From 9b5dd2553fc70eafae2fda48db3d91dbc3023592 Mon Sep 17 00:00:00 2001
From: NessZerra <Finesssee@users.noreply.github.com>
Date: Tue, 21 Jul 2026 10:04:14 +0700
Subject: [PATCH] feat: port deferred 0.44/0.45 providers and serve LAN auth

- Add ai& (aiand) spend-only API provider with logs pagination
- Gate codexbar serve /usage and /cost with dashboard bearer token
- Require token + --allow-plain-http for non-loopback --host
- Soft-remove Kimi K2 and CrossModel from Settings unless enabled
---
 .../src-tauri/src/commands/bridge.rs          |   7 +
 .../src/commands/provider_settings.rs         |  17 +-
 .../providers/icons/ProviderIcon-aiand.svg    |   6 +
 .../src/components/providers/providerIcons.ts |   6 +
 apps/desktop-tauri/src/surfaces/TrayPanel.tsx |   2 +-
 .../surfaces/settings/tabs/ProvidersTab.tsx   |   1 +
 .../desktop-tauri/src/test/providerCatalog.ts |   5 +-
 apps/desktop-tauri/src/types/bridge.ts        |   1 +
 rust/src/cli/serve.rs                         | 356 +++++++++++++-
 rust/src/core/credential_migration.rs         |   1 +
 rust/src/core/provider.rs                     |  65 ++-
 rust/src/core/provider_factory.rs             |  17 +-
 rust/src/core/token_accounts.rs               |  10 +
 rust/src/providers/aiand/mod.rs               | 457 ++++++++++++++++++
 rust/src/providers/mod.rs                     |   2 +
 rust/src/settings/api_keys.rs                 |   9 +
 rust/src/settings/tests.rs                    |   1 +
 17 files changed, 922 insertions(+), 41 deletions(-)
 create mode 100644 apps/desktop-tauri/src/components/providers/icons/ProviderIcon-aiand.svg
 create mode 100644 rust/src/providers/aiand/mod.rs

diff --git a/apps/desktop-tauri/src-tauri/src/commands/bridge.rs b/apps/desktop-tauri/src-tauri/src/commands/bridge.rs
index 96fa06179c..7ea4bc5078 100644
--- a/apps/desktop-tauri/src-tauri/src/commands/bridge.rs
+++ b/apps/desktop-tauri/src-tauri/src/commands/bridge.rs
@@ -557,9 +557,16 @@ impl From<Settings> for SettingsSnapshot {
 }
 
 pub(crate) fn provider_catalog_for(settings: &Settings) -> Vec<ProviderCatalogEntry> {
+    // Soft-removed providers (upstream #2254) stay hidden in Settings unless already enabled.
     settings
         .provider_display_order()
         .into_iter()
+        .filter(|provider| {
+            !provider.is_deprecated()
+                || settings
+                    .enabled_providers
+                    .contains(provider.cli_name())
+        })
         .map(|provider| ProviderCatalogEntry {
             id: provider.cli_name().to_string(),
             display_name: provider.display_name().to_string(),
diff --git a/apps/desktop-tauri/src-tauri/src/commands/provider_settings.rs b/apps/desktop-tauri/src-tauri/src/commands/provider_settings.rs
index 2661b58f0d..9e2730ddc9 100644
--- a/apps/desktop-tauri/src-tauri/src/commands/provider_settings.rs
+++ b/apps/desktop-tauri/src-tauri/src/commands/provider_settings.rs
@@ -25,11 +25,18 @@ pub(crate) fn build_provider_summaries(settings: &Settings) -> Vec<ProviderSumma
         .iter()
         .enumerate()
         .filter_map(|(idx, id)| {
-            by_id.get(id).map(|p| ProviderSummary {
-                id: id.clone(),
-                display_name: p.display_name().to_string(),
-                enabled: settings.enabled_providers.contains(id),
-                order: idx as u32,
+            by_id.get(id).and_then(|p| {
+                let enabled = settings.enabled_providers.contains(id);
+                // Soft-removed providers (upstream #2254) stay hidden unless already enabled.
+                if p.is_deprecated() && !enabled {
+                    return None;
+                }
+                Some(ProviderSummary {
+                    id: id.clone(),
+                    display_name: p.display_name().to_string(),
+                    enabled,
+                    order: idx as u32,
+                })
             })
         })
         .collect()
diff --git a/apps/desktop-tauri/src/components/providers/icons/ProviderIcon-aiand.svg b/apps/desktop-tauri/src/components/providers/icons/ProviderIcon-aiand.svg
new file mode 100644
index 0000000000..68cba8283f
--- /dev/null
+++ b/apps/desktop-tauri/src/components/providers/icons/ProviderIcon-aiand.svg
@@ -0,0 +1,6 @@
+<svg viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
+  <g fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+    <path d="M18.2 11.4c0 4.9-3.5 8.9-8.1 8.9a4.7 4.7 0 0 1-4.7-4.7c0-5.9 7.7-4.4 7.7-8.8a2.9 2.9 0 1 0-5.8 0c0 3.2 2.8 8.9 11.9 13"/>
+    <path d="M16.5 11.4h3.2"/>
+  </g>
+</svg>
diff --git a/apps/desktop-tauri/src/components/providers/providerIcons.ts b/apps/desktop-tauri/src/components/providers/providerIcons.ts
index 9c97d56bf0..3fe4974de8 100644
--- a/apps/desktop-tauri/src/components/providers/providerIcons.ts
+++ b/apps/desktop-tauri/src/components/providers/providerIcons.ts
@@ -18,6 +18,7 @@ import crossmodel from "./icons/ProviderIcon-crossmodel.svg?raw";
 import cursor from "./icons/ProviderIcon-cursor.svg?raw";
 import deepgram from "./icons/ProviderIcon-deepgram.svg?raw";
 import deepinfra from "./icons/ProviderIcon-deepinfra.svg?raw";
+import aiand from "./icons/ProviderIcon-aiand.svg?raw";
 import clinepass from "./icons/ProviderIcon-clinepass.svg?raw";
 import longcat from "./icons/ProviderIcon-longcat.svg?raw";
 import neuralwatt from "./icons/ProviderIcon-neuralwatt.svg?raw";
@@ -95,6 +96,7 @@ const RAW: Record<string, string> = {
   cursor: tint(cursor),
   deepgram: tint(deepgram),
   deepinfra: tint(deepinfra),
+  aiand: tint(aiand),
   clinepass: tint(clinepass),
   longcat: tint(longcat),
   neuralwatt: tint(neuralwatt),
@@ -150,6 +152,7 @@ export const PROVIDER_ICON_REGISTRY: Record<string, ProviderIcon> = {
   cursor:      { id: "cursor",      brandColor: "#00bfa5", fallbackLetter: "▸", svgPath: RAW.cursor },
   deepgram:    { id: "deepgram",    brandColor: "#13ef93", fallbackLetter: "D", svgPath: RAW.deepgram },
   deepinfra:   { id: "deepinfra",   brandColor: "#2a3275", fallbackLetter: "D", svgPath: RAW.deepinfra },
+  aiand:       { id: "aiand",       brandColor: "#e25c2b", fallbackLetter: "&", svgPath: RAW.aiand },
   clinepass:   { id: "clinepass",   brandColor: "#61a3fa", fallbackLetter: "C", svgPath: RAW.clinepass },
   longcat:     { id: "longcat",     brandColor: "#ffd100", fallbackLetter: "L", svgPath: RAW.longcat },
   neuralwatt:  { id: "neuralwatt",  brandColor: "#38d98c", fallbackLetter: "N", svgPath: RAW.neuralwatt },
@@ -229,6 +232,9 @@ const ALIASES: Record<string, string> = {
   "deep infra": "deepinfra",
   "deep-infra": "deepinfra",
   di: "deepinfra",
+  "ai&": "aiand",
+  "ai-and": "aiand",
+  "ai and": "aiand",
   "zen-mux": "zenmux",
   "cline-pass": "clinepass",
   "long-cat": "longcat",
diff --git a/apps/desktop-tauri/src/surfaces/TrayPanel.tsx b/apps/desktop-tauri/src/surfaces/TrayPanel.tsx
index 3b2a4b20bf..7d367e7174 100644
--- a/apps/desktop-tauri/src/surfaces/TrayPanel.tsx
+++ b/apps/desktop-tauri/src/surfaces/TrayPanel.tsx
@@ -38,7 +38,7 @@ import AgentSessions from "../components/AgentSessions";
 const HAS_DASHBOARD = new Set([
   "abacus", "alibaba", "alibabatokenplan", "amp", "augment",
   "azureopenai", "bedrock", "claude", "codex", "codebuff",
-  "commandcode", "copilot", "crof", "crossmodel", "cursor", "deepgram", "deepinfra", "deepseek", "zenmux", "clinepass", "longcat", "neuralwatt",
+  "aiand", "commandcode", "copilot", "crof", "crossmodel", "cursor", "deepgram", "deepinfra", "deepseek", "zenmux", "clinepass", "longcat", "neuralwatt",
   "doubao", "elevenlabs", "factory", "gemini", "grok", "groq",
   "infini", "jetbrains", "kilo", "kimi", "kimik2", "kiro", "manus",
   "mimo", "minimax", "mistral", "nanogpt", "ollama", "openaiapi",
diff --git a/apps/desktop-tauri/src/surfaces/settings/tabs/ProvidersTab.tsx b/apps/desktop-tauri/src/surfaces/settings/tabs/ProvidersTab.tsx
index fb030f12ec..9131b60ac5 100644
--- a/apps/desktop-tauri/src/surfaces/settings/tabs/ProvidersTab.tsx
+++ b/apps/desktop-tauri/src/surfaces/settings/tabs/ProvidersTab.tsx
@@ -230,6 +230,7 @@ function providerSourceHintShort(
     case "nanogpt":
     case "warp":
     case "deepinfra":
+    case "aiand":
     case "zenmux":
     case "clinepass":
     case "neuralwatt":
diff --git a/apps/desktop-tauri/src/test/providerCatalog.ts b/apps/desktop-tauri/src/test/providerCatalog.ts
index d158e3417c..1042ca7d37 100644
--- a/apps/desktop-tauri/src/test/providerCatalog.ts
+++ b/apps/desktop-tauri/src/test/providerCatalog.ts
@@ -13,7 +13,7 @@ export const TEST_PROVIDER_CATALOG: Array<[string, string]> = [
   ["augment", "Augment"],
   ["opencode", "OpenCode"],
   ["kimi", "Kimi"],
-  ["kimik2", "Kimi K2"],
+  ["kimik2", "Kimi K2 (removed)"],
   ["amp", "Amp"],
   ["warp", "Warp"],
   ["ollama", "Ollama"],
@@ -34,6 +34,7 @@ export const TEST_PROVIDER_CATALOG: Array<[string, string]> = [
   ["codebuff", "Codebuff"],
   ["deepseek", "DeepSeek"],
   ["deepinfra", "DeepInfra"],
+  ["aiand", "ai&"],
   ["zenmux", "ZenMux"],
   ["clinepass", "ClinePass"],
   ["longcat", "LongCat"],
@@ -57,7 +58,7 @@ export const TEST_PROVIDER_CATALOG: Array<[string, string]> = [
   ["poe", "Poe"],
   ["devin", "Devin"],
   ["zed", "Zed"],
-  ["crossmodel", "CrossModel"],
+  ["crossmodel", "CrossModel (removed)"],
   ["qoder", "Qoder"],
   ["sakana", "Sakana AI"],
   ["sub2api", "sub2api"],
diff --git a/apps/desktop-tauri/src/types/bridge.ts b/apps/desktop-tauri/src/types/bridge.ts
index 4454995fd0..204977762e 100644
--- a/apps/desktop-tauri/src/types/bridge.ts
+++ b/apps/desktop-tauri/src/types/bridge.ts
@@ -90,6 +90,7 @@ export type ProofProviderId =
   | "codebuff"
   | "deepseek"
   | "deepinfra"
+  | "aiand"
   | "zenmux"
   | "clinepass"
   | "longcat"
diff --git a/rust/src/cli/serve.rs b/rust/src/cli/serve.rs
index 2944aef674..84cedbf4b9 100644
--- a/rust/src/cli/serve.rs
+++ b/rust/src/cli/serve.rs
@@ -1,6 +1,10 @@
 //! Local HTTP server for scriptable usage/cost JSON.
+//!
+//! Upstream 0.44 #2227: bind host + optional dashboard bearer token gate.
+//! Non-loopback binds require a token and `--allow-plain-http`.
 
