pi-pr-review 1.2.0 → 1.3.1

package/README.md

@@ -65,15 +65,17 @@ The `/pr-review-config` command maps three labels to models:
 /pr-review-config show                              # print the current mapping
 /pr-review-config light=<spec> medium=<spec> heavy=<spec>   # set primary tier models
 /pr-review-config heavy_fallbacks=<spec>,<spec>     # retry chain for quota/rate-limit failures
+/pr-review-config light_tool_policy=none            # tier default when a pass omits tool_policy
 /pr-review-config medium=unset                      # clear a tier (back to pi default)
 /pr-review-config heavy_fallbacks=unset             # clear a fallback chain
-/pr-review-config tools=read,bash,grep,find,ls      # tools granted to each subagent
+/pr-review-config light_tool_policy=unset           # restore legacy configured-tool behavior
+/pr-review-config tools=read,bash,grep,find,ls      # allowlist used by configured policy
 ```
 
 Running `/pr-review-config` with no arguments in the TUI opens an interactive settings menu that mirrors pi's `/settings` and the NERVous `/nervous:config`:
 
-- One primary-model row and one fallback-model row per tier (`light` / `medium` / `heavy`) plus a `subagent tools` row.
-- Press Enter on a primary or fallback row to pick a model from a searchable list (or unset it); Enter/Space on `subagent tools` cycles presets. The menu sets one fallback model at a time; use the `key=value` form for longer fallback chains.
+- One primary-model, fallback-model, and tool-policy row per tier (`light` / `medium` / `heavy`) plus a configured-tool allowlist row.
+- Press Enter on a primary or fallback row to pick a model from a searchable list (or unset it); Enter/Space cycles tool policies and allowlist presets. The menu sets one fallback model at a time; use the `key=value` form for longer fallback chains.
 - Selections apply and persist **immediately**; Esc closes the menu.
 - Type to search, and tab-completion is available for the `key=value` form.
 
@@ -98,12 +100,19 @@ Example `pr-review.json`:
     "medium": ["<backup-balanced-model>"],
     "heavy": ["<backup-strong-model:high>", "<balanced-model-spec>"]
   },
+  "toolPolicies": {
+    "light": "none",
+    "medium": "configured",
+    "heavy": "configured"
+  },
   "tools": ["read", "bash", "grep", "find", "ls"]
 }
 ```
 
 Each tier runs in an **isolated `pi` subprocess** on its configured model. The `review_subagents` batch tool runs independent passes concurrently (default `max_parallel: 4`, capped at 6) and returns ordered per-pass results; the older single-pass `review_subagent` tool remains available as a compatibility fallback. If a tier model fails with a retryable quota/rate-limit/capacity error, the subprocess retries that tier's configured `fallbacks` in order. Non-quota failures do not blindly cycle through fallbacks. If a tier is unset, that subagent falls back to the nearest configured tier, then to your pi default model.
 
+Tool policy is additive and backward compatible: `none` emits Pi's explicit `--no-tools`; `configured` uses the existing `tools` allowlist. A tool call's optional `tool_policy` overrides `toolPolicies[tier]`, which in turn falls back to legacy `configured` behavior. The shipped `/pr-review` prompt explicitly uses `none` only for overview because its complete evidence is supplied in context. Conventions/maintainability and both heavy specialist passes use `configured` repository-context tools so they can inspect surrounding files when needed. Fallback model attempts keep the original pass policy.
+
 ### 2. The orchestrator / inline-fallback model
 
 The orchestrator (which fetches the PR, merges findings, and emits the JSON) and the inline fallback path both run on your pi session model:
@@ -181,15 +190,19 @@ Severity tags: `[P0]` blocking/drop-everything · `[P1]` blocking/urgent · `[P2
 pi-pr-review/
 ├─ package.json                      # pi manifest: prompts + extensions
 ├─ prompts/pr-review.md              # the /pr-review orchestrator prompt
+├─ lib/pr-review-policy.ts           # pure tool-policy resolution/argv helpers
 ├─ extensions/pr-review-subagent.ts  # review_subagents/review_subagent tools + /pr-review-config command
-└─ extensions/review-table.ts        # renders the final JSON as a table (TUI only)
+├─ extensions/review-table.ts        # renders the final JSON as a table (TUI only)
+└─ tests/pr-review-policy.test.ts     # focused policy compatibility tests
 ```
 
-## Security & cost notes
+## Speed, security & cost notes
 
-- The `review_subagents` batch tool and `review_subagent` fallback spawn isolated `pi` subprocesses (`--mode json -p --no-session`) on your configured tier models. Subagents are read-only reviewers (`read,bash,grep,find,ls` by default) and never post comments or edit files.
+- The four independent review lenses remain intact. Only overview runs context-only with `--no-tools`; medium and both heavy specialists retain configured tools for surrounding-file validation. All subprocesses use `--no-context-files` because the orchestrator supplies the base review context explicitly, and convention excerpts are sent only to the medium pass instead of every model.
+- Tool results include effective `toolPolicy` and `elapsedMs` telemetry (plus per-attempt timing) so repeated representative runs can be compared at p50/p95 without guessing. Restore tools for a custom pass by sending `tool_policy: "configured"`; callers that omit policy retain legacy behavior unless `toolPolicies` config says otherwise.
