diff --git a/plugins/pstack/skills/poteto-mode/references/provider-dispatch.md b/plugins/pstack/skills/poteto-mode/references/provider-dispatch.md
index 74ab90d..553031f 100644
--- a/plugins/pstack/skills/poteto-mode/references/provider-dispatch.md
+++ b/plugins/pstack/skills/poteto-mode/references/provider-dispatch.md
@@ -80,7 +80,7 @@ Start the background process, continue launching the other lanes, then drain the
 
 The runner and its preflight have no implicit timeout. Do not invent a duration from role, mode, or a convenient round number; real implementation lanes can run for 90 minutes or much longer. Pass `--timeout` only when the user, an external service deadline, or a measured task contract supplies a real bound. That value starts at wrapper entry, before module loading and argument parsing, and remains one absolute deadline across setup, preflight, model execution, and output capture. It is never a fresh allowance per child, and long waits are armed in runtime-safe chunks without shortening the supplied deadline. Otherwise supervise liveness through the retained background task/session handle and cancel manually only on evidence that the run is dead. Cancel through that retained handle so the runner receives SIGINT or SIGTERM, sends it to an active child when one remains, stops waiting on inherited output pipes, removes the empty output reservation, and writes a `cancelled` receipt. Preserve that receipt; a retry is a new attempt with new unique output and receipt paths. Unchanged running state is not a dropout, and Claude's ten-minute foreground ceiling is never a reason to terminate a healthy lane.
 
-Read-only mode maps to Claude plan mode with project-only settings and an explicit tool list, Codex's read-only sandbox, and Grok plan mode plus its `read-only` sandbox and read-oriented tool list. Grok's built-in read-only profile deliberately keeps its own state and system temporary directories writable, so point a read-only Grok lane at the actual checkout rather than a worktree under `/tmp`, `/var/tmp`, or the host's temporary directory. `isolated-write` maps to Claude `acceptEdits` with project-only settings, Codex `workspace-write`, and Grok `acceptEdits` plus its `workspace` sandbox and write-capable tool list. Give every writer only a dedicated worktree or output directory. Never route a writer into the primary checkout.
+Read-only mode maps to Claude plan mode with project-only settings and an explicit tool list, Codex's read-only sandbox, and Grok plan mode plus its `read-only` sandbox and read-oriented tool list. Grok's built-in read-only profile deliberately keeps its own state and system temporary directories writable, so point a read-only Grok lane at the actual checkout rather than a worktree under `/tmp`, `/var/tmp`, or the host's temporary directory. `isolated-write` maps to Claude `acceptEdits` with project-only settings, Codex `workspace-write`, and Grok `bypassPermissions` inside its `workspace` sandbox with the write-capable tool list. Grok needs `bypassPermissions` because headless runs cannot answer an interactive edit prompt. The assigned working directory, workspace sandbox, explicit tool allowlist, denied tools, and no-subagent controls still limit the lane. Give every writer only a dedicated worktree or output directory. Never route a writer into the primary checkout.
 
 Every concurrent external lane needs distinct prompt, output, and receipt paths. The launcher reserves output and receipt paths exclusively and refuses to overwrite them.
 
diff --git a/plugins/pstack/skills/poteto-mode/scripts/runner/commands.test.ts b/plugins/pstack/skills/poteto-mode/scripts/runner/commands.test.ts
index ea697ff..ccc52b1 100644
--- a/plugins/pstack/skills/poteto-mode/scripts/runner/commands.test.ts
+++ b/plugins/pstack/skills/poteto-mode/scripts/runner/commands.test.ts
@@ -113,7 +113,7 @@ describe("invocationCommand", () => {
     ]);
   });
 
-  it("uses bounded write modes without blanket bypasses", () => {
+  it("uses provider-specific write permissions inside bounded sandboxes", () => {
     const codex = invocationCommand(options({ mode: "isolated-write" }));
     expect(codex.args).toEqual(
       expect.arrayContaining(["--sandbox", "workspace-write"])
@@ -124,11 +124,13 @@ describe("invocationCommand", () => {
     expect(grok.args).toEqual(
       expect.arrayContaining([
         "--permission-mode",
-        "acceptEdits",
+        "bypassPermissions",
         "--sandbox",
         "workspace",
         "--tools",
         "read_file,grep,list_dir,run_terminal_cmd,search_replace",
+        "--disallowed-tools",
+        "Agent,search_tool,use_tool",
       ])
     );
     expect(grok.args).not.toContain("--always-approve");
diff --git a/plugins/pstack/skills/poteto-mode/scripts/runner/commands.ts b/plugins/pstack/skills/poteto-mode/scripts/runner/commands.ts
index 5f2b10c..a9782ff 100644
--- a/plugins/pstack/skills/poteto-mode/scripts/runner/commands.ts
+++ b/plugins/pstack/skills/poteto-mode/scripts/runner/commands.ts
@@ -55,10 +55,14 @@ function grokTools(mode: AccessMode): string {
   return [...readonly, ...(mode === "isolated-write" ? ["search_replace"] : [])].join(",");
 }
 
-function permissionMode(mode: AccessMode): string {
+function claudePermissionMode(mode: AccessMode): string {
   return mode === "read-only" ? "plan" : "acceptEdits";
 }
 
+function grokPermissionMode(mode: AccessMode): string {
+  return mode === "read-only" ? "plan" : "bypassPermissions";
+}
+
 function effortOverride(effort: Effort): string {
   return `model_reasoning_effort=${JSON.stringify(effort)}`;
 }
@@ -75,7 +79,7 @@ export function invocationCommand(options: RunnerOptions): CommandSpec {
           "--effort",
           options.effort,
           "--permission-mode",
-          permissionMode(options.mode),
+          claudePermissionMode(options.mode),
           "--setting-sources",
           "project",
           "--strict-mcp-config",
@@ -129,7 +133,7 @@ export function invocationCommand(options: RunnerOptions): CommandSpec {
           "--reasoning-effort",
           options.effort,
           "--permission-mode",
-          permissionMode(options.mode),
+          grokPermissionMode(options.mode),
           "--sandbox",
           grokSandbox(options.mode),
           "--tools",