fix: correct grok activity detection with custom or disabled osc signals (#4337)

refs #4333

1 files changed, 27 insertions, 12 deletions

diff --git a/src/detect/manifests/grok.toml b/src/detect/manifests/grok.toml
index 30b6e9c7..67ba4ebc 100644
--- a/src/detect/manifests/grok.toml
+++ b/src/detect/manifests/grok.toml
@@ -1,16 +1,16 @@
 id = "grok"
-version = "2026.07.16.2"
+version = "2026.09.18.2"
 min_engine_version = 3
-updated_at = "2026-07-16T00:00:00Z"
+updated_at = "2026-09-18T00:00:00Z"
 aliases = ["grok-build"]
 
-# Evidence: Grok Build 0.2.101 source and live pane reads.
+# Evidence: Grok Build 0.2.101 source and 1.0.34 live pane reads.
 #
 # Grok emits OSC 0 titles by default. Idle is "grok" or
 # "<session> - grok". During a turn, the configured title gains a braille
 # spinner and activity text. Permission prompts add "⚠ Action Required";
 # that prefix blinks while the terminal is unfocused, so visible blocker
-# rules outrank the generic non-idle title rule.
+# rules outrank the title spinner rule.
 #
 # Grok also emits OSC 9;4 progress on supported terminals. Herdr retains the
 # payload after "9;": "4;1;-1" while busy and "4;0;0" when idle.
@@ -85,6 +85,16 @@ region = "top_non_empty_lines(1)"
 visible_working = true
 line_regex = ['[⋅:⸬⁙.·]\s+[1-9][0-9]*\s+│']
 
+# Grok 1.0.34 moves background counts above the composer and clears OSC
+# progress between turns even while these commands are still running.
+[[rules]]
+id = "background_status_working"
+state = "working"
+priority = 1165
+region = "bottom_non_empty_lines(12)"
+visible_working = true
+line_regex = ['^\s*[○◎◉]\s+[1-9][0-9]*\s+(?:commands?|monitors?|loops?|subagents?)(?:\s+·\s+[1-9][0-9]*\s+(?:commands?|monitors?|loops?|subagents?))*\s+still running(?:\s+·\s+send a message to interrupt)?\s*$']
+
 [[rules]]
 id = "osc_progress_working"
 state = "working"
@@ -104,16 +114,15 @@ not = [
   { regex = ['[\x{2800}-\x{28FF}]'] },
 ]
 
-# After known idle titles are excluded, any other non-empty Grok title is
-# active. OSC progress remains authoritative when a custom title omits the
-# spinner but the terminal supports progress reporting.
+# Title items are configurable; omitting "grok" does not imply activity.
+# Require a spinner, with OSC progress covering titles that omit it.
 [[rules]]
 id = "osc_title_working"
 state = "working"
 priority = 1000
 region = "osc_title"
 visible_working = true
-regex = ['\S']
+regex = ['(?:^|\s)[\x{2801}-\x{28FF}](?:\s|$)']
 
 [[rules]]
 id = "osc_progress_idle"
@@ -123,10 +132,12 @@ region = "osc_progress"
 visible_idle = true
 regex = ['^4;0;0$']
 
+# Visible activity outranks idle OSC signals: disabling title updates can
+# leave the startup "grok" title unchanged throughout a turn.
 [[rules]]
 id = "spinner_status_working"
 state = "working"
-priority = 200
+priority = 1160
 region = "whole_recent"
 visible_working = true
 line_regex = ['^\s*[\x{2801}-\x{28FF}]\s.*\[stop\]\s*$']
@@ -134,16 +145,20 @@ line_regex = ['^\s*[\x{2801}-\x{28FF}]\s.*\[stop\]\s*$']
 [[rules]]
 id = "esc_cancel_hints_working"
 state = "working"
-priority = 190
+priority = 1155
 region = "bottom_non_empty_lines(2)"
 visible_working = true
-contains = ["esc:cancel", "ctrl+.:shortcuts"]
+contains = ["ctrl+.:shortcuts"]
+any = [
+  { contains = ["esc:cancel"] },
+  { contains = ["ctrl+c:cancel"] },
+]
 
 # Pre-0.2.x working chrome kept for older Grok Build releases.
 [[rules]]
 id = "waiting_tool_working"
 state = "working"
-priority = 120
+priority = 1140
 region = "whole_recent"
 visible_working = true
 any = [