Classify Grok not-signed-in as provider authentication failure

src/external_agent/tests.rs

@@ -15312,7 +15312,13 @@ fn grok_native_auth_failure_is_environment_and_fails_closed() -> Result<()> {
     }
     // The same projection is used for held error/cancellation captures, before
     // summarized stdout can discard the error event.
+    let captured = include_bytes!(concat!(
+        env!("CARGO_MANIFEST_DIR"),
+        "/tests/fixtures/runtime_adapter/grok/not-signed-in.streaming-json"
+    ));
     for (stdout, stderr) in [
+        (captured.as_slice(), b"".as_slice()),
+        (b"".as_slice(), captured.as_slice()),
         (
             b"{\"type\":\"error\",\"message\":\"HTTP 401\"}\n".as_slice(),
             b"".as_slice(),
@@ -15336,6 +15342,17 @@ fn grok_native_auth_failure_is_environment_and_fails_closed() -> Result<()> {
         );
         retain_grok_stream_auth_failure(&mut report, ExternalAgentInvocation::Grok, stdout, stderr);
         assert_eq!(report.environment_failures().len(), 1);
+        assert_eq!(
+            serde_json::to_value(report.environment_failures()[0].category)?,
+            "provider_auth_required"
+        );
+        assert!(report.environment_blocked());
+        assert!(report
+            .error
+            .as_deref()
+            .unwrap()
+            .contains("provider_auth_required"));
+        assert!(!report.publishable);
         assert!(!report.succeeded());
     }
     Ok(())

src/runtime_adapter/grok.rs

@@ -143,6 +143,7 @@ fn is_inference_authentication_error(error: &str) -> bool {
     let lower = error.to_ascii_lowercase();
     lower.contains("unauthenticated")
         || lower.contains("not authenticated")
+        || lower.contains("not signed in")
         || lower.contains("unauthorized")
         || lower.contains("authentication required")
         || lower.contains("invalid api key")
@@ -2407,6 +2408,7 @@ mod tests {
             "HTTP 401: secret-fixture",
             "HTTP status 403 Forbidden: secret-fixture",
             "Unauthenticated: secret-fixture",
+            "nOt SiGnEd In: secret-fixture",
         ] {
             let event = serde_json::json!({"type": "error", "message": error}).to_string();
             assert!(inference_stream_authentication_failed(event.as_bytes()));
@@ -2433,6 +2435,22 @@ mod tests {
         assert!(!inference_stream_authentication_failed(
             b"{\"type\":\"available_commands\"}\n"
         ));
+        let captured = include_bytes!(concat!(
+            env!("CARGO_MANIFEST_DIR"),
+            "/tests/fixtures/runtime_adapter/grok/not-signed-in.streaming-json"
+        ));
+        assert!(inference_stream_authentication_failed(captured));
+        let message = serde_json::from_slice::<Value>(captured)?["message"]
+            .as_str()
+            .context("captured auth message")?
+            .to_string();
+        assert!(!inference_stream_authentication_failed(message.as_bytes()));
+        for kind in ["text", "available_commands"] {
+            let event = serde_json::json!({"type": kind, "message": message, "data": message});
+            assert!(!inference_stream_authentication_failed(
+                event.to_string().as_bytes()
+            ));
+        }
         Ok(())
     }
 

tests/fixtures/runtime_adapter/grok/not-signed-in.streaming-json

@@ -0,0 +1 @@
+{"type":"error","message":"Not signed in. To authenticate without a browser, run:\n  grok login --device-code\n\nAlternatively, set the XAI_API_KEY environment variable or run `grok login` on a machine with a browser."}