Synced from monorepo

Synced from monorepo

Changes:
- grok-shell: send an expired external-provider credential to the sign-in flow, not a 401 loop
- pager: clickable ▲ jumps to the top of the response being read
- grok-shell: keep a large task log from making the completion message too long
- Plan viewer scrollbar: widen grab zone to the border column; fix striped thumb in Terminal.app
- pager: poll the tmux probe teardown grace instead of sleeping it
- security: vendor-compat MCP kill switch is now actually enforced when reported as on
- grok-shell: restore session eviction when a leader client disconnects
- Bump rust-toolchain to 1.93.0
- workspace: lexical-normalize permission path patterns before glob matching
- pager: reject garbage Enter in the /resume picker
- pager: show Mermaid affordances in plan mode preview
- pager: drop manage-account link from /session-info
- workspace: auto-approve read-only git queries; defer write floor to auto classifier
- Add free-form pattern editor to the "Always allow" command prompt
- grok-shell: fix /btw caching
- pager: Tab walks answers in the ask_user_question card
- External-provider auth refresh: single 7s attempt instead of 3×5s
- pager: don't resurrect finished background tasks as Running when completion arrives first
- pager: report tmux truecolor clamping in Doctor
- Fix plan viewer scrollbar click+drag hijacked by comment gutter
- pager/shell: stop double Recap after the same last turn
- sampler: preserve x-should-retry through stream collection
- pager: clear plan-mode indicator immediately when the user approves a plan
- pager: tmux does not re-read its config on reattach

Source-Revision: 64c4de99cc822b25ce9c54ab5a4f372093d0885d

crates/codegen/xai-grok-shell/src/agent/auth_method.rs

@@ -33,7 +33,7 @@ pub const LEGACY_XAI_API_KEY_ENV_VAR: &str = "GROK_CODE_XAI_API_KEY";
 ///
 /// Checks `XAI_API_KEY` first, then falls back to the legacy
 /// `GROK_CODE_XAI_API_KEY` for backward compatibility.
-pub fn read_xai_api_key_env() -> Result<String, std::env::VarError> {
+pub(crate) fn read_xai_api_key_env() -> Result<String, std::env::VarError> {
     std::env::var(XAI_API_KEY_ENV_VAR).or_else(|_| std::env::var(LEGACY_XAI_API_KEY_ENV_VAR))
 }
 
@@ -60,7 +60,7 @@ pub fn has_xai_api_key_env() -> bool {
 /// `GROK_DISABLE_API_KEY_AUTH`) is the admin kill switch: when true the
 /// method is never advertised, regardless of available credentials, so
 /// `XAI_API_KEY` can't bypass a deployment's forced IdP login.
-pub fn should_advertise_xai_api_key<'a, I>(disable_api_key_auth: bool, models: I) -> bool
+pub(crate) fn should_advertise_xai_api_key<'a, I>(disable_api_key_auth: bool, models: I) -> bool
 where
     I: IntoIterator<Item = &'a ModelEntry>,
 {
@@ -311,7 +311,7 @@ impl AuthMethodKind {
     }
 
     /// `true` for session-based methods (cached_token, grok.com, oidc).
-    pub fn is_session_based(self) -> bool {
+    pub(crate) fn is_session_based(self) -> bool {
         matches!(self, Self::CachedToken | Self::GrokCom | Self::Oidc)
     }
 
@@ -319,25 +319,17 @@ impl AuthMethodKind {
     pub fn needs_interactive_login(self) -> bool {
         matches!(self, Self::GrokCom | Self::Oidc)
     }
-
-    pub fn auth_error_message(self) -> &'static str {
-        if self.is_session_based() {
-            AUTH_ERROR_SESSION_EXPIRED
-        } else {
-            AUTH_ERROR_API_KEY
-        }
-    }
 }
 
 /// `true` for session-based ACP methods (cached_token, grok.com, oidc).
-pub fn is_session_based_method(method_id: &acp::AuthMethodId) -> bool {
+pub(crate) fn is_session_based_method(method_id: &acp::AuthMethodId) -> bool {
     AuthMethodKind::from_id(method_id).is_session_based()
 }
 
 /// Per-model BYOK status: whether the selected model carries its own
 /// `[model.*]` `api_key`/`env_key`.
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
-pub enum ModelByok {
+pub(crate) enum ModelByok {
     /// Model has its own per-model key (not refreshable).
     Byok,
     /// Model has no per-model key (session auth governs).
@@ -374,7 +366,7 @@ impl ModelByok {
 /// where sending the session token cannot leak to a third-party BYOK
 /// endpoint. A definite `NotByok` always refreshes (it only ever routes to
 /// the session endpoint); a definite `Byok` never does.
-pub fn session_token_auth_gate(
+pub(crate) fn session_token_auth_gate(
     is_session_based_method: bool,
     model_byok: ModelByok,
     endpoint_is_first_party: bool,
@@ -401,7 +393,7 @@ pub const AUTH_ERROR_API_KEY: &str = "Authentication failed. Run `grok login`, s
 /// Pinned `oidc`: **no** fallthrough to api_key — return `None` so the caller
 /// fails auth. Pinned `api_key` should not reach this path (cached_token is
 /// not advertised).
-pub fn method_id_after_cached_token_unavailable(
+pub(crate) fn method_id_after_cached_token_unavailable(
     has_external_api_key: bool,
     preferred_method: Option<PreferredAuthMethod>,
 ) -> Option<&'static str> {
@@ -423,7 +415,7 @@ pub const PREFERRED_OIDC_UNAVAILABLE: &str =
     "preferred_method=oidc but no session is available. Run `grok login` to authenticate.";
 
 pub const XAI_API_KEY_METHOD_ID: &str = "xai.api_key";
-pub fn xai_api_key_auth_method() -> acp::AuthMethod {
+pub(crate) fn xai_api_key_auth_method() -> acp::AuthMethod {
     acp::AuthMethod::Agent(
         acp::AuthMethodAgent::new(
             acp::AuthMethodId::new(XAI_API_KEY_METHOD_ID),
@@ -436,7 +428,7 @@ pub fn xai_api_key_auth_method() -> acp::AuthMethod {
 }
 
 pub const CACHED_TOKEN_AUTH_METHOD_ID: &str = "cached_token";
-pub fn cached_token_auth_method() -> acp::AuthMethod {
+pub(crate) fn cached_token_auth_method() -> acp::AuthMethod {
     acp::AuthMethod::Agent(
         acp::AuthMethodAgent::new(
             acp::AuthMethodId::new(CACHED_TOKEN_AUTH_METHOD_ID),
@@ -449,7 +441,7 @@ pub fn cached_token_auth_method() -> acp::AuthMethod {
 pub const GROK_COM_METHOD_ID: &str = "grok.com";
 
 /// xAI OAuth2/OIDC auth. Method id `"grok.com"` kept for ACP wire-compat.
-pub fn grok_com_auth_method(
+pub(crate) fn grok_com_auth_method(
     label: Option<&str>,
     has_auth_provider_command: bool,
 ) -> acp::AuthMethod {
@@ -469,7 +461,7 @@ pub fn grok_com_auth_method(
 }
 
 pub const OIDC_METHOD_ID: &str = "oidc";
-pub fn oidc_auth_method(issuer: &str, label: Option<&str>) -> acp::AuthMethod {
+pub(crate) fn oidc_auth_method(issuer: &str, label: Option<&str>) -> acp::AuthMethod {
     let name = label
         .map(|l| l.to_string())
         .unwrap_or_else(|| format!("Single sign-on ({})", issuer));