clauderipple 0.9.1 → 0.9.3

package/dist/router/src/proxy.js

@@ -30,6 +30,7 @@ import { PRESETS } from "./presets.js";
 import { ChatGptAdapter } from "./providers/chatgpt/index.js";
 import { OpenAiCompatibleAdapter } from "./providers/openai/index.js";
 import { GoogleAdapter } from "./providers/google/index.js";
+import { GrokAdapter } from "./providers/grok/index.js";
 import { conversationKey } from "./providers/chatgpt/translate.js";
 import { providerFor, searchProviderFor, terminateHosts } from "./config.js";
 import { chatPickerModels, injectPickerModels, isBootstrapPath } from "./picker.js";
@@ -186,6 +187,7 @@ export class Proxy {
     chatgptAdapters = new Map();
     openaiAdapters = new Map();
     googleAdapters = new Map();
+    grokAdapters = new Map();
     claudeAccounts;
     /** Each Claude subscription account's usage, for the admin status (never a token). */
     claudeUsage;
@@ -304,6 +306,15 @@ export class Proxy {
         this.openaiAdapters.set(name, { key, adapter });
         return adapter;
     }
+    grok(name, cfg) {
+        const key = JSON.stringify(cfg);
+        const cur = this.grokAdapters.get(name);
+        if (cur && cur.key === key)
+            return cur.adapter;
+        const adapter = new GrokAdapter(name, cfg, this.deps.log);
+        this.grokAdapters.set(name, { key, adapter });
+        return adapter;
+    }
     google(name, cfg) {
         const key = JSON.stringify(cfg);
         const cur = this.googleAdapters.get(name);
@@ -881,6 +892,38 @@ export class Proxy {
                 }
                 return;
             }
+            if (provider.type === "grok") {
+                // The chat proxy keeps no server-side thread, so a `continue` is refused like on the other
+                // translated providers and the CLI resends the turn with the full history.
+                const td = threadDecision(json);
+                if (td === "refuse") {
+                    const out = JSON.stringify(THREAD_UNSUPPORTED);
+                    res.writeHead(400, { "content-type": "application/json", "content-length": String(Buffer.byteLength(out)) }).end(out);
+                    finish("400", out.length, "thread continue refused → CLI resends stateless", false, { resent: true });
+                    return;
+                }
+                if (td === "strip")
+                    stripThreadFields(json);
+                record = { ...record, target: route.model, provider: route.provider };
+                const routeEffort = effortOf(json);
+                if (routeEffort)
+                    record.effort = routeEffort;
+                tag = `GROK ${route.tag} effort=${routeEffort ?? "-"}`;
+                try {
+                    const o = await this.grok(route.provider, provider).handle(req, res, path, json, route.model, routeEffort);
+                    this.recordOutcome(route.provider, o.status);
+                    finish(String(o.status), o.bytes, o.note, o.status >= 400, { ...(o.usage ? { usage: o.usage } : {}), ...(o.stopReason ? { stopReason: o.stopReason } : {}) });
+                }
+                catch (e) {
+                    this.recordOutcome(route.provider, 0);
+                    finish("-", 0, `grok error ${e.code ?? ""} ${e.message}`);
+                    if (!res.headersSent)
+                        res.writeHead(502, { "content-type": "application/json" }).end(JSON.stringify({ type: "error", error: { type: "api_error", message: e.message } }));
+                    else
+                        res.destroy();
+                }
+                return;
+            }
             if (provider.type === "anthropic") {
                 if (!provider.accountPool || provider.auth !== "claude-code") {
                     finish("400", 0, "native Anthropic provider is available through OpenAI ingress only", false);

package/dist/router/src/redact.js

@@ -11,8 +11,13 @@ function credentialHeaderName(name) {
 export function credentialHeaderValues(headers) {
     const secrets = new Set();
     for (const [rawName, value] of headers) {
-        if (credentialHeaderName(rawName) && value)
-            secrets.add(value);
+        if (!credentialHeaderName(rawName) || !value)
+            continue;
+        secrets.add(value);
+        // A vendor that echoes the credential echoes the token, not the scheme in front of it.
+        const bare = /^(?:Bearer|Basic|Token)\s+(\S+)$/i.exec(value)?.[1];
+        if (bare)
+            secrets.add(bare);
     }
     return [...secrets].sort((a, b) => b.length - a.length);
 }

package/dist/router/src/version.js

@@ -5,4 +5,4 @@
 // from the manifests. Until 0.1.1 the router and the CLI each carried their own literal, and both
 // still said "0.1.0" in the 0.1.1 release: after an update nobody could tell which router was
 // running, and the tray app had nothing to compare (2026-09-15, reported from a Windows install).
