Synced from monorepo

Changes:
- grok-shell: request workspaces:read/write OAuth2 scopes
- security: fix SSRF bypass via HTTP redirect in hook runner
- fix(grok-build): enterprise STT WSS URL + API-key voice bearer
- Harden identity-change purge and sync-marker invariants
- sandbox + workspace-server: delete the legacy ready-file arm
- Show billing URL when browser cannot open
- fix(pager): show folder-trust UI in minimal mode
- fix(pager): drain task_backgrounded before no-wait headless exit
- grok-agent-sdk: stop SDK-spawned agents from staging self-updates they can never adopt
- Split settings_modal into directory module
- Delegate VS Code SSH file links
- grok-shell: release the workspace session binding when a session is removed
- keep skills reachable when their name collides with a client builtin
- Preserve semantic link targets

crates/codegen/xai-grok-shell-base/src/util/mod.rs

@@ -55,11 +55,18 @@ fn matches_trusted_base_url(candidate: &str, trusted_base: &str) -> bool {
 }
 /// True for cli-chat-proxy URLs (production, plus local-dev hosts when the
 /// optional non-production feature is enabled). When that feature is on,
-/// runtime env overrides can extend this trust set.
+/// runtime env overrides can extend this trust set. Loopback is always
+/// accepted (unit tests and local mock servers on arbitrary ports).
 pub fn is_cli_chat_proxy_url(url: &str) -> bool {
     if matches_trusted_base_url(url, crate::env::PROD_CLI_CHAT_PROXY_BASE_URL) {
         return true;
     }
+    if let Ok(u) = reqwest::Url::parse(url)
+        && let Some(h) = u.host_str()
+        && (h == "localhost" || h == "127.0.0.1" || h == "::1")
+    {
+        return true;
+    }
     false
 }
 /// True for first-party xAI endpoints (`*.x.ai`, cli-chat-proxy, and optional