Renn F 58fd78830c fix(grok): auto-approve tool execution (--always-approve) so headless agents can call tools ...

Live smoke caught every grok agent (Main PM, pr-reviewer, dev, …) ending its run
with stopReason=Cancelled and empty output the instant it reached for a tool. Root
cause: headless `grok -p` cannot approve a tool call without `--always-approve`
(grok's docs: required for unattended automation), and the per-role args didn't
pass it — so no agent could call a gateway verb, an edit, or an MCP tool, and the
run was cancelled.

Add `--always-approve` to grok_cli_args_for_role (one place → every role, one-shot
and interactive). Safety is unaffected: `--disallowed-tools` still removes tools
and `--deny` still hard-blocks command patterns regardless of approval (a denied
command returns a permission error and the agent recovers — verified live).

Proven in the rebuilt image side-by-side: without the flag a tool call yields
Cancelled/not-called; with the real rendered args it returns EndTurn and the MCP
tool actually runs. (My earlier in-image tool-calling check passed `--always-approve`
manually, which masked that the production args omitted it — fixed.)

2026-06-19 07:02:01 +02:00

..

test_grok_cli_config.py

fix(grok): auto-approve tool execution (--always-approve) so headless agents can call tools

2026-06-19 07:02:01 +02:00

test_grok_cli_usage.py

feat(grok): convert interactive intake/secretary to the grok CLI; delete opencode

2026-06-19 04:42:25 +02:00