feat: enhance crew integration checks and recovery mechanisms

- Improved handling of interrupted checks in CrewMergeJournal, including detailed execution states and outputs.
- Added functionality to reconcile check executions and validate applied checkouts post-crash.
- Introduced a new prompt mechanism for handling stale bridges in crew lanes, allowing for retries and recovery.
- Updated UI components to reflect the state of integration checks and custody halts more clearly.
- Added tests for new functionalities, including check process liveness and custody scope validation.

Author: CjLogic

docs/behavioral-merge-review.md

@@ -35,7 +35,9 @@ The sidebar reports the result as a **candidate decision**, not as whether CrewC
 
 The main process atomically persists a merge journal under CrewCode's user-data directory before combination begins and at every phase transition. Each record contains the session, base branch/SHA, lane label, branch, worktree path, owned files and SHA, current phase, discovered check commands, outputs, status, and timestamps.
 
-After restart, an in-flight operation is shown as `interrupted` instead of implying that its process survived. Any running check is likewise marked interrupted. A candidate that had already passed is reconciled against Git; moved base/lane/ref inputs make it stale. If CrewCode stopped while applying but the base now equals the retained integration SHA, reconciliation records the operation as applied. The base is never inferred to be updated merely because a subprocess had started.
+After restart, an in-flight operation is shown as `interrupted` instead of implying that it completed. Every check process receives a random custody token plus a persisted local PID or remote PID file. Restart reconciliation probes the PID and verifies the token through the process environment where the operating system exposes it, reporting `running`, `exited`, or `unknown` rather than treating a reused PID as evidence. A still-running or unresolved interrupted check blocks another verification run. Platforms that do not expose enough process identity evidence remain `unknown` and require manual resolution; CrewCode does not guess that the process exited.
+
+A candidate that had already passed is reconciled against Git; moved base/lane/ref inputs make it stale. If CrewCode stopped while applying and the base ref now equals the retained integration SHA, that SHA alone is not sufficient evidence of success. Reconciliation also requires `HEAD` to be attached to the expected base branch at the exact integration commit, a clean index and worktree (including untracked files), and no remaining `MERGE_HEAD`. Only then is the operation recorded as applied; otherwise it remains interrupted with the failed checkout/index invariant shown in the sidebar. The base is never inferred to be updated merely because a subprocess had started.
 
 Crew session ownership is also persisted locally. Each lane has an explicit **enabled / paused** switch and an editable **next action** checkpoint, automatically seeded from its latest assignment. Pausing stops the lane runtime but retains its worktree, transcript, and checkpoint; resuming does not auto-submit work. Process-local bridge and terminal IDs are cleared on recovery, lanes that previously said `running` recover as `ready`, and persisted pause/checkpoint state remains visible. The UI never claims an agent process survived without evidence.
 

docs/current-state.md

@@ -24,7 +24,7 @@ Supervisor reporting is incremental, not batched: `useCrewSupervisor` feeds each
 
 Task distribution (`session.distribution`, default `split`) is a live header toggle separate from `mode`. `split` = each worker gets a distinct sub-task: the supervisor's per-turn run-selection snapshot carries `distributionDirective()`, and `validateDirectivePolicy()` hard-blocks `"to":"all"`, targets that resolve to multiple workers, unavailable/skipped targets, and exact duplicate task text before dispatch. No-supervisor shared mode renders one composer per worker in `CrewTimeline`, and split timeline rounds show each lane's own prompt inside that lane card rather than collapsing to one shared prompt. `broadcast` = same message to all (`handleBroadcast`) and the supervisor may use `"to":"all"`. `set_distribution` is legal at any phase, so it can flip mid-run.
 
