clauderipple 0.9.1 → 0.9.2

package/dist/router/src/providers/grok/catalog.js

@@ -0,0 +1,52 @@
+// The models a Grok subscription offers, as the CLI chat proxy lists them (`GET /v1/models`).
+//
+// Measured 2026-10-08 (CLI 1.0.46, SuperGrok): four models, each with `context_window`,
+// `reasoning_efforts` (`[{id, value, label, description, default}]`, listed high to low) and
+// `api_backend: "responses"`. The listing is the truth about the ladder: grok-4.5 lists low..high,
+// the others low..xhigh. (Chat Completions accepted `xhigh` on grok-4.5 too, but a 200 means only
+// "not refused" — §4c — so the listing wins.) `max` and the string "none" are refused with 400
+// `invalid-argument` on every model; omitting the field is accepted and the model's default (`high`)
+// applies.
+export const GROK_DEFAULT_URL = "https://cli-chat-proxy.grok.com/v1";
+/** The ladder for a model the listing has not described. Ascending, as the picker expects. */
+export const GROK_EFFORT_LEVELS = ["low", "medium", "high", "xhigh"];
+const ORDER = ["minimal", "low", "medium", "high", "xhigh", "max"];
+/** What the listing said on 2026-10-08, for when it cannot be asked (no session yet, offline). */
+export const GROK_FALLBACK_MODELS = [
+    { id: "grok-4.7", name: "Grok 4.7", contextWindow: 256000, effortLevels: [...GROK_EFFORT_LEVELS] },
+    { id: "grok-4.7-build-fast", name: "Grok 4.7 Fast", contextWindow: 256000, effortLevels: [...GROK_EFFORT_LEVELS] },
+    { id: "grok-4.6", name: "Grok 4.6", contextWindow: 256000, effortLevels: [...GROK_EFFORT_LEVELS] },
+    { id: "grok-4.5", name: "Grok 4.5", contextWindow: 256000, effortLevels: ["low", "medium", "high"] },
+];
+/**
+ * Model entries from a `/v1/models` body. Only `id`, `name`, `contextWindow` and `effortLevels` are
+ * kept: a Grok model never carries `wire`, `url` or `authHeader`, because `providerFor` would turn it
+ * into an openai-compatible provider without the session headers.
+ */
+export function grokModelsFromListing(body) {
+    const data = body && typeof body === "object" && Array.isArray(body.data) ? body.data : [];
+    return data.flatMap((item) => {
+        if (!item || typeof item !== "object")
+            return [];
+        const m = item;
+        if (typeof m.id !== "string" || !m.id)
+            return [];
+        const listed = Array.isArray(m.reasoning_efforts)
+            ? m.reasoning_efforts.flatMap((effort) => {
+                const value = effort && typeof effort === "object" ? effort.value ?? effort.id : undefined;
+                return typeof value === "string" ? [value] : [];
+            })
+            : undefined;
+        const effortLevels = m.supports_reasoning_effort === false
+            ? []
+            : listed && listed.length > 0
+                ? [...new Set(listed)].sort((a, b) => (ORDER.indexOf(a) + 1 || 99) - (ORDER.indexOf(b) + 1 || 99))
+                : undefined;
+        return [{
+                id: m.id,
+                ...(typeof m.name === "string" && m.name ? { name: m.name } : {}),
+                ...(typeof m.context_window === "number" && m.context_window > 0 ? { contextWindow: m.context_window } : {}),
+                ...(effortLevels !== undefined ? { effortLevels } : {}),
+            }];
+    });
+}

