@omnicross/daemon 0.3.1 → 0.4.0

package/dist/cli.cjs

@@ -1170,22 +1170,22 @@ var import_node_fs36 = require("fs");
 var import_node_path36 = require("path");
 var import_audit_types = require("@omnicross/contracts/audit-types");
 var import_billing_types = require("@omnicross/contracts/billing-types");
-var import_core4 = require("@omnicross/core");
+var import_core7 = require("@omnicross/core");
 var import_GeminiCodeAssistProjectResolver = require("@omnicross/core/auth/GeminiCodeAssistProjectResolver");
 var import_ApiKeyPoolService = require("@omnicross/core/completion/ApiKeyPoolService");
 var import_outbound_api10 = require("@omnicross/core/outbound-api");
 var import_subscriptionRegistryPort = require("@omnicross/core/outbound-api/subscriptionRegistryPort");
 var import_SubscriptionAccountHealth4 = require("@omnicross/core/pipeline/SubscriptionAccountHealth");
-var import_AccountAllowanceStore7 = require("@omnicross/core/pipeline/AccountAllowanceStore");
+var import_AccountAllowanceStore9 = require("@omnicross/core/pipeline/AccountAllowanceStore");
 var import_AccountAllowanceScheduling5 = require("@omnicross/core/pipeline/AccountAllowanceScheduling");
-var import_upstreamFetch13 = require("@omnicross/core/pipeline/upstreamFetch");
+var import_upstreamFetch15 = require("@omnicross/core/pipeline/upstreamFetch");
 var import_SubscriptionIdentityStore3 = require("@omnicross/core/provider-proxy/identity/SubscriptionIdentityStore");
 var import_gemini_code_assist_resolver = require("@omnicross/core/ports/gemini-code-assist-resolver");
 var import_provider_proxy4 = require("@omnicross/core/provider-proxy");
 var import_cli_launcher2 = require("@omnicross/cli-launcher");
 var import_outbound_api11 = require("@omnicross/core/outbound-api");
 var import_usage2 = require("@omnicross/core/usage");
-var import_subscriptions9 = require("@omnicross/subscriptions");
+var import_subscriptions12 = require("@omnicross/subscriptions");
 
 // src/admin/accountsCodexOAuth.ts
 var import_node_crypto3 = __toESM(require("crypto"), 1);
@@ -1367,8 +1367,187 @@ function handleKimiOAuthStatus(sessionId, deps) {
   return { status: 200, body: { state: s.status, ...s.error ? { message: s.error } : {} } };
 }
 
+// src/admin/accountsGrokOAuth.ts
+var import_subscriptions3 = require("@omnicross/subscriptions");
+function err3(status, message) {
+  return { status, body: { error: { type: "admin_api_error", message } } };
+}
+var DEFAULT_GROK_OAUTH_TTL_MS = 15 * 6e4;
+async function handleGrokOAuthStart(deps) {
+  if (deps.grokSessions.isBusy()) {
+    return err3(409, "a grok sign-in is already in progress \u2014 finish it in the browser or cancel it");
+  }
+  const fetchImpl = deps.oauthExchangeFetch("grok");
+  let tokenEndpoint;
+  try {
+    tokenEndpoint = await import_subscriptions3.grokOAuth.resolveGrokTokenEndpoint(fetchImpl);
+  } catch (e) {
+    const reason = e instanceof Error ? e.message : "OIDC discovery failed";
+    return err3(502, `grok token-endpoint discovery failed: ${reason}`);
+  }
+  let authorization;
+  try {
+    authorization = await import_subscriptions3.grokOAuth.requestGrokDeviceAuthorization(fetchImpl);
+  } catch (e) {
+    const reason = e instanceof Error ? e.message : "device authorization failed";
+    return err3(502, `grok device authorization failed: ${reason}`);
+  }
+  const { sessionId, signal } = deps.grokSessions.begin();
+  void runGrokDevicePoll(sessionId, tokenEndpoint, authorization.deviceCode, signal, deps).catch((e) => {
+    const reason = e instanceof Error ? e.message : "grok sign-in failed";
+    deps.grokSessions.settle(sessionId, "error", reason);
+  });
+  return {
+    status: 200,
+    body: {
+      authUrl: authorization.verificationUriComplete ?? authorization.verificationUri,
+      userCode: authorization.userCode,
+      sessionId
+    }
+  };
+}
+async function runGrokDevicePoll(sessionId, tokenEndpoint, deviceCode, signal, deps) {
+  const fetchImpl = deps.oauthExchangeFetch("grok");
+  const result = await import_subscriptions3.grokOAuth.awaitGrokDeviceToken(
+    { userCode: "", deviceCode, verificationUri: "" },
+    tokenEndpoint,
+    fetchImpl,
+    {
+      deadlineMs: DEFAULT_GROK_OAUTH_TTL_MS,
+      sleep: (ms) => new Promise((resolve11, reject) => {
+        const onAbort = () => {
+          clearTimeout(timer);
+          reject(new Error("login: cancelled"));
+        };
+        const timer = setTimeout(() => {
+          signal.removeEventListener("abort", onAbort);
+          resolve11();
+        }, ms);
+        signal.addEventListener("abort", onAbort, { once: true });
+      })
+    }
+  );
+  const block = {
+    authMethod: "oauth",
+    status: "authorized",
+    accessToken: result.accessToken,
+    refreshToken: result.refreshToken,
+    expiresAt: new Date(Date.now() + result.expiresIn * 1e3).toISOString(),
+    accountId: import_subscriptions3.grokOAuth.grokAccountIdFromAccessToken(result.accessToken),
+    lastRefreshedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  await deps.subscriptionAccountAppender.appendProviderAccount("grok", block);
+  deps.grokSessions.settle(sessionId, "done");
+}
+function handleGrokOAuthCancel(sessionId, deps) {
+  if (!deps.grokSessions.cancel(sessionId)) return err3(404, "unknown or expired grok sign-in session");
+  return { status: 200, body: { ok: true } };
+}
+function handleGrokOAuthStatus(sessionId, deps) {
+  const s = deps.grokSessions.get(sessionId);
+  if (!s) return err3(404, "unknown or expired grok sign-in session");
+  return { status: 200, body: { state: s.status, ...s.error ? { message: s.error } : {} } };
+}
+
+// src/admin/accountsCopilotOAuth.ts
+var import_subscriptions4 = require("@omnicross/subscriptions");
+function err4(status, message) {
+  return { status, body: { error: { type: "admin_api_error", message } } };
+}
+var DEFAULT_COPILOT_OAUTH_TTL_MS = 15 * 6e4;
+async function handleCopilotOAuthStart(deps, enterpriseUrlInput) {
+  if (deps.copilotSessions.isBusy()) {
+    return err4(409, "a copilot sign-in is already in progress \u2014 finish it in the browser or cancel it");
+  }
+  let enterpriseUrl;
+  if (typeof enterpriseUrlInput === "string" && enterpriseUrlInput.trim()) {
+    try {
+      enterpriseUrl = import_subscriptions4.copilotOAuth.normalizeCopilotEnterpriseDomain(enterpriseUrlInput);
+    } catch (e) {
+      const reason = e instanceof Error ? e.message : "invalid GitHub Enterprise domain";
+      return err4(400, `copilot ${reason}`);
+    }
+  }
+  const fetchImpl = deps.oauthExchangeFetch("copilot");
+  let authorization;
+  try {
+    authorization = await import_subscriptions4.copilotOAuth.requestCopilotDeviceAuthorization(fetchImpl, enterpriseUrl);
+  } catch (e) {
+    const reason = e instanceof Error ? e.message : "device authorization failed";
+    return err4(502, `copilot device authorization failed: ${reason}`);
+  }
+  const { sessionId, signal } = deps.copilotSessions.begin();
+  void runCopilotDevicePoll(sessionId, authorization.deviceCode, signal, deps, enterpriseUrl).catch((e) => {
+    const reason = e instanceof Error ? e.message : "copilot sign-in failed";
+    deps.copilotSessions.settle(sessionId, "error", reason);
+  });
+  return {
+    status: 200,
+    body: {
+      authUrl: authorization.verificationUri,
+      userCode: authorization.userCode,
+      sessionId,
+      ...enterpriseUrl ? { enterpriseUrl } : {}
+    }
+  };
+}
+async function runCopilotDevicePoll(sessionId, deviceCode, signal, deps, enterpriseUrl) {
+  const fetchImpl = deps.oauthExchangeFetch("copilot");
+  const result = await import_subscriptions4.copilotOAuth.awaitCopilotDeviceToken(
+    { userCode: "", deviceCode, verificationUri: "", interval: 5, expiresIn: 900 },
+    fetchImpl,
+    {
+      deadlineMs: DEFAULT_COPILOT_OAUTH_TTL_MS,
+      ...enterpriseUrl ? { enterpriseUrl } : {},
+      sleep: (ms) => new Promise((resolve11, reject) => {
+        const onAbort = () => {
+          clearTimeout(timer);
+          reject(new Error("login: cancelled"));
+        };
+        const timer = setTimeout(() => {
+          signal.removeEventListener("abort", onAbort);
+          resolve11();
+        }, ms);
+        signal.addEventListener("abort", onAbort, { once: true });
+      })
+    }
+  );
+  const identity = await import_subscriptions4.copilotOAuth.fetchCopilotIdentity(result.accessToken, fetchImpl, enterpriseUrl);
+  const apiEndpoint = await import_subscriptions4.copilotOAuth.discoverCopilotApiEndpoint(result.accessToken, fetchImpl, enterpriseUrl);
+  await import_subscriptions4.copilotOAuth.enableAllCopilotModels(
+    result.accessToken,
+    { apiEndpoint, ...enterpriseUrl ? { enterpriseUrl } : {} },
+    fetchImpl
+  );
+  const block = {
+    authMethod: "oauth",
+    status: "authorized",
+    accessToken: result.accessToken,
+    refreshToken: result.accessToken,
+    expiresAt: new Date(Date.now() + import_subscriptions4.copilotOAuth.COPILOT_FAR_FUTURE_MS).toISOString(),
+    ...identity.accountId ? { accountId: identity.accountId } : {},
+    ...identity.email ? { email: identity.email } : {},
+    ...apiEndpoint ? { apiEndpoint } : {},
+    ...enterpriseUrl ? { enterpriseUrl } : {},
+    lastRefreshedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  await deps.subscriptionAccountAppender.appendProviderAccount("copilot", block);
+  deps.copilotSessions.settle(sessionId, "done");
+}
+function handleCopilotOAuthCancel(sessionId, deps) {
+  if (!deps.copilotSessions.cancel(sessionId)) {
+    return err4(404, "unknown or expired copilot sign-in session");
+  }
+  return { status: 200, body: { ok: true } };
+}
+function handleCopilotOAuthStatus(sessionId, deps) {
+  const s = deps.copilotSessions.get(sessionId);
+  if (!s) return err4(404, "unknown or expired copilot sign-in session");
+  return { status: 200, body: { state: s.status, ...s.error ? { message: s.error } : {} } };
+}
+
 // src/allowance/AccountAllowanceService.ts
-var import_AccountAllowanceStore5 = require("@omnicross/core/pipeline/AccountAllowanceStore");
+var import_AccountAllowanceStore7 = require("@omnicross/core/pipeline/AccountAllowanceStore");
 var import_AccountAllowanceScheduling = require("@omnicross/core/pipeline/AccountAllowanceScheduling");
 
