Drive crush through its server so runs are live, not a black box

CHANGELOG.md

@@ -43,3 +43,10 @@ Initial implementation.
   browser rebuilds its table columns and re-renders its markdown at the
   current width; plain (non-TTY) output and summary lines wrap to the
   terminal width instead of a fixed 200 characters.
+- crush runs now execute through `crush server` in client mode: thinking,
+  tool calls and cumulative token usage stream live into the monitor
+  (run_complete is correlated by RunID), budget bands and spend
+  declarations work on real usage, and aborts cancel the remote session
+  through the cancel endpoint before teardown. Permission and question
+  requests cannot be satisfied unattended and fail closed (exit 2) naming
+  the tool. Runs fall back to `crush run` when the server cannot start.

README.md

@@ -53,7 +53,7 @@ Antigravity (agy) is deferred: it has no headless execution path.
 | codex | `codex exec - --json --output-last-message` | ✓ | ✓ | `workspace-write` sandbox, approvals never |
 | pi | `pi --mode json` | ✓ | ✓ | tool grants mapped onto pi's builtin tools |
 | opencode | `opencode run --format json --auto` | partial | — | `--auto` |
-| crush | `crush run` (stdin) | text only | — | your crushrc `permissions allow` entries |
+| crush | `crush server` (client mode): workspace + SSE events, clean cancel; falls back to `crush run` | ✓ live | ✓ | workspace permission level; unanswered permission/question requests fail closed (exit 2) |
 | goose | experimental (`TRAUST_CLI_GOOSE_ARGS` overrides the template) | — | — | goose's own configuration |
 
 Every adapter prints its honest caveats before a run. `--unsafe-full-permission`

cmd/run.go

@@ -248,6 +248,8 @@ func (plainSink) Event(ev harness.Event) {
 	switch ev.Kind {
 	case harness.EventText:
 		fmt.Println(tui.Wrap(ev.Text, tui.TerminalWidth()))
+	case harness.EventThinking:
+		fmt.Println(tui.Wrap(styles.Muted.Render("· "+ev.Text), tui.TerminalWidth()))
 	case harness.EventToolCall:
 		fmt.Println(styles.Accent.Render("→ " + ev.Tool))
 	case harness.EventResult:

internal/harness/crush.go

@@ -39,9 +39,9 @@ func (c *Crush) Command(ctx context.Context, spec *RunSpec) *exec.Cmd {
 
 func (c *Crush) Notes() []string {
 	return []string{
-		"crush run emits plain text, not a structured stream: tool calls are not distinguished live",
-		"token usage is not reported by crush run: the spend declaration is skipped",
-		"headless permission posture comes from your crushrc `permissions allow` entries — pre-allow the tools the skills need",
+		"running through crush server mode: thinking, tool calls and token usage stream live into the monitor",
+		"permission and question requests cannot be answered unattended: the run fails closed (exit 2) naming the tool — pre-allow the tools skills need in a .crush/crushrc at the harness root (`permissions allow`)",
+		"if the server cannot start, the run falls back to `crush run` (plain text, no live events, no usage)",
 	}
 }