package/dist/router/src/providers/grok/index.js

@@ -0,0 +1,94 @@
+// Grok on a SuperGrok / X Premium subscription: Anthropic Messages translated to OpenAI Chat
+// Completions and sent to the chat proxy the Grok CLI itself talks to, signed in with the CLI's own
+// session. The translation, streaming, retries and error mapping are the openai-compatible adapter's;
+// what this adds is the credential, which rotates under us, and the headers the proxy routes on.
+//
+// The proxy is documented for direct use in the CLI's README ("Using auth.json for API Access":
+// `Authorization: Bearer`, `X-XAI-Token-Auth: xai-grok-cli`, `x-grok-model-override`). Measured
+// 2026-10-08 that it also refuses a request without `x-grok-client-version` (426 "Your Grok CLI
+// version (none) is outdated"), which the README does not mention — see ARCHITECTURE §4e.
+import { OpenAiCompatibleAdapter } from "../openai/index.js";
+import { GROK_AUTH_HINT, GrokAuth, GrokAuthError, grokHome, sharedGrokAuth } from "./auth.js";
+import { GROK_DEFAULT_URL, GROK_EFFORT_LEVELS } from "./catalog.js";
+/**
+ * Facts only, returned by the probe in a `warning` field like the Antigravity one. Nothing published
+ * by xAI says either way whether a third-party client may use the CLI's session.
+ */
+export const GROK_WARNING = "This uses the Grok CLI's own sign-in and the chat proxy the CLI talks to. xAI's README for the CLI " +
+    "shows that proxy being called directly with this session, but the version header it also requires " +
+    "is undocumented, and the proxy is not a published API: a CLI release or a change on xAI's side can " +
+    "break this without warning. ClaudeRipple is not affiliated with xAI.";
+/** The headers the proxy authenticates and routes on. The model goes in a header, not just the body. */
+export function grokHeaders(token, model, clientVersion) {
+    return {
+        authorization: `Bearer ${token}`,
+        "x-xai-token-auth": "xai-grok-cli",
+        "x-grok-model-override": model,
+        "x-grok-client-version": clientVersion,
+    };
+}
+function bearer(headers) {
+    return (headers.authorization ?? "").replace(/^Bearer\s+/i, "");
+}
+export class GrokAdapter {
+    name;
+    auth;
+    inner;
+    constructor(name, cfg, log, auth) {
+        this.name = name;
+        // Shared with the dashboard's probe and with any other provider on the same session, and kept
+        // across a config change that rebuilds this adapter.
+        this.auth = auth ?? sharedGrokAuth({ home: cfg.home ?? grokHome(), ...(cfg.cli ? { cli: cfg.cli } : {}), log });
+        // Chat Completions rather than the `responses` backend the listing names: on Chat the reasoning
+        // arrives as text the mapper turns into thinking blocks, and a stable prefix was cached without a
+        // conversation header (measured 2026-10-08, §4e). Effort per model comes from the listing the
+        // probe saved; a model it has not described gets the common ladder.
+        const translated = {
+            type: "openai-compatible",
+            url: cfg.url ?? GROK_DEFAULT_URL,
+            wire: "chat",
+            caps: { reasoning: "effort", effortLevels: [...GROK_EFFORT_LEVELS] },
+            ...(cfg.models ? { models: cfg.models } : {}),
+            ...(cfg.identity === undefined ? {} : { identity: cfg.identity }),
+            ...(cfg.instructionsAppend ? { instructionsAppend: cfg.instructionsAppend } : {}),
+        };
+        this.inner = new OpenAiCompatibleAdapter(name, translated, log, {
+            label: "Grok",
+            logTag: "grok",
+            authHint: GROK_AUTH_HINT,
+            headers: async (model) => {
+                const token = this.auth.current();
+                return grokHeaders(token?.key ?? "", model, await this.auth.clientVersion(cfg.clientVersion));
+            },
+            unauthorized: async (_model, sent) => this.auth.rejected(bearer(sent)),
+        });
+    }
+    async handle(req, res, path, json, model, effort) {
+        // Counting tokens is answered locally and needs no session.
+        if (!path.startsWith("/v1/messages/count_tokens")) {
+            // The wait can be a 30s CLI refresh. A client that leaves meanwhile has cancelled the turn, and
+            // the inner adapter only starts listening for that once it is called, so it is watched from here.
+            let closed = res.destroyed;
+            const onClose = () => { closed = true; };
+            res.on("close", onClose);
+            try {
+                await this.auth.token();
+            }
+            catch (error) {
+                if (closed)
+                    return { status: 0, bytes: 0, note: "client closed" };
+                if (!(error instanceof GrokAuthError))
+                    throw error;
+                const body = JSON.stringify({ type: "error", error: { type: "authentication_error", message: `Grok: ${error.message}` } });
+                res.writeHead(401, { "content-type": "application/json", "content-length": String(Buffer.byteLength(body)) }).end(body);
+                return { status: 401, bytes: Buffer.byteLength(body), note: "no usable Grok session" };
+            }
+            finally {
+                res.off("close", onClose);
+            }
+            if (closed)
+                return { status: 0, bytes: 0, note: "client closed" };
+        }
+        return this.inner.handle(req, res, path, json, model, effort);
+    }
+}

