Patch release focused on external auth provider behaviour: clearer headless-refresh vs interactive sign-in contracts, faster handover when a silent refresh cannot mint, and matching docs and telemetry.
Changelog
[changed] External auth providers are run on two explicit contracts, distinguished by GROK_AUTH_EXPIRED. With the variable set (=1), Grok treats the run as a headless refresh over a credential it already holds: stdin is closed, stderr is not shown, and the process has only a few seconds (then is killed). Mint silently or exit non-zero — never block or prompt. With the variable unset, the run is a sign-in (grok login, the sign-in screen, or escalation after a failed headless mint): a user is attached, stderr reaches them, and the timeout is 300s.
[changed] When a headless refresh cannot produce a token, Grok stops treating the stored credential as usable and starts the interactive sign-in flow. Exiting promptly on GROK_AUTH_EXPIRED=1 makes that handover fast; a binary that blocks forces a full refresh-timeout wait on every start with an expired token.
[changed] Auth provider logs now label the contract: auth: running external auth provider (headless refresh) vs (interactive login), and the timeout message refers specifically to the short headless-refresh budget.
[changed] Leader mode (--leader, or [cli] use_leader = true; off by default) documents one edge case: with no credential at all, the leader may make one background attempt just after startup with the variable unset. Binaries that can mint without a user (service account, keytab, mounted token) can heal the session; binaries that must prompt sit up to the sign-in ceiling while the sign-in screen is already up, with stderr going to ~/.grok/leader.log.
[changed]grok_code.skill_activated telemetry now includes trigger (slash_command | skill_md_read | skill_tool) so skill activations can be attributed by how they were invoked.
[changed] Authentication and monitoring docs (and the main README auth examples) updated for the contracts above, including sample binaries that exit 1 when silent refresh fails.
Under the hood
Internal codegen support for repo-change handling (xai-repo-changes).
Docs and config examples no longer surface a top-level [shortcuts] block; project-scoped config notes refer to models and other user config without calling out shortcuts separately.
Upgrade notes
If you ship a custom auth binary: on GROK_AUTH_EXPIRED=1, prefer a fast silent mint or a non-zero exit over any interactive path. Blocking on the headless contract still works only until the short timeout kills the process, and delays the interactive sign-in handoff.
GROK_AUTH_EXPIRED remains optional — binaries that ignore it still run, but a prompting flow will be killed on headless refresh before it can finish.