-export const VERSION = "0.9.1";
+export const VERSION = "0.9.3";

package/dist/ui/app.js

@@ -105,6 +105,8 @@ function fallbackEffortLevels(provider, model) {
   const explicit = modelEffortLevels(provider, model);
   if (explicit !== undefined) return explicit;
   if (provider.type === "chatgpt") return CHATGPT_ULTRA_MODELS.has(model) ? [...CHATGPT_EFFORT_LEVELS, "ultra"] : [...CHATGPT_EFFORT_LEVELS];
+  // What the router's grok adapter sends a model the proxy's listing has not described.
+  if (provider.type === "grok") return ["low", "medium", "high", "xhigh"];
   const preset = provider.preset && presetById(provider.preset);
   if (provider.type === "openai-compatible") return provider.caps && provider.caps.reasoning === "effort" && Array.isArray(provider.caps.effortLevels) ? provider.caps.effortLevels : [];
   return provider.caps && Array.isArray(provider.caps.effortLevels) ? provider.caps.effortLevels : (preset && preset.effortLevels) || [];
@@ -946,6 +948,8 @@ async function probeProvider(name, provider, onComplete) {
       ? { type: "anthropic", auth: provider.auth, ...(provider.auth === "api-key" && provider.apiKey ? { apiKey: provider.apiKey } : {}) }
       : provider.type === "google"
       ? { type: "google", auth: provider.auth, ...(provider.apiKey ? { apiKey: provider.apiKey } : {}), ...(provider.url ? { url: provider.url } : {}) }
+      : provider.type === "grok"
+      ? { type: "grok", ...Object.fromEntries(["home", "cli", "url", "clientVersion"].filter((key) => provider[key]).map((key) => [key, provider[key]])) }
       : {
         type: provider.type,
         url: provider.url,
@@ -1057,6 +1061,7 @@ function providerKind(name, provider) {
   const preset = provider.preset && presetById(provider.preset);
   if (provider.type === "chatgpt") return t("providers.chatgpt");
   if (provider.type === "google") return `${t("providers.google")} · ${provider.auth === "antigravity" ? t("providers.googleAntigravity") : t("providers.apiKey")}`;
+  if (provider.type === "grok") return t("providers.grok");
   if (provider.type === "anthropic") return provider.auth === "claude-code"
     ? `${t("providers.anthropic")} · ${provider.accountPool ? t("providers.rotationOn") : t("providers.rotationOff")}`
     : `${t("providers.anthropic")} · ${t("providers.apiKey")}`;
@@ -1763,6 +1768,7 @@ function openProviderChooser() {
     tile(t("providers.anthropic"), t("providers.anthropicHelp"), { kind: "anthropic" }),
     tile(t("providers.chatgpt"), t("providers.chatgptHelp"), { kind: "chatgpt" }),
     tile(t("providers.google"), t("providers.googleHelp"), { kind: "google" }),
+    tile(t("providers.grok"), t("providers.grokHelp"), { kind: "grok" }),
   ], null, true);
   const native = presets.filter((preset) => (preset.kind || "anthropic-compatible") === "anthropic-compatible");
   group(t("providers.anthropicGroup"), native.map((preset) => tile(preset.name, null, { preset })), t("providers.presetHelp"));
@@ -1947,6 +1953,104 @@ function openAnthropicProviderForm(options) {
   showModal(form, () => { formActive = false; });
   if (auth.value === "claude-code") void runProbe();
 }
+/**
+ * What a Grok form's check leaves ticked. A handful of models, so a new provider's first listing
+ * starts with all of them ticked. Every later check — and every check of a saved provider — keeps
+ * what is ticked at that moment, so a model the user unticked stays unticked.
+ */
+function grokTickedAfterCheck(firstListing, tickedIds, listedIds) {
+  return new Set(firstListing ? listedIds : tickedIds);
+}
+
+/**
+ * A Grok subscription: nothing to type. The router reads the Grok CLI's own session, so the form
+ * checks that it is there, lists what the proxy offers and saves the ticked models. The check runs
+ * as soon as the form opens, since there is no key to wait for.
+ */
+function openGrokProviderForm(options) {
+  let formActive = true;
+  const existing = options.provider;
+  const nameInput = el("input", { value: options.name || t("providers.grok"), maxlength: "60" });
+  const result = el("div", { class: "probe-result" });
+  const probeButton = el("button", { class: "btn secondary", type: "button", text: t("providers.check") });
+  let foundModels = modelsOf(existing);
+  const currentChecked = new Set(foundModels.map((model) => model.id));
+  let listed = false;
+  const modelArea = el("div", { class: "form-field" });
+  function renderModels(checked, help) {
+    modelArea.replaceChildren(el("span", { text: t("providers.models") }), hint(help || t("providers.modelsHelp")), modelChecklist(foundModels, checked, { allowCustom: true }));
+  }
+  renderModels(currentChecked);
+  // Fields this form has no control for (a home, a binary, a pinned version) go to the probe as saved.
