Synced from monorepo

Synced from monorepo

Changes:
- grok-shell: send an expired external-provider credential to the sign-in flow, not a 401 loop
- pager: clickable ▲ jumps to the top of the response being read
- grok-shell: keep a large task log from making the completion message too long
- Plan viewer scrollbar: widen grab zone to the border column; fix striped thumb in Terminal.app
- pager: poll the tmux probe teardown grace instead of sleeping it
- security: vendor-compat MCP kill switch is now actually enforced when reported as on
- grok-shell: restore session eviction when a leader client disconnects
- Bump rust-toolchain to 1.93.0
- workspace: lexical-normalize permission path patterns before glob matching
- pager: reject garbage Enter in the /resume picker
- pager: show Mermaid affordances in plan mode preview
- pager: drop manage-account link from /session-info
- workspace: auto-approve read-only git queries; defer write floor to auto classifier
- Add free-form pattern editor to the "Always allow" command prompt
- grok-shell: fix /btw caching
- pager: Tab walks answers in the ask_user_question card
- External-provider auth refresh: single 7s attempt instead of 3×5s
- pager: don't resurrect finished background tasks as Running when completion arrives first
- pager: report tmux truecolor clamping in Doctor
- Fix plan viewer scrollbar click+drag hijacked by comment gutter
- pager/shell: stop double Recap after the same last turn
- sampler: preserve x-should-retry through stream collection
- pager: clear plan-mode indicator immediately when the user approves a plan
- pager: tmux does not re-read its config on reattach

Source-Revision: 64c4de99cc822b25ce9c54ab5a4f372093d0885d

crates/codegen/xai-grok-pager/docs/user-guide/24-monitoring-usage.md

@@ -66,6 +66,7 @@ without the master switch.
 | `OTEL_EXPORTER_OTLP_ENDPOINT` | `http://localhost:4318` for HTTP, `http://localhost:4317` for gRPC | Base endpoint. For `http/protobuf`, `/v1/logs` and `/v1/metrics` are appended per the OTLP spec; for `grpc`, the collector endpoint is used as-is. |
 | `OTEL_EXPORTER_OTLP_LOGS_ENDPOINT` / `..._METRICS_ENDPOINT` | — | Signal-specific overrides, used verbatim. For gRPC these should normally be collector endpoints without `/v1/...` paths. |
 | `OTEL_EXPORTER_OTLP_HEADERS` (+ signal-specific variants) | — | Collector auth (`k=v,k2=v2`). The **only** headers the external exporters send, and the only supported collector-auth mechanism (no config-file headers key — tokens never live on disk). |
+| `OTEL_EXPORTER_OTLP_CERTIFICATE` (+ signal-specific variants) | — | Path to a PEM bundle with additional trusted CA certificate(s) for verifying the collector — for collectors behind a private/corporate CA. Additive to the default trust roots (system store and embedded Mozilla roots). |
 | `OTEL_EXPORTER_OTLP_TIMEOUT` | `10000` (ms) | Export timeout. |
 | `OTEL_METRIC_EXPORT_INTERVAL` | `60000` (ms) | Metric export interval. |
 | `OTEL_BLRP_SCHEDULE_DELAY` (or alias `OTEL_LOGS_EXPORT_INTERVAL`) | `5000` (ms) | Log batch interval. |
@@ -115,6 +116,30 @@ the `[telemetry]` `otel_*` keys through `grok setup` managed config /
 requirements pins, or force-disable it fleet-wide with the same local config
 layers (`external_otel_disabled`, content-gate locks).
 
+## Startup suppression (why nothing arrives for the first few seconds)
+
+Because xAI can force-disable this stream fleet-wide, the CLI holds emission
+closed at startup until it knows whether that switch is set — it fetches the
+fleet policy from `/v1/settings` and only then starts exporting. In a healthy
+setup that is well under a second and invisible.
+
+**The wait is bounded**, so a deployment that cannot reach xAI still exports:
+
+- If no fleet policy can apply at all — `[features] remote_fetch = false`, or
+  `[endpoints] cli_chat_proxy_base_url` points somewhere other than xAI — the
+  stream starts immediately, governed by your local configuration.
+- If the policy fetch fails or never completes (firewalled host, offline
+  laptop), emission starts anyway once the attempt is exhausted, and in all
+  cases no later than 30 seconds after startup.
+
+A fleet policy that arrives afterwards still applies; it can only ever
+*tighten* (disable the stream or force the content gates off), never enable
+something your local configuration did not.
+
+If your collector receives nothing at all, check the debug log
+(`grok --debug`) for `external otel:` lines — they record whether the stream
+resolved its configuration, and whether it is exporting or suppressed.
+
 ## Resource attributes
 
 | Attribute | Value |