fix(pstack): unblock headless Grok writers

[DavidsonErickson]

Closes #34

Why

pstack-runner starts external Grok lanes without interactive stdin. Grok requests permission when search_replace runs under acceptEdits, then cancels the headless turn. Using bypassPermissions for Grok isolated-write lanes lets the explicitly allowed write tool run without a prompt. The assigned working directory, workspace sandbox, tool allowlist, denied tools, and no-subagent controls remain in place.

Scope

• Give Claude and Grok separate permission-mode selectors in runner/commands.ts.
• Keep Grok read-only lanes on plan; use bypassPermissions only for Grok isolated-write lanes.
• Lock the permission mode and the existing Grok sandbox and tool restrictions in runner/commands.test.ts.
• Document the headless Grok mapping in provider-dispatch.md.

This change does not install or release the plugin.

Blast radius

The behavior change affects only the command that starts a Grok isolated-write lane. Grok read-only lanes and all Claude and Codex lanes keep their existing permission modes. Although bypassPermissions removes Grok's interactive edit prompt, it does not expand the assigned working directory, sandbox, allowed tools, denied tools, or recursive-agent access.

Verification

• bun install --frozen-lockfile completed with no changes.
• bun run test passed all 158 tests.
• bun run typecheck passed strict TypeScript checks.
• All four plugin and marketplace manifests parsed as JSON.
• PSTACK_STATIC_ONLY=1 bash tests/skill-collision-repro.sh passed all static invariants.
• git diff --check main...HEAD passed.
• The exact candidate is installed in every affected harness.
• The changed behavior passes from each installed user surface.
• The installed version, action, and observed result are recorded.

Live evidence from the source candidate passed. A real Codex-parent Grok isolated-write run used bypassPermissions, the workspace sandbox, the explicit search_replace allowlist, denied recursive tools, and --no-subagents. The Grok session allowed search_replace, completed the requested write, and produced a receipt with exit code 0, status complete, reported model grok-4.6-build, and provider-backed model verification.

Installed-harness verification is not complete. The source checkout ran directly; no installed Open Pstack plugin was changed or tested. This PR must remain a draft until the repository's installed-candidate gate passes.

[greptile-apps]

Greptile Summary

This PR separates Claude and Grok permission-mode selection so headless Grok isolated-write lanes use bypassPermissions while retaining their workspace sandbox and tool restrictions.

• Keeps Grok read-only lanes in plan mode and leaves Claude and Codex mappings unchanged.
• Updates command-construction tests to lock the provider-specific permission and isolation flags.
• Documents the headless Grok writer mapping and retained execution boundaries.

Confidence Score: 5/5

The PR appears safe to merge because the provider-specific mapping is internally consistent and no concrete changed-code failure remains.

The change is narrowly limited to Grok isolated-write permission prompting, while read-only behavior and the existing workspace, tool, cwd, and recursion restrictions remain represented in the generated command and regression tests.

Important Files Changed

Filename	Overview
plugins/pstack/skills/poteto-mode/scripts/runner/commands.ts	Splits permission-mode selection by provider and changes only Grok isolated-write invocations to bypassPermissions while preserving sandbox, tool, cwd, and recursion controls.
plugins/pstack/skills/poteto-mode/scripts/runner/commands.test.ts	Updates isolated-write assertions to cover the new Grok permission mode and retained sandbox, allowlist, and denied-tool arguments.
plugins/pstack/skills/poteto-mode/references/provider-dispatch.md	Documents why headless Grok writers require bypassPermissions and reiterates the isolation boundaries that remain active.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[Assigned external lane] --> B{Provider}
  B -->|Claude| C{Access mode}
  C -->|read-only| D[plan]
  C -->|isolated-write| E[acceptEdits]
  B -->|Grok| F{Access mode}
  F -->|read-only| G[plan + read-only sandbox]
  F -->|isolated-write| H[bypassPermissions + workspace sandbox]
  H --> I[Explicit tools and denied recursive-agent controls]

Loading

_{Reviews (1): Last reviewed commit: "fix(pstack): unblock headless Grok write..." | Re-trigger Greptile}

[DavidsonErickson]

I hit this with Grok Build 1.0.13 and open-pstack 1.2.1 on macOS. Two headless writer runs ended with PermissionCancelled. The proposed fix matches what I observed.