Port upstream 0.69.0: show Grok product usage breakdown on the grok.com billing fallback (stacked on #656)

[Finesssee]

Summary

Grok bearer and cookie logins that read usage from the grok.com GetGrokCreditsConfig gRPC-web answer now show the per-product credit breakdown (for example Grok Chat 4%, Grok Build 2%) as plain detail rows under the single weekly bar, the same presentation the credits-proxy path already has. Before this change that path published only the total, because its parser never paired the [1, 7] product ids with their percentages.

The protobuf wire reader is now one bounded shared implementation used by the billing scan, the new product decoder and the reset-coupon parser, replacing three private copies.

Upstream reference

• steipete/CodexBar PR feat(grok): decode the product breakdown on the grok.com billing path steipete/CodexBar#4041, "Grok product usage breakdown on the grok.com gRPC-web billing fallback", as shipped in v0.69.0 (GrokWebBillingFetcher.decodeProductUsage, GrokProtobufField, GrokWebBillingProductUsageTests, read at tag v0.69.0 only).

Stacking note. This PR is stacked on #656 (product usage from the credits proxy), which is stacked on #652 (credits proxy). It needs GrokProductUsage, LossyProductUsage and display_details from #656. port/upstream-0.69.0 currently points at the same commit as port/upstream-0.67.0, which does not contain that code, so the base is port/micro-0.67.0-grok-product-usage rather than port/upstream-0.69.0. Retarget after #656 lands.

Ported / Deferred

Ported:

• billing/protobuf.rs (new): bounded ProtobufField reader (varint capped at 10 bytes with overflow rejection, length-delimited values bounded by the enclosing message, unknown wire types and out-of-range field numbers malformed).
• billing/web_product_usage.rs (new): decodes repeated [1, 7] entries {1: product id varint, 2: fixed32 percent}; an omitted percent means 0; only ids 2 (GrokBuild) and 4 (GrokChat) are named; the whole list is dropped on a malformed or duplicate entry, a duplicate scalar field, or an unnamed id with a nonzero share.
• Shares are published only when the response is one complete payload, the aggregate came from the config's own [1, 1] field, and the shares compose that percent within 1.0 (compose, shared with the credits proxy).
• GrokBillingSnapshot carries product_usage; result_from_billing turns it into detail rows, so bearer (proxy-failed and period-only-proxy adoption) and cookie paths all show it. The proxy's own shares still never accompany a grok.com percent.
• gRPC-web billing framing now fails closed: a truncated frame or a frame flag other than 0 or 0x80 drops every payload instead of keeping partial ones.
• The billing scan stops at the first malformed field instead of resynchronizing byte by byte.

Deferred: none of the upstream behavior. Differences kept on purpose:

• Win-CodexBar's existing stricter percent rule is unchanged: a payload whose scan is incomplete withholds the percent as well, where upstream keeps it and only drops the breakdown. Tests for those cases assert "no breakdown, no implicit zero" and allow the percent to be either 6 or unavailable.
• A reserved-flag frame that also looks like a raw protobuf key parses to an unavailable reading rather than throwing, because Win-CodexBar reports unknown usage as informational instead of erroring.
• Product ids other than 2 and 4 are not named; none are evidenced upstream.

Validation

• cargo +1.98.0 fmt --all: clean.
• cargo +1.98.0 clippy -p codexbar --all-targets -- -D warnings: clean.
• cargo +1.98.0 clippy --workspace --all-targets -- -D warnings: the Tauri crate build script fails in this environment while reading a stale tauri plugin-permissions path from another machine-local target directory (failed to read plugin permissions ... doubao-agent-icon ... app_hide.toml). No Tauri code or bridge type changed; CI's hosted gate covers it.
• cargo +1.98.0 test -p codexbar grok -- --test-threads=4: 88 passed, 0 failed.
• cargo +1.98.0 test -p codexbar -- --test-threads=4: 2202 passed, 0 failed, 1 ignored (plus the bin target: 1 passed).
• New tests use the upstream live frame verbatim (6% split into GrokChat 4 and GrokBuild 2) and the upstream case list: unnamed ids, missing/duplicate/malformed ids, omitted percent defaults, invalid and noncomposing percents, single-payload and aggregate requirements, duplicate scalar fields, reserved frame flags, truncated frames and varint/length overflow, plus bearer (period-only proxy adoption, proxy failure fallback) and cookie result rows.

Affected areas

• rust/src/providers/grok/billing/ (mod.rs, protobuf.rs, web_product_usage.rs, reset_coupons.rs, tests)
• rust/src/providers/grok/ (credits_proxy.rs, product_usage.rs, mod.rs, tests)
• No file exceeds 1000 lines (largest: grok/mod.rs, 850).

UI proof

Not applicable. This adds rows through the existing provider detail-row pipeline; no UI code, layout, tray, settings or float-bar change.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: ea8bd629-2fb3-44bd-9e0d-89104dd7934f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Finesssee]

Adversarial validation (Claude Opus 5.5) passed at f9833f5

Reviewed the whole diff against base port/micro-0.67.0-grok-product-usage (c396d92), comparing it with upstream v0.69.0 GrokWebBillingFetcher.swift, GrokProtobufField.swift, GrokRemainingResetsFetcher.swift, GrokProviderDescriptor.swift (completing(with:)), GrokWebBillingProductUsageTests.swift and GrokProtobufFieldTests.swift.

What I checked:

• The product decoder matches upstream decodeProductUsage and decodeProductEntry: exactly one config, exactly one [1, 1], id is a varint, at most one fixed32 percent (omitted means 0), finite and non-negative, duplicate ids rejected, only ids 2 and 4 named, and an unnamed id with a nonzero share drops the list.
• Shares are published only for a single complete payload whose percent came from [1, 1], using compose, which the credits proxy also uses (tolerance 1.0).
• adopt_grpc_percent takes the grok.com shares together with the grok.com percent, which matches upstream grpcSnapshot.completing(with: proxy).
• Framing now fails closed on truncation and on flags other than 0 or 0x80, which matches upstream grpcWebDataFrames.
• The scan stops at the first malformed field, which matches upstream scanProtobuf.
• The reset-coupon refactor behaves the same as before.
• The PR adds no dependencies, no locale, bridge or frontend changes, no proof-only patches and no logging. Every file is under 1000 lines.
• The documented deviations are the same as before this PR. The stricter percent rule on incomplete scans also applies on the base commit, and reserved flag 0x81 falling back to raw protobuf behaves the same.

Checks run (from worktree W:\wcb-wt\validator):

• cargo +1.98.0 fmt --all --check: clean
• cargo +1.98.0 clippy --workspace --all-targets -- -D warnings: clean. It also passes for the Tauri crate here, so the environment failure mentioned in the PR body did not reproduce.
• cargo +1.98.0 test -p codexbar grok -- --test-threads=4: 88 passed
• cargo +1.98.0 test -p codexbar -- --test-threads=4: 2202 passed, 1 ignored
• cargo +1.98.0 test -p codexbar-desktop-tauri -- --test-threads=4: 461 passed, 1 failed. The failure is bootstrap_payload_exposes_every_provider_variant (catalog 79 vs 78). It fails the same way on the base commit c396d92. It depends on the settings of the machine running it, and this PR does not touch apps/ or ProviderId.
• Frontend: not touched, so not run.