@monotykamary/pi-better-grok 0.2.1 → 0.2.2

package/README.md

@@ -36,6 +36,8 @@ SuperGrok plans earn banked rate-limit reset tokens: redeeming one restores the
 
 The inventory and redeem calls use the grok.com consumer billing gRPC-Web service (`prod_mc_billing.ConsumerUiSvc/GetRemainingResets` and `RedeemReset`) that the web usage page itself calls, authenticated with the same xAI OAuth token as the usage meter. This surface is undocumented; request shapes are pinned in `src/resets.ts` and schema drift is expected.
 
+**Known limitation:** grok.com fronts this RPC with a Cloudflare managed challenge, which browser-fingerprinted clients (Electron apps) pass but plain CLI runtimes cannot — the edge answers with `403 · cf-mitigated: challenge` regardless of headers or credentials. When that happens the widget hides the count and `/grok-resets` explains the challenge instead of misreporting it as an auth failure. The wiring is live end to end, so the count appears in any environment where the fetch can succeed.
+
 ## pi-multiprovider
 
 When [pi-multiprovider](https://github.com/monotykamary/pi-multiprovider) pools several `xai` accounts, the session's active account (chosen with `/switch-account`) is resolved first for usage display and banked resets, and the usage widget refreshes on every switch. Without that extension, credential resolution is unchanged: pi's native `xai` OAuth, then `xai-oauth`/`xai-auth` auth-file entries, then the Grok CLI store.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@monotykamary/pi-better-grok",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Improve Grok/xAI in pi with fast mode, subscription usage stats, banked reset redemption, multiprovider pools, footer polish, and settings — mirroring pi-better-openai.",
   "keywords": [
     "footer",

package/src/resets.ts

@@ -42,7 +42,14 @@ export type GrokRedeemCode = "reset" | "no_credit" | "already_redeemed";
 
 export type GrokRedeemResult = { code: GrokRedeemCode };
 
-export type ResetErrorCode = "auth" | "http" | "grpc" | "invalid" | "oversize" | "transport";
+export type ResetErrorCode =
+  | "auth"
+  | "challenge"
+  | "http"
+  | "grpc"
+  | "invalid"
+  | "oversize"
+  | "transport";
 
 export class ResetError extends Error {
   readonly code: ResetErrorCode;
@@ -383,6 +390,13 @@ async function postGrokRpc(
     throw new ResetError("transport", `Grok reset request failed: ${message}`);
   }
   if (!response.ok) {
+    if (response.headers.get("cf-mitigated") === "challenge") {
+      throw new ResetError(
+        "challenge",
+        `grok.com is serving a Cloudflare browser challenge (HTTP ${response.status}); banked reset data cannot be fetched from a non-browser client.`,
+        response.status,
+      );
+    }
     if (response.status === 401 || response.status === 403) {
       throw new ResetError(
         "auth",