Should a code-reviewer agent ever have Bash access?
by•
I have a subagent specifically set up to review code without touching any files.
The problem is I kept Bash access enabled so it could run local test suites and git diff. But leaving Bash open technically lets the model modify files via CLI commands if it hallucinates which ruins the whole "read-only" constraint.
Do you drop CLI access entirely to keep the sandbox 100% safe or do you keep Bash and rely on system prompts to keep the agent in line?
20 views
Replies
I'd keep Bash and let hooks do the blocking. A line in the prompt is a request, a hook is a wall. We run 78 hooks and 25 deny rules, and that's where the real limits live, not in the system prompt.
@hisashispace that makes sense. prompts alone can't stop every mistake, so having rules that block certain actions is a better way to keep things safe. it also lets the reviews run tests without giving it full control. l
we gave each agent its own worktree, the reviewer too.. if it does write something it lands in a copy nobody merges. the damage we actually hit wasn't edits though, one session's plain commit picked up files another session had staged. does your reviewer run in the same checkout as the agent writing the code?
@neelagiri_chettiyar giving the reviewer its own worktree sounds like a good way to avoid unwanted changes. The shared staged files issue is something I hadn't considered.
do you also keep the reviewer's Git access separate?