+  const probeBody = () => ({ type: "grok", ...Object.fromEntries(["home", "cli", "url", "clientVersion"].filter((key) => existing && existing[key]).map((key) => [key, existing[key]])) });
+  async function runProbe() {
+    probeButton.disabled = true;
+    result.textContent = t("providers.checking");
+    try {
+      const response = await api("/api/providers/probe", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(probeBody()) });
+      if (!formActive) return;
+      const failed = response.auth === "missing" || response.auth === "bad-key" ? t("providers.grokSignInFirst") : t("providers.probeFailed");
+      result.replaceChildren(...[
+        el("span", { class: response.ok ? "ok-text" : "bad-text", text: response.ok ? t("providers.probeOk") : failed }),
+        response.error ? el("div", { class: "small", text: response.error }) : null,
+      ].filter(Boolean));
+      if (Array.isArray(response.models) && response.models.length) {
+        const ticked = modelArea.querySelector(".model-picker").selected();
+        const keep = grokTickedAfterCheck(!existing && !listed, ticked.map((model) => model.id), response.models.map((model) => model.id));
+        listed = true;
+        foundModels = [...ticked.filter((model) => !response.models.some((m) => m.id === model.id)), ...response.models];
+        renderModels(keep);
+      }
+    } catch (error) { if (formActive) result.replaceChildren(el("span", { class: "bad-text", text: t("providers.probeFailed") }), el("div", { class: "small", text: error.message })); }
+    finally { if (formActive) probeButton.disabled = false; }
+  }
+  probeButton.addEventListener("click", () => void runProbe());
+  const advanced = el("details", { class: "details" }, [el("summary", { text: t("common.advanced") })]);
+  const identity = el("input", { type: "checkbox", checked: !(existing && existing.identity === false) });
+  const append = el("textarea", { rows: "2", value: (existing && existing.instructionsAppend) || "" });
+  advanced.appendChild(el("div", { class: "advanced-content" }, [
+    el("div", { class: "form-field" }, [el("label", { class: "check" }, [identity, el("span", { text: t("providers.identity") })]), el("small", { text: t("providers.identityHelp") })]),
+    inputRow(t("providers.append"), append, t("providers.appendHelp")),
+  ]));
+  const pickerInput = el("input", { type: "checkbox", checked: existing ? modelsOf(existing).some((model) => ((currentConfig.cli && currentConfig.cli.extraModels) || []).some((extra) => extra.model === model.id)) : true });
+  const form = el("div", { class: "provider-form" }, [
+    el("h1", { id: "modal-title", text: existing ? t("providers.edit") : t("providers.addTitle") }),
+    inputRow(t("providers.name"), nameInput, t("providers.nameHelp")),
+    el("div", { class: "form-field" }, [el("span", { text: t("providers.credentials") }), hint(t("providers.grokFormHelp")), el("small", { class: "warn-text", text: t("providers.grokWarningShort") })]),
+    probeButton, result, modelArea,
+    el("label", { class: "check picker-check" }, [pickerInput, el("span", { text: t("providers.showInPicker") })]),
+    pickerModeOn() ? null : hint(t("providers.pickerOffHint")),
+    advanced,
+  ]);
+  const saveButton = el("button", { class: "btn", type: "button", "data-default-action": "", text: existing ? t("common.save") : t("providers.add") });
+  saveButton.addEventListener("click", async () => {
+    const typedName = nameInput.value.trim();
+    if (!typedName) { toast(t("providers.nameRequired"), true); return; }
+    const next = clone(await latestConfig());
+    const providerName = existing ? options.name : uniqueName(typedName, next.providers);
+    const saved = existing && (next.providers[options.name] || existing);
+    const checkedModels = withSavedModelFields(form.querySelector(".model-picker").selected(), saved);
+    const formKeys = new Set(["type", "identity", "instructionsAppend", "models"]);
+    const kept = saved ? Object.fromEntries(Object.entries(saved).filter(([key]) => !formKeys.has(key))) : {};
