diff --git a/apps/desktop-tauri/src-tauri/src/commands/mod.rs b/apps/desktop-tauri/src-tauri/src/commands/mod.rs
index 06721a6e8e..d3aa838481 100644
--- a/apps/desktop-tauri/src-tauri/src/commands/mod.rs
+++ b/apps/desktop-tauri/src-tauri/src/commands/mod.rs
@@ -75,6 +75,8 @@ pub use surface::*;
 pub use system::*;
 pub(crate) use usage_items::*;
 
+#[cfg(test)]
+mod session_cookie_scope_tests;
 #[cfg(test)]
 mod tests;
 
diff --git a/apps/desktop-tauri/src-tauri/src/commands/provider_settings.rs b/apps/desktop-tauri/src-tauri/src/commands/provider_settings.rs
index 4028a688e9..f2a3852773 100644
--- a/apps/desktop-tauri/src-tauri/src/commands/provider_settings.rs
+++ b/apps/desktop-tauri/src-tauri/src/commands/provider_settings.rs
@@ -226,6 +226,7 @@ fn cookie_source_provider(provider_id: &str) -> Option<codexbar::core::ProviderI
         "replicate" => ProviderId::Replicate,
         "helmcode" => ProviderId::Helmcode,
         "typesafe" => ProviderId::TypeSafe,
+        "hyper" => ProviderId::Hyper,
         _ => return None,
     })
 }
@@ -334,6 +335,7 @@ fn workspace_provider(provider_id: &str) -> Option<codexbar::core::ProviderId> {
         "xai" => ProviderId::Xai,
         "v0" => ProviderId::V0,
         "helmcode" => ProviderId::Helmcode,
+        "gitkraken" => ProviderId::GitKraken,
         _ => return None,
     })
 }
@@ -389,7 +391,7 @@ fn litellm_workspace_change_allowed(
 mod tests {
     use codexbar::core::ProviderId;
 
-    use super::{litellm_workspace_change_allowed, workspace_provider};
+    use super::{gateway_provider, litellm_workspace_change_allowed, workspace_provider};
 
     #[test]
     fn maps_opencode_go_workspace_provider() {
@@ -399,6 +401,18 @@ mod tests {
         );
     }
 
+    #[test]
+    fn maps_gitkraken_organization_provider() {
+        assert_eq!(workspace_provider("gitkraken"), Some(ProviderId::GitKraken));
+    }
+
+    #[test]
+    fn gateway_provider_exposes_wayfinder_and_bifrost_only() {
+        assert_eq!(gateway_provider("wayfinder"), Some(ProviderId::Wayfinder));
+        assert_eq!(gateway_provider("bifrost"), Some(ProviderId::Bifrost));
+        assert_eq!(gateway_provider("codex"), None);
+    }
+
     #[test]
     fn litellm_endpoint_change_requires_reentering_saved_key() {
         assert!(
@@ -450,7 +464,18 @@ pub fn get_provider_workspace_id(provider_id: String) -> Result<Option<String>,
 }
 
 fn gateway_provider(provider_id: &str) -> Option<codexbar::core::ProviderId> {
-    (provider_id == "wayfinder").then_some(codexbar::core::ProviderId::Wayfinder)
+    match provider_id {
+        "wayfinder" => Some(codexbar::core::ProviderId::Wayfinder),
+        "bifrost" => Some(codexbar::core::ProviderId::Bifrost),
+        _ => None,
+    }
+}
+
+#[tauri::command]
+pub fn get_provider_gateway_url(provider_id: String) -> Result<String, String> {
+    let id = gateway_provider(&provider_id)
+        .ok_or_else(|| format!("Provider '{provider_id}' does not expose a gateway URL"))?;
+    Ok(Settings::load().gateway_url(id).to_string())
 }
 
 #[tauri::command]
@@ -458,8 +483,17 @@ pub fn set_provider_gateway_url(provider_id: String, gateway_url: String) -> Res
     let id = gateway_provider(&provider_id)
         .ok_or_else(|| format!("Provider '{provider_id}' does not expose a gateway URL"))?;
     let gateway_url = gateway_url.trim();
-    codexbar::providers::wayfinder::parse_gateway_url(gateway_url)
-        .map_err(|error| error.to_string())?;
+    match id {
+        codexbar::core::ProviderId::Wayfinder => {
+            codexbar::providers::wayfinder::parse_gateway_url(gateway_url)
+                .map_err(|error| error.to_string())?;
+        }
+        codexbar::core::ProviderId::Bifrost => {
+            codexbar::providers::bifrost::validate_gateway_url(gateway_url)
+                .map_err(|error| error.to_string())?;
+        }
+        _ => unreachable!("gateway_provider only returns gateway providers"),
+    }
 
     let mut settings = Settings::load();
     settings.set_gateway_url(id, gateway_url.to_string());
@@ -786,6 +820,31 @@ pub fn cookie_source_options_for(provider_id: &str, lang: Language) -> Vec<Cooki
                 None,
             ),
         ],
+        // Upstream's Hyper picker; the session can come from any selected
+        // browser here, not only Chrome.
+        "hyper" => vec![
+            cookie_option(
+                lang,
+                "auto",
+                "Prefer a signed-in Hyper browser session, then fall back to an API key.",
+                "",
+                None,
+            ),
+            cookie_option(
+                lang,
+                "manual",
+                "",
+                "Paste a Cookie header from hyper.charm.land.",
+                None,
+            ),
+            cookie_option(
+                lang,
+                "off",
+                "",
+                "",
+                Some("Use only the configured API key."),
+            ),
+        ],
         _ => Vec::new(),
     }
 }
diff --git a/apps/desktop-tauri/src-tauri/src/commands/providers.rs b/apps/desktop-tauri/src-tauri/src/commands/providers.rs
index 103d47b869..8b4794b1e6 100644
--- a/apps/desktop-tauri/src-tauri/src/commands/providers.rs
+++ b/apps/desktop-tauri/src-tauri/src/commands/providers.rs
@@ -113,6 +113,24 @@ pub(crate) fn build_fetch_context(
                     (SourceMode::Web, stored_cookie.clone(), false)
                 }
                 _ if active_token_env.is_some() => (SourceMode::OAuth, None, false),
+                // Charm Hyper: the cookie source only picks the session, and
+                // the usage source keeps routing. Off and an empty Manual
+                // source never import a browser session, while Auto keeps its
+                // API-key fallback.
+                "off" | "manual" if provider.cookie_source_scopes_session_only() => {
+                    let cookie_header = if cookie_source == "manual" {
+                        active_token_cookie.or(stored_cookie)
+                    } else {
+                        None
+                    };
+                    let source_mode = if provider.available_sources().contains(&usage_source) {
+                        usage_source
+                    } else {
+                        SourceMode::Auto
+                    };
+                    let cookie_missing = cookie_header.is_none();
+                    (source_mode, cookie_header, cookie_missing)
+                }
                 "off" if provider_uses_oauth_without_cookies(id, usage_source) => {
                     (SourceMode::OAuth, None, false)
                 }
diff --git a/apps/desktop-tauri/src-tauri/src/commands/session_cookie_scope_tests.rs b/apps/desktop-tauri/src-tauri/src/commands/session_cookie_scope_tests.rs
new file mode 100644
index 0000000000..d5cf6229d1
--- /dev/null
+++ b/apps/desktop-tauri/src-tauri/src/commands/session_cookie_scope_tests.rs
@@ -0,0 +1,120 @@
+//! Fetch-context routing for providers whose cookie source only scopes the
+//! browser session (Charm Hyper): the usage source keeps routing, and off or
+//! an empty manual source never hands the provider a browser session.
+
+use std::collections::HashMap;
+
+use codexbar::core::{FetchContext, ProviderId, SourceMode};
+use codexbar::settings::{ApiKeys, Language, ManualCookies, Settings};
+
+fn hyper_context(
+    cookie_source: Option<&str>,
+    usage_source: &str,
+    cookie: Option<&str>,
+) -> FetchContext {
+    let mut settings = Settings::default();
+    if let Some(cookie_source) = cookie_source {
+        settings.set_cookie_source(ProviderId::Hyper, cookie_source);
+    }
+    settings.set_usage_source(ProviderId::Hyper, usage_source);
+    let mut cookies = ManualCookies::default();
+    if let Some(cookie) = cookie {
+        cookies.set("hyper", cookie);
+    }
+    let mut api_keys = ApiKeys::default();
+    api_keys.set("hyper", "fixture-key", None);
+    super::build_fetch_context(
+        ProviderId::Hyper,
+        &settings,
+        &cookies,
+        &api_keys,
+        &HashMap::new(),
+    )
+}
+
+#[test]
+fn hyper_defaults_to_automatic_session_with_the_provider_owning_the_browser_read() {
+    // No stored cookie: the shell must not read the browser itself, so the
+    // API source never touches cookies and Auto/Web import inside the provider.
+    for (usage_source, expected) in [
+        ("auto", SourceMode::Auto),
+        ("web", SourceMode::Web),
+        ("oauth", SourceMode::OAuth),
+    ] {
+        let ctx = hyper_context(None, usage_source, None);
+        assert_eq!(ctx.source_mode, expected, "{usage_source}");
+        assert!(ctx.manual_cookie_header.is_none());
+        assert!(!ctx.manual_cookie_missing);
+        assert_eq!(ctx.api_key.as_deref(), Some("fixture-key"));
+    }
+}
+
+#[test]
+fn hyper_manual_cookie_keeps_the_usage_source() {
+    for (usage_source, expected) in [
+        ("auto", SourceMode::Auto),
+        ("web", SourceMode::Web),
+        ("oauth", SourceMode::OAuth),
+    ] {
+        let ctx = hyper_context(Some("manual"), usage_source, Some("session=fixture"));
+        assert_eq!(ctx.source_mode, expected, "{usage_source}");
+        assert_eq!(ctx.manual_cookie_header.as_deref(), Some("session=fixture"));
+        assert!(!ctx.manual_cookie_missing);
+    }
+}
+
+#[test]
+fn hyper_empty_manual_source_falls_back_to_the_key_without_a_browser_session() {
+    let ctx = hyper_context(Some("manual"), "auto", None);
+    assert_eq!(ctx.source_mode, SourceMode::Auto);
+    assert!(ctx.manual_cookie_header.is_none());
+    assert!(ctx.manual_cookie_missing);
+    assert_eq!(ctx.api_key.as_deref(), Some("fixture-key"));
+}
+
+#[test]
+fn hyper_cookie_off_ignores_a_stored_cookie_and_keeps_the_usage_source() {
+    for (usage_source, expected) in [
+        ("auto", SourceMode::Auto),
+        ("web", SourceMode::Web),
+        ("oauth", SourceMode::OAuth),
+    ] {
+        let ctx = hyper_context(Some("off"), usage_source, Some("session=fixture"));
+        assert_eq!(ctx.source_mode, expected, "{usage_source}");
+        assert!(ctx.manual_cookie_header.is_none());
+        assert!(ctx.manual_cookie_missing);
+    }
+}
+
+#[test]
+fn hyper_unsupported_usage_source_routes_to_auto() {
+    for cookie_source in ["off", "manual"] {
+        let ctx = hyper_context(Some(cookie_source), "cli", None);
+        assert_eq!(ctx.source_mode, SourceMode::Auto, "{cookie_source}");
+        assert!(ctx.manual_cookie_missing);
+    }
+}
+
+#[test]
+fn hyper_exposes_upstream_cookie_source_picker() {
+    let settings = Settings::default();
+    assert_eq!(
+        super::provider_cookie_source_lookup(&settings, "hyper").as_deref(),
+        Some("auto")
+    );
+    let options = super::cookie_source_options_for("hyper", Language::English);
+    let values: Vec<_> = options.iter().map(|option| option.value.as_str()).collect();
+    assert_eq!(values, vec!["auto", "manual", "off"]);
+    let descriptions: Vec<_> = options
+        .iter()
+        .map(|option| option.description.as_deref())
+        .collect();
+    assert_eq!(
+        descriptions,
+        vec![
+            Some("Prefer a signed-in Hyper browser session, then fall back to an API key."),
+            Some("Paste a Cookie header from hyper.charm.land."),
+            Some("Use only the configured API key."),
+        ]
+    );
+}
diff --git a/apps/desktop-tauri/src-tauri/src/main.rs b/apps/desktop-tauri/src-tauri/src/main.rs
index 04f9388e80..aa501c7bef 100644
--- a/apps/desktop-tauri/src-tauri/src/main.rs
+++ b/apps/desktop-tauri/src-tauri/src/main.rs
@@ -264,6 +264,7 @@ fn main() {
             commands::get_provider_region_options,
             commands::set_provider_workspace_id,
             commands::set_provider_gateway_url,
+            commands::get_provider_gateway_url,
             commands::get_provider_workspace_id,
             commands::get_gemini_cli_signed_in,
             commands::get_vertexai_status,
diff --git a/apps/desktop-tauri/src/components/providers/providerIcons.ts b/apps/desktop-tauri/src/components/providers/providerIcons.ts
index aefe0035aa..7c65e9922e 100644
--- a/apps/desktop-tauri/src/components/providers/providerIcons.ts
+++ b/apps/desktop-tauri/src/components/providers/providerIcons.ts
@@ -185,7 +185,10 @@ export const PROVIDER_ICON_REGISTRY: Record<string, ProviderIcon> = {
   gemini:      { id: "gemini",      brandColor: "#ab87ea", fallbackLetter: "✦", svgPath: RAW.gemini },
   grok:        { id: "grok",        brandColor: "#111827", fallbackLetter: "G", svgPath: RAW.grok },
   groq:        { id: "groq",        brandColor: "#f55036", fallbackLetter: "G", svgPath: RAW.groq },
+  bifrost:     { id: "bifrost",     brandColor: "#33c09e", fallbackLetter: "B" },
+  gitkraken:   { id: "gitkraken",   brandColor: "#179287", fallbackLetter: "G" },
   huggingface: { id: "huggingface", brandColor: "#ffd21e", fallbackLetter: "H", svgPath: RAW.huggingface },
+  hyper:       { id: "hyper",       brandColor: "#ff60ff", fallbackLetter: "H" },
   helmcode:    { id: "helmcode",    brandColor: "#4f46e5", fallbackLetter: "H" },
   v0:          { id: "v0",          brandColor: "#111827", fallbackLetter: "V" },
   typesafe:    { id: "typesafe",    brandColor: "#2563eb", fallbackLetter: "T" },
diff --git a/apps/desktop-tauri/src/lib/tauri.ts b/apps/desktop-tauri/src/lib/tauri.ts
index 6ccd63c0de..57f6ce274d 100644
--- a/apps/desktop-tauri/src/lib/tauri.ts
+++ b/apps/desktop-tauri/src/lib/tauri.ts
@@ -450,6 +450,10 @@ export function setProviderGatewayUrl(
   return invoke<void>("set_provider_gateway_url", { providerId, gatewayUrl });
 }
 
+export function getProviderGatewayUrl(providerId: string): Promise<string> {
+  return invoke<string>("get_provider_gateway_url", { providerId });
+}
+
 export function getProviderAzureApiVersion(providerId: string): Promise<string | null> {
   return invoke<string | null>("get_provider_azure_api_version", { providerId });
 }
diff --git a/apps/desktop-tauri/src/surfaces/settings/providers/ProviderDetailPane.tsx b/apps/desktop-tauri/src/surfaces/settings/providers/ProviderDetailPane.tsx
index 0dadfe492d..ae3e6766a5 100644
--- a/apps/desktop-tauri/src/surfaces/settings/providers/ProviderDetailPane.tsx
+++ b/apps/desktop-tauri/src/surfaces/settings/providers/ProviderDetailPane.tsx
@@ -1,4 +1,4 @@
-import { useCallback, useEffect, useReducer } from "react";
+import { useCallback, useEffect, useReducer, useState } from "react";
 import type { SettingsSnapshot, SettingsUpdate } from "../../../types/bridge";
 import { useLocale } from "../../../hooks/useLocale";
 import { providerAllowsPace } from "../../../lib/providerPace";
@@ -6,6 +6,7 @@ import {
   getCredentialStorageStatus,
   getProviderCookieSourceOptions,
   getProviderDetail,
+  getProviderGatewayUrl,
   getProviderRegionOptions,
   getTokenAccountProviders,
   openProviderDashboard,
@@ -83,6 +84,8 @@ export function ProviderDetailPane({
   onSettingsChange,
 }: Props) {
   const { t, language } = useLocale();
+  const [gatewayLoadedProviderId, setGatewayLoadedProviderId] =
+    useState<string | null>(null);
   const [state, dispatch] = useReducer(
     providerDetailPaneReducer,
     { wayfinderGatewayUrl, providerId },
@@ -142,11 +145,34 @@ export function ProviderDetailPane({
     }
   }, []);
 
+  const gatewayProviderId = providerId === "wayfinder" || providerId === "bifrost"
+    ? providerId
+    : null;
+
+  useEffect(() => {
+    setGatewayLoadedProviderId(null);
+    if (!gatewayProviderId) return;
+    let cancelled = false;
+    void getProviderGatewayUrl(gatewayProviderId).then((url) => {
+      if (!cancelled) {
+        dispatch({ type: "SET_GATEWAY_DRAFT", draft: url });
+        setGatewayLoadedProviderId(gatewayProviderId);
+      }
+    }).catch((e) => {
+      if (!cancelled) {
+        dispatch({ type: "SAVE_GATEWAY_ERROR", error: String(e) });
+        setGatewayLoadedProviderId(gatewayProviderId);
+      }
+    });
+    return () => { cancelled = true; };
+  }, [gatewayProviderId]);
+
   const saveGateway = async () => {
     dispatch({ type: "SAVE_GATEWAY_START" });
     try {
-      await setProviderGatewayUrl("wayfinder", gatewayDraft);
-      await load("wayfinder");
+      if (!gatewayProviderId) return;
+      await setProviderGatewayUrl(gatewayProviderId, gatewayDraft);