package/dist/router/src/providers/openai/index.js

@@ -20,7 +20,8 @@ function failureStatus(failure) {
 function vendorMessage(text) {
     try {
         const json = JSON.parse(text);
-        const candidate = json.error?.message ?? json.message ?? json.detail;
+        // Most vendors nest the message; some (the Grok CLI proxy) send `{"error": "<message>"}`.
+        const candidate = typeof json.error === "string" ? json.error : json.error?.message ?? json.message ?? json.detail;
         if (typeof candidate === "string")
             return candidate.slice(0, 500);
     }
@@ -31,16 +32,24 @@ function vendorMessage(text) {
 export function looksLikeAuth(text) {
     return /\b(api[_ -]?key|token|credential|unauthori[sz]ed|authentication|invalid[_ -]?key|expired)\b/i.test(text);
 }
-export function mapHttpError(status, text) {
-    const message = `OpenAI-compatible provider: ${vendorMessage(text)}`;
+/**
+ * `label` names the provider in the message the user reads; `authHint`, when given, is appended to an
+ * authentication error to say what to do about it — a credential the user can fix in another tool is
+ * only fixable if the error names the tool.
+ */
+export function mapHttpError(status, text, label = "OpenAI-compatible provider", authHint, redact = (message) => message) {
+    // Cleaned after decoding: a credential escaped inside the JSON (`\u0074ok…`) only reads as itself
+    // once the string is parsed.
+    const message = `${label}: ${redact(vendorMessage(text))}`;
+    const authMessage = authHint ? `${message} — ${authHint}` : message;
     if (status === 401)
-        return anthropicError(401, "authentication_error", message);
+        return anthropicError(401, "authentication_error", authMessage);
     // A 403 is often not the credential at all: a data-sharing policy that needs opting into, a
     // region, a model the account may not use. Calling it an authentication error sends the user
     // back to check a key that was never the problem — which is most of an afternoon.
     if (status === 403) {
         return looksLikeAuth(text)
-            ? anthropicError(401, "authentication_error", message)
+            ? anthropicError(401, "authentication_error", authMessage)
             : anthropicError(403, "permission_error", message);
     }
     if (status === 429)
@@ -62,11 +71,15 @@ export class OpenAiCompatibleAdapter {
     name;
     cfg;
     log;
+    hooks;
+    tag;
     lastInputByKey = new Map();
-    constructor(name, cfg, log) {
+    constructor(name, cfg, log, hooks = {}) {
         this.name = name;
         this.cfg = cfg;
         this.log = log;
+        this.hooks = hooks;
+        this.tag = hooks.logTag ?? "openai";
     }
     rememberInput(key, usage) {
         const total = usage.input_tokens + usage.cache_read_input_tokens;
@@ -96,7 +109,7 @@ export class OpenAiCompatibleAdapter {
         // an empty answer with nothing logged anywhere.
         const serverTools = serverToolNames(json.tools);
         if (serverTools.size > 0)
-            this.log.warn(`openai ${this.name}: dropped server tools for ${model}: ${[...serverTools].join(", ")} (Anthropic runs these; this provider cannot)`);
+            this.log.warn(`${this.tag} ${this.name}: dropped server tools for ${model}: ${[...serverTools].join(", ")} (Anthropic runs these; this provider cannot)`);
         const upstreamRequest = toOpenAiRequest(json, {
             model,
             wire,
@@ -112,46 +125,85 @@ export class OpenAiCompatibleAdapter {
         const sessionHeader = this.cfg.sessionHeader
             ? { [this.cfg.sessionHeader]: conversationKey(json) }
             : {};
-        const upstreamHeaders = { "content-type": "application/json", accept: "text/event-stream", ...sessionHeader, ...(this.cfg.headers ?? {}) };
-        const upstreamSecrets = credentialHeaderValues(Object.entries(upstreamHeaders));
+        const label = this.hooks.label ?? "OpenAI-compatible provider";
+        const headersNow = async () => ({
+            "content-type": "application/json",
+            accept: "text/event-stream",
+            ...sessionHeader,
+            ...(this.cfg.headers ?? {}),
+            ...(this.hooks.headers ? await this.hooks.headers(model) : {}),
+        });
+        let upstreamHeaders = {};
+        // Every credential sent on any attempt: after a 401 retry the vendor's error may still echo the
+        // first one.
+        const upstreamSecrets = new Set();
+        const redact = (text) => redactErrorText(text, [...upstreamSecrets], 2000);
         // Same input floor behavior as the ChatGPT adapter: the CLI snapshots message_start before usage arrives.
