lsm / HyperNeo / 32375799260

80%

Build Type

push

github

Committed by web-flow

Commit Message

fix(daemon): structurally scope Reviewer Bash to read-only gh commands (#2593)

* fix(daemon): structurally scope Reviewer Bash to read-only gh commands

Replace the Reviewer preset's bare Bash grant with scoped Bash(prefix:*)
command patterns (gh pr view/diff/checks, gh api graphql, gh api repos
compare, plus jq/mktemp/echo/cat/test/head/tr/base64/trap/exit posting
helpers) and enforce them with a PreToolUse bash-scope hook that evaluates
every segment of compound commands (heredoc bodies, comments, line
continuations, quotes, and command substitutions are handled), so the
reviewer cannot run tests, builds, or app code while the documented
inspection + review-posting procedure still executes end-to-end.

Tool validation accepts Bash(prefix:*) entries, deriveWorkerDisallowedTools
keeps Bash undenied when scoped entries exist, the contract states the
boundary is permission-enforced (denial = working as designed, no
route-arounds), migration m196 re-stamps existing Reviewer rows, and task
messages label the Verification section implementer-facing so the reviewer
reading the task no longer inherits the implementer's run-instructions.

* fix(daemon): close bash-scope heredoc bypasses and keep scoped patterns through promotion

Review round 1 on #2593: the heredoc branch consumed the closing
delimiter's trailing newline without flushing, so a command placed on the
line after a heredoc concatenated onto the still-open segment and was
never validated; and unquoted heredoc delimiters let command
substitutions in the body execute via shell expansion while the scanner
skipped the body. Flush the segment when a heredoc span completes and
deny unquoted delimiters outright (the documented procedure only uses
<<'DELIM'). Also fix session promotion: extractTools filtered
allowedTools against bare KNOWN_TOOLS, dropping the Bash(...:*) entries
and re-adding bare Bash — promoted reviewer agents lost the scope guard.
Filter with isKnownToolEntry and omit bare Bash when ... (continued)

Coverage Stats

44037 of 59509 branches covered (74.0%)

Branch coverage included in aggregate %.

313 of 356 new or added lines in 10 files covered. (87.92%)

1 existing line in 1 file now uncovered.

59944 of 71755 relevant lines covered (83.54%)

3850.62 hits per line