+      await load(gatewayProviderId);
     } catch (e) {
       dispatch({ type: "SAVE_GATEWAY_ERROR", error: String(e) });
     } finally {
@@ -319,7 +345,8 @@ export function ProviderDetailPane({
         t={t}
         onChanged={reload}
       />
-      {detail.id === "wayfinder" && (
+      {(detail.id === "wayfinder" || detail.id === "bifrost") &&
+        gatewayLoadedProviderId === detail.id && (
         <WayfinderGatewaySection
           draft={gatewayDraft}
           error={gatewayError}
@@ -330,6 +357,7 @@ export function ProviderDetailPane({
           }
           onSave={() => void saveGateway()}
           t={t}
+          bifrost={detail.id === "bifrost"}
         />
       )}
       <MenuBarMetricSection
diff --git a/apps/desktop-tauri/src/surfaces/settings/providers/sections/CredentialsDispatcher.tsx b/apps/desktop-tauri/src/surfaces/settings/providers/sections/CredentialsDispatcher.tsx
index 76c2652ecd..9e57c58d1d 100644
--- a/apps/desktop-tauri/src/surfaces/settings/providers/sections/CredentialsDispatcher.tsx
+++ b/apps/desktop-tauri/src/surfaces/settings/providers/sections/CredentialsDispatcher.tsx
@@ -40,6 +40,7 @@ export function CredentialsDispatcher({ providerId, t }: Props) {
     case "zed":
     case "sub2api":
     case "xai":
+    case "gitkraken":
       return <OpenAiExtras providerId={providerId} t={t} />;
     case "openrouter":
       return <OpenRouterManagementCreds t={t} />;
diff --git a/apps/desktop-tauri/src/surfaces/settings/providers/sections/WayfinderGatewaySection.tsx b/apps/desktop-tauri/src/surfaces/settings/providers/sections/WayfinderGatewaySection.tsx
index 1f0f28f0e6..77b4067771 100644
--- a/apps/desktop-tauri/src/surfaces/settings/providers/sections/WayfinderGatewaySection.tsx
+++ b/apps/desktop-tauri/src/surfaces/settings/providers/sections/WayfinderGatewaySection.tsx
@@ -8,6 +8,7 @@ interface Props {
   onDraftChange: (draft: string) => void;
   onSave: () => void;
   t: (key: LocaleKey) => string;
+  bifrost?: boolean;
 }
 
 export function WayfinderGatewaySection({
@@ -18,12 +19,13 @@ export function WayfinderGatewaySection({
   onDraftChange,
   onSave,
   t,
+  bifrost = false,
 }: Props) {
   return (
     <section className="provider-detail__section">
-      <h3>{t("WayfinderGatewayTitle")}</h3>
+      <h3>{bifrost ? "Bifrost gateway" : t("WayfinderGatewayTitle")}</h3>
       <label>
-        <span>{t("WayfinderGatewayLabel")}</span>
+        <span>{bifrost ? "Gateway URL" : t("WayfinderGatewayLabel")}</span>
         <input
           type="url"
           value={draft}
@@ -32,7 +34,9 @@ export function WayfinderGatewaySection({
           aria-describedby="wayfinder-gateway-help"
         />
       </label>
-      <p id="wayfinder-gateway-help">{t("WayfinderGatewayHelp")}</p>
+      <p id="wayfinder-gateway-help">
+        {bifrost ? "Base URL of your Bifrost gateway." : t("WayfinderGatewayHelp")}
+      </p>
       {error && <p role="alert">{error}</p>}
       <button
         type="button"
diff --git a/apps/desktop-tauri/src/surfaces/settings/providers/sections/credentials/OpenAiExtras.tsx b/apps/desktop-tauri/src/surfaces/settings/providers/sections/credentials/OpenAiExtras.tsx
index 3ed6842890..651436c2e8 100644
--- a/apps/desktop-tauri/src/surfaces/settings/providers/sections/credentials/OpenAiExtras.tsx
+++ b/apps/desktop-tauri/src/surfaces/settings/providers/sections/credentials/OpenAiExtras.tsx
@@ -116,6 +116,7 @@ const WORKSPACE_EXTRA_IDS: Record<string, true> = {
   sub2api: true,
   xai: true,
   fireworks: true,
+  gitkraken: true,
 };
 
 function extraConfig(providerId: string, t: Props["t"]) {
@@ -176,6 +177,13 @@ function extraConfig(providerId: string, t: Props["t"]) {
         placeholder: "your-account-slug",
         help: "From app.fireworks.ai/accounts/<slug>. Or set FIREWORKS_ACCOUNT_SLUG. Pair with a Fireworks API key to read 30-day rated billing spend.",
       };
+    case "gitkraken":
+      return {
+        title: "GitKraken organization",
+        label: "Organization ID (optional)",
+        placeholder: "organization-id",
+        help: "Adds the organization ID to shared-pool usage requests. Or set GITKRAKEN_ORG_ID.",
+      };
     default:
       return null;
   }
diff --git a/apps/desktop-tauri/src/surfaces/settings/providers/sections/usageSourcePolicy.ts b/apps/desktop-tauri/src/surfaces/settings/providers/sections/usageSourcePolicy.ts
index 21de240c09..57ab1c71d5 100644
--- a/apps/desktop-tauri/src/surfaces/settings/providers/sections/usageSourcePolicy.ts
+++ b/apps/desktop-tauri/src/surfaces/settings/providers/sections/usageSourcePolicy.ts
@@ -46,6 +46,25 @@ const POLICIES: Readonly<Record<string, UsageSourcePolicy>> = {
       { value: "oauth", label: "Hermes OAuth", description: "Uses the read-only Nous Portal token from Hermes Agent." },
     ],
   },
+  hyper: {
+    options: [
+      { value: "auto", label: "Auto", description: "Tries the Charm Hyper browser session, then the configured API key." },
+      { value: "web", label: "Browser session", description: "Uses the selected hyper.charm.land browser session only." },
+      { value: "oauth", label: "API", description: "Uses the configured Charm Hyper API key only." },
+    ],
+  },
+  gitkraken: {
+    options: [
+      { value: "auto", label: "Auto", description: "Uses the configured GitKraken access token." },
+      { value: "oauth", label: "API", description: "Uses the configured GitKraken access token only." },
+    ],
+  },
+  bifrost: {
+    options: [
+      { value: "auto", label: "Auto", description: "Uses the configured Bifrost gateway and virtual key." },
+      { value: "oauth", label: "API", description: "Uses the configured Bifrost gateway and virtual key only." },
+    ],
+  },
   muse: {
     options: [
       { value: "auto", label: "Auto", description: "Uses the local Muse Code device login." },
diff --git a/apps/desktop-tauri/src/test/providerCatalog.ts b/apps/desktop-tauri/src/test/providerCatalog.ts
index be41e7b35e..1b1802bc57 100644
--- a/apps/desktop-tauri/src/test/providerCatalog.ts
+++ b/apps/desktop-tauri/src/test/providerCatalog.ts
@@ -76,4 +76,7 @@ export const TEST_PROVIDER_CATALOG: Array<[string, string]> = [
   ["meta", "Meta"],
   ["muse", "Muse Code"],
   ["nous", "Nous Portal"],
+  ["hyper", "Charm Hyper"],
+  ["gitkraken", "GitKraken AI"],
+  ["bifrost", "Bifrost"],
 ];
diff --git a/docs/PROVIDERS.md b/docs/PROVIDERS.md
index 237f7dab3d..59f146cda6 100644
--- a/docs/PROVIDERS.md
+++ b/docs/PROVIDERS.md
@@ -55,6 +55,22 @@ spend and, when the optional balance request succeeds, prepaid credit balance.
 It keeps those values in the cost/detail surfaces and does not invent a quota
 percentage or use a Replicate API token as a website credential.
 
+### Charm Hyper balance
+
+Charm Hyper is disabled by default. It reads
+`GET https://hyper.charm.land/v1/credits` and shows one **Hypercredits** detail
+row in native HC units; it never infers a quota percentage, plan, reset or
+spend. The cookie source only picks the session: Automatic imports the
+`hyper.charm.land` session from the selected browser, Manual uses a pasted
+Cookie header, and Disabled uses only the API key. The usage source keeps
+routing. Auto prefers the session and falls back to the API key (the saved key,
+then `HYPER_API_KEY`) when there is no session, the session request fails, or
+the session is rejected (401, 403, a redirect or an HTML sign-in page).
+Browser session never uses the key, and API never reads cookies. The cookie and
+the bearer key are never sent together. Rate limits, server errors and
+malformed balances are final and do not fall back. Upstream's multiple API-key
+token accounts are not ported yet.
+
 ## Listing what is enabled
 
 ```powershell
diff --git a/rust/src/core/provider.rs b/rust/src/core/provider.rs
index 218901b770..87db192575 100755
--- a/rust/src/core/provider.rs
+++ b/rust/src/core/provider.rs
@@ -92,6 +92,9 @@ pub enum ProviderId {
     Muse,
     Replicate,
     Nous,
+    Hyper,
+    GitKraken,
+    Bifrost,
 }
 
 impl ProviderId {
@@ -177,6 +180,9 @@ impl ProviderId {
             ProviderId::Muse,
             ProviderId::Replicate,
             ProviderId::Nous,
+            ProviderId::Hyper,
+            ProviderId::GitKraken,
+            ProviderId::Bifrost,
         ]
     }
 
@@ -224,6 +230,9 @@ impl ProviderId {
             ProviderId::Meta => "meta",
             ProviderId::Muse => "muse",
             ProviderId::Nous => "nous",
+            ProviderId::Hyper => "hyper",
+            ProviderId::GitKraken => "gitkraken",
+            ProviderId::Bifrost => "bifrost",
             ProviderId::AiAnd => "aiand",
             ProviderId::Windsurf => "windsurf",
             ProviderId::Manus => "manus",
@@ -310,6 +319,9 @@ impl ProviderId {
             ProviderId::Meta => "Meta",
             ProviderId::Muse => "Muse Code",
             ProviderId::Nous => "Nous Portal",
+            ProviderId::Hyper => "Charm Hyper",
+            ProviderId::GitKraken => "GitKraken AI",
+            ProviderId::Bifrost => "Bifrost",
             ProviderId::AiAnd => "ai&",
             ProviderId::Windsurf => "Windsurf",
             ProviderId::Manus => "Manus",
@@ -411,6 +423,9 @@ impl ProviderId {
             ProviderId::Meta => None,
             ProviderId::Muse => None,
             ProviderId::Nous => None,
+            ProviderId::Hyper => Some("hyper.charm.land"),
+            ProviderId::GitKraken => None,
+            ProviderId::Bifrost => None,
             ProviderId::AiAnd => None,
             ProviderId::Windsurf => None,
             ProviderId::Doubao => None,
@@ -490,6 +505,9 @@ impl ProviderId {
             "fireworks" | "fireworks-ai" | "fw" => Some(ProviderId::Fireworks),
             "muse" | "muse-code" | "muse code" => Some(ProviderId::Muse),
             "nous" | "nous-portal" | "nous portal" | "hermes" => Some(ProviderId::Nous),
+            "hyper" | "charm-hyper" | "charm hyper" => Some(ProviderId::Hyper),
+            "gitkraken" | "gitkraken-ai" | "gitkraken ai" => Some(ProviderId::GitKraken),
+            "bifrost" | "bifrost-gateway" | "bifrost gateway" => Some(ProviderId::Bifrost),
             "meta" | "metaspark" | "meta-spark" | "muse-spark" | "musespark" | "muse spark"
             | "meta muse spark" => Some(ProviderId::Meta),
             "aiand" | "ai&" | "ai-and" | "ai and" => Some(ProviderId::AiAnd),
@@ -740,9 +758,11 @@ pub struct FetchContext {
     /// Manual cookie header (for testing)
     pub manual_cookie_header: Option<String>,
 
-    /// The cookie source is manual and no cookie is stored. The provider
-    /// decides what this means; Replicate fails closed instead of importing a
-    /// browser account the user did not select.
+    /// The cookie source is manual and no cookie is stored, or (for providers
+    /// whose cookie source only scopes the session) cookies are off. The
+    /// provider decides what this means; Replicate fails closed instead of
+    /// importing a browser account the user did not select, and Charm Hyper
+    /// skips its session lane.
     pub manual_cookie_missing: bool,
 
     /// API key for providers that require authentication
@@ -891,6 +911,19 @@ pub trait Provider: Send + Sync {
         false
     }
 
+    /// Whether the cookie source only scopes the browser session the
+    /// provider may use, leaving the selected usage source in charge of
+    /// routing.
+    ///
+    /// When true, the shell keeps the usage source for every cookie source:
+    /// `off` and a `manual` source without a stored cookie pass no header and
+    /// set [`FetchContext::manual_cookie_missing`], so the provider skips the
+    /// session and Auto can still use an API key. Otherwise the shell remaps
+    /// the source mode from the cookie source.
+    fn cookie_source_scopes_session_only(&self) -> bool {
+        false
+    }
+
     /// How the shell should treat a failed refresh when a prior good snapshot exists.
     fn last_good_failure_policy(&self, _error: &str) -> LastGoodFailurePolicy {
         LastGoodFailurePolicy::Replace
@@ -1099,6 +1132,9 @@ pub fn brand_color(id: ProviderId) -> &'static str {
         ProviderId::Muse => "#0668E1",
         ProviderId::Replicate => "#000000",
         ProviderId::Nous => "#D6A55C",
+        ProviderId::Hyper => "#FF60FF",
+        ProviderId::GitKraken => "#179287",
+        ProviderId::Bifrost => "#33C09E",
     }
 }
 
@@ -1113,7 +1149,7 @@ mod tests {
     #[test]
     fn test_provider_id_all() {
         let all = ProviderId::all();
-        assert_eq!(all.len(), 79);
+        assert_eq!(all.len(), 82);
         assert!(all.contains(&ProviderId::Claude));
         assert!(all.contains(&ProviderId::Codex));
         assert!(all.contains(&ProviderId::Pi));
@@ -1173,6 +1209,9 @@ mod tests {
         assert!(all.contains(&ProviderId::Replicate));
         assert!(all.contains(&ProviderId::Muse));
         assert!(all.contains(&ProviderId::Nous));
+        assert!(all.contains(&ProviderId::Hyper));
+        assert!(all.contains(&ProviderId::GitKraken));
+        assert!(all.contains(&ProviderId::Bifrost));
     }
 
     #[test]
diff --git a/rust/src/core/provider_factory.rs b/rust/src/core/provider_factory.rs
index d801961af9..747763d4be 100644
--- a/rust/src/core/provider_factory.rs
+++ b/rust/src/core/provider_factory.rs
@@ -8,21 +8,21 @@
 use super::{Provider, ProviderId};
 use crate::providers::{
     AbacusProvider, AiAndProvider, AlibabaProvider, AlibabaTokenPlanProvider, AmpProvider,
-    AntigravityProvider, AugmentProvider, AzureOpenAIProvider, BedrockProvider, ChutesProvider,
-    ClaudeProvider, ClinePassProvider, CodeBuddyProvider, CodeRabbitProvider, CodebuffProvider,
-    CodexProvider, CommandCodeProvider, CopilotProvider, CrossModelProvider, CursorProvider,
-    DeepInfraProvider, DeepSeekProvider, DeepgramProvider, DevinProvider, DoubaoProvider,
-    ElevenLabsProvider, FactoryProvider, FireworksProvider, GeminiProvider, GrokProvider,
-    GroqProvider, HelmcodeProvider, HuggingFaceProvider, InfiniProvider, JetBrainsProvider,
-    KiloProvider, KimiK2Provider, KimiProvider, KiroProvider, LLMProxyProvider, LiteLLMProvider,
-    LongCatProvider, ManusProvider, MetaProvider, MiMoProvider, MiniMaxProvider, MistralProvider,
-    MuseProvider, NanoGPTProvider, NeuralwattProvider, NotionProvider, NousProvider,
-    OllamaProvider, OpenAIApiProvider, OpenCodeGoProvider, OpenCodeProvider, OpenRouterProvider,
-    PerplexityProvider, PiProvider, PoeProvider, QoderProvider, QwenCloudProvider,
-    ReplicateProvider, SakanaProvider, StepFunProvider, Sub2ApiProvider, T3ChatProvider,
-    TypeSafeProvider, V0Provider, VeniceProvider, VertexAIProvider, WarpProvider,
-    WayfinderProvider, WindsurfProvider, XaiProvider, ZaiProvider, ZedProvider, ZenMuxProvider,
-    ZoomMateProvider,
+    AntigravityProvider, AugmentProvider, AzureOpenAIProvider, BedrockProvider, BifrostProvider,
+    ChutesProvider, ClaudeProvider, ClinePassProvider, CodeBuddyProvider, CodeRabbitProvider,
+    CodebuffProvider, CodexProvider, CommandCodeProvider, CopilotProvider, CrossModelProvider,
+    CursorProvider, DeepInfraProvider, DeepSeekProvider, DeepgramProvider, DevinProvider,
+    DoubaoProvider, ElevenLabsProvider, FactoryProvider, FireworksProvider, GeminiProvider,
+    GitKrakenProvider, GrokProvider, GroqProvider, HelmcodeProvider, HuggingFaceProvider,
+    HyperProvider, InfiniProvider, JetBrainsProvider, KiloProvider, KimiK2Provider, KimiProvider,
+    KiroProvider, LLMProxyProvider, LiteLLMProvider, LongCatProvider, ManusProvider, MetaProvider,
+    MiMoProvider, MiniMaxProvider, MistralProvider, MuseProvider, NanoGPTProvider,
+    NeuralwattProvider, NotionProvider, NousProvider, OllamaProvider, OpenAIApiProvider,
+    OpenCodeGoProvider, OpenCodeProvider, OpenRouterProvider, PerplexityProvider, PiProvider,
+    PoeProvider, QoderProvider, QwenCloudProvider, ReplicateProvider, SakanaProvider,
+    StepFunProvider, Sub2ApiProvider, T3ChatProvider, TypeSafeProvider, V0Provider, VeniceProvider,
+    VertexAIProvider, WarpProvider, WayfinderProvider, WindsurfProvider, XaiProvider, ZaiProvider,
+    ZedProvider, ZenMuxProvider, ZoomMateProvider,
 };
 
 /// Instantiate the concrete [`Provider`] implementation for a given [`ProviderId`].
