@monotykamary/pi-better-grok 0.2.1 → 0.3.0

package/README.md

@@ -36,6 +36,10 @@ SuperGrok plans earn banked rate-limit reset tokens: redeeming one restores the
 
 The inventory and redeem calls use the grok.com consumer billing gRPC-Web service (`prod_mc_billing.ConsumerUiSvc/GetRemainingResets` and `RedeemReset`) that the web usage page itself calls, authenticated with the same xAI OAuth token as the usage meter. This surface is undocumented; request shapes are pinned in `src/resets.ts` and schema drift is expected.
 
+**Cloudflare requirement (worked around):** grok.com fronts this RPC with a managed challenge that non-browser clients cannot solve — even a perfect Chrome TLS impersonation (curl-impersonate) is challenged, because the site requires a `cf_clearance` cookie issued after a browser solves the challenge once. The cookie is bound to the browser's user-agent and IP. This is the same mechanism community Grok proxies (e.g. grok2api) rely on.
+
+Because pi runs on the same machine (and IP) as your browser, supplying both values in config unlocks the surface. To get them: open grok.com in your browser, DevTools → Application → Cookies → copy `cf_clearance`; Network → any request → copy the `User-Agent` request header. When the clearance expires, `/grok-resets` says so explicitly and you re-copy the cookie. Without a clearance configured, the widget hides the count and `/grok-resets` explains the challenge instead of misreporting it as an auth failure.
+
 ## pi-multiprovider
 
