Synced from monorepo

Changes:
- grok-shell: request workspaces:read/write OAuth2 scopes
- security: fix SSRF bypass via HTTP redirect in hook runner
- fix(grok-build): enterprise STT WSS URL + API-key voice bearer
- Harden identity-change purge and sync-marker invariants
- sandbox + workspace-server: delete the legacy ready-file arm
- Show billing URL when browser cannot open
- fix(pager): show folder-trust UI in minimal mode
- fix(pager): drain task_backgrounded before no-wait headless exit
- grok-agent-sdk: stop SDK-spawned agents from staging self-updates they can never adopt
- Split settings_modal into directory module
- Delegate VS Code SSH file links
- grok-shell: release the workspace session binding when a session is removed
- keep skills reachable when their name collides with a client builtin
- Preserve semantic link targets

crates/codegen/xai-fast-worktree/src/api.rs

@@ -1411,11 +1411,15 @@ pub(crate) fn register_worktree(
             return;
         }
     };
+    // Same canonical path as discovery rebuild / WorktreeDb::get so macOS
+    // /var vs /private/var (and other symlink roots) do not create duplicate rows.
+    let path = dunce::canonicalize(worktree_path).unwrap_or_else(|_| worktree_path.to_path_buf());
+    let source = dunce::canonicalize(source).unwrap_or_else(|_| source.to_path_buf());
     let record = db::WorktreeRecord {
-        id: worktree_id.unwrap_or_else(|| db::id_from_path(worktree_path)),
-        path: worktree_path.to_path_buf(),
-        source_repo: source.to_path_buf(),
-        repo_name: db::repo_name_from_path(source),
+        id: worktree_id.unwrap_or_else(|| db::id_from_path(&path)),
+        path,
+        source_repo: source.clone(),
+        repo_name: db::repo_name_from_path(&source),
         kind,
         creation_mode: creation_mode.to_owned(),
         git_ref: Some(git_ref.to_owned()),
@@ -1435,7 +1439,9 @@ pub(crate) fn register_worktree(
 #[cfg(feature = "metadata")]
 fn unregister_worktree(worktree_path: &std::path::Path) {
     if let Ok(db) = crate::db::WorktreeDb::open_default() {
-        let _ = db.unregister_by_path(worktree_path);
+        let path =
+            dunce::canonicalize(worktree_path).unwrap_or_else(|_| worktree_path.to_path_buf());
+        let _ = db.unregister_by_path(&path);
     }
 }
 

crates/codegen/xai-fast-worktree/src/discovery.rs

@@ -125,10 +125,12 @@ impl DiscoveredWorktree {
             .unwrap_or_else(|| "unknown".to_string());
         let source_repo = self.source_repo.unwrap_or_else(|| PathBuf::from("unknown"));
         let created_at = fs_creation_time(&self.path);
+        // Match `WorktreeDb::get`, which looks up by canonical path.
+        let path = dunce::canonicalize(&self.path).unwrap_or(self.path);
 
         WorktreeRecord {
-            id: id_from_path(&self.path),
-            path: self.path,
+            id: id_from_path(&path),
+            path,
             source_repo,
             repo_name,
             kind: self.kind,
@@ -163,8 +165,9 @@ pub fn rebuild_worktree_db(
     };
 
     for wt in discovery.found {
-        let id = id_from_path(&wt.path);
-        let path_str = wt.path.to_string_lossy();
+        let path = dunce::canonicalize(&wt.path).unwrap_or_else(|_| wt.path.clone());
+        let id = id_from_path(&path);
+        let path_str = path.to_string_lossy();
         if db.get_by_id(&id)?.is_some() || db.get(&path_str)?.is_some() {
             report.already_tracked += 1;
             continue;