From bf8f921a4925f29c291fcecdd0b6daecc7c3f077 Mon Sep 17 00:00:00 2001
From: Vincent Herbst <superuser404@tuta.com>
Date: Mon, 26 Oct 2026 10:13:56 +0100
Subject: [PATCH] ci(claude): spell out the allowed command shapes for the
 reviewer

The first live review (#879) ended after ten turns with four denied commands
and no comment: pipes and $(cat <<EOF) are outside the allowlist on purpose
(cat would bypass the /proc read denial). The rules now name each allowed
command and the heredoc form for the summary.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WJcXkGQrMiBPixVEFTSBJS
---
 .github/claude/review.md            | 13 +++++++++++++
 .github/workflows/claude-review.yml |  2 ++
 2 files changed, 15 insertions(+)

diff --git a/.github/claude/review.md b/.github/claude/review.md
index 1fba96149..ac8ea0b4b 100644
--- a/.github/claude/review.md
+++ b/.github/claude/review.md
@@ -98,6 +98,19 @@ writing anything, read your own earlier automated summaries in `gh pr view --com
   was checked and nothing changed, and no inline comments.
 - If the maintainer or the author answered a finding and the answer holds, drop it.
 
+## Tools
+
+Only these shell commands are allowed, and each must run ALONE: no pipes, no `&&` / `;`, no
+`$(...)`, no `cat` / `head` / `grep` in the shell (use the Read and Grep tools on the working tree
+instead). Anything else is denied and wastes a turn.
+
+- `gh pr diff <N>` and `gh pr view <N> --comments`
+- `git show <HEAD SHA>:<path>` and `git ls-tree -r --name-only <HEAD SHA> <dir>`
+- `gh pr comment <N> --body-file - <<'EOF'` followed by the body and `EOF`, for the summary
+
+Inline comments go through `mcp__github_inline_comment__create_inline_comment` with
+`confirmed: true`.
+
 ## Output
 
 1. **Inline comments** (`mcp__github_inline_comment__create_inline_comment`) for findings tied to a
diff --git a/.github/workflows/claude-review.yml b/.github/workflows/claude-review.yml
index c3ced7bc3..9ccf844dc 100644
--- a/.github/workflows/claude-review.yml
+++ b/.github/workflows/claude-review.yml
@@ -79,6 +79,8 @@ jobs:
             checked out: read the PR's version of a file with `git show <HEAD SHA>:<path>` and list
             its files with `git ls-tree -r --name-only <HEAD SHA> <dir>`. Get the diff with
             `gh pr diff`, the description and discussion with `gh pr view --comments`.
+            Shell commands must follow the "Tools" section of review.md exactly (one command,
+            no pipes, no command substitution). Finish by posting the summary comment.
           claude_args: |
             --model claude-opus-5-5
             --max-turns 80