 When [pi-multiprovider](https://github.com/monotykamary/pi-multiprovider) pools several `xai` accounts, the session's active account (chosen with `/switch-account`) is resolved first for usage display and banked resets, and the usage widget refreshes on every switch. Without that extension, credential resolution is unchanged: pi's native `xai` OAuth, then `xai-oauth`/`xai-auth` auth-file entries, then the Grok CLI store.
@@ -56,7 +60,8 @@ JSON config at `~/.pi/agent/extensions/pi-better-grok.json` (global) or `<projec
     "showResetTimes": true,
     "showBankedResets": true
   },
-  "footer": { "mode": "status" }
+  "footer": { "mode": "status" },
+  "resets": { "cookies": "", "userAgent": "" }
 }
 ```
 

package/index.ts

@@ -29,6 +29,7 @@ import {
   formatGrokResetOutcome,
   redeemGrokResetForSession,
   selectGrokResetToken,
+  setGrokResetNetworkProfile,
 } from "./src/resets.ts";
 import { ResetController } from "./src/reset-controller.ts";
 import {
@@ -194,6 +195,11 @@ export default function betterGrok(pi: ExtensionAPI): void {
 
   function refresh(ctx: ExtensionContext): ResolvedConfig {
     cachedConfig = resolveConfig(ctx.cwd || process.cwd());
+    setGrokResetNetworkProfile(
+      cachedConfig.resets.cookies || cachedConfig.resets.userAgent
+        ? { cookies: cachedConfig.resets.cookies, userAgent: cachedConfig.resets.userAgent }
+        : undefined,
+    );
     return cachedConfig;
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@monotykamary/pi-better-grok",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "description": "Improve Grok/xAI in pi with fast mode, subscription usage stats, banked reset redemption, multiprovider pools, footer polish, and settings — mirroring pi-better-openai.",
   "keywords": [
     "footer",

package/src/config.ts

@@ -29,6 +29,14 @@ export type UsageConfig = {
 };
 export type FooterConfig = { mode?: FooterMode };
 
+// Cloudflare fronts the grok.com billing gRPC with a managed challenge that
+// non-browser runtimes cannot solve. A clearance cookie captured from a grok.com
+// browser session (bound to the browser user-agent and IP) unlocks the fetch.
+export type ResetConfig = {
+  cookies?: string;
+  userAgent?: string;
+};
+
 export interface ConfigFile {
   persistState?: boolean;
   active?: boolean;
@@ -37,6 +45,7 @@ export interface ConfigFile {
   fast?: FastConfig;
   usage?: UsageConfig;
   footer?: FooterConfig;
+  resets?: ResetConfig;
 }
 
 export interface SupportedModel {
@@ -57,6 +66,7 @@ export interface ResolvedConfig {
   fast: Required<FastConfig>;
   usage: Required<UsageConfig>;
   footer: Required<FooterConfig>;
+  resets: Required<ResetConfig>;
 }
 
 export const DEFAULT_FAST_CONFIG: Required<FastConfig> = { effort: "low" };
@@ -68,6 +78,7 @@ export const DEFAULT_USAGE_CONFIG: Required<UsageConfig> = {
   showBankedResets: true,
 };
 export const DEFAULT_FOOTER_CONFIG: Required<FooterConfig> = { mode: "status" };
+export const DEFAULT_RESET_CONFIG: Required<ResetConfig> = { cookies: "", userAgent: "" };
 export const DEFAULT_CONFIG: ConfigFile = {
   persistState: true,
   active: false,
@@ -76,6 +87,7 @@ export const DEFAULT_CONFIG: ConfigFile = {
   fast: DEFAULT_FAST_CONFIG,
   usage: DEFAULT_USAGE_CONFIG,
   footer: DEFAULT_FOOTER_CONFIG,
+  resets: DEFAULT_RESET_CONFIG,
 };
 
 type SettingsOptionSection = "footer" | "usage" | "fast";
@@ -322,5 +334,6 @@ export function resolveConfig(cwd: string, home = homedir(), env = process.env):
     fast: mergedSection(DEFAULT_FAST_CONFIG, globalRaw.fast, projectRaw.fast),
     usage: mergedSection(DEFAULT_USAGE_CONFIG, globalRaw.usage, projectRaw.usage),
     footer: mergedSection(DEFAULT_FOOTER_CONFIG, globalRaw.footer, projectRaw.footer),
+    resets: mergedSection(DEFAULT_RESET_CONFIG, globalRaw.resets, projectRaw.resets),
   };
 }

package/src/resets.ts

@@ -42,7 +42,14 @@ export type GrokRedeemCode = "reset" | "no_credit" | "already_redeemed";
 
 export type GrokRedeemResult = { code: GrokRedeemCode };
 
-export type ResetErrorCode = "auth" | "http" | "grpc" | "invalid" | "oversize" | "transport";
+export type ResetErrorCode =
+  | "auth"
+  | "challenge"
+  | "http"
+  | "grpc"
+  | "invalid"
+  | "oversize"
+  | "transport";
 
 export class ResetError extends Error {
   readonly code: ResetErrorCode;
@@ -353,13 +360,28 @@ export function mapGrokRedeemStatus(
   );
 }
 
+export type ResetNetworkProfile = { cookies?: string; userAgent?: string };
+
+let networkProfile: ResetNetworkProfile | undefined;
+
+// Optional Cloudflare clearance profile: cookies captured from a grok.com
+// browser session (at minimum cf_clearance) plus the user-agent that solved
+// the challenge. Cloudflare binds the clearance to the user-agent and IP, and
+// pi runs on the same machine as the browser, so only the user-agent must match.
+export function setGrokResetNetworkProfile(profile: ResetNetworkProfile | undefined): void {
+  networkProfile = profile?.cookies || profile?.userAgent ? profile : undefined;
+}
+
 function resetHeaders(credential: GrokCredential): Record<string, string> {
-  return {
+  const headers: Record<string, string> = {
     Authorization: `Bearer ${credential.token}`,
     "X-XAI-Token-Auth": GROK_CLI_AUTH_HEADER,
     "Content-Type": GRPC_WEB_CONTENT_TYPE,
     "x-grpc-web": "1",
   };
+  if (networkProfile?.cookies) headers.Cookie = networkProfile.cookies;
+  if (networkProfile?.userAgent) headers["User-Agent"] = networkProfile.userAgent;
+  return headers;
 }
 
 async function postGrokRpc(
@@ -383,6 +405,15 @@ async function postGrokRpc(
     throw new ResetError("transport", `Grok reset request failed: ${message}`);
   }
   if (!response.ok) {
+    if (response.headers.get("cf-mitigated") === "challenge") {
+      throw new ResetError(
+        "challenge",
+        networkProfile?.cookies
+          ? `grok.com answered with a Cloudflare challenge even with the configured clearance cookie (HTTP ${response.status}); it likely expired or no longer matches the browser user-agent. Re-copy it from a grok.com browser session.`
+          : `grok.com is serving a Cloudflare browser challenge (HTTP ${response.status}); banked reset data cannot be fetched from a non-browser client. Set resets.cookies and resets.userAgent in the Better Grok config from a grok.com browser session to enable it.`,
+        response.status,
+      );
+    }
     if (response.status === 401 || response.status === 403) {
       throw new ResetError(
         "auth",