agent-shell-py 0.1.16__tar.gz → 0.2.0__tar.gz

{agent_shell_py-0.1.16 → agent_shell_py-0.2.0}/AGENTS.md

@@ -38,6 +38,16 @@ classDiagram
         -_parse_event(event, include_thinking) list~StreamEvent~
     }
 
+    class AgentExecutionError {
+        <<Exception>>
+        +str reason
+        +str response
+        +float cost
+        +str session_id
+        +float duration
+        +int output_tokens
+    }
+
     class MCPServerSpec {
         +str name
         +MCPServerType type
@@ -74,22 +84,24 @@ classDiagram
         +float duration
         +str session_id
         +int output_tokens
+        +str error
     }
 
     class AgentType {
         <<StrEnum>>
         CLAUDE_CODE
         OPENCODE
-        GEMINI_CLI
         COPILOT_CLI
         CODEX
         PI
+        CURSOR
     }
 
     AgentShell --> AgentAdapter : delegates to
     AgentShell --> AgentType : resolves via
     ClaudeCodeAdapter ..|> AgentAdapter : satisfies
-    AgentShell ..> AgentResponse : returns
+    AgentShell ..> AgentResponse : returns on success
+    AgentShell ..> AgentExecutionError : raises on failure
     AgentShell ..> HealthCheckResult : returns
     AgentShell ..> StreamEvent : yields
     AgentShell ..> MCPServerSpec : accepts/returns
@@ -101,7 +113,17 @@ The adapter pattern uses Python's `Protocol` (structural typing) rather than ABC
 
 `output_tokens` is a cost measure — the billed output-token count, which **includes reasoning tokens** (billed at the output rate). Each adapter normalises this so the value is consistent across agents (e.g. OpenCode reports reasoning in a sibling field, so its adapter adds it back).
 
-`health_check(cwd, model, timeout)` probes an agent + model combination with a trivial prompt and returns `HealthCheckResult(healthy, exception)`. The verdict is derived from the normalised event stream (healthy = a `result` event with no `error`), not exit codes — which are unreliable, since some CLIs exit 0 on failure. The shared logic lives once in `adapters/health.py`; each adapter delegates to it.
+`health_check(cwd, model, timeout)` probes an agent + model combination with a trivial prompt
+and returns `HealthCheckResult(healthy, exception)`. The verdict is derived from the normalised
+event stream (healthy = the LAST `result` event says `content == "ok"` and no `error` event
+arrived — pi emits one `result` per agent loop, and its auto-retry runs more than one), not exit
+codes — which are unreliable, since some CLIs exit 0 on failure. `execute()` judges a run by the
+same rule and raises `AgentExecutionError` when it fails, carrying whatever partial
+response/cost/session/token data the run produced. The success/failure verdict lives once in
+`adapters/outcome.py`, shared by both surfaces so they report identical reasons for the same
+stream; `adapters/health.py` wraps it for the health probe, and `adapters/response.py` wraps it
+for `execute()`'s stream-to-`AgentResponse` collection (used by every adapter — each `execute()`
+is a single delegating call into it).
 
 ## Supported Agents
 
@@ -110,14 +132,14 @@ The adapter pattern uses Python's `Protocol` (structural typing) rather than ABC
 - [x] Copilot CLI
 - [x] Codex
 - [x] Pi
-- [ ] Gemini CLI
+- [x] Cursor
 