-Crew control stops are scoped intentionally: `stop all` in `CrewSurface` aborts every runtime, the supervisor composer stop button calls `abortSupervisor()` only, and lane composer stop buttons call `restartLane()` for that lane only. The per-lane enabled/paused switch is durable: pausing releases that runtime while retaining the worktree, transcript, and editable `nextAction`; every assignment seeds the checkpoint, restart recovery preserves it, and supervisor status snapshots include paused lanes without making them delegation targets. The supervisor sidebar width is local UI state in `CrewSurface` and is resized with the shared `Splitter`; the supervisor thread also has a scroll-to-bottom affordance. Shared timeline lane groups (`crew-lane-group`) are locally collapsible with chevrons so dense multi-agent rounds remain scannable. Every direct lane composer lazily supports `@` file search scoped to that lane's effective worktree/base path and auto-grows from one line to a bounded 220px before scrolling.
+Crew control stops are scoped intentionally: `stop all` in `CrewSurface` aborts every runtime, the supervisor composer stop button calls `abortSupervisor()` only, and lane composer stop buttons call `restartLane()` for that lane only. A lane stop must release bridge runtimes through `useBridgeRegistry.dropBridge()` rather than raw stop IPC so the cached `(tab, agent)` id is removed; lane prompt dispatch also replaces and retries a `bridge not found` runtime once, re-priming the replacement before sending. The per-lane enabled/paused switch is durable: pausing releases that runtime while retaining the worktree, transcript, and editable `nextAction`; every assignment seeds the checkpoint, restart recovery preserves it, and supervisor status snapshots include paused lanes without making them delegation targets. The supervisor sidebar width is local UI state in `CrewSurface` and is resized with the shared `Splitter`; the supervisor thread also has a scroll-to-bottom affordance. Shared timeline lane groups (`crew-lane-group`) are locally collapsible with chevrons so dense multi-agent rounds remain scannable. Every direct lane composer lazily supports `@` file search scoped to that lane's effective worktree/base path and auto-grows from one line to a bounded 220px before scrolling. Combined-check processes carry durable custody tokens and PID evidence; restart reconciliation reports them as running, exited, or unresolved and gates a replacement verification accordingly. A crash during apply is called applied only after validating the attached base checkout, exact HEAD, clean index/worktree, and absence of unfinished merge state.
 
 Isolated crew review treats clean Git merges as unverified. Cross-lane Diff shows branch/commit ownership, runtime state, exact file overlap, and narrow cross-file contract heuristics; the crew merge sidebar requires explicit acknowledgment when signals exist. Crew sessions persist locally so restart retains lane/worktree provenance while clearing process-local runtime ids. Compare/Merge Git fetches are keyed to a stable ownership fingerprint rather than the once-per-second runtime/usage updates, preventing loaded review evidence from flashing back to a loading state. A merge audit is written before Git starts and recovers a leftover `running` operation as `interrupted`. After a clean merge, the sidebar discovers and visibly presents allowlisted package `typecheck`/`test` scripts; main runs only those discovered ids with `CI=1`, and persists pass/fail/interrupted evidence for local and SSH workspaces. See `docs/behavioral-merge-review.md`.
 

docs/execution-custody.md

@@ -1,5 +1,7 @@
 # Execution Custody
 
+> Scope: interactive halt-and-reauthorize custody is enabled for synthetic crew lane threads only. Ordinary solo chats and the crew supervisor use their normal provider error/retry behavior and do not receive custody-loss banners or gates.
+
 > Status: living document. `docs/security-model.md` covers **granting** authority —
 > whether it may cross the next boundary. This document covers **withdrawing** it:
 > what happens when authority that was already granted stops being knowable while

docs/security-model.md

@@ -208,14 +208,15 @@ cannot be prevented, not what cannot be *contained after the fact*.
    test that read-only/ask/plan block writes and that `full`/bypass is reachable only by
    explicit opt-in. Ollama and OpenRouter expose **no** tool surface at all (pure chat
    streamers), so they cannot write or exec regardless of mode.
-4. **Authority can be withdrawn after it was granted.** Previously CrewCode could only
-   deny the *next* action; a grant already in flight was good until the session ended,
-   and an execution whose outcome was never observed left no trace. Now a persisted
-   custody journal records every bridge execution, an interrupted turn is recovered as
-   halted rather than assumed complete, mid-turn authority mutations are refused and
-   deferred, and a tripped invariant refuses privileged actions until a human explicitly
-   reauthorizes — reporting the exact failed invariant and affected scope, with the
-   interrupted prompt and partial response preserved. See hop 5 and
+4. **Crew-lane authority can be withdrawn after it was granted.** Previously CrewCode
+   could only deny the *next* action; a grant already in flight was good until the lane
+   ended, and an execution whose outcome was never observed left no trace. For synthetic
+   crew lane bridge threads, a persisted custody journal records execution, an interrupted
+   turn is recovered as halted rather than assumed complete, mid-turn authority mutations
+   are refused and deferred, and a tripped invariant refuses privileged actions until a
+   human explicitly reauthorizes — reporting the exact failed invariant and affected
+   scope, with the interrupted prompt and partial response preserved. Ordinary solo chats
+   and crew supervisors deliberately retain normal provider error/retry behavior. See hop 5 and
    [`execution-custody.md`](execution-custody.md). Coverage gaps (remote transport, PTY,
    plugin sessions) are named there rather than implied away.
 
