Remember tool approvals in Grok Build

When remember_tool_approvals is on, permission prompts can show per-tool Always allow … options so you are not asked again for the same tool pattern. Official: Permissions, Settings reference.

Turn the options on

User config (~/.grok/config.toml or $GROK_HOME/config.toml):

[ui]
remember_tool_approvals = true

Process override:

export GROK_REMEMBER_TOOL_APPROVALS=1

Restart the TUI after changing this key — the settings reference marks it as restart-required.

Default for the config key is true. Set false / 0 when you want every approval to be one-shot with no “Always allow” row.

First-prompt default selection

The row preselected on the first permission prompt is separate:

[ui]
default_selected_permission = "always_allow_all_sessions"

Env: GROK_DEFAULT_SELECTED_PERMISSION. Pick the value that matches how aggressive you want the default highlight — you still confirm the prompt.

How this relates to modes and rules

Control	What it does
Ask / Auto / Always-approve	Session mode for whether tools prompt — Configure permissions
remember_tool_approvals	Whether the prompt UI offers sticky per-tool Always allow
[permission] rules / --allow / --deny	Explicit allow/deny patterns; deny always wins

A remembered Always allow grant still prompts for dangerous patterns such as rm and git push. An explicit config or CLI allow rule auto-approves those. Under always-approve they run unless you add a deny.

Pitfalls

• Put [ui] in user config. Project .grok/config.toml cannot hold this key.
• Sticky Always allow is not a substitute for deny rules on destructive bash — add [permission] deny patterns for rm, force-push, and similar.
• Sandbox limits what an approved call can do on disk and network; configure that in Enable the Grok Build sandbox.