xAI Release Notes

• Dashboard directory grouping now shows a header with the folder path and agent count above each folder of agents
• Dashboard location (branch and folder) now sits on the dispatch box top border instead of its own header row
• /resume on the dashboard now lists sessions from every folder, with the current folder and its checkouts first
• Welcome menu now lists Resume session (Ctrl+R) above New worktree (Ctrl+W)
• [ui] simple_mode is retired and no longer has any effect; sessions always open with the prompt focused
• grok doctor and /doctor now point out a leftover [ui] vim_mode key (now [keys] vim) or the retired [ui] simple_mode key in your config
• Quitting Grok returns you to your shell sooner

• Worktree create and fork now list files that could not be copied and any mode changes that were lost
• Vim navigation is now one setting, [keys] vim (off or nav), also set with /vim-mode; the older [ui] vim_mode still works
• Terminal theme now draws a subtle band behind your prompts using the colors your terminal reports
• Mode-switch toast now shows the mode name (Agent, Plan, Ask) in the color of that mode
• Change-directory picker (Ctrl+L on the dashboard) opens with the path field unfocused, like the /resume search
• Image placeholders in the transcript now show whether the actual image was sent or only the text was typed
• Worktree create now fails cleanly instead of falling back when it cannot copy tracked files or runs out of disk space
• Running Grok sessions are no longer broken when an update deletes their binary
• Dashboard model picks now keep their selected context window when spawning the next session
• Send Now prompts and rewound turns now correctly restore and mark any images that were originally sent
• Resumed sessions now show the correct sent or struck-through state for image placeholders

Worktrees also use saved "always allow" answers from the main checkout, so you are not asked again for a tool you already allowed there. Set [features] worktree_inherits_main_approvals = false to turn this off; the main checkout "never allow" answers apply either way

Prompt suggestions follow vim mode: with [ui].vim_mode on, Tab moves focus to the scrollback instead of accepting the suggestion. → or Ctrl+→ accepts a suggestion, and Esc dismisses it

Headless grok -p runs exit when their work is done instead of hanging when a background task or subagent finishes and its output is read in the same turn

The theme picker in Settings restores your previous theme when you leave it any way other than Enter, as /theme already does

Quitting a session with hooks configured is faster

Updates

• /resume search finds sessions from other folders, tolerates typos, and also matches the commands, file paths, and replies in a session
• --permission-mode plan starts the session in plan mode, as documented, instead of the default mode
• The dashboard Ctrl+L folder picker lists up to 50 recent folders instead of 10
• grok --help gives each command and option a one-line summary, and grok help -h and grok help --help print help for the help command itself instead of an error
• /resume search keeps a single typed character literal and matches each typed word at the start of a word, so log fix no longer matches "Blog prefix cleanup"
• Any value of DISABLE_TELEMETRY or DISABLE_ERROR_REPORTING, including 0 and false, turns telemetry and crash reports off

By Chris Bowie and Isaac Hopkinson

IncidentWatch spots ticket spikes before internal alerts fire. IncidentSweep clears the related backlog in an approved batch.

When a product incident occurs, the support queue can be one of the first places it shows up. Customers start reporting the same issue, sometimes before engineering alerts fire or anyone has declared an incident.

Those reports keep coming while the incident unfolds. At first, support may not know what is wrong or have an answer we can confidently provide. By the time the issue is resolved, hundreds or thousands of customers may be waiting for a response. Support has to track those customers through the incident, then make sure each gets the right answer when it is resolved.

We use Grok Bot to handle both parts of this work. It provides us with AI teammates that take ownership of operational jobs, particularly repetitive workflows that otherwise fall between people and systems. As we shared in a recent blog, the SpaceXSI customer support team uses Support Bot in Grok Bot to handle customer-facing communication.