@@ -110,6 +110,9 @@ pub fn instantiate(id: ProviderId) -> Box<dyn Provider> {
         ProviderId::Meta => Box::new(MetaProvider::new()),
         ProviderId::Muse => Box::new(MuseProvider::new()),
         ProviderId::Nous => Box::new(NousProvider::new()),
+        ProviderId::Hyper => Box::new(HyperProvider::new()),
+        ProviderId::GitKraken => Box::new(GitKrakenProvider::new()),
+        ProviderId::Bifrost => Box::new(BifrostProvider::new()),
     }
 }
 
diff --git a/rust/src/core/token_accounts.rs b/rust/src/core/token_accounts.rs
index dbbb929d83..2b86ad8181 100755
--- a/rust/src/core/token_accounts.rs
+++ b/rust/src/core/token_accounts.rs
@@ -376,7 +376,10 @@ impl TokenAccountSupport {
             | ProviderId::Fireworks
             | ProviderId::Meta
             | ProviderId::Nous
-            | ProviderId::Muse => None,
+            | ProviderId::Muse
+            | ProviderId::Hyper
+            | ProviderId::GitKraken
+            | ProviderId::Bifrost => None,
         }
     }
 
@@ -795,6 +798,9 @@ mod tests {
         assert!(TokenAccountSupport::is_supported(ProviderId::Grok));
         assert!(!TokenAccountSupport::is_supported(ProviderId::Codex));
         assert!(!TokenAccountSupport::is_supported(ProviderId::Gemini));
+        assert!(!TokenAccountSupport::is_supported(ProviderId::Hyper));
+        assert!(!TokenAccountSupport::is_supported(ProviderId::GitKraken));
+        assert!(!TokenAccountSupport::is_supported(ProviderId::Bifrost));
     }
 
     #[test]
diff --git a/rust/src/providers/bifrost/mod.rs b/rust/src/providers/bifrost/mod.rs
new file mode 100644
index 0000000000..d872103c12
--- /dev/null
+++ b/rust/src/providers/bifrost/mod.rs
@@ -0,0 +1,1037 @@
+//! Bifrost self-hosted gateway quotas and model spend.
+//!
+//! Ported from upstream CodexBar v0.65.0. The configured gateway URL is
+//! validated before resolving or attaching the virtual-key credential.
+
+use async_trait::async_trait;
+use chrono::{DateTime, Utc};
+use reqwest::{Client, StatusCode, Url};
+use serde_json::Value;
+use std::{net::IpAddr, time::Duration};
+
+use crate::core::{
+    CostSnapshot, FetchContext, Provider, ProviderDisplayDetail, ProviderError,
+    ProviderFetchResult, ProviderId, ProviderMetadata, RateWindow, SourceMode, UsageSnapshot,
+};
+
+const CREDENTIAL_TARGET: &str = "codexbar-bifrost";
+const API_KEY_ENV: &str = "BIFROST_API_KEY";
+const REQUEST_TIMEOUT: Duration = Duration::from_secs(15);
+const MAX_RESPONSE_BYTES: usize = 2 * 1024 * 1024;
+const QUOTA_PATH: &str = "/api/governance/virtual-keys/quota";
+
+pub struct BifrostProvider {
+    metadata: ProviderMetadata,
+    client: Option<Client>,
+}
+
+#[derive(Debug, Clone, PartialEq)]
+struct Scope {
+    id: String,
+    title: Option<String>,
+    body: Value,
+}
+
+#[derive(Debug, Clone, PartialEq)]
+struct Budget {
+    id: String,
+    scope: Scope,
+    source: Option<String>,
+    used: f64,
+    usage_known: bool,
+    limit: f64,
+    reset: ResetTiming,
+    models: Vec<Value>,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq)]
+struct ResetTiming {
+    seconds: Option<f64>,
+    window_minutes: Option<u32>,
+    resets_at: Option<DateTime<Utc>>,
+    label: Option<&'static str>,
+}
+
+impl BifrostProvider {
+    pub fn new() -> Self {
+        Self {
+            metadata: ProviderMetadata {
+                id: ProviderId::Bifrost,
+                display_name: "Bifrost",
+                session_label: "Budget",
+                weekly_label: "Spend",
+                supports_opus: false,
+                supports_credits: true,
+                default_enabled: false,
+                is_primary: false,
+                dashboard_url: None,
+                status_page_url: None,
+                tertiary_label_key: None,
+            },
+            client: crate::core::credentialed_http_client_builder()
+                .timeout(REQUEST_TIMEOUT)
+                // The virtual-key credential uses a custom header; never
+                // follow a gateway redirect that could forward it elsewhere.
+                .redirect(reqwest::redirect::Policy::none())
+                .build()
+                .ok(),
+        }
+    }
+
+    async fn fetch_api(&self, ctx: &FetchContext) -> Result<ProviderFetchResult, ProviderError> {
+        // Validate before touching the keyring/environment or constructing a
+        // request. A malformed/custom public HTTP endpoint must never receive
+        // the virtual-key secret.
+        let base = ctx
+            .gateway_url
+            .clone()
+            .or_else(|| std::env::var("BIFROST_BASE_URL").ok())
+            .ok_or_else(|| {
+                ProviderError::NotInstalled(
+                    "Bifrost gateway URL not found. Set it in provider settings or BIFROST_BASE_URL."
+                        .into(),
+                )
+            })?;
+        let url = quota_url(&base)?;
+        let api_key = crate::providers::resolve_api_key(
+            ctx.api_key.as_deref(),
+            CREDENTIAL_TARGET,
+            &[API_KEY_ENV],
+        )?;
+        let client = self.client.as_ref().ok_or_else(|| {
+            ProviderError::Other("Could not create a secure Bifrost HTTP client.".into())
+        })?;
+
+        let timeout = Duration::from_secs(ctx.web_timeout.max(1)).min(REQUEST_TIMEOUT);
+        let response = client
+            .get(url)
+            .header("x-bf-vk", api_key)
+            .header("Accept", "application/json")
+            .timeout(timeout)
+            .send()
+            .await?;
+        let status = response.status();
+        match status {
+            StatusCode::UNAUTHORIZED => return Err(ProviderError::AuthRequired),
+            StatusCode::FORBIDDEN => {
+                return Err(ProviderError::Other(
+                    "Bifrost denied access to this virtual key's quota.".into(),
+                ));
+            }
+            StatusCode::TOO_MANY_REQUESTS => {
+                return Err(ProviderError::Other(
+                    "Bifrost quota request was rate limited (HTTP 429).".into(),
+                ));
+            }
+            status if status.is_server_error() => {
+                return Err(ProviderError::Other(format!(
+                    "Bifrost quota service is unavailable (HTTP {status})."
+                )));
+            }
+            status if !status.is_success() => {
+                return Err(ProviderError::Other(format!(
+                    "Bifrost quota request failed (HTTP {status})."
+                )));
+            }
+            _ => {}
+        }
+
+        let bytes = crate::providers::read_bounded_response(response, MAX_RESPONSE_BYTES)
+            .await
+            .map_err(|error| match error {
+                crate::providers::BoundedBodyError::TooLarge => {
+                    ProviderError::Parse("Bifrost returned an oversized quota response.".into())
+                }
+                crate::providers::BoundedBodyError::Read(error) => ProviderError::Network(error),
+            })?;
+        let body = std::str::from_utf8(&bytes)
+            .map_err(|_| ProviderError::Parse("Bifrost returned non-UTF-8 quota data.".into()))?;
+        let value: Value = serde_json::from_str(body)
+            .map_err(|_| ProviderError::Parse("Bifrost returned invalid quota JSON.".into()))?;
+        let parsed = parse_usage(&value, Utc::now())?;
+        Ok(result_from_usage(parsed))
+    }
+}
+
+impl Default for BifrostProvider {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+#[async_trait]
+impl Provider for BifrostProvider {
+    fn id(&self) -> ProviderId {
+        ProviderId::Bifrost
+    }
+
+    fn metadata(&self) -> &ProviderMetadata {
+        &self.metadata
+    }
+
+    async fn fetch_usage(&self, ctx: &FetchContext) -> Result<ProviderFetchResult, ProviderError> {
+        match ctx.source_mode {
+            SourceMode::Auto | SourceMode::OAuth => self.fetch_api(ctx).await,
+            source => Err(ProviderError::UnsupportedSource(source)),
+        }
+    }
+
+    fn available_sources(&self) -> Vec<SourceMode> {
+        vec![SourceMode::Auto, SourceMode::OAuth]
+    }
+}
+
+fn quota_url(raw: &str) -> Result<Url, ProviderError> {
+    let raw = raw.trim();
+    if raw.is_empty() {
+        return Err(ProviderError::Other("Bifrost gateway URL is empty.".into()));
+    }
+    let candidate = if raw.contains("://") {
+        raw.to_owned()
+    } else {
+        format!("https://{raw}")
+    };
+    let mut url = Url::parse(&candidate)
+        .map_err(|_| ProviderError::Other("Bifrost gateway URL is invalid.".into()))?;
+    let host = url
+        .host_str()
+        .ok_or_else(|| ProviderError::Other("Bifrost gateway URL must include a host.".into()))?;
+    if !url.username().is_empty() || url.password().is_some() || url.fragment().is_some() {
+        return Err(ProviderError::Other(
+            "Bifrost gateway URL cannot contain user information or a fragment.".into(),
+        ));
+    }
+    let allowed = match url.scheme() {
+        "https" => true,
+        "http" => is_private_http_host(host),
+        _ => false,
+    };
+    if !allowed {
+        return Err(ProviderError::Other(
+            "Bifrost gateway must use HTTPS; HTTP is allowed only for private or loopback IP addresses.".into(),
+        ));
+    }
+
+    // Treat the configured value as a base, preserving a configured path and
+    // query while replacing any trailing slash with the documented API route.
+    let query = url.query().map(str::to_owned);
+    let path = format!("{}{}", url.path().trim_end_matches('/'), QUOTA_PATH);
+    url.set_path(&path);
+    url.set_query(query.as_deref());
+    Ok(url)
+}
+
+/// Validate a configured gateway URL before saving it to settings.
+pub fn validate_gateway_url(raw: &str) -> Result<(), ProviderError> {
+    quota_url(raw).map(|_| ())
+}
+
+fn is_private_http_host(host: &str) -> bool {
+    if host.eq_ignore_ascii_case("localhost") || host.ends_with(".localhost") {
+        return true;
+    }
+    let host = host.trim_start_matches('[').trim_end_matches(']');
+    let Ok(ip) = host.parse::<IpAddr>() else {
+        return false;
+    };
+    match ip {
+        IpAddr::V4(ip) => ip.is_private() || ip.is_loopback() || ip.is_link_local(),
+        IpAddr::V6(ip) => {
+            ip.is_loopback() || ip.is_unique_local() || (ip.segments()[0] & 0xffc0) == 0xfe80
+        }
+    }
+}
+
+fn parse_usage(value: &Value, now: DateTime<Utc>) -> Result<ParsedUsage, ProviderError> {
+    object(value, "quota response")?;
+    let active = optional_bool(value, "is_active")?;
+    let mut scopes = vec![Scope {
+        id: String::new(),
+        title: None,
+        body: value.clone(),
+    }];
+    add_scopes(
+        &mut scopes,
+        value,
+        "provider_configs",
+        "provider",
+        "provider-",
+    )?;
+    add_scopes(&mut scopes, value, "model_configs", "model_name", "model-")?;
+
+    let mut budgets = Vec::new();
+    let mut limits = Vec::new();
+    for scope in scopes {
+        if let Some(items) = scope.body.get("budgets") {
+            for item in array(items, "budgets")? {
+                object(item, "budget")?;
+                let id = optional_text(item, "id")?.unwrap_or_default();
+                if id.is_empty() {
+                    continue;
+                }
+                let mut limit = optional_number(item, "max_limit")?.unwrap_or(0.0);
+                let override_amount = optional_number(item, "override_amount")?.unwrap_or(0.0);
+                let override_mode = optional_text(item, "override_mode")?;
+                let cycles = optional_number(item, "override_cycles_remaining")?.unwrap_or(0.0);
+                if cycles.fract() != 0.0 {
+                    return Err(parse_error("invalid override cycles"));
+                }
+                if override_amount > 0.0
+                    && (override_mode.as_deref() == Some("forever")
+                        || (override_mode.as_deref() == Some("cycles") && cycles > 0.0))
+                {
+                    limit += override_amount;
+                }
+                if !limit.is_finite() || limit < 0.0 {
+                    return Err(parse_error("invalid effective budget"));
+                }
+                let current_usage = optional_number(item, "current_usage")?;
+                let used = current_usage.unwrap_or(0.0);
+                if used < 0.0 {
+                    return Err(parse_error("invalid current usage"));
+                }
+                let reset = reset_timing(
+                    optional_text(item, "reset_duration")?.as_deref(),
+                    optional_text(item, "last_reset")?.as_deref(),
+                    now,
+                );
+                let models = item
+                    .get("per_model_usage")
+                    .map(|v| array(v, "per_model_usage"))
+                    .transpose()?
+                    .unwrap_or_default()
+                    .to_vec();
+                budgets.push(Budget {
+                    id,
+                    scope: scope.clone(),
+                    source: optional_text(item, "source_name")?,
+                    used,
+                    usage_known: current_usage.is_some(),
+                    limit,
+                    reset,
+                    models,
+                });
+            }
+        }
+
+        // The aggregate field is a compatibility merge. It is never counted
+        // together with its component rate_limits when components are present.
+        let components = scope
+            .body
+            .get("rate_limits")
+            .map(|v| array(v, "rate_limits"))
+            .transpose()?
+            .unwrap_or_default();
+        if components.is_empty() {
+            if let Some(aggregate) = scope.body.get("rate_limit")
+                && !aggregate.is_null()
+            {
+                limits.push((scope.clone(), aggregate.clone(), 0usize));
+            }
+        } else {
+            limits.extend(
+                components
+                    .iter()
+                    .cloned()
+                    .enumerate()
+                    .map(|(index, limit)| {
+                        object(&limit, "rate limit")?;
+                        Ok((scope.clone(), limit, index))
+                    })
+                    .collect::<Result<Vec<_>, ProviderError>>()?,
+            );
+        }
+    }
+    budgets.sort_by(|a, b| {
+        a.reset
+            .seconds
+            .unwrap_or(f64::INFINITY)
+            .total_cmp(&b.reset.seconds.unwrap_or(f64::INFINITY))
+            .then_with(|| a.id.cmp(&b.id))
+    });
+    if active == Some(false) && budgets.is_empty() && limits.is_empty() {
+        return Err(ProviderError::Other(
+            "Bifrost virtual key is inactive and has no budgets or rate limits to display.".into(),
+        ));
+    }
+    Ok(ParsedUsage {
+        active,
+        budgets,
+        limits,
+    })
+}
+
+#[derive(Debug, Clone, PartialEq)]
+struct ParsedUsage {
+    active: Option<bool>,
+    budgets: Vec<Budget>,
+    limits: Vec<(Scope, Value, usize)>,
+}
+
+fn add_scopes(
+    scopes: &mut Vec<Scope>,
+    root: &Value,
+    collection: &str,
+    label_field: &str,
+    prefix: &str,
+) -> Result<(), ProviderError> {
+    let Some(value) = root.get(collection) else {
+        return Ok(());
+    };
+    for (index, body) in array(value, collection)?.iter().enumerate() {
+        let provider = optional_text(body, "provider")?;
+        let model = optional_text(body, label_field)?;
+        let title = if label_field == "model_name" {
+            Some(format!(
+                "Model {}",
+                [provider, model.or_else(|| Some((index + 1).to_string()))]
+                    .into_iter()
+                    .flatten()
+                    .collect::<Vec<_>>()
+                    .join(" · ")
+            ))
+        } else {
+            Some(format!(
+                "Provider {}",
+                provider.unwrap_or_else(|| (index + 1).to_string())
+            ))
+        };
+        scopes.push(Scope {
+            id: format!("{prefix}{index}-"),
+            title,
+            body: body.clone(),
+        });
+    }
+    Ok(())
+}
+
+fn result_from_usage(usage: ParsedUsage) -> ProviderFetchResult {
+    let mut budget_windows = usage
+        .budgets
+        .iter()
+        .filter(|budget| budget.limit > 0.0)
+        .map(|budget| {
+            let title = bounded(
+                &[
+                    budget.scope.title.as_deref(),
+                    Some(budget.source.as_deref().unwrap_or("Budget")),
+                ]
+                .into_iter()
+                .flatten()
+                .collect::<Vec<_>>()
+                .join(" · "),
+            );
+            let window = RateWindow::with_details(
+                percent(budget.used, budget.limit),
+                budget.reset.window_minutes,
+                budget.reset.resets_at,
+                Some(budget_description(budget)),
+            )
+            .with_usage_known(budget.usage_known);
+            (budget, title, window)
+        })
+        .collect::<Vec<_>>();
+    let root_windows = budget_windows
+        .iter()
+        .filter(|(budget, _, _)| budget.scope.id.is_empty())
+        .collect::<Vec<_>>();
+    let primary = root_windows
+        .first()
+        .map(|(_, _, window)| window.clone())
+        .unwrap_or_else(|| RateWindow::informational("No Bifrost budget quota reported"));
+    let secondary = root_windows.get(1).map(|(_, _, window)| (*window).clone());
+    let mut snapshot = UsageSnapshot::new(primary).with_login_method("API");
+    if let Some(secondary) = secondary {
+        snapshot = snapshot.with_secondary(secondary);
+    }
+    let mut extra_windows = root_windows
+        .iter()
+        .skip(2)
+        .map(|(_, title, window)| {
+            (
+                format!(
+                    "bifrost-budget-{}",
+                    window.reset_description.as_deref().unwrap_or("extra")
+                ),
+                title.clone(),
+                window.clone(),
+            )
+        })
+        .collect::<Vec<_>>();
+    extra_windows.extend(
+        budget_windows
+            .drain(..)