 // src/allowance/ClaudeAllowanceCollector.ts
@@ -1839,7 +2018,7 @@ var CodexAllowanceCollector = class {
 // src/allowance/KimiAllowanceCollector.ts
 var import_AccountAllowanceStore3 = require("@omnicross/core/pipeline/AccountAllowanceStore");
 var import_upstreamFetch3 = require("@omnicross/core/pipeline/upstreamFetch");
-var import_subscriptions3 = require("@omnicross/subscriptions");
+var import_subscriptions5 = require("@omnicross/subscriptions");
 var KIMI_ALLOWANCE_CACHE_MS = 5 * 6e4;
 var KIMI_USAGE_URL = "https://api.kimi.com/coding/v1/usages";
 function finiteNumber2(value) {
@@ -1994,97 +2173,572 @@ var KimiAllowanceCollector = class {
     let accessToken = await this.credentials.getAccessTokenForAccount("kimi", accountId);
     if (!accessToken) return this.failureSnapshot(accountId, "kimi_usage_token_unavailable", this.now());
     let response = await this.request(accountId, accessToken, tokens);
-    if (response.status === 401) {
-      const refreshed = await this.credentials.refreshAccountToken("kimi", accountId);
-      if (!refreshed) return this.failureSnapshot(accountId, "kimi_usage_unauthorized", this.now());
-      accessToken = await this.credentials.getAccessTokenForAccount("kimi", accountId);
-      if (!accessToken) return this.failureSnapshot(accountId, "kimi_usage_token_unavailable", this.now());
+    if (response.status === 401) {
+      const refreshed = await this.credentials.refreshAccountToken("kimi", accountId);
+      if (!refreshed) return this.failureSnapshot(accountId, "kimi_usage_unauthorized", this.now());
+      accessToken = await this.credentials.getAccessTokenForAccount("kimi", accountId);
+      if (!accessToken) return this.failureSnapshot(accountId, "kimi_usage_token_unavailable", this.now());
+      response = await this.request(accountId, accessToken, tokens);
+    }
+    if (response.status === 403) {
+      const snapshot2 = this.unsupportedSnapshot(accountId, this.now(), "kimi_usage_unsupported");
+      this.store.set(snapshot2);
+      return snapshot2;
+    }
+    if (!response.ok) return this.failureSnapshot(accountId, "kimi_usage_http_error", this.now());
+    let payload;
+    try {
+      payload = await response.json();
+    } catch {
+      return this.failureSnapshot(accountId, "kimi_usage_invalid_response", this.now());
+    }
+    const now = this.now();
+    const windows = parseKimiUsagePayload(payload, now);
+    const snapshot = {
+      providerId: "kimi",
+      accountId,
+      source: "oauth-usage-api",
+      observedAt: new Date(now).toISOString(),
+      expiresAt: new Date(now + KIMI_ALLOWANCE_CACHE_MS).toISOString(),
+      windows: windows.length > 0 ? windows : [
+        { id: "five-hour", label: "5 hours", scope: "all", usedPercent: null, state: "unavailable" },
+        { id: "seven-day", label: "7 days", scope: "all", usedPercent: null, state: "unavailable" }
+      ],
+      ...windows.length > 0 ? {} : { lastErrorCode: "kimi_usage_invalid_response" }
+    };
+    this.store.set(snapshot);
+    return snapshot;
+  }
+  request(accountId, accessToken, tokens) {
+    return this.fetchImpl(KIMI_USAGE_URL, {
+      method: "GET",
+      headers: {
+        Authorization: `Bearer ${accessToken}`,
+        Accept: "application/json",
+        ...(0, import_subscriptions5.kimiFingerprintHeaders)(tokens.deviceId)
+      },
+      signal: AbortSignal.timeout(15e3)
+    }, accountId);
+  }
+  failureSnapshot(accountId, code, now) {
+    const existing = this.store.get("kimi", accountId, now);
+    const snapshot = existing ? {
+      ...existing,
+      expiresAt: new Date(now + KIMI_ALLOWANCE_CACHE_MS).toISOString(),
+      windows: existing.windows.map((window) => ({
+        ...window,
+        state: window.state === "unsupported" ? "unsupported" : window.usedPercent !== null || window.resetsAt ? "stale" : "unavailable"
+      })),
+      lastErrorCode: code
+    } : {
+      providerId: "kimi",
+      accountId,
+      source: "oauth-usage-api",
+      observedAt: new Date(now).toISOString(),
+      expiresAt: new Date(now + KIMI_ALLOWANCE_CACHE_MS).toISOString(),
+      windows: [
+        { id: "five-hour", label: "5 hours", scope: "all", usedPercent: null, state: "unavailable" },
+        { id: "seven-day", label: "7 days", scope: "all", usedPercent: null, state: "unavailable" }
+      ],
+      lastErrorCode: code
+    };
+    this.store.set(snapshot);
+    return snapshot;
+  }
+  unsupportedSnapshot(accountId, now, code = "kimi_usage_unsupported_auth") {
+    return {
+      providerId: "kimi",
+      accountId,
+      source: "oauth-usage-api",
+      observedAt: new Date(now).toISOString(),
+      windows: [
+        { id: "five-hour", label: "5 hours", scope: "all", usedPercent: null, state: "unsupported" },
+        { id: "seven-day", label: "7 days", scope: "all", usedPercent: null, state: "unsupported" }
+      ],
+      lastErrorCode: code
+    };
+  }
+};
+
+// src/allowance/GrokAllowanceCollector.ts
+var import_AccountAllowanceStore4 = require("@omnicross/core/pipeline/AccountAllowanceStore");
+var import_upstreamFetch4 = require("@omnicross/core/pipeline/upstreamFetch");
+var GROK_ALLOWANCE_CACHE_MS = 5 * 6e4;
+var GROK_BILLING_BASE = "https://cli-chat-proxy.grok.com";
+var GROK_BILLING_CREDITS_URL = `${GROK_BILLING_BASE}/v1/billing?format=credits`;
+var GROK_BILLING_MONTHLY_URL = `${GROK_BILLING_BASE}/v1/billing`;
+function isRecord2(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function finiteNumber3(value) {
+  if (value === null || value === void 0 || value === "") return void 0;
+  const parsed = typeof value === "number" ? value : Number(value);
+  return Number.isFinite(parsed) && parsed >= 0 ? parsed : void 0;
+}
+function percent(value) {
+  const parsed = finiteNumber3(value);
+  return parsed !== void 0 && parsed <= 100 ? parsed : void 0;
+}
+function onDemandAmount(value) {
+  return isRecord2(value) ? finiteNumber3(value["val"]) : void 0;
+}
+function confirmsNoMonthlyQuota(raw) {
+  const limit = onDemandAmount(raw["monthlyLimit"]);
+  if (limit !== void 0) return limit === 0;
+  return parseWeeklyConfig(raw)?.inferredPercent === true;
+}
+function parseWeeklyConfig(raw) {
+  const period = isRecord2(raw["currentPeriod"]) ? raw["currentPeriod"] : void 0;
+  if (!period) return null;
+  const start = typeof period["start"] === "string" ? Date.parse(period["start"]) : Number.NaN;
+  const end = typeof period["end"] === "string" ? Date.parse(period["end"]) : Number.NaN;
+  const type = typeof period["type"] === "string" ? period["type"] : "";
+  if (!Number.isFinite(start) || !Number.isFinite(end) || end <= start) return null;
+  if (!type.toUpperCase().includes("WEEK")) return null;
+  const inferred = raw["creditUsagePercent"] === void 0 || raw["creditUsagePercent"] === null;
+  let creditUsagePercent;
+  if (inferred) {
+    creditUsagePercent = end > Date.now() ? 0 : void 0;
+  } else {
+    creditUsagePercent = percent(raw["creditUsagePercent"]);
+  }
+  if (creditUsagePercent === void 0) return null;
+  return {
+    creditUsagePercent,
+    inferredPercent: inferred,
+    resetsAtMs: end,
+    unified: raw["isUnifiedBillingUser"] === true
+  };
+}
+function parseMonthlyConfig(raw) {
+  const start = typeof raw["billingPeriodStart"] === "string" ? Date.parse(raw["billingPeriodStart"]) : Number.NaN;
+  const end = typeof raw["billingPeriodEnd"] === "string" ? Date.parse(raw["billingPeriodEnd"]) : Number.NaN;
+  if (!Number.isFinite(start) || !Number.isFinite(end) || end <= start) return null;
+  const limit = onDemandAmount(raw["monthlyLimit"]);
+  const used = onDemandAmount(raw["used"]);
+  if (limit === void 0 || limit <= 0 || used === void 0) return null;
+  return { used, limit, periodStartMs: start, periodEndMs: end };
+}
+function secondsUntil4(instant, now) {
+  if (!instant) return void 0;
+  return Math.max(0, Math.floor((Date.parse(instant) - now) / 1e3));
+}
+var MINUTE_MS2 = 6e4;
+var DAY_MS2 = 864e5;
+var WEEK_MINUTES = 7 * 24 * 60;
+function weeklyWindow(config, now) {
+  const resetsAt = new Date(config.resetsAtMs).toISOString();
+  return {
+    id: "seven-day",
+    label: "7 days",
+    scope: "all",
+    usedPercent: config.creditUsagePercent,
+    windowMinutes: WEEK_MINUTES,
+    resetsAt,
+    remainingSeconds: secondsUntil4(resetsAt, now),
+    state: "fresh"
+  };
+}
+function monthlyWindow(config, now) {
+  const resetsAt = new Date(config.periodEndMs).toISOString();
+  const days = Math.max(1, Math.round((config.periodEndMs - config.periodStartMs) / DAY_MS2));
+  return {
+    id: "thirty-day",
+    label: days === 30 || days === 31 ? "30 days" : `${days} days`,
+    scope: "all",
+    usedPercent: Math.round(Math.min(100, config.used / config.limit * 100) * 10) / 10,
+    windowMinutes: Math.round((config.periodEndMs - config.periodStartMs) / MINUTE_MS2),
+    resetsAt,
+    remainingSeconds: secondsUntil4(resetsAt, now),
+    state: "fresh"
+  };
+}
+function onDemandWindow(raw) {
+  const cap = onDemandAmount(raw["onDemandCap"]);
+  const used = onDemandAmount(raw["onDemandUsed"]);
+  if (cap === void 0 || cap <= 0 || used === void 0) return null;
+  return {
+    id: "on-demand",
+    label: "On-demand",
+    scope: "all",
+    usedPercent: Math.round(Math.min(100, used / cap * 100) * 10) / 10,
+    state: "fresh"
+  };
+}
+async function probeBilling(url, accessToken, accountId, fetchImpl) {
+  try {
+    const response = await fetchImpl(url, {
+      method: "GET",
+      headers: {
+        Authorization: `Bearer ${accessToken}`,
+        Accept: "application/json",
+        "X-XAI-Token-Auth": "xai-grok-cli"
+      },
+      redirect: "error",
+      signal: AbortSignal.timeout(15e3)
+    }, accountId);
+    if (!response.ok) return { status: response.status, payload: null };
+    const payload = await response.json();
+    return { status: response.status, payload: isRecord2(payload) ? payload : null };
+  } catch {
+    return { status: 0, payload: null };
+  }
+}
+function parseGrokBillingPayloads(creditsPayload, monthlyPayload, now) {
+  const creditsConfig = isRecord2(creditsPayload?.["config"]) ? creditsPayload["config"] : null;
+  const monthlyConfig = isRecord2(monthlyPayload?.["config"]) ? monthlyPayload["config"] : null;
+  let weekly = creditsConfig ? parseWeeklyConfig(creditsConfig) : null;
+  const unifiedFlag = creditsConfig?.["isUnifiedBillingUser"] === true;
+  let monthly = monthlyConfig ? parseMonthlyConfig(monthlyConfig) : null;
+  if (weekly?.inferredPercent && unifiedFlag) {
+    if (monthly) {
+      weekly = null;
+    } else if (!monthlyConfig || !confirmsNoMonthlyQuota(monthlyConfig)) {
+      weekly = null;
+    }
+  }
+  const windows = [];
+  if (weekly) windows.push(weeklyWindow(weekly, now));
+  if (monthly) windows.push(monthlyWindow(monthly, now));
+  const onDemandSource = monthly && monthlyConfig ? monthlyConfig : creditsConfig;
+  const onDemand = onDemandSource ? onDemandWindow(onDemandSource) : null;
+  if (onDemand) windows.push(onDemand);
+  return windows.length > 0 ? windows : null;
+}
+var GrokAllowanceCollector = class {
+  constructor(credentials, store = (0, import_AccountAllowanceStore4.getSharedAccountAllowanceStore)(), fetchImpl = (url, init, accountId) => (0, import_upstreamFetch4.fetchUpstream)(url, init, { providerId: "grok", accountId, redactBodies: true }), now = Date.now) {
+    this.credentials = credentials;
+    this.store = store;
+    this.fetchImpl = fetchImpl;
+    this.now = now;
+  }
+  credentials;
+  store;
+  fetchImpl;
+  now;
+  inFlight = /* @__PURE__ */ new Map();
+  async collectMany(accounts, options = {}) {
+    const settled = await Promise.allSettled(accounts.map((account) => this.collect(account, options)));
+    return settled.flatMap((result) => result.status === "fulfilled" ? [result.value] : []);
+  }
+  collect(account, options = {}) {
+    const now = this.now();
+    if (account.tokens.authMethod !== "oauth") {
+      const existing = this.store.get("grok", account.id, now);
+      if (existing?.windows.every((window) => window.state === "unsupported")) {
+        return Promise.resolve(existing);
+      }
+      const snapshot = this.unsupportedSnapshot(account.id, now);
+      this.store.set(snapshot);
+      return Promise.resolve(snapshot);
+    }
+    const cached = this.store.get("grok", account.id, now);
+    if (!options.force && cached && this.isCacheValid(cached, now, options.refreshAheadMs)) {
+      return Promise.resolve(cached);
+    }
+    const running = this.inFlight.get(account.id);
+    if (running) return running;
+    const promise = this.fetchAccount(account.id).catch(() => this.failureSnapshot(account.id, "grok_usage_request_failed", this.now())).finally(() => this.inFlight.delete(account.id));
+    this.inFlight.set(account.id, promise);
+    return promise;
+  }
+  isCacheValid(snapshot, now, refreshAheadMs) {
+    if (snapshot.windows.every((window) => window.state === "unsupported")) return true;
+    const expiresAt = snapshot.expiresAt ? Date.parse(snapshot.expiresAt) : 0;
+    const ahead = typeof refreshAheadMs === "number" && Number.isFinite(refreshAheadMs) ? Math.max(0, refreshAheadMs) : 0;
+    return Number.isFinite(expiresAt) && expiresAt > now + ahead;
+  }
+  async fetchAccount(accountId) {
+    const probe = async () => {
+      const accessToken = await this.credentials.getAccessTokenForAccount("grok", accountId);
+      if (!accessToken) return { unauthorized: true, windows: null };
+      const credits = await probeBilling(GROK_BILLING_CREDITS_URL, accessToken, accountId, this.fetchImpl);
+      if (credits.status === 401 || credits.status === 403) return { unauthorized: true, windows: null };
+      const creditsConfig = isRecord2(credits.payload?.["config"]) ? credits.payload["config"] : null;
+      const weekly = creditsConfig ? parseWeeklyConfig(creditsConfig) : null;
+      const monthly = !weekly || creditsConfig?.["isUnifiedBillingUser"] === true ? await probeBilling(GROK_BILLING_MONTHLY_URL, accessToken, accountId, this.fetchImpl) : { status: 200, payload: null };
+      if (monthly.status === 401 || monthly.status === 403) return { unauthorized: true, windows: null };
+      return {
+        unauthorized: false,
+        windows: parseGrokBillingPayloads(credits.payload, monthly.payload, this.now())
+      };
+    };
+    let result = await probe();
+    if (result.unauthorized) {
+      const refreshed = await this.credentials.refreshAccountToken("grok", accountId);
+      if (!refreshed) return this.failureSnapshot(accountId, "grok_usage_unauthorized", this.now());
+      result = await probe();
+      if (result.unauthorized) {
+        return this.failureSnapshot(accountId, "grok_usage_unauthorized", this.now());
+      }
+    }
+    const now = this.now();
+    if (result.windows && result.windows.length > 0) {
+      const snapshot = {
+        providerId: "grok",
+        accountId,
+        source: "oauth-usage-api",
+        observedAt: new Date(now).toISOString(),
+        expiresAt: new Date(now + GROK_ALLOWANCE_CACHE_MS).toISOString(),
+        windows: result.windows
+      };
+      this.store.set(snapshot);
+      return snapshot;
+    }
+    return this.failureSnapshot(accountId, "grok_usage_invalid_response", now);
+  }
+  failureSnapshot(accountId, code, now) {
+    const existing = this.store.get("grok", accountId, now);
+    const snapshot = existing ? {
+      ...existing,
+      expiresAt: new Date(now + GROK_ALLOWANCE_CACHE_MS).toISOString(),
+      windows: existing.windows.map((window) => ({
+        ...window,
+        state: window.state === "unsupported" ? "unsupported" : window.usedPercent !== null || window.resetsAt ? "stale" : "unavailable"
+      })),
+      lastErrorCode: code
+    } : {
+      providerId: "grok",
+      accountId,
+      source: "oauth-usage-api",
+      observedAt: new Date(now).toISOString(),
+      expiresAt: new Date(now + GROK_ALLOWANCE_CACHE_MS).toISOString(),
+      windows: [
+        { id: "seven-day", label: "7 days", scope: "all", usedPercent: null, state: "unavailable" },
+        { id: "thirty-day", label: "30 days", scope: "all", usedPercent: null, state: "unavailable" }
+      ],
+      lastErrorCode: code
+    };
+    this.store.set(snapshot);
+    return snapshot;
+  }
+  unsupportedSnapshot(accountId, now) {
+    return {
+      providerId: "grok",
+      accountId,
+      source: "oauth-usage-api",
+      observedAt: new Date(now).toISOString(),
+      windows: [
+        { id: "seven-day", label: "7 days", scope: "all", usedPercent: null, state: "unsupported" },
+        { id: "thirty-day", label: "30 days", scope: "all", usedPercent: null, state: "unsupported" }
+      ],
+      lastErrorCode: "grok_usage_unsupported_auth"
+    };
+  }
+};
+
+// src/allowance/CopilotAllowanceCollector.ts
+var import_AccountAllowanceStore5 = require("@omnicross/core/pipeline/AccountAllowanceStore");
+var import_upstreamFetch5 = require("@omnicross/core/pipeline/upstreamFetch");
+var import_subscriptions6 = require("@omnicross/subscriptions");
+var COPILOT_ALLOWANCE_CACHE_MS = 5 * 6e4;
+function isRecord3(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function finiteNumber4(value) {
+  if (value === null || value === void 0 || value === "") return void 0;
+  const parsed = typeof value === "number" ? value : Number(value);
+  return Number.isFinite(parsed) && parsed >= 0 ? parsed : void 0;
+}
+function booleanValue(value) {
+  if (typeof value === "boolean") return value;
+  if (value === "true") return true;
+  if (value === "false") return false;
+  return void 0;
+}
+function parseQuotaDetail(value) {
+  if (!isRecord3(value)) return null;
+  const entitlement = finiteNumber4(value["entitlement"]);
+  const remaining = finiteNumber4(value["remaining"]);
+  const percentRemaining = finiteNumber4(value["percent_remaining"]);
+  const unlimited = booleanValue(value["unlimited"]);
+  if (entitlement === void 0 || remaining === void 0 || percentRemaining === void 0 || unlimited === void 0) {
+    return null;
+  }
+  return { entitlement, remaining, percentRemaining, unlimited };
+}
+function secondsUntil5(instant, now) {
+  if (!instant) return void 0;
+  return Math.max(0, Math.floor((Date.parse(instant) - now) / 1e3));
+}
+function parseCopilotUserPayload(payload, now) {
+  if (!isRecord3(payload)) return null;
+  const snapshots = isRecord3(payload["quota_snapshots"]) ? payload["quota_snapshots"] : void 0;
+  if (!snapshots) return null;
+  const resetRaw = payload["quota_reset_date"];
+  const resetsAt = typeof resetRaw === "string" && resetRaw.trim() && Number.isFinite(Date.parse(resetRaw)) ? new Date(Date.parse(resetRaw)).toISOString() : void 0;
+  const windows = [];
+  const premium = parseQuotaDetail(snapshots["premium_interactions"]);
+  if (premium) {
+    const usedPercent = premium.unlimited ? 0 : premium.entitlement > 0 ? Math.round(Math.min(100, (premium.entitlement - premium.remaining) / premium.entitlement * 100) * 10) / 10 : finiteNumber4(premium.percentRemaining) !== void 0 ? Math.round(Math.min(100, Math.max(0, 100 - premium.percentRemaining)) * 10) / 10 : null;
+    if (usedPercent !== null) {
+      windows.push({
+        id: "thirty-day",
+        label: "Monthly",
+        scope: "all",
+        usedPercent,
+        windowMinutes: 30 * 24 * 60,
+        ...resetsAt !== void 0 ? { resetsAt } : {},
+        remainingSeconds: secondsUntil5(resetsAt, now),
+        state: "fresh"
+      });
+    }
+  }
+  const chat = parseQuotaDetail(snapshots["chat"]);
+  if (chat && !chat.unlimited && chat.entitlement > 0) {
+    const usedPercent = Math.round(Math.min(100, (chat.entitlement - chat.remaining) / chat.entitlement * 100) * 10) / 10;
+    windows.push({
+      id: "chat-monthly",
+      label: "Chat (monthly)",
+      scope: "all",
+      usedPercent,
+      windowMinutes: 30 * 24 * 60,
+      ...resetsAt !== void 0 ? { resetsAt } : {},
+      remainingSeconds: secondsUntil5(resetsAt, now),
+      state: "fresh"
+    });
+  }
+  return windows.length > 0 ? windows : null;
+}
+function githubApiBase(tokens) {
+  return (0, import_subscriptions6.copilotGitHubApiBase)(tokens.enterpriseUrl);
+}
+var CopilotAllowanceCollector = class {
+  constructor(credentials, store = (0, import_AccountAllowanceStore5.getSharedAccountAllowanceStore)(), fetchImpl = (url, init, accountId) => (0, import_upstreamFetch5.fetchUpstream)(url, init, { providerId: "copilot", accountId, redactBodies: true }), now = Date.now) {
+    this.credentials = credentials;
+    this.store = store;
+    this.fetchImpl = fetchImpl;
+    this.now = now;
+  }
+  credentials;
+  store;
+  fetchImpl;
+  now;
+  inFlight = /* @__PURE__ */ new Map();
+  async collectMany(accounts, options = {}) {
+    const settled = await Promise.allSettled(
+      accounts.map((account) => this.collect(account, options))
+    );
+    return settled.flatMap((result) => result.status === "fulfilled" ? [result.value] : []);
+  }
+  collect(account, options = {}) {
+    const now = this.now();
+    if (account.tokens.authMethod !== "oauth") {
+      const existing = this.store.get("copilot", account.id, now);
+      if (existing?.windows.every((window) => window.state === "unsupported")) {
+        return Promise.resolve(existing);
+      }
+      const snapshot = this.unsupportedSnapshot(account.id, now);
+      this.store.set(snapshot);
+      return Promise.resolve(snapshot);
+    }
+    const cached = this.store.get("copilot", account.id, now);
+    if (!options.force && cached && this.isCacheValid(cached, now, options.refreshAheadMs)) {
+      return Promise.resolve(cached);
+    }
+    const running = this.inFlight.get(account.id);
+    if (running) return running;
+    const promise = this.fetchAccount(account.id, account.tokens).catch(() => this.failureSnapshot(account.id, "copilot_usage_request_failed", this.now())).finally(() => this.inFlight.delete(account.id));
+    this.inFlight.set(account.id, promise);
+    return promise;
+  }
+  isCacheValid(snapshot, now, refreshAheadMs) {
+    if (snapshot.windows.every((window) => window.state === "unsupported")) return true;
+    const expiresAt = snapshot.expiresAt ? Date.parse(snapshot.expiresAt) : 0;
+    const ahead = typeof refreshAheadMs === "number" && Number.isFinite(refreshAheadMs) ? Math.max(0, refreshAheadMs) : 0;
+    return Number.isFinite(expiresAt) && expiresAt > now + ahead;
+  }
+  async fetchAccount(accountId, tokens) {
+    let accessToken = await this.credentials.getAccessTokenForAccount("copilot", accountId);
+    if (!accessToken) return this.failureSnapshot(accountId, "copilot_usage_token_unavailable", this.now());
+    let response = await this.request(accountId, accessToken, tokens);
+    if (response.status === 401 || response.status === 403) {
+      const refreshed = await this.credentials.refreshAccountToken("copilot", accountId);
+      if (!refreshed) return this.failureSnapshot(accountId, "copilot_usage_unauthorized", this.now());
+      accessToken = await this.credentials.getAccessTokenForAccount("copilot", accountId);
+      if (!accessToken) return this.failureSnapshot(accountId, "copilot_usage_token_unavailable", this.now());
       response = await this.request(accountId, accessToken, tokens);
+      if (response.status === 401 || response.status === 403) {
+        return this.failureSnapshot(accountId, "copilot_usage_unauthorized", this.now());
+      }
     }
-    if (response.status === 403) {
-      const snapshot2 = this.unsupportedSnapshot(accountId, this.now(), "kimi_usage_unsupported");
-      this.store.set(snapshot2);
-      return snapshot2;
-    }
-    if (!response.ok) return this.failureSnapshot(accountId, "kimi_usage_http_error", this.now());
+    if (!response.ok) return this.failureSnapshot(accountId, "copilot_usage_http_error", this.now());
     let payload;
     try {
       payload = await response.json();
     } catch {
-      return this.failureSnapshot(accountId, "kimi_usage_invalid_response", this.now());
+      return this.failureSnapshot(accountId, "copilot_usage_invalid_response", this.now());
     }
     const now = this.now();
-    const windows = parseKimiUsagePayload(payload, now);
+    const windows = parseCopilotUserPayload(payload, now);
     const snapshot = {
-      providerId: "kimi",
+      providerId: "copilot",
       accountId,
       source: "oauth-usage-api",
       observedAt: new Date(now).toISOString(),
-      expiresAt: new Date(now + KIMI_ALLOWANCE_CACHE_MS).toISOString(),
-      windows: windows.length > 0 ? windows : [
-        { id: "five-hour", label: "5 hours", scope: "all", usedPercent: null, state: "unavailable" },
-        { id: "seven-day", label: "7 days", scope: "all", usedPercent: null, state: "unavailable" }
+      expiresAt: new Date(now + COPILOT_ALLOWANCE_CACHE_MS).toISOString(),
+      windows: windows ?? [
+        { id: "thirty-day", label: "Monthly", scope: "all", usedPercent: null, state: "unavailable" }
       ],
-      ...windows.length > 0 ? {} : { lastErrorCode: "kimi_usage_invalid_response" }
+      ...windows ? {} : { lastErrorCode: "copilot_usage_invalid_response" }
     };
     this.store.set(snapshot);
     return snapshot;
   }
   request(accountId, accessToken, tokens) {
-    return this.fetchImpl(KIMI_USAGE_URL, {
+    return this.fetchImpl(`${githubApiBase(tokens)}/copilot_internal/user`, {
       method: "GET",
       headers: {
         Authorization: `Bearer ${accessToken}`,
         Accept: "application/json",
-        ...(0, import_subscriptions3.kimiFingerprintHeaders)(tokens.deviceId)
+        "Content-Type": "application/json",
+        ...import_subscriptions6.COPILOT_GITHUB_HEADERS
       },
       signal: AbortSignal.timeout(15e3)
     }, accountId);
   }
   failureSnapshot(accountId, code, now) {
-    const existing = this.store.get("kimi", accountId, now);
+    const existing = this.store.get("copilot", accountId, now);
     const snapshot = existing ? {
       ...existing,
-      expiresAt: new Date(now + KIMI_ALLOWANCE_CACHE_MS).toISOString(),
+      expiresAt: new Date(now + COPILOT_ALLOWANCE_CACHE_MS).toISOString(),
       windows: existing.windows.map((window) => ({
         ...window,
         state: window.state === "unsupported" ? "unsupported" : window.usedPercent !== null || window.resetsAt ? "stale" : "unavailable"
       })),
       lastErrorCode: code
     } : {
-      providerId: "kimi",
+      providerId: "copilot",
       accountId,
       source: "oauth-usage-api",
       observedAt: new Date(now).toISOString(),
-      expiresAt: new Date(now + KIMI_ALLOWANCE_CACHE_MS).toISOString(),
+      expiresAt: new Date(now + COPILOT_ALLOWANCE_CACHE_MS).toISOString(),
       windows: [
-        { id: "five-hour", label: "5 hours", scope: "all", usedPercent: null, state: "unavailable" },
-        { id: "seven-day", label: "7 days", scope: "all", usedPercent: null, state: "unavailable" }
+        { id: "thirty-day", label: "Monthly", scope: "all", usedPercent: null, state: "unavailable" }
       ],
       lastErrorCode: code
     };
     this.store.set(snapshot);
     return snapshot;
   }
-  unsupportedSnapshot(accountId, now, code = "kimi_usage_unsupported_auth") {
+  unsupportedSnapshot(accountId, now) {
     return {
-      providerId: "kimi",
+      providerId: "copilot",
       accountId,
       source: "oauth-usage-api",
       observedAt: new Date(now).toISOString(),
       windows: [
-        { id: "five-hour", label: "5 hours", scope: "all", usedPercent: null, state: "unsupported" },
-        { id: "seven-day", label: "7 days", scope: "all", usedPercent: null, state: "unsupported" }
+        { id: "thirty-day", label: "Monthly", scope: "all", usedPercent: null, state: "unsupported" }
       ],
-      lastErrorCode: code
+      lastErrorCode: "copilot_usage_unsupported_auth"
     };
   }
 };
 
