claude-code-review: gha#541's diff-redirect denial loop recurred despite gha#542's prompt paragraph (7 of 14 denials, $7.99, no verdict)

[d-morrison]

What happened

Morrison-Lab/ai-config run 32529549403 (PR ai-config#1841) burned $7.99 across two attempts and produced no verdict.

• Attempt 1: 5 turns, 23s, $0.91, permission_denials_count: 0, no ### Verdict -> classified retryable (gha#185).
• Attempt 2 (retry): 8 turns, 327s, $7.08, 14 denials, no verdict -> above the threshold of 5, classified gha#198, not retried, job failed.

gha#543's failure comment did post, so the thread is not silent -- that part worked.

The recurrence

Seven of the 14 denials are gha#541's exact pattern, which gha#542 was supposed to have mitigated by adding a system-prompt paragraph telling the reviewer to call gh pr diff bare:

gh pr diff 1841 --repo Morrison-Lab/ai-config > /tmp/pr1841.diff 2>&1; grep -nP '...' /tmp/pr1841.diff | ...
gh pr diff 1841 --repo Morrison-Lab/ai-config > /tmp/pr1841.diff && grep -nP '[^\x00-\x7F]' /tmp/pr1841.diff | head -50
gh pr diff 1841 --repo Morrison-Lab/ai-config > /tmp/pr1841.diff
gh pr diff 1841 --repo Morrison-Lab/ai-config > /home/runner/work/ai-config/ai-config/pr1841.diff && wc -l ...
gh pr diff 1841 --repo Morrison-Lab/ai-config > /tmp/pr1841.diff          (again)
gh pr diff 1841 --repo Morrison-Lab/ai-config > /tmp/pr1841.diff          (again)
gh pr diff 1841 --repo Morrison-Lab/ai-config > /home/runner/work/ai-config/ai-config/pr1841.diff.tmp

That paragraph was verifiably live in this run -- it is in the --append-system-prompt block in the job log. So this is not a case of the mitigation not having shipped; it shipped and did not hold.

Why prompt-only is the wrong shape of fix here

This is the "a prompt instruction is a request; a permission rule is a constraint" point that gha's own CLAUDE.md already makes for gha#392/#532. The reviewer wants a file it can grep, and telling it not to want one has now failed twice. Note the motive is legitimate: it was scanning the diff for non-ASCII punctuation, which needs grep -P over the whole diff rather than a paged tool result.

Proposed deterministic fix: pre-fetch the diff in the workflow, before the agent starts, into the workspace, and name the path in the prompt.

• A workflow step runs gh pr diff <n> --repo <owner>/<repo> > "$GITHUB_WORKSPACE/pr-<n>.diff".
• The system prompt is amended to say the complete diff is already saved at that path -- read or grep it directly, and never try to produce it yourself.

That removes the wanting, rather than forbidding the acting. It also makes the diff available to grep/Read (default-allowed tools) with no Bash redirect involved at all.

Alternative considered

Widening the allowlist cannot express this: Bash(gh pr diff:*) rejects a command as a whole once a redirect, pipe, or chain is present, so no allowlist entry short of allowing arbitrary Bash would permit these.

Evidence

• Run: https://github.com/Morrison-Lab/ai-config/actions/runs/32529549403/job/96921464287
• Denials enumerated from the claude-review-execution-32529549403-2-attempt2 artifact.
• Prior: gha#541 (closed by the prompt paragraph), gha#543 (the failure-comment fix, which worked here).

The other seven denials are a separate gap; filed alongside this.

[d-morrison]

Closing as fixed — #567 merged the exact remedy this issue proposed, and merged before I noticed it existed.

It adds a pr-diff-file input to run-claude-review-attempt, has claude-code-review.yml write the diff into the workspace before the agent starts, and names that absolute path in the prompt — "pre-fetch the diff in the workflow and name the path", the same shape, better argued and with three measured occurrences rather than one.

v2 is at d23a4e8, which is downstream of #567's 01dd0e4, so consumers already have it.

The remaining half of run 32529549403's denials is unaffected by that fix and stays open as #566, which d-morrison has since widened past git to every non-allowlisted shell construct.