Synced from monorepo

Changes:
- Non-blocking coding-data sharing upsell banner
- Consolidate remediation in Doctor
- Auto mode defers fail-closed gate asks to the classifier
- Coalesce marketplace list fetches
- Allow removing a marketplace source by name
- Contain hung git marketplace sources (timeouts, non-blocking refresh, unbrick modal)
- Label failed workspace RPCs with error_kind
- Drop redundant explicit tonic/prost deps from xai-grok-shell
- Report real exit codes for completed background shells
- Narrow the date-rollover reminder to date-bearing templates
- Wire toolOverrides through the session and agent
- Security: Bash(git:*) allowlist matches whole command chain by prefix
- Split prompt-trigger telemetry and record classifier provenance
- Raise connectors-manager timeout to 60s
- Auto classifier honors recorded approvals for repeat actions
- Apply doctor fixes in the TUI
- Auto-mode classifier timeouts prompt instead of silently denying
- Scope subagent completion drains to the owning session
- Add the toolOverrides wire types
- Set client_identifier=grok-agent-sdk
- Accept both spellings of the workspace-teleport kill switch
- Persist one-shot occurrence journal
- Stop turns that poll the exact same tool call 16x in a row
- Copy compaction checkpoint files when forking sessions
- Auto-focus permission prompt from scrollback
- Esc cancels the running turn in non-vim and minimal modes
- List Ctrl+Z undo and redo in keyboard shortcuts
- Out-of-process macOS mic capture
- Show active auth mode on session-info
- Install the npm binary under $GROK_HOME
- Remove hover/click dead zones between dashboard items
- Route startup warnings to doctor
- Document [feedback.user] author identity config
- Extend bang command timeout
- Close combine-queued edit-hold race
- Integrate relocation recovery
- Expose privacy notice rollout flag
- Break harness discovery ref cycle so connections can idle-evict
- Shift/Alt+Enter inserts newline when editing a queued prompt
- Gate project Claude permissions on folder trust
- Echo response.create.event_id on response.created
- Toast when session creation fails from disk full
- Add shared test process lifecycle
- Enable dynamic workflows by default
- Add relocation transaction state machine
- Add shared test sandbox
- Surface auth failures on model-switch compact
- Persist durable scheduler expiry
- Confirm before removing extensions-modal items
- Re-run compact and prompt after login when compact hit expired auth
- Recap sends hosted tools under backend search