Now we’ve added two more AI teammates that we call on specifically for incidents. The first, IncidentWatch, monitors the support queue for spikes in similar tickets and alerts our team when it sees one. The second, IncidentSweep, handles the other end, identifying affected tickets and closing them in an approved batch.

During one incident on September 18, our Bot, IncidentSweep, cleared 204 tickets in about 10 minutes with a support engineer reviewing and approving the batch. Previously, we would have had to reply to those tickets one by one over the course of hours or use a bulk macro that gave us much less control over who received the message.

Detecting incidents through customer reports

Customers often notice problems before our internal alerts fire. When several customers report the same issue at once, those tickets can be an early signal of an incident.

IncidentWatch is a Grok Bot teammate we built to detect that signal. Every five minutes, it reviews the previous 15 minutes of tickets for spikes around the same problem. If the pattern does not match a known incident, IncidentWatch alerts the support engineer on call with the apparent issue, number of matching tickets, and examples to investigate.

A support engineer decides whether the reports point to an incident and works with engineering to investigate. In the meantime, IncidentWatch holds tickets that clearly match the issue.

Once the team confirms the incident, we post it to our public status page. Support Bot, our primary customer-facing Bot, returns to the held tickets, checks them against the incident, and responds to customers whose reports match. As the incident progresses, it can return with updates.

Clearing the incident backlog

Once an incident is resolved, there may still be hundreds of related tickets in the queue, and each needs a final response. Traditionally, support teams have had two ways to clear them, and both have drawbacks. They can respond to each ticket individually, which can take hours, or use a bulk action, which is fast but leaves little room to catch a ticket that should not receive the message.

We built IncidentSweep to combine the control of the first approach with the speed of the second.

A support engineer starts by telling IncidentSweep which tickets to consider, which to exclude, and exactly what message to send. IncidentSweep finds the matching tickets, reviews each one, and sets aside any it cannot confidently connect to the incident.

Before sending anything, IncidentSweep shows the engineer the proposed batch, the tickets it included, and the exact message they will receive. The engineer can spot-check the tickets and make changes before approving the send.

IncidentSweep then sends the approved message in small batches and records each action. It never adds tickets after approval, and if anything fails, it stops and reports what happened.

Give Bots jobs, not tasks

Grok Bot introduces a different way of working with AI. Instead of turning to an AI tool for help with individual tasks, teams can create AI teammates that own jobs and carry entire workflows through to an outcome.

Customer support has been a natural place for us to put this model to work. IncidentWatch and IncidentSweep take on jobs that used to require someone on the team to watch, sort, and act on hundreds of individual tickets. Across SpaceXSI, we’re looking for more workflows where AI teammates can take on the same kind of ownership.

Try Grok Bot today

• Untrusted folders run only managed hooks from your organization. User, project, plugin, and agent hooks wait until you trust the folder. Headless sessions treat user hooks as trusted.
• Worktree names typed with Ctrl+W keep Unicode letters such as café, and a name or ref that starts with - is refused.
• Auto mode runs a shell command without review only when every command in it matches an allowlist entry; anything else asks first. Permission rules read each word the way bash passes it to the program.
• /resume loads older sessions when you reach the last row, and shows how many sessions are loaded.
• Auto mode runs make --version, cmake --version, and just --version without asking.
• HTTP connections, including remote MCP servers, accept gzip, brotli, zstd, and deflate compressed responses.
• Plugin install suggestions above the prompt are off when disable_plugins = true is set.
• New worktrees keep tracked files that match .gitignore, and leave out files excluded only by .git/info/exclude or core.excludesFile.
• A new session that fails to start puts what you typed back in the prompt you return to, instead of losing it.
• Web search works from the first turn of a session, and in subagents, when the search model signs in through an external auth provider.
• grok -w, grok worktree create, worktree forks, and subagent worktrees refuse up front with the sandbox refusal message when the sandbox profile does not allow creating worktrees.
• Worktree options are hidden in /fork, /new, and the Welcome screen when the sandbox profile does not allow creating worktrees.
• A worktree name you type that is already taken is refused instead of getting a numbered suffix, and a name whose folder you deleted by hand can be used again.
• Grok on macOS without a GUI session, such as over SSH, no longer hangs on its first modifier-key check.
• Custom models on the Responses API keep the turn going when a web search call starts without an action.
• Shell commands run correctly on zsh when your startup files alias grep or replace run-help.
• Voice dictation preview grows the prompt as you speak and keeps the newest words in view.

