@omnicross/daemon 0.3.1 → 0.4.0

package/dist/index.d.cts

@@ -6,7 +6,7 @@ import { RouteLeaseManager, ProviderProxy } from '@omnicross/core/provider-proxy
 import { UsageRecorder, PricingEngine } from '@omnicross/core/usage';
 import { SubscriptionCredentialStore, FetchLike, CodexImageCapabilityEvidenceSource, CodexImageCapabilityEvidenceRequest, CodexImageCapabilityEvidence, CodexImageCapabilityObservation, ImageExecutionScheduler, ImageExecutionAccountKey, ImageExecutionSchedulerRequest, ImageExecutionSchedulerGrant, SubscriptionAccountService, SubscriptionProviderRegistry } from '@omnicross/subscriptions';
 import { AccountAllowanceSnapshot, AllowanceWindow } from '@omnicross/contracts/account-allowance-types';
-import { ClaudeTokenConfig, CodexTokenConfig, GeminiTokenConfig, KimiTokenConfig, AccountTokensConfig, ProxyConfig, SubscriptionAccountSanitized, AccountClientIdentity, SubscriptionAccountEntry } from '@omnicross/contracts/account-tokens-types';
+import { ClaudeTokenConfig, CodexTokenConfig, GeminiTokenConfig, KimiTokenConfig, GrokTokenConfig, CopilotTokenConfig, AccountTokensConfig, ProxyConfig, SubscriptionAccountSanitized, AccountClientIdentity, SubscriptionAccountEntry } from '@omnicross/contracts/account-tokens-types';
 import * as _omnicross_contracts_subscription_types from '@omnicross/contracts/subscription-types';
 import { OpenCodeGoTokenConfig, SubscriptionProviderId } from '@omnicross/contracts/subscription-types';
 import { AccountAllowanceStore } from '@omnicross/core/pipeline/AccountAllowanceStore';
@@ -536,6 +536,18 @@ interface DaemonProviderConfig {
      * round-trips verbatim on GET. Management-UI only.
      */
     modelsEndpoint?: string;
+    /**
+     * OPTIONAL static extra request headers merged into every BYO request for
+     * this row — identity/attribution contracts some gateways hard-gate on
+     * (e.g. the Cline client-identity set). Additive + back-compat: absent
+     * reads as undefined. NON-SECRET — round-trips verbatim on GET; values may
+     * carry `{{platform}}` (resolved to `process.platform` at request time).
+     * ENFORCED: the outbound header funnel (`getProviderHeaders`) +
+     * discover-models + test-model merge them; auth/content header NAMES are
+     * dropped by the load guard (`validateExtraHeaders`) so credentials stay
+     * key-field-only.
+     */
+    extraHeaders?: Record<string, string>;
     /**
      * OPTIONAL provider transformer config (app-parity child 5). Additive +
      * back-compat: absent reads as the prior default (undefined). NON-SECRET —
@@ -666,7 +678,7 @@ type AtomicFileReplace = (targetPath: string, contents: string) => void;
  */
 
 /** Provider id → owned contract field names. */
-type DaemonProvider = 'claude' | 'codex' | 'gemini' | 'opencodego' | 'kimi';
+type DaemonProvider = 'claude' | 'codex' | 'gemini' | 'opencodego' | 'kimi' | 'grok' | 'copilot';
 interface AccountMetadataPatch {
     label?: string;
     enabled?: boolean;
@@ -795,7 +807,7 @@ type ExternalCliReader = (provider: ExternalCliProvider) => ExternalCliCredentia
  * shapes), keyed by `SubscriptionProviderId` the daemon admin layer validates
  * the wire body to one of these before calling the writer.
  */
-type SubscriptionTokenBlock = ClaudeTokenConfig | CodexTokenConfig | GeminiTokenConfig | OpenCodeGoTokenConfig | KimiTokenConfig;
+type SubscriptionTokenBlock = ClaudeTokenConfig | CodexTokenConfig | GeminiTokenConfig | OpenCodeGoTokenConfig | KimiTokenConfig | GrokTokenConfig | CopilotTokenConfig;
 declare class JsonSubscriptionCredentialStore implements SubscriptionCredentialStore {
     private readonly tokensPath;
     private readonly box;
@@ -907,13 +919,28 @@ declare class JsonSubscriptionCredentialStore implements SubscriptionCredentialS
      * `false` when no refresh_token.
      */
     refreshKimiToken(): Promise<boolean>;
+    /**
+     * Refresh the Grok (xAI SuperGrok) OAuth access token. The token endpoint is
+     * resolved through OIDC discovery on every refresh (process-cached 1h by the
+     * flow module) so a rotated endpoint document is picked up without a daemon
+     * restart. HONEST `false` when no refresh_token.