+- The `review_subagents` batch tool and `review_subagent` fallback spawn isolated `pi` subprocesses (`--mode json -p --no-session`) on your configured tier models. Reviewer prompts prohibit modifications, but a configured allowlist containing `bash` is not technically read-only; use a narrower allowlist if stronger enforcement is required.
 - Project-local `pr-review.json` is only read when the project is trusted.
-- Tiered review calls multiple models per PR, now concurrently for independent passes. Point `light` at a cheap model for overview/risk scan; reserve `heavy` for the deep passes, and configure per-tier `fallbacks` only for acceptable backup models because retries can increase cost.
+- Tiered review calls multiple models per PR, concurrently for independent passes. Point `light` at a cheap model for overview/risk scan; reserve `heavy` for deep passes, and configure per-tier `fallbacks` only for acceptable backup models because retries can increase cost.
 
 ## Design notes
 

package/extensions/pr-review-subagent.ts

@@ -46,6 +46,13 @@ import {
 	Text,
 } from "@earendil-works/pi-tui";
 import { Type } from "typebox";
+import {
+	appendToolPolicyArgs,
+	buildReviewBaseArgs,
+	normalizeToolPolicy,
+	resolveToolPolicy,
+	type ToolPolicy,
+} from "../lib/pr-review-policy.ts";
 
 // ---------------------------------------------------------------------------
 // Config
@@ -55,6 +62,8 @@ type Tier = "light" | "medium" | "heavy";
 const TIERS: Tier[] = ["light", "medium", "heavy"];
 
 const UNSET = "(unset — pi default)";
+const INHERIT_TOOL_POLICY = "(inherit — configured tools)";
+const TOOL_POLICIES: ToolPolicy[] = ["configured", "none"];
 const TOOLS_PRESETS = ["read,bash,grep,find,ls", "read,grep,find,ls", "read"];
 const DEFAULT_BATCH_PARALLEL = 4;
 const MAX_BATCH_PARALLEL = 6;
@@ -69,7 +78,9 @@ interface PrReviewConfig {
 	tiers: Partial<Record<Tier, string>>;
 	/** Tier label -> ordered fallback model specs used for quota/capacity failures. */
 	fallbacks: Partial<Record<Tier, string[]>>;
-	/** Tools granted to each review subagent process. */
+	/** Optional tier-level policy used when a tool call does not override it. */
+	toolPolicies: Partial<Record<Tier, ToolPolicy>>;
+	/** Tools granted to review subagents whose effective policy is configured. */
 	tools: string[];
 }
 
@@ -113,6 +124,18 @@ function normalizeFallbacks(
 	return out;
 }
 
+function normalizeToolPolicies(
+	raw: Partial<Record<Tier, unknown>> | undefined,
+): Partial<Record<Tier, ToolPolicy>> {
+	const out: Partial<Record<Tier, ToolPolicy>> = {};
+	if (!raw || typeof raw !== "object") return out;
+	for (const tier of TIERS) {
+		const policy = normalizeToolPolicy(raw[tier]);
+		if (policy) out[tier] = policy;
+	}
+	return out;
+}
+
 /** User config, overlaid by project config when the project is trusted. */
 function loadConfig(ctx: Pick<ExtensionContext, "cwd" | "isProjectTrusted">): PrReviewConfig {
 	const user = readConfigFile(userConfigPath());
@@ -125,6 +148,10 @@ function loadConfig(ctx: Pick<ExtensionContext, "cwd" | "isProjectTrusted">): Pr
 	return {
 		tiers: { ...(user.tiers ?? {}), ...(project.tiers ?? {}) },
 		fallbacks: { ...normalizeFallbacks(user.fallbacks, true), ...normalizeFallbacks(project.fallbacks, true) },
+		toolPolicies: {
+			...normalizeToolPolicies(user.toolPolicies),
+			...normalizeToolPolicies(project.toolPolicies),
+		},
 		tools: project.tools ?? user.tools ?? DEFAULT_TOOLS,
 	};
 }
@@ -135,6 +162,7 @@ function readUserConfig(): PrReviewConfig {
 	return {
 		tiers: { ...(raw.tiers ?? {}) },
 		fallbacks: normalizeFallbacks(raw.fallbacks),
+		toolPolicies: normalizeToolPolicies(raw.toolPolicies),
 		tools: raw.tools ?? [...DEFAULT_TOOLS],
 	};
 }
@@ -353,6 +381,7 @@ interface SubagentPassRequest {
 	tier: Tier;
 	objective: string;
 	context?: string;
+	toolPolicy?: ToolPolicy;
 }
 
 interface ModelAttemptReport {
@@ -363,6 +392,7 @@ interface ModelAttemptReport {
 	exitCode: number;
 	status: "completed" | "failed";
 	retryable: boolean;
+	elapsedMs: number;
 	stopReason?: string;
 	errorMessage?: string;
 }
@@ -382,6 +412,8 @@ interface SubagentPassResult {
 	attempts: ModelAttemptReport[];
 	fallbackUsed: boolean;
 	retryableFailure: boolean;
+	toolPolicy: ToolPolicy;
+	elapsedMs: number;
 }
 
 function noticeForAttempt(tier: Tier, attempt: ModelAttempt): string {
@@ -426,14 +458,16 @@ async function runSubagentAttempt(
 	ctx: Pick<ExtensionContext, "cwd">,
 	pass: SubagentPassRequest,
 	attempt: ModelAttempt,
+	toolPolicy: ToolPolicy,
 	signal: AbortSignal | undefined,
 	onText?: (text: string) => void,
-): Promise<{ result: RunResult; notice: string }> {
+): Promise<{ result: RunResult; notice: string; elapsedMs: number }> {
 	let tmp: { dir: string; filePath: string } | undefined;