 use clap::Args;
+use sha2::{Digest, Sha256};
 use tokio::io::{AsyncReadExt, AsyncWriteExt};
 use tokio::net::{TcpListener, TcpStream};
 
@@ -8,40 +12,211 @@ use super::usage::ProviderSelection;
 use crate::core::{FetchContext, ProviderId, SourceMode, instantiate_provider};
 use crate::cost_scanner::CostScanner;
 
+const DASHBOARD_TOKEN_ENV: &str = "CODEXBAR_DASHBOARD_TOKEN";
+
 #[derive(Args, Debug, Clone)]
 pub struct ServeArgs {
     /// Local HTTP port
     #[arg(long, default_value = "8080")]
     pub port: u16,
 
+    /// IPv4 bind address or localhost (default: 127.0.0.1)
+    #[arg(long, default_value = "127.0.0.1")]
+    pub host: String,
+
     /// Response cache TTL in seconds
     #[arg(long = "refresh-interval", default_value = "60")]
     pub refresh_interval: u64,
+
+    /// Bearer token for /usage and /cost (prefer CODEXBAR_DASHBOARD_TOKEN)
+    #[arg(long = "dashboard-token", env = "CODEXBAR_DASHBOARD_TOKEN")]
+    pub dashboard_token: Option<String>,
+
+    /// Accept sending the dashboard token over cleartext HTTP on a non-loopback host
+    #[arg(long = "allow-plain-http", default_value_t = false)]
+    pub allow_plain_http: bool,
+}
+
+/// Normalized serve bind configuration after startup validation.
+#[derive(Debug, Clone)]
+struct ServeConfig {
+    host: String,
+    port: u16,
+    token_digest: Option<[u8; 32]>,
 }
 
 pub async fn run(args: ServeArgs) -> anyhow::Result<()> {
-    let listener = TcpListener::bind(("127.0.0.1", args.port)).await?;
+    let config = validate_serve_args(&args)?;
+    let listener = TcpListener::bind((config.host.as_str(), config.port)).await?;
     eprintln!(
-        "CodexBar server listening on http://127.0.0.1:{}",
-        args.port
+        "CodexBar server listening on http://{}:{}",
+        config.host, config.port
     );
+    if !is_loopback_host(&config.host) {
+        eprintln!(
+            "Warning: plain HTTP on a non-loopback host; the bearer token gating \
+             /usage and /cost crosses the network in cleartext on every request."
+        );
+    }
 
     loop {
         let (stream, _) = listener.accept().await?;
+        let config = config.clone();
         tokio::spawn(async move {
-            if let Err(error) = handle_client(stream).await {
+            if let Err(error) = handle_client(stream, &config).await {
                 tracing::debug!("serve client error: {error}");
             }
         });
     }
 }
 
-async fn handle_client(mut stream: TcpStream) -> anyhow::Result<()> {
+/// Startup validation for bind host + dashboard token flags.
+///
+/// | bind host    | token   | --allow-plain-http | result                          |
+/// |--------------|---------|--------------------|---------------------------------|
+/// | loopback     | absent  | any                | serve                           |
+/// | loopback     | present | any                | serve; data routes gated        |
+/// | non-loopback | absent  | any                | error: token required           |
+/// | non-loopback | present | absent             | error: pass --allow-plain-http  |
+/// | non-loopback | present | present            | serve; data routes gated        |
+fn validate_serve_args(args: &ServeArgs) -> anyhow::Result<ServeConfig> {
+    let host = bind_host(&args.host);
+    if !is_supported_ipv4_bind_host(&host) {
+        anyhow::bail!("--host must be 'localhost' or an IPv4 address.");
+    }
+    if args.port == 0 {
+        anyhow::bail!("--port must be between 1 and 65535.");
+    }
+
+    let token = resolve_dashboard_token(args.dashboard_token.as_deref())?;
+    if let Some(err) = validate_serve_startup(&host, token.is_some(), args.allow_plain_http) {
+        anyhow::bail!("{err}");
+    }
+
+    Ok(ServeConfig {
+        host,
+        port: args.port,
+        token_digest: token.as_ref().map(|t| sha256_digest(t.as_bytes())),
+    })
+}
+
+fn resolve_dashboard_token(cli_token: Option<&str>) -> anyhow::Result<Option<String>> {
+    // Prefer env (already merged by clap env=) but still reject empty/whitespace.
+    if let Some(raw) = cli_token {
+        let bearer = raw.trim();
+        if bearer.is_empty() {
+            anyhow::bail!(
+                "{DASHBOARD_TOKEN_ENV} / --dashboard-token must not be empty or whitespace."
+            );
+        }
+        return Ok(Some(bearer.to_string()));
+    }
+    Ok(None)
+}
+
+fn validate_serve_startup(
+    host: &str,
+    has_configured_bearer: bool,
+    allow_plain_http: bool,
+) -> Option<String> {
+    if is_loopback_host(host) {
+        return None;
+    }
+    if !has_configured_bearer {
+        return Some(format!(
+            "--dashboard-token (or {DASHBOARD_TOKEN_ENV}) is required for non-loopback --host '{host}'."
+        ));
+    }
+    if !allow_plain_http {
+        return Some(format!(
+            "Refusing to serve the dashboard token over cleartext HTTP on non-loopback --host '{host}'. \
+             Pass --allow-plain-http to accept that the bearer token crosses the network \
+             unencrypted on every request."
+        ));
+    }
+    None
+}
+
+fn bind_host(host: &str) -> String {
+    let trimmed = host.trim();
+    if trimmed.eq_ignore_ascii_case("localhost") {
+        "127.0.0.1".to_string()
+    } else {
+        trimmed.to_string()
+    }
+}
+
+fn is_loopback_host(host: &str) -> bool {
+    let normalized = host.trim().to_ascii_lowercase();
+    normalized == "localhost"
+        || normalized == "127.0.0.1"
+        || normalized == "::1"
+        || normalized == "[::1]"
+        || normalized.starts_with("127.")
+}
+
+fn is_supported_ipv4_bind_host(host: &str) -> bool {
+    let parts: Vec<_> = host.split('.').collect();
+    if parts.len() != 4 {
+        return false;
+    }
+    parts.iter().all(|part| {
+        !part.is_empty()
+            && part.bytes().all(|b| b.is_ascii_digit())
+            && part.parse::<u8>().is_ok_and(|v| v.to_string() == *part)
+    })
+}
+
+fn sha256_digest(bytes: &[u8]) -> [u8; 32] {
+    let hash = Sha256::digest(bytes);
+    let mut out = [0_u8; 32];
+    out.copy_from_slice(&hash);
+    out
+}
+
+fn constant_time_eq(a: &[u8], b: &[u8]) -> bool {
+    if a.len() != b.len() {
+        return false;
+    }
+    let mut diff = 0_u8;
+    for (x, y) in a.iter().zip(b.iter()) {
+        diff |= x ^ y;
+    }
+    diff == 0
+}
+
+fn authorize_request(auth_header: Option<&str>, expected: Option<&[u8; 32]>) -> bool {
+    let Some(expected) = expected else {
+        // No token configured: open on loopback (startup already blocks non-loopback without token).
+        return true;
+    };
+    let Some(token) = bearer_token(auth_header) else {
+        return false;
+    };
+    let digest = sha256_digest(token.as_bytes());
+    constant_time_eq(&digest, expected)
+}
+
+fn bearer_token(authorization: Option<&str>) -> Option<String> {
+    let authorization = authorization?;
+    let trimmed = authorization.trim();
+    let rest = trimmed
+        .strip_prefix("Bearer ")
+        .or_else(|| trimmed.strip_prefix("bearer "))?;
+    let token = rest.trim();
+    if token.is_empty() {
+        None
+    } else {
+        Some(token.to_string())
+    }
+}
+
+async fn handle_client(mut stream: TcpStream, config: &ServeConfig) -> anyhow::Result<()> {
     let mut buffer = vec![0_u8; 8192];
     let n = stream.read(&mut buffer).await?;
     let request = String::from_utf8_lossy(&buffer[..n]);
     let response = match parse_request(&request) {
-        Ok(request) => route_request(&request).await,
+        Ok(request) => route_request(&request, config).await,
         Err(status) => json_response(status, serde_json::json!({ "error": "bad request" })),
     };
     stream.write_all(response.as_bytes()).await?;
@@ -49,11 +224,11 @@ async fn handle_client(mut stream: TcpStream) -> anyhow::Result<()> {
     Ok(())
 }
 
-async fn route_request(request: &ServeRequest) -> String {
+async fn route_request(request: &ServeRequest, config: &ServeConfig) -> String {
     if request.method != "GET" {
         return json_response(405, serde_json::json!({ "error": "method not allowed" }));
     }
-    if !allowed_host(&request.host) {
+    if !allowed_host(&request.host, &config.host) {
         return json_response(403, serde_json::json!({ "error": "forbidden host" }));
     }
 
@@ -62,8 +237,24 @@ async fn route_request(request: &ServeRequest) -> String {
             200,
             serde_json::json!({ "status": "ok", "version": env!("CARGO_PKG_VERSION") }),
         ),
-        "/usage" => usage_response(request.query.get("provider").map(String::as_str)).await,
-        "/cost" => cost_response(request.query.get("provider").map(String::as_str)).await,
+        "/usage" => {
+            if !authorize_request(
+                request.authorization.as_deref(),
+                config.token_digest.as_ref(),
+            ) {
+                return json_response(401, serde_json::json!({ "error": "unauthorized" }));
+            }
+            usage_response(request.query.get("provider").map(String::as_str)).await
+        }
+        "/cost" => {
+            if !authorize_request(
+                request.authorization.as_deref(),
+                config.token_digest.as_ref(),
+            ) {
+                return json_response(401, serde_json::json!({ "error": "unauthorized" }));
+            }
+            cost_response(request.query.get("provider").map(String::as_str)).await
+        }
         _ => json_response(404, serde_json::json!({ "error": "not found" })),
     }
 }
@@ -154,6 +345,7 @@ struct ServeRequest {
     method: String,
     path: String,
     host: String,
+    authorization: Option<String>,
     query: std::collections::HashMap<String, String>,
 }
 
