feat(ai): add Grok Build SuperGrok subscription authentication

Allow signing in to a SuperGrok account and routing models through the official Grok Build proxy with in-app OAuth.

Author: bobleer

src/crates/adapters/ai-adapters/src/subscription_auth/grok.rs

@@ -2,7 +2,7 @@
 //!
 //! We only read the payload (no signature verification): the tokens are issued
 //! to this client by the provider and stored locally, so we simply extract
-//! metadata such as `exp`, `email`, and the ChatGPT account id.
+//! metadata such as `exp`, `email`, subject, and the ChatGPT account id.
 
 use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
 use serde_json::Value;
@@ -24,6 +24,14 @@ pub(crate) fn email(token: &str) -> Option<String> {
         .map(str::to_string)
 }
 
+/// Returns the stable `sub` claim if present.
+pub(crate) fn subject(token: &str) -> Option<String> {
+    decode_claims(token)?
+        .get("sub")?
+        .as_str()
+        .map(str::to_string)
+}
+
 /// Extracts the ChatGPT account id from a Codex id/access token, mirroring
 /// OpenCode's `extractAccountIdFromClaims`.
 pub(crate) fn chatgpt_account_id(token: &str) -> Option<String> {
@@ -62,10 +70,12 @@ mod tests {
     fn parses_email_and_account_id() {
         let token = make_token(serde_json::json!({
             "exp": 1_800_000_000i64,
+            "sub": "user_123",
             "email": "user@example.com",
             "https://api.openai.com/auth": { "chatgpt_account_id": "acct_123" }
         }));
         assert_eq!(email(&token).as_deref(), Some("user@example.com"));
+        assert_eq!(subject(&token).as_deref(), Some("user_123"));
         assert_eq!(chatgpt_account_id(&token).as_deref(), Some("acct_123"));
     }
 

src/crates/adapters/ai-adapters/src/subscription_auth/jwt.rs

@@ -1,7 +1,7 @@
 //! In-app subscription authentication.
 //!
 //! Lets BitFun sign in to another product's subscription (Codex/ChatGPT,
-//! Antigravity/Google, OpenCode) with an OpenCode-style in-app OAuth flow,
+//! Antigravity/Google, OpenCode, Grok Build/SuperGrok) with an in-app OAuth flow,
 //! and use the resulting tokens to authenticate AI requests. Secret material
 //! is stored in the operating-system credential vault; the local JSON file
 //! contains non-secret account metadata only.
@@ -10,6 +10,7 @@
 
 mod antigravity;
 mod codex;
+mod grok;
 mod jwt;
 mod oauth_server;
 mod opencode;
@@ -38,6 +39,7 @@ pub enum SubscriptionProvider {
     Codex,
     Antigravity,
     Opencode,
+    Grok,
 }
 
 /// Transport policy shared by subscription-auth requests.
@@ -61,14 +63,16 @@ impl SubscriptionHttpOptions {
 
 impl SubscriptionProvider {
     /// All providers, in display order.
-    pub const ALL: [SubscriptionProvider; 3] = [Self::Codex, Self::Antigravity, Self::Opencode];
+    pub const ALL: [SubscriptionProvider; 4] =
+        [Self::Codex, Self::Antigravity, Self::Opencode, Self::Grok];
 
     /// Stable store key / serde tag for this provider.
     pub fn key(self) -> &'static str {
         match self {
             Self::Codex => "codex",
             Self::Antigravity => "antigravity",
             Self::Opencode => "opencode",
+            Self::Grok => "grok",
         }
     }
 
@@ -78,6 +82,7 @@ impl SubscriptionProvider {
             "codex" => Some(Self::Codex),
             "antigravity" => Some(Self::Antigravity),
             "opencode" => Some(Self::Opencode),
+            "grok" => Some(Self::Grok),
             _ => None,
         }
     }
@@ -86,7 +91,8 @@ impl SubscriptionProvider {
         match self {
             Self::Codex => "Codex (ChatGPT)",
             Self::Antigravity => "Antigravity (Google)",
-            Self::Opencode => "OpenCode",
+            Self::Opencode => "OpenCode (Go/Zen)",
+            Self::Grok => "Grok Build (SuperGrok)",
         }
         .to_string()
     }
@@ -96,6 +102,7 @@ impl SubscriptionProvider {
             Self::Codex => codex::suggested(),
             Self::Antigravity => antigravity::suggested(),
             Self::Opencode => opencode::suggested(),
+            Self::Grok => grok::suggested(),
         }
     }
 }
@@ -313,10 +320,12 @@ pub(crate) fn store_lock(provider: SubscriptionProvider) -> &'static tokio::sync
     static CODEX: tokio::sync::Mutex<()> = tokio::sync::Mutex::const_new(());
     static ANTIGRAVITY: tokio::sync::Mutex<()> = tokio::sync::Mutex::const_new(());
     static OPENCODE: tokio::sync::Mutex<()> = tokio::sync::Mutex::const_new(());
+    static GROK: tokio::sync::Mutex<()> = tokio::sync::Mutex::const_new(());
     match provider {
         SubscriptionProvider::Codex => &CODEX,
         SubscriptionProvider::Antigravity => &ANTIGRAVITY,
         SubscriptionProvider::Opencode => &OPENCODE,
+        SubscriptionProvider::Grok => &GROK,
     }
 }
 
