fix(grok): preserve billing defaults in nonempty requests

[steipete]

Grok's web billing request currently contains an empty protobuf message, which can be rejected with gRPC status 13 (Missing request message.). Encode field 1, exclude_legacy_monthly_usage, explicitly as false: 00 00 00 00 02 08 00. The public billing descriptor confirms the boolean contract; 08 02 would mean true. Authentication, the 15-second timeout, retries, response parsing, and unknown-usage semantics are unchanged. Thanks @CharlieLZ for the original request fix and report.

The synthetic #3716 investigation also follows a CLI -32601 failure through proxy billing, real local signals.json scanning, Usage & Spend, and the share payload. It passes on unchanged production code: 42 tokens survive in memory, while usage JSON intentionally omits live-only costUsage. This PR documents and tests that distinction; it does not claim to fix the reported dashboard state or introduce Grok dollar estimates. No authenticated provider probe, browser-cookie import, Keychain access, or running-app relaunch was performed.

Validation

• Regression red on unchanged production: GrokWebBillingFetcherTests ran 49 tests with 4 failures, all detecting the empty request body on bearer, cookie, combined-auth, and retry paths.
• Baseline investigation: GrokAccountContextTests passed 8 tests, including the new RPC-to-share proof.
• After the one-line production fix: 422 tests across 31 suites passed, plus 1 platform-gating test. The opt-in live Grok proof was skipped. Grok, OpenCodex, pricing, and provider architecture coverage passed.
• make check passed: 0/2,518 files require formatting; SwiftLint found 0 violations across 2,517 files. Parser hash remained current; no generated files changed.
• Independent Codex autoreview was scoped-clean through P2. git diff --check passed. A merge-tree check against main 7678afe828f1 found no conflicts.
• Production diff: 1 insertion, 1 deletion, net zero. The complete patch changes 5 files, with 89 insertions and 3 deletions.

Exact commands:

CODEXBAR_SUPPRESS_TEST_KEYCHAIN_ACCESS=1 CODEXBAR_ALLOW_TEST_KEYCHAIN_ACCESS=0 CODEXBAR_TEST_CODEX_FILE_ISOLATION=1 CODEXBAR_TEST_SESSION_FILE_ISOLATION=1 swift test --jobs 2 --filter GrokWebBillingFetcherTests
CODEXBAR_SUPPRESS_TEST_KEYCHAIN_ACCESS=1 CODEXBAR_ALLOW_TEST_KEYCHAIN_ACCESS=0 CODEXBAR_TEST_CODEX_FILE_ISOLATION=1 CODEXBAR_TEST_SESSION_FILE_ISOLATION=1 swift test --skip-build --no-parallel --filter GrokAccountContextTests
CODEXBAR_SUPPRESS_TEST_KEYCHAIN_ACCESS=1 CODEXBAR_ALLOW_TEST_KEYCHAIN_ACCESS=0 CODEXBAR_TEST_CODEX_FILE_ISOLATION=1 CODEXBAR_TEST_SESSION_FILE_ISOLATION=1 CODEXBAR_LIVE_GROK_CATALOG_PROOF=0 swift test --jobs 2 --no-parallel --filter 'Grok(AccountContext|Auth|BillingResponse|CreditsProxyFetcher|FailedBillingWork|LocalSessionScanner|MenuCardModel|Plan|RemainingResetsFetcher|RemainingResetsRouting|SettingsReader|TokenSnapshotProjection|WebBillingFetcher|XAISpendCatalog|ZeroUsage)Tests|OpenCodex.*Tests|CostUsagePricing.*Tests|ModelsDevPricing.*Tests|ProviderArchitectureGatekeeperTests'
make check
git diff --check

The first command records the intentional pre-fix failures; the third verifies the corrected implementation. The full sharded suite was not run; validation is limited to the focused suites above. Live recovery for the affected billing account remains unverified.

Closes #3336
Refs #3716
Refs #3135

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 21, 2026, 2:47 AM ET / 06:47 UTC.

ClawSweeper review

What this changes

The branch sends an explicitly false billing flag in a nonempty Grok request and adds tests and documentation for request encoding and local-token fallback behavior.

Merge readiness

✅ Ready for maintainer review

Keep open: this remains a useful, focused repair absent from current main and v0.63.0. No actionable correctness or security defect was found, and repository policy protects this owner-authored PR from automatic closure.