@@ -168,6 +360,7 @@ fn parse_request(raw: &str) -> Result<ServeRequest, u16> {
     }
 
     let mut hosts = Vec::new();
+    let mut authorization = None;
     for line in lines {
         if line.is_empty() {
             break;
@@ -177,6 +370,8 @@ fn parse_request(raw: &str) -> Result<ServeRequest, u16> {
         };
         if name.trim().eq_ignore_ascii_case("host") {
             hosts.push(value.trim().to_string());
+        } else if name.trim().eq_ignore_ascii_case("authorization") {
+            authorization = Some(value.trim().to_string());
         }
     }
     if hosts.len() != 1 {
@@ -188,6 +383,7 @@ fn parse_request(raw: &str) -> Result<ServeRequest, u16> {
         method,
         path,
         host: hosts.remove(0),
+        authorization,
         query,
     })
 }
@@ -206,7 +402,7 @@ fn parse_target(target: &str) -> (String, std::collections::HashMap<String, Stri
     (path.to_string(), query)
 }
 
-fn allowed_host(host: &str) -> bool {
+fn allowed_host(host: &str, bind_host: &str) -> bool {
     let trimmed = host.trim();
     if trimmed.is_empty() || trimmed.contains(',') {
         return false;
@@ -227,10 +423,18 @@ fn allowed_host(host: &str) -> bool {
             _ => return false,
         }
     };
-    matches!(
-        without_port.to_ascii_lowercase().as_str(),
+    let host_lc = without_port.to_ascii_lowercase();
+    let bind_lc = bind_host.trim().to_ascii_lowercase();
+
+    // Always accept loopback Host headers.
+    if matches!(
+        host_lc.as_str(),
         "127.0.0.1" | "localhost" | "localhost." | "[::1]"
-    )
+    ) {
+        return true;
+    }
+    // Also accept the configured non-loopback bind host.
+    host_lc == bind_lc
 }
 
 fn valid_port_suffix(raw: &str) -> bool {
@@ -268,6 +472,7 @@ fn json_response(status: u16, payload: serde_json::Value) -> String {
     let reason = match status {
         200 => "OK",
         400 => "Bad Request",
+        401 => "Unauthorized",
         403 => "Forbidden",
         404 => "Not Found",
         405 => "Method Not Allowed",
@@ -284,12 +489,21 @@ mod tests {
     use super::*;
 
     #[test]
-    fn rejects_non_loopback_hosts() {
-        assert!(allowed_host("127.0.0.1:8080"));
-        assert!(allowed_host("localhost"));
-        assert!(allowed_host("[::1]:8080"));
-        assert!(!allowed_host("example.com"));
-        assert!(!allowed_host("127.0.0.1, example.com"));
+    fn rejects_non_loopback_hosts_by_default() {
+        assert!(allowed_host("127.0.0.1:8080", "127.0.0.1"));
+        assert!(allowed_host("localhost", "127.0.0.1"));
+        assert!(allowed_host("[::1]:8080", "127.0.0.1"));
+        assert!(!allowed_host("example.com", "127.0.0.1"));
+        assert!(!allowed_host("127.0.0.1, example.com", "127.0.0.1"));
+    }
+
+    #[test]
+    fn allows_configured_non_loopback_host() {
+        assert!(allowed_host("192.168.1.10:8080", "192.168.1.10"));
+        assert!(allowed_host("192.168.1.10", "192.168.1.10"));
+        // Loopback Host headers still work when bound to LAN.
+        assert!(allowed_host("127.0.0.1:8080", "192.168.1.10"));
+        assert!(!allowed_host("10.0.0.1", "192.168.1.10"));
     }
 
