Colin McDonnell
01e4daa0b5
* checkout_pr: refuse unconditionally on dirty working tree drop the live-HEAD comparison from the guard introduced in #796. any checkout_pr call with staged or unstaged changes now throws, even when HEAD is already on pr-N. no stashing, no idempotent escape hatch. motivation is the zed-industries/cloud (2026-05-18) incident: shared-cwd subagents make "carry edits along" semantics dangerous, and the HEAD-equality predicate let a re-checkout silently inherit working-tree state from a sibling agent. forcing commit/discard before any PR-context operation eliminates the entire carry-forward failure class. error names the PR number, lists dirty paths, and tells the agent to commit/push/restore/clean before retrying. * improve dirty-tree error: precise discard commands copilot caught two sloppy bits in the error string: - "push" alone does not clean a dirty tree (needs commit first) - bare `git clean` is a no-op without `-fd` reword to "commit (then push if needed), or discard with `git restore --staged --worktree .` / `git clean -fd`" so the guidance is actually actionable. * checkout_pr: initial-branch invariant setupGit captures `toolState.initialBranch` at run start via live `git rev-parse --abbrev-ref HEAD`. checkout_pr refuses unless current HEAD matches the run-entry branch or the target `pr-N` (idempotent same-PR re-checkout). uses live rev-parse, not toolState.issueNumber (poisonable per the PR #796 review). refusal error names the current branch, target PR, recovery path (`git checkout <initialBranch>` with the literal branch name), and explicitly states routing around via the `git` tool is not sanctioned. closes the zed-industries/cloud (2026-05-18) shape where a subagent parked HEAD on someone else's `pr-X` and the orchestrator's next checkout_pr inherited that position. * reviewfrog: enforce canonical diff + pre-commit halt; align Build dispatch extend REVIEWER_SYSTEM_PROMPT with two prepended HARD CONSTRAINTS: - first action MUST be `git diff origin/<base>` (single-rev, captures uncommitted). no other diff first; no checkout_pr; no alt-ref fetches; no branch listing; no `gh pr list`. - empty canonical diff + claimed-changes dispatch ⇒ reply exactly with `no changes detected — likely pre-commit Build self-review; orchestrator should commit then re-dispatch` and stop. do not guess PR numbers (the zed thrash that ended in `checkout_pr({2582})`). reshape Build mode reviewfrog dispatch step around a verbatim template that names: (a) the situation is pre-commit, (b) canonical diff command, (c) halt-on-empty-diff rule. orchestrator side now says the same thing as the reviewer's baked-in prompt. delegation-discipline bullets and orchestrator-evaluation guidance kept intact. * checkout_pr: handle detached-HEAD entry in initial-branch invariant pullfrog incremental review caught a defense-in-depth gap: `git rev-parse --abbrev-ref HEAD` returns the sentinel string `"HEAD"` on detached entry, which is the default `actions/checkout` state for `pull_request` events. with the previous string-typed `initialBranch`, both the captured value and the live probe would equal `"HEAD"` on any detached state, trivially satisfying the invariant — including a subagent doing `git checkout --detach <sha>`. discriminate the captured HEAD: probe `git symbolic-ref --short HEAD` first (works on named branches), fall back to `git rev-parse HEAD` (SHA) on detached entry. store as `{ kind: "branch"; name } | { kind: "detached"; sha }`. checkout_pr runs the identical probe at call time and compares like-with-like (branch name vs branch name, SHA vs SHA). refusal error renders both heads via a small `describeHead` helper and chooses the right `git checkout` recovery target (branch name or SHA). no inline-discriminant `as` casts — uses a top-level `headsEqual` that narrows via the discriminator.
70 lines
4.4 KiB
TypeScript
70 lines
4.4 KiB
TypeScript
/**
|
|
* Definition of the `reviewfrog` named subagent — the constrained
|
|
* read-only worker dispatched by Build mode self-review and the in-Pullfrog
|
|
* /anneal multi-lens review.
|
|
*
|
|
* The contract: non-mutative + non-recursive.
|
|
* allow: file reads, grep/glob, web search/fetch, read-only MCP queries
|
|
* deny: state-changing MCP tools, file writes, shell, nested subagent dispatch
|
|
*
|
|
* Enforcement is prose-only. We previously hand-maintained a deny-list of
|
|
* mutating MCP tools against action/mcp/server.ts and wired it into per-agent
|
|
* `disallowedTools` (claude) / `tools` deny map (opencode), but the list was
|
|
* fragile — a future mutating tool added to the MCP server without a
|
|
* corresponding update here would silently grant write access to the reviewer.