+     */
+    refreshGrokToken(): Promise<boolean>;
+    /**
+     * "Refresh" a GitHub Copilot token — there is nothing to refresh (ghu_
+     * tokens are long-lived with no exchange endpoint). A call here means the
+     * strategy saw a 401 (the token was revoked); mark the account `expired`
+     * with a re-authenticate message and return `false` (the proxy then declines
+     * the retry instead of looping on a dead token).
+     */
+    refreshCopilotToken(): Promise<boolean>;
     /**
      * Refresh a SPECIFIC managed account by id (background scheduler sweep and
      * account-pool resolution). It uses only that account's stored refresh
      * token. Coalesced per `provider:id`; on failure flags ONLY that account
      * `expired`.
      */
-    refreshAccountById(provider: 'claude' | 'codex' | 'gemini' | 'kimi', id: string): Promise<boolean>;
+    refreshAccountById(provider: 'claude' | 'codex' | 'gemini' | 'kimi' | 'grok' | 'copilot', id: string): Promise<boolean>;
     /**
      * Resolve a SPECIFIC account's access token by id (design D6). Mirrors each
      * provider's ACTIVE-getter policy, keyed by id: claude returns the stored token
@@ -1510,6 +1537,105 @@ declare class KimiAllowanceCollector {
     private unsupportedSnapshot;
 }
 
+/**
+ * Grok (xAI SuperGrok) OAuth usage collector.
+ *
+ * Polls the Grok CLI billing proxy (`cli-chat-proxy.grok.com/v1/billing` —
+ * NOT `*.x.ai`, and it REJECTS paid API keys: OAuth bearer only) per grok
+ * account, mirroring the Claude/Codex/Kimi collectors' cache contract:
+ * 5-minute cache, per-account in-flight merging, one 401→refresh→retry.
+ *
+ * Dual shape (mirrors the audit source's semantics):
+ *  - WEEKLY credits (`?format=credits`): `config.creditUsagePercent` +
+ *    `config.currentPeriod{start,end,type}` (+ per-product rows and an
+ *    on-demand cap, both optional). A missing `creditUsagePercent` on an
+ *    ACTIVE weekly period reads as 0 (a fresh period has no usage row).
+ *  - UNIFIED monthly (default URL): `config.{billingPeriodStart,
+ *    billingPeriodEnd, monthlyLimit{val}, used{val}}` — accounts flagged
+ *    `isUnifiedBillingUser` omit the weekly percentage and meter a monthly
+ *    included quota instead.
+ *
+ * Probe policy: always probe weekly first; probe monthly when weekly is
+ * missing OR the account is flagged unified. An INFERRED weekly percentage
+ * (field absent) on a unified account is only kept when the monthly probe
+ * positively confirms there is no monthly quota — otherwise the monthly
+ * window wins (an inferred 0% weekly on a unified account is a lie), and a
+ * failed monthly probe falls through to a failure snapshot so the store
+ * retains the last good one.
+ *
+ * Every request carries `X-XAI-Token-Auth: xai-grok-cli` — the same product
+ * gate the official CLI uses on this host.
+ */
+
+interface GrokAllowanceCredentialReader {
+    getAccessTokenForAccount(providerId: 'grok', accountId: string): Promise<string | null>;
+    refreshAccountToken(providerId: 'grok', accountId: string): Promise<boolean>;
+}
+type GrokAllowanceFetch = (url: string, init: RequestInit, accountId: string) => Promise<Response>;
+interface GrokAllowanceCollectOptions {
+    force?: boolean;
+    refreshAheadMs?: number;
+}
+declare class GrokAllowanceCollector {
+    private readonly credentials;
+    private readonly store;
+    private readonly fetchImpl;
+    private readonly now;
+    private readonly inFlight;
+    constructor(credentials: GrokAllowanceCredentialReader, store?: AccountAllowanceStore, fetchImpl?: GrokAllowanceFetch, now?: () => number);
+    collectMany(accounts: readonly SubscriptionAccountEntry<GrokTokenConfig>[], options?: GrokAllowanceCollectOptions): Promise<AccountAllowanceSnapshot[]>;
+    collect(account: SubscriptionAccountEntry<GrokTokenConfig>, options?: GrokAllowanceCollectOptions): Promise<AccountAllowanceSnapshot>;
+    private isCacheValid;
+    private fetchAccount;
+    private failureSnapshot;
+    private unsupportedSnapshot;
+}
+
+/**
+ * CopilotAllowanceCollector — GitHub Copilot quota via the internal user API.
