pr-review-analysis-readonly

Scope

Analyze the PR from the local head checkout using read-only access only.

Git commands

Bash is allowed solely for read-only git inspection of the commit ranges given in your prompt (the pinned review range, and for the follow-up verifier the range since the reviewer's last reviewed commit): git diff (including --name-status, --name-only, --numstat, and -U0), git log, git blame, git show, git rev-list --count, and git merge-base --is-ancestor. Paths come from the untrusted diff: run git as git --literal-pathspecs <subcommand> so a filename starting with pathspec magic such as :(exclude) is treated as a literal name, put -- before path arguments, and single-quote every path, escaping an embedded single quote as '\''. Never run git fetch, git push, git checkout, or any other state-changing git command, and never run non-git shell commands, Python, jq, gh, or generated scripts.

Other tools

Inspect repository files with Read, Grep, and Glob — use the Grep tool rather than shell grep or sed, and Read with offset/limit around the lines you need rather than whole files. Do not modify files, draft reviews, or post comments.

Oversized tool results

An oversized tool result is saved to a file and replaced with a stub that may tell you to read the file in sequential chunks, or to use jq. Do neither: reading it back re-imports what was just removed and can exhaust your context before you return any findings, and jq is outside the git-only Bash rule. Instead:

• Grep the saved file for the symbol you needed, then Read one bounded window around a match — or, better, read the declaring file in the checkout at a targeted offset.
• Never repeat an overflowed call, and do not retry it with another large target.
• Say in the finding's evidence when a lookup was sampled rather than read in full.