Synced from monorepo

Synced from monorepo

Changes:
- grok-shell: send an expired external-provider credential to the sign-in flow, not a 401 loop
- pager: clickable ▲ jumps to the top of the response being read
- grok-shell: keep a large task log from making the completion message too long
- Plan viewer scrollbar: widen grab zone to the border column; fix striped thumb in Terminal.app
- pager: poll the tmux probe teardown grace instead of sleeping it
- security: vendor-compat MCP kill switch is now actually enforced when reported as on
- grok-shell: restore session eviction when a leader client disconnects
- Bump rust-toolchain to 1.93.0
- workspace: lexical-normalize permission path patterns before glob matching
- pager: reject garbage Enter in the /resume picker
- pager: show Mermaid affordances in plan mode preview
- pager: drop manage-account link from /session-info
- workspace: auto-approve read-only git queries; defer write floor to auto classifier
- Add free-form pattern editor to the "Always allow" command prompt
- grok-shell: fix /btw caching
- pager: Tab walks answers in the ask_user_question card
- External-provider auth refresh: single 7s attempt instead of 3×5s
- pager: don't resurrect finished background tasks as Running when completion arrives first
- pager: report tmux truecolor clamping in Doctor
- Fix plan viewer scrollbar click+drag hijacked by comment gutter
- pager/shell: stop double Recap after the same last turn
- sampler: preserve x-should-retry through stream collection
- pager: clear plan-mode indicator immediately when the user approves a plan
- pager: tmux does not re-read its config on reattach

Source-Revision: 64c4de99cc822b25ce9c54ab5a4f372093d0885d

crates/codegen/xai-grok-shell/src/extensions/notification.rs

@@ -92,7 +92,7 @@ impl PromptUsage {
     /// Project a ledger snapshot for the wire. Returns `Some` whenever
     /// `incomplete` is set — even if `ledger` is `None` — so the flag is never
     /// dropped by omission. Always scrubs untrustworthy costs.
-    pub fn project_from_ledger(
+    pub(crate) fn project_from_ledger(
         ledger: Option<&xai_chat_state::UsageLedger>,
         incomplete: bool,
     ) -> Option<Self> {
@@ -116,7 +116,7 @@ impl PromptUsage {
 
     /// Error-path attach: any open ledger is always incomplete (may under-count
     /// without a freeze drain). `may_undercount` only matters when the ledger is empty.
-    pub fn for_error_path(
+    pub(crate) fn for_error_path(
         ledger: Option<&xai_chat_state::UsageLedger>,
         may_undercount: bool,
     ) -> Option<Self> {
@@ -129,7 +129,7 @@ impl PromptUsage {
 
     /// Drop cost ticks when partial or incomplete so all wire surfaces fail closed.
     /// Incomplete bills clear ticks even when `cost_is_partial` is false.
-    pub fn scrub_untrustworthy_costs(&mut self) {
+    pub(crate) fn scrub_untrustworthy_costs(&mut self) {
         if !(self.usage_is_incomplete || self.totals.cost_is_partial) {
             return;
         }
@@ -282,7 +282,7 @@ pub fn ticks_to_usd(ticks: i64) -> f64 {
 }
 
 /// Full ACP input → headless uncached input (`full − cache_read`).
-pub fn uncached_input_tokens(full_input: u64, cached_read: u64) -> u64 {
+pub(crate) fn uncached_input_tokens(full_input: u64, cached_read: u64) -> u64 {
     full_input.saturating_sub(cached_read)
 }
 
@@ -294,7 +294,7 @@ pub fn uncached_input_tokens(full_input: u64, cached_read: u64) -> u64 {
 /// - Omits all cost floats when partial or incomplete (absence ≠ free).
 /// - Incomplete with no tokens emits only `usage_is_incomplete` (no zero usage object).
 /// - `modelUsage` rows are a reduced external-compat schema (camelCase; no reasoning/duration).
-pub fn project_result_usage(result: &mut serde_json::Value, usage: &PromptUsage) {
+pub(crate) fn project_result_usage(result: &mut serde_json::Value, usage: &PromptUsage) {
     if usage.usage_is_incomplete && usage.is_token_empty() {
         result["usage_is_incomplete"] = true.into();
         return;