+	const startedAt = Date.now();
 	try {
-		const args = ["--mode", "json", "-p", "--no-session"];
+		const args = buildReviewBaseArgs();
 		if (attempt.spec) args.push("--model", attempt.spec);
-		if (config.tools.length > 0) args.push("--tools", config.tools.join(","));
+		appendToolPolicyArgs(args, toolPolicy, config.tools);
 
 		tmp = await writeTempPrompt(pass.tier, buildSubagentSystemPrompt(pass.tier));
 		args.push("--append-system-prompt", tmp.filePath);
@@ -443,11 +477,12 @@ async function runSubagentAttempt(
 		const result = await runReviewSubprocess(invocation.command, invocation.args, ctx.cwd, signal, (text) => {
 			onText?.(text);
 		});
-		return { result, notice: noticeForAttempt(pass.tier, attempt) };
+		return { result, notice: noticeForAttempt(pass.tier, attempt), elapsedMs: Date.now() - startedAt };
 	} catch (e) {
 		return {
 			result: { text: "", exitCode: 1, stderr: "", errorMessage: errMessage(e) },
 			notice: noticeForAttempt(pass.tier, attempt),
+			elapsedMs: Date.now() - startedAt,
 		};
 	} finally {
 		if (tmp) {
@@ -467,14 +502,24 @@ async function runSubagentPass(
 	signal: AbortSignal | undefined,
 	onText?: (text: string) => void,
 ): Promise<SubagentPassResult> {
+	const startedAt = Date.now();
 	const tier = pass.tier;
+	const toolPolicy = resolveToolPolicy(pass.toolPolicy, config.toolPolicies[tier]);
 	const attempts = resolveModelAttempts(config, tier);
 	const reports: ModelAttemptReport[] = [];
 	let lastResult: RunResult | undefined;
 	let lastNotice = noticeForAttempt(tier, attempts[0]!);
 
 	for (const attempt of attempts) {
-		const { result, notice } = await runSubagentAttempt(config, ctx, pass, attempt, signal, onText);
+		const { result, notice, elapsedMs } = await runSubagentAttempt(
+			config,
+			ctx,
+			pass,
+			attempt,
+			toolPolicy,
+			signal,
+			onText,
+		);
 		const failed = result.exitCode !== 0 || result.stopReason === "error" || result.stopReason === "aborted";
 		const retryable = failed && isRetryableModelFailure(result);
 		lastResult = result;
@@ -487,6 +532,7 @@ async function runSubagentPass(
 			exitCode: result.exitCode,
 			status: failed ? "failed" : "completed",
 			retryable,
+			elapsedMs,
 			stopReason: result.stopReason,
 			errorMessage: result.errorMessage,
 		});
@@ -507,6 +553,8 @@ async function runSubagentPass(
 				attempts: reports,
 				fallbackUsed: attempt.kind === "fallback" || reports.length > 1,
 				retryableFailure: false,
+				toolPolicy,
+				elapsedMs: Date.now() - startedAt,
 			};
 		}
 
@@ -529,6 +577,8 @@ async function runSubagentPass(
 		attempts: reports,
 		fallbackUsed: reports.length > 1,
 		retryableFailure: reports.at(-1)?.retryable ?? false,
+		toolPolicy,
+		elapsedMs: Date.now() - startedAt,
 	};
 }
 
@@ -573,7 +623,14 @@ function formatBatchResults(results: SubagentPassResult[], maxParallel: number):
 		);
 	}
 	for (const result of results) {
-		lines.push("", `## Pass: ${result.id}`, `status: ${result.status}`, result.notice);
+		lines.push(
+			"",
+			`## Pass: ${result.id}`,
+			`status: ${result.status}`,
+			`tool_policy: ${result.toolPolicy}`,
+			`elapsed_ms: ${result.elapsedMs}`,
+			result.notice,
+		);
 		const attemptSummary = formatAttemptSummary(result);
 		if (attemptSummary) lines.push(attemptSummary);
 		if (result.status === "failed") {
@@ -611,13 +668,19 @@ const ReviewSubagentParams = Type.Object({
 				"Shared context for the subagent, typically the PR title/description plus the unified diff to review.",
 		}),
 	),
+	tool_policy: Type.Optional(
+		StringEnum(["none", "configured"] as const, {
+			description:
+				"Tool access for this pass. none emits --no-tools; configured uses the configured allowlist. Request override wins over tier config; omission preserves configured legacy behavior unless tier policy is set.",
+		}),
+	),
 });
 
 const ReviewSubagentsParams = Type.Object({
 	context: Type.Optional(
 		Type.String({
 			description:
-				"Shared PR context for every pass, typically PR title/body/metadata, in-scope convention-file summaries, and the unified diff.",
+				"Shared PR context for every pass, typically PR title/body/metadata, cross-cutting requirements, and the unified diff. Put specialist-only convention excerpts in the medium pass context.",
 		}),
 	),
 	max_parallel: Type.Optional(
@@ -644,6 +707,12 @@ const ReviewSubagentsParams = Type.Object({
 					description: "Optional pass-specific context appended after the shared context.",
 				}),
 			),
+			tool_policy: Type.Optional(
+				StringEnum(["none", "configured"] as const, {
+					description:
+					"Tool access for this pass. none emits --no-tools; configured uses the configured allowlist. The resolved policy remains fixed across fallback model attempts.",
+				}),
+			),
 		}),