 ## MCP Server Configuration
 
 `AgentShell` exposes a unified API for registering MCP servers across all supported agents:
 
 ```python
-from agent_shell import AgentShell
+from agent_shell.shell import AgentShell
 from agent_shell.models.agent import AgentType, MCPServerSpec, MCPServerType
 
 shell = AgentShell(agent_type=AgentType.CLAUDE_CODE)
@@ -140,7 +162,7 @@ All adapters write to user-scope configuration:
 | Copilot CLI | direct JSON file write | `~/.copilot/mcp-config.json` |
 | Codex | `codex mcp add` subprocess | Codex config |
 
-Adds are idempotent (overwrite existing entries with the same name). Removes warn rather than raise when the named server is not found. Claude Code listing reads the user-scope `mcpServers` entries from `~/.claude.json` directly, avoiding the health checks and human-readable output of `claude mcp list`. MCP is not yet implemented for Pi — all three methods raise `NotImplementedError` (Pi manages capability via `pi install` extensions, which needs investigation before wiring up).
+Adds are idempotent (overwrite existing entries with the same name). Removes warn rather than raise when the named server is not found. Claude Code listing reads the user-scope `mcpServers` entries from `~/.claude.json` directly, avoiding the health checks and human-readable output of `claude mcp list`. MCP is not implemented for Pi or Cursor — all three methods raise `NotImplementedError`. Pi manages capability via `pi install` extensions (which needs investigation before wiring up); Cursor's `mcp` subcommands are login/list/list-tools/enable/disable only (no add/remove — servers are declared in `.cursor/mcp.json`), and `mcp list` reports only `name: status`, not the transport an `MCPServerSpec` needs.
 
 ## Test Philosophy
 

{agent_shell_py-0.1.16 → agent_shell_py-0.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agent-shell-py
-Version: 0.1.16
+Version: 0.2.0
 Summary: A lightweight abstraction for executing CLI coding agents headlessly
 License-Expression: MIT
 License-File: LICENSE
@@ -15,10 +15,10 @@ and returning the output that can be used programatically as a unified contract
 
 - **One unified contract** — the same `execute` / `stream` / `health_check` API across every
   agent; swap the backend without changing a line of consuming code.
-- **Five CLI agents** — Claude Code, OpenCode, Copilot CLI, Codex, and Pi behind a common
-  adapter protocol.
-- **Execute or stream** — get one `AgentResponse`, or async-iterate normalized `StreamEvent`s
-  with optional thinking/reasoning.
+- **Six CLI agents** — Claude Code, OpenCode, Copilot CLI, Codex, Pi, and Cursor behind a
+  common adapter protocol.
+- **Execute or stream** — get one `AgentResponse` (raises `AgentExecutionError` on a failed run),
+  or async-iterate normalized `StreamEvent`s with optional thinking/reasoning.
 - **Session resumption** — continue any conversation by passing back its `session_id`.
 - **Normalized cost & tokens** — consistent `cost` and `output_tokens` (reasoning included)
   regardless of how each CLI reports them.
@@ -77,6 +77,22 @@ follow_up = await shell.execute(
 > `output_tokens` is a cost measure: the billed output-token count, which **includes reasoning
 > tokens** (they are billed at the output rate). It is reported consistently across all adapters.
 
+### Failure handling
+
+`execute()` raises `AgentExecutionError` instead of returning when a run failed — an `error`
+event was emitted, the terminal `result` had `content == "error"`, or no terminal `result`
+arrived at all. `str(e)` is the bare reason; the exception also carries whatever partial
+`response`/`cost`/`session_id`/`duration`/`output_tokens` the run produced before failing.
+
+```python
+from agent_shell.models.agent import AgentExecutionError
+
+try:
+    response = await shell.execute(cwd="/path/to/project", prompt="Fix the failing test")
+except AgentExecutionError as e:
+    print(f"run failed: {e}")   # e.g. "500 model name=qwen3.6-27b-8Q failed to load"
+```
+
 ### Stream
 
 ```python
@@ -137,7 +153,8 @@ response = await shell.execute(
 - Where a backend cannot enforce a deny, the adapter emits a `UserWarning` listing the
   ignored tools rather than failing silently. Coverage varies: Claude and OpenCode enforce
   all five canonical names; Copilot enforces only `bash`/`edit` canonically (use a verbatim
-  name for its other tools); Codex can only deny `web_search`.
+  name for its other tools); Codex can only deny `web_search`; Cursor cannot enforce any
+  per-call deny (its tool policy lives in `.cursor/cli.json`).
 - Denying `edit` or `read` is **best-effort**: a model can still modify or read files through
   the shell, so also deny `bash` when you need a hard file boundary.
 
