From 49f67e91230c30755907f39a050137d2e7ffa2d6 Mon Sep 17 00:00:00 2001 From: Marcelo Gobetti Date: Fri, 10 Jul 2026 01:51:31 -0300 Subject: [PATCH] Steer file navigation to Glob/LS instead of find MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit On large monorepos, reviews spend turns on denied `find` calls — locating files, listing directories, and cross-app consistency sweeps the review prompt asks for. A reproduced ht-platform review hit permission denials that were entirely `find`; on one run the production job logged 16, all of the same shape. find can't be allow-listed the way grep/jq/ls were: `find -exec` and `-delete` execute and mutate, so it breaks the read-only contract. The legitimate need — locating and listing files — is already served read-only by the Glob and LS tools. Point the model at those and note find is unavailable, so it stops probing and wasting turns. --- .github/workflows/claude-review.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/claude-review.yml b/.github/workflows/claude-review.yml index 487a650..0938bc3 100644 --- a/.github/workflows/claude-review.yml +++ b/.github/workflows/claude-review.yml @@ -65,6 +65,8 @@ jobs: shell (`git log`/`git diff`/`git show`, `grep`, `cat`, `head`, `tail`, `wc`, `ls`, `jq`) are available. Use `jq` to inspect or query JSON (it is read-only) — `python`, `node`, and other interpreters are NOT available. + To locate or list files, use the Glob and LS tools (or `ls`) — `find` is + NOT available. It cannot run builds, linters, or test suites, install dependencies, edit files, or reach the network — so do not attempt repo setup, linting, or test commands. Review primarily from the