+    next.providers[providerName] = {
+      ...kept,
+      type: "grok",
+      identity: identity.checked,
+      ...(append.value.trim() ? { instructionsAppend: append.value.trim() } : {}),
+      models: checkedModels,
+    };
+    const existingSelections = pickerSelectionsExcept(next, providerName);
+    applyPickerSelections(next, pickerInput.checked ? [...existingSelections, ...checkedModels.map((model) => ({ ...model, provider: providerName }))] : existingSelections);
+    saveButton.disabled = true;
+    try { await configRequest(next); currentConfig = next; selectedProviderName = providerName; providerDetailTab = "overview"; slotsLoaded = false; clientsLoaded = false; providersLoaded = false; closeModal(); await loadProviders(); toast(t("common.saved")); await offerPickerOn(pickerInput.checked && checkedModels.length > 0); }
+    catch (error) { toast(t("common.saveFailed"), true, error.message); }
+    finally { saveButton.disabled = false; }
+  });
+  form.appendChild(el("div", { class: "actions end" }, [el("button", { class: "btn secondary", type: "button", text: t("common.cancel"), onclick: closeModal }), saveButton]));
+  showModal(form, () => { formActive = false; });
+  void runProbe();
+}
+
 function openGoogleProviderForm(options) {
   let formActive = true;
   const existing = options.provider;
@@ -2066,6 +2170,7 @@ function openProviderForm(options) {
   const displayName = options.name || (preset && preset.name) || (isChatgpt ? t("providers.chatgpt") : isAnthropic ? t("providers.anthropic") : t("providers.customName"));
   if (isAnthropic) { openAnthropicProviderForm(options); return; }
   if (options.kind === "google" || (existing && existing.type === "google")) { openGoogleProviderForm(options); return; }
+  if (options.kind === "grok" || (existing && existing.type === "grok")) { openGrokProviderForm(options); return; }
   const nameInput = el("input", { value: displayName, maxlength: "60" });
   const keyInput = el("input", { type: "password", autocomplete: "off", placeholder: t("providers.keyPlaceholder") });
   const showKey = el("button", { class: "eye-button", type: "button", text: t("common.show") });
@@ -2381,7 +2486,7 @@ const MOD_DEFAULTS = {
       hard: [{ target: { agent: "gpt-6-astra" }, effort: "high" }], plan: [modClaude("opus", "high")],
     } },
   },
-  allow: [], modes: [], providers: {},
+  allow: [], allowKnown: [], modes: [], providers: {},
   fallback: { agent: "general-purpose", model: "sonnet" },
   keepWarm: false, keepWarmHours: 2, keepWarmMinTokens: 30000,
   compactWith: "haiku", handoffSkill: "", handoffAfter: "continue", handoffButton: "advised",
@@ -2405,6 +2510,7 @@ function modNormalize(raw) {
     ...value,
     rules: { ...clone(MOD_DEFAULTS.rules), ...(value.rules || {}) },
     allow: Array.isArray(value.allow) ? value.allow : [],
+    allowKnown: Array.isArray(value.allowKnown) ? value.allowKnown : [],
     modes: Array.isArray(value.modes) ? value.modes : [],
     providers: { ...(value.providers || {}) },
     hide: Array.isArray(value.hide) ? value.hide : clone(MOD_DEFAULTS.hide),
@@ -2590,7 +2696,7 @@ function modEffortCard() {
  */
 function modChoices() {
   const options = modState.options || {};
-  const claudeEfforts = Array.isArray(options.claudeEfforts) && options.claudeEfforts.length ? options.claudeEfforts : ["low", "medium", "high", "max"];
+  const claudeEfforts = Array.isArray(options.claudeEfforts) && options.claudeEfforts.length ? options.claudeEfforts : ["low", "medium", "high", "xhigh", "max"];
   const workers = modAgents().map((agent) => {
     const info = modProviderInfo(agent.provider);
     return {
@@ -2644,17 +2750,20 @@ function modGroupLabel(group) { return group.billing ? `${group.name} · ${t(`mo
 function modTickKey(choice) { return choice.claude ? choice.value.replace("+", ":") : choice.value; }
 /** The models that can be ticked: every worker and Claude's own; the session's model is always there. */
 function modTickable() { return modChoices().filter((choice) => choice.value !== "general-purpose"); }