@@ -240,13 +241,20 @@ cannot be prevented, not what cannot be *contained after the fact*.
    - **Claude** — full coverage. Full Access routes through `canUseTool` (no more native
      `bypassPermissions`), so every command is classified; denylisted ones pause. Highest
      priority because Claude's Full Access is an unsandboxed shell.
+   - **Grok** — full coverage. Full Access now routes through `session/request_permission`
+     (`--permission-mode default` instead of `bypassPermissions`); benign commands
+     auto-approve, denylisted ones pause. Also an unsandboxed shell, so high priority.
    - **CrewCoder(ACP), Hermes(ACP)** — covered via the tool call's `rawInput`; denylisted
      commands fall through to a confirmation prompt instead of auto-approving.
-   - **Codex** — **not yet routed through the tripwire**, but Full Access still runs under a
-     `workspace-write` sandbox (writes scoped to the workspace, network off), so its blast
-     radius is already the smallest. Tracked as follow-up.
-   - **Grok, pi** — **not yet covered**; their Full Access uses engine-native bypass / a
-     confirmation channel that does not carry the command string. Tracked as follow-up.
+   - **Codex** — defense-in-depth tripwire wired into its approval handler, AND Full Access
+     runs under a `workspace-write` sandbox (writes scoped to the workspace, network off).
+     The sandbox alone already blocks most of the denylist (`curl|sh`, force-push, `dd`,
+     `mkfs`, `sudo`, `chmod /` all need network or out-of-workspace access it denies); the
+     only residual is destroying files *inside* the workspace, which is git-recoverable.
+   - **pi** — **not covered.** pi's protocol has no pre-execution permission request that
+     carries the command string (its `confirm` channel omits it, and `tool_execution_start`
+     is informational — it cannot block). A tripwire here needs a pi protocol change; a
+     best-effort hook would be false confidence, so it is deliberately omitted and tracked.
    - **Ollama, OpenRouter** — N/A (no tool surface; cannot exec).
 7. **MCP servers run with user privilege.** A user-configured MCP server is trusted code on
    the host; CrewCode gates *which* sessions may use it, not what the server binary itself

src/main/agents/codex-bridge.ts

@@ -1,6 +1,7 @@
 import { spawnAgentProcess } from './agent-spawn'
 import type { AgentBridge, BridgeStartOpts, EmitFn, ModeLevel, RequestUserFn, TurnUsage } from './bridge-types'
 import { buildUsage, contextWindowFor } from './model-context'
+import { tripwireForToolCall } from './dangerous-command'
 
 // Codex app-server JSON-RPC over stdio.
 // Protocol: newline-delimited JSON (`"jsonrpc": "2.0"` header omitted on the wire).
@@ -516,15 +517,26 @@ export async function createCodexBridge(
       // Mode switches mutate opts on the live bridge; honor them even when the
       // Codex thread was started with a different approval policy.
       const modeDecision = codexApprovalDecisionForMode(opts.mode, opts.toolPolicy)
-      if (modeDecision || !requestUser) {
+      // Full Access tripwire: a denylisted command must confirm even when the mode
+      // would auto-accept. Codex's workspace-write sandbox (no network, scoped
+      // writes) already blocks most of the denylist; this is defense-in-depth for
+      // in-workspace destruction whenever Codex does surface an approval request.
+      const itemRecord = (msg.params.item && typeof msg.params.item === 'object') ? msg.params.item as Record<string, unknown> : undefined
+      const codexCommand = msg.params.command ?? itemRecord?.command
+      const codexVerdict = codexCommand !== undefined ? tripwireForToolCall('shell', { command: codexCommand }) : { dangerous: false as const }
+      if (!codexVerdict.dangerous && (modeDecision || !requestUser)) {
         respond(msg.id, { decision: modeDecision ?? 'accept' })
         return
       }
+      if (!requestUser) {
+        respond(msg.id, { decision: codexVerdict.dangerous ? 'decline' : (modeDecision ?? 'accept') })
+        return
+      }
       const response = await requestUser({
         kind: 'permission',
         turnId: currentTurnId ?? undefined,
-        title: msg.method.includes('commandExecution') ? 'approve command execution' : 'approve file change',
-        message: typeof msg.params.reason === 'string' ? msg.params.reason : undefined,
+        title: codexVerdict.dangerous ? 'Full Access tripwire — confirm dangerous command' : (msg.method.includes('commandExecution') ? 'approve command execution' : 'approve file change'),
+        message: codexVerdict.dangerous ? codexVerdict.reason : (typeof msg.params.reason === 'string' ? msg.params.reason : undefined),
         detail: requestDetail(msg.params),
         dangerous: true,
         source: 'codex',

