Repository navigation
fix(guard): count Grok use_tool recalls as consults; run the freshness gate in every harness (#472, #473) - #474
Conversation
…s gate in every harness (#472, #473) Grok's Claude-hook fast path: omi-guard.sh unwraps use_tool / CallMcpTool (first non-empty inner name, JSON-string arguments parsed, empty payloads skipped), accepts camelCase, and maps Grok built-ins onto Claude names. The Python translator does the same, and translates snake_case Grok events on the Claude harness. Started by a Grok Build session; finished and hardened here. The commit freshness gate and the other Bash-only checks matched the tool name Bash only, so Antigravity, Gemini, Hermes, OpenCode, Poolside and Codex shell tools skipped them. The adapter and guard.decide map guard.SHELL_TOOL_NAMES onto Bash, the command is read from command / CommandLine / cmd (string or argv list) on PreToolUse and in the PostToolUse retraction, and the no-jq no-core last resort fails closed for every shell name and dispatcher. Antigravity takes the repo from run_command's Cwd. Regression tests: fetch, then a multi-line -m commit from another repo's cwd, in every guarded harness (omind 10.0.2 lost the git -C at the newline and blocked the commit). Reviewed by the Flatline Roundtable panel; its confirmed findings are fixed here. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GwidRobbpZsQUPJXNu4Hf2
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 52 minutes. View limit details
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📜 Recent review details
📝 Summary
Merge Risk: ⚪ Minimal · up to No confirmed issue remains that should block merging after normal checks. Pre-merge checks |
  |
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Docstring Coverage |  |
Docstring coverage is 73.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 45 functions across 9 files. (4 skipped: … | Write docstrings for the functions missing them to satisfy the coverage threshold. |
✅ Passed checks (4 passed)
-
-
Check name Status Explanation Title check The title clearly identifies the two primary changes: Grok use_tool recalls count as consults, and freshness checks run across harnesses. Description check The description directly explains issues #472and#473, the implementation changes, test coverage, validation results, and deferred scope.Linked Issues check The PR addresses the coding requirements in [ #472] and [#473]. The Grok path unwrapsuse_toolandCallMcpTool, selects the first non-empty inner payload, parses JSON-string arguments, and translat…Out of Scope Changes check The changes remain within [ #472] and [#473]. Source changes implement event translation, shell-tool normalization, command extraction, fallback behavior, freshness handling, and Antigravity directory …
-
Full details: Docstring Coverage
-
-
Explanation
Docstring coverage is 73.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 45 functions across 9 files. (4 skipped: 4 unsupported.)
-
✨ Finishing Touches 💡 1
-
-
📝 Generate docstrings 💡
-
-
-
- Commit to this branch
- Create a new PR
-
-
🧪 Generate unit tests (beta)
-
-
- Commit to this branch
- Create a new PR
-
-
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
…Windows) On Windows /w/repo is drive-relative, so the code correctly treated it as relative to the workspace root. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GwidRobbpZsQUPJXNu4Hf2
1 participant
Closes #472. Closes #473. Version 10.3.1.
What
#472, Grok's Claude-hook fast path. A Grok recall arrives as
use_toolwithomi__recall-notenested inside, so the gate didn't treat it as a consult and denied the recall that would have cleared it.omi-guard.shnow unwrapsuse_tool/CallMcpTooland maps Grok built-ins (run_terminal_command→Bash, …). Edge cases handled:argumentsare parsedThe Python translator matches this, and also translates snake_case Grok events on the Claude harness. A Grok Build session started this; this PR finishes and hardens it and adds the tests it lacked.
#473, the freshness gate only ran for tools named
Bash. Antigravity (run_command), Gemini (run_shell_command), Hermes (terminal), OpenCode (bash), Poolside (shell) and Codex (exec_command,local_shell, …) commits never needed a fetch, and the repo-work and global-config checks were skipped too.guard.decidemapguard.SHELL_TOOL_NAMESontoBash.guard.shell_command_textreadscommand/CommandLine/cmd(a string or an argv list), and both PreToolUse and the PostToolUse retraction use it.run_command's ownCwd.Why
A live commit on ronin28 was blocked right after a clean fetch. The cause was the installed 10.0.2: it split
git -C "<repo>" commit -m "…<newline>Co-Authored-By: …"at the newline inside the quotes, lost the-Cpath, and judged the commit against the hook cwd's repo.mainalready handles that, but no test pinned it. While adding that test across harnesses, theBash-only gap above showed up.Tests
-mcommit run from another repo's cwd, in all eight guarded harnesses. The commit before the fetch must be denied by the freshness gate specifically.decide()with each shell name.SHELL_TOOL_NAMES.Cwdprecedence and relative-path resolution.commandkey is not mapped toBash.Each new test fails on the code before its fix.
Locally: ruff, mypy --strict and pip-audit are clean, and pytest gives 3949 passed. Two
test_name_timelinesdecoy-ranking cases also fail on a cleanmaincheckout here; they don't involve this change.Review
A Flatline Roundtable panel reviewed the diff (GLM-5.3, Fable, Opus, Mistral Medium, DeepSeek V4, Nemotron, GPT-6-Astra). Confirmed findings are fixed in this PR: the fail-open last resort, retraction key coverage, the empty-name dispatcher,
decide-level mapping, and AntigravityCwdprecedence. Deferred: stdin-style tools (Codexwrite_stdin, Antigravitysend_command_input) that feed text to an already-running shell; that's a separate gap for a follow-up.Proudly Made in Nebraska. Go Big Red! 🌽 https://xkcd.com/2347/
🤖 Generated with Claude Code
https://claude.ai/code/session_01GwidRobbpZsQUPJXNu4Hf2