 		{
 			description: "Independent review passes to run concurrently. Results are returned in this same order.",
@@ -674,7 +743,12 @@ export default function (pi: ExtensionAPI) {
 			const result = await runSubagentPass(
 				loadConfig(ctx),
 				ctx,
-				{ tier, objective: params.objective, context: params.context },
+				{
+					tier,
+					objective: params.objective,
+					context: params.context,
+					toolPolicy: normalizeToolPolicy(params.tool_policy),
+				},
 				signal,
 				(text) => onUpdate?.({ content: [{ type: "text", text }] }),
 			);
@@ -691,6 +765,8 @@ export default function (pi: ExtensionAPI) {
 						exitCode: result.exitCode,
 						fallbackUsed: result.fallbackUsed,
 						retryableFailure: result.retryableFailure,
+						toolPolicy: result.toolPolicy,
+						elapsedMs: result.elapsedMs,
 						attempts: result.attempts,
 					},
 				};
@@ -704,6 +780,8 @@ export default function (pi: ExtensionAPI) {
 					model: result.model,
 					exitCode: result.exitCode,
 					fallbackUsed: result.fallbackUsed,
+					toolPolicy: result.toolPolicy,
+					elapsedMs: result.elapsedMs,
 					attempts: result.attempts,
 				},
 			};
@@ -746,6 +824,7 @@ export default function (pi: ExtensionAPI) {
 					tier,
 					objective: pass.objective,
 					context: combineContexts(sharedContext, typeof pass.context === "string" ? pass.context : undefined),
+					toolPolicy: normalizeToolPolicy(pass.tool_policy),
 				};
 			});
 			const maxParallel = normalizeMaxParallel(params.max_parallel, passes.length);
@@ -783,6 +862,8 @@ export default function (pi: ExtensionAPI) {
 						errorMessage: r.errorMessage,
 						fallbackUsed: r.fallbackUsed,
 						retryableFailure: r.retryableFailure,
+						toolPolicy: r.toolPolicy,
+						elapsedMs: r.elapsedMs,
 						attempts: r.attempts,
 						outputChars: r.text.length,
 					})),
@@ -867,7 +948,11 @@ const CONFIG_COMPLETIONS: Array<{ value: string; label: string }> = [
 		value: `${t}_fallbacks=`,
 		label: `${t}_fallbacks=<model1,model2> — retry chain for quota/rate-limit failures`,
 	})),
-	{ value: "tools=", label: "tools=read,bash,grep,find,ls — tools granted to review subagents" },
+	...TIERS.map((t) => ({
+		value: `${t}_tool_policy=`,
+		label: `${t}_tool_policy=<none|configured|unset> — default tool access when a pass does not override it`,
+	})),
+	{ value: "tools=", label: "tools=read,bash,grep,find,ls — allowlist used by configured policy" },
 	{ value: "show", label: "show — print the current tier config" },
 ];
 
@@ -913,14 +998,32 @@ function isFallbackKey(key: string): boolean {
 	return false;
 }
 
+function isToolPolicyKey(key: string): boolean {
+	for (const tier of TIERS) {
+		if (
+			key === `${tier}_tool_policy` ||
+			key === `${tier}-tool-policy` ||
+			key === `${tier}.toolpolicy`
+		) {
+			return true;
+		}
+	}
+	return false;
+}
+
+function tierFromCompoundKey(key: string): Tier {
+	return key.split(/[_\-.]/)[0] as Tier;
+}
+
 interface ConfigPatch {
 	tiers: Partial<Record<Tier, string | null>>;
 	fallbacks: Partial<Record<Tier, string[] | null>>;
+	toolPolicies: Partial<Record<Tier, ToolPolicy | null>>;
 	tools?: string[];
 }
 
 function parseConfigArgs(args: string): { patch: ConfigPatch; hasChanges: boolean; errors: string[] } {
-	const patch: ConfigPatch = { tiers: {}, fallbacks: {} };
+	const patch: ConfigPatch = { tiers: {}, fallbacks: {}, toolPolicies: {} };
 	const errors: string[] = [];
 	const tokens = splitConfigArgs(args).filter((t) => !["show", "get", "current"].includes(t.toLowerCase()));
 	for (const token of tokens) {
@@ -934,16 +1037,29 @@ function parseConfigArgs(args: string): { patch: ConfigPatch; hasChanges: boolea
 		if ((TIERS as string[]).includes(key)) {
 			patch.tiers[key as Tier] = value === "" || value === "unset" ? null : value;
 		} else if (isFallbackKey(key)) {
-			const tier = key.split(/[_\-.]/)[0] as Tier;
+			const tier = tierFromCompoundKey(key);
 			patch.fallbacks[tier] = value === "" || value === "unset" || value === "none" ? null : splitCommaList(value);
+		} else if (isToolPolicyKey(key)) {
+			const tier = tierFromCompoundKey(key);
+			if (value === "" || value === "unset" || value === "inherit") patch.toolPolicies[tier] = null;
+			else {
+				const policy = normalizeToolPolicy(value);
+				if (policy) patch.toolPolicies[tier] = policy;
+				else errors.push(`invalid ${key} "${value}" (expected none|configured|unset)`);
+			}
 		} else if (key === "tools") {
 			patch.tools = splitCommaList(value);
 		} else {
-			errors.push(`unknown key "${key}" (expected light|medium|heavy|<tier>_fallbacks|tools)`);
+			errors.push(
+				`unknown key "${key}" (expected light|medium|heavy|<tier>_fallbacks|<tier>_tool_policy|tools)`,
+			);
 		}
 	}
 	const hasChanges =