 // src/allowance/OpenCodeGoAllowanceCollector.ts
-var import_AccountAllowanceStore4 = require("@omnicross/core/pipeline/AccountAllowanceStore");
-var import_upstreamFetch4 = require("@omnicross/core/pipeline/upstreamFetch");
-var import_subscriptions4 = require("@omnicross/subscriptions");
+var import_AccountAllowanceStore6 = require("@omnicross/core/pipeline/AccountAllowanceStore");
+var import_upstreamFetch6 = require("@omnicross/core/pipeline/upstreamFetch");
+var import_subscriptions7 = require("@omnicross/subscriptions");
 var OPENCODEGO_ALLOWANCE_CACHE_MS = 5 * 6e4;
 var OPENCODEGO_DEFAULT_GO_BASE = "https://opencode.ai/zen/go";
 function finitePercent3(value) {
@@ -2097,7 +2751,7 @@ function isoInstant2(value) {
   const time = Date.parse(value);
   return Number.isFinite(time) ? new Date(time).toISOString() : void 0;
 }
-function secondsUntil4(instant, now) {
+function secondsUntil6(instant, now) {
   if (!instant) return void 0;
   return Math.max(0, Math.floor((Date.parse(instant) - now) / 1e3));
 }
@@ -2112,12 +2766,12 @@ function windowFromPayload3(id, label, minutes, payload, now) {
     usedPercent,
     windowMinutes: minutes,
     ...resetsAt !== void 0 ? { resetsAt } : {},
-    remainingSeconds: secondsUntil4(resetsAt, now),
+    remainingSeconds: secondsUntil6(resetsAt, now),
     state: usedPercent !== null || resetsAt ? "fresh" : "unavailable"
   };
 }
 var OpenCodeGoAllowanceCollector = class {
-  constructor(credentials, store = (0, import_AccountAllowanceStore4.getSharedAccountAllowanceStore)(), fetchImpl = (url, init, accountId) => (0, import_upstreamFetch4.fetchUpstream)(url, init, { providerId: "opencodego", accountId, redactBodies: true }), now = Date.now) {
+  constructor(credentials, store = (0, import_AccountAllowanceStore6.getSharedAccountAllowanceStore)(), fetchImpl = (url, init, accountId) => (0, import_upstreamFetch6.fetchUpstream)(url, init, { providerId: "opencodego", accountId, redactBodies: true }), now = Date.now) {
     this.credentials = credentials;
     this.store = store;
     this.fetchImpl = fetchImpl;
@@ -2147,7 +2801,7 @@ var OpenCodeGoAllowanceCollector = class {
   async fetchAccount(account) {
     const apiKey = await this.credentials.getAccessTokenForAccount("opencodego", account.id);
     if (!apiKey) return this.failureSnapshot(account.id, this.now());
-    const base = account.tokens.baseUrl ? (0, import_subscriptions4.normalizeOpenCodeGoBaseUrl)(account.tokens.baseUrl) : OPENCODEGO_DEFAULT_GO_BASE;
+    const base = account.tokens.baseUrl ? (0, import_subscriptions7.normalizeOpenCodeGoBaseUrl)(account.tokens.baseUrl) : OPENCODEGO_DEFAULT_GO_BASE;
     const response = await this.fetchImpl(`${base}/v1/usage`, {
       method: "GET",
       headers: { Authorization: `Bearer ${apiKey}`, Accept: "application/json" },
@@ -2222,7 +2876,7 @@ function codexUnavailable(accountId, now) {
   };
 }
 var AccountAllowanceService = class {
-  constructor(credentials, store = (0, import_AccountAllowanceStore5.getSharedAccountAllowanceStore)(), collector, codexCollector, kimiCollector, opencodegoCollector, now = Date.now) {
+  constructor(credentials, store = (0, import_AccountAllowanceStore7.getSharedAccountAllowanceStore)(), collector, codexCollector, kimiCollector, opencodegoCollector, grokCollector, copilotCollector, now = Date.now) {
     this.credentials = credentials;
     this.store = store;
     this.now = now;
@@ -2230,6 +2884,8 @@ var AccountAllowanceService = class {
     this.codexCollector = codexCollector ?? new CodexAllowanceCollector(credentials, store);
     this.kimiCollector = kimiCollector ?? new KimiAllowanceCollector(credentials, store);
     this.opencodegoCollector = opencodegoCollector ?? new OpenCodeGoAllowanceCollector(credentials, store);
+    this.grokCollector = grokCollector ?? new GrokAllowanceCollector(credentials, store);
+    this.copilotCollector = copilotCollector ?? new CopilotAllowanceCollector(credentials, store);
   }
   credentials;
   store;
@@ -2237,6 +2893,8 @@ var AccountAllowanceService = class {
   claudeCollector;
   codexCollector;
   kimiCollector;
+  grokCollector;
+  copilotCollector;
   opencodegoCollector;
   /**
    * Read all/filtered snapshots. Claude's and Codex's five-minute caches are
@@ -2271,11 +2929,23 @@ var AccountAllowanceService = class {
       (account) => !filter.accountId || account.id === filter.accountId
     );
     if (wantsOpenCodeGo) await this.opencodegoCollector.collectMany(opencodegoAccounts);
+    const wantsGrok = !filter.providerId || filter.providerId === "grok";
+    const grokAccounts = (config.grokAccounts ?? []).filter(
+      (account) => !filter.accountId || account.id === filter.accountId
+    );
+    if (wantsGrok) await this.grokCollector.collectMany(grokAccounts);
+    const wantsCopilot = !filter.providerId || filter.providerId === "copilot";
+    const copilotAccounts = (config.copilotAccounts ?? []).filter(
+      (account) => !filter.accountId || account.id === filter.accountId
+    );
+    if (wantsCopilot) await this.copilotCollector.collectMany(copilotAccounts);
     const known = /* @__PURE__ */ new Set();
     if (wantsClaude) for (const account of claudeAccounts) known.add(`claude\0${account.id}`);
     if (wantsCodex) for (const account of codexAccounts) known.add(`codex\0${account.id}`);
     if (wantsKimi) for (const account of kimiAccounts) known.add(`kimi\0${account.id}`);
     if (wantsOpenCodeGo) for (const account of opencodegoAccounts) known.add(`opencodego\0${account.id}`);
+    if (wantsGrok) for (const account of grokAccounts) known.add(`grok\0${account.id}`);
+    if (wantsCopilot) for (const account of copilotAccounts) known.add(`copilot\0${account.id}`);
     return this.store.list(filter).filter((snapshot) => known.has(`${snapshot.providerId}\0${snapshot.accountId}`));
   }
   knownAccounts(config) {
@@ -2283,7 +2953,9 @@ var AccountAllowanceService = class {
       ...(config.claudeAccounts ?? []).map((account) => ({ providerId: "claude", accountId: account.id })),
       ...(config.codexAccounts ?? []).map((account) => ({ providerId: "codex", accountId: account.id })),
       ...(config.kimiAccounts ?? []).map((account) => ({ providerId: "kimi", accountId: account.id })),
-      ...(config.opencodegoAccounts ?? []).map((account) => ({ providerId: "opencodego", accountId: account.id }))
+      ...(config.opencodegoAccounts ?? []).map((account) => ({ providerId: "opencodego", accountId: account.id })),
+      ...(config.grokAccounts ?? []).map((account) => ({ providerId: "grok", accountId: account.id })),
+      ...(config.copilotAccounts ?? []).map((account) => ({ providerId: "copilot", accountId: account.id }))
     ];
   }
   /** Force-refresh Claude usage for one account or every stored Claude account. */
@@ -2326,6 +2998,24 @@ var AccountAllowanceService = class {
     );
     return this.kimiCollector.collectMany(accounts, { force: true });
   }
+  /** Force-refresh Copilot usage (copilot_internal/user) for one/all accounts. */
+  async refreshCopilot(accountId) {
+    const config = await this.credentials.getFullConfig();
+    this.store.pruneToKnownAccounts(this.knownAccounts(config));
+    const accounts = (config.copilotAccounts ?? []).filter(
+      (account) => !accountId || account.id === accountId
+    );
+    return this.copilotCollector.collectMany(accounts, { force: true });
+  }
+  /** Force-refresh Grok usage (CLI billing proxy) for one/all accounts. */
+  async refreshGrok(accountId) {
+    const config = await this.credentials.getFullConfig();
+    this.store.pruneToKnownAccounts(this.knownAccounts(config));
+    const accounts = (config.grokAccounts ?? []).filter(
+      (account) => !accountId || account.id === accountId
+    );
+    return this.grokCollector.collectMany(accounts, { force: true });
+  }
   /**
    * Keep Claude + Codex + Kimi snapshots warm for allowance-aware routing. All
    * collectors preserve their cache + per-account in-flight coalescing; a tick
@@ -2340,6 +3030,8 @@ var AccountAllowanceService = class {
     await this.codexCollector.collectMany(config.codexAccounts ?? [], { refreshAheadMs });
     await this.kimiCollector.collectMany(config.kimiAccounts ?? [], { refreshAheadMs });
     await this.opencodegoCollector.collectMany(config.opencodegoAccounts ?? [], { refreshAheadMs });
+    await this.grokCollector.collectMany(config.grokAccounts ?? [], { refreshAheadMs });
+    await this.copilotCollector.collectMany(config.copilotAccounts ?? [], { refreshAheadMs });
   }
   /** Remove a cache row as soon as an account is deleted by the admin path. */
   removeAccountSnapshot(providerId, accountId) {
@@ -2434,7 +3126,7 @@ var ClaudeAllowanceRefreshScheduler = class {
 var import_node_crypto4 = require("crypto");
 var import_node_fs6 = require("fs");
 var import_node_path6 = require("path");
-var import_AccountAllowanceStore6 = require("@omnicross/core/pipeline/AccountAllowanceStore");
+var import_AccountAllowanceStore8 = require("@omnicross/core/pipeline/AccountAllowanceStore");
 var ACCOUNT_ALLOWANCE_CACHE_VERSION = 1;
 var MAX_PERSISTED_ALLOWANCE_SNAPSHOTS = 256;
 var MAX_ALLOWANCE_CACHE_BYTES = 1e6;
@@ -2463,7 +3155,7 @@ var JsonAccountAllowancePersistence = class {
   save(snapshots) {
     const rows = [];
     for (const snapshot of snapshots) {
-      const normalized2 = (0, import_AccountAllowanceStore6.normalizeAccountAllowanceSnapshot)(snapshot);
+      const normalized2 = (0, import_AccountAllowanceStore8.normalizeAccountAllowanceSnapshot)(snapshot);
       if (!normalized2) continue;
       rows.push(normalized2);
       if (rows.length >= MAX_PERSISTED_ALLOWANCE_SNAPSHOTS) break;
@@ -2739,7 +3431,8 @@ var import_outbound_api5 = require("@omnicross/core/outbound-api");
 var import_image_generation_types = require("@omnicross/contracts/image-generation-types");
 var import_AccountAllowanceScheduling2 = require("@omnicross/core/pipeline/AccountAllowanceScheduling");
 var import_SubscriptionAccountHealth = require("@omnicross/core/pipeline/SubscriptionAccountHealth");
-var import_upstreamFetch7 = require("@omnicross/core/pipeline/upstreamFetch");
+var import_upstreamFetch9 = require("@omnicross/core/pipeline/upstreamFetch");
+var import_core3 = require("@omnicross/core");
 
 // src/image-generation/imagesConfigValidation.ts
 var import_outbound_api = require("@omnicross/core/outbound-api");
@@ -3035,6 +3728,7 @@ async function applyServerConfigTransaction(current, next, deps) {
 
 // src/config.ts
 var import_node_fs8 = require("fs");
+var import_core = require("@omnicross/core");
 var DEFAULT_ADMIN_PORT = 8766;
 function validateAdmin(raw) {
   if (!raw || typeof raw !== "object" || Array.isArray(raw)) return void 0;
@@ -3091,6 +3785,18 @@ var FORMAT_AXIS_TRANSFORMERS = [
   "openai-response",
   "gemini-code-assist"
 ];
+function validateExtraHeaders(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return void 0;
+  const reserved = import_core.EXTRA_HEADER_RESERVED_NAMES;
+  const out = {};
+  for (const [name, value] of Object.entries(raw)) {
+    if (!name.trim()) continue;
+    if (typeof value !== "string") continue;
+    if (reserved.has(name.toLowerCase())) continue;
+    out[name] = value;
+  }
+  return Object.keys(out).length > 0 ? out : void 0;
+}
 function validateApiKeys(raw) {
   if (!Array.isArray(raw)) return void 0;
   const out = [];
@@ -3304,6 +4010,9 @@ function validateProvider(raw, index) {
     apiVersion,
     maxConcurrency,
     modelsEndpoint,
+    // Static extra headers: load-guard (reserved names dropped), collapse-to-
+    // undefined; enforced by the outbound header funnel + admin probes.
+    extraHeaders: validateExtraHeaders(p["extraHeaders"]),
     // Provider transformer config (app-parity child 5): load-guard, collapse-to-
     // undefined; non-secret; ENFORCED via resolveTransformerChain (parity-2 child 2).
     // Format-axis entries are stripped by `migrateFormatAxis` — `use[]` is the
@@ -3373,7 +4082,7 @@ var import_node_crypto6 = require("crypto");
 var import_node_fs10 = require("fs");
 var import_node_os3 = require("os");
 var import_node_path10 = require("path");
-var import_core = require("@omnicross/core");
+var import_core2 = require("@omnicross/core");
 
 // src/integrations/codexAuthHelper.ts
 var import_node_path8 = require("path");
@@ -3854,7 +4563,7 @@ var IntegrationManager = class {
     if (!secret) {
       throw new IntegrationConflictError("The selected access key cannot be revealed and cannot power a CLI integration.");
     }
-    const effective = [...(0, import_core.effectiveOutboundPermissions)(row.allowedEndpoints)];
+    const effective = [...(0, import_core2.effectiveOutboundPermissions)(row.allowedEndpoints)];
     const previousPermissions = row.allowedEndpoints === void 0 ? [...effective] : [...row.allowedEndpoints];
     const nextPermissions = [...effective];
     for (const required of REQUIRED_PERMISSIONS[client]) {
@@ -3952,7 +4661,7 @@ var IntegrationManager = class {
     return { binding, row, secret, created: false };
   }
   async createManagedClientKey(client, state) {
-    const created = await (0, import_core.createIntegrationKey)(
+    const created = await (0, import_core2.createIntegrationKey)(
       this.options.keyDb,
       `Omnicross ${displayClient(client)} integration`,
       [...REQUIRED_PERMISSIONS[client]]
@@ -4044,7 +4753,7 @@ var IntegrationManager = class {
     const row = rows.find((candidate) => candidate.id === keyId);
     if (!row) return { usable: false, message: "The bound access key no longer exists." };
     const secret = legacy?.secret ?? await this.options.keyDb.outboundApiKeysReveal(keyId) ?? void 0;
-    const allowedEndpoints = [...(0, import_core.effectiveOutboundPermissions)(row.allowedEndpoints)];
+    const allowedEndpoints = [...(0, import_core2.effectiveOutboundPermissions)(row.allowedEndpoints)];
     const status = {
       id: row.id,
       name: row.name,
@@ -4088,7 +4797,7 @@ var IntegrationManager = class {
   }
 };
 function hasRequiredPermissions(row, client) {
-  const allowed = (0, import_core.effectiveOutboundPermissions)(row.allowedEndpoints);
+  const allowed = (0, import_core2.effectiveOutboundPermissions)(row.allowedEndpoints);
   return REQUIRED_PERMISSIONS[client].every((permission) => allowed.includes(permission));
 }
 function samePermissions(a, b) {
@@ -4257,7 +4966,10 @@ function mapPresetToProvider(preset, opts) {
     apiFormat: resolved.format,
     baseUrl: opts.baseUrlOverride ?? preset.api_base_url,
     apiKey: opts.key,
-    models: Array.isArray(preset.models) ? preset.models : void 0
+    models: Array.isArray(preset.models) ? preset.models : void 0,
+    // Static identity headers (e.g. the Cline client set) survive the mapping —
+    // the CLI-seeded row needs them as much as an admin-API-created one.
+    extraHeaders: preset.extraHeaders
   };
   return { provider };
 }
@@ -4282,7 +4994,8 @@ function listMappablePresets() {
       description: preset.description,
       features: preset.features,
       website: preset.website,
-      modelsEndpoint: preset.modelsEndpoint
+      modelsEndpoint: preset.modelsEndpoint,
+      extraHeaders: preset.extraHeaders
     });
   }
   return { mappable, excluded };
@@ -4372,11 +5085,11 @@ function preserveOutboundProxySecrets(incoming, current) {
 }
 
 // src/proxy/upstreamProxyResolver.ts
-var import_upstreamFetch5 = require("@omnicross/core/pipeline/upstreamFetch");
+var import_upstreamFetch7 = require("@omnicross/core/pipeline/upstreamFetch");
 var serverProxy;
 function setServerProxyConfig(proxy) {
   serverProxy = proxy;
-  (0, import_upstreamFetch5.bumpUpstreamProxyGeneration)();
+  (0, import_upstreamFetch7.bumpUpstreamProxyGeneration)();
 }
 function getServerProxyConfig() {
   return serverProxy;
@@ -4444,7 +5157,7 @@ function createUpstreamProxyResolver(src = {}) {
 }
 
 // src/admin/accountsOAuth.ts
-var import_subscriptions5 = require("@omnicross/subscriptions");
+var import_subscriptions8 = require("@omnicross/subscriptions");
 
