fix: detect grok build working and blocked states from current ui chrome (#1055)

* fix: detect grok build working and blocked states from current ui chrome

refs #1017

* fix: sync grok detection website manifest

refs #1017

---------

Co-authored-by: Ogulcan Celik <ogulcancelik@gmail.com>

3 files changed, 149 insertions, 8 deletions

diff --git a/docs/next/CHANGELOG.md b/docs/next/CHANGELOG.md
index 22d74383..fcfe7e07 100644
--- a/docs/next/CHANGELOG.md
+++ b/docs/next/CHANGELOG.md
@@ -18,6 +18,7 @@
 
 ### Fixed
 - `herdr server stop` now waits until both server sockets are unreachable before returning, avoiding an immediate first-start failure when restarting right after replacing the binary.
+- Grok Build agent detection now tracks the current Grok Build UI: panes report working while responses, tools, and subagents run, and blocked on permission prompts and question dialogs, instead of falling back to idle mid-turn. (#1017)
 - Unix local Herdr clients no longer treat empty bracketed paste as a clipboard-image bridge; `herdr --remote` keeps using it for local-desktop image paste over SSH. (#986)
 - Custom command keybindings now run through `cmd.exe /d /c` on Windows instead of `/bin/sh`, so `type = "pane"` and `type = "shell"` bindings can launch native Windows commands. (#1041)
 - Plain PageUp/PageDown now reach primary-screen pager apps such as `less -X` and Git diff when they enter application cursor mode, while shell transcripts still use Herdr pane scrollback. (#953)
diff --git a/src/detect/manifests/grok.toml b/src/detect/manifests/grok.toml
index f4b6537f..ef2457ae 100644
--- a/src/detect/manifests/grok.toml
+++ b/src/detect/manifests/grok.toml
@@ -1,9 +1,50 @@
 id = "grok"
-version = "2026.06.10.1"
-min_engine_version = 1
-updated_at = "2026-06-10T00:00:00Z"
+version = "2026.07.03.1"
+min_engine_version = 2
+updated_at = "2026-07-03T00:00:00Z"
 aliases = ["grok-build"]
 
+# Evidence: Grok Build 0.2.82 live pane reads.
+#
+# Working turns render one live status line directly above the prompt box:
+#   "⠧ Waiting on subagent… 2.8s   13s ⇣29.7k [stop]"
+#   "⠴ Explore /tmp/… + 1 more… 5.6s   19s ⇣29.7k [stop]"
+# with a braille spinner and a trailing [stop] chip, plus an Esc:cancel
+# footer hint. Permission prompts and ask-user-question dialogs replace the
+# spinner with "◆" and draw a "┃"-guttered option list:
+#   "┃  2 (○) Yes, proceed"
+#   "┃  z (○) Type your answer here"
+# with footer hints "1/3:select │ Ctrl+o:yolo │ Ctrl+c:cancel" (permission)
+# or "Esc:unselect │ Tab:scrollback │ Shift+x:dismiss" (question dialog).
+# Idle footers end with "Ctrl+.:shortcuts" and never contain "Esc:cancel".
+# The startup splash draws its logo with braille characters, so working
+# rules must anchor on the [stop] chip, not on a bare spinner glyph.
+
+[[rules]]
+id = "option_dialog_blocked"
+state = "blocked"
+priority = 320
+region = "whole_recent"
+visible_blocker = true
+line_regex = ['^\s*┃\s+[0-9a-z]+\s+\([●○]\)\s']
+
+[[rules]]
+id = "permission_hints_blocked"
+state = "blocked"
+priority = 310
+region = "bottom_non_empty_lines(2)"
+visible_blocker = true
+contains = [":select", "ctrl+o:yolo", "ctrl+c:cancel"]
+
+[[rules]]
+id = "question_dialog_hints_blocked"
+state = "blocked"
+priority = 305
+region = "bottom_non_empty_lines(2)"
+visible_blocker = true
+contains = ["tab:scrollback", "shift+x:dismiss"]
+
+# Pre-0.2.x permission UI kept for older Grok Build releases.
 [[rules]]
 id = "permission_scope_selector"
 state = "blocked"
@@ -17,6 +58,23 @@ any = [
 ]
 