+            .filter(|(budget, _, _)| !budget.scope.id.is_empty())
+            .map(|(budget, title, window)| {
+                (
+                    format!("bifrost-{}budget-{}", budget.scope.id, budget.id),
+                    title,
+                    window,
+                )
+            }),
+    );
+
+    for (scope, limit, index) in &usage.limits {
+        let source = optional_text(limit, "source_name").ok().flatten();
+        for (key, title) in [("token", "Tokens"), ("request", "Requests")] {
+            let max = optional_number(limit, &format!("{key}_max_limit"))
+                .ok()
+                .flatten();
+            let reset_raw = optional_text(limit, &format!("{key}_reset_duration"))
+                .ok()
+                .flatten();
+            let Some(max_or_reset) = max
+                .filter(|max| *max > 0.0)
+                .or_else(|| reset_raw.as_ref().map(|_| 0.0))
+            else {
+                continue;
+            };
+            let used = optional_number(limit, &format!("{key}_current_usage"))
+                .ok()
+                .flatten()
+                .unwrap_or(0.0);
+            let reset = reset_timing(
+                reset_raw.as_deref(),
+                optional_text(limit, &format!("{key}_last_reset"))
+                    .ok()
+                    .flatten()
+                    .as_deref(),
+                Utc::now(),
+            );
+            let title = bounded(
+                &[scope.title.as_deref(), source.as_deref(), Some(title)]
+                    .into_iter()
+                    .flatten()
+                    .collect::<Vec<_>>()
+                    .join(" "),
+            );
+            let window = RateWindow::with_details(
+                if max_or_reset > 0.0 {
+                    percent(used, max_or_reset)
+                } else {
+                    0.0
+                },
+                reset.window_minutes,
+                reset.resets_at,
+                reset.label.map(str::to_owned),
+            );
+            extra_windows.push((
+                format!("bifrost-{}{}s-{index}", scope.id, key),
+                title,
+                window,
+            ));
+        }
+    }
+    for (id, title, window) in extra_windows {
+        snapshot = snapshot.with_extra_rate_window(id, title, window);
+    }
+    if usage.active == Some(false) {
+        snapshot = snapshot.with_extra_rate_window(
+            "bifrost-key-inactive",
+            "Key inactive",
+            RateWindow::informational("Virtual key is inactive"),
+        );
+    }
+
+    let mut result = ProviderFetchResult::new(snapshot, "api");
+    if let Some(first) = usage
+        .budgets
+        .iter()
+        .find(|budget| budget.scope.id.is_empty())
+    {
+        let mut cost = CostSnapshot::new(
+            first.used,
+            "USD",
+            first
+                .reset
+                .label
+                .unwrap_or(if first.limit > 0.0 { "Budget" } else { "Spend" }),
+        );
+        if first.limit > 0.0 {
+            cost = cost.with_limit(first.limit);
+        }
+        if let Some(resets_at) = first.reset.resets_at {
+            cost = cost.with_resets_at(resets_at);
+        }
+        result = result.with_cost(cost);
+    }
+
+    if usage.budgets.len() > 1 || usage.budgets.iter().any(|b| !b.scope.id.is_empty()) {
+        for (index, budget) in usage.budgets.iter().take(24).enumerate() {
+            let title = bounded(
+                &[
+                    budget.scope.title.as_deref(),
+                    Some(budget.source.as_deref().unwrap_or("Budget")),
+                ]
+                .into_iter()
+                .flatten()
+                .collect::<Vec<_>>()
+                .join(" · "),
+            );
+            let value = if budget.limit > 0.0 {
+                format!("{} / {}", usd(budget.used), usd(budget.limit))
+            } else {
+                usd(budget.used)
+            };
+            let mut detail =
+                ProviderDisplayDetail::new(format!("bifrost-budget-detail-{index}"), title, value);
+            if budget.limit > 0.0 {
+                detail =
+                    detail.and_then(|row| row.with_progress(budget.used.max(0.0), budget.limit));
+            }
+            if let Some(label) = budget.reset.label {
+                detail = detail.and_then(|row| row.with_secondary_value(label));
+            }
+            result = result.with_display_detail(detail);
+        }
+    }
+    if let Some(first) = usage
+        .budgets
+        .iter()
+        .find(|budget| budget.scope.id.is_empty())
+    {
+        let mut models = first
+            .models
+            .iter()
+            .filter_map(|model| {
+                let name = optional_text(model, "model")
+                    .ok()
+                    .flatten()
+                    .unwrap_or_else(|| "Model".into());
+                let provider = optional_text(model, "provider").ok().flatten();
+                let cost = optional_number(model, "total_cost").ok().flatten();
+                let tokens = optional_number(model, "total_tokens").ok().flatten();
+                (cost.unwrap_or(0.0) != 0.0 || tokens.unwrap_or(0.0) != 0.0)
+                    .then_some((name, provider, cost, tokens))
+            })
+            .collect::<Vec<_>>();
+        models.sort_by(|a, b| {
+            b.2.unwrap_or(0.0)
+                .total_cmp(&a.2.unwrap_or(0.0))
+                .then_with(|| b.3.unwrap_or(0.0).total_cmp(&a.3.unwrap_or(0.0)))
+                .then_with(|| a.0.cmp(&b.0))
+        });
+        for (index, (name, provider, cost, tokens)) in models.iter().take(5).enumerate() {
+            let label = bounded(
+                &[provider.as_deref(), Some(name.as_str())]
+                    .into_iter()
+                    .flatten()
+                    .collect::<Vec<_>>()
+                    .join(" · "),
+            );
+            let value = cost.map(usd).unwrap_or_else(|| "—".into());
+            let mut detail =
+                ProviderDisplayDetail::new(format!("bifrost-model-{index}"), label, value);
+            if let Some(tokens) = tokens {
+                detail = detail.and_then(|row| {
+                    row.with_secondary_value(format!("{} tokens", format_count(*tokens)))
+                });
+            }
+            result = result.with_display_detail(detail);
+        }
+        if models.len() > 5 {
+            result = result.with_display_detail(ProviderDisplayDetail::new(
+                "bifrost-model-other",
+                "Other models",
+                (models.len() - 5).to_string(),
+            ));
+        }
+    }
+    result
+}
+
+fn budget_description(budget: &Budget) -> String {
+    let mut parts = Vec::new();
+    if let Some(source) = &budget.source {
+        parts.push(bounded(&source.chars().take(24).collect::<String>()));
+    }
+    if let Some(label) = budget.reset.label {
+        parts.push(label.into());
+    }
+    parts.push(format!("{} / {}", usd(budget.used), usd(budget.limit)));
+    bounded(&parts.join(" · "))
+}
+
+fn reset_timing(reset: Option<&str>, last_reset: Option<&str>, now: DateTime<Utc>) -> ResetTiming {
+    let seconds = reset.and_then(parse_duration);
+    let fixed =
+        reset.is_some_and(|raw| !matches!(raw.chars().last(), Some('d' | 'w' | 'M' | 'Q' | 'Y')));
+    let resets_at = if fixed {
+        let start = last_reset
+            .and_then(|v| DateTime::parse_from_rfc3339(v).ok())
+            .map(|v| v.with_timezone(&Utc));
+        match (start, seconds) {
+            (Some(start), Some(seconds)) => Duration::try_from_secs_f64(seconds)
+                .ok()
+                .and_then(|period| chrono::TimeDelta::from_std(period).ok())
+                .and_then(|period| {
+                    let period_ms = period.num_milliseconds();
+                    if period_ms <= 0 {
+                        return None;
+                    }
+                    let elapsed_ms = (now - start).num_milliseconds().max(0);
+                    let periods = elapsed_ms.checked_div(period_ms)?.checked_add(1)?;
+                    let delta_ms = period_ms.checked_mul(periods)?;
+                    chrono::TimeDelta::try_milliseconds(delta_ms)
+                        .and_then(|delta| start.checked_add_signed(delta))
+                }),
+            _ => None,
+        }
+    } else {
+        None
+    };
+    let label = match reset {
+        None => None,
+        Some(raw) => match raw {
+            "1h" => Some("Hourly"),
+            "1d" => Some("Daily"),
+            "1w" => Some("Weekly"),
+            "1M" => Some("Monthly"),
+            "1Q" => Some("Quarterly"),
+            "1Y" => Some("Yearly"),
+            _ => None,
+        },
+    };
+    let minutes = seconds
+        .and_then(|value| Duration::try_from_secs_f64(value).ok())
+        .map(|duration| duration.as_secs() / 60)
+        .and_then(|minutes| u32::try_from(minutes).ok())
+        .filter(|minutes| *minutes > 0);
+    ResetTiming {
+        seconds,
+        window_minutes: (fixed).then_some(minutes).flatten(),
+        resets_at,
+        label,
+    }
+}
+
+fn parse_duration(raw: &str) -> Option<f64> {
+    let raw = raw.trim();
+    let extended = raw
+        .strip_suffix('Y')
+        .map(|n| (n, 31_536_000.0))
+        .or_else(|| raw.strip_suffix('Q').map(|n| (n, 7_776_000.0)))
+        .or_else(|| raw.strip_suffix('M').map(|n| (n, 2_592_000.0)))
+        .or_else(|| raw.strip_suffix('w').map(|n| (n, 604_800.0)))
+        .or_else(|| raw.strip_suffix('d').map(|n| (n, 86_400.0)));
+    if let Some((amount, multiplier)) = extended {
+        let seconds = amount.parse::<f64>().ok()? * multiplier;
+        return (seconds.is_finite() && seconds > 0.0).then_some(seconds);
+    }
+
+    let mut rest = raw;
+    let mut total = 0.0;
+    while !rest.is_empty() {
+        let number_end = rest
+            .find(|ch: char| !ch.is_ascii_digit() && ch != '.')
+            .unwrap_or(rest.len());
+        if number_end == 0 {
+            return None;
+        }
+        let amount = rest[..number_end].parse::<f64>().ok()?;
+        if !amount.is_finite() {
+            return None;
+        }
+        rest = &rest[number_end..];
+        let (unit, multiplier) = [
+            ("ms", 0.001),
+            ("us", 0.000_001),
+            ("µs", 0.000_001),
+            ("μs", 0.000_001),
+            ("ns", 0.000_000_001),
+            ("s", 1.0),
+            ("m", 60.0),
+            ("h", 3_600.0),
+        ]
+        .into_iter()
+        .find(|(unit, _)| rest.starts_with(unit))?;
+        total += amount * multiplier;
+        if !total.is_finite() {
+            return None;
+        }
+        rest = &rest[unit.len()..];
+    }
+    (total > 0.0).then_some(total)
+}
+
+fn quota_url_for_test(raw: &str) -> Result<Url, ProviderError> {
+    quota_url(raw)
+}
+
+fn object<'a>(
+    value: &'a Value,
+    name: &str,
+) -> Result<&'a serde_json::Map<String, Value>, ProviderError> {
+    value
+        .as_object()
+        .ok_or_else(|| parse_error(&format!("{name} must be an object")))
+}
+
+fn array<'a>(value: &'a Value, name: &str) -> Result<&'a [Value], ProviderError> {
+    match value {
+        Value::Null => Ok(&[]),
+        Value::Array(values) => Ok(values),
+        _ => Err(parse_error(&format!("{name} must be an array"))),
+    }
+}
+
+fn optional_text(value: &Value, key: &str) -> Result<Option<String>, ProviderError> {
+    match value.get(key) {
+        None | Some(Value::Null) => Ok(None),
+        Some(Value::String(value)) => {
+            Ok((!value.trim().is_empty()).then(|| value.trim().to_owned()))
+        }
+        _ => Err(parse_error(&format!("{key} must be a string"))),
+    }
+}
+
+fn optional_number(value: &Value, key: &str) -> Result<Option<f64>, ProviderError> {
+    match value.get(key) {
+        None | Some(Value::Null) => Ok(None),
+        Some(value) => value
+            .as_f64()
+            .filter(|value| value.is_finite())
+            .map(Some)
+            .ok_or_else(|| parse_error(&format!("{key} must be a finite number"))),
+    }
+}
+
+fn optional_bool(value: &Value, key: &str) -> Result<Option<bool>, ProviderError> {
+    match value.get(key) {
+        None | Some(Value::Null) => Ok(None),
+        Some(value) => value
+            .as_bool()
+            .map(Some)
+            .ok_or_else(|| parse_error(&format!("{key} must be a boolean"))),
+    }
+}
+
+fn percent(used: f64, limit: f64) -> f64 {
+    if used.is_finite() && limit.is_finite() && limit > 0.0 {
+        (used / limit * 100.0).clamp(0.0, 100.0)
+    } else {
+        0.0
+    }
+}
+
+fn usd(value: f64) -> String {
+    format!("${value:.2}")
+}
+fn bounded(value: &str) -> String {
+    value.chars().take(120).collect()
+}
+fn format_count(value: f64) -> String {
+    if value.fract() == 0.0 && value.abs() <= i64::MAX as f64 {
+        format!("{value:.0}")
+    } else {
+        format!("{value:.2}")
+    }
+}
+fn parse_error(reason: &str) -> ProviderError {
+    ProviderError::Parse(format!(
+        "Bifrost returned an unrecognized quota response ({reason})."
+    ))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::json;
+    use tokio::{
+        io::{AsyncReadExt, AsyncWriteExt},
+        net::TcpListener,
+        time::timeout,
+    };
+
+    fn now() -> DateTime<Utc> {
+        DateTime::parse_from_rfc3339("2026-01-01T00:00:00Z")
+            .unwrap()
+            .with_timezone(&Utc)
+    }
+
+    #[test]
+    fn component_rate_limits_take_precedence_over_aggregate_compatibility_field() {
+        let value = json!({
+            "rate_limit": { "token_max_limit": 900, "token_current_usage": 450, "token_reset_duration": "1h" },
+            "rate_limits": [
+                { "source_name": "provider-a", "token_max_limit": 100, "token_current_usage": 25, "token_reset_duration": "1h" },
+                { "source_name": "provider-b", "request_max_limit": 20, "request_current_usage": 5, "request_reset_duration": "1d" }
+            ]
+        });
+        let parsed = parse_usage(&value, now()).unwrap();
+        assert_eq!(parsed.limits.len(), 2);
+        assert_eq!(parsed.limits[0].1["token_max_limit"], 100);
+        assert_eq!(parsed.limits[1].1["request_max_limit"], 20);
+        assert!(
+            !parsed
+                .limits
+                .iter()
+                .any(|(_, limit, _)| limit["token_max_limit"] == 900)
+        );
+    }
+
+    #[test]
+    fn aggregate_rate_limit_is_fallback_when_components_are_absent() {
+        let parsed = parse_usage(&json!({
+            "rate_limit": { "token_max_limit": 50, "token_current_usage": 10, "token_reset_duration": "1h" }
+        }), now()).unwrap();
+        assert_eq!(parsed.limits.len(), 1);
+        assert_eq!(parsed.limits[0].1["token_max_limit"], 50);
+    }
+
+    #[test]
+    fn missing_current_usage_at_a_positive_rate_limit_is_known_zero() {
+        for (usage_field, id) in [
+            ("token_current_usage", "bifrost-tokens-0"),
+            ("request_current_usage", "bifrost-requests-0"),
+        ] {
+            let mut limit = json!({
+                "token_max_limit": 100,
+                "token_current_usage": 25,
+                "request_max_limit": 20,
+                "request_current_usage": 5
+            });
+            limit.as_object_mut().unwrap().remove(usage_field);
+            let result =
+                result_from_usage(parse_usage(&json!({ "rate_limit": limit }), now()).unwrap());
+            let named = result
+                .usage
+                .extra_rate_windows
+                .iter()
+                .find(|window| window.id == id)
+                .unwrap_or_else(|| panic!("missing named rate window {id}"));
+
+            assert_eq!(named.window.used_percent, 0.0, "{usage_field}");
+            assert!(named.usage_known, "{usage_field}");
+            assert!(named.window.usage_known(), "{usage_field}");
+        }
+    }
+
+    #[test]
+    fn validates_gateway_before_request_url_is_built() {
+        assert!(
+            quota_url_for_test("https://bifrost.example.com/base/")
+                .unwrap()
+                .as_str()
+                .starts_with("https://bifrost.example.com/base/api/governance/virtual-keys/quota")
+        );
+        assert!(quota_url_for_test("http://10.1.2.3:8080").is_ok());
+        assert!(quota_url_for_test("http://bifrost.example.com").is_err());
+        assert!(quota_url_for_test("https://user:secret@bifrost.example.com").is_err());
+        assert!(quota_url_for_test("ftp://10.1.2.3").is_err());
+    }
+
+    #[tokio::test]
+    async fn rejects_public_http_before_resolving_any_credential() {
+        let provider = BifrostProvider::new();
+        let ctx = FetchContext {
+            gateway_url: Some("http://public.example.com".into()),
+            ..FetchContext::default()
+        };
+        let error = provider.fetch_api(&ctx).await.unwrap_err();
+        assert!(error.to_string().contains("must use HTTPS"));
+    }
+
+    #[tokio::test]
+    async fn does_not_forward_virtual_key_through_gateway_redirects() {
+        let redirect_target = TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let redirect_target_addr = redirect_target.local_addr().unwrap();
+        let gateway = TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let gateway_addr = gateway.local_addr().unwrap();
+        let gateway_task = tokio::spawn(async move {
+            let (mut stream, _) = gateway.accept().await.unwrap();
+            let mut request = vec![0; 4096];
+            let read = stream.read(&mut request).await.unwrap();
+            let request = String::from_utf8_lossy(&request[..read]).to_ascii_lowercase();
+            assert!(request.contains("x-bf-vk: test-virtual-key"));
+            let response = format!(
+                "HTTP/1.1 302 Found\r\nLocation: http://{redirect_target_addr}/redirected\r\nContent-Length: 0\r\nConnection: close\r\n\r\n"
+            );
+            stream.write_all(response.as_bytes()).await.unwrap();
+        });
+        let redirect_target_task = tokio::spawn(async move {
+            timeout(Duration::from_millis(250), redirect_target.accept()).await
+        });
+
+        let provider = BifrostProvider::new();
+        let ctx = FetchContext {
+            gateway_url: Some(format!("http://{gateway_addr}")),
+            api_key: Some("test-virtual-key".into()),
+            ..FetchContext::default()
+        };
+        let error = provider.fetch_api(&ctx).await.unwrap_err();
+        assert!(error.to_string().contains("HTTP 302"));
+        gateway_task.await.unwrap();
+        assert!(redirect_target_task.await.unwrap().is_err());
+    }
+
+    #[test]
+    fn parses_fixed_reset_and_calendar_label_without_inventing_calendar_time() {
+        let fixed = reset_timing(Some("1h"), Some("2025-12-31T23:30:00Z"), now());
+        assert_eq!(fixed.window_minutes, Some(60));
+        assert_eq!(
+            fixed.resets_at.unwrap().to_rfc3339(),
+            "2026-01-01T00:30:00+00:00"
+        );
+        let calendar = reset_timing(Some("1M"), Some("2025-12-01T00:00:00Z"), now());
+        assert_eq!(calendar.label, Some("Monthly"));
+        assert_eq!(calendar.resets_at, None);
+        assert_eq!(calendar.window_minutes, None);
+        assert_eq!(parse_duration("1h30m"), Some(5_400.0));
+    }
+
+    #[test]
+    fn budgets_and_overrides_are_mapped_to_percent_and_spend() {
+        let parsed = parse_usage(
+            &json!({
+                "virtual_key_name": "Build key",
+                "budgets": [{ "id": "b1", "max_limit": 10, "current_usage": 5,
+                    "override_amount": 5, "override_mode": "forever", "source_name": "Team" }]
+            }),
+            now(),
+        )
+        .unwrap();
+        let result = result_from_usage(parsed);
+        assert!((result.usage.primary.used_percent - (100.0 / 3.0)).abs() < 0.001);
+        assert_eq!(result.cost.unwrap().limit, Some(15.0));
+    }
+
+    #[test]
+    fn shortest_root_budget_is_primary_and_cost_without_summing_budgets() {
+        let parsed = parse_usage(
+            &json!({
+                "budgets": [
+                    { "id": "monthly", "max_limit": 1_000, "current_usage": 200,
+                        "reset_duration": "1M" },
+                    { "id": "daily", "max_limit": 100, "current_usage": 10,
+                        "reset_duration": "1d" }
+                ]
+            }),
+            now(),
+        )
+        .unwrap();
+        let result = result_from_usage(parsed);
+
+        assert_eq!(result.usage.primary.used_percent, 10.0);
+        assert_eq!(
+            result.usage.primary.reset_description.as_deref(),
+            Some("Daily · $10.00 / $100.00")
+        );
+        let secondary = result.usage.secondary.as_ref().unwrap();
+        assert_eq!(secondary.used_percent, 20.0);
+        assert_eq!(
+            secondary.reset_description.as_deref(),
+            Some("Monthly · $200.00 / $1000.00")
+        );
+
+        let cost = result.cost.unwrap();
+        assert_eq!(cost.used, 10.0);
+        assert_eq!(cost.limit, Some(100.0));
+        assert_eq!(cost.period, "Daily");
+    }
+
+    #[test]
+    fn malformed_optional_scope_collection_fails_closed() {
+        assert!(parse_usage(&json!({ "provider_configs": {} }), now()).is_err());
+    }
+}
diff --git a/rust/src/providers/format.rs b/rust/src/providers/format.rs
new file mode 100644
index 0000000000..864027f0bf
--- /dev/null
+++ b/rust/src/providers/format.rs
@@ -0,0 +1,175 @@
+//! Display formatting shared by ports of upstream plugin providers.