 // src/admin/accountsWrite.ts
 var VALID_PROVIDER_IDS = [
@@ -4452,7 +5165,9 @@ var VALID_PROVIDER_IDS = [
   "codex",
   "gemini",
   "opencodego",
-  "kimi"
+  "kimi",
+  "grok",
+  "copilot"
 ];
 function asSubscriptionProviderId(id) {
   return VALID_PROVIDER_IDS.includes(id) ? id : null;
@@ -4600,6 +5315,40 @@ function validateKimi(body) {
   copyOptional(out, body, ["accessToken", "refreshToken", "expiresAt", "accountId", "deviceId", "lastRefreshedAt", "errorMessage"]);
   return out;
 }
+function validateGrok(body) {
+  const authMethod = str(body["authMethod"]);
+  const status = str(body["status"]);
+  if (!authMethod || !OAUTH_AUTH_METHODS.has(authMethod)) return null;
+  if (!status || !TOKEN_STATUSES.has(status)) return null;
+  const out = {
+    authMethod,
+    status
+  };
+  copyOptional(out, body, ["accessToken", "refreshToken", "expiresAt", "accountId", "lastRefreshedAt", "errorMessage"]);
+  return out;
+}
+function validateCopilot(body) {
+  const authMethod = str(body["authMethod"]);
+  const status = str(body["status"]);
+  if (!authMethod || !OAUTH_AUTH_METHODS.has(authMethod)) return null;
+  if (!status || !TOKEN_STATUSES.has(status)) return null;
+  const out = {
+    authMethod,
+    status
+  };
+  copyOptional(out, body, [
+    "accessToken",
+    "refreshToken",
+    "expiresAt",
+    "accountId",
+    "email",
+    "apiEndpoint",
+    "enterpriseUrl",
+    "lastRefreshedAt",
+    "errorMessage"
+  ]);
+  return out;
+}
 function validateOpenCodeGo(body) {
   const authMethod = str(body["authMethod"]);
   const status = str(body["status"]);
@@ -4637,6 +5386,10 @@ function validateTokenBody(providerId, body) {
       return validateOpenCodeGo(body);
     case "kimi":
       return validateKimi(body);
+    case "grok":
+      return validateGrok(body);
+    case "copilot":
+      return validateCopilot(body);
     default:
       return null;
   }
@@ -4666,37 +5419,37 @@ async function statusEntryFor(reader, providerId) {
 
 // src/admin/accountsOAuth.ts
 var OAUTH_HTTP_PROVIDERS = /* @__PURE__ */ new Set(["claude", "gemini"]);
-function err3(status, message) {
+function err5(status, message) {
   return { status, body: { error: { type: "admin_api_error", message } } };
 }
 function handleOAuthStart(providerId, deps) {
   if (!OAUTH_HTTP_PROVIDERS.has(providerId)) {
-    return err3(400, `oauth not available for provider '${providerId}'`);
+    return err5(400, `oauth not available for provider '${providerId}'`);
   }
-  const flow = providerId === "claude" ? import_subscriptions5.claudeOAuth : import_subscriptions5.geminiOAuth;
+  const flow = providerId === "claude" ? import_subscriptions8.claudeOAuth : import_subscriptions8.geminiOAuth;
   const { authUrl, codeVerifier, state } = flow.generateAuthParams();
   const sessionId = deps.oauthSessions.put({ providerId, codeVerifier, state });
   return { status: 200, body: { authUrl, sessionId } };
 }
 async function handleOAuthComplete(providerId, body, deps) {
   if (!OAUTH_HTTP_PROVIDERS.has(providerId)) {
-    return err3(400, `oauth not available for provider '${providerId}'`);
+    return err5(400, `oauth not available for provider '${providerId}'`);
   }
   const sessionId = typeof body["sessionId"] === "string" ? body["sessionId"] : "";
   const rawCode = typeof body["code"] === "string" ? body["code"] : "";
-  if (!sessionId) return err3(400, "oauth complete requires { sessionId }");
-  if (!rawCode) return err3(400, "oauth complete requires { code }");
+  if (!sessionId) return err5(400, "oauth complete requires { sessionId }");
+  if (!rawCode) return err5(400, "oauth complete requires { code }");
   const session = deps.oauthSessions.peek(sessionId);
-  if (!session) return err3(410, "oauth session is unknown, expired, or already used");
+  if (!session) return err5(410, "oauth session is unknown, expired, or already used");
   if (session.providerId !== providerId) {
-    return err3(400, `oauth session does not match provider '${providerId}'`);
+    return err5(400, `oauth session does not match provider '${providerId}'`);
   }
   let code = rawCode.trim();
   if (providerId === "claude") {
     const [splitCode, pastedState] = code.split("#");
-    if (!splitCode) return err3(400, "no authorization code was provided");
+    if (!splitCode) return err5(400, "no authorization code was provided");
     if (pastedState && pastedState !== session.state) {
-      return err3(400, "oauth state did not match (possible CSRF) \u2014 aborting");
+      return err5(400, "oauth state did not match (possible CSRF) \u2014 aborting");
     }
     code = splitCode;
   }
@@ -4706,7 +5459,7 @@ async function handleOAuthComplete(providerId, body, deps) {
     block = providerId === "claude" ? await exchangeClaude(code, session.codeVerifier, session.state, exchangeFetch) : await exchangeGemini(code, session.codeVerifier, exchangeFetch);
   } catch (exchangeError) {
     const reason = exchangeError instanceof Error ? exchangeError.message : "token exchange failed";
-    return err3(502, `oauth token exchange failed for '${providerId}': ${reason}`);
+    return err5(502, `oauth token exchange failed for '${providerId}': ${reason}`);
   }
   deps.oauthSessions.consume(sessionId);
   const label = typeof body["label"] === "string" && body["label"].trim() ? body["label"].trim() : void 0;
@@ -4715,7 +5468,7 @@ async function handleOAuthComplete(providerId, body, deps) {
   return { status: 200, body: status ? { account: status } : { ok: true } };
 }
 async function exchangeClaude(code, codeVerifier, state, exchangeFetch) {
-  const result = await import_subscriptions5.claudeOAuth.exchangeCodeForTokens(
+  const result = await import_subscriptions8.claudeOAuth.exchangeCodeForTokens(
     { authorizationCode: code, codeVerifier, state },
     exchangeFetch
   );
@@ -4731,7 +5484,7 @@ async function exchangeClaude(code, codeVerifier, state, exchangeFetch) {
   };
 }
 async function exchangeGemini(code, codeVerifier, exchangeFetch) {
-  const result = await import_subscriptions5.geminiOAuth.exchangeCodeForTokens(code, codeVerifier, exchangeFetch);
+  const result = await import_subscriptions8.geminiOAuth.exchangeCodeForTokens(code, codeVerifier, exchangeFetch);
   const expiresAt = new Date(Date.now() + result.expiresIn * 1e3).toISOString();
   return {
     authMethod: "oauth",
@@ -5036,8 +5789,8 @@ function errBody(message) {
   return { error: { type: "admin_api_error", message } };
 }
 var defaultCommandRunner = (command) => new Promise((resolve11) => {
-  (0, import_node_child_process.exec)(command, { timeout: 18e4 }, (err6, _stdout, stderr) => {
-    if (err6) resolve11({ ok: false, error: stderr.trim() || err6.message });
+  (0, import_node_child_process.exec)(command, { timeout: 18e4 }, (err8, _stdout, stderr) => {
+    if (err8) resolve11({ ok: false, error: stderr.trim() || err8.message });
     else resolve11({ ok: true });
   });
 });
@@ -5083,8 +5836,8 @@ async function handleCliLaunch(cli, body, ctx) {
       providerId: typeof body["providerId"] === "string" ? body["providerId"] : void 0,
       model: typeof body["model"] === "string" ? body["model"] : void 0
     });
-  } catch (err6) {
-    return { status: 400, body: errBody(err6 instanceof Error ? err6.message : "no launch target") };
+  } catch (err8) {
+    return { status: 400, body: errBody(err8 instanceof Error ? err8.message : "no launch target") };
   }
   const id = (0, import_node_crypto7.randomUUID)();
   let leaseId2;
@@ -5112,9 +5865,9 @@ async function handleCliLaunch(cli, body, ctx) {
     } else {
       launch = await buildLaunchEnv(cli, ctx.llmConfig, target);
     }
-  } catch (err6) {
-    const status = err6 instanceof import_provider_proxy2.RouteLeaseError ? err6.status : 400;
-    return { status, body: errBody(err6 instanceof Error ? err6.message : "failed to build launch env") };
+  } catch (err8) {
+    const status = err8 instanceof import_provider_proxy2.RouteLeaseError ? err8.status : 400;
+    return { status, body: errBody(err8 instanceof Error ? err8.message : "failed to build launch env") };
   }
   const cwd = typeof body["cwd"] === "string" && body["cwd"].trim() ? body["cwd"].trim() : void 0;
   const opener = ctx.opener ?? defaultTerminalOpener;
@@ -5142,9 +5895,9 @@ async function handleCliLaunch(cli, body, ctx) {
       onFailure: onSessionEnd
     });
     if (cleanup) openerCleanup = cleanup;
-  } catch (err6) {
+  } catch (err8) {
     onSessionEnd();
-    return { status: 500, body: errBody(err6 instanceof Error ? err6.message : "failed to open terminal") };
+    return { status: 500, body: errBody(err8 instanceof Error ? err8.message : "failed to open terminal") };
   }
   if (ended) {
     openerCleanup?.();
@@ -5399,7 +6152,7 @@ async function runSearchLiveChecks(contributions, now = () => (/* @__PURE__ */ n
 }
 
 // src/search/SearchAssembly.ts
-var import_upstreamFetch6 = require("@omnicross/core/pipeline/upstreamFetch");
+var import_upstreamFetch8 = require("@omnicross/core/pipeline/upstreamFetch");
 var import_search = require("@omnicross/core/search");
 var import_api2 = require("@omnicross/core/search/api");
 var import_http2 = require("@omnicross/core/search/http");
@@ -5417,7 +6170,7 @@ function searchPolicyFrom(config) {
   };
 }
 function resolveSearchUpstreamDispatcher(url) {
-  return (0, import_upstreamFetch6.resolveUpstreamDispatcher)({ url });
+  return (0, import_upstreamFetch8.resolveUpstreamDispatcher)({ url });
 }
 var searchUpstreamProxyConfig = createUpstreamProxyResolver();
 function resolveSearchUpstreamProxyConfig(url) {
@@ -5699,7 +6452,7 @@ async function handleSearchQuery(req, res, deps) {
 // src/admin/searchAdminView.ts
 var API_KEY_PROVIDERS = /* @__PURE__ */ new Set(["tavily", "jina", "zhipu", "z.ai"]);
 var BASIC_AUTH_PROVIDERS = /* @__PURE__ */ new Set(["searxng"]);
-function isRecord2(value) {
+function isRecord4(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function redactSearchServerConfig(search) {
@@ -5749,13 +6502,13 @@ function resolveSecretField(entry, field, stored) {
   else delete entry[field];
 }
 function preserveSearchSecrets(incoming, current) {
-  if (!isRecord2(incoming)) return incoming;
+  if (!isRecord4(incoming)) return incoming;
   const section = { ...incoming };
   const providersValue = section["providers"];
-  if (!isRecord2(providersValue)) return section;
+  if (!isRecord4(providersValue)) return section;
   const providers = {};
   for (const [id, entryValue] of Object.entries(providersValue)) {
-    if (!isRecord2(entryValue)) {
+    if (!isRecord4(entryValue)) {
       providers[id] = entryValue;
       continue;
     }
@@ -5833,7 +6586,7 @@ function parseKeyPolicyBody(body) {
 var ENDPOINTS = /* @__PURE__ */ new Set(["chat", "responses", "messages", "gemini"]);
 var TARGET_KINDS = /* @__PURE__ */ new Set(["account", "account-group", "account-pool", "provider"]);
 var FALLBACKS = /* @__PURE__ */ new Set(["next", "fail", "global"]);
-function isRecord3(value) {
+function isRecord5(value) {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
 function nonBlank(value) {
@@ -5853,7 +6606,7 @@ function validateGatewayBindingsSegment(patch) {
   const ids = /* @__PURE__ */ new Set();
   raw.forEach((entry, index) => {
     const path2 = `bindings[${index}]`;
-    if (!isRecord3(entry)) {
+    if (!isRecord5(entry)) {
       errors.push(`${path2} must be an object`);
       return;
     }
@@ -5882,12 +6635,12 @@ function validateGatewayBindingsSegment(patch) {
       } else if (entry.modelMappings.length > 100) {
         errors.push(`${path2}.modelMappings cannot contain more than 100 entries`);
       } else if (entry.modelMappings.some(
-        (mapping) => !isRecord3(mapping) || !nonBlank(mapping.source) || !nonBlank(mapping.target)
+        (mapping) => !isRecord5(mapping) || !nonBlank(mapping.source) || !nonBlank(mapping.target)
       )) {
         errors.push(`${path2}.modelMappings must contain non-empty source and target strings`);
       }
     }
-    if (!isRecord3(entry.target) || !TARGET_KINDS.has(String(entry.target.kind))) {
+    if (!isRecord5(entry.target) || !TARGET_KINDS.has(String(entry.target.kind))) {
       errors.push(`${path2}.target is invalid`);
     } else {
       if (!nonBlank(entry.target.providerId)) errors.push(`${path2}.target.providerId is required`);
@@ -5902,7 +6655,7 @@ function validateGatewayBindingsSegment(patch) {
       }
     }
     if (entry.modelMap !== void 0) {
-      if (!isRecord3(entry.modelMap) || Object.values(entry.modelMap).some((value) => typeof value !== "string")) {
+      if (!isRecord5(entry.modelMap) || Object.values(entry.modelMap).some((value) => typeof value !== "string")) {
         errors.push(`${path2}.modelMap must contain string values`);
       }
     }
@@ -6185,7 +6938,9 @@ var PROVIDER_KEYS = {
     accounts: "opencodegoAccounts",
     active: "activeOpencodegoAccountId"
   },
-  kimi: { block: "kimi", accounts: "kimiAccounts", active: "activeKimiAccountId" }
+  kimi: { block: "kimi", accounts: "kimiAccounts", active: "activeKimiAccountId" },
+  grok: { block: "grok", accounts: "grokAccounts", active: "activeGrokAccountId" },
+  copilot: { block: "copilot", accounts: "copilotAccounts", active: "activeCopilotAccountId" }
 };
 function clone(value) {
   return JSON.parse(JSON.stringify(value));
@@ -6707,7 +7462,7 @@ async function applyImport(packString, passphrase, mode, deps, parseProviderInpu
 }
 
 // src/admin/adminMigration.ts
-function err4(status, message) {
+function err6(status, message) {
   return { status, body: { error: { type: "admin_api_error", message } } };
 }
 async function handleExport(body, deps) {
@@ -6717,30 +7472,30 @@ async function handleExport(body, deps) {
     return { status: 200, body: { pack, version: BUNDLE_VERSION } };
   } catch (error) {
     if (error instanceof WeakPassphraseError) {
-      return err4(400, error.message);
+      return err6(400, error.message);
     }
-    return err4(500, "failed to build the migration pack");
+    return err6(500, "failed to build the migration pack");
   }
 }
 async function handleImport(body, deps) {
   const blob = typeof body["blob"] === "string" ? body["blob"] : "";
   const passphrase = typeof body["passphrase"] === "string" ? body["passphrase"] : "";
   const mode = body["mode"] === "overwrite" ? "overwrite" : "merge";
-  if (!blob) return err4(400, "import requires { blob }");
+  if (!blob) return err6(400, "import requires { blob }");
   try {
     const counts = await applyImport(blob, passphrase, mode, deps, deps.parseProviderInput);
     return { status: 200, body: counts };
   } catch (error) {
     if (error instanceof WeakPassphraseError) {
-      return err4(400, error.message);
+      return err6(400, error.message);
     }
-    return err4(400, error instanceof Error ? error.message : "import failed");
+    return err6(400, error instanceof Error ? error.message : "import failed");
   }
 }
 
