fix(runner): make Grok isolated-write lanes usable

[andrewfree]

Closes #

What changed

Two fixes for the external runner's Grok lane, found while driving pstack-runner --provider grok from Claude Code with grok CLI 1.0.41.

1. Tool name. The runner allowlists the shell tool as run_terminal_cmd, but grok 1.0.41 names it run_terminal_command. The unknown name is ignored, so every shell call falls through to an approver that a headless run cannot answer, and the lane is cancelled with User cancelled the execution for tool run_terminal_command.
2. Permission mode for writers. Even with the right name, acceptEdits still routes multi-line commands (a python3 - <<'PY' heredoc) to that approver. Isolated-write Grok lanes now pass --permission-mode bypassPermissions, which is Grok's always-approve policy, while keeping --sandbox workspace; the sandbox, not the approver, confines the writer (reads everywhere, writes only to the lane's cwd, Grok's own state, and the system temp dirs; child network stays open). Read-only lanes keep plan plus read-only.

Review round (Codex GPT-6 Astra, xhigh): the writer test now asserts the complete Grok argv instead of arrayContaining, and the comment plus provider-dispatch.md state the approval-policy change and the sandbox's actual bounds, verified against the Grok sandbox and permissions docs.

Verification

• Bun tests, strict typecheck, static invariants, and plugin validation pass.
• The exact candidate is installed in every affected harness.
• The changed behavior passes from each real user surface.
• The installed version, action, and observed result appear below.

Live evidence:

• Candidate: this branch's scripts/runner/pstack-runner at the reviewed commit, run from a checkout of the branch, with grok CLI 1.0.41 and model grok-4.7 (reported grok-4.7-build). Claude Code additionally has open-pstack 1.4.4 installed from the fork, which carries this change.
• Claude parent: pstack-runner --parent claude --provider grok --model grok-4.7 --mode isolated-write with a prompt asking for a file written through a shell heredoc. Receipt: status: complete, modelVerified: true; the workspace contains proof.txt with pr92 claude; final reply done.
• Codex parent: same invocation with --parent codex. Receipt: status: complete, modelVerified: true; proof.txt contains pr92 codex; final reply done.
• Before the fix, the same lane was cancelled at the first shell call under both parents.
• bun test in scripts/runner: 50 tests pass.

🤖 Generated with Claude Code

[mergify]

This pull request does not currently match the merge queue conditions, so it cannot be queued from here. The box comes back if it matches again.

[greptile-apps]

Confidence Score: 5/5

[High risk] Changes Grok runner permission and tool configuration.

The PR appears safe to merge; no actionable regression was established.

Summary

The PR updates the Grok shell-tool name in both access modes and uses bypassPermissions for isolated-write lanes while retaining the workspace sandbox. It updates command assertions and the dispatch reference accordingly.

_{Reviews (1) · Last reviewed commit: "fix(runner): make Grok isolated-write la..."}

[ericlitman]

Thanks for this, @andrewfree. I appreciate the time you put into it. Open Pstack now accepts contributions as detailed issues rather than pull requests, so I'm closing this one. If it's still relevant, please open an issue describing the problem, how to reproduce it, and the change you'd suggest. I'll take it from there.

[ericlitman]

Follow-up to the close: this work is already tracked in #34, so there is no need to open a new issue. This PR is noted there as prior art and will be credited when the fix lands.