Synced from monorepo

Changes:
- grok-shell: request workspaces:read/write OAuth2 scopes
- security: fix SSRF bypass via HTTP redirect in hook runner
- fix(grok-build): enterprise STT WSS URL + API-key voice bearer
- Harden identity-change purge and sync-marker invariants
- sandbox + workspace-server: delete the legacy ready-file arm
- Show billing URL when browser cannot open
- fix(pager): show folder-trust UI in minimal mode
- fix(pager): drain task_backgrounded before no-wait headless exit
- grok-agent-sdk: stop SDK-spawned agents from staging self-updates they can never adopt
- Split settings_modal into directory module
- Delegate VS Code SSH file links
- grok-shell: release the workspace session binding when a session is removed
- keep skills reachable when their name collides with a client builtin
- Preserve semantic link targets

crates/codegen/xai-fast-worktree/src/api.rs

@@ -1411,11 +1411,15 @@ pub(crate) fn register_worktree(
             return;
         }
     };
+    // Same canonical path as discovery rebuild / WorktreeDb::get so macOS
+    // /var vs /private/var (and other symlink roots) do not create duplicate rows.
+    let path = dunce::canonicalize(worktree_path).unwrap_or_else(|_| worktree_path.to_path_buf());
+    let source = dunce::canonicalize(source).unwrap_or_else(|_| source.to_path_buf());
     let record = db::WorktreeRecord {
-        id: worktree_id.unwrap_or_else(|| db::id_from_path(worktree_path)),
-        path: worktree_path.to_path_buf(),
-        source_repo: source.to_path_buf(),
-        repo_name: db::repo_name_from_path(source),
+        id: worktree_id.unwrap_or_else(|| db::id_from_path(&path)),
+        path,
+        source_repo: source.clone(),
+        repo_name: db::repo_name_from_path(&source),
         kind,
         creation_mode: creation_mode.to_owned(),
         git_ref: Some(git_ref.to_owned()),
@@ -1435,7 +1439,9 @@ pub(crate) fn register_worktree(
 #[cfg(feature = "metadata")]
 fn unregister_worktree(worktree_path: &std::path::Path) {
     if let Ok(db) = crate::db::WorktreeDb::open_default() {
-        let _ = db.unregister_by_path(worktree_path);
+        let path =
+            dunce::canonicalize(worktree_path).unwrap_or_else(|_| worktree_path.to_path_buf());
+        let _ = db.unregister_by_path(&path);
     }
 }