Skip to content

HB-5 - #218

Merged
cryptoquick merged 2 commits into
mainfrom
HB-5
Oct 19, 2026
Merged

HB-5#218
cryptoquick merged 2 commits into
mainfrom
HB-5

Conversation

@cryptoquick

Copy link
Copy Markdown
Member

HB-5 for the Operator. Tracking: #217.

Branch HB-5 on top of main (decb0527, #208).

just check-remote EXIT 0, drv 0ny123dygsl259ch7csm64bzacfvh6ql. 38033 tests passed, 1 flaky, 646 skipped. Installed grok-oss 1.0.45 (4a8739f5da61).

cargo-audit leftover stays #214.

@cryptoquick
cryptoquick merged commit 182293c into main Oct 19, 2026
1 check passed
@cryptoquick
cryptoquick deleted the HB-5 branch October 19, 2026 04:26
@cryptoquick cryptoquick mentioned this pull request Oct 19, 2026
cryptoquick added a commit that referenced this pull request Oct 19, 2026
HB-5 follow-up after #218. Tracking: #217.

#218 already merged into `main` as `182293cb`. This PR still contains
those commits plus the nested 401 land that was missing from the
installed `4a8739f5` binary. GitHub reports merge conflicts because the
same nested-auth files were edited on both sides. Resolving that is a
merge of `origin/main` into `HB-5`, keeping the recoveredBearer
follow-up.

## Nested 401 still (#215)

After #218 / grok-oss 1.0.45 (`4a8739f5da61`), nested spawn still 401'd:

`Invalid or expired credentials (auth_kind=bearer,
x_xai_token_auth=xai-grok-cli, upstream=PermissionDenied, reason=no auth
context)`

The parent kept talking. Nested views sat on Logging in / Waiting for
the model for minutes. Orange "Authentication temporarily unavailable"
was the wrong banner. The first 401 only stamped `attempt.error` and did
not POST again. `SetApiKey` raced the nested POST. The child resubmitted
its own spawn JWT.

This land:

- Nested missing-auth 401 is `auth`, not `auth_transient`.
- The first 401 queues `UnstickResendPrompt` with `recoveredBearer`
immediately.
- `AuthComplete` still starts that nested POST with the parent sampler
JWT.
- Await `CurrentApiKey` after `SetApiKey`.
- Nested stamp does not resubmit the child's own JWT.
- Do not paint `/login` while the parent still talks.

Named tests that passed on the remote gate:

-
`apply_retry_state_nested_bearer_no_auth_context_does_not_paint_login_while_parent_talks`
-
`apply_retry_state_nested_bearer_no_auth_context_does_not_paint_authentication_temporarily_unavailable`
-
`nested_bearer_no_auth_context_is_not_authentication_temporarily_unavailable`
-
`child_nested_bearer_no_auth_context_401_retries_with_recovered_bearer`
-
`auth_complete_after_nested_bearer_no_auth_context_401_starts_nested_post_with_recovered_bearer`

## Already on main via #218, still on this branch

- Connecting splash timeout (#212)
- Plan images on revise (#213)
- Nested 401 plus resume-after-login first cut (#215)
- Inference endpoint plus API key for the entire client (#216)

## Quality

`just check-remote` EXIT 0 after the E0499 borrow fix (`retry_effects`
then extend). 38037 tests passed, 646 skipped. Named recoveredBearer
tests PASS.

`just install` EXIT 0. Installed grok-oss 1.0.45 (`d67b795e360c`),
197229712 bytes, mtime 2026-10-19 14:56:20 -0600. Tip of this branch is
`1db326c6`.

cargo-audit leftover stays #214. yaml-rust remains in the lock until
`cargo update -p syntect` on a permitted host. paste, smartstring, and
bincode stay blocked on parents. No vendor, no `--ignore`.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant