Synced from monorepo

Synced from monorepo

Changes:
- Shell: accept target response id on rewind execute
- Shell: stamp response id on chat user message chunks
- Worktree: optional rebuild and stale git registration cleanup in auto-GC
- Worktree: kind-aware auto-GC TTLs and config knobs
- Worktree: macOS process CWD scan and Unix PID liveness for GC guards
- Worktree: automatic throttled GC on startup (Linux age-based; non-Linux dead-only)
- Pager: add `[ui].combine_queued_prompts` to batch queued follow-ups
- Shell: stop overwriting user skills
- Tools: read markdown in `skills/` directories untruncated
- `/usage` shows per-session token and dollar usage in the TUI
- Security: prompt on environment-dumping `ps` variants
- Security: always-safe `kubectl` no longer runs arbitrary kubeconfig credential plugins without permission
- Tools: make scheduler deletion durable
- Shell: add relocation storage primitives
- Shell: give side model calls their own conversation ids
- Fix five workflow-runtime bugs (budget, pause, cancel, reconnect)
- Security: peel `env -S` / `--split-string` operands in the Bash permission gate (managed deny/ask)
- Pager: expose doctor in the TUI
- Security: block unauthorized RCE via abused safe commands
- Pager idle watcher cue: "1 subagent still running" instead of "watching · 1 subagent"
- Security: block `rg --pre` arbitrary code execution in auto-mode
- Voice: diagnose silent-mic failures (macOS permission) and add doctor/terminal-setup Voice section
- App builder deployer: `allow_forking` and `show_built_with_grok`
- Pager: stop stacking duplicate "Worked for" markers on parked turns
- Shell: support `max` as a distinct reasoning effort tier
- Tools: serialize background `/loop` fires on the whole work unit
- Shell: add working-directory relocation state primitives
- Proto: `ClientToolResult` and `ChatConfig` client-side tools
- Shell: model providers
- Chat: select App Builder product on the Build path
- Shell: attach author identity to feedback when the deployment opts in
- Doctor: fix for SSH wrap setup
- Workflow authoring skills: create-workflow and import-claude-workflow docs
- Add read-only grok doctor
- Sandbox: apply Landlock without a controlling TTY
- Pager: recover image paste over grok wrap on headless remotes
- Pager: make actions screen-mode aware
- Shell: resume sessions when the working directory moves
- Pager: centralize terminal diagnostics
- Workspace: gate inline shell file access
- Pager: centralize terminal probes
- Pager: edit minimal prompts in an external editor
- Pager: standardize backgrounding on Ctrl+B
- Shell: recap rides the parent turn's prompt cache
- Tools: add scheduler lifecycle version clock

Source-Revision: 0f4d7c91b8b2b408333f6de1e8a76cb8eaa71899

crates/codegen/xai-grok-sampler/src/retry.rs

@@ -156,6 +156,9 @@ pub fn classify_error(
     if err.is_encrypted_content_error() {
         return RetryDecision::EmitToSession(clone_error(err));
     }
+    if max_retries == 0 {
+        return RetryDecision::Fatal(clone_error(err));
+    }
 
     // 413 Payload Too Large: strip inline images and try once. The
     // caller checks if there are images left after the strip; if not,
@@ -209,6 +212,9 @@ pub fn classify_error(
     if err.is_rate_limited() {
         let next_attempt = retry_count + 1;
         let effective_cap = max_retries.min(rate_limit_threshold);
+        if effective_cap == 0 {
+            return RetryDecision::Fatal(clone_error(err));
+        }
         if next_attempt >= effective_cap {
             return RetryDecision::Fatal(clone_error(err));
         }
@@ -227,7 +233,7 @@ pub fn classify_error(
     // later retries just back off.
     if err.is_retryable() {
         let next_attempt = retry_count + 1;
-        if next_attempt >= max_retries {
+        if max_retries == 0 || next_attempt >= max_retries {
             return RetryDecision::Fatal(clone_error(err));
         }
         let backoff = err
@@ -619,6 +625,34 @@ mod tests {
         }
     }
 
+    #[test]
+    fn zero_retry_budget_never_reuses_a_model_output_cap() {
+        for err in [
+            api_err(StatusCode::INTERNAL_SERVER_ERROR, "boom"),
+            api_err(StatusCode::PAYLOAD_TOO_LARGE, "too big"),
+            api_err(StatusCode::BAD_REQUEST, "Could not process image"),
+            SamplingError::EmptyResponse {
+                context: xai_grok_sampling_types::EmptyResponseContext {
+                    reason: xai_grok_sampling_types::EmptyReason::NoVisibleContent,
+                    had_reasoning: false,
+                    content_len: 0,
+                    tool_call_count: 0,
+                    finish_reason: Some("stop".into()),
+                    completion_tokens: Some(1),
+                    reasoning_tokens: Some(0),
+                    prompt_tokens: Some(10),
+                    model: "m".into(),
+                    first_choice_seen: true,
+                },
+            },
+        ] {
+            assert!(matches!(
+                classify_error(&err, 0, 0, RATE_LIMIT_RETRY_THRESHOLD),
+                RetryDecision::Fatal(_)
+            ));
+        }
+    }
+
     #[test]
     fn classify_5xx_first_retry_rebuilds_client() {
         let err = api_err(StatusCode::INTERNAL_SERVER_ERROR, "boom");