Open-source tree sync to 9684fa3cdbf2 (still product 1.0.10): UserPromptSubmit hooks can block prompts, active agent / subagent messaging lands, and root-owned managed hooks are enforced.
Changelog
[changed] UserPromptSubmit hooks can block a prompt — exit code 2 or JSON {"decision":"block","reason":"..."} rejects the submit; the reason is shown to you and is not added to model context. Only typed prompts are blocked (auto-wake and subagent sessions stay observe-only). Timed-out or crashed hooks fail open. A blocked prompt is not stored in conversation history, the on-disk session, or the session summary; it stays editable at the front of the queue in the live UI (local up-arrow history still keeps the text). Allowing-hook stdout / additionalContext is still discarded.
[new] Active agent messages — optional features.active_agent_messages (default off; also GROK_ACTIVE_AGENT_MESSAGES) plus tooling and UI plumbing so parent/child agents can surface in-flight messages (including a send_subagent_message tool path and scrollback presentation).
[changed] Root-owned hook layers are enforced — hooks from system-dir requirements.toml (e.g. /etc/grok/requirements.toml) or /etc/grok/managed_config.toml cannot be turned off via the hooks modal, enable/disable APIs, or disabled-hooks, and a byte-identical lower-layer copy cannot steal their provenance. Enforcement is OS file ownership (root-owned or MDM); there is no signature check. Hooks under $GROK_HOME remain user-editable convenience distribution.
[changed] Auto mode (interactive) — when the classifier will not auto-allow a call, the session surfaces a normal permission prompt instead of only failing closed; non-interactive paths (grok -p, unidentified stdio) still fail the call and report it to the model.
[changed] Default model entries for Grok 4.6 / 4.5 no longer set show_model_fingerprint.
[changed] Docs and examples standardize on grok-4.6 / “Grok 4.6” where they previously used grok-build / “Grok Build” (slash commands, CLI flags, config samples, headless/agent/subagent guides).
Agent & tools
New send_subagent_message implementation under the grok-build tool set, with task/coordinator active message support.
Subagent session path gains clearer child runtime, prompt-turn receipt/result, parent message, and child tool projection handling, plus active-agent message presentation in the pager/scrollback (sent_message blocks).
Session slash authority helpers and related ACP session tests (managed hooks, prompt gate, slash-authority turns).
Sandbox work on read-deny verification and runtime sockets, including child-net e2e coverage.
Docs
Hooks guide: UserPromptSubmit marked blocking; new “UserPromptSubmit Decision Control” section; Cursor compatibility notes updated (blocking works; allowing additionalContext still dropped).
Shell README: root-owned vs $GROK_HOME hook enforcement wording.
Getting started, slash commands, configuration, custom models, headless, agent mode, and subagents guides: model ID examples → grok-4.6.
Permissions and safety: auto-mode interactive vs non-interactive behavior clarified.
GROK_PROXY_URL; host list includes https://api.x.ai/v1/salon-text.
Auth backend module layout under the shell; computer-hub SDK discovery helper; tool-protocol bot-relay conformance test.
Upgrade notes
If you ship UserPromptSubmit hooks that exit non-zero or emit decision: "block" (e.g. imported Claude-style validators), they will reject user-typed prompts now; previously they were observe-only. Default timeout for this event is 30s; failure/timeout fails open.
Deploy managed/requirements hooks you intend to lock down as root-owned under the system paths above; users can no longer disable those from the UI or disabled-hooks.
Opt in to active agent messages explicitly (features.active_agent_messages or GROK_ACTIVE_AGENT_MESSAGES); default remains off.
Tree remains 1.0.10 on xai-org/grok-build; rebuild from the updated source tarball/commit and refresh local docs bookmarks if you mirror the user guide.
