tools: move pr-review-state.json out of .claude/ to /tmp/

[dognose24]

Fixes RSM-3254

Proposed changes

Move jetpack-pr-review-cycle's state file from .claude/pr-review-state.json to /tmp/pr-review-state.json.

• Why — anything under .claude/ is treated as a sensitive file by Claude Code, even with --dangerously-skip-permissions, because that directory controls permissions and skill behavior. The review-cycle state file is harmless tracking data (addressed comment IDs + rerun counts + round number), but its location forced an interactive permission prompt on every write, breaking the autonomous review-cycle flow inside the sandbox.
• Where it now lives — /tmp/pr-review-state.json. Outside the repo, outside .claude/, and per-container ephemeral by design. Each new review cycle resets the file at the start, so loss on container restart is harmless (worst case: idempotent re-processing of already-addressed comments).
• Setup simplified — drops the mkdir -p .claude and echo ... >> .git/info/exclude lines. /tmp/ always exists, and we're outside the repo so no gitignore needed.

Five references in .claude/commands/jetpack-pr-review-cycle.md updated:

1. State file declaration + setup snippet
2. "Compare to prior rounds" read in Step 2
3. Flaky-CI rerun-count tracker
4. End-of-round write-back
5. (Plus the rationale paragraph explaining why we avoid .claude/)

Why this matters beyond one skill

/jetpack-pr-review-cycle is delegated to by other skills — fixing once here unblocks all callers:

• /premium-analytics-implement-task Step 9 — RSM-3217 / merged in tools: improve premium-analytics-implement-task skill (continue-on-branch, DoD-driven, slash-command registration) #29
• /jetpack-address-issue Step 8

Both inherit the same sensitive-file blocker until the review-cycle skill itself is fixed.

How was this discovered

Sandbox run of /premium-analytics-implement-task for the pie-chart task (PR #30) progressed cleanly through Steps 1–8 and into Step 9, then blocked on:

Claude requested permissions to edit /home/dev/jetpack/.claude/pr-review-state.json which is a sensitive file.

Even with IS_SANDBOX=1 claude --dangerously-skip-permissions. The prompt repeats on every state write, so a full review cycle would generate many prompts in a row.

Does this pull request change what data or activity we track or use?

No.

Testing instructions

This is a docs-only change to a Claude Code slash command's instructions — no code execution path is altered until the next time someone invokes /jetpack-pr-review-cycle. To validate:

1. After merge, in jetpack-ai-sandbox, launch IS_SANDBOX=1 claude --dangerously-skip-permissions.
2. Open a PR that this branch's revised review-cycle will run against (or rerun cycle on an existing PR via /jetpack-pr-review-cycle <PR>).
3. Confirm the state-file setup writes /tmp/pr-review-state.json without prompting, and that subsequent rounds read/write the same path without prompting.
4. Confirm git status stays clean (no .claude/pr-review-state.json to gitignore anymore).

Related

• RSM-3254 — this issue
• RSM-3217 — /premium-analytics-implement-task Step 9 delegates here
• PR #30 — first encounter with the prompt blocker

[github-actions]

Thank you for your PR!

When contributing to Jetpack, we have a few suggestions that can help us test and review your patch:

• ✅ Include a description of your PR changes.
  
• 🔴 Add a "[Status]" label (In Progress, Needs Review, ...).
  
• ✅ Add testing instructions.
  
• ✅ Specify whether this PR includes any changes to data or privacy.
  
• ✅ Add changelog entries to affected projects
  

This comment will be updated as you work on your PR and make changes. If you think that some of those checks are not needed for your PR, please explain why you think so. Thanks for cooperation 🤖

---

Follow this PR Review Process:

1. Ensure all required checks appearing at the bottom of this PR are passing.
2. Make sure to test your changes on all platforms that it applies to. You're responsible for the quality of the code you ship.
3. You can use GitHub's Reviewers functionality to request a review.
4. When it's reviewed and merged, you will be pinged in Slack to deploy the changes to WordPress.com simple once the build is done.

If you have questions about anything, reach out in #jetpack-developers for guidance!

[Copilot]

Pull request overview

Docs-only change to the /jetpack-pr-review-cycle slash command: relocates its state file from .claude/pr-review-state.json to /tmp/pr-review-state.json to avoid Claude Code's sensitive-file permission prompt that fires for any path under .claude/, even with --dangerously-skip-permissions. This unblocks autonomous review-cycle runs invoked directly or via delegating skills (/premium-analytics-implement-task, /jetpack-address-issue).

Changes:

• Update state-file path in declaration, setup snippet, prior-round comparison, flaky-CI rerun tracker, and end-of-round write-back (5 references).
• Drop now-unneeded mkdir -p .claude and .git/info/exclude setup steps.
• Add rationale paragraph explaining why /tmp/ is used and why per-container ephemerality is harmless.