Synced from monorepo

Synced from monorepo

Changes:
- Workspace server: report `/ready` as failed with dwell on hub connect failure
- Refresh OIDC token for the Grok agent in the shell
- ACP terminal output recorder
- Cross-platform provider auth commands in the shell
- Default `/resume` to Grok sessions with a hint for hidden external sessions
- Resume sessions by title with `--resume`
- Limit app-builder archive size
- Data-driven tag labels for slash commands
- Doctor fixes for tmux
- Custom provider gateways and subprocess environment policy in the shell
- `/tutorial` — opt-in onboarding tour of Grok Build
- Soft and required CLI version checks in the shell
- Privacy banner env overrides survive live settings updates
- Add remote flag to override the image-edit model
- Return profile fields from auth info even when the access token is expired
- Add edit control on queued prompt rows
- Keep fail-closed policy when clearing orphans with no team
- Setting to disable the Ctrl+Space/F8 voice shortcut
- Pass `--raw` to pw-record so Linux dictation works on older PipeWire
- Validate git URLs when adding marketplace entries
- Stop shipping stale tool-doc parameter and tool names
- Re-point dashboard attach after `/fork` only when the parent was attached
- Surface Grok Computer media-generation results as file-path chunks
- Clear web background-task tray on kill and keep the task description
- Show privacy upsell banner in agent view until acted on
- Add tools-server client callback surface
- Protect persistent global hook sources

Source-Revision: 95d84f443eddcbed6cbfd6eed22e2eafe6b3939d

crates/codegen/xai-tty-utils/src/lib.rs

@@ -402,18 +402,24 @@ pub const GIT_AUTH_SUPPRESSION_ENVS: [(&str, &str); 4] = [
 ///
 /// Respects `GIT_BIN_PATH` for hermetic git in Bazel test sandboxes.
 pub fn git_command() -> std::process::Command {
+    let mut hermetic_exec_path: Option<std::path::PathBuf> = None;
     let git = match std::env::var("GIT_BIN_PATH") {
         Ok(p) => {
             let p = std::path::PathBuf::from(p);
-            if p.is_relative() {
-                std::env::current_dir()
-                    .unwrap_or_default()
-                    .join(&p)
-                    .to_string_lossy()
-                    .into_owned()
+            let p = if p.is_relative() {
+                std::env::current_dir().unwrap_or_default().join(&p)
             } else {
-                p.to_string_lossy().into_owned()
+                p
+            };
+            // git-minimal spawns subcommands (`git stash` → `git
+            // update-index`) through its exec path, which is baked to a
+            // build-machine prefix. Helpers live next to the binary, so point
+            // the exec path there. Skip the host-fallback wrapper: host git
+            // must keep its own exec path.
+            if p.file_name().is_some_and(|name| name == "git") {
+                hermetic_exec_path = p.parent().map(std::path::Path::to_path_buf);
             }
+            p.to_string_lossy().into_owned()
         }
         Err(_) => "git".to_string(),
     };
@@ -424,6 +430,9 @@ pub fn git_command() -> std::process::Command {
     for &(key, val) in &GIT_AUTH_SUPPRESSION_ENVS {
         cmd.env(key, val);
     }
+    if let Some(exec_path) = hermetic_exec_path {
+        cmd.env("GIT_EXEC_PATH", exec_path);
+    }
     cmd.arg("--no-optional-locks");
     cmd
 }