Patch release with clearer external-auth re-login when a headless refresh can’t mint a token, tighter permission path matching, a broader read-only git allowlist, and full keyboard control for the question card.
Changelog
[fix] External auth providers that fail a headless refresh (for example when SSO needs an interactive sign-in) no longer leave a dead credential in place. Grok invalidates the stored token and runs the provider interactively instead — the same flow as a fresh machine at startup, or a re-auth prompt and /login mid-session so device-code URLs and browser prompts can reach you.
[fix] Read/Edit/Grep path rules now match after lexical normalization: ./.. are collapsed, relative paths are joined with the session working directory, and ~-prefixed paths match literally. Rooted patterns can no longer be escaped with traversal, and shell-touched paths use the same working-directory-aware rules.
[changed] More read-only git commands are permitted without extra approval, including blame, describe, merge-base, shortlog, check-ignore, check-attr, cat-file, ls-tree, show-ref, for-each-ref, rev-list, name-rev, and count-objects.
[new] The ask_user_question card owns the keyboard while it is open: arrows/hjkl to move, Tab/Shift+Tab to walk answers across questions, number/letter hotkeys to pick, free-text via z or Space, multi-select toggle, copy, dismiss (Shift+X), and fullscreen (Ctrl+F).
[changed] Scroll follow indicators are documented as ▼/▲ arrows (center or hidden), not a single down-arrow.
[changed] Session details still report OAuth vs API key (and still suggest grok login for SuperGrok on API-key sessions) but no longer embed account/billing management URLs.
[changed] The Imagine skill steers multi-panel work (storyboards, contact sheets, comic grids) through per-panel reference-anchored generation plus code assembly, and tightens video continuity by seeding connected shots from the previous frame.
[removed] The [shortcuts] config block is no longer part of the documented configuration surface (including the project-scoped config note).
Under the hood
Mid-session external auth refresh timeout is 7s (was 5s); the initial interactive run remains 60s.
Bundled content manifest bumped to public-2026-07-30-r1.
Upgrade notes
If you relied on a [shortcuts] section in ~/.grok/config.toml, remove it; keyboard behavior is no longer configured that way.