+ *
+ * Polls `GET api.github.com/copilot_internal/user` per copilot account
+ * (Bearer ghu_ + the mirrored Copilot CLI user-agent), reading
+ * `quota_snapshots`:
+ *  - `premium_interactions` — the plan's premium-request monthly window
+ *    (`{entitlement, remaining, percent_remaining, unlimited}` + the
+ *    account-level `quota_reset_date`). Reported as a single `thirty-day`
+ *    window; an `unlimited` entitlement reports 0% (never blocks).
+ *  - `chat` — the legacy chat-completions quota, reported only when it is
+ *    NOT unlimited (newer plans fold it into premium).
+ *
+ * Mirrors the Claude/Codex/Kimi/Grok collectors' cache contract: 5-minute
+ * cache, per-account in-flight merging, one 401→refresh→retry (for copilot a
+ * "refresh" marks the account expired — ghu_ tokens cannot be refreshed — so
+ * the retry path is exercised only by transient upstream 401 flaps and never
+ * loops). The GitHub API base honors the account's `enterpriseUrl` (GHE).
+ */
+
+interface CopilotAllowanceCredentialReader {
+    getAccessTokenForAccount(providerId: 'copilot', accountId: string): Promise<string | null>;
+    refreshAccountToken(providerId: 'copilot', accountId: string): Promise<boolean>;
+}
+type CopilotAllowanceFetch = (url: string, init: RequestInit, accountId: string) => Promise<Response>;
+interface CopilotAllowanceCollectOptions {
+    force?: boolean;
+    refreshAheadMs?: number;
+}
+declare class CopilotAllowanceCollector {
+    private readonly credentials;
+    private readonly store;
+    private readonly fetchImpl;
+    private readonly now;
+    private readonly inFlight;
+    constructor(credentials: CopilotAllowanceCredentialReader, store?: AccountAllowanceStore, fetchImpl?: CopilotAllowanceFetch, now?: () => number);
+    collectMany(accounts: readonly SubscriptionAccountEntry<CopilotTokenConfig>[], options?: CopilotAllowanceCollectOptions): Promise<AccountAllowanceSnapshot[]>;
+    collect(account: SubscriptionAccountEntry<CopilotTokenConfig>, options?: CopilotAllowanceCollectOptions): Promise<AccountAllowanceSnapshot>;
+    private isCacheValid;
+    private fetchAccount;
+    private request;
+    private failureSnapshot;
+    private unsupportedSnapshot;
+}
+
 /**
  * OpenCodeGo usage collector.
  *
@@ -1557,8 +1683,8 @@ declare class OpenCodeGoAllowanceCollector {
  * literals — extending them all would make the overloads conflict.
  */
 interface AccountAllowanceCredentialReader {
-    getAccessTokenForAccount(providerId: 'claude' | 'codex' | 'kimi' | 'opencodego', accountId: string): Promise<string | null>;
-    refreshAccountToken(providerId: 'claude' | 'codex' | 'kimi', accountId: string): Promise<boolean>;
+    getAccessTokenForAccount(providerId: 'claude' | 'codex' | 'kimi' | 'opencodego' | 'grok' | 'copilot', accountId: string): Promise<string | null>;
+    refreshAccountToken(providerId: 'claude' | 'codex' | 'kimi' | 'grok' | 'copilot', accountId: string): Promise<boolean>;
     getFullConfig(): Promise<AccountTokensConfig>;
 }
 interface AccountAllowanceFilter {
@@ -1576,8 +1702,10 @@ declare class AccountAllowanceService {
     readonly claudeCollector: ClaudeAllowanceCollector;
     readonly codexCollector: CodexAllowanceCollector;
     readonly kimiCollector: KimiAllowanceCollector;
+    readonly grokCollector: GrokAllowanceCollector;
+    readonly copilotCollector: CopilotAllowanceCollector;
     readonly opencodegoCollector: OpenCodeGoAllowanceCollector;
-    constructor(credentials: AccountAllowanceCredentialReader, store?: AccountAllowanceStore, collector?: ClaudeAllowanceCollector, codexCollector?: CodexAllowanceCollector, kimiCollector?: KimiAllowanceCollector, opencodegoCollector?: OpenCodeGoAllowanceCollector, now?: () => number);