crates/codegen/xai-grok-workspace/src/bin/workspace_server.rs

@@ -230,11 +230,11 @@ async fn run(args: Args, cwd: PathBuf) -> anyhow::Result<()> {
         Ok(endpoint) if !endpoint.is_empty() => {
             match xai_tracing::init_fastrace(endpoint.clone(), SERVICE_NAME.to_owned(), None) {
                 Ok(()) => {
-                    tracing::info!(% endpoint, "trace export enabled (direct OTLP)");
+                    tracing::info!(%endpoint, "trace export enabled (direct OTLP)");
                     true
                 }
                 Err(e) => {
-                    tracing::warn!(error = % e, "direct OTLP trace export init failed");
+                    tracing::warn!(error = %e, "direct OTLP trace export init failed");
                     false
                 }
             }
@@ -250,10 +250,8 @@ async fn run(args: Args, cwd: PathBuf) -> anyhow::Result<()> {
                     .parse::<ProfileName>()
                     .expect("ProfileName::from_str is infallible");
                 if matches!(parsed, ProfileName::Custom(_)) {
-                    tracing::warn!(
-                        value = % val,
-                        "Unrecognized GROK_SANDBOX_PROFILE, defaulting to workspace"
-                    );
+                    tracing::warn!(value = %val,
+                        "Unrecognized GROK_SANDBOX_PROFILE, defaulting to workspace");
                     ProfileName::Workspace
                 } else {
                     parsed
@@ -264,16 +262,11 @@ async fn run(args: Args, cwd: PathBuf) -> anyhow::Result<()> {
         };
         let profile_name = profile.to_string();
         if profile == ProfileName::Off {
-            tracing::info!(
-                profile = % profile_name,
-                "Sandbox explicitly disabled via GROK_SANDBOX_PROFILE=off"
-            );
+            tracing::info!(profile = %profile_name, "Sandbox explicitly disabled via GROK_SANDBOX_PROFILE=off");
         } else {
             let mut sandbox = SandboxManager::new(profile, &cwd);
             if let Err(e) = sandbox.apply(&cwd) {
-                tracing::warn!(
-                    error = % e, "Sandbox apply returned error, continuing unsandboxed"
-                );
+                tracing::warn!(error = %e, "Sandbox apply returned error, continuing unsandboxed");
             } else if !sandbox.is_applied() {
                 tracing::warn!("Sandbox could not be applied (unsupported platform)");
             }
@@ -285,14 +278,19 @@ async fn run(args: Args, cwd: PathBuf) -> anyhow::Result<()> {
                 "Workspace server sandbox NOT active"
             };
             tracing::info!(
-                profile = % profile_name, active,
-                restrict_network_at_known_linux_launches =
-                xai_grok_sandbox::should_restrict_child_network(), "{status_msg}"
+                profile = %profile_name,
+                active,
+                restrict_network_at_known_linux_launches = xai_grok_sandbox::should_restrict_child_network(),
+                "{status_msg}"
             );
         }
     }
     let auth_provider = xai_grok_workspace::hub_auth::provider(&url, args.auth_config.as_deref())?;
-    tracing::info!(hub_url = % url, cwd = % cwd.display(), "Starting workspace server");
+    tracing::info!(
+        hub_url = %url,
+        cwd = %cwd.display(),
+        "Starting workspace server"
+    );
     let cwd_display = cwd.display().to_string();
     let session_id = std::env::var("GROK_SESSION_ID").ok();
     let parsed_metadata = match args.metadata {
@@ -314,26 +312,24 @@ async fn run(args: Args, cwd: PathBuf) -> anyhow::Result<()> {
     #[cfg(windows)]
     let diag_listener = diag_server::DiagListener::Tcp(args.diag_port);
     let diag_log_file = args.daemonize.then_some(args.log_file);
-    let _diag_server =
-        match diag_server::serve(diag_listener, diag_handle.clone(), diag_log_file).await {
-            Ok(bound) => {
-                tracing::info!(addr = % bound.addr, "diagnostics server listening");
-                Some(bound)
+    let _diag_server = match diag_server::serve(diag_listener, diag_handle.clone(), diag_log_file)
+        .await
+    {
+        Ok(bound) => {
+            tracing::info!(addr = %bound.addr, "diagnostics server listening");
+            Some(bound)
+        }
+        Err(e) => {
+            if args.daemonize {
+                tracing::error!(error = %e, "{}", diag_server::DIAG_BIND_FAILED_MARKER);
+                std::process::exit(diag_server::EXIT_DIAG_BIND_FAILED);
             }
-            Err(e) => {
-                if args.daemonize {
-                    tracing::error!(error = % e, "{}", diag_server::DIAG_BIND_FAILED_MARKER);
-                    std::process::exit(diag_server::EXIT_DIAG_BIND_FAILED);
-                }
-                tracing::warn!(
-                    error = % e, "{} (continuing without)",
-                    diag_server::DIAG_BIND_FAILED_MARKER
-                );
-                None
-            }
-        };
+            tracing::warn!(error = %e, "{} (continuing without)", diag_server::DIAG_BIND_FAILED_MARKER);
+            None
+        }
+    };
     tracing::info!(
-        cwd = % cwd_display,
+        cwd = %cwd_display,
         "Workspace server starting — sessions created dynamically via server bind"
     );
     let server_id = args.server_id.clone();
@@ -403,14 +399,16 @@ async fn run(args: Args, cwd: PathBuf) -> anyhow::Result<()> {
         None => tracing::info!("metric export disabled (not connected)"),
     }
     tracing::info!(
-        server_id = ? server_id, "Workspace server connected to hub. Serving tools."
+        server_id = ?server_id,
+        "Workspace server connected to hub. Serving tools."
     );
     #[cfg(unix)]
     {
         use tokio::signal::unix::{SignalKind, signal};
         let mut sigterm = signal(SignalKind::terminate())?;
         tokio::select! {
-            _ = tokio::signal::ctrl_c() => {} _ = sigterm.recv() => {}
+            _ = tokio::signal::ctrl_c() => {}
+            _ = sigterm.recv() => {}
         }
     }
     #[cfg(not(unix))]
@@ -467,7 +465,7 @@ mod tests {
     #[test]
     fn capabilities_manifest_shape() {
         let value = serde_json::to_value(CAPABILITIES).unwrap();
-        assert_eq!(value, serde_json::json!({ "diag" : true }));
+        assert_eq!(value, serde_json::json!({"diag": true}));
     }
     #[test]
     fn capabilities_probe_of_legacy_binary_exits_nonzero() {