@@ -167,7 +184,38 @@ follow_up = await shell.execute(
 )
 ```
 
-> **Note:** OpenCode's `run` mode auto-approves all tools. The `allowed_tools` and `effort` parameters are configured via `opencode.json`, not CLI flags.
+> **Note:** For OpenCode, `allowed_tools` and `effort` are **ignored** — the adapter maps
+> neither to a CLI flag nor to `opencode.json`. To restrict an OpenCode agent, use
+> `disallowed_tools` (see [Restricting tools](#restricting-tools-disallowed_tools)): it is
+> enforced via a per-run `OPENCODE_PERMISSION` environment variable and holds even under
+> auto-approve. Keep `auto_approve=True` (the default) — with `auto_approve=False`,
+> `opencode run` auto-*rejects* permission prompts non-interactively and can silently abort the run.
+
+### Cursor
+
+```python
+from agent_shell.shell import AgentShell
+from agent_shell.models.agent import AgentType
+
+shell = AgentShell(agent_type=AgentType.CURSOR)
+
+response = await shell.execute(
+    cwd="/path/to/project",
+    prompt="Can you tell me about this project?",
+)
+
+print(response.response)
+print(f"Session: {response.session_id}")
+```
+
+> **Note:** Cursor runs headlessly via `cursor-agent --print --output-format stream-json` and
+> **requires** workspace trust, which the adapter always passes (`--trust`). With
+> `auto_approve=True` (the default) it also passes `--force` so tools auto-run; otherwise
+> tools are auto-*rejected* but the run still completes. `allowed_tools`, `effort`, and
+> `disallowed_tools` are **ignored** — Cursor exposes no per-call tool policy or effort flag
+> (tool policy lives in `.cursor/cli.json`), so each emits a `UserWarning`. On a Free plan
+> only `model=None`/`"auto"` works. MCP servers are declared in `.cursor/mcp.json`; the
+> `add`/`remove`/`list` MCP methods raise `NotImplementedError`.
 
 ## MCP Servers
 
@@ -208,7 +256,7 @@ await shell.add_mcp_server(MCPServerSpec(
 ))
 ```
 
-`add_mcp_server` overwrites an existing server with the same name. `remove_mcp_server` warns rather than raises when the named server is not found. `list_mcp_servers()` works for Claude Code, OpenCode, Copilot CLI, and Codex. Claude Code reads user-scope entries directly from `~/.claude.json`, so listing does not launch configured servers for health checks.
+`add_mcp_server` overwrites an existing server with the same name. `remove_mcp_server` warns rather than raises when the named server is not found. `list_mcp_servers()` works for Claude Code, OpenCode, Copilot CLI, and Codex. Claude Code reads user-scope entries directly from `~/.claude.json`, so listing does not launch configured servers for health checks. MCP is not supported for Pi or Cursor — neither CLI exposes an add/remove subcommand, so all three MCP methods raise `NotImplementedError`.
 
 ## Logging
 

{agent_shell_py-0.1.16 → agent_shell_py-0.2.0}/README.md

@@ -6,10 +6,10 @@ and returning the output that can be used programatically as a unified contract
 
 - **One unified contract** — the same `execute` / `stream` / `health_check` API across every
   agent; swap the backend without changing a line of consuming code.
-- **Five CLI agents** — Claude Code, OpenCode, Copilot CLI, Codex, and Pi behind a common
-  adapter protocol.
-- **Execute or stream** — get one `AgentResponse`, or async-iterate normalized `StreamEvent`s
-  with optional thinking/reasoning.
+- **Six CLI agents** — Claude Code, OpenCode, Copilot CLI, Codex, Pi, and Cursor behind a
+  common adapter protocol.
+- **Execute or stream** — get one `AgentResponse` (raises `AgentExecutionError` on a failed run),
+  or async-iterate normalized `StreamEvent`s with optional thinking/reasoning.
 - **Session resumption** — continue any conversation by passing back its `session_id`.
 - **Normalized cost & tokens** — consistent `cost` and `output_tokens` (reasoning included)
   regardless of how each CLI reports them.
@@ -68,6 +68,22 @@ follow_up = await shell.execute(
 > `output_tokens` is a cost measure: the billed output-token count, which **includes reasoning
 > tokens** (they are billed at the output rate). It is reported consistently across all adapters.
 
