Synced from monorepo

Changes:
- Gate session-lifecycle heap steady state with a dhat soak
- Unbreak merge lifecycle e2e after default model → grok-4.5
- Scan home-scope rules dirs at <root>/rules
- Complete text-input paste and terminal parity
- Gate project roles and personas
- Use canonical editing in dialogs
- Use canonical editing in search bars
- Reject ambiguous MCP tool IDs
- Harden Git operands for plugins
- Simplify queue drain API
- Pass RFC 9207 iss through MCP OAuth token exchange
- Show leader roster when local agents map is empty
- Use canonical editing in Persona views
- Remove marketplace default-skills auto-install and purge old installs
- Use canonical editing in extension forms
- Add canonical dashboard text editing
- Use canonical editing in settings
- Add /summarize as a /recap alias
- Restore previous agent when exiting dashboard
- Use tool_choice auto for compaction
- Settings toggle for snap-prompt-to-top on send
- Update default models to grok-4.5
- Source login shell once for local bash (env + alias/function snapshot)
- Template hardcoded param names in server-native tool descriptions
- Fix System-Reminder XML tag injection in CLAUDE.md via agents_md
- Fix remote workspace-server hardcoding LSP trust (repo code execution risk)
- Clear orphaned tool-call updates at turn end
- Suppress task wake after cancel
- Send x-grok-client-identifier on direct API tool calls
- Harden dashboard peek lease transitions
- Host /btw side panel in live region (minimal mode)
- Bound scroll presentation latency
- Highlight multi-line constructs correctly in diffs and the file viewer
- Block web_fetch non-public IPs; local opt-in is explicit-host only
- Seed coding_data_retention_opt_out=false for OAuth e2es in pty-harness
- Follow up clipboard delivery feedback
- Use canonical editing in pickers
- Route TextArea through canonical editor
- Persistent "watching" status row; quieter turn markers
- Gate sensitive edit targets
- Expose agent registry counts and gate session churn on them
- Default coding data sharing to opt-out until server preference applies
- Wire chat attachment ids through gateway prompts
- On auth refresh failure, issue retry
- Forward preview provenance and computer lifecycle state
- Document independent privacy controls and scope /privacy output
- Strip SamplingError Display prefix on rate-limit UI copy
- Stop dumping Cloudflare HTML into Retry failed
- Disable in-place prompt edit (scroll jank on enter)
- Strip forced ANSI color from gh pr view JSON
- Plumb bash tool description onto ToolUsageCard wire

crates/codegen/xai-grok-workspace/src/bin/workspace_server.rs

@@ -81,6 +81,15 @@ struct Args {
     /// instead of widening to the built-in default catalog.
     #[arg(long)]
     require_explicit_toolset: bool,
+    /// Trust project-scoped LSP servers from `<repo>/.grok/lsp.json`.
+    /// Defaults off; sandbox opts in only after workspace trust is established.
+    #[arg(
+        long,
+        env = "GROK_WORKSPACE_PROJECT_LSP_TRUSTED",
+        default_value_t = false,
+        action = clap::ArgAction::Set,
+    )]
+    project_lsp_trusted: bool,
     /// Confine `x.ai/fs/*` resolution to the workspace root (reject `..`,
     /// absolute-outside-root, symlink escapes). On by default: the standalone
     /// server always backs a remote-sandbox workspace, a real tenant boundary.
@@ -338,7 +347,6 @@ async fn run(args: Args, cwd: PathBuf) -> anyhow::Result<()> {
     } else {
         None
     };
-    let project_lsp_trusted = true;
     let preview_scrape_interval = status_config.preview_activity_scrape_interval;
     xai_grok_workspace::init_metrics();
     let ws_handle = xai_grok_workspace::handle::connect_local_workspace(
@@ -351,7 +359,7 @@ async fn run(args: Args, cwd: PathBuf) -> anyhow::Result<()> {
         args.allow_insecure_ws,
         status_config,
         args.upload_queue_enabled,
-        project_lsp_trusted,
+        args.project_lsp_trusted,
         Some(diag_handle.clone()),
         args.require_explicit_toolset,
         args.confine_fs_to_workspace_root,
@@ -448,6 +456,15 @@ mod tests {
         assert!(args.capabilities);
     }
     #[test]
+    fn project_lsp_trust_defaults_off_and_is_opt_in() {
+        unsafe { std::env::remove_var("GROK_WORKSPACE_PROJECT_LSP_TRUSTED") };
+        let args = Args::try_parse_from(["xai-workspace-server"]).unwrap();
+        assert!(!args.project_lsp_trusted);
+        let args = Args::try_parse_from(["xai-workspace-server", "--project-lsp-trusted", "true"])
+            .unwrap();
+        assert!(args.project_lsp_trusted);
+    }
+    #[test]
     fn capabilities_manifest_shape() {
         let value = serde_json::to_value(CAPABILITIES).unwrap();
         assert_eq!(value, serde_json::json!({ "diag" : true }));