@@ -543,6 +552,9 @@ pub async fn start_login_with_options(
             SubscriptionProvider::Opencode => {
                 opencode::begin_login(begin_cancel.clone(), expected_revision, options).await
             }
+            SubscriptionProvider::Grok => {
+                grok::begin_login(begin_cancel.clone(), expected_revision, options).await
+            }
         }
     };
     let started_result = tokio::select! {
@@ -801,6 +813,7 @@ pub async fn resolve_with_options(
         SubscriptionProvider::Codex => codex::resolve(options).await,
         SubscriptionProvider::Antigravity => antigravity::resolve(options).await,
         SubscriptionProvider::Opencode => opencode::resolve(options).await,
+        SubscriptionProvider::Grok => grok::resolve(options).await,
     }
 }
 
@@ -820,6 +833,21 @@ pub async fn resolve_opencode_with_options(
     opencode::resolve_for(plan, format, options).await
 }
 
+/// Resolves a Grok Build credential for a concrete model. The adapter owns
+/// both the subscription endpoint and model-routing header so the OAuth token
+/// can never be sent to an arbitrary URL supplied by model configuration.
+pub async fn resolve_grok(model: &str) -> Result<ResolvedCredential> {
+    resolve_grok_with_options(model, &SubscriptionHttpOptions::default()).await
+}
+
+/// Resolves a Grok Build credential with an explicit transport policy.
+pub async fn resolve_grok_with_options(
+    model: &str,
+    options: &SubscriptionHttpOptions,
+) -> Result<ResolvedCredential> {
+    grok::resolve_for(model, options).await
+}
+
 /// Forces a resolve (which refreshes and saves), then returns the account entry.
 pub async fn refresh_account(provider: SubscriptionProvider) -> Result<SubscriptionAccount> {
     refresh_account_with_options(provider, &SubscriptionHttpOptions::default()).await
@@ -878,13 +906,21 @@ mod tests {
             serde_json::to_value(SubscriptionProvider::Antigravity).unwrap(),
             serde_json::json!("antigravity")
         );
+        assert_eq!(
+            serde_json::to_value(SubscriptionProvider::Grok).unwrap(),
+            serde_json::json!("grok")
+        );
         let parsed: SubscriptionProvider =
             serde_json::from_value(serde_json::json!("opencode")).unwrap();
         assert_eq!(parsed, SubscriptionProvider::Opencode);
         assert_eq!(
             SubscriptionProvider::from_key("codex"),
             Some(SubscriptionProvider::Codex)
         );
+        assert_eq!(
+            SubscriptionProvider::from_key("grok"),
+            Some(SubscriptionProvider::Grok)
+        );
         assert_eq!(SubscriptionProvider::from_key("unknown"), None);
     }
 

src/crates/adapters/ai-adapters/src/subscription_auth/mod.rs

@@ -443,6 +443,7 @@ fn to_adapter_provider(provider: SubscriptionProvider) -> AdapterProvider {
         SubscriptionProvider::Codex => AdapterProvider::Codex,
         SubscriptionProvider::Antigravity => AdapterProvider::Antigravity,
         SubscriptionProvider::Opencode => AdapterProvider::Opencode,
+        SubscriptionProvider::Grok => AdapterProvider::Grok,
     }
 }
 
@@ -522,6 +523,9 @@ pub async fn apply_subscription_auth_with_options(
                     )
                     .await
                 }
+                (SubscriptionProvider::Grok, None) => {
+                    subscription_auth::resolve_grok_with_options(&ai_config.model, options).await
+                }
                 (_, None) => {
                     subscription_auth::resolve_with_options(to_adapter_provider(*provider), options)
                         .await
@@ -570,7 +574,7 @@ pub async fn apply_subscription_auth_with_options(
     Ok(resolved.expires_at)
 }
 
-/// List subscription accounts (Codex / Antigravity / OpenCode).
+/// List subscription accounts (Codex / Antigravity / OpenCode / Grok Build).
 #[cfg(feature = "subscription-auth")]
 pub async fn list_subscription_accounts() -> Vec<subscription_auth::SubscriptionAccount> {
     subscription_auth::list_accounts().await

src/crates/assembly/core/src/infrastructure/ai/client_factory.rs

@@ -1313,6 +1313,7 @@ pub enum SubscriptionProvider {
     Codex,
     Antigravity,
     Opencode,
+    Grok,
 }
 
 /// OpenCode API product selected for a subscription-authenticated model.
@@ -1327,7 +1328,7 @@ pub enum OpenCodePlan {
 /// Where to obtain the runtime auth material for an `AIModelConfig`.
 ///
 /// Stored on disk as `{"type":"api_key"}` or
-/// `{"type":"subscription","provider":"codex"|"antigravity"|"opencode"}`.
+/// `{"type":"subscription","provider":"codex"|"antigravity"|"opencode"|"grok"}`.
 /// OpenCode models may additionally persist `"plan":"zen"|"go"`; an absent
 /// plan preserves the legacy Zen Chat Completions behavior.
 /// Tokens live in the subscription auth store and are resolved at request time.
@@ -2010,6 +2011,26 @@ mod tests {
         );
     }
 
