From 4dbcc3b47f60cb735311e5bde5f773e9f082aaaf Mon Sep 17 00:00:00 2001
From: Marcelo Gobetti <mwgobetti@gmail.com>
Date: Tue, 7 Jul 2026 16:57:49 -0300
Subject: [PATCH] Restore read-only shell to PR review (grep, cat, head, tail)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The review's `--allowedTools` was added in 834a453 to grant git
commands for PR analysis, but `--allowedTools` is an exclusive
whitelist: setting it silently dropped the general Bash the action
allowed by default, so `grep`, `cat`, and friends are now denied.
That was a side effect of the flag, not a deliberate restriction —
the commit's intent was to enable analysis, not lock it down.

Sonnet 5 still reaches for `grep` (including `git show | grep`) to
verify findings across files, and each denied call burns a review
turn plus a retry. Add the read-only inspection commands back to
the allow-list so those calls run instead of being denied. Builds,
tests, installs, edits, and network stay unlisted and therefore
still denied, so the blast radius is unchanged — these commands
only re-expose what the Read and Grep tools already permit.

Also drops the now-contradictory "don't use shell grep" steer from
the prompt, since shell grep is allowed again.
---
 .github/workflows/claude-review.yml | 21 +++++++++------------
 1 file changed, 9 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/claude-review.yml b/.github/workflows/claude-review.yml
index a58a93b..ec97a17 100644
--- a/.github/workflows/claude-review.yml
+++ b/.github/workflows/claude-review.yml
@@ -61,17 +61,14 @@ jobs:
 
             ## Environment constraints
 
-            This review runs with a restricted toolset: Read, Glob, Grep, LS, and
-            `git log`/`git diff`/`git show`. There is no ability to run builds,
-            linters, or test suites, install dependencies, or reach the network, so
-            do not attempt repo setup, linting, or test commands. To search and read
-            code use the Read, Grep, and Glob tools, not shell `grep`, `find`, `cat`,
-            or `python`: bash is git-only, so any other shell command is denied and
-            wastes a turn. Review primarily from the diff
-            (`git diff origin/<base>...HEAD`), opening additional files only when a
-            finding needs cross-file confirmation. Do not retry a denied tool call —
-            if something genuinely requires a disallowed tool, note it once in the
-            final comment.
+            This review is read-only: the Read, Glob, and Grep tools plus read-only
+            shell (`git log`/`git diff`/`git show`, `grep`, `cat`, `head`, `tail`,
+            `wc`) are available. It cannot run builds, linters, or test suites,
+            install dependencies, edit files, or reach the network — so do not
+            attempt repo setup, linting, or test commands. Review primarily from the
+            diff (`git diff origin/<base>...HEAD`), opening additional files only when
+            a finding needs cross-file confirmation. If something genuinely requires a
+            disallowed tool, note it once in the final comment instead of retrying.
 
             The review rubric below already incorporates the organization-wide code
             review guidelines. Apply it IN ADDITION to any repository-specific
@@ -177,5 +174,5 @@ jobs:
             5. Provide detailed feedback on code review
 
             ${{ inputs.extra_prompt }}
-          claude_args: "--model ${{ inputs.model }} --max-turns ${{ inputs.max_turns }} --allowedTools 'Read,Glob,Grep,LS,Bash(git log:*),Bash(git diff:*),Bash(git show:*)'"
+          claude_args: "--model ${{ inputs.model }} --max-turns ${{ inputs.max_turns }} --allowedTools 'Read,Glob,Grep,LS,Bash(git log:*),Bash(git diff:*),Bash(git show:*),Bash(grep:*),Bash(cat:*),Bash(head:*),Bash(tail:*),Bash(wc:*)'"
           track_progress: true