Priority: P2
Reviewed head: 446c3bafd5eaf32b9a56a56e544c6e968fc3acd1

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A narrow repair with focused regression coverage and no identified blocking defect; live endpoint recovery is not claimed.
Proof confidence	🌊 off-meta tidepool	Not applicable: The owner-authored PR is exempt from the ordinary contributor proof gate. Stubbed billing tests exercise the changed request bytes; the synthetic CLI-to-share test covers a separate existing path, and neither establishes live Grok recovery.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: The owner-authored PR is exempt from the ordinary contributor proof gate. Stubbed billing tests exercise the changed request bytes; the synthetic CLI-to-share test covers a separate existing path, and neither establishes live Grok recovery.
Evidence reviewed	9 items	Introduced production change: The pinned merge-base-to-head diff changes only the request body in production: a two-byte protobuf payload replaces an empty payload. Authentication headers, endpoint, timeout, retry behavior, and response parsing remain unchanged. Still needed on main: Fetched main still sends the five-byte empty gRPC-web frame. Latest release comparison: The supplied latest release, v0.63.0, also contains the empty request frame; this repair is not present there.
Findings	None	None.
Security	None	None.

How this fits together

CodexBar’s Grok provider combines CLI and web billing results into usage snapshots for the menu and dashboard. The changed request feeds the existing web billing parser and fallback logic.

flowchart LR
 A[Grok credentials] --> B[Usage fetch strategy]
 B --> C[CLI proxy billing]
 B --> D[Nonempty web billing request]
 D --> E[Billing response parser]
 C --> F[Usage snapshot]
 E --> F
 G[Local session history] --> F
 F --> H[Menu and dashboard]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Production and test delta	production +1/-1; tests +71/-1	The production repair has no net growth, with most added code devoted to request and fallback regression coverage.

Technical review

Best possible solution:

Preserve the explicit-false request encoding and existing billing semantics, while keeping live dashboard diagnosis and dollar-spend work separate.

Do we have a high-confidence way to reproduce the issue?

No: source confirms the empty request on main, but the reported server rejection and affected-account recovery were not reproduced in this read-only review.

Is this the best way to solve the issue?

Yes: explicitly encoding the documented false default is a narrow way to supply a nonempty message without changing billing selection or response interpretation.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 7678afe828f1.

Labels

Label changes:

• add P2: This repairs a limited Grok billing fallback failure without evidence of an app-wide outage.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The owner-authored PR is exempt from the ordinary contributor proof gate. Stubbed billing tests exercise the changed request bytes; the synthetic CLI-to-share test covers a separate existing path, and neither establishes live Grok recovery.

Label justifications:

• P2: This repairs a limited Grok billing fallback failure without evidence of an app-wide outage.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The owner-authored PR is exempt from the ordinary contributor proof gate. Stubbed billing tests exercise the changed request bytes; the synthetic CLI-to-share test covers a separate existing path, and neither establishes live Grok recovery.

Evidence

What I checked:

• Introduced production change: The pinned merge-base-to-head diff changes only the request body in production: a two-byte protobuf payload replaces an empty payload. Authentication headers, endpoint, timeout, retry behavior, and response parsing remain unchanged. (Sources/CodexBarCore/Providers/Grok/GrokWebBillingFetcher.swift:223, 446c3bafd5ea)
• Still needed on main: Fetched main still sends the five-byte empty gRPC-web frame. (Sources/CodexBarCore/Providers/Grok/GrokWebBillingFetcher.swift:223, 7678afe828f1)
• Latest release comparison: The supplied latest release, v0.63.0, also contains the empty request frame; this repair is not present there. (Sources/CodexBarCore/Providers/Grok/GrokWebBillingFetcher.swift:223, f3e718c897d5)
• Focused regression coverage: Request assertions cover bearer, cookie, combined authentication, and retry paths, including preservation of the 15-second retry timeout. These use URLProtocol stubs, not live Grok responses. (Tests/CodexBarTests/GrokWebBillingFetcherTests.swift:771, 446c3bafd5ea)
• Adjacent dashboard investigation: The added synthetic CLI failure test preserves 42 local tokens through proxy fallback, dashboard construction, and share payload construction. Existing UsageSnapshot serialization deliberately excludes costUsage. This supports the documentation clarification but does not resolve the reported live dashboard failure at Grok token totals never reach Usage & Spend: x.ai/billing returns -32601 on grok CLI 1.0.25 and the local session summary is dropped #3716. (Tests/CodexBarTests/GrokAccountContextTests.swift:269, 446c3bafd5ea)
• Related request repair and proof boundary: The supplied body of fix(grok): preserve billing semantics in nonempty requests #3336 documents the same explicit-false request correction and asks to leave that external contribution unmerged pending affected-account confirmation. Its inspected comments contain automated reviews, not a separate maintainer ruling. This owner-authored PR credits that work and explicitly acknowledges that live recovery remains unverified; neither open PR establishes an implemented-on-main close.

Likely related people:

• unknown: The claimed source-line change could not be verified from bounded local history. (role: source history unknown; confidence: low)
• olddonkey: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.