+    constructor(credentials: AccountAllowanceCredentialReader, store?: AccountAllowanceStore, collector?: ClaudeAllowanceCollector, codexCollector?: CodexAllowanceCollector, kimiCollector?: KimiAllowanceCollector, opencodegoCollector?: OpenCodeGoAllowanceCollector, grokCollector?: GrokAllowanceCollector, copilotCollector?: CopilotAllowanceCollector, now?: () => number);
     /**
      * Read all/filtered snapshots. Claude's and Codex's five-minute caches are
      * refreshed lazily on read (Codex polls `/backend-api/wham/usage`; the
@@ -1597,6 +1725,10 @@ declare class AccountAllowanceService {
     refreshOpenCodeGo(accountId?: string): Promise<AccountAllowanceSnapshot[]>;
     /** Force-refresh Kimi usage (`/coding/v1/usages`) for one/all accounts. */
     refreshKimi(accountId?: string): Promise<AccountAllowanceSnapshot[]>;
+    /** Force-refresh Copilot usage (copilot_internal/user) for one/all accounts. */
+    refreshCopilot(accountId?: string): Promise<AccountAllowanceSnapshot[]>;
+    /** Force-refresh Grok usage (CLI billing proxy) for one/all accounts. */
+    refreshGrok(accountId?: string): Promise<AccountAllowanceSnapshot[]>;
     /**
      * Keep Claude + Codex + Kimi snapshots warm for allowance-aware routing. All
      * collectors preserve their cache + per-account in-flight coalescing; a tick
@@ -1988,6 +2120,12 @@ type BillingStatusReader = () => BillingDeliveryStatus;
  *      .status_code === 0` is the real success gate. `model_remains[]` buckets
  *      each carry a rolling interval + weekly window as REMAINING percent
  *      (0-100); the `"general"` bucket is the plan-wide shared quota.
+ *  - Cline Pass:
+ *      GET {origin}/api/v1/users/me/plan/usage-limits
+ *      `Authorization: Bearer <key>` PLUS the Cline client-identity header set
+ *      (the row's `extraHeaders` — the gateway 403s without the full mirror).
+ *      `limits[]` rows carry `{type: five_hour|weekly|monthly, percentUsed,
+ *      resetsAt}` — pure percentage windows, no absolute meters.
  *
  * Everything here is pure; the fetch/cache lifecycle lives in
  * `ProviderKeyQuotaService`. Windows reuse the subscription `AllowanceWindow`
@@ -1995,7 +2133,7 @@ type BillingStatusReader = () => BillingDeliveryStatus;
  */
 
 /** Which quota adapter applies to a provider row (by resolved endpoint). */
-type ProviderKeyQuotaAdapter = 'zai' | 'minimax-token-plan' | 'umans' | 'synthetic';
+type ProviderKeyQuotaAdapter = 'zai' | 'minimax-token-plan' | 'umans' | 'synthetic' | 'cline-pass';
 
 /**
  * ProviderKeyQuotaService — read-through quota cache for BYO provider-row keys.
@@ -2797,6 +2935,10 @@ interface AccountAllowanceAdminReader {
     refreshKimi?(accountId?: string): Promise<AccountAllowanceSnapshot[]>;
     /** Optional: OpenCodeGo `/v1/usage` refresh (absent on older daemons). */
     refreshOpenCodeGo?(accountId?: string): Promise<AccountAllowanceSnapshot[]>;
+    /** Optional: Grok CLI-billing refresh (absent on older daemons). */
+    refreshGrok?(accountId?: string): Promise<AccountAllowanceSnapshot[]>;
+    /** Optional: Copilot user-quota refresh (absent on older daemons). */
+    refreshCopilot?(accountId?: string): Promise<AccountAllowanceSnapshot[]>;
     removeAccountSnapshot?(providerId: SubscriptionProviderId, accountId: string): void;
     removeProviderSnapshots?(providerId: SubscriptionProviderId): void;
     getSchedulingStatus?(): AccountAllowanceSchedulingStatus;
@@ -2946,6 +3088,16 @@ interface AdminApiDeps {
      * shape as codex; one sign-in at a time. Wired in `bootstrap.ts`.
      */
     readonly kimiSessions: CodexOAuthSessionStore;
+    /**
+     * Grok interactive-OAuth flow store (device code). Same token-free polled
+     * shape as codex; one sign-in at a time. Wired in `bootstrap.ts`.
+     */
+    readonly grokSessions: CodexOAuthSessionStore;
+    /**
+     * Copilot interactive-OAuth flow store (device code). Same token-free
+     * polled shape; one sign-in at a time. Wired in `bootstrap.ts`.
