Synced from monorepo

Changes:
- Non-blocking coding-data sharing upsell banner
- Consolidate remediation in Doctor
- Auto mode defers fail-closed gate asks to the classifier
- Coalesce marketplace list fetches
- Allow removing a marketplace source by name
- Contain hung git marketplace sources (timeouts, non-blocking refresh, unbrick modal)
- Label failed workspace RPCs with error_kind
- Drop redundant explicit tonic/prost deps from xai-grok-shell
- Report real exit codes for completed background shells
- Narrow the date-rollover reminder to date-bearing templates
- Wire toolOverrides through the session and agent
- Security: Bash(git:*) allowlist matches whole command chain by prefix
- Split prompt-trigger telemetry and record classifier provenance
- Raise connectors-manager timeout to 60s
- Auto classifier honors recorded approvals for repeat actions
- Apply doctor fixes in the TUI
- Auto-mode classifier timeouts prompt instead of silently denying
- Scope subagent completion drains to the owning session
- Add the toolOverrides wire types
- Set client_identifier=grok-agent-sdk
- Accept both spellings of the workspace-teleport kill switch
- Persist one-shot occurrence journal
- Stop turns that poll the exact same tool call 16x in a row
- Copy compaction checkpoint files when forking sessions
- Auto-focus permission prompt from scrollback
- Esc cancels the running turn in non-vim and minimal modes
- List Ctrl+Z undo and redo in keyboard shortcuts
- Out-of-process macOS mic capture
- Show active auth mode on session-info
- Install the npm binary under $GROK_HOME
- Remove hover/click dead zones between dashboard items
- Route startup warnings to doctor
- Document [feedback.user] author identity config
- Extend bang command timeout
- Close combine-queued edit-hold race
- Integrate relocation recovery
- Expose privacy notice rollout flag
- Break harness discovery ref cycle so connections can idle-evict
- Shift/Alt+Enter inserts newline when editing a queued prompt
- Gate project Claude permissions on folder trust
- Echo response.create.event_id on response.created
- Toast when session creation fails from disk full
- Add shared test process lifecycle
- Enable dynamic workflows by default
- Add relocation transaction state machine
- Add shared test sandbox
- Surface auth failures on model-switch compact
- Persist durable scheduler expiry
- Confirm before removing extensions-modal items
- Re-run compact and prompt after login when compact hit expired auth
- Recap sends hosted tools under backend search

crates/codegen/xai-grok-pager-pty-harness/src/flows.rs

@@ -76,7 +76,7 @@ pub fn inference_request_count(content: &ContentController) -> usize {
 /// e2es (e.g. storage park-on-401) still enqueue traces — missing that field
 /// now deserializes as opted-out via
 /// `default_coding_data_retention_opt_out()`. The mock server accepts any
-/// bearer. Pair with [`oauth_env_for_pager`].
+/// bearer. Pair with [`oauth_credential_ops`].
 pub fn seed_fake_oauth(content: &ContentController, user: &str) {
     let grok_home = content.home().join(".grok");
     std::fs::create_dir_all(&grok_home).expect("create temp .grok");
@@ -102,12 +102,10 @@ pub fn seed_fake_oauth(content: &ContentController, user: &str) {
     .expect("seed fake oauth auth.json");
 }
 
-/// [`ContentController::env_for_pager`] minus `XAI_API_KEY`, so the entry
-/// written by [`seed_fake_oauth`] is the active credential.
-pub fn oauth_env_for_pager(content: &ContentController) -> Vec<(String, String)> {
-    let mut env = content.env_for_pager();
-    env.retain(|(k, _)| k != "XAI_API_KEY");
-    env
+/// Remove only the sandbox's fake API-key credential, allowing the `auth.json`
+/// entry written by [`seed_fake_oauth`] to determine the advertised auth method.
+pub fn oauth_credential_ops() -> [crate::EnvOp<'static>; 1] {
+    [crate::EnvOp::remove("XAI_API_KEY")]
 }
 
 /// Drive `/new` until `model` shows on screen. Campaigns apply to **new