     #[test]
@@ -301,4 +515,106 @@ mod tests {
         assert_eq!(request.path, "/usage");
         assert_eq!(request.query.get("provider"), Some(&"deepseek".to_string()));
     }
+
+    #[test]
+    fn parses_authorization_header() {
+        let request = parse_request(
+            "GET /usage HTTP/1.1\r\nHost: localhost:8080\r\nAuthorization: Bearer secret-token\r\n\r\n",
+        )
+        .unwrap();
+        assert_eq!(
+            request.authorization.as_deref(),
+            Some("Bearer secret-token")
+        );
+    }
+
+    #[test]
+    fn validate_startup_requires_token_and_plain_http_for_lan() {
+        assert!(validate_serve_startup("127.0.0.1", false, false).is_none());
+        assert!(validate_serve_startup("127.0.0.1", true, false).is_none());
+
+        let missing = validate_serve_startup("0.0.0.0", false, false).unwrap();
+        assert!(missing.contains("dashboard-token"));
+
+        let plain = validate_serve_startup("192.168.1.5", true, false).unwrap();
+        assert!(plain.contains("allow-plain-http"));
+
+        assert!(validate_serve_startup("192.168.1.5", true, true).is_none());
+    }
+
+    #[test]
+    fn validate_serve_args_accepts_loopback_without_token() {
+        let config = validate_serve_args(&ServeArgs {
+            port: 8080,
+            host: "localhost".into(),
+            refresh_interval: 60,
+            dashboard_token: None,
+            allow_plain_http: false,
+        })
+        .unwrap();
+        assert_eq!(config.host, "127.0.0.1");
+        assert!(config.token_digest.is_none());
+    }
+
+    #[test]
+    fn validate_serve_args_rejects_lan_without_token() {
+        let err = validate_serve_args(&ServeArgs {
+            port: 8080,
+            host: "0.0.0.0".into(),
+            refresh_interval: 60,
+            dashboard_token: None,
+            allow_plain_http: true,
+        })
+        .unwrap_err()
+        .to_string();
+        assert!(err.contains("dashboard-token"));
+    }
+
+    #[test]
+    fn validate_serve_args_rejects_lan_without_allow_plain_http() {
+        let err = validate_serve_args(&ServeArgs {
+            port: 8080,
+            host: "192.168.0.2".into(),
+            refresh_interval: 60,
+            dashboard_token: Some("tok".into()),
+            allow_plain_http: false,
+        })
+        .unwrap_err()
+        .to_string();
+        assert!(err.contains("allow-plain-http"));
+    }
+
+    #[test]
+    fn auth_gate_constant_time_compare() {
+        let digest = sha256_digest(b"correct-token");
+        assert!(authorize_request(
+            Some("Bearer correct-token"),
+            Some(&digest)
+        ));
+        assert!(!authorize_request(Some("Bearer wrong-token"), Some(&digest)));
+        assert!(!authorize_request(None, Some(&digest)));
+        assert!(!authorize_request(Some("Basic correct-token"), Some(&digest)));
+        // No configured token → open.
+        assert!(authorize_request(None, None));
+    }
+
+    #[test]
+    fn bearer_token_extraction() {
+        assert_eq!(
+            bearer_token(Some("Bearer abc")),
+            Some("abc".to_string())
+        );
+        assert_eq!(
+            bearer_token(Some("bearer  xyz  ")),
+            Some("xyz".to_string())
+        );
+        assert_eq!(bearer_token(Some("Bearer")), None);
+        assert_eq!(bearer_token(Some("Token abc")), None);
+    }
+
+    #[test]
+    fn rejects_empty_dashboard_token() {
+        let err = resolve_dashboard_token(Some("   ")).unwrap_err().to_string();
+        assert!(err.contains("empty"));
+    }
 }
diff --git a/rust/src/core/credential_migration.rs b/rust/src/core/credential_migration.rs
index 32965bc0c5..328d6a57b2 100755
--- a/rust/src/core/credential_migration.rs
+++ b/rust/src/core/credential_migration.rs
@@ -341,6 +341,7 @@ const PROVIDER_ACCOUNT_NAMES: &[(ProviderId, &str)] = &[
     (ProviderId::Codebuff, "codebuff-api-token"),
     (ProviderId::DeepSeek, "deepseek-api-token"),
     (ProviderId::DeepInfra, "deepinfra-api-token"),
+    (ProviderId::AiAnd, "aiand-api-token"),
     (ProviderId::Windsurf, "windsurf-local-cache"),
     (ProviderId::Manus, "manus-cookie"),
     (ProviderId::MiMo, "mimo-cookie"),
diff --git a/rust/src/core/provider.rs b/rust/src/core/provider.rs
index 19c283c200..1b62296fa8 100755
--- a/rust/src/core/provider.rs
+++ b/rust/src/core/provider.rs
@@ -46,6 +46,7 @@ pub enum ProviderId {
     Codebuff,
     DeepSeek,
     DeepInfra,
+    AiAnd,
     Windsurf,
     Manus,
     MiMo,
@@ -115,6 +116,7 @@ impl ProviderId {
             ProviderId::Codebuff,
             ProviderId::DeepSeek,
             ProviderId::DeepInfra,
+            ProviderId::AiAnd,
             ProviderId::Windsurf,
             ProviderId::Manus,
             ProviderId::MiMo,
@@ -184,6 +186,7 @@ impl ProviderId {
             ProviderId::Codebuff => "codebuff",
             ProviderId::DeepSeek => "deepseek",
             ProviderId::DeepInfra => "deepinfra",
+            ProviderId::AiAnd => "aiand",
             ProviderId::Windsurf => "windsurf",
             ProviderId::Manus => "manus",
             ProviderId::MiMo => "mimo",
@@ -232,7 +235,8 @@ impl ProviderId {
             ProviderId::Augment => "Augment",
             ProviderId::OpenCode => "OpenCode",
             ProviderId::Kimi => "Kimi",
-            ProviderId::KimiK2 => "Kimi K2",
+            // Soft-removed (upstream #2254); still resolvable via CLI for legacy configs.
+            ProviderId::KimiK2 => "Kimi K2 (removed)",
             ProviderId::Amp => "Amp",
             ProviderId::Warp => "Warp",
             ProviderId::Ollama => "Ollama",
@@ -253,6 +257,7 @@ impl ProviderId {
             ProviderId::Codebuff => "Codebuff",
             ProviderId::DeepSeek => "DeepSeek",
             ProviderId::DeepInfra => "DeepInfra",
+            ProviderId::AiAnd => "ai&",
             ProviderId::Windsurf => "Windsurf",
             ProviderId::Manus => "Manus",
             ProviderId::MiMo => "Xiaomi MiMo",
@@ -272,7 +277,8 @@ impl ProviderId {
             ProviderId::Poe => "Poe",
             ProviderId::Devin => "Devin",
             ProviderId::Zed => "Zed",
-            ProviderId::CrossModel => "CrossModel",
+            // Soft-removed (upstream #2254); still resolvable via CLI for legacy configs.
+            ProviderId::CrossModel => "CrossModel (removed)",
             ProviderId::Qoder => "Qoder",
             ProviderId::Sakana => "Sakana AI",
             ProviderId::Sub2Api => "sub2api",
@@ -334,6 +340,7 @@ impl ProviderId {
             ProviderId::Codebuff => None,
             ProviderId::DeepSeek => None,
             ProviderId::DeepInfra => None,
+            ProviderId::AiAnd => None,
             ProviderId::Windsurf => None,
             ProviderId::Doubao => None,
             ProviderId::Crof => None,
@@ -375,7 +382,9 @@ impl ProviderId {
             "augment" => Some(ProviderId::Augment),
             "opencode" => Some(ProviderId::OpenCode),
             "kimi" | "moonshot" => Some(ProviderId::Kimi),
-            "kimik2" | "kimi-k2" | "kimi k2" | "k2" => Some(ProviderId::KimiK2),
+            "kimik2" | "kimi-k2" | "kimi k2" | "k2" | "kimi k2 (removed)" => {
+                Some(ProviderId::KimiK2)
+            }
             "amp" | "sourcegraph" => Some(ProviderId::Amp),
             "warp" | "warp-ai" | "warp-terminal" => Some(ProviderId::Warp),
             "ollama" => Some(ProviderId::Ollama),
@@ -399,6 +408,7 @@ impl ProviderId {
             "codebuff" | "manicode" => Some(ProviderId::Codebuff),
             "deepseek" | "deep-seek" | "ds" => Some(ProviderId::DeepSeek),
             "deepinfra" | "deep-infra" | "di" => Some(ProviderId::DeepInfra),
+            "aiand" | "ai&" | "ai-and" | "ai and" => Some(ProviderId::AiAnd),
             "windsurf" | "codeium" => Some(ProviderId::Windsurf),
             "manus" => Some(ProviderId::Manus),
             "mimo" | "xiaomi" | "xiaomimimo" | "xiaomi-mimo" | "xiaomi mimo" => {
@@ -422,7 +432,9 @@ impl ProviderId {
             "poe" => Some(ProviderId::Poe),
             "devin" => Some(ProviderId::Devin),
             "zed" | "zed-ai" => Some(ProviderId::Zed),
-            "crossmodel" | "cross-model" | "cross model" => Some(ProviderId::CrossModel),
+            "crossmodel" | "cross-model" | "cross model" | "crossmodel (removed)" => {
+                Some(ProviderId::CrossModel)
+            }
             "qoder" => Some(ProviderId::Qoder),
             "sakana" | "sakana-ai" | "sakana ai" => Some(ProviderId::Sakana),
             "sub2api" | "sub-2-api" | "sub 2 api" => Some(ProviderId::Sub2Api),
@@ -434,6 +446,14 @@ impl ProviderId {
             _ => None,
         }
     }
+
+    /// Soft-removed providers (upstream #2254: Kimi K2 + CrossModel).
+    ///
+    /// Modules and CLI resolution stay so existing configs and `--provider kimik2`
+    /// still work. Settings UI hides them unless already enabled in settings.
+    pub fn is_deprecated(&self) -> bool {
+        matches!(self, ProviderId::KimiK2 | ProviderId::CrossModel)
+    }
 }
 
 impl std::fmt::Display for ProviderId {
@@ -614,6 +634,8 @@ pub fn cli_name_map() -> HashMap<&'static str, ProviderId> {
     map.insert("ds", ProviderId::DeepSeek);
     map.insert("deep-infra", ProviderId::DeepInfra);
     map.insert("di", ProviderId::DeepInfra);
+    map.insert("ai&", ProviderId::AiAnd);
+    map.insert("ai-and", ProviderId::AiAnd);
     map.insert("codeium", ProviderId::Windsurf);
     map.insert("google", ProviderId::Gemini);
     map.insert("agy", ProviderId::Antigravity);
@@ -666,7 +688,7 @@ mod tests {
     #[test]
     fn test_provider_id_all() {
         let all = ProviderId::all();
-        assert_eq!(all.len(), 59);
+        assert_eq!(all.len(), 64);
         assert!(all.contains(&ProviderId::Claude));
         assert!(all.contains(&ProviderId::Codex));
         assert!(all.contains(&ProviderId::Kimi));
@@ -682,6 +704,7 @@ mod tests {
         assert!(all.contains(&ProviderId::Codebuff));
         assert!(all.contains(&ProviderId::DeepSeek));
         assert!(all.contains(&ProviderId::DeepInfra));
+        assert!(all.contains(&ProviderId::AiAnd));
         assert!(all.contains(&ProviderId::Windsurf));
         assert!(all.contains(&ProviderId::Manus));
         assert!(all.contains(&ProviderId::MiMo));
@@ -712,6 +735,38 @@ mod tests {
         assert!(all.contains(&ProviderId::Neuralwatt));
     }
 