+     */
+    readonly copilotSessions: CodexOAuthSessionStore;
     /**
      * Codex loopback listener (app-parity-2 child 5) — defaults to `awaitLoopbackCode`
      * (binds 127.0.0.1:1455) in `bootstrap.ts`; tests inject a mock so no real port

package/dist/index.d.ts

@@ -6,7 +6,7 @@ import { RouteLeaseManager, ProviderProxy } from '@omnicross/core/provider-proxy
 import { UsageRecorder, PricingEngine } from '@omnicross/core/usage';
 import { SubscriptionCredentialStore, FetchLike, CodexImageCapabilityEvidenceSource, CodexImageCapabilityEvidenceRequest, CodexImageCapabilityEvidence, CodexImageCapabilityObservation, ImageExecutionScheduler, ImageExecutionAccountKey, ImageExecutionSchedulerRequest, ImageExecutionSchedulerGrant, SubscriptionAccountService, SubscriptionProviderRegistry } from '@omnicross/subscriptions';
 import { AccountAllowanceSnapshot, AllowanceWindow } from '@omnicross/contracts/account-allowance-types';
-import { ClaudeTokenConfig, CodexTokenConfig, GeminiTokenConfig, KimiTokenConfig, AccountTokensConfig, ProxyConfig, SubscriptionAccountSanitized, AccountClientIdentity, SubscriptionAccountEntry } from '@omnicross/contracts/account-tokens-types';
+import { ClaudeTokenConfig, CodexTokenConfig, GeminiTokenConfig, KimiTokenConfig, GrokTokenConfig, CopilotTokenConfig, AccountTokensConfig, ProxyConfig, SubscriptionAccountSanitized, AccountClientIdentity, SubscriptionAccountEntry } from '@omnicross/contracts/account-tokens-types';
 import * as _omnicross_contracts_subscription_types from '@omnicross/contracts/subscription-types';
 import { OpenCodeGoTokenConfig, SubscriptionProviderId } from '@omnicross/contracts/subscription-types';
 import { AccountAllowanceStore } from '@omnicross/core/pipeline/AccountAllowanceStore';
@@ -536,6 +536,18 @@ interface DaemonProviderConfig {
      * round-trips verbatim on GET. Management-UI only.
      */
     modelsEndpoint?: string;
+    /**
+     * OPTIONAL static extra request headers merged into every BYO request for
+     * this row — identity/attribution contracts some gateways hard-gate on
+     * (e.g. the Cline client-identity set). Additive + back-compat: absent
+     * reads as undefined. NON-SECRET — round-trips verbatim on GET; values may
+     * carry `{{platform}}` (resolved to `process.platform` at request time).
+     * ENFORCED: the outbound header funnel (`getProviderHeaders`) +
+     * discover-models + test-model merge them; auth/content header NAMES are
+     * dropped by the load guard (`validateExtraHeaders`) so credentials stay
+     * key-field-only.
+     */
+    extraHeaders?: Record<string, string>;
     /**
      * OPTIONAL provider transformer config (app-parity child 5). Additive +
      * back-compat: absent reads as the prior default (undefined). NON-SECRET —
@@ -666,7 +678,7 @@ type AtomicFileReplace = (targetPath: string, contents: string) => void;
  */
 
 /** Provider id → owned contract field names. */
-type DaemonProvider = 'claude' | 'codex' | 'gemini' | 'opencodego' | 'kimi';
+type DaemonProvider = 'claude' | 'codex' | 'gemini' | 'opencodego' | 'kimi' | 'grok' | 'copilot';
 interface AccountMetadataPatch {
     label?: string;
     enabled?: boolean;
@@ -795,7 +807,7 @@ type ExternalCliReader = (provider: ExternalCliProvider) => ExternalCliCredentia
  * shapes), keyed by `SubscriptionProviderId` the daemon admin layer validates
  * the wire body to one of these before calling the writer.
  */
-type SubscriptionTokenBlock = ClaudeTokenConfig | CodexTokenConfig | GeminiTokenConfig | OpenCodeGoTokenConfig | KimiTokenConfig;
+type SubscriptionTokenBlock = ClaudeTokenConfig | CodexTokenConfig | GeminiTokenConfig | OpenCodeGoTokenConfig | KimiTokenConfig | GrokTokenConfig | CopilotTokenConfig;
 declare class JsonSubscriptionCredentialStore implements SubscriptionCredentialStore {
     private readonly tokensPath;
     private readonly box;
@@ -907,13 +919,28 @@ declare class JsonSubscriptionCredentialStore implements SubscriptionCredentialS
      * `false` when no refresh_token.
      */
     refreshKimiToken(): Promise<boolean>;
+    /**
+     * Refresh the Grok (xAI SuperGrok) OAuth access token. The token endpoint is
+     * resolved through OIDC discovery on every refresh (process-cached 1h by the
+     * flow module) so a rotated endpoint document is picked up without a daemon
+     * restart. HONEST `false` when no refresh_token.