 // src/admin/usagePricing.ts
 var import_usage = require("@omnicross/core/usage");
-var err5 = (status, message) => ({
+var err7 = (status, message) => ({
   status,
   body: { error: { type: "admin_api_error", message } }
 });
@@ -6753,7 +7508,7 @@ function parseRange(query2) {
   const startTs = parseFiniteInt(query2.get("startTs"));
   const endTs = parseFiniteInt(query2.get("endTs"));
   if (startTs === null || endTs === null) {
-    return err5(400, "startTs and endTs are required finite-integer unix-millis query params");
+    return err7(400, "startTs and endTs are required finite-integer unix-millis query params");
   }
   return { startTs, endTs };
 }
@@ -6778,14 +7533,14 @@ async function handleUsageGet(view, query2, deps) {
     case "timeseries": {
       const bucket = query2.get("bucket");
       if (bucket !== "hour" && bucket !== "day" && bucket !== "month") {
-        return err5(400, "bucket must be one of 'hour', 'day', 'month'");
+        return err7(400, "bucket must be one of 'hour', 'day', 'month'");
       }
       const now = Date.now();
       const clamped = { startTs: range.startTs, endTs: Math.min(range.endTs, now) };
       if (clamped.startTs < clamped.endTs) {
         const projected = Math.ceil((clamped.endTs - clamped.startTs) / BUCKET_SPAN_MS[bucket]) + 1;
         if (projected > MAX_TIMESERIES_BUCKETS) {
-          return err5(
+          return err7(
             400,
             `requested range projects ~${projected} '${bucket}' buckets (max ${MAX_TIMESERIES_BUCKETS}); narrow the range or use a coarser bucket`
           );
@@ -6808,7 +7563,7 @@ async function handleUsageGet(view, query2, deps) {
       };
     }
     default:
-      return err5(404, `unknown usage view '${view ?? ""}'`);
+      return err7(404, `unknown usage view '${view ?? ""}'`);
   }
 }
 function poolKeyLabels(cfg) {
@@ -6857,7 +7612,7 @@ async function handlePricingList(deps) {
 async function handlePricingUpsert(body, deps) {
   const input = parsePricingEntryInput(body);
   if (!input) {
-    return err5(400, "invalid pricing entry (providerId, modelId, finite numeric inputPricePer1m/outputPricePer1m required)");
+    return err7(400, "invalid pricing entry (providerId, modelId, finite numeric inputPricePer1m/outputPricePer1m required)");
   }
   const entry = await deps.pricingEngine.upsertManual(input);
   return { status: 200, body: { entry } };
@@ -6866,7 +7621,7 @@ async function handlePricingDelete(query2, deps) {
   const providerId = query2.get("providerId")?.trim() ?? "";
   const modelId = query2.get("modelId")?.trim() ?? "";
   if (!providerId || !modelId) {
-    return err5(400, "delete requires providerId and modelId query params");
+    return err7(400, "delete requires providerId and modelId query params");
   }
   const deleted = await deps.pricingStore.delete(providerId, modelId);
   if (deleted) await deps.pricingEngine.invalidateCache();
@@ -6886,13 +7641,13 @@ async function handlePricingFetchLatest(deps) {
       }
     };
   } catch (e) {
-    return err5(502, `pricing-source fetch failed: ${e instanceof Error ? e.message : String(e)}`);
+    return err7(502, `pricing-source fetch failed: ${e instanceof Error ? e.message : String(e)}`);
   }
 }
 async function handlePricingResolveConflicts(body, deps) {
   const raw = body["resolutions"];
   if (!Array.isArray(raw)) {
-    return err5(400, "resolve-conflicts requires { resolutions: [...] }");
+    return err7(400, "resolve-conflicts requires { resolutions: [...] }");
   }
   const currentRows = await deps.pricingStore.getAll();
   const userEditedKeys = new Set(
@@ -6902,21 +7657,21 @@ async function handlePricingResolveConflicts(body, deps) {
   const pendingIncoming = /* @__PURE__ */ new Map();
   let staleCount = 0;
   for (const item of raw) {
-    if (!item || typeof item !== "object") return err5(400, "invalid resolution entry");
+    if (!item || typeof item !== "object") return err7(400, "invalid resolution entry");
     const r = item;
     const action = r["action"];
     if (action !== "overwrite" && action !== "skip") {
-      return err5(400, "resolution action must be 'overwrite' or 'skip'");
+      return err7(400, "resolution action must be 'overwrite' or 'skip'");
     }
     const providerId = typeof r["providerId"] === "string" && r["providerId"].trim() ? r["providerId"].trim() : "";
     const modelId = typeof r["modelId"] === "string" && r["modelId"].trim() ? r["modelId"].trim() : "";
     if (!providerId || !modelId) {
-      return err5(400, "each resolution requires top-level providerId and modelId");
+      return err7(400, "each resolution requires top-level providerId and modelId");
     }
     const incoming = parsePricingEntryInput(r["incoming"]);
-    if (!incoming) return err5(400, "each resolution must echo a valid incoming pricing entry");
+    if (!incoming) return err7(400, "each resolution must echo a valid incoming pricing entry");
     if (incoming.providerId !== providerId || incoming.modelId !== modelId) {
-      return err5(400, "resolution providerId/modelId must match the echoed incoming entry");
+      return err7(400, "resolution providerId/modelId must match the echoed incoming entry");
     }
     const key = `${providerId}::${modelId}`;
     if (action === "overwrite" && !userEditedKeys.has(key)) {
@@ -6961,7 +7716,7 @@ function query(req) {
 }
 function allowanceProvider(value) {
   if (!value) return void 0;
-  return value === "claude" || value === "codex" || value === "kimi" || value === "opencodego" ? value : null;
+  return value === "claude" || value === "codex" || value === "kimi" || value === "opencodego" || value === "grok" || value === "copilot" ? value : null;
 }
 async function handleAccountAllowanceApi(req, res, method, rest, service) {
   if (!service) return writeError2(res, 501, "account allowance service is not available");
@@ -6976,7 +7731,7 @@ async function handleAccountAllowanceApi(req, res, method, rest, service) {
     const pathProvider = rest.length >= 2 ? rest[0] : null;
     const providerId = allowanceProvider(pathProvider ?? params.get("providerId") ?? params.get("provider"));
     if (providerId === null) {
-      return writeError2(res, 400, "providerId must be claude, codex, kimi, or opencodego");
+      return writeError2(res, 400, "providerId must be claude, codex, kimi, opencodego, grok, or copilot");
     }
     const accountId = rest.length >= 2 ? rest[1] : params.get("accountId") ?? void 0;
     const allowances = await service.list({ providerId, accountId });
@@ -7018,6 +7773,26 @@ async function handleAccountAllowanceApi(req, res, method, rest, service) {
       }
       return writeJson3(res, 200, { allowances: allowances2 });
     }
+    if (requestedProvider === "copilot") {
+      if (!service.refreshCopilot) {
+        return writeError2(res, 501, "copilot allowance refresh is not available");
+      }
+      const allowances2 = await service.refreshCopilot(accountId);
+      if (accountId && allowances2.length === 0) {
+        return writeError2(res, 404, `Copilot account '${accountId}' not found`);
+      }
+      return writeJson3(res, 200, { allowances: allowances2 });
+    }
+    if (requestedProvider === "grok") {
+      if (!service.refreshGrok) {
+        return writeError2(res, 501, "grok allowance refresh is not available");
+      }
+      const allowances2 = await service.refreshGrok(accountId);
+      if (accountId && allowances2.length === 0) {
+        return writeError2(res, 404, `Grok account '${accountId}' not found`);
+      }
+      return writeJson3(res, 200, { allowances: allowances2 });
+    }
     const allowances = await service.refreshClaude(accountId);
     if (accountId && allowances.length === 0) {
       return writeError2(res, 404, `Claude account '${accountId}' not found`);
@@ -7116,6 +7891,9 @@ function toProviderView(row) {
     apiVersion: row.apiVersion,
     maxConcurrency: row.maxConcurrency,
     modelsEndpoint: row.modelsEndpoint,
+    // Static extra headers round-trip VERBATIM (non-secret identity values;
+    // auth/content names were already dropped at the write/load gate).
+    extraHeaders: row.extraHeaders,
     // app-parity child 5: transformer config round-trips VERBATIM (non-secret —
     // transform-rule names + options, no key material; absent stays absent).
     transformer: row.transformer,
@@ -7185,8 +7963,8 @@ async function handleAdminApi(req, res, path2, deps) {
       default:
         return writeJsonError(res, 404, `unknown admin resource '${resource}'`);
     }
-  } catch (err6) {
-    writeJsonError(res, 500, err6 instanceof Error ? err6.message : String(err6));
+  } catch (err8) {
+    writeJsonError(res, 500, err8 instanceof Error ? err8.message : String(err8));
   }
 }
 function requestQuery(req) {
@@ -7344,6 +8122,9 @@ async function handleProviderReorder(req, res, cfg, deps) {
   persistProviders(cfg, deps);
   return writeJson4(res, 200, { ok: true, providers: cfg.providers.map(toProviderView) });
 }
+function expandRowExtraHeaders(row) {
+  return (0, import_core3.mergeExtraHeaders)({}, row.extraHeaders);
+}
 async function handleDiscoverModels(res, id, cfg) {
   if (!id) return writeJsonError(res, 400, "provider id required in path");
   const row = cfg.providers.find((p) => p.id === id);
@@ -7357,7 +8138,8 @@ async function handleDiscoverModels(res, id, cfg) {
   try {
     const headers = { Accept: "application/json" };
     if (resolvedKey) headers["Authorization"] = `Bearer ${resolvedKey}`;
-    const response = await (0, import_upstreamFetch7.fetchUpstream)(url, { method: "GET", headers }, { providerId: "byo" });
+    Object.assign(headers, expandRowExtraHeaders(row));
+    const response = await (0, import_upstreamFetch9.fetchUpstream)(url, { method: "GET", headers }, { providerId: "byo" });
     if (!response.ok) {
       const text = await response.text().catch(() => "");
       let message = text.slice(0, 300);
@@ -7374,8 +8156,8 @@ async function handleDiscoverModels(res, id, cfg) {
     const data = await response.json();
     const models = Array.isArray(data?.data) ? data.data.map((m) => typeof m?.id === "string" ? m.id : "").filter((m) => m.length > 0) : [];
     return writeJson4(res, 200, { models });
-  } catch (err6) {
-    const message = err6 instanceof Error ? err6.message : String(err6);
+  } catch (err8) {
+    const message = err8 instanceof Error ? err8.message : String(err8);
     return writeJson4(res, 200, { models: [], error: `discovery failed: ${message}` });
   }
 }
@@ -7414,9 +8196,10 @@ async function handleTestModel(req, res, id, cfg) {
       messages: [{ role: "user", content: prompt }]
     };
   }
+  Object.assign(headers, expandRowExtraHeaders(row));
   const startedAt = Date.now();
   try {
-    const response = await (0, import_upstreamFetch7.fetchUpstream)(
+    const response = await (0, import_upstreamFetch9.fetchUpstream)(
       url,
       { method: "POST", headers, body: JSON.stringify(payload) },
       { providerId: "byo" }
@@ -7438,8 +8221,8 @@ async function handleTestModel(req, res, id, cfg) {
       latencyMs,
       sample: extractSampleText(text, row.apiFormat)
     });
-  } catch (err6) {
-    const message = err6 instanceof Error ? err6.message : String(err6);
+  } catch (err8) {
+    const message = err8 instanceof Error ? err8.message : String(err8);
     return writeJson4(res, 200, { ok: false, latencyMs: Date.now() - startedAt, message });
   }
 }
@@ -7721,6 +8504,7 @@ function parseProviderInput(body, existing) {
   const apiVersion = typeof body["apiVersion"] === "string" && body["apiVersion"].length > 0 ? body["apiVersion"] : body["apiVersion"] === null ? void 0 : existing?.apiVersion;
   const modelsEndpoint = typeof body["modelsEndpoint"] === "string" && body["modelsEndpoint"].length > 0 ? body["modelsEndpoint"] : body["modelsEndpoint"] === null ? void 0 : existing?.modelsEndpoint;
   const maxConcurrency = typeof body["maxConcurrency"] === "number" && Number.isFinite(body["maxConcurrency"]) ? body["maxConcurrency"] : body["maxConcurrency"] === null ? void 0 : existing?.maxConcurrency;
+  const extraHeaders = body["extraHeaders"] === null ? void 0 : body["extraHeaders"] === void 0 ? existing?.extraHeaders : validateExtraHeaders(body["extraHeaders"]);
   const transformer = body["transformer"] === null ? void 0 : parseTransformerInput(body["transformer"], existing?.transformer);
   const codingPlan = body["codingPlan"] === null ? void 0 : body["codingPlan"] === void 0 ? existing?.codingPlan : body["codingPlan"] && typeof body["codingPlan"] === "object" && !Array.isArray(body["codingPlan"]) ? parseCodingPlanInput(body["codingPlan"], existing?.codingPlan) : existing?.codingPlan;
   const apiModes = body["apiModes"] === null ? void 0 : parseApiModesInput(body["apiModes"], existing?.apiModes);
@@ -7746,6 +8530,7 @@ function parseProviderInput(body, existing) {
     apiVersion,
     maxConcurrency,
     modelsEndpoint,
+    extraHeaders,
     transformer: migrated.transformer,
     codingPlan,
     apiModes,
@@ -7767,7 +8552,10 @@ function handlePresets(res, method) {
     description: p.description,
     features: p.features,
     website: p.website,
-    modelsEndpoint: p.modelsEndpoint
+    modelsEndpoint: p.modelsEndpoint,
+    // Static extra headers ride along so `addFromPreset` can seed them onto the
+    // row (the write gateway re-validates via the shared allowlist).
+    extraHeaders: p.extraHeaders
   }));
   return writeJson4(res, 200, { presets, excluded });
 }
@@ -8249,12 +9037,12 @@ async function handleAccounts(req, res, method, rest, deps) {
     }
     return writeJson4(res, 200, { ok: true, affected: result.affected });
   }
-  if (method === "GET" && (rest[0] === "codex" || rest[0] === "kimi") && rest[1] === "oauth" && rest[3] === "status") {
-    const result = rest[0] === "codex" ? handleCodexOAuthStatus(rest[2], deps) : handleKimiOAuthStatus(rest[2], deps);
+  if (method === "GET" && (rest[0] === "codex" || rest[0] === "kimi" || rest[0] === "grok" || rest[0] === "copilot") && rest[1] === "oauth" && rest[3] === "status") {
+    const result = rest[0] === "codex" ? handleCodexOAuthStatus(rest[2], deps) : rest[0] === "kimi" ? handleKimiOAuthStatus(rest[2], deps) : rest[0] === "grok" ? handleGrokOAuthStatus(rest[2], deps) : handleCopilotOAuthStatus(rest[2], deps);
     return writeJson4(res, result.status, result.body);
   }
-  if (method === "DELETE" && (rest[0] === "codex" || rest[0] === "kimi") && rest[1] === "oauth" && rest[2]) {
-    const result = rest[0] === "codex" ? handleCodexOAuthCancel(rest[2], deps) : handleKimiOAuthCancel(rest[2], deps);
+  if (method === "DELETE" && (rest[0] === "codex" || rest[0] === "kimi" || rest[0] === "grok" || rest[0] === "copilot") && rest[1] === "oauth" && rest[2]) {
+    const result = rest[0] === "codex" ? handleCodexOAuthCancel(rest[2], deps) : rest[0] === "kimi" ? handleKimiOAuthCancel(rest[2], deps) : rest[0] === "grok" ? handleGrokOAuthCancel(rest[2], deps) : handleCopilotOAuthCancel(rest[2], deps);
     return writeJson4(res, result.status, result.body);
   }
   if (method === "GET" && rest.length === 3 && rest[2] === "diagnostics") {
@@ -8315,6 +9103,15 @@ async function handleAccounts(req, res, method, rest, deps) {
         const result2 = await handleKimiOAuthStart(deps);
         return writeJson4(res, result2.status, result2.body);
       }
+      if (providerId === "grok") {
+        const result2 = await handleGrokOAuthStart(deps);
+        return writeJson4(res, result2.status, result2.body);
+      }
+      if (providerId === "copilot") {
+        const body2 = await readJsonBody4(req);
+        const result2 = await handleCopilotOAuthStart(deps, body2["enterpriseUrl"]);
+        return writeJson4(res, result2.status, result2.body);
+      }
       const result = handleOAuthStart(providerId, deps);
       return writeJson4(res, result.status, result.body);
     }
@@ -8809,12 +9606,12 @@ async function handlePlayground(req, res, method, deps) {
   const payload = body["body"];
   const status = deps.outboundApiServer.getStatus();
   if (!status.running || !status.port) return writeJsonError(res, 503, "outbound server not running");
-  const path2 = resolvePlaygroundPath(endpoint, isRecord4(payload) ? payload : {});
+  const path2 = resolvePlaygroundPath(endpoint, isRecord6(payload) ? payload : {});
   if (!path2) return writeJsonError(res, 400, `unknown endpoint '${endpoint}'`);
   const upstreamBody = typeof payload === "string" ? payload : JSON.stringify(payload ?? {});
   await proxyToOutbound(res, status.port, path2, key, upstreamBody);
 }
-function isRecord4(v) {
+function isRecord6(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
 function proxyToOutbound(res, outboundPort, path2, key, body) {
@@ -8843,8 +9640,8 @@ function proxyToOutbound(res, outboundPort, path2, key, body) {
         });
       }
     );
-    upstream.on("error", (err6) => {
-      if (!res.headersSent) writeJsonError(res, 502, `playground proxy failed: ${err6.message}`);
+    upstream.on("error", (err8) => {
+      if (!res.headersSent) writeJsonError(res, 502, `playground proxy failed: ${err8.message}`);
       else res.end();
       resolve11();
     });
@@ -8950,7 +9747,7 @@ async function handleUiStatic(req, res, urlPath, uiDist) {
 }
 
 // src/admin/version.ts
-var DAEMON_VERSION = true ? "0.3.1" : "0.0.0-dev";
+var DAEMON_VERSION = true ? "0.4.0" : "0.0.0-dev";
 
 // src/admin/AdminServer.ts
 var LOOPBACK_ADDR = "127.0.0.1";
@@ -8993,13 +9790,13 @@ var AdminServer = class {
       const server = import_node_http2.default.createServer((req, res) => {
         this.onRequest(req, res);
       });
-      const onError = (err6) => {
-        if (err6.code === "EADDRINUSE" && port !== 0) {
+      const onError = (err8) => {
+        if (err8.code === "EADDRINUSE" && port !== 0) {
           server.removeListener("error", onError);
           this.listen(bindAddr, 0).then(resolve11, reject);
           return;
         }
-        reject(err6);
+        reject(err8);
       };
       server.on("error", onError);
       server.listen(port, bindAddr, () => {
@@ -9017,8 +9814,8 @@ var AdminServer = class {
   }
   /** Per-request handler: auth gate (when a token is set) → routing. */
   onRequest(req, res) {
-    void this.dispatch(req, res).catch((err6) => {
-      const message = err6 instanceof Error ? err6.message : String(err6);
+    void this.dispatch(req, res).catch((err8) => {
+      const message = err8 instanceof Error ? err8.message : String(err8);
       this.deps.logger.error("[AdminServer] unhandled error:", message);
       if (!res.headersSent) {
         res.writeHead(500, { "Content-Type": "application/json" });
@@ -9282,18 +10079,18 @@ function awaitLoopbackCode(expectedState, timeoutMs = DEFAULT_TIMEOUT_MS, signal
       return;
     }
     signal?.addEventListener("abort", abort, { once: true });
-    server.on("error", (err6) => {
+    server.on("error", (err8) => {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      if (err6.code === "EADDRINUSE") {
+      if (err8.code === "EADDRINUSE") {
         reject(
           new Error(
             `login: cannot bind ${LOOPBACK_HOST}:${LOOPBACK_PORT} (address in use) \u2014 another codex login or process is holding the port`
           )
         );
       } else {
-        reject(err6);
+        reject(err8);
       }
     });
     const timer = setTimeout(() => {
@@ -9369,21 +10166,22 @@ function createPoolKeysLoader(getProviderRow, autoDisabled) {
 }
 
 // src/allowance/ProviderKeyQuotaService.ts
-var import_upstreamFetch8 = require("@omnicross/core/pipeline/upstreamFetch");
+var import_core4 = require("@omnicross/core");
+var import_upstreamFetch10 = require("@omnicross/core/pipeline/upstreamFetch");
 
