Patch release 1.0.12: enforced root-owned managed hooks, a clearer first-launch flow for auth_provider_command, and tighter background-monitor failure handling.
Changelog
[changed] Hooks installed from root-owned system layers (/etc/grok/requirements.toml, /etc/grok/managed_config.toml) are now enforced. They cannot be turned off from the hooks modal, the enable/disable APIs, or disabled-hooks, and a byte-identical copy in a lower layer cannot steal their provenance. Enforcement is based on OS file ownership (deploy root-owned or via MDM); there is no signature check. Hooks under $GROK_HOME stay user-editable convenience distribution.
[changed] With auth_provider_command, first launch runs your provider binary on the real terminal (URL and progress on stderr), then opens the UI already signed in. You can still run grok login ahead of time to hydrate auth.json. Mid-session /login still uses the in-TUI copy-link overlay.
[changed] Background monitors fail fast: they emit FAILED as soon as any required item fails instead of waiting on unrelated work, and they fold every tracked failure into that immediate failure condition.
[changed] User guide and README sections on authentication, hooks, configuration, permissions, agent/headless/subagent mode, and related topics are updated to match the behavior above.
Under the hood
ACP session path gains streaming capture, wait/interrupt handling, and sampling-event support for more reliable session control.
LSP integration adds watched-files support so language-server file watching can track workspace changes.
Session compaction prefire / pass-1 timing knobs and related outcome tracking are wired through for better compaction diagnostics.
Client version bumped to 1.0.12 across the shell binaries and live surfaces.
Upgrade notes
If you ship org-wide hooks via /etc/grok/requirements.toml or /etc/grok/managed_config.toml, keep those files root-owned (or MDM-managed). That is what makes them non-disableable on the device.
Custom auth_provider_command setups should expect first-run auth on the real terminal before the TUI appears; mid-session /login behavior is unchanged.
