Synced from monorepo

Synced from monorepo

Changes:
- Workspace server: report `/ready` as failed with dwell on hub connect failure
- Refresh OIDC token for the Grok agent in the shell
- ACP terminal output recorder
- Cross-platform provider auth commands in the shell
- Default `/resume` to Grok sessions with a hint for hidden external sessions
- Resume sessions by title with `--resume`
- Limit app-builder archive size
- Data-driven tag labels for slash commands
- Doctor fixes for tmux
- Custom provider gateways and subprocess environment policy in the shell
- `/tutorial` — opt-in onboarding tour of Grok Build
- Soft and required CLI version checks in the shell
- Privacy banner env overrides survive live settings updates
- Add remote flag to override the image-edit model
- Return profile fields from auth info even when the access token is expired
- Add edit control on queued prompt rows
- Keep fail-closed policy when clearing orphans with no team
- Setting to disable the Ctrl+Space/F8 voice shortcut
- Pass `--raw` to pw-record so Linux dictation works on older PipeWire
- Validate git URLs when adding marketplace entries
- Stop shipping stale tool-doc parameter and tool names
- Re-point dashboard attach after `/fork` only when the parent was attached
- Surface Grok Computer media-generation results as file-path chunks
- Clear web background-task tray on kill and keep the task description
- Show privacy upsell banner in agent view until acted on
- Add tools-server client callback surface
- Protect persistent global hook sources

Source-Revision: 95d84f443eddcbed6cbfd6eed22e2eafe6b3939d

crates/codegen/xai-grok-config/src/managed_cache/tests.rs

@@ -1316,6 +1316,50 @@ fn managed_config_stale_for_far_future_sync() {
     );
 }
 
+/// Unreadable requirements (PermissionDenied) with no fail_closed marker must
+/// still arm the gate so clear_orphan cannot wipe policy that may still be
+/// fail_closed on disk.
+#[test]
+#[cfg(unix)]
+fn unreadable_requirements_treats_fail_closed_as_armed() {
+    use std::os::unix::fs::PermissionsExt;
+
+    let dir = tempfile::tempdir().unwrap();
+    let home = dir.path();
+    let req = home.join(crate::loader::REQUIREMENTS_FILENAME);
+    std::fs::write(&req, "fail_closed = true\n").unwrap();
+    assert!(
+        fail_closed_policy_armed_at(home),
+        "readable fail_closed requirements must arm the gate"
+    );
+
+    // Drop read perms so read_to_string fails with PermissionDenied (not NotFound).
+    std::fs::set_permissions(&req, std::fs::Permissions::from_mode(0o000)).unwrap();
+    // Restore on drop so tempfile cleanup can remove the file.
+    struct RestorePerms<'a>(&'a std::path::Path);
+    impl Drop for RestorePerms<'_> {
+        fn drop(&mut self) {
+            let _ = std::fs::set_permissions(self.0, std::fs::Permissions::from_mode(0o600));
+        }
+    }
+    let _restore = RestorePerms(&req);
+
+    assert!(
+        fail_closed_policy_armed_at(home),
+        "unreadable requirements must treat fail_closed as armed (no wipe)"
+    );
+}
+
+/// Absent requirements + no fail_closed marker → not armed (safe to clear).
+#[test]
+fn missing_requirements_and_marker_not_armed() {
+    let dir = tempfile::tempdir().unwrap();
+    assert!(
+        !fail_closed_policy_armed_at(dir.path()),
+        "NotFound requirements with no marker must not arm fail_closed"
+    );
+}
+
 // The is-managed claim gate tests live in a sibling child module (this file is
 // past the 1k-line mark); same private access via the #[path] include below.
 #[path = "claim_tests.rs"]