-/** Whether a model is ticked: an empty list means every model, and an old provider name ticks that provider's. */
+/** Whether a model is ticked: an empty list means every model, an old provider name ticks that provider's, and a model added after the list was last written (absent from `allowKnown`) ticks on. */
 function modTicked(choice) {
   const allow = modState.settings.allow || [];
-  return !allow.length || allow.includes(modTickKey(choice)) || allow.includes(choice.provider);
+  const known = modState.settings.allowKnown || [];
+  return !allow.length || allow.includes(modTickKey(choice)) || allow.includes(choice.provider) || known.length > 0 && !known.includes(modTickKey(choice));
 }
 /** Ticks one model; every model on again is stored as [], and the last one on cannot go off. */
 function modTick(choice, on) {
   const all = modTickable();
-  const kept = new Set(all.filter(modTicked).map(modTickKey));
+  const known = all.map(modTickKey);
+  const kept = new Set(all.filter((model) => modTicked(model)).map(modTickKey));
   if (on) kept.add(modTickKey(choice)); else kept.delete(modTickKey(choice));
-  modPatch({ allow: kept.size === all.length ? [] : all.map(modTickKey).filter((key) => kept.has(key)) });
+  const allow = kept.size === known.length ? [] : known.filter((key) => kept.has(key));
+  modPatch({ allow, allowKnown: allow.length ? known : [] });
 }
 function modTickRows() {
   const choices = modTickable();

package/dist/ui/i18n.js

@@ -41,7 +41,7 @@ const I18N = {
     "providers.googleWarningShort": "Google 이용약관에서 해당 사용을 금지하고 있으며 계정 정지 사례가 있습니다. 주 계정 대신 보조 계정 사용을 권장합니다.",
     "providers.googleOpenManually": "브라우저가 열리지 않았습니다. 아래 주소를 직접 여세요.",
     "providers.googleAdded": "Google 계정을 추가했습니다.",
-    "providers.googleSignInFirst": "로그인된 Google 계정이 없습니다. 먼저 로그인해 주세요.",
+    "providers.googleSignInFirst": "로그인된 Google 계정이 없습니다. 먼저 로그인해 주세요.", "providers.grok": "Grok 구독", "providers.grokHelp": "Grok CLI가 포함된 Grok 요금제로 Grok 모델을 씁니다. `grok login`으로 로그인만 하면 되고 API 키는 필요 없습니다.", "providers.grokFormHelp": "ClaudeRipple은 Grok CLI의 로그인 세션(~/.grok/auth.json)을 읽기만 하고, 만료가 가까우면 CLI에 갱신을 맡깁니다. 터미널에서 `grok login`을 한 번 실행해 두세요.", "providers.grokWarningShort": "Grok CLI 전용 채널을 씁니다. xAI가 API로 공개한 경로가 아니라서 CLI 업데이트나 xAI 쪽 변경으로 예고 없이 막힐 수 있습니다.", "providers.grokSignInFirst": "Grok CLI 로그인 세션이 없습니다. 먼저 터미널에서 `grok login`을 실행하세요.",
     "providers.googleRemoveConfirm": "Google 계정 {name}을(를) ClaudeRipple에서 삭제하시겠습니까? 실제 Google 계정은 삭제되지 않습니다.",
     "providers.googleProject": "프로젝트 {id}",
     "providers.googleOwnHelp": "ClaudeRipple이 로컬 사용자 전용 파일에 로그인 정보를 안전하게 저장하고 자동으로 갱신합니다.",
@@ -247,7 +247,7 @@ const I18N = {
     "providers.googleWarningShort": "Google's terms prohibit this use and accounts have been suspended for it. A secondary account is recommended.",
     "providers.googleOpenManually": "The browser did not open. Open this address yourself.",
     "providers.googleAdded": "Google account added.",
-    "providers.googleSignInFirst": "No Google account is signed in. Sign in first.",
+    "providers.googleSignInFirst": "No Google account is signed in. Sign in first.", "providers.grok": "Grok subscription", "providers.grokHelp": "Use Grok models through a Grok plan that includes the Grok CLI. Sign in with `grok login`, no API key.", "providers.grokFormHelp": "ClaudeRipple only reads the Grok CLI's session (~/.grok/auth.json) and asks the CLI to refresh it when it runs low. Run `grok login` once in a terminal.", "providers.grokWarningShort": "This uses the Grok CLI's own channel, which xAI does not publish as an API; a CLI update or a change on xAI's side can break it without warning.", "providers.grokSignInFirst": "No Grok CLI session. Run `grok login` in a terminal first.",
     "providers.googleRemoveConfirm": "Remove {name} from ClaudeRipple? The Google account itself is untouched.",
     "providers.googleProject": "project {id}",
     "providers.googleOwnHelp": "ClaudeRipple keeps this sign-in in a file only your user can read and refreshes it automatically.",
