Patch release 1.0.4: default model moves to grok-4.6, mid-turn follow-ups can steer instead of only queue, web_search gains domain policy, and hooks pick up a proper cancel path plus richer turn-end reporting.
Changelog
[changed] Default model for new sessions and web_search is now grok-4.6 (was grok-4.5). Both grok-4.5 and grok-4.6 remain available.
[new] Mid-turn follow-ups: [ui].follow_up_behavior is "queue" by default (wait for the turn to end) or "steer" (plain Enter still shows the queue row, then injects at the next tool/model safe gap). Keyboard shortcut docs cover the behavior.
[new][toolset.web_search] domain policy: allowed_domains (max 5) or excluded_domains constrain what web_search may query. The two are mutually exclusive (allowlist wins if both are set). Policy is authoritative for the session and cannot be bypassed by the model’s per-call allowlist; apply before starting a session.
[new] Hook event StopCancelled: fires instead of Stop when a turn ends without completing (user interrupt, declined/dismissed permission, --max-turns, no-progress bail-out). Observation-only, with reason, cancelledBy, and related fields for busy/idle hosts.
[new]PreToolUse hooks can rewrite tool input via updatedInput (normalize or harden a call before plan-mode, permission prompts, and the tool itself see it). Invalid rewritten input fails closed as an invalid-input error.
[new] Hook payloads include promptId on turn-scoped events; SessionStart does not fire for a subagent’s own session; SessionEnd carries subagentType for child sessions. Docs describe resolution order, fail-open rules, and busy/idle patterns across Stop / StopFailure / StopCancelled / idle_prompt.
[new] Session info (/session-info, /status, /info): click a value or drag to select and copy; c copies the session ID and y copies the whole block (same clipboard path as the rest of Grok, including grok wrap).
[changed] MCP permission rules accept Claude-style mcp__server__tool spellings as well as native MCPTool(server__tool), including server-wide and global MCP globs.
[changed] Dangerous commands (e.g. git push, rm) never honor a remembered prefix—only an exact full-command grant. “Always allow” is omitted when no rememberable grant could stop further prompts.
[changed] Interactive permission grants are scoped to the git repository root (so a grant at the root applies in subdirectories of the same repo). Outside a git repo they stay launch-directory scoped; each worktree keeps its own grants.
[new] External OpenTelemetry: trust a private CA and optional mTLS client identity via [telemetry] otel_certificate, otel_client_certificate, and otel_client_key (PEM paths only), with matching OTEL_EXPORTER_OTLP_* env vars and per-signal protocol overrides. Env wins over config for cert/key paths.
[new] Bundled shared personas for structured multi-step work: design-doc-writer, design-doc-reviewer, implementer, reviewer, and security-auditor (design docs, code review notes, implementation pass, and security audit reports with severity and file:line findings).
[new] Wix marketplace plugin: replatform skill for routing RePlatform source-to-Wix migrations from project artifacts.
[changed] Marketplace plugin revisions updated for sentry, stripe, and wix.
Under the hood
Turn-end hook dispatch and subagent lifecycle handling were reworked so cancelled, failed, and completed turns report cleanly without blocking interrupts; observe hooks stay off the critical path of the next turn.
Permission grant storage for bash-style approvals and related grant matching were tightened to match the dangerous-command and repo-root scoping rules above.
Telemetry redaction helpers and OTLP export options (private CA, mTLS, per-signal protocol) land for corporate collectors; the external stream remains logs and metrics only.
Image-capability probing and session/search-related internal gates were added ahead of broader workspace features.
Runtime traffic includes session storage upload and repo-visibility checks used with remote/repo context.
Upgrade notes
New sessions default to grok-4.6. Pin default / web_search under [models] if you need to stay on grok-4.5.
[toolset.web_search] is read at session start; set allow/block lists before launching if you rely on them.
Optional: set [ui].follow_up_behavior = "steer" if you want mid-turn injection instead of end-of-turn queueing.
Re-check interactive “always allow” expectations for dangerous commands and for grants made only in a subdirectory—grants now follow the git root (or worktree) rules above.
OTEL cert/key config keys are filesystem paths only; do not put PEM contents in TOML.