+     */
+    refreshGrokToken(): Promise<boolean>;
+    /**
+     * "Refresh" a GitHub Copilot token — there is nothing to refresh (ghu_
+     * tokens are long-lived with no exchange endpoint). A call here means the
+     * strategy saw a 401 (the token was revoked); mark the account `expired`
+     * with a re-authenticate message and return `false` (the proxy then declines
+     * the retry instead of looping on a dead token).
+     */
+    refreshCopilotToken(): Promise<boolean>;
     /**
      * Refresh a SPECIFIC managed account by id (background scheduler sweep and
      * account-pool resolution). It uses only that account's stored refresh
      * token. Coalesced per `provider:id`; on failure flags ONLY that account
      * `expired`.
      */
-    refreshAccountById(provider: 'claude' | 'codex' | 'gemini' | 'kimi', id: string): Promise<boolean>;
+    refreshAccountById(provider: 'claude' | 'codex' | 'gemini' | 'kimi' | 'grok' | 'copilot', id: string): Promise<boolean>;
     /**
      * Resolve a SPECIFIC account's access token by id (design D6). Mirrors each
      * provider's ACTIVE-getter policy, keyed by id: claude returns the stored token
@@ -1510,6 +1537,105 @@ declare class KimiAllowanceCollector {
     private unsupportedSnapshot;
 }
 
+/**
+ * Grok (xAI SuperGrok) OAuth usage collector.
+ *
+ * Polls the Grok CLI billing proxy (`cli-chat-proxy.grok.com/v1/billing` —
+ * NOT `*.x.ai`, and it REJECTS paid API keys: OAuth bearer only) per grok
+ * account, mirroring the Claude/Codex/Kimi collectors' cache contract:
+ * 5-minute cache, per-account in-flight merging, one 401→refresh→retry.
+ *
+ * Dual shape (mirrors the audit source's semantics):
+ *  - WEEKLY credits (`?format=credits`): `config.creditUsagePercent` +
+ *    `config.currentPeriod{start,end,type}` (+ per-product rows and an
+ *    on-demand cap, both optional). A missing `creditUsagePercent` on an
+ *    ACTIVE weekly period reads as 0 (a fresh period has no usage row).
+ *  - UNIFIED monthly (default URL): `config.{billingPeriodStart,
+ *    billingPeriodEnd, monthlyLimit{val}, used{val}}` — accounts flagged
+ *    `isUnifiedBillingUser` omit the weekly percentage and meter a monthly
+ *    included quota instead.
+ *
+ * Probe policy: always probe weekly first; probe monthly when weekly is
+ * missing OR the account is flagged unified. An INFERRED weekly percentage
+ * (field absent) on a unified account is only kept when the monthly probe
+ * positively confirms there is no monthly quota — otherwise the monthly
+ * window wins (an inferred 0% weekly on a unified account is a lie), and a
+ * failed monthly probe falls through to a failure snapshot so the store
+ * retains the last good one.
+ *
+ * Every request carries `X-XAI-Token-Auth: xai-grok-cli` — the same product
+ * gate the official CLI uses on this host.
+ */
+
+interface GrokAllowanceCredentialReader {
+    getAccessTokenForAccount(providerId: 'grok', accountId: string): Promise<string | null>;
+    refreshAccountToken(providerId: 'grok', accountId: string): Promise<boolean>;
+}
+type GrokAllowanceFetch = (url: string, init: RequestInit, accountId: string) => Promise<Response>;
+interface GrokAllowanceCollectOptions {
+    force?: boolean;
+    refreshAheadMs?: number;
+}
+declare class GrokAllowanceCollector {
+    private readonly credentials;
+    private readonly store;
+    private readonly fetchImpl;
+    private readonly now;
+    private readonly inFlight;
+    constructor(credentials: GrokAllowanceCredentialReader, store?: AccountAllowanceStore, fetchImpl?: GrokAllowanceFetch, now?: () => number);
+    collectMany(accounts: readonly SubscriptionAccountEntry<GrokTokenConfig>[], options?: GrokAllowanceCollectOptions): Promise<AccountAllowanceSnapshot[]>;
+    collect(account: SubscriptionAccountEntry<GrokTokenConfig>, options?: GrokAllowanceCollectOptions): Promise<AccountAllowanceSnapshot>;
+    private isCacheValid;
+    private fetchAccount;
+    private failureSnapshot;
+    private unsupportedSnapshot;
+}
+
+/**
+ * CopilotAllowanceCollector — GitHub Copilot quota via the internal user API.