+    #[test]
+    fn deprecated_providers_are_kimik2_and_crossmodel() {
+        assert!(ProviderId::KimiK2.is_deprecated());
+        assert!(ProviderId::CrossModel.is_deprecated());
+        assert!(!ProviderId::Kimi.is_deprecated());
+        assert!(!ProviderId::AiAnd.is_deprecated());
+        assert!(
+            ProviderId::KimiK2
+                .display_name()
+                .contains("(removed)")
+        );
+        assert!(
+            ProviderId::CrossModel
+                .display_name()
+                .contains("(removed)")
+        );
+        assert_eq!(ProviderId::from_cli_name("kimik2"), Some(ProviderId::KimiK2));
+        assert_eq!(
+            ProviderId::from_cli_name("crossmodel"),
+            Some(ProviderId::CrossModel)
+        );
+    }
+
+    #[test]
+    fn aiand_cli_aliases_resolve() {
+        assert_eq!(ProviderId::from_cli_name("aiand"), Some(ProviderId::AiAnd));
+        assert_eq!(ProviderId::from_cli_name("ai&"), Some(ProviderId::AiAnd));
+        assert_eq!(ProviderId::from_cli_name("ai-and"), Some(ProviderId::AiAnd));
+        assert_eq!(ProviderId::AiAnd.cli_name(), "aiand");
+        assert_eq!(ProviderId::AiAnd.display_name(), "ai&");
+    }
+
     #[test]
     fn test_provider_id_cli_name() {
         assert_eq!(ProviderId::Claude.cli_name(), "claude");
diff --git a/rust/src/core/provider_factory.rs b/rust/src/core/provider_factory.rs
index a5ff4c2094..8897ef6317 100644
--- a/rust/src/core/provider_factory.rs
+++ b/rust/src/core/provider_factory.rs
@@ -7,14 +7,14 @@
 