+//!
+//! These mirror the helpers in the upstream provider plugin prelude
+//! (`ctx.format.number`, `ctx.format.usd`) and JavaScript's
+//! `Number.prototype.toFixed`, so ported rows render the same strings.
+
+/// `ctx.format.number(value, { maximumFractionDigits })`: fixed to
+/// `max_fraction_digits`, trailing fractional zeros trimmed, and the integer
+/// part grouped with commas.
+pub(crate) fn number(value: f64, max_fraction_digits: usize) -> String {
+    format_number(value, 0, max_fraction_digits)
+}
+
+/// `ctx.format.usd(value)`: a dollar amount with exactly two fractional
+/// digits, grouped, and the sign before the dollar sign.
+pub(crate) fn usd(value: f64) -> String {
+    let sign = if value < 0.0 { "-$" } else { "$" };
+    format!("{sign}{}", format_number(value.abs(), 2, 2))
+}
+
+/// JavaScript `Number.prototype.toFixed(digits)`.
+///
+/// Rust's formatter rounds an exact binary tie to even; JavaScript picks the
+/// larger magnitude. Magnitudes of 1e21 or more use JavaScript's exponent
+/// notation, as `toFixed` does.
+pub(crate) fn to_fixed(value: f64, digits: usize) -> String {
+    if !value.is_finite() {
+        return js_string(value);
+    }
+    let sign = if value < 0.0 { "-" } else { "" };
+    let magnitude = value.abs();
+    if magnitude >= 1e21 {
+        return format!("{sign}{}", js_string(magnitude));
+    }
+    // An exact tie is a dyadic fraction whose expansion ends at digit
+    // `digits + 1`. Any other double that can round at `digits` lies at least
+    // 1e-16 of its own magnitude away from the tie, so forty extra digits
+    // never print a near-tie as "5000...".
+    let probe = format!("{:.*}", digits + 40, magnitude);
+    let tail = probe
+        .split_once('.')
+        .and_then(|(_, fraction)| fraction.get(digits..))
+        .unwrap_or("");
+    let tie = tail.starts_with('5') && tail[1..].bytes().all(|byte| byte == b'0');
+    let magnitude = if tie { magnitude.next_up() } else { magnitude };
+    format!("{sign}{magnitude:.digits$}")
+}
+
+/// The prelude's `formatNumber`: `toFixed(max)` of the magnitude, trailing
+/// zeros trimmed down to `min` fractional digits, digit groups of three.
+fn format_number(value: f64, min_fraction_digits: usize, max_fraction_digits: usize) -> String {
+    if !value.is_finite() {
+        return js_string(value);
+    }
+    let fixed = to_fixed(value.abs(), max_fraction_digits);
+    let (integer, fraction) = fixed.split_once('.').unwrap_or((fixed.as_str(), ""));
+    let mut fraction = fraction;
+    while fraction.len() > min_fraction_digits && fraction.ends_with('0') {
+        fraction = &fraction[..fraction.len() - 1];
+    }
+    let sign = if value < 0.0 { "-" } else { "" };
+    let integer = group_thousands(integer);
+    if fraction.is_empty() {
+        format!("{sign}{integer}")
+    } else {
+        format!("{sign}{integer}.{fraction}")
+    }
+}
+
+/// Groups a run of ASCII digits with commas. Anything else (JavaScript's
+/// exponent form) is returned unchanged, as the prelude's regex does.
+fn group_thousands(integer: &str) -> String {
+    if integer.is_empty() || !integer.bytes().all(|byte| byte.is_ascii_digit()) {
+        return integer.to_string();
+    }
+    let mut grouped = String::with_capacity(integer.len() + integer.len() / 3);
+    for (index, digit) in integer.chars().enumerate() {
+        if index > 0 && (integer.len() - index).is_multiple_of(3) {
+            grouped.push(',');
+        }
+        grouped.push(digit);
+    }
+    grouped
+}
+
+/// JavaScript `String(number)` for the values `toFixed` passes through:
+/// non-finite values and magnitudes of 1e21 or more.
+fn js_string(value: f64) -> String {
+    if value.is_nan() {
+        return "NaN".to_string();
+    }
+    if value.is_infinite() {
+        return if value > 0.0 { "Infinity" } else { "-Infinity" }.to_string();
+    }
+    // Both languages print the shortest round-trip digits; JavaScript also
+    // signs a positive exponent.
+    let exponent = format!("{value:e}");
+    match exponent.split_once('e') {
+        Some((mantissa, power)) if !power.starts_with('-') => format!("{mantissa}e+{power}"),
+        _ => exponent,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{number, to_fixed, usd};
+
+    #[test]
+    fn to_fixed_rounds_exact_ties_away_from_zero_like_javascript() {
+        for (value, digits, expected) in [
+            (0.5, 0, "1"),
+            (1.5, 0, "2"),
+            (2.5, 0, "3"),
+            (0.125, 2, "0.13"),
+            (0.375, 2, "0.38"),
+            (-2.5, 0, "-3"),
+            (1.005, 2, "1.00"),
+            (1.0049999, 2, "1.00"),
+            (12.5, 0, "13"),
+            (9.95, 1, "9.9"),
+            (0.0, 2, "0.00"),
+            (-0.0, 1, "0.0"),
+            (123.456, 0, "123"),
+        ] {
+            assert_eq!(to_fixed(value, digits), expected, "{value} to {digits}");
+        }
+    }
+
+    #[test]
+    fn to_fixed_switches_to_exponent_notation_at_1e21() {
+        assert_eq!(to_fixed(1e21, 2), "1e+21");
+        assert_eq!(to_fixed(1.5e25, 0), "1.5e+25");
+        assert_eq!(to_fixed(-1e21, 0), "-1e+21");
+        assert_eq!(
+            to_fixed(999_999_999_999_999_900_000.0, 0),
+            "999999999999999868928"
+        );
+        assert_eq!(to_fixed(f64::NAN, 2), "NaN");
+        assert_eq!(to_fixed(f64::INFINITY, 2), "Infinity");
+    }
+
+    #[test]
+    fn number_trims_zeros_and_groups_thousands_like_the_plugin_prelude() {
+        for (value, digits, expected) in [
+            (0.0, 2, "0"),
+            (12.0, 2, "12"),
+            (18.5, 2, "18.5"),
+            (42.5, 2, "42.5"),
+            (12_500.0, 2, "12,500"),
+            (400_000.0, 2, "400,000"),
+            (1_234_567.891, 2, "1,234,567.89"),
+            (12_500.125, 2, "12,500.13"),
+            (999.999, 2, "1,000"),
+            (100.0, 0, "100"),
+            (1_000.0, 0, "1,000"),
+            (-1_234.5, 2, "-1,234.5"),
+            (-0.001, 2, "-0"),
+            (0.1 + 0.2, 2, "0.3"),
+        ] {
+            assert_eq!(number(value, digits), expected, "{value} to {digits}");
+        }
+        assert_eq!(number(f64::NAN, 2), "NaN");
+        assert_eq!(number(f64::NEG_INFINITY, 2), "-Infinity");
+        assert_eq!(number(1e21, 2), "1e+21");
+    }
+
+    #[test]
+    fn usd_keeps_two_digits_groups_and_signs_before_the_dollar() {
+        assert_eq!(usd(0.0), "$0.00");
+        assert_eq!(usd(1_234.5), "$1,234.50");
+        assert_eq!(usd(12.345), "$12.35");
+        assert_eq!(usd(-1.0), "-$1.00");
+        assert_eq!(usd(1_000_000.0), "$1,000,000.00");
+    }
+}
diff --git a/rust/src/providers/gitkraken/mod.rs b/rust/src/providers/gitkraken/mod.rs
new file mode 100644
index 0000000000..5ff37f765d
--- /dev/null
+++ b/rust/src/providers/gitkraken/mod.rs
@@ -0,0 +1,615 @@
+//! GitKraken AI usage provider.
+//!
+//! The API returns personal credits and, when an organization is selected,
+//! its shared-pool total. Shared usage is a slice of that total and is only
+//! exposed as display detail; it must not be added to personal usage.
+
+use async_trait::async_trait;
+use chrono::{DateTime, Utc};
+use reqwest::StatusCode;
+use serde_json::Value;
+use std::time::Duration;
+
+use crate::core::{
+    FetchContext, Provider, ProviderDisplayDetail, ProviderError, ProviderFetchResult, ProviderId,
+    ProviderMetadata, RateWindow, SourceMode, UsageSnapshot,
+};
+use crate::providers::{BoundedBodyError, read_bounded_response};
+
+const USAGE_URL: &str = "https://api.gitkraken.dev/v1/ai-tasks/usage";
+const CREDENTIAL_TARGET: &str = "codexbar-gitkraken";
+const TOKEN_ENV: &str = "GITKRAKEN_API_TOKEN";
+const ORGANIZATION_ENV: &str = "GITKRAKEN_ORG_ID";
+const REQUEST_TIMEOUT: Duration = Duration::from_secs(15);
+const MAX_RESPONSE_BYTES: usize = 64 * 1024;
+const WEEKLY_WINDOW_MINUTES: u32 = 10_080;
+
+#[derive(Debug, Clone, Copy, PartialEq)]
+struct Quota {
+    used: f64,
+    limit: f64,
+}
+
+#[derive(Debug, Clone, PartialEq)]
+struct GitKrakenUsage {
+    personal: Quota,
+    organization: Option<Quota>,
+    shared_used: Option<f64>,
+    resets_at: DateTime<Utc>,
+}
+
+/// GitKraken AI provider.
+pub struct GitKrakenProvider {
+    metadata: ProviderMetadata,
+}
+
+impl GitKrakenProvider {
+    pub fn new() -> Self {
+        Self {
+            metadata: ProviderMetadata {
+                id: ProviderId::GitKraken,
+                display_name: "GitKraken AI",
+                session_label: "Personal",
+                weekly_label: "Shared pool",
+                supports_opus: false,
+                supports_credits: false,
+                default_enabled: false,
+                is_primary: false,
+                dashboard_url: Some("https://gitkraken.dev/account#ai-usage"),
+                status_page_url: None,
+                tertiary_label_key: None,
+            },
+        }
+    }
+
+    async fn fetch(&self, ctx: &FetchContext) -> Result<ProviderFetchResult, ProviderError> {
+        self.fetch_from(ctx, USAGE_URL).await
+    }
+
+    async fn fetch_from(
+        &self,
+        ctx: &FetchContext,
+        usage_url: &str,
+    ) -> Result<ProviderFetchResult, ProviderError> {
+        let token = resolve_token(ctx.api_key.as_deref())?;
+        let organization = resolve_organization(ctx.workspace_id.as_deref())?;
+        let client = crate::core::credentialed_http_client_builder()
+            .timeout(REQUEST_TIMEOUT)
+            .build()
+            .map_err(|error| {
+                ProviderError::Other(format!("Could not create GitKraken client: {error}"))
+            })?;
+
+        let mut request = client
+            .get(usage_url)
+            .bearer_auth(token)
+            .header("Client-Name", "CodexBar")
+            .header("Client-Version", env!("CARGO_PKG_VERSION"))
+            .header("User-Agent", "CodexBar");
+        if let Some(organization) = organization.as_deref() {
+            request = request.header("gk-org-id", organization);
+        }
+
+        let response = request.send().await?;
+        let status = response.status();
+        if status != StatusCode::OK {
+            return Err(status_error(status));
+        }
+
+        let body = read_bounded_response(response, MAX_RESPONSE_BYTES)
+            .await
+            .map_err(|error| match error {
+                BoundedBodyError::TooLarge => parse_failure("response exceeded the size limit"),
+                BoundedBodyError::Read(error) => ProviderError::Network(error),
+            })?;
+        let body = std::str::from_utf8(&body)
+            .map_err(|_| parse_failure("response was not valid UTF-8"))?;
+        let value: Value =
+            serde_json::from_str(body).map_err(|_| parse_failure("response was not valid JSON"))?;
+        let usage = parse_usage(&value)?;
+
+        Ok(result_from_usage(usage))
+    }
+}
+
+impl Default for GitKrakenProvider {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+#[async_trait]
+impl Provider for GitKrakenProvider {
+    fn id(&self) -> ProviderId {
+        ProviderId::GitKraken
+    }
+
+    fn metadata(&self) -> &ProviderMetadata {
+        &self.metadata
+    }
+
+    async fn fetch_usage(&self, ctx: &FetchContext) -> Result<ProviderFetchResult, ProviderError> {
+        match ctx.source_mode {
+            SourceMode::Auto | SourceMode::OAuth => self.fetch(ctx).await,
+            source => Err(ProviderError::UnsupportedSource(source)),
+        }
+    }
+
+    fn available_sources(&self) -> Vec<SourceMode> {
+        vec![SourceMode::Auto, SourceMode::OAuth]
+    }
+}
+
+fn resolve_token(configured: Option<&str>) -> Result<String, ProviderError> {
+    let keyring_token = keyring::Entry::new(CREDENTIAL_TARGET, "api_token")
+        .ok()
+        .and_then(|entry| entry.get_password().ok());
+    let token = configured
+        .filter(|token| !token.trim().is_empty())
+        .map(str::to_string)
+        .or(keyring_token)
+        .or_else(|| std::env::var(TOKEN_ENV).ok())
+        .unwrap_or_default();
+    let token = token.trim();
+    if token.is_empty() {
+        return Err(ProviderError::NotInstalled(format!(
+            "Set a GitKraken access token in Settings or {TOKEN_ENV}."
+        )));
+    }
+    if token.len() > 16_384 || !token.bytes().all(|byte| (0x21..=0x7e).contains(&byte)) {
+        return Err(ProviderError::AuthRequired);
+    }
+    Ok(token.to_string())
+}
+
+fn resolve_organization(configured: Option<&str>) -> Result<Option<String>, ProviderError> {
+    let organization = configured
+        .map(str::to_string)
+        .or_else(|| std::env::var(ORGANIZATION_ENV).ok())
+        .unwrap_or_default();
+    let organization = organization.trim();
+    if organization.is_empty() {
+        return Ok(None);
+    }
+    if organization.len() > 256
+        || !organization
+            .bytes()
+            .all(|byte| (0x21..=0x7e).contains(&byte))
+    {
+        return Err(ProviderError::Other(
+            "Invalid GitKraken organization ID. Enter a single ID without whitespace.".into(),
+        ));
+    }
+    Ok(Some(organization.to_string()))
+}
+
+fn status_error(status: StatusCode) -> ProviderError {
+    match status {
+        StatusCode::UNAUTHORIZED => ProviderError::AuthRequired,
+        StatusCode::FORBIDDEN => {
+            ProviderError::Other("GitKraken denied access to this account or organization.".into())
+        }
+        StatusCode::TOO_MANY_REQUESTS => {
+            ProviderError::Other("GitKraken rate limited usage requests.".into())
+        }
+        status if status.is_server_error() => {
+            ProviderError::Other("GitKraken usage is temporarily unavailable.".into())
+        }
+        _ => ProviderError::Other(format!("GitKraken returned HTTP {status}.")),
+    }
+}
+
+fn parse_usage(body: &Value) -> Result<GitKrakenUsage, ProviderError> {
+    let data = body
+        .get("data")
+        .and_then(Value::as_object)
+        .ok_or_else(|| parse_failure("missing data object"))?;
+    if body.get("error").is_some_and(|error| !error.is_null()) {
+        return Err(parse_failure("API returned an error envelope"));
+    }
+
+    let personal = parse_quota(&Value::Object(data.clone()))
+        .ok_or_else(|| parse_failure("invalid personal quota"))?;
+    let resets_at = data
+        .get("resetsOn")
+        .and_then(Value::as_str)
+        .and_then(|value| DateTime::parse_from_rfc3339(value).ok())
+        .map(|value| value.with_timezone(&Utc))
+        .ok_or_else(|| parse_failure("invalid reset timestamp"))?;
+
+    // Upstream deliberately ignores a malformed optional organization quota
+    // without discarding the valid personal quota.
