Grok Build

The Headless Mode and Scripting guide in 1.0.52, “Update Check Suppression” at byte offset 2340884, lists the flag as a session opt-out, the environment variable as a process opt-out, and the config setting as persistent. These are documented controls; inspect the saved setting and installed version after applying them.

All byte offsets in these notes are zero-based and refer to the same pinned Linux x86_64 artifact, generation 1791762841427964. They locate text in the file, not instructions to run it. Passage summaries are paraphrases except where explicitly quoted.

The Sandbox Mode section in the pinned 1.0.52 artifact starts at byte offset 2412062. Exact excerpts:

• At byte offset 2412324: “Sandbox mode is off by default.”
• At byte offset 2415680: “The agent can read the current working directory, essential system paths, and ~/.grok.”

Other passages in the same section:

• “Built-in Profiles”, byte offset 2412748: the table and its footnotes limit child-network blocking to Linux and describe a custom deny list for sensitive files. Strict’s read access includes the workspace.
• Strict profile paragraph, byte offset 2415606: daemon-backed sessions also write to ~/.grok/daemon/run/strict for sockets, logs and session storage. This allowance depends on that backend running the session.
• “Direct global write protection”, byte offset 2416091, and the paragraph at 2417898: the protected bases are workspace, read-only and strict, including derivatives. Protection covers the workspace’s project hook folders and ancestors through the repository root. Package folders below the workspace, including worktree-subagent copies, are excluded; devbox is excluded.

These passages describe the shipped guide. Enforcement still needs the tests in What is unresolved.

The Headless Mode and Scripting guide starts at byte offset 2301134. Its note at 2304956 lists these filters among headless-only flags and says the interactive TUI warns and ignores them.

The Hooks guide in 1.0.52 starts at byte offset 2172942. The guide names SessionStart sources new/load and says Grok does not read native Cursor hook replies. Translate imported matchers and replies, then test successful denies and failures.

• Matcher configuration, byte offset 2186477, gives SessionStart sources as new and load. Use them for fresh and reopened sessions respectively; imported startup/resume/clear/compact matchers do not match.
• “Cursor Hook Compatibility”, byte offset 2183983: native Cursor entries do not run; Grok-supported matcher groups do. At 2184387, the guide says: “Grok doesn’t read that format yet.” Convert native replies and entries before relying on a migrated deny hook.
• Timeout and failure handling, byte offset 2189400: crashes and timeouts let work proceed. For PreToolUse, replies beyond read limits, inapplicable input rewrites from successful hooks and explicit denies block tool calls. The event-specific rules at byte offset 2219954 say oversized replies on Stop, SubagentStop, PostToolUse and PostToolUseFailure can fail open; a failed hook’s over-deep input rewrite is dropped and the call proceeds. Test these exceptions separately from a transport or script failure.
• Package hook path handling, byte offset 2176908: package hooks run from the workspace root. A missing root script fails open, including for a deny hook. Point the hook at the package script explicitly.
• “HTTP Hooks”, byte offset 2247114: refused requests are hook errors. The paragraph at 2249465 says, “The hook fails open.” The fake-IP proxy paragraph at 2247890 describes names resolving into 198.18.0.0/15: requests are refused even with HTTPS_PROXY, and a managed policy hook then fails open. Exercise that route and timeouts as well as explicit deny replies.

In the 1.0.52 embedded guides:

• Hooks, “Enforced hooks”, byte offset 2199281: edited signed requirements or a missing or unreadable signature downgrade their hooks to user hooks. fail_closed = true makes an edited copy or missing signature stop startup. Requirements that cannot be read or parsed stop startup even without that setting.
• Permissions and safety starts at byte offset 2467622. Its compatibility notes at 2483150 distinguish malformed individual rules from wrong list types or non-string entries in imported managed deny/ask lists. Only the latter also suppress that file’s allow list.

If you use Jujutsu, test its worktree command compatibility on disposable state first.

In the pinned 1.0.52 artifact:

• Sandbox Mode, “Direct global write protection”, paragraph at byte offset 2417898, requires startup refusal when the required kernel policy cannot apply. “Platform Support”, at 2427097, instead describes warning and continuing, with an exception for explicitly requested custom profiles. The guide leaves that broader failure behavior conflicted.
• Permissions and safety, paragraph at 2501389: project permission rules, startup instructions and skills require folder trust. Headless startup with these project sources requires --trust or a prior grant.
• Configuration reference, cursor_worker heading at 2573107: registration offers the machine to Cursor Cloud Agents. The table sets auto-start and any_repo off by default. The opening paragraph also describes successful startup opening a clone-pool path for Git URLs outside worker_dirs.
• Worker command messages around 1508236 describe account-link gates. The start-refusal message around 1508900, and the leader-start message at 1528937, say a selected sandbox profile cannot prove confinement of Cloud Agent shell commands and prevents worker startup. These are embedded messages, not an observed startup test.