-		Object.keys(patch.tiers).length > 0 || Object.keys(patch.fallbacks).length > 0 || patch.tools !== undefined;
+		Object.keys(patch.tiers).length > 0 ||
+		Object.keys(patch.fallbacks).length > 0 ||
+		Object.keys(patch.toolPolicies).length > 0 ||
+		patch.tools !== undefined;
 	return { patch, hasChanges, errors };
 }
 
@@ -951,6 +1067,7 @@ function applyConfigPatch(base: PrReviewConfig, patch: ConfigPatch): PrReviewCon
 	const next: PrReviewConfig = {
 		tiers: { ...base.tiers },
 		fallbacks: normalizeFallbacks(base.fallbacks),
+		toolPolicies: normalizeToolPolicies(base.toolPolicies),
 		tools: [...base.tools],
 	};
 	for (const tier of TIERS) {
@@ -964,6 +1081,11 @@ function applyConfigPatch(base: PrReviewConfig, patch: ConfigPatch): PrReviewCon
 			if (value === null || value === undefined || value.length === 0) delete next.fallbacks[tier];
 			else next.fallbacks[tier] = [...new Set(value)];
 		}
+		if (tier in patch.toolPolicies) {
+			const value = patch.toolPolicies[tier];
+			if (value === null || value === undefined) delete next.toolPolicies[tier];
+			else next.toolPolicies[tier] = value;
+		}
 	}
 	if (patch.tools) next.tools = patch.tools;
 	return next;
@@ -997,11 +1119,14 @@ function summarizeConfig(
 			(t) =>
 				`| \`${t}\` | ${user.tiers[t] ? `\`${user.tiers[t]}\`` : "_unset_"} | ${effective.tiers[t] ? `\`${effective.tiers[t]}\`` : "_pi default_"} | ${TIER_PURPOSE[t]} |`,
 		),
-		`| \`tools\` | \`${user.tools.join(",")}\` | \`${effective.tools.join(",")}\` | tools granted to each review subagent |`,
+		`| \`tools\` | \`${user.tools.join(",")}\` | \`${effective.tools.join(",")}\` | allowlist used when policy is \`configured\` |`,
 		"",
-		"| Tier | Your fallbacks | Effective fallbacks |",
-		"|---|---|---|",
-		...TIERS.map((t) => `| \`${t}\` | ${formatModelList(user.fallbacks[t])} | ${formatModelList(effective.fallbacks[t])} |`),
+		"| Tier | Your fallbacks | Effective fallbacks | Tool policy |",
+		"|---|---|---|---|",
+		...TIERS.map(
+			(t) =>
+				`| \`${t}\` | ${formatModelList(user.fallbacks[t])} | ${formatModelList(effective.fallbacks[t])} | ${user.toolPolicies[t] ? `\`${user.toolPolicies[t]}\`` : "_inherit configured_"} → \`${effective.toolPolicies[t] ?? "configured"}\` |`,
+		),
 		"",
 		`User config: \`${userConfigPath()}\``,
 	];
@@ -1013,8 +1138,10 @@ function summarizeConfig(
 		"- Print this summary: `/pr-review-config show`",
 		"- Set directly: `/pr-review-config light=provider/model heavy=provider/model:high`",
 		"- Set fallback chain: `/pr-review-config heavy_fallbacks=provider/backup:high,provider/backup2`",
+		"- Set tier tool policy: `/pr-review-config light_tool_policy=none`",
 		"- Clear a tier: `/pr-review-config medium=unset`",
 		"- Clear fallback chain: `/pr-review-config heavy_fallbacks=unset`",
+		"- Restore legacy tier tool behavior: `/pr-review-config light_tool_policy=unset`",
 		"- A `<model>` is any pi model pattern (`provider/model` or `provider/model:thinking`).",
 	);
 	return lines.join("\n");
@@ -1110,15 +1237,23 @@ function configMenuItems(cfg: PrReviewConfig, available: string[]): SettingItem[
 			"Clear this tier's fallback chain. Use key=value form to set multiple fallbacks.",
 		),
 	}));
+	const policyItems: SettingItem[] = TIERS.map((tier) => ({
+		id: `${tier}_tool_policy`,
+		label: `${tier} tool policy`,
+		description: "Default when a pass does not explicitly set tool_policy. Enter/Space cycles values.",
+		currentValue: cfg.toolPolicies[tier] ?? INHERIT_TOOL_POLICY,
+		values: [INHERIT_TOOL_POLICY, ...TOOL_POLICIES],
+	}));
 	const current = cfg.tools.join(",");
 	const toolValues = [current, ...TOOLS_PRESETS.filter((p) => p !== current)];
 	return [
 		...tierItems,
 		...fallbackItems,
+		...policyItems,
 		{
 			id: "tools",
-			label: "subagent tools",
-			description: "Tools granted to each review subagent. Enter/Space cycles presets.",
+			label: "configured tool allowlist",
+			description: "Tools available when effective policy is configured. Enter/Space cycles presets.",
 			currentValue: current,
 			values: toolValues,
 		},
@@ -1144,6 +1279,7 @@ async function showConfigMenu(
 				for (const tier of TIERS) {
 					settingsList.updateValue(tier, draft.tiers[tier] ?? UNSET);
 					settingsList.updateValue(`${tier}_fallbacks`, draft.fallbacks[tier]?.join(",") || "(none)");
+					settingsList.updateValue(`${tier}_tool_policy`, draft.toolPolicies[tier] ?? INHERIT_TOOL_POLICY);
 				}
 				settingsList.updateValue("tools", draft.tools.join(","));
 			};
@@ -1153,9 +1289,16 @@ async function showConfigMenu(
 					if (newValue === "__unset__") delete draft.tiers[id as Tier];
 					else draft.tiers[id as Tier] = newValue;
 				} else if (isFallbackKey(id)) {
-					const tier = id.split(/[_\-.]/)[0] as Tier;
+					const tier = tierFromCompoundKey(id);
