Grok isolated-write lanes cancel headless edit permissions

[FBakkensen]

Summary

Open Pstack 1.2.0 launches Grok isolated-write lanes with --permission-mode acceptEdits. Grok Build 1.0.13 asks for permission when the model calls search_replace. A headless session cancels that request immediately, so every attempted edit fails and pstack-runner reports malformed-output.

Read-only Grok lanes are unaffected.

Environment

• Open Pstack 1.2.0 at 27e0ce32be3dfc496d1372a4f3d45d91d15007da
• Grok Build 1.0.13, stable, 5e9a58528b76
• Codex parent on Linux
• OAuth authentication
• Model grok-4.6, reported as grok-4.6-build

Reproduction

Run pstack-runner with these relevant options:

--parent codex
--provider grok
--model grok-4.6
--effort high
--mode isolated-write

Use a prompt that asks Grok to create one file in the assigned workspace.

The runner builds this part of the Grok command:

--permission-mode acceptEdits
--sandbox workspace
--tools read_file,grep,list_dir,run_terminal_cmd,search_replace

Grok reaches the model and requests search_replace. Its session log then records:

permission_requested tool_name=search_replace
permission_resolved tool_name=search_replace decision=cancelled wait_ms=0
turn_ended outcome=cancelled cancellation_category=permission_cancelled

The runner receipt has exit code 65, status malformed-output, and error grok reported an error result.

Expected result

An isolated-write lane can use the write tools allowed by the runner inside the assigned workspace sandbox without an interactive prompt.

Verified local fix

Use bypassPermissions for Grok isolated-write lanes only. Keep plan for read-only lanes and keep the existing sandbox, tool allowlist, denied tools, assigned working directory, and no-subagent controls.

function grokPermissionMode(mode: AccessMode): string {
  return mode === "read-only" ? "plan" : "bypassPermissions";
}

The same writer probe then completed through pstack-runner:

status: complete
reportedModel: grok-4.6-build
modelVerified: true
modelEvidence: provider-report
permission mode: bypassPermissions
sandbox: workspace

The probe created the requested file, and the runner recorded exit code 0. The focused command-construction test also passed after its expected permission mode changed.

Additional observation

--always-approve combined with --permission-mode acceptEdits still cancelled search_replace in this headless invocation. --permission-mode auto appeared as permissionMode: default and did not provide a reliable non-interactive writer path.