         const key = JSON.stringify({ model, wire, system: json.system ?? "", user: json.messages.find((message) => message.role === "user")?.content ?? "" });
         const startInput = Math.max(estimateTokens(json), this.lastInputByKey.get(key) ?? 0);
         const controller = new AbortController();
         const onClose = () => controller.abort();
         res.on("close", onClose);
-        let upstream;
-        try {
+        const ask = async () => {
+            upstreamHeaders = await headersNow();
+            for (const secret of credentialHeaderValues(Object.entries(upstreamHeaders)))
+                upstreamSecrets.add(secret);
             // Nothing has been written to the client yet, so a failure another attempt could answer is
             // asked again here rather than handed to the user as an error they would have to retry by
             // hand. Once this returns, the response is written straight through (see `fetchWithRetry`).
-            upstream = await fetchWithRetry(endpoint(this.cfg.url, wire), {
+            return fetchWithRetry(endpoint(this.cfg.url, wire), {
                 method: "POST",
                 headers: upstreamHeaders,
                 body: requestBody,
                 signal: controller.signal,
-            }, { log: (line) => this.log.info(`openai ${this.name}: ${line}`) });
+            }, { log: (line) => this.log.info(`${this.tag} ${this.name}: ${redact(line)}`), ...(this.hooks.attempts ? { attempts: this.hooks.attempts } : {}) });
+        };
+        let upstream;
+        try {
+            upstream = await ask();
+            // A credential that rotates under us can be refused for being the one we read a moment before
+            // its owner replaced it. Still nothing written, so the turn can be asked once more.
+            if (upstream.status === 401 && this.hooks.unauthorized) {
+                const refusal = await upstream.text().catch(() => "");
+                if (await this.hooks.unauthorized(model, upstreamHeaders)) {
+                    this.log.info(`${this.tag} ${this.name}: 401 for ${model}; credential changed, asking again`);
+                    upstream = await ask();
+                }
+                else {
+                    upstream = new Response(refusal, { status: 401 });
+                }
+            }
         }
         catch (error) {
             res.off("close", onClose);
             if (controller.signal.aborted)
                 return { status: 0, bytes: 0, note: "client closed" };
-            const out = anthropicError(502, "api_error", `OpenAI-compatible provider unreachable: ${error.message}`);
+            // fetch names an invalid header value in full, credential included; the message also reaches the
+            // request log through whoever catches this.
+            error.message = redact(error.message);
+            const out = anthropicError(502, "api_error", `${label} unreachable: ${error.message}`);
             if (!res.headersSent)
                 res.writeHead(out.status, { "content-type": "application/json" }).end(out.body);
             throw error;
         }
         if (!upstream.ok || !upstream.body) {
             const text = await upstream.text().catch(() => "");
-            const safeText = redactErrorText(text, upstreamSecrets);
-            const out = mapHttpError(upstream.status, safeText);
-            this.log.warn(`openai ${this.name}: upstream ${upstream.status} for ${model}: ${safeText.slice(0, 400)}`);
+            // Re-serialised first, so an escaped credential in a JSON body is spelled out before it is matched.
+            let plain = text;
+            try {
+                plain = JSON.stringify(JSON.parse(text));
+            }
+            catch { /* not JSON: matched as it came */ }
+            const safeText = redactErrorText(plain, [...upstreamSecrets]);
+            const out = mapHttpError(upstream.status, text, label, this.hooks.authHint, redact);
+            this.log.warn(`${this.tag} ${this.name}: upstream ${upstream.status} for ${model}: ${safeText.slice(0, 400)}`);
             res.off("close", onClose);
             res.writeHead(out.status, { "content-type": "application/json", "content-length": String(Buffer.byteLength(out.body)) }).end(out.body);
             return { status: out.status, bytes: Buffer.byteLength(out.body), note: `upstream ${upstream.status}`, exhaustion: providerExhaustion(upstream.status, text, retryAfterMs(Object.fromEntries(upstream.headers))) };
         }
         const wantStream = json.stream === true;
         const mapper = new OpenAiStreamMapper(model, startInput, toolNameRestoreMap(json));
+        mapper.redactError = redact;
         const parser = new SseParser();
         const reader = upstream.body.getReader();
         const decoder = new TextDecoder();