 // src/allowance/ProviderKeyQuota.ts
-var MINUTE_MS2 = 6e4;
-var HOUR_MS2 = 60 * MINUTE_MS2;
-var DAY_MS2 = 24 * HOUR_MS2;
-var WEEK_MS = 7 * DAY_MS2;
-var MONTH_MS = 30 * DAY_MS2;
-function finiteNumber3(value) {
+var MINUTE_MS3 = 6e4;
+var HOUR_MS2 = 60 * MINUTE_MS3;
+var DAY_MS3 = 24 * HOUR_MS2;
+var WEEK_MS = 7 * DAY_MS3;
+var MONTH_MS = 30 * DAY_MS3;
+function finiteNumber5(value) {
   if (value === null || value === void 0 || value === "") return void 0;
   const parsed = typeof value === "number" ? value : Number(value);
   return Number.isFinite(parsed) && parsed >= 0 ? parsed : void 0;
 }
 function finitePercent4(value) {
-  const parsed = finiteNumber3(value);
+  const parsed = finiteNumber5(value);
   return parsed !== void 0 && parsed <= 100 ? parsed : null;
 }
 function isoInstant3(value) {
@@ -9391,18 +10189,18 @@ function isoInstant3(value) {
     const time = Date.parse(value);
     if (Number.isFinite(time)) return new Date(time).toISOString();
   }
-  const numeric = finiteNumber3(value);
+  const numeric = finiteNumber5(value);
   if (numeric !== void 0 && numeric > 1e9) {
     const ms = numeric > 1e12 ? numeric : numeric * 1e3;
     return new Date(ms).toISOString();
   }
   return void 0;
 }
-function secondsUntil5(instant, now) {
+function secondsUntil7(instant, now) {
   if (!instant) return void 0;
   return Math.max(0, Math.floor((Date.parse(instant) - now) / 1e3));
 }
-function isRecord5(value) {
+function isRecord7(value) {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
 function detectProviderKeyQuotaAdapter(baseUrl) {
@@ -9425,6 +10223,7 @@ function detectProviderKeyQuotaAdapter(baseUrl) {
   }
   if (host === "api.code.umans.ai") return "umans";
   if (host === "api.synthetic.new") return "synthetic";
+  if (host === "api.cline.bot") return "cline-pass";
   return null;
 }
 function providerKeyQuotaUrl(adapter, baseUrl) {
@@ -9432,6 +10231,7 @@ function providerKeyQuotaUrl(adapter, baseUrl) {
   if (adapter === "zai") return `${origin}/api/monitor/usage/quota/limit`;
   if (adapter === "minimax-token-plan") return `${origin}/v1/token_plan/remains`;
   if (adapter === "umans") return `${origin}/v1/usage`;
+  if (adapter === "cline-pass") return `${origin}/api/v1/users/me/plan/usage-limits`;
   return `${origin}/v2/quotas`;
 }
 function providerKeyQuotaAuthHeader(adapter, key) {
@@ -9443,7 +10243,7 @@ function zaiWindowDurationMs(item) {
     case 3:
       return count * HOUR_MS2;
     case 4:
-      return count * DAY_MS2;
+      return count * DAY_MS3;
     case 5:
       return count * MONTH_MS;
     case 6:
@@ -9456,8 +10256,8 @@ function zaiWindowIdLabel(durationMs) {
   if (durationMs === WEEK_MS) return { id: "seven-day", label: "7 days" };
   if (durationMs === 5 * HOUR_MS2) return { id: "five-hour", label: "5 hours" };
   if (durationMs === MONTH_MS) return { id: "thirty-day", label: "30 days" };
-  if (durationMs !== void 0 && durationMs % DAY_MS2 === 0) {
-    const days = durationMs / DAY_MS2;
+  if (durationMs !== void 0 && durationMs % DAY_MS3 === 0) {
+    const days = durationMs / DAY_MS3;
     return { id: `${days}d`, label: `${days} day${days === 1 ? "" : "s"}` };
   }
   if (durationMs !== void 0 && durationMs % HOUR_MS2 === 0) {
@@ -9467,23 +10267,23 @@ function zaiWindowIdLabel(durationMs) {
   return { id: "quota", label: "Quota" };
 }
 function parseZaiQuotaPayload(payload, now) {
-  if (!isRecord5(payload)) return null;
-  const data = isRecord5(payload["data"]) ? payload["data"] : payload;
+  if (!isRecord7(payload)) return null;
+  const data = isRecord7(payload["data"]) ? payload["data"] : payload;
   if (payload["success"] === false) return null;
   const limits = Array.isArray(data["limits"]) ? data["limits"] : [];
   const byWindow = /* @__PURE__ */ new Map();
   for (const raw of limits) {
-    if (!isRecord5(raw)) continue;
+    if (!isRecord7(raw)) continue;
     const item = raw;
     if (item.type === void 0) continue;
     const details = raw["usageDetails"];
-    if (Array.isArray(details) && details.some((d) => isRecord5(d) && d["modelCode"] === "zread")) {
+    if (Array.isArray(details) && details.some((d) => isRecord7(d) && d["modelCode"] === "zread")) {
       continue;
     }
     const durationMs = zaiWindowDurationMs(item);
     const { id, label } = zaiWindowIdLabel(durationMs);
-    const limit = finiteNumber3(item.usage);
-    const used = finiteNumber3(item.currentValue);
+    const limit = finiteNumber5(item.usage);
+    const used = finiteNumber5(item.currentValue);
     const fromAbsolute = limit !== void 0 && used !== void 0 && limit > 0 ? Math.min(100, used / limit * 100) : void 0;
     const fromPercentage = finitePercent4(item.percentage) ?? void 0;
     const usedPercent = fromAbsolute !== void 0 ? Math.round(fromAbsolute * 10) / 10 : fromPercentage;
@@ -9494,9 +10294,9 @@ function parseZaiQuotaPayload(payload, now) {
       label,
       scope: "all",
       usedPercent,
-      ...durationMs !== void 0 ? { windowMinutes: Math.round(durationMs / MINUTE_MS2) } : {},
+      ...durationMs !== void 0 ? { windowMinutes: Math.round(durationMs / MINUTE_MS3) } : {},
       ...resetsAt !== void 0 ? { resetsAt } : {},
-      remainingSeconds: secondsUntil5(resetsAt, now),
+      remainingSeconds: secondsUntil7(resetsAt, now),
       state: "fresh"
     };
     const existing = byWindow.get(id);
@@ -9510,21 +10310,21 @@ function parseZaiQuotaPayload(payload, now) {
 var MINIMAX_STATUS_EXHAUSTED = 2;
 var MINIMAX_SHARED_BUCKET = "general";
 function parseMiniMaxBucket(value) {
-  if (!isRecord5(value)) return null;
+  if (!isRecord7(value)) return null;
   const modelName = typeof value["model_name"] === "string" ? value["model_name"].trim() : "";
   if (!modelName) return null;
   const instant = (v) => {
-    const n = finiteNumber3(v);
+    const n = finiteNumber5(v);
     return n !== void 0 && n > 1e9 ? n > 1e12 ? n : n * 1e3 : void 0;
   };
   return {
     modelName,
     intervalEnd: instant(value["end_time"]),
-    intervalRemainingPercent: finiteNumber3(value["current_interval_remaining_percent"]),
-    intervalStatus: finiteNumber3(value["current_interval_status"]),
+    intervalRemainingPercent: finiteNumber5(value["current_interval_remaining_percent"]),
+    intervalStatus: finiteNumber5(value["current_interval_status"]),
     weeklyEnd: instant(value["weekly_end_time"]),
-    weeklyRemainingPercent: finiteNumber3(value["current_weekly_remaining_percent"]),
-    weeklyStatus: finiteNumber3(value["current_weekly_status"])
+    weeklyRemainingPercent: finiteNumber5(value["current_weekly_remaining_percent"]),
+    weeklyStatus: finiteNumber5(value["current_weekly_status"])
   };
 }
 function minimaxWindow(id, label, windowMinutes, resetsAtMs, remainingPercent, status, now) {
@@ -9537,14 +10337,14 @@ function minimaxWindow(id, label, windowMinutes, resetsAtMs, remainingPercent, s
     usedPercent,
     ...windowMinutes !== void 0 ? { windowMinutes } : {},
     ...resetsAt !== void 0 ? { resetsAt } : {},
-    remainingSeconds: secondsUntil5(resetsAt, now),
+    remainingSeconds: secondsUntil7(resetsAt, now),
     state: usedPercent !== null ? "fresh" : "unavailable"
   };
 }
 function parseMiniMaxTokenPlanPayload(payload, now) {
-  if (!isRecord5(payload)) return null;
+  if (!isRecord7(payload)) return null;
   const baseResp = payload["base_resp"];
-  if (!isRecord5(baseResp) || baseResp["status_code"] !== 0) return null;
+  if (!isRecord7(baseResp) || baseResp["status_code"] !== 0) return null;
   const buckets = Array.isArray(payload["model_remains"]) ? payload["model_remains"] : [];
   let general = null;
   for (const raw of buckets) {
@@ -9568,7 +10368,7 @@ function parseMiniMaxTokenPlanPayload(payload, now) {
     minimaxWindow(
       "seven-day",
       "7 days",
-      Math.round(WEEK_MS / MINUTE_MS2),
+      Math.round(WEEK_MS / MINUTE_MS3),
       general.weeklyEnd,
       general.weeklyRemainingPercent,
       general.weeklyStatus,
@@ -9577,15 +10377,15 @@ function parseMiniMaxTokenPlanPayload(payload, now) {
   ];
 }
 function parseUmansUsagePayload(payload, now) {
-  if (!isRecord5(payload)) return null;
-  const limits = isRecord5(payload["limits"]) ? payload["limits"] : void 0;
-  const requests = limits && isRecord5(limits["requests"]) ? limits["requests"] : void 0;
-  const usage = isRecord5(payload["usage"]) ? payload["usage"] : void 0;
-  const window = isRecord5(payload["window"]) ? payload["window"] : void 0;
-  const hardCap = finiteNumber3(requests?.["hard_cap"]);
-  const softLimit = finiteNumber3(requests?.["limit"]);
-  const requestsInWindow = finiteNumber3(usage?.["requests_in_window"]);
-  const weightedInWindow = finiteNumber3(usage?.["weighted_in_window"]);
+  if (!isRecord7(payload)) return null;
+  const limits = isRecord7(payload["limits"]) ? payload["limits"] : void 0;
+  const requests = limits && isRecord7(limits["requests"]) ? limits["requests"] : void 0;
+  const usage = isRecord7(payload["usage"]) ? payload["usage"] : void 0;
+  const window = isRecord7(payload["window"]) ? payload["window"] : void 0;
+  const hardCap = finiteNumber5(requests?.["hard_cap"]);
+  const softLimit = finiteNumber5(requests?.["limit"]);
+  const requestsInWindow = finiteNumber5(usage?.["requests_in_window"]);
+  const weightedInWindow = finiteNumber5(usage?.["weighted_in_window"]);
   const resetsAt = isoInstant3(window?.["resets_at"]);
   let usedPercent = null;
   if (hardCap !== void 0 && hardCap > 0 && requestsInWindow !== void 0) {
@@ -9602,19 +10402,19 @@ function parseUmansUsagePayload(payload, now) {
       usedPercent,
       windowMinutes: 5 * 60,
       ...resetsAt !== void 0 ? { resetsAt } : {},
-      remainingSeconds: secondsUntil5(resetsAt, now),
+      remainingSeconds: secondsUntil7(resetsAt, now),
       state: "fresh"
     }
   ];
 }
 function parseSyntheticQuotasPayload(payload, now) {
-  if (!isRecord5(payload)) return null;
-  const fiveHour = isRecord5(payload["rollingFiveHourLimit"]) ? payload["rollingFiveHourLimit"] : void 0;
-  const weekly = isRecord5(payload["weeklyTokenLimit"]) ? payload["weeklyTokenLimit"] : void 0;
+  if (!isRecord7(payload)) return null;
+  const fiveHour = isRecord7(payload["rollingFiveHourLimit"]) ? payload["rollingFiveHourLimit"] : void 0;
+  const weekly = isRecord7(payload["weeklyTokenLimit"]) ? payload["weeklyTokenLimit"] : void 0;
   const windows = [];
   if (fiveHour) {
-    const max = finiteNumber3(fiveHour["max"]);
-    const remaining = finiteNumber3(fiveHour["remaining"]);
+    const max = finiteNumber5(fiveHour["max"]);
+    const remaining = finiteNumber5(fiveHour["remaining"]);
     const usedPercent = max !== void 0 && max > 0 && remaining !== void 0 ? Math.round(Math.min(100, (max - remaining) / max * 100) * 10) / 10 : null;
     const resetsAt = isoInstant3(fiveHour["nextTickAt"]);
     windows.push({
@@ -9624,12 +10424,12 @@ function parseSyntheticQuotasPayload(payload, now) {
       usedPercent,
       windowMinutes: 5 * 60,
       ...resetsAt !== void 0 ? { resetsAt } : {},
-      remainingSeconds: secondsUntil5(resetsAt, now),
+      remainingSeconds: secondsUntil7(resetsAt, now),
       state: usedPercent !== null || resetsAt ? "fresh" : "unavailable"
     });
   }
   if (weekly) {
-    const percentRemaining = finiteNumber3(weekly["percentRemaining"]);
+    const percentRemaining = finiteNumber5(weekly["percentRemaining"]);
     const usedPercent = percentRemaining !== void 0 ? Math.round(Math.min(100, Math.max(0, 100 - percentRemaining)) * 10) / 10 : null;
     const resetsAt = isoInstant3(weekly["nextRegenAt"]);
     windows.push({
@@ -9639,12 +10439,42 @@ function parseSyntheticQuotasPayload(payload, now) {
       usedPercent,
       windowMinutes: 7 * 24 * 60,
       ...resetsAt !== void 0 ? { resetsAt } : {},
-      remainingSeconds: secondsUntil5(resetsAt, now),
+      remainingSeconds: secondsUntil7(resetsAt, now),
       state: usedPercent !== null || resetsAt ? "fresh" : "unavailable"
     });
   }
   return windows.length > 0 ? windows : null;
 }
+var CLINE_WINDOW_CONFIG = {
+  five_hour: { id: "five-hour", label: "5 hours", minutes: 5 * 60 },
+  weekly: { id: "seven-day", label: "7 days", minutes: 7 * 24 * 60 },
+  monthly: { id: "thirty-day", label: "30 days", minutes: 30 * 24 * 60 }
+};
+function parseClinePassUsageLimitsPayload(payload, now) {
+  if (!isRecord7(payload)) return null;
+  const data = isRecord7(payload["data"]) ? payload["data"] : payload;
+  const limits = Array.isArray(data["limits"]) ? data["limits"] : [];
+  const windows = [];
+  for (const raw of limits) {
+    if (!isRecord7(raw)) continue;
+    const config = CLINE_WINDOW_CONFIG[typeof raw["type"] === "string" ? raw["type"] : ""];
+    if (!config) continue;
+    const usedPercent = finitePercent4(raw["percentUsed"]);
+    if (usedPercent === null) continue;
+    const resetsAt = isoInstant3(raw["resetsAt"]);
+    windows.push({
+      id: config.id,
+      label: config.label,
+      scope: "all",
+      usedPercent,
+      windowMinutes: config.minutes,
+      ...resetsAt !== void 0 ? { resetsAt } : {},
+      remainingSeconds: secondsUntil7(resetsAt, now),
+      state: "fresh"
+    });
+  }
+  return windows.length > 0 ? windows : null;
+}
 
 // src/allowance/ProviderKeyQuotaService.ts
 function parseQuotaPayload(adapter, payload, now) {
@@ -9657,6 +10487,8 @@ function parseQuotaPayload(adapter, payload, now) {
       return parseUmansUsagePayload(payload, now);
     case "synthetic":
       return parseSyntheticQuotasPayload(payload, now);
+    case "cline-pass":
+      return parseClinePassUsageLimitsPayload(payload, now);
   }
 }
 var PROVIDER_KEY_QUOTA_CACHE_MS = 5 * 6e4;
@@ -9676,7 +10508,7 @@ function rowKeyEntries(row) {
   return [];
 }
 var ProviderKeyQuotaService = class {
-  constructor(box, fetchImpl = (url, init) => (0, import_upstreamFetch8.fetchUpstream)(url, init, { redactBodies: true }), now = Date.now) {
+  constructor(box, fetchImpl = (url, init) => (0, import_upstreamFetch10.fetchUpstream)(url, init, { redactBodies: true }), now = Date.now) {
     this.box = box;
     this.fetchImpl = fetchImpl;
     this.now = now;
@@ -9738,7 +10570,10 @@ var ProviderKeyQuotaService = class {
       headers: {
         Authorization: providerKeyQuotaAuthHeader(adapter, key),
         Accept: "application/json",
-        "Content-Type": "application/json"
+        "Content-Type": "application/json",
+        // The row's static identity headers ride along — the Cline usage
+        // endpoint sits behind the SAME client-identity 403 gate as inference.
+        ...(0, import_core4.mergeExtraHeaders)({}, row.extraHeaders)
       },
       signal: AbortSignal.timeout(15e3)
     });
@@ -9776,7 +10611,7 @@ var ProviderKeyQuotaService = class {
 // src/image-generation/ImageDoctorService.ts
 var import_image_generation = require("@omnicross/core/image-generation");
 var import_outbound_api7 = require("@omnicross/core/outbound-api");
-var import_subscriptions6 = require("@omnicross/subscriptions");
+var import_subscriptions9 = require("@omnicross/subscriptions");
 
 // src/image-generation/FileCodexImageCapabilityEvidenceSource.ts
 var import_node_crypto13 = require("crypto");
@@ -10214,7 +11049,7 @@ function createImageDoctorService(options) {
     paths,
     ttlMs: config.evidenceTtlMs
   }));
-  const createLiveVerifier = options.createLiveVerifier ?? ((strategy, config) => (0, import_subscriptions6.createCodexImageLiveVerifier)({
+  const createLiveVerifier = options.createLiveVerifier ?? ((strategy, config) => (0, import_subscriptions9.createCodexImageLiveVerifier)({
     authStrategy: strategy,
     generationTimeoutMs: config.queue.generationTimeoutMs
   }));
@@ -10576,7 +11411,7 @@ var ImageCleanupService = class {
 var import_node_crypto16 = require("crypto");
 var import_image_generation5 = require("@omnicross/core/image-generation");
 var import_outbound_api8 = require("@omnicross/core/outbound-api");
-var import_subscriptions7 = require("@omnicross/subscriptions");
+var import_subscriptions10 = require("@omnicross/subscriptions");
 
 // src/image-generation/ImageApiRuntimeResolver.ts
 var import_node_crypto14 = require("crypto");
@@ -11107,7 +11942,7 @@ function createImageRuntimeGeneration(options) {
       now: options.now ?? Date.now,
       referenceStore: options.storage.referenceStore,
       stateStore: options.storage.stateStore
-    }) : (0, import_subscriptions7.createCodexSubscriptionImageProvider)({
+    }) : (0, import_subscriptions10.createCodexSubscriptionImageProvider)({
       authStrategy,
       evidenceSource: generationEvidenceSource,
       executionScheduler: scheduler,
@@ -14251,7 +15086,7 @@ var ImageRuntimeManager = class {
 };
 
 // src/ports/ConfigFileProviderConfigSource.ts
-var import_core2 = require("@omnicross/core");
+var import_core5 = require("@omnicross/core");
 var EMPTY_CHAIN = {
   providerTransformers: [],
   modelTransformers: []
@@ -14276,8 +15111,8 @@ var ConfigFileProviderConfigSource = class {
   reloadHook;
   constructor(config) {
     for (const p of config.providers) this.providers.set(p.id, p);
-    this.transformerService = new import_core2.TransformerService();
-    void (0, import_core2.registerBuiltinTransformers)(this.transformerService);
+    this.transformerService = new import_core5.TransformerService();
+    void (0, import_core5.registerBuiltinTransformers)(this.transformerService);
   }
   // ── Reload hook (key-pool design D4) ───────────────────────────────────────
   /**
@@ -14298,7 +15133,7 @@ var ConfigFileProviderConfigSource = class {
   }
   /** Await the built-in transformer registration (tests await this before dispatch). */
   async ready() {
-    await (0, import_core2.registerBuiltinTransformers)(this.transformerService);
+    await (0, import_core5.registerBuiltinTransformers)(this.transformerService);
   }
   // ── Hot-reload seam (admin dashboard, RT3 design D6) ───────────────────────
   /**
@@ -14409,6 +15244,10 @@ function toLLMProvider(row) {
     // `parseProviderInput`), so customizations are preserved (the row value wins).
     apiModes: row.apiModes,
     selectedApiModeId: row.selectedApiModeId,
+    // Static extra request headers ride along verbatim (load-guarded — no
+    // auth/content names); core's `getProviderHeaders` merges them into every
+    // BYO request, and the same-format relay path inherits that funnel.
+    extraHeaders: row.extraHeaders,
     // Official-Anthropic signature handling only matters for the Anthropic
     // ingress (deferred → 502); leave it off for the BYO transform path.
     isOfficial: false
@@ -15774,7 +16613,7 @@ function bucketLabel(bucketStartTs, bucket) {
 
 // src/ports/JsonOutboundKeyDb.ts
 var import_node_fs23 = require("fs");
-var import_core3 = require("@omnicross/core");
+var import_core6 = require("@omnicross/core");
 
 // src/ports/atomicFile.ts
 var import_node_crypto22 = require("crypto");
@@ -15896,7 +16735,7 @@ var JsonOutboundKeyDb = class {
     });
   }
   async outboundApiKeysSetPermissions(id, permissions) {
-    const exact = (0, import_core3.validateOutboundPermissions)(permissions);
+    const exact = (0, import_core6.validateOutboundPermissions)(permissions);
     return this.mutateRow(id, (row) => {
       if (row.revokedAt !== null) return false;
       row.allowedEndpoints = [...exact];
@@ -16333,9 +17172,9 @@ var import_node_fs28 = require("fs");
 var import_node_path27 = require("path");
 var import_SubscriptionAccountHealth2 = require("@omnicross/core/pipeline/SubscriptionAccountHealth");
 var import_AccountAllowanceScheduling3 = require("@omnicross/core/pipeline/AccountAllowanceScheduling");
-var import_upstreamFetch9 = require("@omnicross/core/pipeline/upstreamFetch");
+var import_upstreamFetch11 = require("@omnicross/core/pipeline/upstreamFetch");
 var import_SubscriptionIdentityStore2 = require("@omnicross/core/provider-proxy/identity/SubscriptionIdentityStore");
-var import_subscriptions8 = require("@omnicross/subscriptions");
+var import_subscriptions11 = require("@omnicross/subscriptions");
 