 use super::{Provider, ProviderId};
 use crate::providers::{
-    AbacusProvider, AlibabaProvider, AlibabaTokenPlanProvider, AmpProvider, AntigravityProvider,
-    AugmentProvider, AzureOpenAIProvider, BedrockProvider, ChutesProvider, ClinePassProvider,
-    ClaudeProvider, CodebuffProvider, CodexProvider, CommandCodeProvider, CopilotProvider,
-    CrofProvider, CrossModelProvider, CursorProvider, DeepInfraProvider, DeepSeekProvider,
-    DeepgramProvider, DevinProvider, DoubaoProvider, ElevenLabsProvider, FactoryProvider,
-    GeminiProvider, GrokProvider, GroqProvider, InfiniProvider, JetBrainsProvider, KiloProvider,
-    KimiK2Provider, KimiProvider, KiroProvider, LLMProxyProvider, LiteLLMProvider, LongCatProvider,
-    ManusProvider, MiMoProvider, MiniMaxProvider, MistralProvider, NanoGPTProvider,
+    AbacusProvider, AiAndProvider, AlibabaProvider, AlibabaTokenPlanProvider, AmpProvider,
+    AntigravityProvider, AugmentProvider, AzureOpenAIProvider, BedrockProvider, ChutesProvider,
+    ClinePassProvider, ClaudeProvider, CodebuffProvider, CodexProvider, CommandCodeProvider,
+    CopilotProvider, CrofProvider, CrossModelProvider, CursorProvider, DeepInfraProvider,
+    DeepSeekProvider, DeepgramProvider, DevinProvider, DoubaoProvider, ElevenLabsProvider,
+    FactoryProvider, GeminiProvider, GrokProvider, GroqProvider, InfiniProvider, JetBrainsProvider,
+    KiloProvider, KimiK2Provider, KimiProvider, KiroProvider, LLMProxyProvider, LiteLLMProvider,
+    LongCatProvider, ManusProvider, MiMoProvider, MiniMaxProvider, MistralProvider, NanoGPTProvider,
     NeuralwattProvider, OllamaProvider, OpenAIApiProvider, OpenCodeGoProvider, OpenCodeProvider,
     OpenRouterProvider, PerplexityProvider, PoeProvider, QoderProvider, SakanaProvider,
     StepFunProvider, Sub2ApiProvider, T3ChatProvider, VeniceProvider, VertexAIProvider,
@@ -62,6 +62,7 @@ pub fn instantiate(id: ProviderId) -> Box<dyn Provider> {
         ProviderId::Codebuff => Box::new(CodebuffProvider::new()),
         ProviderId::DeepSeek => Box::new(DeepSeekProvider::new()),
         ProviderId::DeepInfra => Box::new(DeepInfraProvider::new()),
+        ProviderId::AiAnd => Box::new(AiAndProvider::new()),
         ProviderId::Windsurf => Box::new(WindsurfProvider::new()),
         ProviderId::Manus => Box::new(ManusProvider::new()),
         ProviderId::MiMo => Box::new(MiMoProvider::new()),
diff --git a/rust/src/core/token_accounts.rs b/rust/src/core/token_accounts.rs
index 56384039a5..d157b0993e 100755
--- a/rust/src/core/token_accounts.rs
+++ b/rust/src/core/token_accounts.rs
@@ -209,6 +209,16 @@ impl TokenAccountSupport {
                 requires_manual_cookie_source: false,
                 cookie_name: None,
             }),
+            ProviderId::AiAnd => Some(TokenAccountSupport {
+                title: "API keys",
+                subtitle: "Store multiple ai& API keys.",
+                placeholder: "API key from console.aiand.com",
+                injection: TokenInjection::Environment {
+                    key: "AIAND_API_KEY".to_string(),
+                },
+                requires_manual_cookie_source: false,
+                cookie_name: None,
+            }),
             ProviderId::ZenMux => Some(TokenAccountSupport {
                 title: "API keys",
                 subtitle: "Store multiple ZenMux Management API keys.",
diff --git a/rust/src/providers/aiand/mod.rs b/rust/src/providers/aiand/mod.rs
new file mode 100644
index 0000000000..078eda975c
--- /dev/null
+++ b/rust/src/providers/aiand/mod.rs
@@ -0,0 +1,457 @@
+//! ai& (aiand) provider — spend-only API-key usage from request logs.
+//!
+//! Ported from steipete/CodexBar `AiAndUsageFetcher` (upstream 0.45 #2256):
+//! `GET https://api.aiand.com/logs?range=30days&limit=100` with Bearer auth,
+//! paginating up to 10 pages via `after` / `after_id` cursors.
+
+use async_trait::async_trait;
+use reqwest::Client;
+use serde::Deserialize;
+
+use crate::core::{
+    CostSnapshot, FetchContext, Provider, ProviderError, ProviderFetchResult, ProviderId,
+    ProviderMetadata, RateWindow, SourceMode, UsageSnapshot,
+};
+
+const LOGS_URL: &str = "https://api.aiand.com/logs";
+const PAGE_LIMIT: u32 = 100;
+const MAX_PAGES: usize = 10;
+const CREDENTIAL_TARGET: &str = "codexbar-aiand";
+const ENV_KEYS: &[&str] = &["AIAND_API_KEY"];
+
+#[derive(Debug, Deserialize, Clone)]
+struct LogsEnvelope {
+    #[serde(default)]
+    data: Vec<LogRow>,
+    #[serde(default)]
+    has_more: Option<bool>,
+    #[serde(default)]
+    next_after: Option<String>,
+    #[serde(default)]
+    next_after_id: Option<String>,
+}
+
+#[derive(Debug, Deserialize, Clone)]
+struct LogRow {
+    cost: Option<String>,
+    currency: Option<String>,
+}
+
+#[derive(Debug, Clone, PartialEq)]
+struct AiAndSpend {
+    amount: f64,
+    currency_code: String,
+}
+
+#[derive(Debug, Clone, PartialEq)]
+struct AiAndSnapshot {
+    last_30_days_spend: Option<AiAndSpend>,
+    /// False when the page cap was hit before the end of the 30-day window.
+    is_complete: bool,
+}
+
+impl AiAndSnapshot {
+    fn summarize(rows: &[LogRow], is_complete: bool) -> Self {
+        // Rows arrive newest-first; the newest priced row decides display currency.
+        let mut currency: Option<String> = None;
+        let mut total = 0.0_f64;
+        for row in rows {
+            let Some(raw_cost) = row.cost.as_deref() else {
+                continue;
+            };
+            let Ok(cost) = raw_cost.trim().parse::<f64>() else {
+                continue;
+            };
+            if !cost.is_finite() {
+                continue;
+            }
+            let Some(row_currency) = row
+                .currency
+                .as_deref()
+                .map(str::trim)
+                .filter(|s| !s.is_empty())
+                .map(|s| s.to_ascii_lowercase())
+            else {
+                continue;
+            };
+            if currency.is_none() {
+                currency = Some(row_currency.clone());
+            }
+            if currency.as_deref() != Some(row_currency.as_str()) {
+                continue;
+            }
+            total += cost;
+        }
+        Self {
+            last_30_days_spend: currency.map(|code| AiAndSpend {
+                amount: total,
+                currency_code: code.to_ascii_uppercase(),
+            }),
+            is_complete,
+        }
+    }
+
+    fn period_label(&self) -> &'static str {
+        if self.is_complete {
+            "Last 30 days"
+        } else {
+            "Last 30 days (partial)"
+        }
+    }
+
+    fn to_usage_snapshot(&self) -> UsageSnapshot {
+        let detail = match &self.last_30_days_spend {
+            Some(spend) => format!(
+                "{} {:.2} · {}",
+                spend.currency_code,
+                spend.amount,
+                self.period_label()
+            ),
+            None => format!("No priced requests · {}", self.period_label()),
+        };
+        // UsageSnapshot requires a primary window; spend is informational only.
+        let primary = RateWindow::informational(detail.clone());
+        UsageSnapshot::new(primary).with_login_method(detail)
+    }
+
+    fn to_cost_snapshot(&self) -> Option<CostSnapshot> {
+        self.last_30_days_spend.as_ref().map(|spend| {
+            CostSnapshot::new(spend.amount, spend.currency_code.clone(), self.period_label())
+        })
+    }
+}
+
+pub struct AiAndProvider {
+    metadata: ProviderMetadata,
+    client: Client,
+}
+
+impl AiAndProvider {
+    pub fn new() -> Self {
+        Self {
+            metadata: ProviderMetadata {
+                id: ProviderId::AiAnd,
+                display_name: "ai&",
+                session_label: "Spend",
+                weekly_label: "Spend",
+                supports_opus: false,
+                supports_credits: false,
+                default_enabled: false,
+                is_primary: false,
+                dashboard_url: Some("https://console.aiand.com"),
+                status_page_url: None,
+            },
+            client: crate::core::credentialed_http_client_builder()
+                .timeout(std::time::Duration::from_secs(15))
+                .build()
+                .unwrap_or_else(|_| Client::new()),
+        }
+    }
+
+    fn resolve_api_key(api_key: Option<&str>) -> Result<String, ProviderError> {
+        let raw = crate::providers::resolve_api_key(api_key, CREDENTIAL_TARGET, ENV_KEYS)?;
+        clean_api_key(&raw).ok_or_else(|| {
+            ProviderError::NotInstalled(
+                "Missing ai& API key. Add one in Settings or set AIAND_API_KEY.".to_string(),
+            )
+        })
+    }
+
+    async fn fetch_usage_api(
+        &self,
+        ctx: &FetchContext,
+    ) -> Result<ProviderFetchResult, ProviderError> {
+        let api_key = Self::resolve_api_key(ctx.api_key.as_deref())?;
+        let snapshot = self.fetch_logs_snapshot(&api_key).await?;
+        let mut result = ProviderFetchResult::new(snapshot.to_usage_snapshot(), "api");
+        if let Some(cost) = snapshot.to_cost_snapshot() {
+            result = result.with_cost(cost);
+        }
+        Ok(result)
+    }
+
+    async fn fetch_logs_snapshot(&self, api_key: &str) -> Result<AiAndSnapshot, ProviderError> {
+        let mut rows = Vec::new();
+        let mut after: Option<String> = None;
+        let mut after_id: Option<String> = None;
+        let mut is_complete = false;
+
+        for _ in 0..MAX_PAGES {
+            let page = self
+                .fetch_logs_page(api_key, after.as_deref(), after_id.as_deref())
+                .await?;
+            rows.extend(page.data);
+            if !page.has_more.unwrap_or(false) {
+                is_complete = true;
+                break;
+            }
+            match (page.next_after, page.next_after_id) {
+                (Some(next_after), Some(next_after_id)) => {
+                    after = Some(next_after);
+                    after_id = Some(next_after_id);
+                }
+                // Server reports more rows but omitted a cursor; after alone is unsafe.
+                _ => break,
+            }
+        }
+
+        Ok(AiAndSnapshot::summarize(&rows, is_complete))
+    }
+
+    async fn fetch_logs_page(
+        &self,
+        api_key: &str,
+        after: Option<&str>,
+        after_id: Option<&str>,
+    ) -> Result<LogsEnvelope, ProviderError> {
+        let mut req = self
+            .client
+            .get(LOGS_URL)
+            .query(&[("range", "30days"), ("limit", &PAGE_LIMIT.to_string())])
+            .header("Authorization", format!("Bearer {api_key}"))
+            .header("Accept", "application/json");
+        if let Some(after) = after {
+            req = req.query(&[("after", after)]);
+        }
+        if let Some(after_id) = after_id {
+            req = req.query(&[("after_id", after_id)]);
+        }
+
+        let resp = req.send().await?;
+        let status = resp.status();
+        if status == reqwest::StatusCode::UNAUTHORIZED {
+            return Err(ProviderError::Other(
+                "ai& rejected the API key. Create a new key at console.aiand.com and update Settings."
+                    .to_string(),
+            ));
+        }
+        if status == reqwest::StatusCode::PAYMENT_REQUIRED {
+            return Err(ProviderError::Other(
+                "ai& reports the organization is out of credits. Top up at console.aiand.com."
+                    .to_string(),
+            ));
+        }
+        if status == reqwest::StatusCode::TOO_MANY_REQUESTS {
+            return Err(ProviderError::Other(
+                "ai& rate limit exceeded. Usage will refresh on the next cycle.".to_string(),
+            ));
+        }
+        if !status.is_success() {
+            return Err(ProviderError::Other(format!(
+                "ai& logs API returned HTTP {status}."
+            )));
+        }
+
+        resp.json().await.map_err(|e| {
+            ProviderError::Parse(format!("Could not parse ai& usage: {e}"))
+        })
+    }
+}
+
+impl Default for AiAndProvider {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+#[async_trait]
+impl Provider for AiAndProvider {
+    fn id(&self) -> ProviderId {
+        ProviderId::AiAnd
+    }
+
+    fn metadata(&self) -> &ProviderMetadata {
+        &self.metadata
+    }
+
+    async fn fetch_usage(&self, ctx: &FetchContext) -> Result<ProviderFetchResult, ProviderError> {
+        match ctx.source_mode {
+            SourceMode::Auto | SourceMode::OAuth => self.fetch_usage_api(ctx).await,
+            SourceMode::Web | SourceMode::Cli => {
+                Err(ProviderError::UnsupportedSource(ctx.source_mode))
+            }
+        }
+    }
+
+    fn available_sources(&self) -> Vec<SourceMode> {
+        vec![SourceMode::Auto, SourceMode::OAuth]
+    }
+}
+
+fn clean_api_key(raw: &str) -> Option<String> {
+    let mut value = raw.trim().to_string();
+    if (value.starts_with('"') && value.ends_with('"'))
+        || (value.starts_with('\'') && value.ends_with('\''))
+    {
+        value = value[1..value.len() - 1].trim().to_string();
+    }
+    if let Some(stripped) = value
+        .strip_prefix("Bearer ")
+        .or_else(|| value.strip_prefix("bearer "))
+    {
+        value = stripped.trim().to_string();
+    }
+    (!value.is_empty()).then_some(value)
+}
+
+/// Parse fixture page JSON without network (unit tests).
+fn summarize_pages_for_testing(pages: &[&str]) -> Result<AiAndSnapshot, ProviderError> {
+    let mut rows = Vec::new();
+    let mut is_complete = false;
+    let mut page_count = 0usize;
+    for page_json in pages {
+        page_count += 1;
+        let page: LogsEnvelope = serde_json::from_str(page_json)
+            .map_err(|e| ProviderError::Parse(format!("Could not parse ai& usage: {e}")))?;
+        rows.extend(page.data);
+        if !page.has_more.unwrap_or(false) {
+            is_complete = true;
+            break;
+        }
+        if page.next_after.is_none() || page.next_after_id.is_none() {
+            break;
+        }
+        if page_count >= MAX_PAGES {
+            break;
+        }
+    }
+    // Hitting MAX_PAGES without has_more=false leaves is_complete false.
+    Ok(AiAndSnapshot::summarize(&rows, is_complete))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn page(
+        costs: &[(&str, &str)],
+        has_more: bool,
+        next_after: Option<&str>,
+        next_after_id: Option<&str>,
+    ) -> String {
+        let rows: Vec<String> = costs
+            .iter()
+            .map(|(cost, currency)| {
+                format!(r#"{{"cost":"{cost}","currency":"{currency}"}}"#)
+            })
+            .collect();
+        let next_after_json = match next_after {
+            Some(v) => format!("\"{v}\""),
+            None => "null".to_string(),
+        };
+        let next_after_id_json = match next_after_id {
+            Some(v) => format!("\"{v}\""),
+            None => "null".to_string(),
+        };
+        format!(
+            r#"{{
+              "data": [{}],
+              "has_more": {},
+              "next_after": {},
+              "next_after_id": {}
+            }}"#,
+            rows.join(","),
+            has_more,
+            next_after_json,
+            next_after_id_json
+        )
+    }
+
+    #[test]
+    fn sums_same_currency_rows_and_marks_complete() {
+        let p1 = page(
+            &[("1.50", "usd"), ("2.25", "USD"), ("0.10", "eur")],
+            false,
+            None,
+            None,
+        );
+        let snapshot = summarize_pages_for_testing(&[&p1]).unwrap();
+        let spend = snapshot.last_30_days_spend.as_ref().unwrap();
+        assert!((spend.amount - 3.75).abs() < 1e-9);
+        assert_eq!(spend.currency_code, "USD");
+        assert!(snapshot.is_complete);
+
+        let usage = snapshot.to_usage_snapshot();
+        assert!(usage.primary.is_informational);
+        assert!(
+            usage
+                .primary
+                .reset_description
+                .as_deref()
+                .unwrap_or("")
+                .contains("Last 30 days")
+        );
+        let cost = snapshot.to_cost_snapshot().unwrap();
+        assert_eq!(cost.period, "Last 30 days");
+        assert!((cost.used - 3.75).abs() < 1e-9);
+        assert_eq!(cost.currency_code, "USD");
+    }
+
+    #[test]
+    fn partial_when_page_cap_or_missing_cursor() {
+        let p1 = page(
+            &[("1.00", "usd")],
+            true,
+            Some("2026-01-01T00:00:00+00"),
+            Some("id-1"),
+        );
+        let p2 = page(&[("2.00", "usd")], true, None, None);
+        let snapshot = summarize_pages_for_testing(&[&p1, &p2]).unwrap();
+        assert!(!snapshot.is_complete);
+        assert!((snapshot.last_30_days_spend.as_ref().unwrap().amount - 3.00).abs() < 1e-9);
+        assert_eq!(
+            snapshot.to_cost_snapshot().unwrap().period,
+            "Last 30 days (partial)"
+        );
+    }
+
+    #[test]
+    fn empty_window_has_no_cost_snapshot() {
+        let p1 = page(&[], false, None, None);
+        let snapshot = summarize_pages_for_testing(&[&p1]).unwrap();
+        assert!(snapshot.last_30_days_spend.is_none());
+        assert!(snapshot.is_complete);
+        assert!(snapshot.to_cost_snapshot().is_none());
+        assert!(
+            snapshot
+                .to_usage_snapshot()
+                .primary
+                .reset_description
+                .as_deref()
+                .unwrap_or("")
+                .contains("No priced")
+        );
+    }
+
+    #[test]
+    fn rejects_malformed_page_json() {
+        let err = summarize_pages_for_testing(&["not-json"]).unwrap_err();
+        match err {
+            ProviderError::Parse(msg) => assert!(msg.contains("ai&")),
+            other => panic!("expected parse error, got {other:?}"),
+        }
+    }
+
+    #[test]
+    fn cleans_quoted_and_bearer_prefixed_keys() {
+        assert_eq!(
+            clean_api_key("  \"Bearer sk-test\"  ").as_deref(),
+            Some("sk-test")
+        );
+        assert_eq!(clean_api_key("bearer sk-abc").as_deref(), Some("sk-abc"));
+        assert_eq!(clean_api_key("   ").as_deref(), None);
+    }
+
+    #[test]
+    fn metadata_matches_upstream_descriptor() {
+        let provider = AiAndProvider::new();
+        assert_eq!(provider.id(), ProviderId::AiAnd);
+        assert_eq!(provider.metadata().display_name, "ai&");
+        assert_eq!(
+            provider.metadata().dashboard_url,
+            Some("https://console.aiand.com")
+        );
+        assert!(!provider.metadata().supports_credits);
+        assert!(!provider.metadata().default_enabled);
+    }
+}
diff --git a/rust/src/providers/mod.rs b/rust/src/providers/mod.rs
index 4a349f776c..c97e304739 100755
--- a/rust/src/providers/mod.rs
+++ b/rust/src/providers/mod.rs
@@ -3,6 +3,7 @@
 #![allow(dead_code)]
 
