Synced from monorepo

Changes:
- Classify clipboard delivery confidence
- Add durable session update append
- Scope the xAI session bearer to first-party memory embedding endpoints
- Persist subagent outputs to disk and bound long-lived agent state
- Add MiniSweAgent:bash for mini-swe-agent parity
- Revert taking local sessions off the persistent shell
- Contextual tip recommending grok wrap on SSH sessions
- Voice STT bearer from model BYOK env_key/api_key
- Define exact website policies for sandbox
- Gate unsafe shell environments
- Shared pin hoist; single require_sha gate for marketplace plugins
- Server-signed is-managed claim (closes sidecar-removal downgrade)
- Optional require_sha pin for remote plugin installs
- Show session title and last exchange in the exit resume hint
- Gate shell output redirects
- Warn when fail_closed is present but not a boolean
- Add canonical text editing core (ratatui-textarea)
- Keep execution state out of goal scratch
- Add acknowledged persistence primitives
- Inherit child network restrictions in sandbox
- Fail closed when hook matchers fail to recompile
- Add MCP setup preferences for plugin MCPs
- Gate sourced shell scripts
- Gate file-typed project hooks
- grok wrap: restore terminal modes on child death
- Harden owner-only permissions on auth and MCP credentials
- Create crash dump files with owner-only permissions
- Write the agent_id cache owner-only (0600)
- SessionMetrics mode skips Mixpanel profile sync
- Dashboard: slim live-tail peek
- Yank full queued prompt text, not (+N lines)
- Defeat clock-rollback on the signed managed-config cache
- Stop early session/cancel from overtaking the prompt and wedging the turn slot
- Self-heal a diverged agent entrypoint on startup
- Add matched inference expectations in test-support
- Add AuthSingleFlight cancel/successor gap tests
- Remove consumer from external OTEL allowlist and pin scrub coverage
- Enable /copy in minimal mode
- Surface capacity and API-key detail on 429 errors
- Single-flight interactive auth
- Fix PageUp/PageDown skipping lines behind sticky prompt header

crates/codegen/xai-grok-pager/docs/user-guide/09-plugins.md

@@ -132,11 +132,35 @@ The `<source>` argument accepts:
 
 - `user/repo` -- GitHub shorthand
 - `user/repo@v1.0` -- pinned to a ref
+- `user/repo@<commit-sha>` -- pinned to an exact commit (verified after fetch)
 - `user/repo#subdir` -- subdirectory within the repo
 - `https://github.com/user/repo.git` -- full URL
 - `git@github.com:user/repo.git` -- SSH
 - `./local-dir` or `/absolute/path` -- local directory
 
+### Requiring commit pins (`require_sha`)
+
+Remote plugins are not cryptographically signed: an install that tracks a
+branch or tag runs whatever that ref points at tomorrow. Operators can require
+every remote install and update to pin a full commit sha (40- or 64-hex,
+verified against the fetched checkout):
+
+```toml
+# config.toml
+[marketplace]
+require_sha = true
+```
+
+or `GROK_MARKETPLACE_REQUIRE_SHA=1`. Both are tighten-only: either one enables
+the policy and neither can switch it back off. With the policy on, unpinned
+remote installs, marketplace installs without a published `sha`, and updates of
+branch-tracking installs are refused.
+
+Scope: the policy covers everything fetched from a remote git URL at install or
+update time. Plugins vendored inside a marketplace source itself are copied
+from that source's synced checkout and are not covered — pin your marketplace
+source's content by publishing `sha` entries in `plugin-index.json`.
+
 ### Marketplace commands
 
 ```bash