Synced from monorepo

Synced from monorepo

Changes:
- grok-shell: send an expired external-provider credential to the sign-in flow, not a 401 loop
- pager: clickable ▲ jumps to the top of the response being read
- grok-shell: keep a large task log from making the completion message too long
- Plan viewer scrollbar: widen grab zone to the border column; fix striped thumb in Terminal.app
- pager: poll the tmux probe teardown grace instead of sleeping it
- security: vendor-compat MCP kill switch is now actually enforced when reported as on
- grok-shell: restore session eviction when a leader client disconnects
- Bump rust-toolchain to 1.93.0
- workspace: lexical-normalize permission path patterns before glob matching
- pager: reject garbage Enter in the /resume picker
- pager: show Mermaid affordances in plan mode preview
- pager: drop manage-account link from /session-info
- workspace: auto-approve read-only git queries; defer write floor to auto classifier
- Add free-form pattern editor to the "Always allow" command prompt
- grok-shell: fix /btw caching
- pager: Tab walks answers in the ask_user_question card
- External-provider auth refresh: single 7s attempt instead of 3×5s
- pager: don't resurrect finished background tasks as Running when completion arrives first
- pager: report tmux truecolor clamping in Doctor
- Fix plan viewer scrollbar click+drag hijacked by comment gutter
- pager/shell: stop double Recap after the same last turn
- sampler: preserve x-should-retry through stream collection
- pager: clear plan-mode indicator immediately when the user approves a plan
- pager: tmux does not re-read its config on reattach

Source-Revision: 64c4de99cc822b25ce9c54ab5a4f372093d0885d

crates/codegen/xai-grok-telemetry/Cargo.toml

@@ -70,8 +70,20 @@ opentelemetry_sdk = { workspace = true, features = [
     "experimental_metrics_periodicreader_with_async_runtime",
     "rt-tokio-current-thread",
 ] }
-opentelemetry-otlp = { workspace = true }
+# `tls-aws-lc` compiles opentelemetry-otlp's TLS support for the gRPC
+# transport. The workspace default is only `tls-roots`, which since otlp 0.32
+# no longer implies a TLS provider feature — without one, every `https://`
+# gRPC collector endpoint is rejected at exporter build time (GB-4580).
+# aws-lc matches the TLS backend the workspace `tonic` already uses.
+opentelemetry-otlp = { workspace = true, features = ["tls-aws-lc"] }
 opentelemetry-http = { workspace = true }
+# Embedded Mozilla trust anchors for the gRPC TLS fallback: keeps `https://`
+# collectors working on hosts with no readable system CA store (parity with
+# the HTTP transport's embedded-roots reqwest client in `otlp_http.rs`).
+webpki-roots = { workspace = true }
+# Re-encodes the validated GROK_EXTRA_CA_BUNDLE DERs as PEM for tonic's
+# `Certificate::from_pem` (the gRPC transport's extra-CA parity with HTTP).
+base64 = { workspace = true }
 http = { workspace = true }
 bytes = { workspace = true }
 async-trait = { workspace = true }
@@ -83,6 +95,12 @@ tracing-opentelemetry = { workspace = true }
 # Pre-main unified-log redirect for this crate's own test binary.
 ctor = { workspace = true }
 tonic = { workspace = true, features = ["transport"] }
+# Self-signed CA + server cert for the TLS collector fixture
+# (tests/external_otlp_grpc_tls.rs). `rustls` pins the process-default crypto
+# provider there: the test binary links both ring and aws-lc-rs, so rustls
+# can't auto-select one for the server-side acceptor.
+rcgen = { workspace = true }
+rustls = { workspace = true }
 # In-memory log/metric exporters for the external-stream wire-shape tests.
 opentelemetry_sdk = { workspace = true, features = ["testing"] }
 # In-process OTLP collector fixture (tests/external_otlp.rs).