+ *
+ * Polls `GET api.github.com/copilot_internal/user` per copilot account
+ * (Bearer ghu_ + the mirrored Copilot CLI user-agent), reading
+ * `quota_snapshots`:
+ *  - `premium_interactions` — the plan's premium-request monthly window
+ *    (`{entitlement, remaining, percent_remaining, unlimited}` + the
+ *    account-level `quota_reset_date`). Reported as a single `thirty-day`
+ *    window; an `unlimited` entitlement reports 0% (never blocks).
+ *  - `chat` — the legacy chat-completions quota, reported only when it is
+ *    NOT unlimited (newer plans fold it into premium).
+ *
+ * Mirrors the Claude/Codex/Kimi/Grok collectors' cache contract: 5-minute
+ * cache, per-account in-flight merging, one 401→refresh→retry (for copilot a
+ * "refresh" marks the account expired — ghu_ tokens cannot be refreshed — so
+ * the retry path is exercised only by transient upstream 401 flaps and never
+ * loops). The GitHub API base honors the account's `enterpriseUrl` (GHE).
+ */
+
+interface CopilotAllowanceCredentialReader {
+    getAccessTokenForAccount(providerId: 'copilot', accountId: string): Promise<string | null>;
+    refreshAccountToken(providerId: 'copilot', accountId: string): Promise<boolean>;
+}
+type CopilotAllowanceFetch = (url: string, init: RequestInit, accountId: string) => Promise<Response>;
+interface CopilotAllowanceCollectOptions {
+    force?: boolean;
+    refreshAheadMs?: number;
+}
+declare class CopilotAllowanceCollector {
+    private readonly credentials;
+    private readonly store;
+    private readonly fetchImpl;
+    private readonly now;
+    private readonly inFlight;
+    constructor(credentials: CopilotAllowanceCredentialReader, store?: AccountAllowanceStore, fetchImpl?: CopilotAllowanceFetch, now?: () => number);
+    collectMany(accounts: readonly SubscriptionAccountEntry<CopilotTokenConfig>[], options?: CopilotAllowanceCollectOptions): Promise<AccountAllowanceSnapshot[]>;
+    collect(account: SubscriptionAccountEntry<CopilotTokenConfig>, options?: CopilotAllowanceCollectOptions): Promise<AccountAllowanceSnapshot>;
+    private isCacheValid;
+    private fetchAccount;
+    private request;
+    private failureSnapshot;
+    private unsupportedSnapshot;
+}
+
 /**
  * OpenCodeGo usage collector.
  *
@@ -1557,8 +1683,8 @@ declare class OpenCodeGoAllowanceCollector {
  * literals — extending them all would make the overloads conflict.
  */
 interface AccountAllowanceCredentialReader {
-    getAccessTokenForAccount(providerId: 'claude' | 'codex' | 'kimi' | 'opencodego', accountId: string): Promise<string | null>;
-    refreshAccountToken(providerId: 'claude' | 'codex' | 'kimi', accountId: string): Promise<boolean>;
+    getAccessTokenForAccount(providerId: 'claude' | 'codex' | 'kimi' | 'opencodego' | 'grok' | 'copilot', accountId: string): Promise<string | null>;
+    refreshAccountToken(providerId: 'claude' | 'codex' | 'kimi' | 'grok' | 'copilot', accountId: string): Promise<boolean>;
     getFullConfig(): Promise<AccountTokensConfig>;
 }
 interface AccountAllowanceFilter {
@@ -1576,8 +1702,10 @@ declare class AccountAllowanceService {
     readonly claudeCollector: ClaudeAllowanceCollector;
     readonly codexCollector: CodexAllowanceCollector;
     readonly kimiCollector: KimiAllowanceCollector;
+    readonly grokCollector: GrokAllowanceCollector;
+    readonly copilotCollector: CopilotAllowanceCollector;
     readonly opencodegoCollector: OpenCodeGoAllowanceCollector;
-    constructor(credentials: AccountAllowanceCredentialReader, store?: AccountAllowanceStore, collector?: ClaudeAllowanceCollector, codexCollector?: CodexAllowanceCollector, kimiCollector?: KimiAllowanceCollector, opencodegoCollector?: OpenCodeGoAllowanceCollector, now?: () => number);
+    constructor(credentials: AccountAllowanceCredentialReader, store?: AccountAllowanceStore, collector?: ClaudeAllowanceCollector, codexCollector?: CodexAllowanceCollector, kimiCollector?: KimiAllowanceCollector, opencodegoCollector?: OpenCodeGoAllowanceCollector, grokCollector?: GrokAllowanceCollector, copilotCollector?: CopilotAllowanceCollector, now?: () => number);