package/dist/router/src/providers/openai/translate.js

@@ -291,6 +291,8 @@ export class OpenAiStreamMapper {
     startInput;
     /** Mangled tool name → the name Claude Code knows, from `toolNameRestoreMap`. */
     toolNames;
+    /** Applied to every error message before it is stored or sent. */
+    redactError = (message) => message;
     constructor(model, startInput = 0, toolNames = new Map()) {
         this.model = model;
         this.startInput = startInput;
@@ -548,10 +550,13 @@ export class OpenAiStreamMapper {
         this.stopReason = this.sawTool || this.finishReason === "tool_calls" ? "tool_use" : this.finishReason === "length" || this.finishReason === "max_output_tokens" ? "max_tokens" : "end_turn";
         return [...this.start(), ...this.closeBlock(), { event: "message_delta", data: { type: "message_delta", delta: { stop_reason: this.stopReason, stop_sequence: null }, usage: this.usage } }, { event: "message_stop", data: { type: "message_stop" } }];
     }
-    fail(message, code) {
+    fail(rawMessage, code) {
         if (this.finished)
             return [];
         this.finished = true;
+        // A vendor's error text can echo the credential it was sent; the client, the non-streamed body
+        // and the request log all take `failure.message`, so it is cleaned once, here.
+        const message = this.redactError(rawMessage);
         // `overloaded_error` is the one mid-stream error Claude Code retries on its own (CLI 2.1.278
         // matches `"type":"overloaded_error"` in the message); `api_error` ends the turn for good.
         const type = code === "rate_limit_exceeded" ? "rate_limit_error" : code === "server_is_overloaded" ? "overloaded_error" : "api_error";

package/dist/router/src/proxy.js

@@ -30,6 +30,7 @@ import { PRESETS } from "./presets.js";
 import { ChatGptAdapter } from "./providers/chatgpt/index.js";
 import { OpenAiCompatibleAdapter } from "./providers/openai/index.js";
 import { GoogleAdapter } from "./providers/google/index.js";
+import { GrokAdapter } from "./providers/grok/index.js";
 import { conversationKey } from "./providers/chatgpt/translate.js";
 import { providerFor, searchProviderFor, terminateHosts } from "./config.js";
 import { chatPickerModels, injectPickerModels, isBootstrapPath } from "./picker.js";
@@ -186,6 +187,7 @@ export class Proxy {
     chatgptAdapters = new Map();
     openaiAdapters = new Map();
     googleAdapters = new Map();
+    grokAdapters = new Map();
     claudeAccounts;
     /** Each Claude subscription account's usage, for the admin status (never a token). */
     claudeUsage;
@@ -304,6 +306,15 @@ export class Proxy {
         this.openaiAdapters.set(name, { key, adapter });
         return adapter;
     }
+    grok(name, cfg) {
+        const key = JSON.stringify(cfg);
+        const cur = this.grokAdapters.get(name);
+        if (cur && cur.key === key)
+            return cur.adapter;
+        const adapter = new GrokAdapter(name, cfg, this.deps.log);
+        this.grokAdapters.set(name, { key, adapter });
+        return adapter;
+    }
     google(name, cfg) {
         const key = JSON.stringify(cfg);
         const cur = this.googleAdapters.get(name);
@@ -881,6 +892,38 @@ export class Proxy {
                 }
                 return;
             }
+            if (provider.type === "grok") {
+                // The chat proxy keeps no server-side thread, so a `continue` is refused like on the other
+                // translated providers and the CLI resends the turn with the full history.
+                const td = threadDecision(json);
+                if (td === "refuse") {
+                    const out = JSON.stringify(THREAD_UNSUPPORTED);
+                    res.writeHead(400, { "content-type": "application/json", "content-length": String(Buffer.byteLength(out)) }).end(out);
+                    finish("400", out.length, "thread continue refused → CLI resends stateless", false, { resent: true });
+                    return;
+                }
+                if (td === "strip")
+                    stripThreadFields(json);
+                record = { ...record, target: route.model, provider: route.provider };
+                const routeEffort = effortOf(json);
+                if (routeEffort)
+                    record.effort = routeEffort;
+                tag = `GROK ${route.tag} effort=${routeEffort ?? "-"}`;
+                try {
+                    const o = await this.grok(route.provider, provider).handle(req, res, path, json, route.model, routeEffort);
+                    this.recordOutcome(route.provider, o.status);
+                    finish(String(o.status), o.bytes, o.note, o.status >= 400, { ...(o.usage ? { usage: o.usage } : {}), ...(o.stopReason ? { stopReason: o.stopReason } : {}) });
+                }
+                catch (e) {
+                    this.recordOutcome(route.provider, 0);
+                    finish("-", 0, `grok error ${e.code ?? ""} ${e.message}`);
+                    if (!res.headersSent)
+                        res.writeHead(502, { "content-type": "application/json" }).end(JSON.stringify({ type: "error", error: { type: "api_error", message: e.message } }));
+                    else
+                        res.destroy();
+                }
+                return;
+            }
             if (provider.type === "anthropic") {
                 if (!provider.accountPool || provider.auth !== "claude-code") {
                     finish("400", 0, "native Anthropic provider is available through OpenAI ingress only", false);