@@ -737,7 +737,7 @@ const I18N = {
     "providers.googleWarningShort": "Google 的条款禁止这种用法，已有账号因此被停用。建议使用备用账号。",
     "providers.googleOpenManually": "浏览器未能打开，请手动打开此地址。",
     "providers.googleAdded": "已添加 Google 账号。",
-    "providers.googleSignInFirst": "尚未登录任何 Google 账号，请先登录。",
+    "providers.googleSignInFirst": "尚未登录任何 Google 账号，请先登录。", "providers.grok": "Grok 订阅", "providers.grokHelp": "通过包含 Grok CLI 的 Grok 套餐使用 Grok 模型。用 `grok login` 登录即可，无需 API 密钥。", "providers.grokFormHelp": "ClaudeRipple 只读取 Grok CLI 的登录会话（~/.grok/auth.json），快过期时请 CLI 刷新。请先在终端运行一次 `grok login`。", "providers.grokWarningShort": "这里使用的是 Grok CLI 自己的通道，xAI 并未将其作为 API 公开，CLI 更新或 xAI 一侧的变更都可能使其在没有预告的情况下失效。", "providers.grokSignInFirst": "没有 Grok CLI 登录会话。请先在终端运行 `grok login`。",
     "providers.googleRemoveConfirm": "从 ClaudeRipple 中移除 {name}？Google 账号本身不受影响。",
     "providers.googleProject": "项目 {id}",
     "providers.googleOwnHelp": "ClaudeRipple 将此登录保存在只有你的系统用户账号能读取的文件中，并自动刷新。",
@@ -1227,7 +1227,7 @@ const I18N = {
     "providers.googleWarningShort": "Googleの規約はこの使い方を禁止しており、実際にアカウントが停止された例があります。サブアカウントの使用をおすすめします。",
     "providers.googleOpenManually": "ブラウザが開きませんでした。このアドレスを手動で開いてください。",
     "providers.googleAdded": "Googleアカウントを追加しました",
-    "providers.googleSignInFirst": "ログイン済みのGoogleアカウントがありません。先にログインしてください。",
+    "providers.googleSignInFirst": "ログイン済みのGoogleアカウントがありません。先にログインしてください。", "providers.grok": "Grokサブスクリプション", "providers.grokHelp": "Grok CLIを含むGrokプランでGrokモデルを使います。`grok login`でログインするだけで、APIキーは不要です。", "providers.grokFormHelp": "ClaudeRippleはGrok CLIのログインセッション（~/.grok/auth.json）を読むだけで、期限が近づくと更新をCLIに任せます。ターミナルで一度`grok login`を実行してください。", "providers.grokWarningShort": "Grok CLI専用の経路を使います。xAIがAPIとして公開しているものではないため、CLIの更新やxAI側の変更で予告なく使えなくなる可能性があります。", "providers.grokSignInFirst": "Grok CLIのログインセッションがありません。先にターミナルで`grok login`を実行してください。",
     "providers.googleRemoveConfirm": "{name} をClaudeRippleから削除しますか？Googleアカウント自体には影響しません。",
     "providers.googleProject": "プロジェクト {id}",
     "providers.googleOwnHelp": "ClaudeRippleがこのログインを自分のユーザーだけが読めるファイルに保存し、自動で更新します。",
@@ -1717,7 +1717,7 @@ const I18N = {
     "providers.googleWarningShort": "Los términos de Google prohíben este uso y se han suspendido cuentas por ello. Se recomienda una cuenta secundaria.",
     "providers.googleOpenManually": "El navegador no se abrió. Abre esta dirección manualmente.",
     "providers.googleAdded": "Cuenta de Google añadida.",
-    "providers.googleSignInFirst": "No hay ninguna cuenta de Google con sesión iniciada. Inicia sesión primero.",
+    "providers.googleSignInFirst": "No hay ninguna cuenta de Google con sesión iniciada. Inicia sesión primero.", "providers.grok": "Suscripción de Grok", "providers.grokHelp": "Usa modelos Grok con un plan de Grok que incluya la CLI de Grok. Solo inicia sesión con `grok login`, sin clave de API.", "providers.grokFormHelp": "ClaudeRipple solo lee la sesión de la CLI de Grok (~/.grok/auth.json) y le pide a la CLI que la renueve cuando está por vencer. Ejecuta `grok login` una vez en una terminal.", "providers.grokWarningShort": "Usa el canal propio de la CLI de Grok, que xAI no publica como API; una actualización de la CLI o un cambio por parte de xAI puede romperlo sin aviso.", "providers.grokSignInFirst": "No hay sesión de la CLI de Grok. Ejecuta `grok login` en una terminal primero.",
     "providers.googleRemoveConfirm": "¿Quitar {name} de ClaudeRipple? La cuenta de Google en sí no se modifica.",
     "providers.googleProject": "proyecto {id}",
     "providers.googleOwnHelp": "ClaudeRipple guarda este inicio de sesión en un archivo que solo tu usuario puede leer y lo renueva automáticamente.",
@@ -2207,7 +2207,7 @@ const I18N = {
     "providers.googleWarningShort": "Os termos do Google proíbem este uso, e contas já foram suspensas por isso. Recomenda-se usar uma conta secundária.",
     "providers.googleOpenManually": "O navegador não abriu. Abra este endereço manualmente.",
     "providers.googleAdded": "Conta do Google adicionada.",