 [[rules]]
+id = "spinner_status_working"
+state = "working"
+priority = 200
+region = "whole_recent"
+visible_working = true
+line_regex = ['^\s*[\x{2801}-\x{28FF}]\s.*\[stop\]\s*$']
+
+[[rules]]
+id = "esc_cancel_hints_working"
+state = "working"
+priority = 190
+region = "bottom_non_empty_lines(2)"
+visible_working = true
+contains = ["esc:cancel", "ctrl+.:shortcuts"]
+
+# Pre-0.2.x working chrome kept for older Grok Build releases.
+[[rules]]
 id = "waiting_tool_working"
 state = "working"
 priority = 120
@@ -24,5 +82,17 @@ region = "whole_recent"
 visible_working = true
 any = [
   { all = [{ contains = ["ctrl+c:cancel", "ctrl+enter:interject"] }, { contains = ["waiting"] }] },
-  { line_regex = ['^\s*[\u2800-\u28FF]\s+(Run|Read|Search|List)\b'] },
+  { line_regex = ['^\s*[\x{2801}-\x{28FF}]\s+(Run|Read|Search|List)\b'] },
+]
+
+[[rules]]
+id = "prompt_hints_idle"
+state = "idle"
+priority = 100
+region = "bottom_non_empty_lines(2)"
+visible_idle = true
+contains = ["ctrl+.:shortcuts"]
+not = [
+  { contains = ["esc:cancel"] },
+  { contains = ["ctrl+c:cancel"] },
 ]
diff --git a/website/agent-detection/grok.toml b/website/agent-detection/grok.toml
index f4b6537f..ef2457ae 100644
--- a/website/agent-detection/grok.toml
+++ b/website/agent-detection/grok.toml
@@ -1,9 +1,50 @@
 id = "grok"
-version = "2026.06.10.1"
-min_engine_version = 1
-updated_at = "2026-06-10T00:00:00Z"
+version = "2026.07.03.1"
+min_engine_version = 2
+updated_at = "2026-07-03T00:00:00Z"
 aliases = ["grok-build"]
 
+# Evidence: Grok Build 0.2.82 live pane reads.
+#
+# Working turns render one live status line directly above the prompt box:
+#   "⠧ Waiting on subagent… 2.8s   13s ⇣29.7k [stop]"
+#   "⠴ Explore /tmp/… + 1 more… 5.6s   19s ⇣29.7k [stop]"
+# with a braille spinner and a trailing [stop] chip, plus an Esc:cancel
+# footer hint. Permission prompts and ask-user-question dialogs replace the
+# spinner with "◆" and draw a "┃"-guttered option list:
+#   "┃  2 (○) Yes, proceed"
+#   "┃  z (○) Type your answer here"
+# with footer hints "1/3:select │ Ctrl+o:yolo │ Ctrl+c:cancel" (permission)
+# or "Esc:unselect │ Tab:scrollback │ Shift+x:dismiss" (question dialog).
+# Idle footers end with "Ctrl+.:shortcuts" and never contain "Esc:cancel".
+# The startup splash draws its logo with braille characters, so working
+# rules must anchor on the [stop] chip, not on a bare spinner glyph.
+
+[[rules]]
+id = "option_dialog_blocked"
+state = "blocked"
+priority = 320
+region = "whole_recent"
+visible_blocker = true
+line_regex = ['^\s*┃\s+[0-9a-z]+\s+\([●○]\)\s']
+
+[[rules]]
+id = "permission_hints_blocked"
+state = "blocked"
+priority = 310
+region = "bottom_non_empty_lines(2)"
+visible_blocker = true
+contains = [":select", "ctrl+o:yolo", "ctrl+c:cancel"]
+
+[[rules]]
+id = "question_dialog_hints_blocked"
+state = "blocked"
+priority = 305
+region = "bottom_non_empty_lines(2)"
+visible_blocker = true
+contains = ["tab:scrollback", "shift+x:dismiss"]
+
+# Pre-0.2.x permission UI kept for older Grok Build releases.
 [[rules]]
 id = "permission_scope_selector"
 state = "blocked"
@@ -17,6 +58,23 @@ any = [
 ]
 
 [[rules]]
+id = "spinner_status_working"
+state = "working"
+priority = 200
+region = "whole_recent"
+visible_working = true
+line_regex = ['^\s*[\x{2801}-\x{28FF}]\s.*\[stop\]\s*$']
+
+[[rules]]
+id = "esc_cancel_hints_working"
+state = "working"
+priority = 190
+region = "bottom_non_empty_lines(2)"
+visible_working = true
+contains = ["esc:cancel", "ctrl+.:shortcuts"]
+
+# Pre-0.2.x working chrome kept for older Grok Build releases.
+[[rules]]
 id = "waiting_tool_working"
 state = "working"
 priority = 120
@@ -24,5 +82,17 @@ region = "whole_recent"
 visible_working = true
 any = [
   { all = [{ contains = ["ctrl+c:cancel", "ctrl+enter:interject"] }, { contains = ["waiting"] }] },
-  { line_regex = ['^\s*[\u2800-\u28FF]\s+(Run|Read|Search|List)\b'] },
+  { line_regex = ['^\s*[\x{2801}-\x{28FF}]\s+(Run|Read|Search|List)\b'] },
+]
+
+[[rules]]
+id = "prompt_hints_idle"
+state = "idle"
+priority = 100
+region = "bottom_non_empty_lines(2)"
+visible_idle = true
+contains = ["ctrl+.:shortcuts"]
+not = [
+  { contains = ["esc:cancel"] },
+  { contains = ["ctrl+c:cancel"] },
 ]