feat(review): enforce reviewer read-only via tool allowlist

[neversettle17-101]

Ported from aoagents/ReverbCode#278.

Summary

The reviewer's read-only guarantee was enforced only by the prompt. This makes it an enforced sandbox by launching the reviewer off bypassPermissions (which skips the permission system and ignores allow/deny rules) with a scoped tool allowlist.

1. ports.LaunchConfig gains AllowedTools []string / DisallowedTools []string. Empty = unrestricted, so worker sessions are unaffected.
2. claude-code agent adapter plumbs them to --allowedTools / --disallowedTools. Each list is comma-joined into one value so a rule containing spaces (e.g. Bash(git diff:*)) is not split into separate tool names.
3. Reviewer adapter launches in the default auto mode (off bypass) with:
   • allow: Read, Grep, Glob, Bash(gh:*), Bash(git diff:*), Bash(git log:*), Bash(git show:*), Bash(git status:*), Bash(ao review submit:*)
   • deny (defense in depth): Edit, Write, NotebookEdit, Bash(git push:*), Bash(git commit:*)

Port note

ReverbCode#278 also added ao review submit --body-text and rewrote the reviewer prompt so the verdict was recorded inline rather than written to review.md (to avoid granting Write). This repo already solves that differently — ao review submit --body - reads the body from stdin and the prompt already instructs the reviewer to stay read-only — so those two files are intentionally not ported. Only the tool-allowlist enforcement is brought over.

Test

• go build ./..., go vet, gofmt — all clean.
• go test ./internal/adapters/agent/claudecode/... ./internal/adapters/reviewer/claudecode/... ./internal/cli/... — pass.
• New tests: agent-adapter flag emission (joined values; omitted when unset) and a hermetic reviewer test (off-bypass + correct allow/deny lists, no claude binary needed).

Notes

• Accepted stall risk (as in Add Composio banner to README #278): the reviewer pane is headless. Off bypass, a tool that is neither allowed nor denied prompts — with no one to answer, it stalls. The scoped Bash allowlist means an unlisted bash command (cat, rg, ls) would stall. Worth an end-to-end review run to confirm the allowlist is permissive enough.

🤖 Generated with Claude Code