src/main/agents/grok-bridge.test.ts

@@ -91,7 +91,8 @@ describe('grokPermissionMode', () => {
 
   it('maps build to interactive approval and full to bypass', () => {
     expect(grokPermissionMode({ mode: 'build' })).toBe('default')
-    expect(grokPermissionMode({ mode: 'full' })).toBe('bypassPermissions')
+    // Full Access routes through 'default' (not native bypass) so the tripwire can inspect commands.
+    expect(grokPermissionMode({ mode: 'full' })).toBe('default')
   })
 
   it('defaults an absent mode to interactive approval rather than bypass', () => {

src/main/agents/grok-bridge.ts

@@ -17,6 +17,7 @@ import type {
 } from './bridge-types'
 import { buildUsage } from './model-context'
 import { enrichUsageContextWindow } from './openrouter-model-context'
+import { tripwireForToolCall } from './dangerous-command'
 
 // Grok Build via ACP (Agent Client Protocol) — newline-delimited JSON-RPC 2.0
 // over stdio. CrewCode is the client and spawns `grok agent stdio`.
@@ -140,7 +141,11 @@ export function grokPermissionMode(opts: Pick<BridgeStartOpts, 'mode' | 'toolPol
   // A constrained role (supervisor, completion) outranks the composer mode.
   if (opts.toolPolicy === 'read-only') return 'dontAsk'
   if (opts.mode === 'ask' || opts.mode === 'plan') return 'dontAsk'
-  if (opts.mode === 'full') return 'bypassPermissions'
+  // Full Access used to send 'bypassPermissions', which made Grok run every tool
+  // silently — leaving no chance to inspect commands. Route through 'default' so
+  // Grok asks via session/request_permission; CrewCode auto-approves everything
+  // except the denylist (the Full Access tripwire, see handlePermissionRequest).
+  if (opts.mode === 'full') return 'default'
   return 'default'
 }
 
@@ -709,14 +714,23 @@ export async function createGrokBridge(
 
   async function handlePermissionRequest(requestMessage: AcpRequestIn, params: Record<string, unknown>): Promise<void> {
     const options = grokPermissionOptions(params)
-    if (opts.mode === 'full' && opts.toolPolicy !== 'read-only') {
+    const fullToolCall = record(params.toolCall)
+    const fullVerdict = tripwireForToolCall(typeof fullToolCall?.kind === 'string' ? fullToolCall.kind : undefined, fullToolCall?.rawInput)
+    if (opts.mode === 'full' && opts.toolPolicy !== 'read-only' && !fullVerdict.dangerous) {
+      // Auto-approve in Full Access — except denylisted catastrophic commands,
+      // which fall through to the confirmation prompt (the Full Access tripwire).
       send({
         jsonrpc: '2.0',
         id: requestMessage.id,
         result: { outcome: { outcome: 'selected', optionId: grokSelectedOption({ requestId: '', action: 'accept' }, params, options) } },
       })
       return
     }
+    if (opts.mode === 'full' && fullVerdict.dangerous && !requestUser) {
+      // Tripwire tripped but no human to confirm — fail safe by refusing.
+      send({ jsonrpc: '2.0', id: requestMessage.id, result: { outcome: { outcome: 'cancelled' } } })
+      return
+    }
     if (writeBlocked(opts) || !requestUser) {
       send({ jsonrpc: '2.0', id: requestMessage.id, result: { outcome: { outcome: 'cancelled' } } })
       return
@@ -729,11 +743,11 @@ export async function createGrokBridge(
       const response = await requestUser({
         kind: 'permission',
         turnId: currentTurnId ?? undefined,
-        title: typeof toolCall?.title === 'string' ? toolCall.title : 'Permission required',
-        message: typeof params.message === 'string' ? params.message : undefined,
+        title: fullVerdict.dangerous ? 'Full Access tripwire — confirm dangerous command' : (typeof toolCall?.title === 'string' ? toolCall.title : 'Permission required'),
+        message: fullVerdict.dangerous ? fullVerdict.reason : (typeof params.message === 'string' ? params.message : undefined),
         detail: JSON.stringify(toolCall ?? params, null, 2).slice(0, 1600),
         options,
-        dangerous: meta.readOnly !== true,
+        dangerous: fullVerdict.dangerous || meta.readOnly !== true,
         source: 'grok',
       })
       const optionId = grokSelectedOption(response, params, options)