+    let organization = data.get("organization").and_then(parse_quota);
+    let shared_used = data
+        .get("sharedUsed")
+        .and_then(Value::as_f64)
+        .filter(|value| value.is_finite() && *value >= 0.0)
+        .filter(|value| organization.is_some_and(|pool| *value <= pool.used));
+
+    Ok(GitKrakenUsage {
+        personal,
+        organization,
+        shared_used,
+        resets_at,
+    })
+}
+
+fn parse_quota(value: &Value) -> Option<Quota> {
+    let object = value.as_object()?;
+    let used = object.get("used")?.as_f64()?;
+    let limit = object.get("limit")?.as_f64()?;
+    (used.is_finite()
+        && used >= 0.0
+        && limit.is_finite()
+        && (limit >= 0.0 || limit == -1.0)
+        && (limit <= 0.0 || ((used / limit) * 100.0).is_finite()))
+    .then_some(Quota { used, limit })
+}
+
+fn result_from_usage(usage: GitKrakenUsage) -> ProviderFetchResult {
+    let personal = usage.personal;
+    let primary = rate_window(personal, usage.resets_at)
+        .unwrap_or_else(|| RateWindow::informational(quota_description(personal)));
+    let mut snapshot = UsageSnapshot::new(primary)
+        .with_primary_label("Personal")
+        .with_login_method("API");
+    if let Some(pool) = usage.organization
+        && let Some(window) = rate_window(pool, usage.resets_at)
+    {
+        snapshot = snapshot
+            .with_secondary(window)
+            .with_secondary_label("Shared pool");
+    }
+
+    let mut result = ProviderFetchResult::new(snapshot, "api").with_display_detail(
+        ProviderDisplayDetail::new("personal-credits", "Personal", quota_description(personal)),
+    );
+    if let Some(pool) = usage.organization {
+        result = result.with_display_detail(ProviderDisplayDetail::new(
+            "shared-pool-credits",
+            "Shared pool",
+            quota_description(pool),
+        ));
+        if let Some(shared_used) = usage.shared_used {
+            result = result
+                .with_display_detail(ProviderDisplayDetail::new(
+                    "your-shared-usage",
+                    "Your shared usage",
+                    format!("{} credits", format_number(shared_used)),
+                ))
+                .with_display_detail(ProviderDisplayDetail::new(
+                    "organization-rest-usage",
+                    "Rest of organization",
+                    format!("{} credits", format_number(pool.used - shared_used)),
+                ));
+        }
+    }
+    if personal.limit <= 0.0 && usage.organization.is_none_or(|pool| pool.limit <= 0.0) {
+        result = result.with_display_detail(ProviderDisplayDetail::new(
+            "reset",
+            "Reset",
+            usage.resets_at.to_rfc3339(),
+        ));
+    }
+    result
+}
+
+fn rate_window(quota: Quota, resets_at: DateTime<Utc>) -> Option<RateWindow> {
+    (quota.limit > 0.0).then(|| {
+        RateWindow::with_details(
+            (quota.used / quota.limit) * 100.0,
+            Some(WEEKLY_WINDOW_MINUTES),
+            Some(resets_at),
+            None,
+        )
+    })
+}
+
+fn quota_description(quota: Quota) -> String {
+    if quota.limit <= 0.0 {
+        format!(
+            "{} credits used · {}",
+            format_number(quota.used),
+            if quota.limit == -1.0 {
+                "Unlimited"
+            } else {
+                "No allowance"
+            }
+        )
+    } else {
+        format!(
+            "{} / {} credits used",
+            format_number(quota.used),
+            format_number(quota.limit)
+        )
+    }
+}
+
+fn format_number(value: f64) -> String {
+    let rounded = if value.abs() <= f64::MAX / 100.0 {
+        (value * 100.0).round() / 100.0
+    } else {
+        value
+    };
+    let fixed = format!("{rounded:.2}");
+    let trimmed = fixed.trim_end_matches('0').trim_end_matches('.');
+    let (integer, fraction) = trimmed.split_once('.').unwrap_or((trimmed, ""));
+    let mut grouped = String::with_capacity(trimmed.len() + integer.len() / 3);
+    for (index, digit) in integer.chars().enumerate() {
+        if index > 0 && (integer.len() - index) % 3 == 0 {
+            grouped.push(',');
+        }
+        grouped.push(digit);
+    }
+    if !fraction.is_empty() {
+        grouped.push('.');
+        grouped.push_str(fraction);
+    }
+    grouped
+}
+
+fn parse_failure(reason: &str) -> ProviderError {
+    ProviderError::Parse(format!(
+        "GitKraken returned an unrecognized usage response ({reason})."
+    ))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::json;
+    use tokio::{
+        io::{AsyncReadExt, AsyncWriteExt},
+        net::TcpListener,
+    };
+
+    fn response(personal_limit: Value, organization: Value, shared_used: Value) -> Value {
+        json!({
+            "data": {
+                "used": 12_500,
+                "limit": personal_limit,
+                "resetsOn": "2026-09-27T00:00:00Z",
+                "organization": organization,
+                "sharedUsed": shared_used,
+            },
+            "error": null,
+        })
+    }
+
+    async fn assert_request_headers(organization: Option<&str>) {
+        let expected_organization = organization.map(str::to_owned);
+        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let address = listener.local_addr().unwrap();
+        let server = tokio::spawn(async move {
+            let (mut stream, _) = listener.accept().await.unwrap();
+            let mut request = Vec::new();
+            let mut chunk = [0; 1024];
+            loop {
+                let read = stream.read(&mut chunk).await.unwrap();
+                assert_ne!(read, 0, "client closed before sending HTTP headers");
+                request.extend_from_slice(&chunk[..read]);
+                if request.windows(4).any(|window| window == b"\r\n\r\n") {
+                    break;
+                }
+            }
+            let request = String::from_utf8(request).unwrap().to_ascii_lowercase();
+            assert!(request.contains("authorization: bearer fixture-token\r\n"));
+            match expected_organization.as_deref() {
+                Some(organization) => assert!(request.contains(&format!(
+                    "gk-org-id: {}\r\n",
+                    organization.to_ascii_lowercase()
+                ))),
+                None => assert!(!request.contains("gk-org-id:")),
+            }
+
+            let body =
+                r#"{"data":{"used":1,"limit":10,"resetsOn":"2026-09-27T00:00:00Z"},"error":null}"#;
+            let response = format!(
+                "HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{}",
+                body.len(),
+                body
+            );
+            stream.write_all(response.as_bytes()).await.unwrap();
+        });
+
+        let ctx = FetchContext {
+            api_key: Some("fixture-token".into()),
+            workspace_id: Some(organization.unwrap_or("").into()),
+            ..FetchContext::default()
+        };
+        GitKrakenProvider::new()
+            .fetch_from(&ctx, &format!("http://{address}/usage"))
+            .await
+            .unwrap();
+        server.await.unwrap();
+    }
+
+    #[tokio::test]
+    async fn sends_bearer_token_and_optional_organization_header() {
+        assert_request_headers(Some("org-fixture")).await;
+        assert_request_headers(None).await;
+    }
+
+    #[test]
+    fn parses_personal_and_organization_weekly_quotas_with_shared_usage_as_display_only() {
+        let usage = parse_usage(&response(
+            json!(400_000),
+            json!({ "used": 20_000, "limit": 100_000 }),
+            json!(5_000),
+        ))
+        .unwrap();
+        assert_eq!(
+            usage.personal,
+            Quota {
+                used: 12_500.0,
+                limit: 400_000.0
+            }
+        );
+        assert_eq!(
+            usage.organization,
+            Some(Quota {
+                used: 20_000.0,
+                limit: 100_000.0
+            })
+        );
+        assert_eq!(usage.shared_used, Some(5_000.0));
+        assert_eq!(
+            usage.resets_at,
+            DateTime::parse_from_rfc3339("2026-09-27T00:00:00Z")
+                .unwrap()
+                .with_timezone(&Utc)
+        );
+
+        let result = result_from_usage(usage);
+        // Personal usage stays at 12,500 credits (3.125%); the shared slice
+        // is display detail and must never be added to personal usage.
+        assert_eq!(result.usage.primary.used_percent, 3.125);
+        assert_eq!(
+            result.usage.primary.window_minutes,
+            Some(WEEKLY_WINDOW_MINUTES)
+        );
+        assert_eq!(result.usage.secondary.as_ref().unwrap().used_percent, 20.0);
+        assert_eq!(
+            result
+                .display_details()
+                .iter()
+                .map(ProviderDisplayDetail::value)
+                .collect::<Vec<_>>(),
+            [
+                "12,500 / 400,000 credits used",
+                "20,000 / 100,000 credits used",
+                "5,000 credits",
+                "15,000 credits",
+            ]
+        );
+    }
+
+    #[test]
+    fn malformed_optional_organization_does_not_discard_personal_usage() {
+        for organization in [json!(null), json!({}), json!({"used":-1,"limit":100})] {
+            let usage = parse_usage(&response(json!(400_000), organization, json!(1))).unwrap();
+            assert_eq!(usage.personal.used, 12_500.0);
+            assert!(usage.organization.is_none());
+            assert!(usage.shared_used.is_none());
+        }
+    }
+
+    #[test]
+    fn invalid_shared_slice_is_ignored_without_changing_pool_total() {
+        for shared_used in [
+            json!(null),
+            json!(true),
+            json!("5"),
+            json!(-1),
+            json!(20_001),
+        ] {
+            let usage = parse_usage(&response(
+                json!(400_000),
+                json!({"used":20_000,"limit":100_000}),
+                shared_used,
+            ))
+            .unwrap();
+            assert_eq!(usage.organization.unwrap().used, 20_000.0);
+            assert!(usage.shared_used.is_none());
+        }
+    }
+
+    #[test]
+    fn zero_and_unlimited_limits_are_informational_not_fake_percentages() {
+        for (limit, expected) in [(json!(0), "No allowance"), (json!(-1), "Unlimited")] {
+            let usage = parse_usage(&response(limit, json!(null), json!(null))).unwrap();
+            let result = result_from_usage(usage);
+            assert!(result.usage.primary.is_informational);
+            assert_eq!(result.usage.primary.used_percent, 0.0);
+            assert_eq!(
+                result.display_details()[0].value(),
+                format!("12,500 credits used · {expected}")
+            );
+            assert_eq!(result.display_details().last().unwrap().title(), "Reset");
+        }
+    }
+
+    #[test]
+    fn malformed_required_personal_quota_or_reset_fails_closed() {
+        let invalid = [
+            json!({"data":{"limit":10,"resetsOn":"2026-09-27T00:00:00Z"}}),
+            json!({"data":{"used":true,"limit":10,"resetsOn":"2026-09-27T00:00:00Z"}}),
+            json!({"data":{"used":-1,"limit":10,"resetsOn":"2026-09-27T00:00:00Z"}}),
+            json!({"data":{"used":1,"limit":-0.5,"resetsOn":"2026-09-27T00:00:00Z"}}),
+            json!({"data":{"used":1,"limit":10,"resetsOn":"2026-09-27"}}),
+            json!({"data":{"used":1,"limit":10,"resetsOn":null}}),
+            json!({"error":"failure","data":{"used":1,"limit":10,"resetsOn":"2026-09-27T00:00:00Z"}}),
+        ];
+        for value in invalid {
+            assert!(matches!(parse_usage(&value), Err(ProviderError::Parse(_))));
+        }
+    }
+
+    #[test]
+    fn validates_configured_token_and_organization_values() {
+        assert_eq!(
+            resolve_token(Some(" fixture-token ")).unwrap(),
+            "fixture-token"
+        );
+        assert!(matches!(
+            resolve_token(Some("bad token")),
+            Err(ProviderError::AuthRequired)
+        ));
+        assert!(matches!(
+            resolve_token(Some("bad\ntoken")),
+            Err(ProviderError::AuthRequired)
+        ));
+        assert!(matches!(
+            resolve_token(Some(&"x".repeat(16_385))),
+            Err(ProviderError::AuthRequired)
+        ));
+
+        assert_eq!(
+            resolve_organization(Some(" org-fixture ")).unwrap(),
+            Some("org-fixture".into())
+        );
+        assert_eq!(resolve_organization(Some("  ")).unwrap(), None);
+        assert!(matches!(
+            resolve_organization(Some("org id")),
+            Err(ProviderError::Other(_))
+        ));
+        assert!(matches!(
+            resolve_organization(Some("org\nid")),
+            Err(ProviderError::Other(_))
+        ));
+        assert!(matches!(
+            resolve_organization(Some(&"x".repeat(257))),
+            Err(ProviderError::Other(_))
+        ));
+    }
+
+    #[test]
+    fn response_statuses_match_upstream_error_classes_without_reading_private_bodies() {
+        assert!(matches!(
+            status_error(StatusCode::UNAUTHORIZED),
+            ProviderError::AuthRequired
+        ));
+        assert!(matches!(
+            status_error(StatusCode::FORBIDDEN),
+            ProviderError::Other(_)
+        ));
+        assert!(matches!(
+            status_error(StatusCode::TOO_MANY_REQUESTS),
+            ProviderError::Other(_)
+        ));
+        assert!(matches!(
+            status_error(StatusCode::SERVICE_UNAVAILABLE),
+            ProviderError::Other(_)
+        ));
+        assert!(matches!(
+            status_error(StatusCode::NOT_FOUND),
+            ProviderError::Other(_)
+        ));
+    }
+
+    #[test]
+    fn formats_counts_with_at_most_two_fractional_digits() {
+        assert_eq!(format_number(12_500.0), "12,500");
+        assert_eq!(format_number(12_500.125), "12,500.13");
+    }
+}
diff --git a/rust/src/providers/hyper/mod.rs b/rust/src/providers/hyper/mod.rs
new file mode 100644
index 0000000000..21da830112
--- /dev/null
+++ b/rust/src/providers/hyper/mod.rs
@@ -0,0 +1,344 @@
+//! Charm Hyper Hypercredit balance provider.
+//!
+//! Port of upstream `hyper.ts` (v0.65.0). Unless browser cookies are off, a
+//! hyper.charm.land session is tried first. Auto falls back to the API key
+//! when no session cookie exists, the session request cannot connect, or the
+//! session is rejected; Web fails closed instead. Every other response is
+//! final: malformed balances, rate limits and server errors never fall back.
+
+use async_trait::async_trait;
+use reqwest::{
+    Client, StatusCode,
+    header::{ACCEPT, CONTENT_TYPE, COOKIE},
+    redirect::Policy,
+};
+use std::time::Duration;
+
+use crate::core::{
+    FetchContext, Provider, ProviderDisplayDetail, ProviderError, ProviderFetchResult, ProviderId,
+    ProviderMetadata, ProviderStateKind, RateWindow, SourceMode, UsageSnapshot,
+};
+use crate::providers::{BoundedBodyError, format, read_bounded_response};
+
+const CREDITS_URL: &str = "https://hyper.charm.land/v1/credits";
+const COOKIE_DOMAIN: &str = "hyper.charm.land";
+const CREDENTIAL_TARGET: &str = "codexbar-hyper";
+const API_KEY_ENV: &[&str] = &["HYPER_API_KEY"];
+const MAX_RESPONSE_BYTES: usize = 512 * 1024;
+const SESSION_TIMEOUT: Duration = Duration::from_secs(5);
+const API_TIMEOUT: Duration = Duration::from_secs(10);
+
+const MISSING_CREDENTIAL: &str = "Sign in to hyper.charm.land or configure a Charm Hyper API key.";
+const SESSION_REQUEST_FAILED: &str = "Charm Hyper session request failed.";
+const SESSION_EXPIRED: &str =
+    "Charm Hyper session expired. Sign in again or paste a fresh Cookie header.";
+const API_KEY_REJECTED: &str = "Charm Hyper API key rejected (HTTP 401).";
+const API_KEY_FORBIDDEN: &str = "Charm Hyper API key cannot access credits (HTTP 403).";
+const RATE_LIMITED: &str = "Charm Hyper credits requests are rate limited.";
+const INVALID_JSON: &str = "Charm Hyper credits response is not valid JSON.";
+const INVALID_BALANCE: &str = "Charm Hyper balance must be a non-negative number.";
+
+pub struct HyperProvider {
+    metadata: ProviderMetadata,
+    client: Client,
+    credits_url: String,
+}
+
+/// Which credential a `/v1/credits` request carries. Upstream never sends
+/// the cookie and the bearer key together.
+enum Credential<'a> {
+    Session(&'a str),
+    ApiKey(&'a str),
+}
+
+/// A `/v1/credits` reply. Upstream reads the body as part of the request, so
+/// an unreadable success body counts as a failed request; other bodies are
+/// never shown and are not read.
+struct CreditsReply {
+    status: StatusCode,
+    is_html: bool,
+    body: Vec<u8>,
+}
+
+impl CreditsReply {
+    /// Upstream treats auth failures, redirects and an HTML sign-in page as an
+    /// expired session.
