Repository navigation
fix: preserve Grok authentication and terminal failure evidence - #52
Merged
Merged
Conversation
Grok API-key sessions were rejected by preflight, neighboring model names could pass availability checks, and cancellation/error events lost their status and metadata. Port the scoped upstream fixes for #39 while keeping pstack-flex's shared harness routing and execution constraints. - Accept subscription and XAI_API_KEY login evidence, reject explicit auth and model errors, and match regex-escaped exact model tokens. - Classify the full preflight response once and reuse its verdict for the bounded auth retry so truncated receipt evidence cannot cause a retry. - Preserve terminal messages, cancellation status, session, model proof, usage, and cost on both zero and nonzero Grok exits; keep terminal tails in bounded failure evidence and remove failed answer reservations. - Use auto permissions for headless read-only and isolated-write lanes while retaining each sandbox, cwd, tool list, and recursion restriction. - Cover both login forms, contradictory auth, neighboring model tokens, long preflight output, terminal status validation, and exit-code cases. Retain explicit deadlines, named dropouts, and the absence of implicit runtime timeouts or fallback models. Installed parent-surface validation remains pending; deliver this candidate as a draft PR. Refs: #39; ericlitman#130; upstream 47cd5a2
thisguymartin
marked this pull request as ready for review
October 13, 2026 22:39
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #39
What changed
Grok API-key sessions could fail preflight, neighboring model names could pass it, and cancellation or error events lost their terminal details. The runner now accepts both login forms, checks exact model tokens, and preserves failure messages, session identity, model evidence, usage, and cost on zero and nonzero exits.
autofor both headless modes with the existing sandboxes, cwd, tool lists, and recursion restrictions.Ported the Grok changes from upstream #130 and 47cd5a2. Full upstream import pins stay unchanged. Stream capture already retains the required output, so Sync 4 is not a dependency.
Review
runner/run.tsfor retry classification and launcher cancellation/deadline precedence;runner/commands.tsretains the sandbox and tool boundaries.Mermaid/mer-inkdrop: terminal failures retain their metadata while the runner removes the answer file.
Verification
bash scripts/check.sh: 296 tests passed, 0 failed; strict typecheck, static invariants, manifest parsing, and both Claude plugin validations passed. Diff security scan: no confirmed findings.Live evidence:
A pull request without live evidence remains a draft. Do not merge, tag, release, or roll it out.