 // src/ports/account-sync.ts
 function viewOf(tokens) {
@@ -16483,7 +17322,7 @@ var JsonSubscriptionCredentialStore = class {
    * a plaintext token pair into `upstream-trace.jsonl`.
    */
   buildRefreshFetch(providerId, accountId) {
-    return this.fetchImpl ?? ((url, init) => (0, import_upstreamFetch9.fetchUpstream)(url, init, { providerId, accountId, redactBodies: true }));
+    return this.fetchImpl ?? ((url, init) => (0, import_upstreamFetch11.fetchUpstream)(url, init, { providerId, accountId, redactBodies: true }));
   }
   /**
    * In-flight refresh coalescing. OAuth refresh tokens are
@@ -16524,7 +17363,7 @@ var JsonSubscriptionCredentialStore = class {
    * other hot reads. Never returns token material.
    */
   getAccountProxy(providerId, accountId) {
-    if (providerId !== "claude" && providerId !== "codex" && providerId !== "gemini" && providerId !== "opencodego" && providerId !== "kimi") {
+    if (providerId !== "claude" && providerId !== "codex" && providerId !== "gemini" && providerId !== "opencodego" && providerId !== "kimi" && providerId !== "grok" && providerId !== "copilot") {
       return void 0;
     }
     return getAccountProxy(this.readConfig(), providerId, accountId);
@@ -16543,7 +17382,7 @@ var JsonSubscriptionCredentialStore = class {
     const fingerprintOn = identityStore.isEnabled();
     const now = Date.now();
     const out = {};
-    for (const provider of ["claude", "codex", "gemini", "opencodego", "kimi"]) {
+    for (const provider of ["claude", "codex", "gemini", "opencodego", "kimi", "grok", "copilot"]) {
       const sanitized = sanitizeAccounts(config, provider);
       if (sanitized.length === 0) continue;
       for (const account of sanitized) {
@@ -16609,7 +17448,7 @@ var JsonSubscriptionCredentialStore = class {
       this.materializeMigration(config);
       const refreshFetch = this.buildRefreshFetch("claude", capturedId);
       try {
-        const result = await import_subscriptions8.claudeOAuth.refreshAccessToken(claude.refreshToken, refreshFetch);
+        const result = await import_subscriptions11.claudeOAuth.refreshAccessToken(claude.refreshToken, refreshFetch);
         const expiresAt = new Date(Date.now() + result.expiresIn * 1e3).toISOString();
         const next = {
           ...claude,
@@ -16644,7 +17483,7 @@ var JsonSubscriptionCredentialStore = class {
       this.materializeMigration(config);
       const refreshFetch = this.buildRefreshFetch("codex", capturedId);
       try {
-        const result = await import_subscriptions8.codexOAuth.refreshAccessToken(codex.refreshToken, refreshFetch);
+        const result = await import_subscriptions11.codexOAuth.refreshAccessToken(codex.refreshToken, refreshFetch);
         const expiresAt = new Date(Date.now() + result.expiresIn * 1e3).toISOString();
         const next = {
           ...codex,
@@ -16682,7 +17521,7 @@ var JsonSubscriptionCredentialStore = class {
       this.materializeMigration(config);
       const refreshFetch = this.buildRefreshFetch("gemini", capturedId);
       try {
-        const result = await import_subscriptions8.geminiOAuth.refreshAccessToken(gemini.refreshToken, refreshFetch);
+        const result = await import_subscriptions11.geminiOAuth.refreshAccessToken(gemini.refreshToken, refreshFetch);
         const expiresAt = new Date(Date.now() + result.expiresIn * 1e3).toISOString();
         const next = {
           ...gemini,
@@ -16718,10 +17557,10 @@ var JsonSubscriptionCredentialStore = class {
       this.materializeMigration(config);
       const refreshFetch = this.buildRefreshFetch("kimi", capturedId);
       try {
-        const result = await import_subscriptions8.kimiOAuth.refreshAccessToken(
+        const result = await import_subscriptions11.kimiOAuth.refreshAccessToken(
           kimi.refreshToken,
           refreshFetch,
-          import_subscriptions8.kimiOAuth.kimiFingerprintHeaders(kimi.deviceId)
+          import_subscriptions11.kimiOAuth.kimiFingerprintHeaders(kimi.deviceId)
         );
         const expiresAt = new Date(Date.now() + result.expiresIn * 1e3).toISOString();
         const next = {
@@ -16742,6 +17581,66 @@ var JsonSubscriptionCredentialStore = class {
       }
     });
   }
+  /**
+   * Refresh the Grok (xAI SuperGrok) OAuth access token. The token endpoint is
+   * resolved through OIDC discovery on every refresh (process-cached 1h by the
+   * flow module) so a rotated endpoint document is picked up without a daemon
+   * restart. HONEST `false` when no refresh_token.
+   */
+  async refreshGrokToken() {
+    return this.coalesce("grok:active", async () => {
+      const config = this.readConfig();
+      const active = getActiveAccount(config, "grok");
+      const grok = active?.tokens;
+      if (!active || !grok?.refreshToken) return false;
+      const capturedId = active.id;
+      this.materializeMigration(config);
+      const refreshFetch = this.buildRefreshFetch("grok", capturedId);
+      try {
+        const tokenEndpoint = await import_subscriptions11.grokOAuth.resolveGrokTokenEndpoint(refreshFetch);
+        const result = await import_subscriptions11.grokOAuth.refreshGrokAccessToken(grok.refreshToken, tokenEndpoint, refreshFetch);
+        const expiresAt = new Date(Date.now() + result.expiresIn * 1e3).toISOString();
+        const next = {
+          ...grok,
+          accessToken: result.accessToken,
+          refreshToken: result.refreshToken,
+          expiresAt,
+          status: "authorized",
+          lastRefreshedAt: (/* @__PURE__ */ new Date()).toISOString(),
+          errorMessage: void 0,
+          syncWarning: void 0
+        };
+        this.writeBackById("grok", capturedId, next);
+        return true;
+      } catch (error) {
+        this.markExpiredById("grok", capturedId, grok, error);
+        return false;
+      }
+    });
+  }
+  /**
+   * "Refresh" a GitHub Copilot token — there is nothing to refresh (ghu_
+   * tokens are long-lived with no exchange endpoint). A call here means the
+   * strategy saw a 401 (the token was revoked); mark the account `expired`
+   * with a re-authenticate message and return `false` (the proxy then declines
+   * the retry instead of looping on a dead token).
+   */
+  async refreshCopilotToken() {
+    return this.coalesce("copilot:active", async () => {
+      const config = this.readConfig();
+      const active = getActiveAccount(config, "copilot");
+      const copilot = active?.tokens;
+      if (!active || !copilot?.accessToken) return false;
+      this.materializeMigration(config);
+      this.markExpiredById(
+        "copilot",
+        active.id,
+        copilot,
+        new Error("GitHub Copilot tokens cannot be refreshed \u2014 re-authenticate the account")
+      );
+      return false;
+    });
+  }
   /**
    * Refresh a SPECIFIC managed account by id (background scheduler sweep and
    * account-pool resolution). It uses only that account's stored refresh
@@ -16794,7 +17693,7 @@ var JsonSubscriptionCredentialStore = class {
     }
     const oauth = account.tokens;
     if (!oauth.accessToken) return null;
-    if (providerId === "codex" || providerId === "gemini" || providerId === "kimi") {
+    if (providerId === "codex" || providerId === "gemini" || providerId === "kimi" || providerId === "grok" || providerId === "copilot") {
       const expiresAtMs = oauth.expiresAt ? Date.parse(oauth.expiresAt) : 0;
       const expiringSoon = expiresAtMs > 0 && Date.now() >= expiresAtMs - ACCOUNT_REFRESH_LEAD_MS;
       if (expiringSoon && oauth.refreshToken) {
@@ -16887,10 +17786,10 @@ var JsonSubscriptionCredentialStore = class {
     if (provider === "kimi") {
       const account = accountId ? getAccountById(this.readConfig(), "kimi", accountId) : void 0;
       const deviceId = account?.tokens?.deviceId;
-      const r2 = await import_subscriptions8.kimiOAuth.refreshAccessToken(
+      const r2 = await import_subscriptions11.kimiOAuth.refreshAccessToken(
         refreshToken,
         refreshFetch,
-        import_subscriptions8.kimiOAuth.kimiFingerprintHeaders(deviceId)
+        import_subscriptions11.kimiOAuth.kimiFingerprintHeaders(deviceId)
       );
       return {
         accessToken: r2.accessToken,
@@ -16898,7 +17797,19 @@ var JsonSubscriptionCredentialStore = class {
         expiresAt: new Date(Date.now() + r2.expiresIn * 1e3).toISOString()
       };
     }
-    const flow = provider === "claude" ? import_subscriptions8.claudeOAuth : provider === "codex" ? import_subscriptions8.codexOAuth : import_subscriptions8.geminiOAuth;
+    if (provider === "grok") {
+      const tokenEndpoint = await import_subscriptions11.grokOAuth.resolveGrokTokenEndpoint(refreshFetch);
+      const r2 = await import_subscriptions11.grokOAuth.refreshGrokAccessToken(refreshToken, tokenEndpoint, refreshFetch);
+      return {
+        accessToken: r2.accessToken,
+        refreshToken: r2.refreshToken,
+        expiresAt: new Date(Date.now() + r2.expiresIn * 1e3).toISOString()
+      };
+    }
+    if (provider === "copilot") {
+      throw new Error("GitHub Copilot tokens cannot be refreshed \u2014 re-authenticate the account");
+    }
+    const flow = provider === "claude" ? import_subscriptions11.claudeOAuth : provider === "codex" ? import_subscriptions11.codexOAuth : import_subscriptions11.geminiOAuth;
     const r = await flow.refreshAccessToken(refreshToken, refreshFetch);
     return {
       accessToken: r.accessToken,
@@ -17141,7 +18052,7 @@ var JsonSubscriptionCredentialStore = class {
 };
 
 // src/AccountHealthProbeScheduler.ts
-var import_upstreamFetch10 = require("@omnicross/core/pipeline/upstreamFetch");
+var import_upstreamFetch12 = require("@omnicross/core/pipeline/upstreamFetch");
 
 // src/probe/CodexGenerationProbe.ts
 var import_codexCliHeaders = require("@omnicross/core/provider-proxy/identity/codexCliHeaders");
@@ -17284,7 +18195,16 @@ var PROVIDER_PROBE_PLANS = {
   // Kimi's `GET /coding/v1/usages` is a verified FREE authed GET (the allowance
   // collector uses it), but the probe path also needs the fingerprint headers —
   // keep the probe local until the collector covers the health surface.
-  kimi: { kind: "local" }
+  kimi: { kind: "local" },
+  // Grok's billing proxy is a verified FREE authed GET (the allowance collector
+  // uses it) but it REJECTS non-OAuth credentials and sits on a separate host
+  // with its own product-gate header — keep the probe local, the collector
+  // owns the health surface.
+  grok: { kind: "local" },
+  // The Copilot quota endpoint (copilot_internal/user) is a verified FREE
+  // authed GET but lives on api.github.com with its own auth dialect and a
+  // monthly-only window — the allowance collector owns the health surface.
+  copilot: { kind: "local" }
 };
 function probePlanFor(providerId) {
   return PROVIDER_PROBE_PLANS[providerId] ?? { kind: "local" };
@@ -17306,7 +18226,7 @@ var AccountHealthProbeScheduler = class {
     this.logger = logger;
     this.config = config;
     this.now = opts.now ?? Date.now;
-    this.fetchImpl = opts.fetchImpl ?? import_upstreamFetch10.fetchUpstream;
+    this.fetchImpl = opts.fetchImpl ?? import_upstreamFetch12.fetchUpstream;
     this.sleep = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
     this.planFor = opts.planFor ?? probePlanFor;
   }
@@ -17856,7 +18776,7 @@ async function readAuditStats(auditDir, query2 = {}) {
 }
 
 // src/audit/AuditPruneSweeper.ts
-var DAY_MS3 = 24 * 60 * 6e4;
+var DAY_MS4 = 24 * 60 * 6e4;
 var SWEEP_INTERVAL_MS2 = 60 * 6e4;
 var ARCHIVE_BATCH = 64;
 var AuditPruneSweeper = class {
@@ -17920,7 +18840,7 @@ var AuditPruneSweeper = class {
     this.sweeping = true;
     try {
       if (!(0, import_node_fs30.existsSync)(this.auditDir)) return 0;
-      const cutoff = this.todayMidnight() - (this.config.retentionDays - 1) * DAY_MS3;
+      const cutoff = this.todayMidnight() - (this.config.retentionDays - 1) * DAY_MS4;
       let removed = 0;
       for (const name of (0, import_node_fs30.readdirSync)(this.auditDir)) {
         const dateMs = auditFileDateMs(name);
@@ -18177,7 +19097,7 @@ async function closeAll(writers) {
 // src/usage/UsagePruneSweeper.ts
 var import_promises8 = require("fs/promises");
 var import_node_path31 = require("path");
-var DAY_MS4 = 24 * 60 * 6e4;
+var DAY_MS5 = 24 * 60 * 6e4;
 var SWEEP_INTERVAL_MS3 = 60 * 6e4;
 var DEFAULT_USAGE_RETENTION_DAYS = 90;
 var UsagePruneSweeper = class {
@@ -18234,7 +19154,7 @@ var UsagePruneSweeper = class {
     this.sweeping = true;
     try {
       const retentionDays = this.config.retentionDays ?? DEFAULT_USAGE_RETENTION_DAYS;
-      const cutoff = this.todayMidnight() - (retentionDays - 1) * DAY_MS4;
+      const cutoff = this.todayMidnight() - (retentionDays - 1) * DAY_MS5;
       let removed = 0;
       for (const entry of await listUsageDays(this.usageDir)) {
         if (!entry.hasShard) continue;
@@ -18462,7 +19382,7 @@ var AuditWriter = class {
 var import_node_fs34 = require("fs");
 var import_node_crypto24 = require("crypto");
 var import_node_path34 = require("path");
-var import_upstreamFetch11 = require("@omnicross/core/pipeline/upstreamFetch");
+var import_upstreamFetch13 = require("@omnicross/core/pipeline/upstreamFetch");
 
 // src/billing/billingFiles.ts
 var BILLING_FILE_RE = /^billing-(\d{4})-(\d{2})-(\d{2})\.jsonl$/;
@@ -18485,7 +19405,7 @@ var BillingPublisher = class {
   constructor(billingDir, logger, opts = {}) {
     this.billingDir = billingDir;
     this.logger = logger;
-    this.fetchImpl = opts.fetchImpl ?? ((url, init) => (0, import_upstreamFetch11.fetchUpstream)(url, init));
+    this.fetchImpl = opts.fetchImpl ?? ((url, init) => (0, import_upstreamFetch13.fetchUpstream)(url, init));
     this.defer = opts.defer ?? ((fn) => setTimeout(fn, 0));
     this.timeoutMs = opts.timeoutMs ?? BILLING_POST_TIMEOUT_MS;
     this.now = opts.now ?? Date.now;
@@ -18735,7 +19655,7 @@ var BillingRetrySweeper = class {
 // src/TokenRefreshScheduler.ts
 var REFRESH_LEAD_MS2 = 5 * 6e4;
 var SWEEP_INTERVAL_MS5 = 6e4;
-var OAUTH_PROVIDERS2 = ["claude", "codex", "gemini", "kimi"];
+var OAUTH_PROVIDERS2 = ["claude", "codex", "gemini", "kimi", "grok", "copilot"];
 var TokenRefreshScheduler = class {
   constructor(store, logger, intervalMs = SWEEP_INTERVAL_MS5, leadMs = REFRESH_LEAD_MS2) {
     this.store = store;
@@ -18820,6 +19740,12 @@ var TokenRefreshScheduler = class {
         return this.store.refreshGeminiToken();
       case "kimi":
         return this.store.refreshKimiToken();
+      case "grok":
+        return this.store.refreshGrokToken();
+      // ghu_ tokens never near-expire (far-future expiresAt), so the sweep
+      // never reaches this — the branch exists for union totality.
+      case "copilot":
+        return this.store.refreshCopilotToken();
     }
   }
 };
@@ -18896,7 +19822,7 @@ function createRouteLeaseSubscriptionPreflight(credentials) {
 