+    fn is_rejected_session(&self) -> bool {
+        self.status == StatusCode::UNAUTHORIZED
+            || self.status == StatusCode::FORBIDDEN
+            || self.status.is_redirection()
+            || (self.status == StatusCode::OK && self.is_html)
+    }
+}
+
+impl HyperProvider {
+    pub fn new() -> Self {
+        let client = crate::core::credentialed_http_client_builder()
+            .redirect(Policy::none())
+            .timeout(API_TIMEOUT)
+            .build()
+            .expect("Charm Hyper HTTP client configuration is valid");
+        Self::with_client(CREDITS_URL, client)
+    }
+
+    fn with_client(credits_url: impl Into<String>, client: Client) -> Self {
+        Self {
+            metadata: ProviderMetadata {
+                id: ProviderId::Hyper,
+                display_name: "Charm Hyper",
+                session_label: "Balance",
+                weekly_label: "Balance",
+                supports_opus: false,
+                supports_credits: false,
+                default_enabled: false,
+                is_primary: false,
+                dashboard_url: Some("https://hyper.charm.land"),
+                status_page_url: None,
+                tertiary_label_key: None,
+            },
+            client,
+            credits_url: credits_url.into(),
+        }
+    }
+
+    async fn request(&self, credential: Credential<'_>) -> Result<CreditsReply, ProviderError> {
+        let request = self
+            .client
+            .get(&self.credits_url)
+            .header(ACCEPT, "application/json");
+        let request = match credential {
+            Credential::Session(cookie) => request.header(COOKIE, cookie).timeout(SESSION_TIMEOUT),
+            Credential::ApiKey(key) => request.bearer_auth(key).timeout(API_TIMEOUT),
+        };
+        let response = request.send().await?;
+        let status = response.status();
+        let is_html = response
+            .headers()
+            .get(CONTENT_TYPE)
+            .and_then(|value| value.to_str().ok())
+            .is_some_and(|value| value.to_ascii_lowercase().contains("text/html"));
+        let body = if status == StatusCode::OK && !is_html {
+            read_bounded_response(response, MAX_RESPONSE_BYTES)
+                .await
+                .map_err(|error| match error {
+                    BoundedBodyError::Read(error) => ProviderError::Network(error),
+                    BoundedBodyError::TooLarge => ProviderError::Parse(format!(
+                        "Charm Hyper response exceeded {MAX_RESPONSE_BYTES} bytes."
+                    )),
+                })?
+        } else {
+            Vec::new()
+        };
+        Ok(CreditsReply {
+            status,
+            is_html,
+            body,
+        })
+    }
+
+    /// Runs upstream's session-then-key flow with an already resolved key.
+    async fn fetch_with_key(
+        &self,
+        ctx: &FetchContext,
+        key: Option<&str>,
+    ) -> Result<ProviderFetchResult, ProviderError> {
+        if ctx.source_mode == SourceMode::Cli {
+            return Err(ProviderError::UnsupportedSource(SourceMode::Cli));
+        }
+        // Web never falls back, so a configured key is irrelevant there.
+        let fallback_key = match ctx.source_mode {
+            SourceMode::Web => None,
+            _ => key.and_then(cleaned_key),
+        };
+
+        let mut session_reply = None;
+        // Upstream turns browser cookies off for the API source.
+        if ctx.source_mode != SourceMode::OAuth {
+            match session_cookie(ctx) {
+                Some(cookie) => match self.request(Credential::Session(&cookie)).await {
+                    Ok(reply) => session_reply = Some(reply),
+                    Err(error) if fallback_key.is_none() => {
+                        tracing::debug!(%error, "Charm Hyper session request failed");
+                        return Err(ProviderError::Other(SESSION_REQUEST_FAILED.into()));
+                    }
+                    Err(error) => {
+                        tracing::debug!(%error, "Charm Hyper session request failed; trying the API key");
+                    }
+                },
+                None if fallback_key.is_none() => return Err(missing_credential()),
+                None => {}
+            }
+            if session_reply
+                .as_ref()
+                .is_some_and(CreditsReply::is_rejected_session)
+            {
+                // Upstream also drops its cached browser cookie here. This
+                // port keeps no cookie cache, so the next refresh reads the
+                // browser again.
+                if fallback_key.is_none() {
+                    return Err(ProviderError::Other(SESSION_EXPIRED.into()));
+                }
+                tracing::debug!("Charm Hyper session was rejected; trying the API key");
+                session_reply = None;
+            }
+        }
+
+        let (reply, session) = match session_reply {
+            Some(reply) => (reply, true),
+            None => {
+                let Some(key) = fallback_key else {
+                    return Err(missing_credential());
+                };
+                (self.request(Credential::ApiKey(key)).await?, false)
+            }
+        };
+        if reply.status != StatusCode::OK {
+            return Err(status_error(reply.status));
+        }
+        let balance = parse_balance(&reply.body)?;
+        Ok(balance_result(balance, session))
+    }
+}
+
+impl Default for HyperProvider {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+#[async_trait]
+impl Provider for HyperProvider {
+    fn id(&self) -> ProviderId {
+        ProviderId::Hyper
+    }
+
+    fn metadata(&self) -> &ProviderMetadata {
+        &self.metadata
+    }
+
+    async fn fetch_usage(&self, ctx: &FetchContext) -> Result<ProviderFetchResult, ProviderError> {
+        // This repository's SourceMode::OAuth is the documented API-key lane
+        // for non-OAuth providers; upstream calls this source "api". Web never
+        // uses the key, so it is not read there.
+        let key = match ctx.source_mode {
+            SourceMode::Auto | SourceMode::OAuth => crate::providers::resolve_api_key(
+                ctx.api_key.as_deref(),
+                CREDENTIAL_TARGET,
+                API_KEY_ENV,
+            )
+            .ok(),
+            SourceMode::Web | SourceMode::Cli => None,
+        };
+        self.fetch_with_key(ctx, key.as_deref()).await
+    }
+
+    fn available_sources(&self) -> Vec<SourceMode> {
+        vec![SourceMode::Auto, SourceMode::Web, SourceMode::OAuth]
+    }
+
+    fn supports_web(&self) -> bool {
+        true
+    }
+
+    fn cookie_source_scopes_session_only(&self) -> bool {
+        true
+    }
+
+    /// The API source must not read browser cookies (upstream turns them off
+    /// there), so the provider imports the session only when it will use it.
+    fn owns_browser_cookie_resolution(&self) -> bool {
+        true
+    }
+
+    fn error_state_kind(&self, error: &ProviderError) -> ProviderStateKind {
+        match error {
+            // Upstream classifies both as `authenticationExpired`.
+            ProviderError::Other(message)
+                if message == SESSION_EXPIRED || message == API_KEY_REJECTED =>
+            {
+                ProviderStateKind::ExpiredSession
+            }
+            _ => error.state_kind(),
+        }
+    }
+}
+
+/// The session cookie upstream's browser broker would hand out: a manual or
+/// shell-resolved header first, nothing when the cookie source is off or an
+/// empty manual source, otherwise the browser's hyper.charm.land session.
+fn session_cookie(ctx: &FetchContext) -> Option<String> {
+    if let Some(header) = ctx.manual_cookie_header.as_deref() {
+        return crate::providers::normalize_cookie_header(header);
+    }
+    if ctx.manual_cookie_missing {
+        return None;
+    }
+    match crate::providers::browser_cookie_header(&[COOKIE_DOMAIN]) {
+        Ok(header) => crate::providers::normalize_cookie_header(&header),
+        Err(error) => {
+            tracing::debug!(%error, "Charm Hyper browser session is unavailable");
+            None
+        }
+    }
+}
+
+/// Upstream's `SettingsValue.cleaned`: trimmed, one pair of wrapping quotes
+/// removed, trimmed again, and blank keys treated as absent.
+fn cleaned_key(raw: &str) -> Option<&str> {
+    let value = raw.trim();
+    let quoted = (value.starts_with('"') && value.ends_with('"'))
+        || (value.starts_with('\'') && value.ends_with('\''));
+    let value = if quoted {
+        value.get(1..value.len() - 1).unwrap_or_default()
+    } else {
+        value
+    };
+    let value = value.trim();
+    (!value.is_empty()).then_some(value)
+}
+
+fn status_error(status: StatusCode) -> ProviderError {
+    match status {
+        StatusCode::UNAUTHORIZED => ProviderError::Other(API_KEY_REJECTED.into()),
+        StatusCode::FORBIDDEN => ProviderError::Other(API_KEY_FORBIDDEN.into()),
+        StatusCode::TOO_MANY_REQUESTS => ProviderError::Other(RATE_LIMITED.into()),
+        status => ProviderError::Other(format!("Charm Hyper API error: HTTP {}", status.as_u16())),
+    }
+}
+
+/// Upstream parses any JSON document and requires a finite, non-negative
+/// numeric `balance`. serde_json rejects out-of-range numbers such as
+/// `1e400` while parsing, so those report invalid JSON; upstream reaches the
+/// balance check with `Infinity`. Both are parse failures without fallback.
+fn parse_balance(body: &[u8]) -> Result<f64, ProviderError> {
+    let payload: serde_json::Value =
+        serde_json::from_slice(body).map_err(|_| ProviderError::Parse(INVALID_JSON.into()))?;
+    payload
+        .get("balance")
+        .and_then(serde_json::Value::as_f64)
+        .filter(|balance| balance.is_finite() && *balance >= 0.0)
+        .ok_or_else(|| ProviderError::Parse(INVALID_BALANCE.into()))
+}
+
+fn balance_result(balance: f64, session: bool) -> ProviderFetchResult {
+    let detail = ProviderDisplayDetail::new(
+        "hypercredits",
+        "Hypercredits",
+        format!("{} HC", format::number(balance, 2)),
+    );
+    let (source, login_method) = if session {
+        ("web", "Browser session")
+    } else {
+        ("api", "API key")
+    };
+    let usage = UsageSnapshot::new(RateWindow::informational("Hypercredit balance"))
+        .with_login_method(login_method);
+    ProviderFetchResult::new(usage, source).with_display_detail(detail)
+}
+
+fn missing_credential() -> ProviderError {
+    ProviderError::NotInstalled(MISSING_CREDENTIAL.into())
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/rust/src/providers/hyper/tests.rs b/rust/src/providers/hyper/tests.rs
new file mode 100644
index 0000000000..5ad8667b88
--- /dev/null
+++ b/rust/src/providers/hyper/tests.rs
@@ -0,0 +1,566 @@
+//! Translations of upstream `HyperPluginTests` (v0.65.0). Every test passes
+//! the key to `fetch_with_key` (or an explicit `api_key`) and a manual or
+//! missing cookie, so no test reads the keyring or a real browser.
+
+use super::*;
+use mockito::{Matcher, Mock, Server, ServerGuard};
+
+const KEY: &str = "fixture-key";
+const BALANCE_BODY: &str = r#"{"balance":42.5}"#;
+
+fn test_provider(base_url: &str) -> HyperProvider {
+    let client = Client::builder()
+        .redirect(Policy::none())
+        .timeout(API_TIMEOUT)
+        .build()
+        .unwrap();
+    HyperProvider::with_client(format!("{base_url}/v1/credits"), client)
+}
+
+/// `cookie: None` is the shell's off / empty-manual cookie source.
+fn context(source_mode: SourceMode, cookie: Option<&str>) -> FetchContext {
+    FetchContext {
+        source_mode,
+        manual_cookie_header: cookie.map(str::to_string),
+        manual_cookie_missing: cookie.is_none(),
+        ..FetchContext::default()
+    }
+}
+
+/// A session request: only the cookie, never a bearer key.
+async fn session_mock(
+    server: &mut ServerGuard,
+    cookie: &str,
+    status: usize,
+    html: bool,
+    hits: usize,
+) -> Mock {
+    let (content_type, body) = if html {
+        ("text/html; charset=utf-8", "<html>Log in</html>")
+    } else {
+        ("application/json", BALANCE_BODY)
+    };
+    server
+        .mock("GET", "/v1/credits")
+        .match_header("accept", "application/json")
+        .match_header("cookie", cookie)
+        .match_header("authorization", Matcher::Missing)
+        .with_status(status)
+        .with_header("content-type", content_type)
+        .with_body(body)
+        .expect(hits)
+        .create_async()
+        .await
+}
+
+/// An API-key request: only the bearer key, never a cookie.
+async fn api_mock(server: &mut ServerGuard, status: usize, body: &str, hits: usize) -> Mock {
+    server
+        .mock("GET", "/v1/credits")
+        .match_header("accept", "application/json")
+        .match_header("authorization", format!("Bearer {KEY}").as_str())
+        .match_header("cookie", Matcher::Missing)
+        .with_status(status)
+        .with_header("content-type", "application/json")
+        .with_body(body)
+        .expect(hits)
+        .create_async()
+        .await
+}
+
+/// Fails the test if the provider sends any request at all.
+async fn no_request_mock(server: &mut ServerGuard) -> Mock {
+    server
+        .mock("GET", Matcher::Any)
+        .expect(0)
+        .create_async()
+        .await
+}
+
+fn closed_port_url() -> String {
+    let listener = std::net::TcpListener::bind("127.0.0.1:0").unwrap();
+    let address = listener.local_addr().unwrap();
+    drop(listener);
+    format!("http://{address}")
+}
+
+fn message(error: &ProviderError) -> String {
+    error.to_string()
+}
+
+#[tokio::test]
+async fn balance_fixtures_render_native_hc_without_fabricated_limits() {
+    for (body, expected) in [
+        (r#"{"balance":0}"#, "0 HC"),
+        (r#"{"balance":12}"#, "12 HC"),
+        (r#"{"balance":18.5}"#, "18.5 HC"),
+        (r#"{"balance":42.5}"#, "42.5 HC"),
+    ] {
+        let mut server = Server::new_async().await;
+        let api = api_mock(&mut server, 200, body, 1).await;
+        let provider = test_provider(&server.url());
+
+        let result = provider
+            .fetch_with_key(&context(SourceMode::Auto, None), Some(KEY))
+            .await
+            .unwrap();
+
+        api.assert_async().await;
+        assert_eq!(result.source_label, "api");
+        assert_eq!(result.usage.login_method.as_deref(), Some("API key"));
+        assert!(result.usage.primary.is_informational);
+        assert!(result.usage.secondary.is_none());
+        assert!(result.cost.is_none());
+        let details = result.display_details();
+        assert_eq!(details.len(), 1);
+        assert_eq!(details[0].title(), "Hypercredits");
+        assert_eq!(details[0].value(), expected);
+    }
+}
+
+#[tokio::test]
+async fn fetch_usage_uses_the_configured_api_key_for_the_api_source() {
+    let mut server = Server::new_async().await;
+    let api = api_mock(&mut server, 200, BALANCE_BODY, 1).await;
+    let provider = test_provider(&server.url());
+    let ctx = FetchContext {
+        api_key: Some(format!(" '{KEY}' ")),
+        ..context(SourceMode::OAuth, None)
+    };
+
+    let result = provider.fetch_usage(&ctx).await.unwrap();
+
+    api.assert_async().await;
+    assert_eq!(result.display_details()[0].value(), "42.5 HC");
+    assert_eq!(result.usage.login_method.as_deref(), Some("API key"));
+}
+
+#[tokio::test]
+async fn session_wins_over_key_and_sends_only_cookies() {
+    let mut server = Server::new_async().await;
+    let session = session_mock(&mut server, "session=fixture-session", 200, false, 1).await;
+    let api = api_mock(&mut server, 200, BALANCE_BODY, 0).await;
+    let provider = test_provider(&server.url());
+
+    let result = provider
+        .fetch_with_key(
+            &context(SourceMode::Auto, Some("session=fixture-session")),
+            Some(KEY),
+        )
+        .await
+        .unwrap();
+
+    session.assert_async().await;
+    api.assert_async().await;
+    assert_eq!(result.source_label, "web");
+    assert_eq!(
+        result.usage.login_method.as_deref(),
+        Some("Browser session")
+    );
+    assert_eq!(result.display_details()[0].value(), "42.5 HC");
+}
+
+#[tokio::test]
+async fn api_source_bypasses_the_session_cookie() {
+    let mut server = Server::new_async().await;
+    let session = session_mock(&mut server, "session=unused", 200, false, 0).await;
+    let api = api_mock(&mut server, 200, BALANCE_BODY, 1).await;
+    let provider = test_provider(&server.url());
+
+    let result = provider
+        .fetch_with_key(
+            &context(SourceMode::OAuth, Some("session=unused")),
+            Some(KEY),
+        )
+        .await
+        .unwrap();
+
+    session.assert_async().await;
+    api.assert_async().await;
+    assert_eq!(result.usage.login_method.as_deref(), Some("API key"));
+}
+
+#[tokio::test]
+async fn missing_session_falls_back_to_key() {
+    // An empty manual cookie and an off / empty-manual cookie source both
+    // leave Auto without a session.
+    for ctx in [
+        context(SourceMode::Auto, None),
+        context(SourceMode::Auto, Some("  ")),
+    ] {
+        let mut server = Server::new_async().await;
+        let api = api_mock(&mut server, 200, BALANCE_BODY, 1).await;
+        let provider = test_provider(&server.url());
+
+        let result = provider.fetch_with_key(&ctx, Some(KEY)).await.unwrap();
+
+        api.assert_async().await;
+        assert_eq!(result.usage.login_method.as_deref(), Some("API key"));
+    }
+}
+
+#[tokio::test]
+async fn expired_session_is_rejected_before_api_fallback() {
+    for (status, html) in [(401, false), (403, false), (302, false), (200, true)] {
+        let mut server = Server::new_async().await;
+        let session = session_mock(
+            &mut server,
+            "session=fixture-rejected-session",
+            status,
+            html,
+            1,
+        )
+        .await;
+        let api = api_mock(&mut server, 200, BALANCE_BODY, 1).await;
+        let provider = test_provider(&server.url());
+
+        let result = provider
+            .fetch_with_key(
+                &context(SourceMode::Auto, Some("session=fixture-rejected-session")),
+                Some(KEY),
+            )
+            .await
+            .unwrap();
+
+        session.assert_async().await;
+        api.assert_async().await;
+        assert_eq!(result.source_label, "api", "status {status}");
+        assert_eq!(result.usage.login_method.as_deref(), Some("API key"));
+    }
+}
+
+#[tokio::test]
+async fn web_only_never_falls_back_to_configured_key() {
+    for (status, html) in [(401, false), (403, false), (302, false), (200, true)] {
+        let mut server = Server::new_async().await;
+        let session = session_mock(
+            &mut server,
+            "session=fixture-rejected-session",
+            status,
+            html,
+            1,
+        )
+        .await;
+        let api = api_mock(&mut server, 200, BALANCE_BODY, 0).await;
+        let provider = test_provider(&server.url());
+
+        let error = provider
+            .fetch_with_key(
+                &context(SourceMode::Web, Some("session=fixture-rejected-session")),
+                Some(KEY),
+            )
+            .await
+            .unwrap_err();
+
+        session.assert_async().await;
+        api.assert_async().await;
+        assert!(
+            matches!(&error, ProviderError::Other(message) if message == SESSION_EXPIRED),
+            "status {status}: {error:?}"
+        );
+        assert_eq!(
+            provider.error_state_kind(&error),
+            ProviderStateKind::ExpiredSession
+        );
+    }
+}
+
+#[tokio::test]
+async fn rejected_session_without_a_key_reports_expired_session() {
+    let mut server = Server::new_async().await;
+    let session = session_mock(&mut server, "session=fixture", 401, false, 1).await;
+    let provider = test_provider(&server.url());
+
+    let error = provider
+        .fetch_with_key(&context(SourceMode::Auto, Some("session=fixture")), None)
+        .await
+        .unwrap_err();
+
+    session.assert_async().await;
+    assert!(matches!(&error, ProviderError::Other(message) if message == SESSION_EXPIRED));
+}
+
+#[tokio::test]
+async fn invalid_bodies_fail_closed_without_key_fallback() {
+    for body in [
+        "",
+        "{}",
+        r#"{"balance":"#,
+        r#"{"balance":-1}"#,
+        r#"{"balance":"invalid"}"#,
+        r#"{"balance":null}"#,
+        r#"{"balance":true}"#,
+        r#"{"balance":1e400}"#,
+        "null",
+        "[]",
+    ] {
+        // Without a session the key request returns the invalid body.
