Patch release: grok doctor fix for named remediations (starting with SSH wrap), /doctor as the primary terminal diagnostic, tighter permission defaults, and removal of the headless --best-of-n and --check flags.
Changelog
[new] grok doctor fix <id> applies a named automatic remediation after printing the exact plan. First handle: ssh-wrap (canonical terminal.ssh-wrap) installs an interactive-shell alias for grok wrap ssh on your local machine (bash/zsh/fish; not available on Windows). Pass --yes to skip the confirmation prompt.
[changed] In-session terminal diagnostics are now the read-only /doctor command. /terminal-setup, /terminal-check, and /terminal-info remain permanent aliases. Standalone grok doctor and /doctor also report microphone/voice details when the build supports audio capture.
[removed] Headless flags --best-of-n (run the task N ways and pick the best) and --check / --self-verify (append a self-verification loop) are gone from the CLI and completions.
[changed] Bundled platform skills are cached under ~/.grok/bundled/skills/ and are no longer written into ~/.grok/skills/. A same-named local, repo, or user skill still overrides the bundled copy; grok inspect labels each skill by its real source.
[changed] cargo check is no longer treated as a read-only auto-approved command (it can compile and run build.rs, proc-macros, and rustc wrappers). Ask mode prompts; Auto may still heuristic-allow plain cargo as a project runner.
[changed] Permission safety is stricter for several patterns that can execute code: sort --compress-program=…, git -c / --config-env overrides, and git commands whose local/worktree config installs executable hooks (core.fsmonitor, custom diff/textconv/external drivers, or shell alias.<cmd> = !…) now raise a request-level floor and prompt unless that exact script was already granted or YOLO is on.
[changed] Reasoning effort level max is a distinct tier (not an alias of xhigh). A model only accepts the levels its menu advertises.
[changed] The background-work status line reads “still running” and keeps live counts only there; the transcript no longer restates running counts on completions or “Worked for” markers.
[changed] User-guide docs refreshed across slash commands, configuration, theming, skills, headless mode, background tasks, terminal support, and permissions — including voice-dictation troubleshooting when the mic delivers silence or no speech.
Under the hood
Shell completions (bash, zsh, fish, elvish, PowerShell) cover doctor fix / doctor help and drop the removed headless flags.
GROK_WORKFLOWS is documented for enabling background workflows and selecting the /goal driver (default off uses the legacy update_goal path; on uses the host-owned workflow driver).
Doctor JSON and in-TUI reports share the same clipboard preflight facts; passive mic lookup does not open a stream and cannot detect a denied macOS microphone grant.
Upgrade notes
Drop any scripts or aliases that pass --best-of-n or --check / --self-verify; those flags are no longer accepted.
If you customized files that used to live under the old bundled-skills extract path, move personal overrides into ~/.grok/skills/ (or project/local skill dirs). Platform skills now live only under ~/.grok/bundled/skills/.
Expect permission prompts for cargo check and for git/sort invocations that can run hooks or external programs, unless you already allowlisted the exact command or run with always-approve/YOLO.
Prefer /doctor (or grok doctor) for terminal setup checks; the old /terminal-setup name still works as an alias.
To wire SSH through wrap on an ongoing basis: run grok doctor fix ssh-wrap on the local machine, review the planned shell rc change, and confirm (or use --yes).