 					if (newValue === "__unset__") delete draft.fallbacks[tier];
 					else draft.fallbacks[tier] = [newValue];
+				} else if (isToolPolicyKey(id)) {
+					const tier = tierFromCompoundKey(id);
+					if (newValue === INHERIT_TOOL_POLICY) delete draft.toolPolicies[tier];
+					else {
+						const policy = normalizeToolPolicy(newValue);
+						if (policy) draft.toolPolicies[tier] = policy;
+					}
 				} else if (id === "tools") {
 					draft.tools = splitCommaList(newValue);
 				} else {
@@ -1167,8 +1310,10 @@ async function showConfigMenu(
 					const shown = id === "tools"
 						? draft.tools.join(",")
 						: isFallbackKey(id)
-							? (draft.fallbacks[id.split(/[_\-.]/)[0] as Tier]?.join(",") ?? "(none)")
-							: (draft.tiers[id as Tier] ?? UNSET);
+							? (draft.fallbacks[tierFromCompoundKey(id)]?.join(",") ?? "(none)")
+							: isToolPolicyKey(id)
+								? (draft.toolPolicies[tierFromCompoundKey(id)] ?? INHERIT_TOOL_POLICY)
+								: (draft.tiers[id as Tier] ?? UNSET);
 					ctx.ui.notify(`PR review config: ${id} = ${shown}`, "info");
 				} catch (e) {
 					ctx.ui.notify(`pr-review-config failed: ${errMessage(e)}`, "error");
@@ -1178,7 +1323,7 @@ async function showConfigMenu(
 
 			settingsList = new SettingsList(
 				configMenuItems(draft, available),
-				10,
+				12,
 				getSettingsListTheme(),
 				(id, newValue) => persist(id, newValue),
 				() => done(undefined),

package/lib/pr-review-policy.ts

@@ -0,0 +1,32 @@
+export type ToolPolicy = "none" | "configured";
+
+/** Isolated review subprocesses receive all review context explicitly. */
+export function buildReviewBaseArgs(): string[] {
+	return ["--mode", "json", "-p", "--no-session", "--no-context-files"];
+}
+
+export function normalizeToolPolicy(value: unknown): ToolPolicy | undefined {
+	return value === "none" || value === "configured" ? value : undefined;
+}
+
+/** Request override wins, then explicit tier config, then legacy configured behavior. */
+export function resolveToolPolicy(
+	requested: ToolPolicy | undefined,
+	configured: ToolPolicy | undefined,
+): ToolPolicy {
+	return requested ?? configured ?? "configured";
+}
+
+/** Preserve legacy configured behavior; only `none` explicitly disables every tool. */
+export function appendToolPolicyArgs(
+	args: string[],
+	policy: ToolPolicy,
+	configuredTools: string[],
+): string[] {
+	if (policy === "none") {
+		args.push("--no-tools");
+	} else if (configuredTools.length > 0) {
+		args.push("--tools", configuredTools.join(","));
+	}
+	return args;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-pr-review",
-  "version": "1.2.0",
+  "version": "1.3.1",
   "description": "Model-agnostic GitHub PR code review prompt for pi. Pass a PR number; it derives the base and head branches from the PR in the current repo, reviews the diff, and returns structured JSON findings.",
   "keywords": [
     "pi-package",
@@ -14,6 +14,9 @@
     "type": "git",
     "url": "git+https://github.com/10ego/pi-pr-review.git"
   },
+  "scripts": {
+    "test": "bun test"
+  },
   "peerDependencies": {
     "@earendil-works/pi-ai": "*",
     "@earendil-works/pi-coding-agent": "*",

package/prompts/pr-review.md

@@ -20,14 +20,16 @@ You are the **orchestrator**. You own all GitHub access, skip decisions, convent
 
 If the `review_subagents` batch tool is available, prefer it over multiple single-pass calls. Fetch PR metadata and the unified diff once, gather any relevant convention-file excerpts, then call `review_subagents` with shared `context`, `max_parallel`, and ordered `passes`. This guarantees bounded parallel fan-out instead of depending on whether the tool interface runs separate calls concurrently. Use these pass assignments:
 
-| Pass id | Tier label | Scope |
-|---------|------------|-------|
-| `overview` | `light` | Step 3 overview, strengths, and high-level risk areas |
-| `conventions-maintainability` | `medium` | Step 5 convention compliance, readability, maintainability, test gaps, and nits |
-| `correctness` | `heavy` | Step 5 compile/parse, logic, error handling, lifecycle, concurrency, and edge-case defects |
-| `security-performance` | `heavy` | Step 5 security vulnerabilities and performance regressions |
+| Pass id | Tier label | Tool policy | Scope |
+|---------|------------|-------------|-------|
+| `overview` | `light` | `none` | Step 3 overview, strengths, and high-level risk areas |
+| `conventions-maintainability` | `medium` | `configured` | Step 5 convention compliance, readability, maintainability, test gaps, and nits |
+| `correctness` | `heavy` | `configured` | Step 5 compile/parse, logic, error handling, lifecycle, concurrency, and edge-case defects |
+| `security-performance` | `heavy` | `configured` | Step 5 security vulnerabilities and performance regressions |
 
