a7591853eb
Document the provenance gap that prevents deriving Grok CLI usage data safely. - Record version-skewed source and sanitized billing-replay evidence - Keep absent Grok usage fields authenticated but unmeterable pending source-backed confirmation - Link the usage-provider rationale to the investigation record Files changed: .../grok-cli-usage-data-source.md | 93 ++++++++++++++++++++++ packages/dashboard/src/usage.ts | 4 +- 2 files changed, 95 insertions(+), 2 deletions(-) Fusion-Task-Id: FN-8688 Fusion-Task-Lineage: 5aafa505-968f-4f63-83db-35e623f84052 Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>
4.2 KiB
category, module, tags, problem_type, applies_when
| category | module | tags | problem_type | applies_when | |||||
|---|---|---|---|---|---|---|---|---|---|
| integration-issues | packages/dashboard/src/usage.ts |
|
upstream-provenance-mismatch | investigating a third-party CLI usage display whose installed release cannot be mapped to inspectable source |
Do not derive Grok usage from an unproven CLI source
Symptom
Fusion's Grok card was authenticated but empty because GET https://cli-chat-proxy.grok.com/v1/billing?format=credits did not provide
config.creditUsagePercent. The installed grok command documents /usage
(and alias /cost) as credit usage, but the request and arithmetic behind that
display were not available from the source trees named in the original
integration evidence.
Evidence recorded on 2026-08-01
The local command resolves to a standalone grok-0.2.118-macos-aarch64 Mach-O
binary. It was never executed or treated as source.
Two disposable, source-only retrievals were inspected without installing or executing code:
npm pack @vibe-kit/grok-cli@0.0.34supplied package version0.0.34. Its source contains no/usage,/cost, billing,creditUsagePercent,productUsage, orcli-chat-proxyreference.- A read-only shallow clone of
https://github.com/superagent-ai/grok-cli.gitatfb97af83f06dca873281d60168430f06c8de6324identifies itself asgrok-dev@1.1.7. It has no/usageor/costslash-command handler and no Grok billing-endpoint or response-field reference. No upstream tag matching0.2.118was available during the inspection.
These are version-skewed from the installed binary and cannot establish its request, response schema, or display formula. The original package/repository references therefore do not currently supply auditable source provenance for this installed CLI release.
Redacted replay of Fusion's existing request
A disposable in-memory harness read the credential locally, made only Fusion's
existing request, parsed the response in memory, sanitized every key segment,
and self-deleted. It printed status 200 and only this allow-listed shape:
config.currentPeriod.type: string=<redacted>
config.currentPeriod.start: string=<redacted>
config.currentPeriod.end: string=<redacted>
config.onDemandCap.val: number=<redacted>
config.onDemandUsed.val: number=<redacted>
config.<key1>: boolean=<redacted>
config.prepaidBalance.val: number=<redacted>
config.topUpMethod: string=<redacted>
config.billingPeriodStart: string=<redacted>
config.billingPeriodEnd: string=<redacted>
config.creditUsagePercent was absent. The generic *.val leaves remained
redacted because their names do not prove that they form credits, usage, limits,
or a valid used/total pair. No raw response body, string value, credential, or
dynamic account key was recorded.
Verdict: BLOCKED — actual CLI request and meter derivation unconfirmed
This is not a conclusion that no meter exists. The authenticated replay proves only that Fusion's current request does not expose the percentage it needs. It does not prove which request the installed CLI issues, nor support a percentage formula.
Blocked pending operator capture
Before any implementation, obtain source provenance for the installed
grok-0.2.118-macos-aarch64 release: the exact source archive or repository
commit that built it, plus its /usage//cost handler. From that source,
record the exact method, URL, query parameters, non-secret headers, response
fields, and display arithmetic.
Then an operator must replay that source-identified exact request through a
harness equivalent to the one above: read the credential in-process; never
print it or a raw body; print only HTTP status, sanitized structural paths,
allow-listed meter numbers, and redacted non-meter values. Report the
source-read fields and every numeric input to the formatter. Do not use a CLI
screen, curl, or an unsanitized proxy capture as evidence.
What FN-8668 should implement
Nothing yet. FN-8668 must remain blocked until the installed CLI's source and
harness-backed response identify meterable fields and an exact formula. In
particular, it must not infer a percentage from missing
config.creditUsagePercent or from the unclassified *.val fields.