+        let mut server = Server::new_async().await;
+        let api = api_mock(&mut server, 200, body, 1).await;
+        let provider = test_provider(&server.url());
+        let error = provider
+            .fetch_with_key(&context(SourceMode::Auto, None), Some(KEY))
+            .await
+            .unwrap_err();
+        api.assert_async().await;
+        assert!(
+            matches!(error, ProviderError::Parse(_)),
+            "{body}: {error:?}"
+        );
+
+        // With a session the invalid session body is final.
+        let mut server = Server::new_async().await;
+        let session = server
+            .mock("GET", "/v1/credits")
+            .match_header("cookie", "session=fixture")
+            .match_header("authorization", Matcher::Missing)
+            .with_status(200)
+            .with_header("content-type", "application/json")
+            .with_body(body)
+            .create_async()
+            .await;
+        let api = api_mock(&mut server, 200, BALANCE_BODY, 0).await;
+        let provider = test_provider(&server.url());
+        let error = provider
+            .fetch_with_key(
+                &context(SourceMode::Auto, Some("session=fixture")),
+                Some(KEY),
+            )
+            .await
+            .unwrap_err();
+        session.assert_async().await;
+        api.assert_async().await;
+        assert!(
+            matches!(error, ProviderError::Parse(_)),
+            "{body}: {error:?}"
+        );
+    }
+}
+
+#[test]
+fn invalid_balances_report_the_upstream_messages() {
+    assert_eq!(
+        message(&parse_balance(b"not-json").unwrap_err()),
+        format!("Parse error: {INVALID_JSON}")
+    );
+    for body in [
+        r#"{}"#,
+        r#"{"balance":"12"}"#,
+        r#"{"balance":-1}"#,
+        r#"{"balance":null}"#,
+        "null",
+        "[]",
+    ] {
+        assert_eq!(
+            message(&parse_balance(body.as_bytes()).unwrap_err()),
+            format!("Parse error: {INVALID_BALANCE}"),
+            "{body}"
+        );
+    }
+    assert_eq!(parse_balance(br#"{"balance":0}"#).unwrap(), 0.0);
+    assert_eq!(
+        parse_balance(br#"{"balance":12500.125}"#).unwrap(),
+        12_500.125
+    );
+}
+
+#[tokio::test]
+async fn http_errors_are_classified_without_exposing_response_or_key() {
+    for (status, expected, kind) in [
+        (
+            401,
+            API_KEY_REJECTED.to_string(),
+            ProviderStateKind::ExpiredSession,
+        ),
+        (
+            403,
+            API_KEY_FORBIDDEN.to_string(),
+            ProviderStateKind::Unknown,
+        ),
+        (429, RATE_LIMITED.to_string(), ProviderStateKind::Unknown),
+        (
+            503,
+            "Charm Hyper API error: HTTP 503".to_string(),
+            ProviderStateKind::Unknown,
+        ),
+        (
+            404,
+            "Charm Hyper API error: HTTP 404".to_string(),
+            ProviderStateKind::Unknown,
+        ),
+    ] {
+        let mut server = Server::new_async().await;
+        let api = api_mock(&mut server, status, "private upstream body fixture-key", 1).await;
+        let provider = test_provider(&server.url());
+
+        let error = provider
+            .fetch_with_key(&context(SourceMode::Auto, None), Some(KEY))
+            .await
+            .unwrap_err();
+
+        api.assert_async().await;
+        let text = message(&error);
+        assert_eq!(text, expected);
+        assert!(!text.contains("private upstream body"));
+        assert!(!text.contains(KEY));
+        assert_eq!(provider.error_state_kind(&error), kind, "status {status}");
+    }
+}
+
+#[tokio::test]
+async fn session_rate_limits_and_server_errors_are_final() {
+    for (status, expected) in [
+        (429, RATE_LIMITED.to_string()),
+        (503, "Charm Hyper API error: HTTP 503".to_string()),
+    ] {
+        let mut server = Server::new_async().await;
+        let session = session_mock(&mut server, "session=fixture", status, false, 1).await;
+        let api = api_mock(&mut server, 200, BALANCE_BODY, 0).await;
+        let provider = test_provider(&server.url());
+
+        let error = provider
+            .fetch_with_key(
+                &context(SourceMode::Auto, Some("session=fixture")),
+                Some(KEY),
+            )
+            .await
+            .unwrap_err();
+
+        session.assert_async().await;
+        api.assert_async().await;
+        assert_eq!(message(&error), expected);
+    }
+}
+
+#[tokio::test]
+async fn no_credentials_produce_guidance_without_http() {
+    for (source_mode, key) in [
+        (SourceMode::Auto, None),
+        (SourceMode::Auto, Some("  ")),
+        (SourceMode::Auto, Some("''")),
+        (SourceMode::Web, Some(KEY)),
+        (SourceMode::OAuth, None),
+    ] {
+        let mut server = Server::new_async().await;
+        let none = no_request_mock(&mut server).await;
+        let provider = test_provider(&server.url());
+
+        let error = provider
+            .fetch_with_key(&context(source_mode, None), key)
+            .await
+            .unwrap_err();
+
+        none.assert_async().await;
+        assert!(
+            matches!(&error, ProviderError::NotInstalled(message) if message == MISSING_CREDENTIAL),
+            "{source_mode:?}: {error:?}"
+        );
+        let text = message(&error);
+        assert!(text.contains("Sign in"));
+        assert!(text.contains("API key"));
+        assert_eq!(
+            provider.error_state_kind(&error),
+            ProviderStateKind::NeedsAuthentication
+        );
+    }
+}
+
+#[tokio::test]
+async fn session_transport_failure_fails_closed_without_a_fallback_key() {
+    let provider = test_provider(&closed_port_url());
+    for (source_mode, key) in [(SourceMode::Web, Some(KEY)), (SourceMode::Auto, None)] {
+        let error = provider
+            .fetch_with_key(&context(source_mode, Some("session=fixture")), key)
+            .await
+            .unwrap_err();
+
+        assert!(
+            matches!(&error, ProviderError::Other(message) if message == SESSION_REQUEST_FAILED),
+            "{source_mode:?}: {error:?}"
+        );
+    }
+}
+
+#[tokio::test]
+async fn failed_session_request_falls_back_to_key_in_auto() {
+    // An oversized session body fails the session request the way upstream's
+    // response-size limit does; Auto then tries the key.
+    let mut server = Server::new_async().await;
+    let session = server
+        .mock("GET", "/v1/credits")
+        .match_header("cookie", "session=fixture")
+        .match_header("authorization", Matcher::Missing)
+        .with_status(200)
+        .with_header("content-type", "application/json")
+        .with_body(vec![b' '; MAX_RESPONSE_BYTES + 1])
+        .create_async()
+        .await;
+    let api = api_mock(&mut server, 200, BALANCE_BODY, 1).await;
+    let provider = test_provider(&server.url());
+
+    let result = provider
+        .fetch_with_key(
+            &context(SourceMode::Auto, Some("session=fixture")),
+            Some(KEY),
+        )
+        .await
+        .unwrap();
+
+    session.assert_async().await;
+    api.assert_async().await;
+    assert_eq!(result.usage.login_method.as_deref(), Some("API key"));
+}
+
+#[tokio::test]
+async fn cli_source_is_unsupported() {
+    let mut server = Server::new_async().await;
+    let none = no_request_mock(&mut server).await;
+    let provider = test_provider(&server.url());
+
+    let error = provider
+        .fetch_with_key(
+            &context(SourceMode::Cli, Some("session=fixture")),
+            Some(KEY),
+        )
+        .await
+        .unwrap_err();
+
+    none.assert_async().await;
+    assert!(matches!(
+        error,
+        ProviderError::UnsupportedSource(SourceMode::Cli)
+    ));
+}
+
+#[test]
+fn keys_are_cleaned_like_upstream_settings_values() {
+    assert_eq!(cleaned_key(" 'fixture-key' "), Some("fixture-key"));
+    assert_eq!(cleaned_key("\" fixture-key \""), Some("fixture-key"));
+    assert_eq!(cleaned_key("fixture-key"), Some("fixture-key"));
+    assert_eq!(cleaned_key("'fixture-key"), Some("'fixture-key"));
+    assert_eq!(cleaned_key("  "), None);
+    assert_eq!(cleaned_key("''"), None);
+    assert_eq!(cleaned_key("\""), None);
+}
+
+#[test]
+fn provider_capabilities_match_the_upstream_descriptor() {
+    let provider = HyperProvider::new();
+    assert_eq!(
+        provider.available_sources(),
+        vec![SourceMode::Auto, SourceMode::Web, SourceMode::OAuth]
+    );
+    assert!(provider.supports_web());
+    assert!(provider.cookie_source_scopes_session_only());
+    assert!(provider.owns_browser_cookie_resolution());
+    assert!(!provider.metadata().default_enabled);
+    assert_eq!(crate::core::brand_color(ProviderId::Hyper), "#FF60FF");
+    assert_eq!(
+        provider.error_state_kind(&ProviderError::Other(RATE_LIMITED.into())),
+        ProviderStateKind::Unknown
+    );
+    assert_eq!(
+        provider.error_state_kind(&ProviderError::Parse(INVALID_BALANCE.into())),
+        ProviderStateKind::Unknown
+    );
+}
diff --git a/rust/src/providers/mod.rs b/rust/src/providers/mod.rs
index 0b4cdc2bff..6ca919c0be 100755
--- a/rust/src/providers/mod.rs
+++ b/rust/src/providers/mod.rs
@@ -16,6 +16,7 @@ pub mod antigravity;
 pub mod augment;
 pub mod azureopenai;
 pub mod bedrock;
+pub mod bifrost;
 pub mod chart;
 pub mod chutes;
 pub mod claude;
@@ -36,11 +37,14 @@ pub mod doubao;
 pub mod elevenlabs;
 pub mod factory;
 pub mod fireworks;
+pub(crate) mod format;
 pub mod gemini;
+pub mod gitkraken;
 pub mod grok;
 pub mod groq;
 pub mod helmcode;
 pub mod huggingface;
+pub mod hyper;
 pub mod infini;
 pub mod jetbrains;
 pub mod kilo;
@@ -99,6 +103,7 @@ pub use antigravity::AntigravityProvider;
 pub use augment::AugmentProvider;
 pub use azureopenai::AzureOpenAIProvider;
 pub use bedrock::BedrockProvider;
+pub use bifrost::BifrostProvider;
 pub use chutes::ChutesProvider;
 pub use claude::ClaudeProvider;
 pub use clinepass::ClinePassProvider;
@@ -119,10 +124,12 @@ pub use elevenlabs::ElevenLabsProvider;
 pub use factory::FactoryProvider;
 pub use fireworks::FireworksProvider;
 pub use gemini::GeminiProvider;
+pub use gitkraken::GitKrakenProvider;
 pub use grok::GrokProvider;
 pub use groq::GroqProvider;
 pub use helmcode::HelmcodeProvider;
 pub use huggingface::HuggingFaceProvider;
+pub use hyper::HyperProvider;
 pub use infini::InfiniProvider;
 pub use jetbrains::JetBrainsProvider;
 pub use kilo::KiloProvider;
diff --git a/rust/src/settings.rs b/rust/src/settings.rs
index 70e18d32ad..9d3cbea356 100755
--- a/rust/src/settings.rs
+++ b/rust/src/settings.rs
@@ -945,16 +945,16 @@ impl Settings {
         self.provider_configs.entry(id).or_default()
     }
 
-    /// Cookie source for `id`. Kimi follows upstream's automatic default;
-    /// providers with no specific default retain the legacy manual default.
+    /// Cookie source for `id`. Kimi and Charm Hyper follow upstream's
+    /// automatic default; providers with no specific default retain the
+    /// legacy manual default.
     pub fn cookie_source(&self, id: ProviderId) -> &str {
         self.provider_configs
             .get(&id)
             .and_then(|c| c.cookie_source.as_deref())
-            .unwrap_or(if id == ProviderId::Kimi {
-                "auto"
-            } else {
-                DEFAULT_COOKIE_SOURCE
+            .unwrap_or(match id {
+                ProviderId::Kimi | ProviderId::Hyper => "auto",
+                _ => DEFAULT_COOKIE_SOURCE,
             })
     }
 
diff --git a/rust/src/settings/api_keys.rs b/rust/src/settings/api_keys.rs
index 9fa7544ee0..457a9b553c 100644
--- a/rust/src/settings/api_keys.rs
+++ b/rust/src/settings/api_keys.rs
@@ -619,6 +619,39 @@ pub fn get_api_key_providers() -> Vec<ProviderConfigInfo> {
             config_file_path: None,
             dashboard_url: Some("https://dev.meta.ai/docs"),
         },
+        ProviderConfigInfo {
+            id: ProviderId::Hyper,
+            name: "Charm Hyper",
+            requires_api_key: false,
+            api_key_env_var: Some("HYPER_API_KEY"),
+            api_key_help: Some(
+                "Fallback when no hyper.charm.land session is available. Save an API key here or set HYPER_API_KEY.",
+            ),
+            config_file_path: None,
+            dashboard_url: Some("https://hyper.charm.land"),
+        },
+        ProviderConfigInfo {
+            id: ProviderId::GitKraken,
+            name: "GitKraken AI",
+            requires_api_key: true,
+            api_key_env_var: Some("GITKRAKEN_API_TOKEN"),
+            api_key_help: Some(
+                "Save a GitKraken access token. Optional organization ID: provider extras or GITKRAKEN_ORG_ID.",
+            ),
+            config_file_path: None,
+            dashboard_url: Some("https://gitkraken.dev/account#ai-usage"),
+        },
+        ProviderConfigInfo {
+            id: ProviderId::Bifrost,
+            name: "Bifrost",
+            requires_api_key: true,
+            api_key_env_var: Some("BIFROST_API_KEY"),
+            api_key_help: Some(
+                "Save a Bifrost virtual key and configure the gateway base URL in provider settings. Or set BIFROST_API_KEY and BIFROST_BASE_URL.",
+            ),
+            config_file_path: None,
+            dashboard_url: None,
+        },
     ]
 }
 
diff --git a/rust/src/settings/provider_workspace.rs b/rust/src/settings/provider_workspace.rs
index 338747c8ef..965a24cfb7 100644
--- a/rust/src/settings/provider_workspace.rs
+++ b/rust/src/settings/provider_workspace.rs
@@ -40,6 +40,14 @@ pub fn validate_provider_workspace_value(
             }
             Ok(trimmed.to_string())
         }
+        ProviderId::GitKraken => {
+            if trimmed.len() > 256 || !trimmed.bytes().all(|byte| (0x21..=0x7e).contains(&byte)) {
+                return Err(
+                    "GitKraken organization ID must be a single printable identifier".to_string(),
+                );
+            }
+            Ok(trimmed.to_string())
+        }
         ProviderId::V0 => validate_id(trimmed, "v0 scope", |value| {
             value.len() <= 128
                 && value
@@ -192,6 +200,12 @@ mod tests {
             validate_provider_workspace_value(ProviderId::Devin, "https://api.devin.ai").is_err()
         );
         assert!(validate_provider_workspace_value(ProviderId::OpenCodeGo, "wrk_abc/123").is_err());
+        assert_eq!(
+            validate_provider_workspace_value(ProviderId::GitKraken, " org-123 ").unwrap(),
+            "org-123"
+        );
+        assert!(validate_provider_workspace_value(ProviderId::GitKraken, "org id").is_err());
+        assert!(validate_provider_workspace_value(ProviderId::GitKraken, "org\n123").is_err());
     }
 
     #[test]
diff --git a/rust/src/settings/tests.rs b/rust/src/settings/tests.rs
index 6ffec91c6a..facdc18d94 100644
--- a/rust/src/settings/tests.rs
+++ b/rust/src/settings/tests.rs
@@ -38,6 +38,15 @@ fn kimi_cookie_source_defaults_to_automatic_discovery() {
     assert_eq!(settings.cookie_source(ProviderId::Claude), "manual");
 }
 
+#[test]
+fn hyper_cookie_source_defaults_to_automatic_session_import() {
+    // Upstream resolves `hyperCookieSource` with an `.auto` fallback.
+    let mut settings = Settings::default();
+    assert_eq!(settings.cookie_source(ProviderId::Hyper), "auto");
+    settings.set_cookie_source(ProviderId::Hyper, "off");
+    assert_eq!(settings.cookie_source(ProviderId::Hyper), "off");
+}
+
 #[test]
 fn overview_layout_defaults_to_compact_and_round_trips() {
     let defaulted: Settings = serde_json::from_str(r#"{ "enabled_providers": [] }"#)