Synced from monorepo

Changes:
- Classify clipboard delivery confidence
- Add durable session update append
- Scope the xAI session bearer to first-party memory embedding endpoints
- Persist subagent outputs to disk and bound long-lived agent state
- Add MiniSweAgent:bash for mini-swe-agent parity
- Revert taking local sessions off the persistent shell
- Contextual tip recommending grok wrap on SSH sessions
- Voice STT bearer from model BYOK env_key/api_key
- Define exact website policies for sandbox
- Gate unsafe shell environments
- Shared pin hoist; single require_sha gate for marketplace plugins
- Server-signed is-managed claim (closes sidecar-removal downgrade)
- Optional require_sha pin for remote plugin installs
- Show session title and last exchange in the exit resume hint
- Gate shell output redirects
- Warn when fail_closed is present but not a boolean
- Add canonical text editing core (ratatui-textarea)
- Keep execution state out of goal scratch
- Add acknowledged persistence primitives
- Inherit child network restrictions in sandbox
- Fail closed when hook matchers fail to recompile
- Add MCP setup preferences for plugin MCPs
- Gate sourced shell scripts
- Gate file-typed project hooks
- grok wrap: restore terminal modes on child death
- Harden owner-only permissions on auth and MCP credentials
- Create crash dump files with owner-only permissions
- Write the agent_id cache owner-only (0600)
- SessionMetrics mode skips Mixpanel profile sync
- Dashboard: slim live-tail peek
- Yank full queued prompt text, not (+N lines)
- Defeat clock-rollback on the signed managed-config cache
- Stop early session/cancel from overtaking the prompt and wedging the turn slot
- Self-heal a diverged agent entrypoint on startup
- Add matched inference expectations in test-support
- Add AuthSingleFlight cancel/successor gap tests
- Remove consumer from external OTEL allowlist and pin scrub coverage
- Enable /copy in minimal mode
- Surface capacity and API-key detail on 429 errors
- Single-flight interactive auth
- Fix PageUp/PageDown skipping lines behind sticky prompt header

crates/codegen/xai-grok-pager/src/app/effects/mod.rs

@@ -81,6 +81,10 @@ pub(crate) fn execute(
                     TaskResult::LogoutComplete
                 });
         }
+        Effect::CancelAuth { request_seq } => {
+            let tx = acp_tx.clone();
+            tasks.spawn(async move { send_auth_cancel(&tx, request_seq).await });
+        }
         Effect::CheckSubscription { verify } => {
             let tx = acp_tx.clone();
             tasks.spawn(async move { send_check_subscription(&tx, verify).await });
@@ -1900,7 +1904,7 @@ pub(crate) fn execute(
         }
         Effect::PollAuthUrl { request_seq } => {
             let tx = acp_tx.clone();
-            tasks
+            let abort_handle = tasks
                 .spawn(async move {
                     let mut auth_url: Option<String> = None;
                     let mut external = false;
@@ -1944,6 +1948,7 @@ pub(crate) fn execute(
                         mode,
                     }
                 });
+            meta.auth_url_poll_handle = Some((request_seq, abort_handle));
         }
         Effect::SubmitAuthCode { request_seq, code } => {
             let tx = acp_tx.clone();
@@ -2043,7 +2048,24 @@ pub(crate) fn execute(
                                 .and_then(|s| s.as_str())
                                 .unwrap_or("unknown");
                             if status == "authenticated" {
-                                Ok(())
+                                Ok(
+                                    crate::app::actions::McpAuthTriggerOutcome::Authenticated,
+                                )
+                            } else if status == "setup_required" {
+                                let setup = result_obj
+                                    .and_then(|r| r.get("setup"))
+                                    .cloned()
+                                    .and_then(|value| {
+                                        serde_json::from_value::<
+                                            crate::views::mcps_modal::McpSetupConfig,
+                                        >(value)
+                                            .ok()
+                                    })
+                                    .ok_or_else(|| "setup required".to_string());
+                                setup
+                                    .map(
+                                        crate::app::actions::McpAuthTriggerOutcome::SetupRequired,
+                                    )
                             } else {
                                 let detail = result_obj
                                     .and_then(|r| r.get("error"))
@@ -2066,6 +2088,51 @@ pub(crate) fn execute(
                     }
                 });
         }
+        Effect::McpSetupSubmit { agent_id, session_id, server_name, values } => {
+            let tx = acp_tx.clone();
+            tasks
+                .spawn(async move {
+                    let params = serde_json::json!(
+                        { "sessionId" : session_id.0.to_string(), "serverName" :
+                        server_name, "values" : values, }
+                    );
+                    let req = acp::ExtRequest::new(
+                        "x.ai/mcp/setup",
+                        serde_json::value::to_raw_value(&params)
+                            .expect("serialize mcp/setup params")
+                            .into(),
+                    );
+                    let result = match acp_send(req, &tx).await {
+                        Ok(resp) => {
+                            let wrapper: serde_json::Value = serde_json::from_str(
+                                    resp.0.get(),
+                                )
+                                .unwrap_or_default();
+                            let result_obj = wrapper.get("result");
+                            if result_obj
+                                .and_then(|r| r.get("ok"))
+                                .and_then(|ok| ok.as_bool())
+                                .unwrap_or(false)
+                            {
+                                Ok(())
+                            } else {
+                                let detail = result_obj
+                                    .and_then(|r| r.get("error"))
+                                    .and_then(|e| e.as_str())
+                                    .map(|s| s.to_string())
+                                    .unwrap_or_else(|| "setup failed".to_string());
+                                Err(detail)
+                            }
+                        }
+                        Err(e) => Err(sanitize_user_error(&format!("setup failed: {e}"))),
+                    };
+                    TaskResult::McpSetupSubmitDone {
+                        agent_id,
+                        server_name,
+                        result,
+                    }
+                });
+        }
         Effect::FetchHooksList { agent_id, session_id } => {
             let tx = acp_tx.clone();
             tasks
@@ -4180,17 +4247,9 @@ fn format_session_info(
         .as_deref()
         .map(|b| format!("\n  API Backend: {b}"))
         .unwrap_or_default();
-    let sandbox_line = match xai_grok_sandbox::profile_name() {
-        Some(profile) => {
-            let net = if xai_grok_sandbox::should_restrict_child_network() {
-                " (network: restricted)"
-            } else {
-                ""
-            };
-            format!("\n  Sandbox: {profile}{net}")
-        }
-        None => String::new(),
-    };
+    let sandbox_line = xai_grok_sandbox::profile_name()
+        .map(|profile| format!("\n  Sandbox: {profile}"))
+        .unwrap_or_default();
     let turn_line = format!("\n  Turn: {}", info.data.turn_index);
     let conversation_line = info
         .data