-    "providers.googleSignInFirst": "Nenhuma conta do Google conectada. Entre primeiro.",
+    "providers.googleSignInFirst": "Nenhuma conta do Google conectada. Entre primeiro.", "providers.grok": "Assinatura do Grok", "providers.grokHelp": "Use modelos Grok com um plano do Grok que inclua a CLI do Grok. Só entre com `grok login`, sem chave de API.", "providers.grokFormHelp": "O ClaudeRipple só lê a sessão da CLI do Grok (~/.grok/auth.json) e pede à CLI que a renove quando estiver perto de expirar. Rode `grok login` uma vez em um terminal.", "providers.grokWarningShort": "Usa o canal próprio da CLI do Grok, que a xAI não publica como API; uma atualização da CLI ou uma mudança do lado da xAI pode quebrá-lo sem aviso.", "providers.grokSignInFirst": "Nenhuma sessão da CLI do Grok. Rode `grok login` em um terminal primeiro.",
     "providers.googleRemoveConfirm": "Remover {name} do ClaudeRipple? A conta do Google em si não é afetada.",
     "providers.googleProject": "projeto {id}",
     "providers.googleOwnHelp": "O ClaudeRipple guarda este login em um arquivo que só o seu usuário pode ler e o renova automaticamente.",

package/docs/ARCHITECTURE.md

@@ -1256,6 +1256,84 @@ subscription exists in this environment. Files are under `src/`:
   `PATCH/DELETE /api/google-accounts/:id`, and `POST /api/providers/probe` with
   `{type:"google", auth:"antigravity"}`. CLI: `clauderipple google-login` / `google-logout`.
 
+### 4e. `grok` providers (implemented 2026-10-08)
+
+Grok on a Grok subscription, through the chat proxy the Grok CLI itself talks to, signed in
+with the CLI's own session. A translated provider like §4c: the adapter
+(`packages/router/src/providers/grok/`) reuses `OpenAiCompatibleAdapter` on the Chat wire
+and adds only what an API key would not need — a credential that rotates under the router,
+and the headers the proxy routes on. Measured 2026-10-08 against CLI 1.0.46 on a SuperGrok
+plan unless marked otherwise.
+
+- **Endpoint and headers.** `POST https://cli-chat-proxy.grok.com/v1/chat/completions`,
+  `GET …/v1/models`. The CLI's own README ("Using auth.json for API Access") documents calling
+  it directly with `Authorization: Bearer <auth.json key>`, `X-XAI-Token-Auth: xai-grok-cli`
+  and `x-grok-model-override: <model>` (the proxy routes on the header, not the body). It does
+  not mention that the proxy also refuses a request without `x-grok-client-version`:
+  `426 {"error":"Your Grok CLI version (none) is outdated. Please update to version 1.0.13 or
+  later …"}`. The router sends `clientVersion` from the config when set, else the installed
+  CLI's version (`grok --version`, read again when the binary changes), else 1.0.46. The header names were
+  read from the CLI binary's strings; nothing else from it is used. This channel is the CLI's,
+  not a published API, so the probe returns a facts-only `warning` (like Antigravity's) and the
+  form says so.
+- **Session.** `<grok home>/auth.json` (`$GROK_HOME`, else `~/.grok`), written by `grok login`:
+  one entry per issuer keyed `https://auth.x.ai::<id>`, each with `key`, `expires_at`,
+  `refresh_token`. The README's own `jq` example reads a different key
+  (`https://accounts.x.ai/sign-in`), so the entry that expires last is taken and no key name
+  is assumed. A session token lives **six hours** (`expires_at` − `create_time`; the README
+  says 7 days); a running CLI refreshes it about five minutes before expiry under its own lock
+  (`auth lock: attempting acquire (timeout=25000ms)`, `oidc try_refresh_pure`). Whether the
+  refresh token rotates was not measured. So, as with `borrow-codex`, the router never
+  refreshes the grant itself — if it does rotate, racing the CLI could sign the CLI out.
+- **Refresh by asking the CLI.** With no CLI running, the file just goes stale. When the token
+  has under 10 minutes left the router runs `grok models` with
+  `GROK_AUTH_EARLY_INVALIDATION_SECS=600`: the CLI then sees the token as expiring, refreshes
+  it under its lock and rewrites the file (measured: expiry moved six hours, file rewritten).