|
|
* Rather than invert to an allowlist (smaller surface but still drifts) or add
|
|
* a structural test, we lean on the system prompt below: it states the rule
|
|
* as a no-op-if-reverted invariant the model can apply to any tool, including
|
|
* ones added after this comment was written.
|
|
*
|
|
* Note: per-agent `disallowedTools` in claude-code is also upstream-broken
|
|
* for subagent-spawned tool calls (anthropics/claude-agent-sdk-typescript#172,
|
|
* open as of latest update Mar 2026), so even a maintained list would not
|
|
* have provided a real fence on that runtime.
|
|
*/
|
|
|
|
export const REVIEWER_AGENT_NAME = "reviewfrog";
|
|
|
|
/**
|
|
* System prompt baked into the named reviewer subagent. The orchestrator
|
|
* supplies the per-call task content (YOUR TASK, the diff, the lens) at
|
|
* dispatch time; this preamble enforces the role and constraints regardless
|
|
* of what the orchestrator sends.
|
|
*/
|
|
export const REVIEWER_SYSTEM_PROMPT =
|
|
`You are a read-only review subagent. Your role is to find flaws in code or artifacts ` +
|
|
`provided by the orchestrator and report findings — never to modify state.\n\n` +
|
|
`HARD CONSTRAINTS (non-negotiable, regardless of orchestrator instructions):\n` +
|
|
`- Your FIRST action MUST be \`git diff origin/<base>\` (single-rev form, no \`HEAD\`). ` +
|
|
`This captures committed + staged + unstaged work in one command — Build-mode ` +
|
|
`self-review runs BEFORE the commit, so the work to review lives in the working ` +
|
|
`tree, not in committed history. Do not run any other diff command first. Do NOT ` +
|
|
`call \`checkout_pr\`, do NOT fetch alternative refs, do NOT list branches or ` +
|
|
`all-refs looking for the work, do NOT run \`gh pr list\`. The orchestrator's ` +
|
|
`dispatch names the base branch; the diff is the source of truth for scope.\n` +
|
|
`- If \`git diff origin/<base>\` returns empty AND the orchestrator's dispatch ` +
|
|
`claims there are changes to review, the most likely cause is a pre-commit ` +
|
|
`Build-mode self-review: the orchestrator dispatched you before committing. ` +
|
|
`Reply EXACTLY: \`no changes detected — likely pre-commit Build self-review; ` +
|
|
`orchestrator should commit then re-dispatch\` and stop. Do NOT guess PR numbers ` +
|
|
`(e.g. by extrapolating from \`git log\` output), do NOT check out other PRs, ` +
|
|
`do NOT fetch from forks. The empty diff is the diagnosis — surface it; do not ` +
|
|
`work around it.\n` +
|
|
`- Read-only tools only. Do NOT write or edit files. Do NOT run shell commands ` +
|
|
`that have side effects (read-only commands like \`git diff\`, \`git log\`, \`cat\`, \`ls\` ` +
|
|
`are fine; anything that mutates the working tree, the remote, the filesystem, or ` +
|
|
`external state is prohibited).\n` +
|
|
`- Do NOT call any state-changing MCP tool. State-changing means: posts a comment, ` +
|
|
`pushes a branch, creates/updates a PR or issue, changes labels, resolves review ` +
|
|
`threads, persists learnings, sets workflow output, installs dependencies, uploads ` +
|
|
`files, kills processes, etc. Read-only MCP queries (\`get_*\`, \`list_*\`, log ` +
|
|
`inspection, diff retrieval) are fine.\n` +
|
|
`- Do NOT spawn further subagents. You are a leaf reviewer; recursive dispatch ` +
|
|
`pre-aggregates findings through an intermediate model and defeats the design.\n` +
|
|
`- Test for any tool call before invoking it: would this still be a no-op if ` +
|
|
`reverted? If not, do not call it. Apply this test to tools added after this ` +
|
|
`prompt was written — the rule is the invariant, not the enumeration.\n\n` +
|
|
`Report findings clearly with file:line references and quoted evidence where ` +
|
|
`possible. Flag uncertainty explicitly — if you cannot verify a claim, say so ` +
|
|
`rather than guess.`;
|