fix(runner): pre-approve file edits for headless Grok writers

[smashru]

What changed

Headless Grok cancels any tool call that needs an approval prompt, then ends the turn. The runner starts isolated-write Grok lanes with --permission-mode acceptEdits, but on grok CLI 1.0.41, that mode does not pre-approve Grok's file tools. Every write and search_replace call stops at a prompt that headless mode cancels. The runner exits 77 with a permission-cancelled receipt, and the worktree has no changes. A real grok:grok-4.7@xhigh implementation lane ended this way after 38 turns. Its last tool result was "User cancelled the execution for tool write".

• isolated-write Grok lanes now pass --allow Edit after --allow Bash. Grok's permissions doc groups Write with Edit as one rule name, and live probes show that --allow Edit pre-approves both search_replace and write. The workspace sandbox still refuses writes outside the worktree, and deny rules and hooks still apply. Read-only lanes pass no allow rules, as before.
• The isolated-write --tools list now includes write. Now that fix(runner): let headless Grok writers run shell commands #81 restores the valid terminal ID, run_terminal_cmd, Grok honors the allowlist. Without this entry, a writer cannot call write at all.
• provider-dispatch.md names the new rule and says why the lane needs it. It also names the shell commands Grok still cancels under --allow Bash, so writer prompts keep file changes on the file tools.

This PR stacks on #81. Until #81 merges, this PR also shows #81's commits. Review the top three commits, test(runner): reproduce headless Grok writers losing file edits, fix(runner): pre-approve file edits for headless Grok writers, and docs(dispatch): name the shell commands headless Grok still cancels.

Tradeoffs

• A --tools list with write and no allow rule does not help. That probe still ends with "User cancelled the execution for tool write".
• --always-approve would approve every tool, which the uses bounded write modes without blanket bypasses test forbids. --no-plan changes nothing.
• A path-scoped rule such as Edit(<worktree>/**) would not shrink what the lane can write. The pre-approved shell can already write anywhere the sandbox allows, so the sandbox is the real limit.

Verification

• Bun tests, strict typecheck, static invariants, and plugin validation pass.
• The exact candidate is installed in every affected harness.
• The changed behavior passes from each real user surface.
• The installed version, action, and observed result appear below.

On 7140d30, the two changed tests fail (commands.test.ts: 4 pass, 2 fail). With the fix, bun run test passes 162/162. bun run typecheck, the manifest JSON checks, PSTACK_STATIC_ONLY=1 bash tests/skill-collision-repro.sh, and git diff --check pass.

Live evidence so far comes from the source runner on this branch. A Claude Code session's shell launched it with --parent claude --provider grok --model grok-4.7 --effort xhigh --mode isolated-write on grok CLI 1.0.41, and Grok reported the model as grok-4.7-build. Each lane ran in a fresh scratch git repository. The 7140d30 column is #81's head. It ran once from the installed Claude Code plugin and once from source.

Lane prompt	7140d30	This branch (source)
Create probe.txt with write	Grok has no write tool. It either falls back to search_replace, which it then cancels with exit 77, or replies FAILED. No file is created.	complete, probe.txt created
Replace alpha with beta in seed.txt with search_replace	Exit 77, permission-cancelled on search_replace	complete, seed.txt reads beta
Create notes/hello.txt and edit seed.txt, no tool named	Exit 77, permission-cancelled on search_replace	complete, both changes made
Create a file under $HOME with write	No file	Grok allows the call, the sandbox returns "Operation not permitted (os error 1)", and no file appears

Grok's session tool_definitions.json for these lanes lists exactly six tools: grep, list_dir, read_file, run_terminal_command, search_replace, and write.

The shell note comes from one-command probes on the same argv, read from Grok's permission_resolved events. Grok allowed touch, mkdir, git add, echo, a single-line and a multi-line python3 -c, a heredoc into cat, and printf ... > /dev/null. It cancelled printf ... > plain.txt, printf ... | tee teed.txt, echo "$(pwd)", echo "${PROBE_UNSET:-x}", and (cd . && ls).

This PR stays a draft until the exact candidate is installed in the Claude Code and Codex harnesses and passes from both.

🤖 Generated with Claude Code

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge, with the new Grok writer permissions remaining bounded by the workspace sandbox and the failure status fully wired through the runner.

Summary

This PR makes headless Grok writer lanes capable of completing file edits while preserving their workspace sandbox and records provider-reported failures more precisely.

• Adds the Grok Edit permission rule and write tool for isolated-write lanes.
• Restricts the environment inherited by pre-approved Grok writer shells.
• Classifies permission-prompt cancellations separately from malformed output and preserves bounded evidence in receipts.
• Adds regression coverage and updates provider-dispatch guidance.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Runner receives Grok lane] --> B{Access mode}
  B -->|read-only| C[Plan mode and read-only sandbox]
  B -->|isolated-write| D[Workspace sandbox]
  D --> E[Allow Bash and Edit]
  E --> F[Expose read, terminal, search_replace, and write tools]
  F --> G[Run with filtered environment]
  C --> H[Parse terminal event]
  G --> H
  H -->|Successful result and model proof| I[Write output and complete receipt]
  H -->|Permission prompt cancelled| J[Remove output and write permission-cancelled receipt]
  H -->|Other provider error| K[Remove output and write child-failed receipt]
  H -->|Malformed stream| L[Remove output and write malformed-output receipt]

Loading

_{Reviews (1) · Last reviewed commit: "fix(runner): pre-approve file edits for ..."}