 // src/webhook/WebhookDispatcher.ts
 var import_node_crypto25 = require("crypto");
-var import_upstreamFetch12 = require("@omnicross/core/pipeline/upstreamFetch");
+var import_upstreamFetch14 = require("@omnicross/core/pipeline/upstreamFetch");
 var WEBHOOK_MAX_ATTEMPTS = 3;
 var WEBHOOK_QUEUE_MAX = 1e3;
 var WEBHOOK_SEND_TIMEOUT_MS = 1e4;
@@ -18916,7 +19842,7 @@ var WebhookDispatcher = class {
   sleep;
   now;
   constructor(opts = {}) {
-    this.fetchImpl = opts.fetchImpl ?? ((url, init) => (0, import_upstreamFetch12.fetchUpstream)(url, init));
+    this.fetchImpl = opts.fetchImpl ?? ((url, init) => (0, import_upstreamFetch14.fetchUpstream)(url, init));
     this.logger = opts.logger;
     this.maxAttempts = opts.maxAttempts ?? WEBHOOK_MAX_ATTEMPTS;
     this.queueMax = opts.queueMax ?? WEBHOOK_QUEUE_MAX;
@@ -19002,8 +19928,8 @@ var WebhookDispatcher = class {
         signal: AbortSignal.timeout(this.timeoutMs)
       });
       return res.ok ? { ok: true, status: res.status } : { ok: false, status: res.status };
-    } catch (err6) {
-      return { ok: false, error: err6 instanceof Error ? err6.message : String(err6) };
+    } catch (err8) {
+      return { ok: false, error: err8 instanceof Error ? err8.message : String(err8) };
     }
   }
   /**
@@ -19066,7 +19992,7 @@ function feishuText(event) {
 // src/bootstrap.ts
 var activeImageRuntimeBootstrapSession;
 function createImageRuntimeBootstrapSession(initialGeneration) {
-  const openAIOperationRegistry = new import_core4.OpenAIOperationRegistry();
+  const openAIOperationRegistry = new import_core7.OpenAIOperationRegistry();
   const imageRuntimeManager = new ImageRuntimeManager(initialGeneration);
   const unregisterContributions = [];
   try {
@@ -19140,12 +20066,12 @@ function buildDaemon(config, paths) {
   setSecretBox(secretBox3);
   setSecretBox2(secretBox3);
   const decryptedConfig = decryptConfigSecrets(config, secretBox3);
-  const accountAllowanceStore = new import_AccountAllowanceStore7.AccountAllowanceStore(
+  const accountAllowanceStore = new import_AccountAllowanceStore9.AccountAllowanceStore(
     Date.now,
     void 0,
     new JsonAccountAllowancePersistence(defaultAccountAllowancePath(paths.configPath))
   );
-  (0, import_AccountAllowanceStore7.setSharedAccountAllowanceStore)(accountAllowanceStore);
+  (0, import_AccountAllowanceStore9.setSharedAccountAllowanceStore)(accountAllowanceStore);
   (0, import_AccountAllowanceScheduling5.getSharedAccountAllowanceScheduling)().configure(
     (0, import_outbound_api10.normalizeServerConfig)(decryptedConfig.server).allowanceScheduling
   );
@@ -19170,15 +20096,15 @@ function buildDaemon(config, paths) {
   claudeAllowanceRefreshScheduler.configure(
     (0, import_outbound_api10.normalizeServerConfig)(decryptedConfig.server).allowanceScheduling
   );
-  const subscriptionAccounts = new import_subscriptions9.SubscriptionAccountService(credentialStore);
-  (0, import_subscriptions9.setSubscriptionAccountService)(subscriptionAccounts);
-  const subscriptionRegistry = new import_subscriptions9.SubscriptionProviderRegistry(
+  const subscriptionAccounts = new import_subscriptions12.SubscriptionAccountService(credentialStore);
+  (0, import_subscriptions12.setSubscriptionAccountService)(subscriptionAccounts);
+  const subscriptionRegistry = new import_subscriptions12.SubscriptionProviderRegistry(
     subscriptionAccounts,
     credentialStore
   );
-  (0, import_subscriptions9.setSubscriptionProviderRegistry)(subscriptionRegistry);
+  (0, import_subscriptions12.setSubscriptionProviderRegistry)(subscriptionRegistry);
   setServerProxyConfig(decryptedConfig.server?.proxy);
-  (0, import_upstreamFetch13.setUpstreamProxyResolver)(
+  (0, import_upstreamFetch15.setUpstreamProxyResolver)(
     createUpstreamProxyResolver({
       getAccountProxy: (providerId, accountId) => credentialStore.getAccountProxy(providerId, accountId)
     })
@@ -19202,7 +20128,7 @@ function buildDaemon(config, paths) {
   const pricingEngine = new import_usage2.PricingEngine(pricingStore, logger, {
     // Catalog egress follows the same global/env proxy policy as every other
     // daemon upstream call; no provider/account override applies here.
-    fetchImpl: ((input, init) => (0, import_upstreamFetch13.fetchUpstream)(String(input), init ?? {}))
+    fetchImpl: ((input, init) => (0, import_upstreamFetch15.fetchUpstream)(String(input), init ?? {}))
   });
   const pricingRefreshScheduler = new PricingRefreshScheduler(
     pricingEngine,
@@ -19487,7 +20413,7 @@ function buildDaemon(config, paths) {
     // — `server.proxy.byProvider[...]` was silently skipped — and the call was
     // excluded from the upstream trace, so a failing login left no evidence.
     // `redactBodies` keeps the code/verifier + minted token out of that trace.
-    oauthExchangeFetch: paths.oauthExchangeFetch ? () => paths.oauthExchangeFetch : (providerId) => (url, init) => (0, import_upstreamFetch13.fetchUpstream)(url, init, { providerId, redactBodies: true }),
+    oauthExchangeFetch: paths.oauthExchangeFetch ? () => paths.oauthExchangeFetch : (providerId) => (url, init) => (0, import_upstreamFetch15.fetchUpstream)(url, init, { providerId, redactBodies: true }),
     subscriptionAccountAppender: credentialStore,
     // Codex interactive OAuth (app-parity-2 child 5) — the async loopback flow store
     // + the one-shot 127.0.0.1:1455 listener. Token captured + persisted daemon-side;
@@ -19499,6 +20425,9 @@ function buildDaemon(config, paths) {
     // paste; the app shows the verification URL + user code and polls the
     // token-free status). Token captured + persisted daemon-side.
     kimiSessions: new CodexOAuthSessionStore(),
+    // Grok interactive OAuth — the same async DEVICE-CODE shape as kimi.
+    grokSessions: new CodexOAuthSessionStore(),
+    copilotSessions: new CodexOAuthSessionStore(),
     // Migration pack (app-parity child 6, design D2/D3) — the concrete credential
     // store provides BOTH the full DECRYPTED read (`getFullConfig`, export) and
     // the multi-account append (`appendProviderAccount`, import re-encrypts at-
@@ -19557,7 +20486,7 @@ function buildDaemon(config, paths) {
   });
   const webhookDispatcher = new WebhookDispatcher({
     logger,
-    fetchImpl: (url, init) => (0, import_upstreamFetch13.fetchUpstream)(url, init)
+    fetchImpl: (url, init) => (0, import_upstreamFetch15.fetchUpstream)(url, init)
   });
   setWebhookRuntime(webhookDispatcher, (0, import_SubscriptionAccountHealth4.getSharedAccountHealth)());
   const auditWriter = new AuditWriter(auditDir, logger);
@@ -19871,11 +20800,11 @@ async function runLiveProbe(url, key, fetchImpl = fetch) {
       status: res.status,
       estimateHeader: res.headers.get("x-omnicross-count-estimate")
     };
-  } catch (err6) {
+  } catch (err8) {
     return {
       status: null,
       estimateHeader: null,
-      error: err6 instanceof Error ? err6.message : String(err6)
+      error: err8 instanceof Error ? err8.message : String(err8)
     };
   }
 }
@@ -20282,9 +21211,9 @@ async function runLaunch(argv, deps) {
     await daemon.llmConfig.ready();
     await daemon.migrateUsageStore();
     await daemon.providerProxy.start();
-  } catch (err6) {
+  } catch (err8) {
     await shutdownLaunchDaemon(daemon);
-    throw err6;
+    throw err8;
   }
   let launch;
   try {
@@ -20292,9 +21221,9 @@ async function runLaunch(argv, deps) {
       providerId: values.provider,
       model: values.model
     });
-  } catch (err6) {
+  } catch (err8) {
     await shutdownLaunchDaemon(daemon);
-    throw err6;
+    throw err8;
   }
   try {
     const plan = buildCliSpawnPlan({
@@ -20399,9 +21328,9 @@ function spawnCliInherit(plan) {
       process.removeListener("SIGINT", onSignal);
       process.removeListener("SIGTERM", onSignal);
     };
-    child.on("error", (err6) => {
+    child.on("error", (err8) => {
       detach();
-      if (err6.code === "ENOENT") {
+      if (err8.code === "ENOENT") {
         reject(
           new Error(
             `launch: "${plan.command}" not found on PATH \u2014 install the CLI first.`
@@ -20409,7 +21338,7 @@ function spawnCliInherit(plan) {
         );
         return;
       }
-      reject(err6);
+      reject(err8);
     });
     child.on("exit", (code, signal) => {
       detach();
@@ -20422,9 +21351,9 @@ function spawnCliInherit(plan) {
 var import_node_child_process3 = require("child_process");
 var import_node_readline2 = require("readline");
 var import_node_util7 = require("util");
-var import_upstreamFetch14 = require("@omnicross/core/pipeline/upstreamFetch");
-var import_subscriptions10 = require("@omnicross/subscriptions");
-var PROVIDERS2 = ["claude", "codex", "gemini", "kimi"];
+var import_upstreamFetch16 = require("@omnicross/core/pipeline/upstreamFetch");
+var import_subscriptions13 = require("@omnicross/subscriptions");
+var PROVIDERS2 = ["claude", "codex", "gemini", "kimi", "grok", "copilot"];
 async function runLogin(argv, deps) {
   const { values, positionals } = (0, import_node_util7.parseArgs)({
     args: argv,
@@ -20432,7 +21361,9 @@ async function runLogin(argv, deps) {
       config: { type: "string", short: "c" },
       "master-key-file": { type: "string" },
       // Optional user label for the appended account (multi-account).
-      label: { type: "string" }
+      label: { type: "string" },
+      // Optional GitHub Enterprise domain for `login copilot` (GHE accounts).
+      enterprise: { type: "string" }
     },
     allowPositionals: true
   });
@@ -20446,46 +21377,55 @@ async function runLogin(argv, deps) {
   if (!values.config) {
     throw new Error("login: --config <path> is required");
   }
+  if (values.enterprise !== void 0 && provider !== "copilot") {
+    throw new Error("login: --enterprise is only supported for the copilot provider");
+  }
+  const enterpriseDomain = values.enterprise !== void 0 ? import_subscriptions13.copilotOAuth.normalizeCopilotEnterpriseDomain(values.enterprise) : void 0;
   const resolved = {
     openBrowser: deps?.openBrowser ?? openBrowser,
     promptPaste: deps?.promptPaste ?? promptPaste,
     awaitLoopback: deps?.awaitLoopback ?? ((state) => awaitLoopbackCode(state)),
     awaitKimiDevice: deps?.awaitKimiDevice ?? ((fetchImpl) => runKimiDeviceFlow(fetchImpl, resolvedOpenBrowser)),
+    awaitGrokDevice: deps?.awaitGrokDevice ?? ((fetchImpl) => runGrokDeviceFlow(fetchImpl, resolvedOpenBrowser)),
+    awaitCopilotDevice: deps?.awaitCopilotDevice ?? ((fetchImpl, enterpriseUrl) => runCopilotDeviceFlow(fetchImpl, resolvedOpenBrowser, enterpriseUrl)),
     tokensFetch: deps?.tokensFetch
   };
   const resolvedOpenBrowser = resolved.openBrowser;
   const box = resolveSecretBox(values["master-key-file"]);
   setSecretBox(box);
-  (0, import_upstreamFetch14.setUpstreamProxyResolver)(createUpstreamProxyResolver());
+  (0, import_upstreamFetch16.setUpstreamProxyResolver)(createUpstreamProxyResolver());
   try {
     const tokensPath = defaultTokensPath(values.config);
-    const exchangeFetch = resolved.tokensFetch ?? ((url, init) => (0, import_upstreamFetch14.fetchUpstream)(url, init, { providerId: provider, redactBodies: true }));
+    const exchangeFetch = resolved.tokensFetch ?? ((url, init) => (0, import_upstreamFetch16.fetchUpstream)(url, init, { providerId: provider, redactBodies: true }));
     const store = new JsonSubscriptionCredentialStore(tokensPath, box, exchangeFetch);
     const expiresAt = await runProviderLogin(
       provider,
       store,
       resolved,
       exchangeFetch,
-      values.label
+      values.label,
+      enterpriseDomain
     );
     console.info(`Logged in to '${provider}' \u2192 ${tokensPath}`);
     console.info(`  token: [stored, encrypted]   expiresAt: ${expiresAt ?? "n/a"}`);
   } finally {
     setSecretBox(null);
-    (0, import_upstreamFetch14.setUpstreamProxyResolver)(null);
+    (0, import_upstreamFetch16.setUpstreamProxyResolver)(null);
   }
 }
-async function runProviderLogin(provider, store, deps, exchangeFetch, label) {
+async function runProviderLogin(provider, store, deps, exchangeFetch, label, enterpriseUrl) {
   if (provider === "codex") return loginCodex(store, deps, exchangeFetch, label);
   if (provider === "claude") return loginClaude(store, deps, exchangeFetch, label);
   if (provider === "kimi") return loginKimi(store, deps, exchangeFetch, label);
+  if (provider === "grok") return loginGrok(store, deps, exchangeFetch, label);
+  if (provider === "copilot") return loginCopilot(store, deps, exchangeFetch, label, enterpriseUrl);
   return loginGemini(store, deps, exchangeFetch, label);
 }
 async function loginCodex(store, deps, exchangeFetch, label) {
-  const { authUrl, codeVerifier, state } = import_subscriptions10.codexOAuth.generateAuthParams();
+  const { authUrl, codeVerifier, state } = import_subscriptions13.codexOAuth.generateAuthParams();
   await presentUrl(authUrl, deps);
   const code = await deps.awaitLoopback(state);
-  const result = await import_subscriptions10.codexOAuth.exchangeCodeForTokens(
+  const result = await import_subscriptions13.codexOAuth.exchangeCodeForTokens(
     { authorizationCode: code, codeVerifier, state },
     exchangeFetch
   );
@@ -20504,7 +21444,7 @@ async function loginCodex(store, deps, exchangeFetch, label) {
   return expiresAt;
 }
 async function loginClaude(store, deps, exchangeFetch, label) {
-  const { authUrl, codeVerifier, state } = import_subscriptions10.claudeOAuth.generateAuthParams();
+  const { authUrl, codeVerifier, state } = import_subscriptions13.claudeOAuth.generateAuthParams();
   await presentUrl(authUrl, deps);
   const pasted = (await deps.promptPaste("Paste the authorization code (code#state): ")).trim();
   const [code, pastedState] = pasted.split("#");
@@ -20512,7 +21452,7 @@ async function loginClaude(store, deps, exchangeFetch, label) {
   if (pastedState && pastedState !== state) {
     throw new Error("login: pasted state did not match (possible CSRF) \u2014 aborting");
   }
-  const result = await import_subscriptions10.claudeOAuth.exchangeCodeForTokens(
+  const result = await import_subscriptions13.claudeOAuth.exchangeCodeForTokens(
     { authorizationCode: code, codeVerifier, state },
     exchangeFetch
   );
@@ -20531,11 +21471,11 @@ async function loginClaude(store, deps, exchangeFetch, label) {
   return expiresAt;
 }
 async function loginGemini(store, deps, exchangeFetch, label) {
-  const { authUrl, codeVerifier } = import_subscriptions10.geminiOAuth.generateAuthParams();
+  const { authUrl, codeVerifier } = import_subscriptions13.geminiOAuth.generateAuthParams();
   await presentUrl(authUrl, deps);
   const code = (await deps.promptPaste("Paste the authorization code: ")).trim();
   if (!code) throw new Error("login: no authorization code was pasted");
-  const result = await import_subscriptions10.geminiOAuth.exchangeCodeForTokens(code, codeVerifier, exchangeFetch);
+  const result = await import_subscriptions13.geminiOAuth.exchangeCodeForTokens(code, codeVerifier, exchangeFetch);
   const expiresAt = new Date(Date.now() + result.expiresIn * 1e3).toISOString();
   const block = {
     authMethod: "oauth",
@@ -20550,9 +21490,9 @@ async function loginGemini(store, deps, exchangeFetch, label) {
   return expiresAt;
 }
 async function runKimiDeviceFlow(exchangeFetch, openBrowserFn) {
-  const deviceId = import_subscriptions10.kimiOAuth.generateKimiDeviceId();
-  const fingerprint = import_subscriptions10.kimiOAuth.kimiFingerprintHeaders(deviceId);
-  const authorization = await import_subscriptions10.kimiOAuth.requestDeviceAuthorization(exchangeFetch, fingerprint);
+  const deviceId = import_subscriptions13.kimiOAuth.generateKimiDeviceId();
+  const fingerprint = import_subscriptions13.kimiOAuth.kimiFingerprintHeaders(deviceId);
+  const authorization = await import_subscriptions13.kimiOAuth.requestDeviceAuthorization(exchangeFetch, fingerprint);
   const url = authorization.verificationUriComplete ?? authorization.verificationUri;
   console.info("Open this URL in your browser and approve the request:");
   console.info(`  ${url}`);
@@ -20560,14 +21500,14 @@ async function runKimiDeviceFlow(exchangeFetch, openBrowserFn) {
     console.info(`  Then enter this code: ${authorization.userCode}`);
   }
   await openBrowserFn(url).catch(() => false);
-  const result = await import_subscriptions10.kimiOAuth.awaitDeviceToken(authorization, exchangeFetch, {
+  const result = await import_subscriptions13.kimiOAuth.awaitDeviceToken(authorization, exchangeFetch, {
     fingerprint,
     onPending: () => process.stdout.write(".")
   });
   console.info("");
   return {
     ...result,
-    accountId: import_subscriptions10.kimiOAuth.kimiAccountIdFromAccessToken(result.accessToken),
+    accountId: import_subscriptions13.kimiOAuth.kimiAccountIdFromAccessToken(result.accessToken),
     deviceId
   };
 }
@@ -20588,6 +21528,90 @@ async function loginKimi(store, deps, exchangeFetch, label) {
   logMasked("kimi", result.accessToken);
   return expiresAt;
 }
+async function runGrokDeviceFlow(exchangeFetch, openBrowserFn) {
+  const tokenEndpoint = await import_subscriptions13.grokOAuth.resolveGrokTokenEndpoint(exchangeFetch);
+  const authorization = await import_subscriptions13.grokOAuth.requestGrokDeviceAuthorization(exchangeFetch);
+  const url = authorization.verificationUriComplete ?? authorization.verificationUri;
+  console.info("Open this URL in your browser and approve the request:");
+  console.info(`  ${url}`);
+  if (!authorization.verificationUriComplete) {
+    console.info(`  Then enter this code: ${authorization.userCode}`);
+  }
+  await openBrowserFn(url).catch(() => false);
+  const result = await import_subscriptions13.grokOAuth.awaitGrokDeviceToken(authorization, tokenEndpoint, exchangeFetch, {
+    onPending: () => process.stdout.write(".")
+  });
+  console.info("");
+  return {
+    ...result,
+    accountId: import_subscriptions13.grokOAuth.grokAccountIdFromAccessToken(result.accessToken)
+  };
+}
+async function loginGrok(store, deps, exchangeFetch, label) {
+  const result = await deps.awaitGrokDevice(exchangeFetch);
+  const expiresAt = new Date(Date.now() + result.expiresIn * 1e3).toISOString();
+  const block = {
+    authMethod: "oauth",
+    status: "authorized",
+    accessToken: result.accessToken,
+    refreshToken: result.refreshToken,
+    expiresAt,
+    ...result.accountId ? { accountId: result.accountId } : {},
+    lastRefreshedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  await store.appendProviderAccount("grok", block, label);
+  logMasked("grok", result.accessToken);
+  return expiresAt;
+}
+async function runCopilotDeviceFlow(exchangeFetch, openBrowserFn, enterpriseUrl) {
+  if (enterpriseUrl) console.info(`Using GitHub Enterprise host: ${enterpriseUrl}`);
+  const authorization = await import_subscriptions13.copilotOAuth.requestCopilotDeviceAuthorization(exchangeFetch, enterpriseUrl);
+  const url = authorization.verificationUri;
+  console.info("Open this URL in your browser and approve the request:");
+  console.info(`  ${url}`);
+  console.info(`  Then enter this code: ${authorization.userCode}`);
+  await openBrowserFn(url).catch(() => false);
+  const result = await import_subscriptions13.copilotOAuth.awaitCopilotDeviceToken(authorization, exchangeFetch, {
+    onPending: () => process.stdout.write("."),
+    ...enterpriseUrl ? { enterpriseUrl } : {}
+  });
+  console.info("");
+  const identity = await import_subscriptions13.copilotOAuth.fetchCopilotIdentity(result.accessToken, exchangeFetch, enterpriseUrl);
+  const apiEndpoint = await import_subscriptions13.copilotOAuth.discoverCopilotApiEndpoint(result.accessToken, exchangeFetch, enterpriseUrl);
+  console.info("Enabling Copilot models (policy)...");
+  await import_subscriptions13.copilotOAuth.enableAllCopilotModels(
+    result.accessToken,
+    { apiEndpoint, ...enterpriseUrl ? { enterpriseUrl } : {} },
+    exchangeFetch
+  );
+  return {
+    accessToken: result.accessToken,
+    expiresIn: Math.floor(import_subscriptions13.copilotOAuth.COPILOT_FAR_FUTURE_MS / 1e3),
+    ...identity,
+    ...apiEndpoint ? { apiEndpoint } : {}
+  };
+}
+async function loginCopilot(store, deps, exchangeFetch, label, enterpriseUrl) {
+  const result = await deps.awaitCopilotDevice(exchangeFetch, enterpriseUrl);
+  const expiresAt = new Date(Date.now() + result.expiresIn * 1e3).toISOString();
+  const block = {
+    authMethod: "oauth",
+    status: "authorized",
+    accessToken: result.accessToken,
+    // ghu_ tokens have no refresh lifecycle — the same token doubles as the
+    // stored refresh credential so generic refresh paths stay well-formed.
+    refreshToken: result.accessToken,
+    expiresAt,
+    ...result.accountId ? { accountId: result.accountId } : {},
+    ...result.email ? { email: result.email } : {},
+    ...result.apiEndpoint ? { apiEndpoint: result.apiEndpoint } : {},
+    ...enterpriseUrl ? { enterpriseUrl } : {},
+    lastRefreshedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  await store.appendProviderAccount("copilot", block, label);
+  logMasked("copilot", result.accessToken);
+  return expiresAt;
+}
 function isLoginProvider(value) {
   return PROVIDERS2.includes(value);
 }
@@ -21293,7 +22317,7 @@ async function main() {
       process.exitCode = 1;
   }
 }
-main().catch((err6) => {
-  console.error(err6 instanceof Error ? err6.message : String(err6));
+main().catch((err8) => {
+  console.error(err8 instanceof Error ? err8.message : String(err8));
   process.exitCode = 1;
 });