+    #[test]
+    fn grok_subscription_auth_roundtrips_without_opencode_plan() {
+        let grok = AuthConfig::Subscription {
+            provider: SubscriptionProvider::Grok,
+            plan: None,
+        };
+        let serialized = serde_json::to_value(&grok).expect("Grok auth should serialize");
+        assert_eq!(
+            serialized,
+            serde_json::json!({
+                "type": "subscription",
+                "provider": "grok"
+            })
+        );
+        assert_eq!(
+            serde_json::from_value::<AuthConfig>(serialized).expect("Grok auth should deserialize"),
+            grok
+        );
+    }
+
     #[test]
     fn permission_request_notifications_default_to_enabled() {
         assert!(NotificationConfig::default().permission_request_notify);

src/crates/assembly/core/src/service/config/types.rs

@@ -2406,6 +2406,7 @@ const AIModelConfig: React.FC = () => {
       { value: 'api_key', label: t('subscriptionAuth.options.apiKey') },
       { value: 'subscription:codex', label: t('subscriptionAuth.options.codex') },
       { value: 'subscription:antigravity', label: t('subscriptionAuth.options.antigravity') },
+      { value: 'subscription:grok', label: t('subscriptionAuth.options.grok') },
       { value: 'subscription:opencode:zen', label: t('subscriptionAuth.options.opencodeZen') },
       { value: 'subscription:opencode:go', label: t('subscriptionAuth.options.opencodeGo') },
     ];

src/web-ui/src/infrastructure/config/components/AIModelConfig.tsx

@@ -288,7 +288,7 @@ export interface AIModelConfig {
 }
 
 /** Subscription provider for in-app OAuth auth. */
-export type SubscriptionProvider = 'codex' | 'antigravity' | 'opencode';
+export type SubscriptionProvider = 'codex' | 'antigravity' | 'opencode' | 'grok';
 
 /** OpenCode billing/API product. Both plans reuse the same signed-in account. */
 export type OpenCodePlan = 'zen' | 'go';

src/web-ui/src/infrastructure/config/types/index.ts

@@ -46,7 +46,7 @@
   },
   "subscriptionAuth": {
     "sectionTitle": "Subscription accounts",
-    "sectionDescription": "Sign in once to an OpenCode account and use either its Zen or Go API plan, alongside Codex and Antigravity",
+    "sectionDescription": "Connect Codex, Antigravity, OpenCode, or Grok Build subscriptions",
     "rescan": "Refresh status",
     "import": "Use as model",
     "login": "Sign in",
@@ -71,6 +71,7 @@
       "apiKey": "API Key",
       "codex": "Codex (ChatGPT subscription)",
       "antigravity": "Antigravity (Google subscription)",
+      "grok": "Grok Build (SuperGrok subscription)",
       "opencodeZen": "OpenCode account · Zen API",
       "opencodeGo": "OpenCode account · Go API"
     },

src/web-ui/src/locales/en-US/settings/ai-model.json

@@ -46,7 +46,7 @@
   },
   "subscriptionAuth": {
     "sectionTitle": "订阅账号",
-    "sectionDescription": "OpenCode 账号只需登录一次，即可分别使用 Zen 或 Go API 套餐；同时支持 Codex 与 Antigravity",
+    "sectionDescription": "连接 Codex、Antigravity、OpenCode 或 Grok Build 订阅",
     "rescan": "刷新状态",
     "import": "导入使用",
     "login": "登录",
@@ -71,6 +71,7 @@
       "apiKey": "API Key",
       "codex": "Codex（ChatGPT 订阅）",
       "antigravity": "Antigravity（Google 订阅）",
+      "grok": "Grok Build（SuperGrok 订阅）",
       "opencodeZen": "OpenCode 账号 · Zen API",
       "opencodeGo": "OpenCode 账号 · Go API"
     },

src/web-ui/src/locales/zh-CN/settings/ai-model.json

@@ -46,7 +46,7 @@
   },
   "subscriptionAuth": {
     "sectionTitle": "訂閱賬號",
-    "sectionDescription": "OpenCode 帳號只需登入一次，即可分別使用 Zen 或 Go API 方案；同時支援 Codex 與 Antigravity",
+    "sectionDescription": "連接 Codex、Antigravity、OpenCode 或 Grok Build 訂閱",
     "rescan": "重新整理狀態",
     "import": "匯入使用",
     "login": "登入",
@@ -71,6 +71,7 @@
       "apiKey": "API Key",
       "codex": "Codex（ChatGPT 訂閱）",
       "antigravity": "Antigravity（Google 訂閱）",
+      "grok": "Grok Build（SuperGrok 訂閱）",
       "opencodeZen": "OpenCode 帳號 · Zen API",
       "opencodeGo": "OpenCode 帳號 · Go API"
     },