Synced from monorepo

Synced from monorepo

Changes:
- grok-shell: send an expired external-provider credential to the sign-in flow, not a 401 loop
- pager: clickable ▲ jumps to the top of the response being read
- grok-shell: keep a large task log from making the completion message too long
- Plan viewer scrollbar: widen grab zone to the border column; fix striped thumb in Terminal.app
- pager: poll the tmux probe teardown grace instead of sleeping it
- security: vendor-compat MCP kill switch is now actually enforced when reported as on
- grok-shell: restore session eviction when a leader client disconnects
- Bump rust-toolchain to 1.93.0
- workspace: lexical-normalize permission path patterns before glob matching
- pager: reject garbage Enter in the /resume picker
- pager: show Mermaid affordances in plan mode preview
- pager: drop manage-account link from /session-info
- workspace: auto-approve read-only git queries; defer write floor to auto classifier
- Add free-form pattern editor to the "Always allow" command prompt
- grok-shell: fix /btw caching
- pager: Tab walks answers in the ask_user_question card
- External-provider auth refresh: single 7s attempt instead of 3×5s
- pager: don't resurrect finished background tasks as Running when completion arrives first
- pager: report tmux truecolor clamping in Doctor
- Fix plan viewer scrollbar click+drag hijacked by comment gutter
- pager/shell: stop double Recap after the same last turn
- sampler: preserve x-should-retry through stream collection
- pager: clear plan-mode indicator immediately when the user approves a plan
- pager: tmux does not re-read its config on reattach

Source-Revision: 64c4de99cc822b25ce9c54ab5a4f372093d0885d

crates/codegen/xai-grok-shell/src/auth/flow.rs

@@ -11,7 +11,7 @@ use crate::http::TransportFailureKind;
 use crate::util::grok_home;
 use xai_grok_telemetry::events::{LoginFailed, LoginFailureKind};
 
-pub type StderrCallback = Box<dyn Fn(&str)>;
+pub(crate) type StderrCallback = Box<dyn Fn(&str)>;
 
 /// Reject a cached credential for reuse if it lacks `oidc_issuer`, has a
 /// mismatched issuer, or its team principal violates the `force_login_team_uuid`
@@ -186,7 +186,7 @@ impl AuthUrlMode {
     }
 
     /// Back-compat flag for older clients that only read `external_provider`.
-    pub fn is_external_provider(self) -> bool {
+    pub(crate) fn is_external_provider(self) -> bool {
         matches!(self, Self::Command)
     }
 }
@@ -319,7 +319,7 @@ async fn run_external_auth_provider(
 }
 
 /// GUI auth: bridges external provider stderr to `url_tx`, pipes code submission via `code_rx`.
-pub async fn run_auth_flow_with_stderr_bridge(
+pub(crate) async fn run_auth_flow_with_stderr_bridge(
     auth_manager: &Arc<AuthManager>,
     grok_com_config: &GrokComConfig,
     channels: AuthChannels,
@@ -432,7 +432,7 @@ pub async fn run_auth_flow(
 /// Like [`run_auth_flow`] but with `force_interactive`: skip cached
 /// credentials without clearing them. Used by `/login` for mid-session
 /// re-auth where abandoning the flow must not disrupt the session.
-pub async fn run_auth_flow_interactive(
+pub(crate) async fn run_auth_flow_interactive(
     auth_manager: &Arc<AuthManager>,
     grok_com_config: &GrokComConfig,
     on_stderr: Option<StderrCallback>,