package/dist/router/src/redact.js

@@ -11,8 +11,13 @@ function credentialHeaderName(name) {
 export function credentialHeaderValues(headers) {
     const secrets = new Set();
     for (const [rawName, value] of headers) {
-        if (credentialHeaderName(rawName) && value)
-            secrets.add(value);
+        if (!credentialHeaderName(rawName) || !value)
+            continue;
+        secrets.add(value);
+        // A vendor that echoes the credential echoes the token, not the scheme in front of it.
+        const bare = /^(?:Bearer|Basic|Token)\s+(\S+)$/i.exec(value)?.[1];
+        if (bare)
+            secrets.add(bare);
     }
     return [...secrets].sort((a, b) => b.length - a.length);
 }

package/dist/router/src/version.js

@@ -5,4 +5,4 @@
 // from the manifests. Until 0.1.1 the router and the CLI each carried their own literal, and both
 // still said "0.1.0" in the 0.1.1 release: after an update nobody could tell which router was
 // running, and the tray app had nothing to compare (2026-09-15, reported from a Windows install).
-export const VERSION = "0.9.1";
+export const VERSION = "0.9.2";

package/dist/ui/app.js

@@ -105,6 +105,8 @@ function fallbackEffortLevels(provider, model) {
   const explicit = modelEffortLevels(provider, model);
   if (explicit !== undefined) return explicit;
   if (provider.type === "chatgpt") return CHATGPT_ULTRA_MODELS.has(model) ? [...CHATGPT_EFFORT_LEVELS, "ultra"] : [...CHATGPT_EFFORT_LEVELS];
+  // What the router's grok adapter sends a model the proxy's listing has not described.
+  if (provider.type === "grok") return ["low", "medium", "high", "xhigh"];
   const preset = provider.preset && presetById(provider.preset);
   if (provider.type === "openai-compatible") return provider.caps && provider.caps.reasoning === "effort" && Array.isArray(provider.caps.effortLevels) ? provider.caps.effortLevels : [];
   return provider.caps && Array.isArray(provider.caps.effortLevels) ? provider.caps.effortLevels : (preset && preset.effortLevels) || [];
@@ -946,6 +948,8 @@ async function probeProvider(name, provider, onComplete) {
       ? { type: "anthropic", auth: provider.auth, ...(provider.auth === "api-key" && provider.apiKey ? { apiKey: provider.apiKey } : {}) }
       : provider.type === "google"
       ? { type: "google", auth: provider.auth, ...(provider.apiKey ? { apiKey: provider.apiKey } : {}), ...(provider.url ? { url: provider.url } : {}) }
+      : provider.type === "grok"
+      ? { type: "grok", ...Object.fromEntries(["home", "cli", "url", "clientVersion"].filter((key) => provider[key]).map((key) => [key, provider[key]])) }
       : {
         type: provider.type,
         url: provider.url,
@@ -1057,6 +1061,7 @@ function providerKind(name, provider) {
   const preset = provider.preset && presetById(provider.preset);
   if (provider.type === "chatgpt") return t("providers.chatgpt");
   if (provider.type === "google") return `${t("providers.google")} · ${provider.auth === "antigravity" ? t("providers.googleAntigravity") : t("providers.apiKey")}`;
+  if (provider.type === "grok") return t("providers.grok");
   if (provider.type === "anthropic") return provider.auth === "claude-code"
     ? `${t("providers.anthropic")} · ${provider.accountPool ? t("providers.rotationOn") : t("providers.rotationOff")}`
     : `${t("providers.anthropic")} · ${t("providers.apiKey")}`;
@@ -1763,6 +1768,7 @@ function openProviderChooser() {
     tile(t("providers.anthropic"), t("providers.anthropicHelp"), { kind: "anthropic" }),
     tile(t("providers.chatgpt"), t("providers.chatgptHelp"), { kind: "chatgpt" }),
     tile(t("providers.google"), t("providers.googleHelp"), { kind: "google" }),
+    tile(t("providers.grok"), t("providers.grokHelp"), { kind: "grok" }),
   ], null, true);
   const native = presets.filter((preset) => (preset.kind || "anthropic-compatible") === "anthropic-compatible");
   group(t("providers.anthropicGroup"), native.map((preset) => tile(preset.name, null, { preset })), t("providers.presetHelp"));
