Synced from monorepo

Changes:
- Persist submitter identity for /feedback
- Let custom models use rotating tokens from named auth providers
- Template stale tool/param name literals in server-native descriptions
- Minimal mode commits thinking in full, lookups as one-liners
- Tighten durable append internals
- Nudge model to end turn on no-op bash commands
- Per-fetch signing nonce in the managed-config envelope, with a server-side replay probe
- Include working tree in startup status

crates/codegen/xai-grok-workspace/src/file_system/git_status.rs

@@ -64,24 +64,22 @@ fn collapse_status_spaces(s: &str) -> String {
     out
 }
 
-/// Short git status for the templated user message.
-///
-/// Runs `git status --short --branch` and returns its output with consecutive
-/// spaces collapsed via [`collapse_status_spaces`]: a leading `## <branch>`
-/// line followed by the file change list (or just `## <branch>` on a clean
-/// tree). This matches the body embedded in the `<git_status>` block
-/// byte-for-byte.
 pub async fn git_status_short(working_directory: impl Into<PathBuf>) -> Result<String, FsError> {
     let working_directory = working_directory.into();
 
     tokio::task::spawn_blocking(move || {
         let output = xai_tty_utils::git_command()
-            .args(["status", "--short", "--branch"])
+            .args(["status", "--short", "--branch", "--untracked-files=normal"])
             .current_dir(&working_directory)
             .stdout(std::process::Stdio::piped())
             .stderr(std::process::Stdio::null())
             .output()
-            .map_err(|e| FsError::Other(format!("git status --short --branch failed: {}", e)))?;
+            .map_err(|e| {
+                FsError::Other(format!(
+                    "git status --short --branch --untracked-files=normal failed: {}",
+                    e
+                ))
+            })?;
 
         if !output.status.success() {
             return Err(FsError::Other(format!(

crates/codegen/xai-grok-workspace/src/permission/resolution.rs

@@ -2480,7 +2480,8 @@ mod tests {
         let (entries, logs) = parse_mcp_entries_capturing_logs(&json, "deniedMcpServers");
         assert_eq!(entries.len(), 1);
         assert!(
-            matches!(&entries[0], AllowedMcpServer::Name { name } if name == "internal-only"),
+            matches!(&entries[0], AllowedMcpServer::Name { name }
+if name == "internal-only"),
             "expected a Name entry, got {entries:?}"
         );
         assert!(

crates/codegen/xai-grok-workspace/src/permission/types.rs

@@ -534,7 +534,8 @@ mod tests {
         });
         let access = AccessKind::from(&input);
         assert!(
-            matches!(access, AccessKind::MCPTool { ref name, ref input } if name ==
+            matches!(access, AccessKind::MCPTool { ref name, ref input }
+if name ==
             "linear__save_issue" && input["title"] == "test"),
             "UseTool should produce AccessKind::MCPTool carrying the inner tool name and args, got {access:?}"
         );

crates/codegen/xai-grok-workspace/src/upload/mod.rs

@@ -392,7 +392,8 @@ mod tests {
         let cfg = source.resolve();
         assert_eq!(cfg.bucket_url.as_deref(), Some("gs://placeholder"));
         assert!(
-            matches!(& cfg.upload_method, UploadMethod::Proxy { proxy_base_url, .. } if
+            matches!(& cfg.upload_method, UploadMethod::Proxy { proxy_base_url, .. }
+if
             proxy_base_url == "https://proxy.example/v1"),
             "resolve() must carry the proxy upload method + base url"
         );