Patch release with organization-managed hooks enforcement, stronger sandbox protection for global config and trust files, and dashboard polish (optional preview panel and stable pinned-row order).
Changelog
[new]Managed-hooks-only policy pin — Organizations can set allow_managed_hooks_only = true (or allowManagedHooksOnly) in a policy layer so only managed-policy hooks run. User, project, plugin, agent-frontmatter, and vendor-compat hooks are skipped at dispatch, show [disabled] in /hooks, and cannot be re-enabled; ACP client-registered hooks still run. The pin is tighten-only, accepts a non-boolean as engaged, and is read at startup (grok inspect reports it under enforced policy).
[new]Dashboard preview toggle — Appearance in /settings (or ui.dashboard_preview in config.toml) controls the dashboard preview and reply panel. Turning it off frees list space; you open a session to reply or handle permissions. The setting persists across restarts.
[changed]Sandbox global write protection — Under workspace, read-only, strict, and profiles that extend them, write-deny now covers not only hook sources but also ~/.grok/config.toml, trusted_folders.toml, managed_config.toml, requirements.toml, and sandbox.toml. Folder trust, /model, and permission-mode changes apply for the session only; persist trust with grok --trust before sandbox, or edit config outside the sandbox.
[changed]How config.toml is saved — User ~/.grok/config.toml writes follow a leaf symlink (atomic rename to the referent; dangling links create a regular file). Project .grok/config.toml writes replace a leaf symlink with a regular file so saves stay in-repo. An unparseable user config is not overwritten.
[changed]Pinned dashboard rows keep manual order — In both grouping modes, pinned agents stay where you put them; activity does not reshuffle them. Reorder with Shift+↑ / Shift+↓.
[changed]Managed policy paths — managed_config.toml and requirements.toml are documented to load from $GROK_HOME as well as /etc/grok (and MDM for requirements). Policy pins such as managed-hooks-only and MCP/marketplace allowlists are accepted in both layers and only ever tighten.
[changed]Agent safety guidance — The runtime instructions emphasize confirming destructive or hard-to-reverse actions, treating quoted UI text as context rather than send authority, and not inventing personal names from handles or emails.
Under the hood
Dashboard settings dispatch and related pager work for the preview control; terminal probe and reader-thread support in the pager stack.
Worktree create-root helpers and web-search tool-type groundwork.
Clearer folder-trust save failures (no home directory, path changed, trust store unreadable, session-only trust under sandbox).
Upgrade notes
If your organization enables allow_managed_hooks_only, local and project hooks stop dispatching until they are shipped in a root-owned managed layer; restart after the pin is applied.
Under sandboxed profiles, expect config, trust, and related global files to be read-only for the session—plan persistent trust and default model/permission changes outside the sandbox.