@@ -1947,6 +1953,104 @@ function openAnthropicProviderForm(options) {
   showModal(form, () => { formActive = false; });
   if (auth.value === "claude-code") void runProbe();
 }
+/**
+ * What a Grok form's check leaves ticked. A handful of models, so a new provider's first listing
+ * starts with all of them ticked. Every later check — and every check of a saved provider — keeps
+ * what is ticked at that moment, so a model the user unticked stays unticked.
+ */
+function grokTickedAfterCheck(firstListing, tickedIds, listedIds) {
+  return new Set(firstListing ? listedIds : tickedIds);
+}
+
+/**
+ * A Grok subscription: nothing to type. The router reads the Grok CLI's own session, so the form
+ * checks that it is there, lists what the proxy offers and saves the ticked models. The check runs
+ * as soon as the form opens, since there is no key to wait for.
+ */
+function openGrokProviderForm(options) {
+  let formActive = true;
+  const existing = options.provider;
+  const nameInput = el("input", { value: options.name || t("providers.grok"), maxlength: "60" });
+  const result = el("div", { class: "probe-result" });
+  const probeButton = el("button", { class: "btn secondary", type: "button", text: t("providers.check") });
+  let foundModels = modelsOf(existing);
+  const currentChecked = new Set(foundModels.map((model) => model.id));
+  let listed = false;
+  const modelArea = el("div", { class: "form-field" });
+  function renderModels(checked, help) {
+    modelArea.replaceChildren(el("span", { text: t("providers.models") }), hint(help || t("providers.modelsHelp")), modelChecklist(foundModels, checked, { allowCustom: true }));
+  }
+  renderModels(currentChecked);
+  // Fields this form has no control for (a home, a binary, a pinned version) go to the probe as saved.
+  const probeBody = () => ({ type: "grok", ...Object.fromEntries(["home", "cli", "url", "clientVersion"].filter((key) => existing && existing[key]).map((key) => [key, existing[key]])) });
+  async function runProbe() {
+    probeButton.disabled = true;
+    result.textContent = t("providers.checking");
+    try {
+      const response = await api("/api/providers/probe", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(probeBody()) });
+      if (!formActive) return;
+      const failed = response.auth === "missing" || response.auth === "bad-key" ? t("providers.grokSignInFirst") : t("providers.probeFailed");
+      result.replaceChildren(...[
+        el("span", { class: response.ok ? "ok-text" : "bad-text", text: response.ok ? t("providers.probeOk") : failed }),
+        response.error ? el("div", { class: "small", text: response.error }) : null,
+      ].filter(Boolean));
+      if (Array.isArray(response.models) && response.models.length) {
+        const ticked = modelArea.querySelector(".model-picker").selected();
+        const keep = grokTickedAfterCheck(!existing && !listed, ticked.map((model) => model.id), response.models.map((model) => model.id));
+        listed = true;
+        foundModels = [...ticked.filter((model) => !response.models.some((m) => m.id === model.id)), ...response.models];
+        renderModels(keep);
+      }
+    } catch (error) { if (formActive) result.replaceChildren(el("span", { class: "bad-text", text: t("providers.probeFailed") }), el("div", { class: "small", text: error.message })); }
+    finally { if (formActive) probeButton.disabled = false; }
+  }
+  probeButton.addEventListener("click", () => void runProbe());
+  const advanced = el("details", { class: "details" }, [el("summary", { text: t("common.advanced") })]);
+  const identity = el("input", { type: "checkbox", checked: !(existing && existing.identity === false) });
+  const append = el("textarea", { rows: "2", value: (existing && existing.instructionsAppend) || "" });
+  advanced.appendChild(el("div", { class: "advanced-content" }, [
+    el("div", { class: "form-field" }, [el("label", { class: "check" }, [identity, el("span", { text: t("providers.identity") })]), el("small", { text: t("providers.identityHelp") })]),