Memory always uses the concise MEMORY.md index of topic titles and paths, and /memory lists topics by how often Grok reads them. The [memory_v2] compact_index_enabled setting no longer has an effect

Rex terminal support reports each open session and each running subagent as its own record, so Rex shows what each one is doing. Set children = false under [ui.notifications.program_status] to report only the main status

grok worktree list and grok worktree show mark a worktree whose folder is missing or whose source repository moved, with a hint on how to repair it

Command hooks accept an args list: Grok runs command as one program with those arguments and no shell, and fills hook variables such as $GROK_SESSION_ID in each argument

Plan reviews that open while you are typing keep your text in the review notes, so a typed letter no longer triggers a plan shortcut such as approve

Plan reviews at the end of a turn wait until you close an open /feedback dialog, question, tool prompt, or queued prompt edit

grok -w and Ctrl+W explain that no worktree was made when you run them outside a git repository

/fork keeps the model and effort from the parent session when Grok was started with -m or --effort

Custom models on Chat Completions endpoints no longer fail turns with a tool schema error when MCP servers are connected

Workflow run views hide live status text for each agent on narrower terminals, so agent names are no longer cut off

• Headless mode (grok -p) waits for the follow-up turn that a finished background task starts before exiting, and a --background-wait-timeout that stops pending work exits with an error instead of success
• Cold /resume from the dashboard overlay keeps the overlay attached, so you can still back out with Left or Ctrl+\
• Enter on a highlighted slash command with optional arguments runs the command instead of leaving a trailing space in the composer
• CLI commands such as grok models, grok sessions and grok export no longer crash when their output pipe closes early, such as when piped to head, or when the output device is full
• grok update and grok login no longer crash when stdout or stderr is closed or unwritable

Resume picker finds sessions whose titles contain every word you type, in any order

/resume opens the session directly when the ID or title matches exactly one session, instead of always opening the picker

Dashboard peek text can be selected by dragging over it with the mouse, and the selection is copied to the clipboard when you release

Workflow run views scroll toward newer agents when you wheel down the agent roster, instead of snapping back

Hook spawn failures on Windows name the program that failed to start, such as PowerShell or Git Bash, instead of blaming the hook script

• grok --resume lists matching sessions newest first with when each was last updated, and suggests similar titles when nothing matches</li> <li>Shift+Y in the fullscreen markdown viewer copies the code block under the cursor</li> <li>grok --resume <title> with a title that matches no local session reports the miss right away instead of trying a remote restore and asking you to sign in</li> <li>Esc on the first question in a session opened from the dashboard moves focus to the scrollback, as it does in a standalone session, instead of returning to the dashboard</li> </ul>

Dashboard /loop without a prompt shows its usage instead of starting a new session

grok --resume <title> matches a title whatever separates its words, so fix-login-bug finds "Fix login bug"

[Copy] buttons appear under code blocks in finished replies, labeled with the language or file name of the code

Dashboard peek replies waiting on a clipboard paste are canceled with a toast when you move the peek to another row or press Esc, instead of being sent later

grok worktree rm no longer suggests -f for a worktree that -f would also refuse to remove

Advanced PowerShell inline hooks that read $input run with a warning instead of failing

Hooks that return continue: false stop the turn instead of being ignored

Copy rows under code blocks, tables, and diagrams display correctly after switching between minimal and fullscreen modes

Copying a code block or a whole reply keeps its original tabs instead of turning them into spaces