Minor release: per-model auth providers for rotating gateway tokens, Claude Code–compatible stop-hook gates that can keep the agent working, and a swap of the background-task / tasks-pane shortcuts.
Changelog
[new]Per-model auth providers — Define named credential helpers under [auth_provider.<name>] and point a model at them with auth_provider. Helpers mint rotating bearer tokens (bare token or JSON with access_token / expires_in) for gateways such as LiteLLM or a corporate proxy, while xAI models keep normal session login. Tokens are cached in memory per provider, shared across models that reference it, and re-minted near expiry or on rejection; api_key / env_key still win when set. Provider tables are only honored from trusted config layers (not project .grok/config.toml).
[new]Stop decision control — Stop and SubagentStop hooks can block the agent from ending a turn (e.g. until tests pass) and feed a reason or additional context back to the model. Compatible with Claude Code’s decision vocabulary (decision: "block", additionalContext, continue: false). Gates run only on genuine completions; interrupt/error paths skip them or use StopFailure. Default timeout for these events is 600s; after 8 continuations in one turn the gate is overridden.
[changed]Hook matchers and payloads — Matchers now apply by event (tool name, notification type, subagent type, session start/end reason, compaction trigger, StopFailure error class). Every event includes common fields such as permissionMode. Stop input adds backgroundTasks and sessionCrons so gates can tell a finished turn from one waiting on background work. SubagentStop fires once per subagent turn with stop decision control.
[changed]Background / tasks shortcuts swapped — Ctrl+B sends the running foreground command to the background; Ctrl+G toggles the tasks pane (previously the reverse). Docs for keyboard shortcuts, background tasks, and subagents are updated to match.
Under the hood
Credential resolution order is now api_key → env_key → cached auth_provider token → session token → XAI_API_KEY. A cache miss on a provider-backed model does not fall back to the session token (BYOK).
Auth provider commands run with a bounded timeout, optional args (no shell), and hand back prior credentials via GROK_AUTH_PROVIDER_* env vars on refresh; first-party xAI keys are stripped from the helper environment.
Hook exit-code handling for stop gates aligns with Claude Code: valid decision JSON on stdout wins; exit 2 with no JSON blocks using stderr as feedback.
Upgrade notes
Relearn the pane shortcuts: background a running command with Ctrl+B, open the tasks pane with Ctrl+G.
If you already had passive Stop / SubagentStop hooks, they can now keep the agent in the turn when they return a block decision or exit 2 — gate only on reason == "end_turn" if you count or enforce completion, and size timeout for any verify/build step you run.
To route non-xAI models through a rotating-token gateway, add an [auth_provider.*] table in ~/.grok/config.toml (or managed config) and set auth_provider on those models; keep provider definitions out of project-level config.
