Patch release 1.0.11: UserPromptSubmit hooks can block prompts, compaction defaults shift to segments with two-pass on by default, and root-owned managed hooks are enforced.
Changelog
[new]UserPromptSubmit hooks can reject a prompt (exit 2 or JSON decision: "block"). The reason is shown to you and never enters model context; blocked prompts are not stored in history, the session record, or the summary. Auto-wake and subagent turns stay observe-only; allowing hooks still do not inject additionalContext.
[new] Optional features.active_agent_messages (default off; also GROK_ACTIVE_AGENT_MESSAGES) for active agent message handling between parent and subagent work.
[changed] Default compaction mode is now segments (per-segment markdown you can grep) instead of summary. features.two_pass_compaction defaults to on.
[changed] Hooks from root-owned system layers (/etc/grok/requirements.toml, /etc/grok/managed_config.toml) are enforced: they cannot be turned off from the hooks modal, enable/disable APIs, or disabled-hooks, and a lower-layer copy cannot steal their provenance. Hooks under $GROK_HOME remain user-editable convenience config.
[changed] With auth_provider_command, first launch runs your provider binary on the real terminal (URL and progress on stderr), then opens the UI already signed in. Mid-session /login still uses the in-TUI copy-link overlay.
[changed] Folder trust covers subdirectories of the same repository; a nested git checkout is a separate workspace and is not covered by the parent grant.
[changed]PreToolUse allow/deny and updatedInput behavior is tightened: dual decision fields resolve with deny winning, rewrites are silent and schema-validated (invalid rewrite is a hook denial), and a rewrite cannot change which tool runs.
[changed] Auto mode: calls the classifier will not auto-allow surface a normal permission prompt in interactive use; in non-interactive sessions (grok -p, unidentified stdio) those calls still fail and are reported to the model.
[changed] Docs and shell completions updated for the new compaction default and current model examples (grok-4.6).
Under the hood
Identity and auth path work: shared identity SDK, Grok auth backend, and pre-TUI auth so external provider login can complete before the UI opens.
Subagent runtime: child runtime and prompt-turn receipt handling, plus a send_subagent_message path for parent/child messaging aligned with active agent messages.
Dashboard store subsystem (owner-only open/store types) and directory helpers replacing the older home crate layout.
Telemetry: span profiling (GROK_SPAN_PROFILE_OUT), subagent spawn spans, and related session/context snapshot plumbing.
New environment knobs including GROK_DEFAULT_PERMISSION_MODE, GROK_WORKER_THREADS, and GROK_BWRAP_RUNTIME_SOCKET_DENY.
Runtime settings fetch can use GET /v1/user for account/org profile fields.
Upgrade notes
If you depended on summary-style compaction or single-pass compaction, set --compaction-mode summary / GROK_COMPACTION_MODE=summary and turn off features.two_pass_compaction (or GROK_TWO_PASS_COMPACTION) explicitly.
Admins shipping hooks via root-owned /etc/grok managed or requirements files should expect those hooks to be non-disableable on managed machines; deploy them root-owned (or via MDM) as documented.
Prompt-validation hooks aimed at UserPromptSubmit now actually block; confirm exit codes and JSON decision shapes match the updated contract (stdout from an allowing hook is still discarded).
