Synced from monorepo

Changes:
- grok-shell: request workspaces:read/write OAuth2 scopes
- security: fix SSRF bypass via HTTP redirect in hook runner
- fix(grok-build): enterprise STT WSS URL + API-key voice bearer
- Harden identity-change purge and sync-marker invariants
- sandbox + workspace-server: delete the legacy ready-file arm
- Show billing URL when browser cannot open
- fix(pager): show folder-trust UI in minimal mode
- fix(pager): drain task_backgrounded before no-wait headless exit
- grok-agent-sdk: stop SDK-spawned agents from staging self-updates they can never adopt
- Split settings_modal into directory module
- Delegate VS Code SSH file links
- grok-shell: release the workspace session binding when a session is removed
- keep skills reachable when their name collides with a client builtin
- Preserve semantic link targets

crates/codegen/xai-grok-workspace/src/diag_server.rs

@@ -25,8 +25,7 @@ use tokio::net::TcpListener;
 use tokio::net::UnixListener;
 use tokio::task::JoinHandle;
 
-/// Default Unix socket path (resolves host-visibly under the production
-/// launcher's `/tmp` bind mount, next to the ready/pid files).
+/// Default Unix socket path (next to the log/pid files).
 #[cfg(unix)]
 pub const DEFAULT_DIAG_SOCKET_PATH: &str = "/tmp/workspace-server.sock";
 
@@ -137,11 +136,6 @@ impl DiagHandle {
         inner.state_changed_at = now_ms();
     }
 
-    /// True after [`Self::set_shutting_down`].
-    pub fn is_shutting_down(&self) -> bool {
-        self.lock().shutting_down
-    }
-
     fn lock(&self) -> MutexGuard<'_, Inner> {
         self.inner.lock().unwrap_or_else(PoisonError::into_inner)
     }
@@ -416,7 +410,6 @@ mod tests {
         let (status, body) = get_json(port, "/ready").await;
         assert_eq!(status, 503);
         assert_eq!(body["state"], "disconnected");
-        assert!(handle.is_shutting_down());
     }
 
     #[cfg(unix)]