 pub mod abacus;
+pub mod aiand;
 pub mod alibaba;
 pub mod alibabatokenplan;
 pub mod amp;
@@ -69,6 +70,7 @@ pub mod zenmux;
 
 // Re-export provider implementations
 pub use abacus::AbacusProvider;
+pub use aiand::AiAndProvider;
 pub use alibaba::{AlibabaProvider, AlibabaRegion};
 pub use alibabatokenplan::AlibabaTokenPlanProvider;
 pub use amp::AmpProvider;
diff --git a/rust/src/settings/api_keys.rs b/rust/src/settings/api_keys.rs
index d36d92e8be..35c1fe0c24 100644
--- a/rust/src/settings/api_keys.rs
+++ b/rust/src/settings/api_keys.rs
@@ -310,6 +310,15 @@ pub fn get_api_key_providers() -> Vec<ProviderConfigInfo> {
             config_file_path: None,
             dashboard_url: Some("https://deepinfra.com/dash"),
         },
+        ProviderConfigInfo {
+            id: ProviderId::AiAnd,
+            name: "ai&",
+            requires_api_key: true,
+            api_key_env_var: Some("AIAND_API_KEY"),
+            api_key_help: Some("Get your API key from console.aiand.com."),
+            config_file_path: None,
+            dashboard_url: Some("https://console.aiand.com"),
+        },
         ProviderConfigInfo {
             id: ProviderId::ZenMux,
             name: "ZenMux",
diff --git a/rust/src/settings/tests.rs b/rust/src/settings/tests.rs
index e0e22061de..6ae8c25079 100644
--- a/rust/src/settings/tests.rs
+++ b/rust/src/settings/tests.rs
@@ -375,6 +375,7 @@ fn test_api_key_provider_catalog_includes_token_providers() {
         ProviderId::Codebuff,
         ProviderId::DeepSeek,
         ProviderId::DeepInfra,
+        ProviderId::AiAnd,
         ProviderId::ElevenLabs,
         ProviderId::Deepgram,
         ProviderId::Grok,