floats with path ending in field 1 in [0,100]; fixed64/double (wire type 1) values are skipped entirely in scanProtobuf. That matches the synthetic fixtures and CodexBar-derived shape claimed in the PR, but any upstream schema shift to double percent would surface as permanent badPayload/"Couldn't read Grok plan usage" with no alternate path. Residual schema-coupling risk, not a logic error against current fixtures.🔧 Fix: Raise Grok MCP wait; keep partial frames
3 issues (1 warning, 2 infos) still open:
Sources/TrifolaKit/GrokQuota.swift:253- Round-1 fixed incomplete headers (breakinstead ofreturn []), but a complete 5-byte header whose length overruns the remaining body still doesreturn [], discarding any already-parsed data frames. Trailer parsing usesbreakfor the same case. A valid SuperGrok data frame followed by a truncated later frame (common under partial reads) therefore fails as badPayload even though a usable payload was already collected. Change the overrun branch tobreak/return framesfor parity with the header fix.Sources/TrifolaKit/MCPServer.swift:358- tools/list and quota_windows note/description correctly describe triple-provider Claude/Codex/Grok, but initializeResult instructions still say quota_windows is "real Claude + Codex plan limits". Agents that only read server instructions will miss the Grok SuperGrok surface. Update that phrase to include Grok.Sources/TrifolaKit/MCPServer.swift:667- quotaWindows() invokes Claude, Codex, and Grok providers sequentially. After raising grokQuotaFetchTimeout to 35s to cover the 15s×2 retry budget, worst-case live tool wall-clock is roughly credentialReadTimeout + 35 + 2 + 35 ≈ 75s (budget test now ≤90), vs the prior ~40s Claude+Codex cap. Default-off consent keeps this dormant, but with all three consents enabled a dual-network stall can block MCP stdio much longer than before. Overlap the two network bridges (wall clock ≈ max(claude, grok) + codex) if that latency budget still matters.✅ **Test** - passed
✅ No issues found.
swift test --filter GrokQuota(credentials OIDC/legacy, protobuf/gRPC-web parser, stub fetcher, error taxonomy, MCP blocking Grok fetch — 19 passed)swift test --filter 'MCPQuota|quotaWindows|QuotaConsent'(triple-provider quota_windows, consent gates for Claude/Codex/Grok, timeout budgets — 19 passed)swift build --product TrifolathenTrifola --render-quota <evidence>/quota(dark/light Plan quota UI with Grok SuperGrok + consent-off + degradation)Trifola --render-parity <evidence>/parity(includes quota-section dark/light)Evidence harness: stubbed auth.json + GrokQuotaHTTPTransport → blockingGrokQuotaFetch + MCP tools/call quota_windows JSON (SuperGrok 42.5%, token never in reply, grokQuotaAccessEnabled default false)✅ **Document** - passed
✅ No issues found.
✅ **Lint** - passed
✅ No issues found.
✅ **Push** - passed
✅ No issues found.
Summary by CodeRabbit
New Features
Privacy
Documentation