-Call `review_subagents` with `{ context, max_parallel: 4, passes: [...] }`. If any pass returns `status: failed`, treat the review evidence as incomplete: rerun the failed pass with `review_subagent` or perform that pass inline before finalizing. Always put the PR title/description, relevant metadata, convention-file excerpts, and unified diff in shared `context` so subagents do not refetch anything.
+Call `review_subagents` with `{ context, max_parallel: 4, passes: [...] }`, setting each pass's `tool_policy` exactly as shown. Shared `context` contains the PR title/description, relevant metadata, complete unified diff, and strictly cross-cutting review requirements. Put convention-file paths and excerpts only in the `conventions-maintainability` pass's own `context`; they are appended to shared context by the tool. This avoids sending specialist-only material to every model while still allowing the medium reviewer to inspect surrounding files when maintainability or test-gap analysis requires it.
+
+If deterministic context assembly reports that required input is missing or truncated before dispatch (for example, an incomplete diff or unreadable applicable convention file), set `tool_policy: configured` for that affected pass instead of `none`. Do not ask the model to self-diagnose and rerun. If any pass returns `status: failed`, treat the review evidence as incomplete: rerun the failed pass with `review_subagent` using the same tool policy, or perform that pass inline before finalizing.
 
 If `review_subagents` is unavailable but `review_subagent` is available, run the same pass assignments as individual `review_subagent` calls; emit independent calls in the same turn when the interface supports parallel tool calls. If neither subagent tool is available, perform every pass yourself inline on the current session model.
 
@@ -78,25 +80,25 @@ List (do not dump contents yet) the repository convention files that could gover
 - The root convention file (`CLAUDE.md`, and/or `AGENTS.md` if present).
 - Any convention file living in a directory that contains a file modified by this PR.
 
-When you evaluate compliance for a given changed file, only apply convention files that share that file's path or a parent path. Read a convention file's contents when a changed file falls under its scope, and include the relevant rule excerpts (with file paths) in the shared context for the medium pass.
+When you evaluate compliance for a given changed file, only apply convention files that share that file's path or a parent path. Read a convention file's contents when a changed file falls under its scope, and include the relevant rule excerpts (with file paths) only in the `conventions-maintainability` pass-specific `context`, not the batch's shared context.
 
 ## Step 3 — Overview & strengths (`light` reviewer)
 
 Write a short **overview** (1–3 short paragraphs) of what the PR does and how, grounded in the diff and PR title/description — enough to understand author intent. Also collect a list of genuine **strengths** (good tests, nice consolidation, correct reuse of helpers, etc.) and any high-level risk areas for the specialist passes. Strengths are part of the output, and understanding intent is what lets you tell an intentional change from a bug.
 
-When `review_subagents` is available, include this as the `overview` pass in the same batch as the Step 5 review passes instead of waiting for a separate sequential call.
+When `review_subagents` is available, include this as the `overview` pass in the same batch as the Step 5 review passes instead of waiting for a separate sequential call. Set `tool_policy: none`; the complete PR metadata and diff are already supplied.
 
 ## Step 4 — (reserved)
 
 ## Step 5 — Review passes (dispatch by tier, then merge results)
 
-Run these independent passes over the diff, each on its tier reviewer (or inline if subagent tools are unavailable). Give every pass the shared PR context from Step 1 plus the relevant convention-file excerpts from Step 2, and instruct each pass to report issues **at every severity, including nits**, within its own scope. Do **not** ask every pass to audit everything; the objective boundaries below reduce duplicate work while preserving coverage.
+Run these independent passes over the diff, each on its tier reviewer (or inline if subagent tools are unavailable). Give every pass the shared PR metadata and complete diff from Step 1; give only the medium pass the relevant convention-file excerpts from Step 2. Instruct each pass to report issues **at every severity, including nits**, within its own scope. Do **not** ask every pass to audit everything; the objective and tool-policy boundaries below reduce duplicate work while preserving coverage.