+    inputRow(t("providers.append"), append, t("providers.appendHelp")),
+  ]));
+  const pickerInput = el("input", { type: "checkbox", checked: existing ? modelsOf(existing).some((model) => ((currentConfig.cli && currentConfig.cli.extraModels) || []).some((extra) => extra.model === model.id)) : true });
+  const form = el("div", { class: "provider-form" }, [
+    el("h1", { id: "modal-title", text: existing ? t("providers.edit") : t("providers.addTitle") }),
+    inputRow(t("providers.name"), nameInput, t("providers.nameHelp")),
+    el("div", { class: "form-field" }, [el("span", { text: t("providers.credentials") }), hint(t("providers.grokFormHelp")), el("small", { class: "warn-text", text: t("providers.grokWarningShort") })]),
+    probeButton, result, modelArea,
+    el("label", { class: "check picker-check" }, [pickerInput, el("span", { text: t("providers.showInPicker") })]),
+    pickerModeOn() ? null : hint(t("providers.pickerOffHint")),
+    advanced,
+  ]);
+  const saveButton = el("button", { class: "btn", type: "button", "data-default-action": "", text: existing ? t("common.save") : t("providers.add") });
+  saveButton.addEventListener("click", async () => {
+    const typedName = nameInput.value.trim();
+    if (!typedName) { toast(t("providers.nameRequired"), true); return; }
+    const next = clone(await latestConfig());
+    const providerName = existing ? options.name : uniqueName(typedName, next.providers);
+    const saved = existing && (next.providers[options.name] || existing);
+    const checkedModels = withSavedModelFields(form.querySelector(".model-picker").selected(), saved);
+    const formKeys = new Set(["type", "identity", "instructionsAppend", "models"]);
+    const kept = saved ? Object.fromEntries(Object.entries(saved).filter(([key]) => !formKeys.has(key))) : {};
+    next.providers[providerName] = {
+      ...kept,
+      type: "grok",
+      identity: identity.checked,
+      ...(append.value.trim() ? { instructionsAppend: append.value.trim() } : {}),
+      models: checkedModels,
+    };
+    const existingSelections = pickerSelectionsExcept(next, providerName);
+    applyPickerSelections(next, pickerInput.checked ? [...existingSelections, ...checkedModels.map((model) => ({ ...model, provider: providerName }))] : existingSelections);
+    saveButton.disabled = true;
+    try { await configRequest(next); currentConfig = next; selectedProviderName = providerName; providerDetailTab = "overview"; slotsLoaded = false; clientsLoaded = false; providersLoaded = false; closeModal(); await loadProviders(); toast(t("common.saved")); await offerPickerOn(pickerInput.checked && checkedModels.length > 0); }
+    catch (error) { toast(t("common.saveFailed"), true, error.message); }
+    finally { saveButton.disabled = false; }
+  });
+  form.appendChild(el("div", { class: "actions end" }, [el("button", { class: "btn secondary", type: "button", text: t("common.cancel"), onclick: closeModal }), saveButton]));
+  showModal(form, () => { formActive = false; });
+  void runProbe();
+}
+
 function openGoogleProviderForm(options) {
   let formActive = true;
   const existing = options.provider;
@@ -2066,6 +2170,7 @@ function openProviderForm(options) {
   const displayName = options.name || (preset && preset.name) || (isChatgpt ? t("providers.chatgpt") : isAnthropic ? t("providers.anthropic") : t("providers.customName"));
   if (isAnthropic) { openAnthropicProviderForm(options); return; }
   if (options.kind === "google" || (existing && existing.type === "google")) { openGoogleProviderForm(options); return; }
+  if (options.kind === "grok" || (existing && existing.type === "grok")) { openGrokProviderForm(options); return; }
   const nameInput = el("input", { value: displayName, maxlength: "60" });
   const keyInput = el("input", { type: "password", autocomplete: "off", placeholder: t("providers.keyPlaceholder") });
   const showKey = el("button", { class: "eye-button", type: "button", text: t("common.show") });