+  One run serves every turn waiting on it; 30s bound, since the CLI's lock wait is 25s. A token
+  still alive is used even when that run fails, and a run that left it short is not repeated
+  for a minute, so a broken IdP does not add 30s to every turn. Under launchd's environment
+  (`env -i PATH=/usr/bin:/bin:/usr/sbin:/sbin HOME=…`) `grok models` exits 0 and leaves no
+  process behind. The router runs under launchd with
+  `PATH=/usr/bin:/bin:/usr/sbin:/sbin`, so the binary is looked up in `<home>/bin/grok` first,
+  then PATH, then `~/.local/bin/grok`; `HOME` is set there, which the CLI needs to find its
+  session.
+- **A 401 is asked once more.** The token read a moment ago can be the one the CLI just
+  replaced. On a 401 before any byte is written the adapter re-reads the file; if it still
+  holds the refused token the CLI refresh is forced (`GROK_AUTH_EARLY_INVALIDATION_SECS=86400`,
+  the value measured to make the CLI refresh, at most once a minute — a proxy that refuses a fresh token is refusing the
+  account), and the turn is asked again only when a different token exists. Otherwise the
+  user reads `authentication_error "Grok: … — sign in with grok login, …"`. An unknown token is
+  `401 {"error":"Invalid or expired credentials (auth_kind=bearer, x_xai_token_auth=xai-grok-cli,
+  upstream=PermissionDenied, reason=no auth context)"}` — a bare string under `error`, which
+  `vendorMessage` now reads. `fetchWithRetry` still never retries a 401 on its own.
+- **Models and effort.** `/v1/models` lists grok-4.7, grok-4.7-build-fast, grok-4.6 and
+  grok-4.5, each with `context_window` 256000, `api_backend: "responses"` and
+  `reasoning_efforts` listed high to low: low..xhigh, except grok-4.5 low..high. The probe
+  saves that ladder per model. On Chat, every model accepted low/medium/high/xhigh (grok-4.5's
+  `xhigh` too — a 200 is only "not refused", so the listing wins) and refused the string
+  `"none"` and `max` with `400 {"code":"invalid-argument"}`; omitting the field is accepted and
+  the model's default (`high`) applies. A model the listing did not describe gets low..xhigh.
+- **Chat, not Responses.** Both wires answer. On Chat the reasoning arrives as text the mapper
+  turns into thinking blocks; the Responses mapper has no reasoning handling (§4c), so a Grok
+  turn there showed none. Tools stream as ordinary `tool_calls` deltas and `tool` messages are
+  accepted back; the usage chunk carries `prompt_tokens_details.cached_tokens`.
+- **Cache.** No conversation header: a repeated 25.5k-token prefix was read from cache on the
+  second call without one (1,152 cached on the first, 25,472 of 25,573 on the second), while
+  the same pair with `x-grok-conv-id` on Chat missed both times. One
+  Claude Code session through a dev router (CLI 2.1.291, grok-4.7, four turns with Read, Write
+  and Bash) read 21,888 / 21,995, 21,888 / 22,210 and 22,144 / 22,257 from cache after its
+  cold first turn; a second session's second turn 21,760 / 22,023. A session's first turn is
+  cold. Watch the daily figure in `requests.jsonl` as for the other translated providers.
+- **Probe.** `POST /api/providers/probe` with `{type:"grok", home?, cli?, url?,
+  clientVersion?}` checks the session through the same `GrokAuth` the adapter uses (so a near-
+  expired one is refreshed here too) and asks `/models` with the headers live traffic sends.
+  `auth: "missing"` is no session or an expired one the CLI could not refresh; `"bad-key"` is
+  the proxy refusing it. The measured list above is offered when the listing cannot be read.
+- Routing, agent files, picker entries and the refusal of `web_search` side requests are the
+  same as for any translated provider. A grok model may not carry `wire`, `url` or
+  `authHeader` (validation refuses it): `providerFor` would turn it into an openai-compatible
+  provider without the session headers. Not available through the OpenAI ingress.
+
 ## 5. Failure modes that must not exist in the product (all observed)
 
 | Observed | Product requirement |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clauderipple",
-  "version": "0.9.1",
+  "version": "0.9.3",
   "description": "Use GPT (any ChatGPT plan with Codex), DeepSeek and 400+ other models in the Claude Desktop Code tab and Claude Code while staying signed in to your Claude subscription — no third-party gateway mode. Several ChatGPT accounts that take over when one runs out, in Codex too.",
   "license": "GPL-3.0-only",
   "workspaces": [