claude-code-review: reviewer loops ~15x failing to save a large PR diff to disk, exhausting the denial budget

[d-morrison]

Root cause of a 33-denial no-verdict review, with the execution artifact as evidence

Related to #198, #370, #540, but this is the actual mechanism behind the denials, which #370's reporter could not confirm (blocked by an egress proxy from downloading the execution artifact). I could download it this time.

Run: 32415477507, job review / claude-review, on ucdavis/win#78 at head 963b138 (a documentation-only Quarto PR, 21 files, 700+ lines changed).
Result: {"num_turns":26,"total_cost_usd":2.29,"permission_denials_count":33} — no verdict.
Artifact: claude-review-execution-32415477507-1-attempt1, ID 9423905363, downloaded via gh run download 32415477507 -n claude-review-execution-32415477507-1-attempt1.

The mechanism

The reviewer needed to read this PR's (fairly large) diff. Its very first attempt, gh pr view ucdavis/win/pull/78 --json ... / gh pr diff ucdavis/win/pull/78 --name-only, failed for an unrelated reason — passing ucdavis/win/pull/78 as the PR argument makes `gh` treat it as a branch name, not a PR reference (`no pull requests found for branch "ucdavis/win/pull/78"`) — so it pivoted to the correct `gh pr diff 78 --repo ucdavis/win` form.

From there, every subsequent attempt to save the diff to a file (so it could be grepped/counted in chunks, reasonable for a 700+-line diff) was denied, in two distinct ways:

1. Compound commands get rejected wholesale unless every clause matches an allowed pattern. `allowedTools` includes `Bash(gh pr diff:*)`, but `gh pr diff 78 --repo ucdavis/win > /tmp/pr78.diff; wc -l /tmp/pr78.diff` is rejected with "This Bash command contains multiple operations. The following parts require approval: ..." — chaining an allowed command with `;`/`&&`/a redirect turns the whole line into an unapproved command, even though the allowed part matches exactly.
2. Redirects and `mkdir` outside a narrow "allowed working directory" are hard-blocked, not just requiring approval. `gh pr diff ... > /tmp/pr78.diff` fails with "Output redirection to '/tmp/pr78.diff' was blocked. For security, Claude Code may only write to files in the allowed working directories for this session." Pivoting to write inside the repo checkout instead (`mkdir -p /home/runner/work/win/win/.tmp_review`) fails identically: "mkdir in '...' was blocked. For security, Claude Code may only create directories in the allowed working directories for this session." This is a hard block, not a permission prompt — no allowlist pattern can satisfy it, because the working-directory allowlist for this sandboxed session appears to exclude essentially everywhere the agent tried, including subdirectories of the very checkout it's reviewing.

The agent tried at least 15 distinct variations of "fetch the diff and save/count/grep it" across the 5-minute run (see the full `tool_use`/`tool_result` pairs in the artifact) — different temp paths, different repo-relative paths, combining/splitting the redirect and the follow-up `wc`/`grep`, trying `gh pr diff 78 -R ucdavis/win --patch > .claude-pr/pr78.diff` — every one denied by one of the two mechanisms above, until the 33-denial budget was exhausted with no verdict ever produced.

Why this is likely diff-size-correlated (worth checking against #198/#370)

A bare, single, unredirected `gh pr diff 78 --repo ucdavis/win` (no pipe, no `;`, no `>`) would return the whole diff as the Bash tool's own stdout result and match the allowlist cleanly — no file write needed at all. The reviewer only reached for file-based chunking because the diff is large enough that reading it inline seemed unwieldy. Smaller diffs plausibly never trigger this path, which would explain why this reproduces intermittently and correlates with PR size (this PR's diff grew substantially between an earlier successful-ish attempt and this 21-file one).

Suggested directions (not fully diagnosed which is best)

• Teach the reviewer prompt/system-prompt to call `gh pr diff` bare, unredirected, and rely on the tool result being returned as text rather than reaching for a file at all.
• Or: grant a genuinely writable scratch directory (and confirm what "the allowed working directories for this session" actually resolves to — it rejected both `/tmp` and `mkdir`-created subdirectories of the repo checkout, which reads like nothing is currently writable in practice for this workflow).
• Or: allowlist the compound pattern used for diff-saving explicitly, if the single-command approach doesn't scale to very large diffs.

In the meantime

I've been relying on a manual self-review posted directly on the PR per self-review-fallback.md — tracked from the ucdavis/win side at ucdavis/win#80.

[d-morrison]

Working on this --- paws off until I'm done.

[d-morrison]

Fifth attempt on the same PR (ucdavis/win#78, same head 963b138), run 32415477507, job 96840008698, 2026-08-21.

Denied-tool logging (gha#540) appears to have shipped since the original report --- the log now names denials directly, no artifact download needed:

```
permission_denials_count=48 (max_denials=5)
Denied tools: Bashx45 Skillx3 (sample: Bash: git fetch origin pull/78/head:pr-78 2>&1 | tail -5; echo "---"; find . -iname "CLAUDE.md" -not -path "*/node_modules/...; Skill: Skill)
```

Higher denial count than the original (48 vs. 33) and a different leading command this time (`git fetch origin pull/78/head:pr-78 | tail -5; echo ...` --- another compound command, plus bare `Skill` calls also denied). Same overall shape as the original report: the reviewer can't get past its own tool-permission sandbox on this PR's diff size, whatever specific command it reaches for first. Confirms this isn't a one-off --- five attempts across ~20 hours, same PR, same failure family, and now with the denied-tool names visible directly in the log rather than requiring the workaround this issue was originally filed to document.

[d-morrison]

Recurred on Morrison-Lab/ai-config run 32529549403 (2026-08-21), with gha#542's prompt paragraph verifiably live in that run's --append-system-prompt block.

Seven gh pr diff ... > <file> variants denied in a row, across /tmp and the workspace, with and without a chained grep/wc. Filed as gha#565, proposing a deterministic fix (pre-fetch the diff in the workflow and name the path) rather than a stronger prompt.