     /**
      * Read all/filtered snapshots. Claude's and Codex's five-minute caches are
      * refreshed lazily on read (Codex polls `/backend-api/wham/usage`; the
@@ -1597,6 +1725,10 @@ declare class AccountAllowanceService {
     refreshOpenCodeGo(accountId?: string): Promise<AccountAllowanceSnapshot[]>;
     /** Force-refresh Kimi usage (`/coding/v1/usages`) for one/all accounts. */
     refreshKimi(accountId?: string): Promise<AccountAllowanceSnapshot[]>;
+    /** Force-refresh Copilot usage (copilot_internal/user) for one/all accounts. */
+    refreshCopilot(accountId?: string): Promise<AccountAllowanceSnapshot[]>;
+    /** Force-refresh Grok usage (CLI billing proxy) for one/all accounts. */
+    refreshGrok(accountId?: string): Promise<AccountAllowanceSnapshot[]>;
     /**
      * Keep Claude + Codex + Kimi snapshots warm for allowance-aware routing. All
      * collectors preserve their cache + per-account in-flight coalescing; a tick
@@ -1988,6 +2120,12 @@ type BillingStatusReader = () => BillingDeliveryStatus;
  *      .status_code === 0` is the real success gate. `model_remains[]` buckets
  *      each carry a rolling interval + weekly window as REMAINING percent
  *      (0-100); the `"general"` bucket is the plan-wide shared quota.
+ *  - Cline Pass:
+ *      GET {origin}/api/v1/users/me/plan/usage-limits
+ *      `Authorization: Bearer <key>` PLUS the Cline client-identity header set
+ *      (the row's `extraHeaders` — the gateway 403s without the full mirror).
+ *      `limits[]` rows carry `{type: five_hour|weekly|monthly, percentUsed,
+ *      resetsAt}` — pure percentage windows, no absolute meters.
  *
  * Everything here is pure; the fetch/cache lifecycle lives in
  * `ProviderKeyQuotaService`. Windows reuse the subscription `AllowanceWindow`
@@ -1995,7 +2133,7 @@ type BillingStatusReader = () => BillingDeliveryStatus;
  */
 
 /** Which quota adapter applies to a provider row (by resolved endpoint). */
-type ProviderKeyQuotaAdapter = 'zai' | 'minimax-token-plan' | 'umans' | 'synthetic';
+type ProviderKeyQuotaAdapter = 'zai' | 'minimax-token-plan' | 'umans' | 'synthetic' | 'cline-pass';
 
 /**
  * ProviderKeyQuotaService — read-through quota cache for BYO provider-row keys.
@@ -2797,6 +2935,10 @@ interface AccountAllowanceAdminReader {
     refreshKimi?(accountId?: string): Promise<AccountAllowanceSnapshot[]>;
     /** Optional: OpenCodeGo `/v1/usage` refresh (absent on older daemons). */
     refreshOpenCodeGo?(accountId?: string): Promise<AccountAllowanceSnapshot[]>;
+    /** Optional: Grok CLI-billing refresh (absent on older daemons). */
+    refreshGrok?(accountId?: string): Promise<AccountAllowanceSnapshot[]>;
+    /** Optional: Copilot user-quota refresh (absent on older daemons). */
+    refreshCopilot?(accountId?: string): Promise<AccountAllowanceSnapshot[]>;
     removeAccountSnapshot?(providerId: SubscriptionProviderId, accountId: string): void;
     removeProviderSnapshots?(providerId: SubscriptionProviderId): void;
     getSchedulingStatus?(): AccountAllowanceSchedulingStatus;
@@ -2946,6 +3088,16 @@ interface AdminApiDeps {
      * shape as codex; one sign-in at a time. Wired in `bootstrap.ts`.
      */
     readonly kimiSessions: CodexOAuthSessionStore;
+    /**
+     * Grok interactive-OAuth flow store (device code). Same token-free polled
+     * shape as codex; one sign-in at a time. Wired in `bootstrap.ts`.
+     */
+    readonly grokSessions: CodexOAuthSessionStore;
+    /**
+     * Copilot interactive-OAuth flow store (device code). Same token-free
+     * polled shape; one sign-in at a time. Wired in `bootstrap.ts`.
+     */
+    readonly copilotSessions: CodexOAuthSessionStore;
     /**
      * Codex loopback listener (app-parity-2 child 5) — defaults to `awaitLoopbackCode`
      * (binds 127.0.0.1:1455) in `bootstrap.ts`; tests inject a mock so no real port