 
 When `review_subagents` is available, dispatch the Step 3 `overview` pass and these Step 5 passes in one batch with `max_parallel: 4`, then combine the ordered outputs:
 
-1. **Convention, readability & maintainability pass — `medium` reviewer.** Audit changed lines against the in-scope convention files from Step 2. Flag violations (quote the rule), softer deviations from documented style as nits, naming/dead-code/comment/typo issues, minor duplication, test gaps, and "worth confirming" observations (e.g. "no current callers — confirm intended", "confirm this generated file came from codegen not a hand-edit"). Do not duplicate deep correctness or security analysis unless needed to explain a convention/maintainability issue.
-2. **Bug & correctness pass — `heavy` reviewer.** Hunt for defects in the introduced code: compile/parse failures, logic errors, wrong results, off-by-one, error handling, resource/lifecycle, concurrency, and edge cases. Include lower-severity correctness smells and missing edge cases as P2/P3. Do not duplicate pure style nits covered by the medium pass.
-3. **Security & performance pass — `heavy` reviewer.** Look for security issues (injection, authz, secrets, unsafe deserialization) and performance regressions in the changed code. Note minor ones too. Do not duplicate ordinary correctness/readability findings unless they are security/performance relevant.
+1. **Convention, readability & maintainability pass — `medium` reviewer, `tool_policy: configured`.** Audit changed lines against the in-scope convention excerpts supplied in this pass's context. Flag violations (quote the rule), softer deviations from documented style as nits, naming/dead-code/comment/typo issues, minor duplication, test gaps, and "worth confirming" observations (e.g. "no current callers — confirm intended", "confirm this generated file came from codegen not a hand-edit"). Use configured tools to inspect surrounding files, tests, callers, or generated-file context when needed; do not modify files or duplicate deep correctness/security analysis unless needed to explain a convention/maintainability issue.
+2. **Bug & correctness pass — `heavy` reviewer, `tool_policy: configured`.** Hunt for defects in the introduced code: compile/parse failures, logic errors, wrong results, off-by-one, error handling, resource/lifecycle, concurrency, and edge cases. Include lower-severity correctness smells and missing edge cases as P2/P3. Do not duplicate pure style nits covered by the medium pass. Use configured repository-context tools when surrounding files or callers are needed to confirm impact; reviewing remains non-modifying even if the allowlist includes `bash`.
+3. **Security & performance pass — `heavy` reviewer, `tool_policy: configured`.** Look for security issues (injection, authz, secrets, unsafe deserialization) and performance regressions in the changed code. Note minor ones too. Do not duplicate ordinary correctness/readability findings unless they are security/performance relevant. Use configured tools when repository context is needed to validate a candidate; do not modify files.
 
 ## Step 6 — Verification (best-effort, orchestrator-owned, non-destructive)
 

package/tests/pr-review-policy.test.ts

@@ -0,0 +1,72 @@
+import { describe, expect, test } from "bun:test";
+import {
+	appendToolPolicyArgs,
+	buildReviewBaseArgs,
+	normalizeToolPolicy,
+	resolveToolPolicy,
+} from "../lib/pr-review-policy.ts";
+
+describe("tool policy resolution", () => {
+	test("request override wins over tier config", () => {
+		expect(resolveToolPolicy("none", "configured")).toBe("none");
+		expect(resolveToolPolicy("configured", "none")).toBe("configured");
+	});
+
+	test("tier config applies when request omits policy", () => {
+		expect(resolveToolPolicy(undefined, "none")).toBe("none");
+	});
+
+	test("omission preserves legacy configured behavior", () => {
+		expect(resolveToolPolicy(undefined, undefined)).toBe("configured");
+	});
+
+	test("normalization rejects unknown values", () => {
+		expect(normalizeToolPolicy("none")).toBe("none");
+		expect(normalizeToolPolicy("configured")).toBe("configured");
+		expect(normalizeToolPolicy("auto")).toBeUndefined();
+	});
+});
+
+describe("tool policy argv", () => {
+	test("base args isolate explicit review context", () => {
+		expect(buildReviewBaseArgs()).toEqual([
+			"--mode",
+			"json",
+			"-p",
+			"--no-session",
+			"--no-context-files",
+		]);
+	});
+
+	test("none emits explicit --no-tools", () => {
+		const args = ["--mode", "json"];
+		expect(appendToolPolicyArgs(args, "none", ["read", "bash"])).toEqual([
+			"--mode",
+			"json",
+			"--no-tools",
+		]);
+	});
+
+	test("configured emits the configured allowlist", () => {
+		const args = ["--mode", "json"];
+		expect(appendToolPolicyArgs(args, "configured", ["read", "grep"])).toEqual([
+			"--mode",
+			"json",
+			"--tools",
+			"read,grep",
+		]);
+	});
+
+	test("configured with an empty list preserves legacy omitted-flag behavior", () => {
+		const args = ["--mode", "json"];
+		expect(appendToolPolicyArgs(args, "configured", [])).toEqual(["--mode", "json"]);
+	});
+
+	test("one resolved policy can be reused across fallback attempts", () => {
+		const policy = resolveToolPolicy("none", "configured");
+		const first = appendToolPolicyArgs([], policy, ["read"]);
+		const fallback = appendToolPolicyArgs([], policy, ["read"]);
+		expect(first).toEqual(["--no-tools"]);
+		expect(fallback).toEqual(["--no-tools"]);
+	});
+});