Synced from monorepo

Changes:
- Classify clipboard delivery confidence
- Add durable session update append
- Scope the xAI session bearer to first-party memory embedding endpoints
- Persist subagent outputs to disk and bound long-lived agent state
- Add MiniSweAgent:bash for mini-swe-agent parity
- Revert taking local sessions off the persistent shell
- Contextual tip recommending grok wrap on SSH sessions
- Voice STT bearer from model BYOK env_key/api_key
- Define exact website policies for sandbox
- Gate unsafe shell environments
- Shared pin hoist; single require_sha gate for marketplace plugins
- Server-signed is-managed claim (closes sidecar-removal downgrade)
- Optional require_sha pin for remote plugin installs
- Show session title and last exchange in the exit resume hint
- Gate shell output redirects
- Warn when fail_closed is present but not a boolean
- Add canonical text editing core (ratatui-textarea)
- Keep execution state out of goal scratch
- Add acknowledged persistence primitives
- Inherit child network restrictions in sandbox
- Fail closed when hook matchers fail to recompile
- Add MCP setup preferences for plugin MCPs
- Gate sourced shell scripts
- Gate file-typed project hooks
- grok wrap: restore terminal modes on child death
- Harden owner-only permissions on auth and MCP credentials
- Create crash dump files with owner-only permissions
- Write the agent_id cache owner-only (0600)
- SessionMetrics mode skips Mixpanel profile sync
- Dashboard: slim live-tail peek
- Yank full queued prompt text, not (+N lines)
- Defeat clock-rollback on the signed managed-config cache
- Stop early session/cancel from overtaking the prompt and wedging the turn slot
- Self-heal a diverged agent entrypoint on startup
- Add matched inference expectations in test-support
- Add AuthSingleFlight cancel/successor gap tests
- Remove consumer from external OTEL allowlist and pin scrub coverage
- Enable /copy in minimal mode
- Surface capacity and API-key detail on 429 errors
- Single-flight interactive auth
- Fix PageUp/PageDown skipping lines behind sticky prompt header

crates/codegen/xai-grok-shell/src/auth/credential_provider.rs

@@ -87,6 +87,24 @@ impl AuthCredentialProvider for ShellAuthCredentialProvider {
         self.static_credentials.deployment_key.is_none()
     }
 }
+/// Resolves the embedding credentials for `embed_base_url`, attaching the xAI
+/// session credential only to xAI-operated endpoints over `https`.
+pub(crate) fn embedding_session_credentials(
+    embed_base_url: &str,
+    auth_manager: Option<&Arc<AuthManager>>,
+    api_key_provider: Option<xai_grok_tools::types::SharedApiKeyProvider>,
+) -> xai_grok_memory::EndpointScopedCredentials {
+    let auth_credentials = auth_manager.map(|am| {
+        Arc::new(ShellAuthCredentialProvider::new(am.clone(), None, None))
+            as Arc<dyn AuthCredentialProvider>
+    });
+    xai_grok_memory::EndpointScopedCredentials::for_endpoint(
+        embed_base_url,
+        crate::util::is_xai_api_bearer_url,
+        auth_credentials,
+        api_key_provider,
+    )
+}
 /// Build a `StorageClient` for proxy uploads (including the high-volume
 /// `batch_upload` used for repo context / `repo_changes_dedup`).
 ///
@@ -568,6 +586,31 @@ mod tests {
             "snapshot must reflect refreshed token for subsequent apply() calls"
         );
     }
+    #[test]
+    fn embedding_session_credentials_scopes_to_first_party() {
+        let _guard = EarlyInvalidationGuard::pin_to_default();
+        let dir = tempfile::tempdir().unwrap();
+        let mgr = make_manager(
+            &dir,
+            Some(make_auth("xai-session-token", ChronoDuration::hours(1))),
+        );
+        let api_key_provider: xai_grok_tools::types::SharedApiKeyProvider =
+            Arc::new(crate::auth::manager::SharedAuthKeyProvider(mgr.clone()));
+        for denied in ["https://byok.attacker.example/v1", "http://api.x.ai/v1"] {
+            let resolved =
+                embedding_session_credentials(denied, Some(&mgr), Some(api_key_provider.clone()));
+            assert!(
+                resolved.is_empty(),
+                "session credentials must not reach {denied}"
+            );
+        }
+        let resolved = embedding_session_credentials(
+            "https://api.x.ai/v1",
+            Some(&mgr),
+            Some(api_key_provider),
+        );
+        assert!(!resolved.is_empty());
+    }
     /// Deployment-key path has no recovery (operator owns the bearer).
     #[tokio::test]
     async fn refresh_after_unauthorized_is_noop_for_deployment_key() {