+### Failure handling
+
+`execute()` raises `AgentExecutionError` instead of returning when a run failed — an `error`
+event was emitted, the terminal `result` had `content == "error"`, or no terminal `result`
+arrived at all. `str(e)` is the bare reason; the exception also carries whatever partial
+`response`/`cost`/`session_id`/`duration`/`output_tokens` the run produced before failing.
+
+```python
+from agent_shell.models.agent import AgentExecutionError
+
+try:
+    response = await shell.execute(cwd="/path/to/project", prompt="Fix the failing test")
+except AgentExecutionError as e:
+    print(f"run failed: {e}")   # e.g. "500 model name=qwen3.6-27b-8Q failed to load"
+```
+
 ### Stream
 
 ```python
@@ -128,7 +144,8 @@ response = await shell.execute(
 - Where a backend cannot enforce a deny, the adapter emits a `UserWarning` listing the
   ignored tools rather than failing silently. Coverage varies: Claude and OpenCode enforce
   all five canonical names; Copilot enforces only `bash`/`edit` canonically (use a verbatim
-  name for its other tools); Codex can only deny `web_search`.
+  name for its other tools); Codex can only deny `web_search`; Cursor cannot enforce any
+  per-call deny (its tool policy lives in `.cursor/cli.json`).
 - Denying `edit` or `read` is **best-effort**: a model can still modify or read files through
   the shell, so also deny `bash` when you need a hard file boundary.
 
@@ -158,7 +175,38 @@ follow_up = await shell.execute(
 )
 ```
 
-> **Note:** OpenCode's `run` mode auto-approves all tools. The `allowed_tools` and `effort` parameters are configured via `opencode.json`, not CLI flags.
+> **Note:** For OpenCode, `allowed_tools` and `effort` are **ignored** — the adapter maps
+> neither to a CLI flag nor to `opencode.json`. To restrict an OpenCode agent, use
+> `disallowed_tools` (see [Restricting tools](#restricting-tools-disallowed_tools)): it is
+> enforced via a per-run `OPENCODE_PERMISSION` environment variable and holds even under
+> auto-approve. Keep `auto_approve=True` (the default) — with `auto_approve=False`,
+> `opencode run` auto-*rejects* permission prompts non-interactively and can silently abort the run.
+
+### Cursor
+
+```python
+from agent_shell.shell import AgentShell
+from agent_shell.models.agent import AgentType
+
+shell = AgentShell(agent_type=AgentType.CURSOR)
+
+response = await shell.execute(
+    cwd="/path/to/project",
+    prompt="Can you tell me about this project?",
+)
+
+print(response.response)
+print(f"Session: {response.session_id}")
+```
+
+> **Note:** Cursor runs headlessly via `cursor-agent --print --output-format stream-json` and
+> **requires** workspace trust, which the adapter always passes (`--trust`). With
+> `auto_approve=True` (the default) it also passes `--force` so tools auto-run; otherwise
+> tools are auto-*rejected* but the run still completes. `allowed_tools`, `effort`, and
+> `disallowed_tools` are **ignored** — Cursor exposes no per-call tool policy or effort flag
+> (tool policy lives in `.cursor/cli.json`), so each emits a `UserWarning`. On a Free plan
+> only `model=None`/`"auto"` works. MCP servers are declared in `.cursor/mcp.json`; the
+> `add`/`remove`/`list` MCP methods raise `NotImplementedError`.
 
 ## MCP Servers
 
@@ -199,7 +247,7 @@ await shell.add_mcp_server(MCPServerSpec(
 ))
 ```
 
-`add_mcp_server` overwrites an existing server with the same name. `remove_mcp_server` warns rather than raises when the named server is not found. `list_mcp_servers()` works for Claude Code, OpenCode, Copilot CLI, and Codex. Claude Code reads user-scope entries directly from `~/.claude.json`, so listing does not launch configured servers for health checks.
+`add_mcp_server` overwrites an existing server with the same name. `remove_mcp_server` warns rather than raises when the named server is not found. `list_mcp_servers()` works for Claude Code, OpenCode, Copilot CLI, and Codex. Claude Code reads user-scope entries directly from `~/.claude.json`, so listing does not launch configured servers for health checks. MCP is not supported for Pi or Cursor — neither CLI exposes an add/remove subcommand, so all three MCP methods raise `NotImplementedError`.
 
 ## Logging
 

agent_shell_py-0.2.0/agent-skills/delegating-code-review/SKILL.md

@@ -0,0 +1,195 @@
+---
+name: delegating-code-review
+description: Use when you have made code changes and want another CLI agent to review them before committing or continuing — a second-opinion, security, correctness, requirements, or test-coverage review, or a cross-agent independent review. Keywords: reviewer agent, read-only review, disallowed_tools, git diff review, review uncommitted changes.
+---
+
+# Delegating Code Review to Another Agent
+
+Use AgentShell to invoke another CLI agent to review changes in a repository. The reviewing
+agent has its own tools — point it at the repo, tell it what to look at, and let it run
+`git diff` itself.
+
+Assumes familiarity with AgentShell basics. See [invoking-cli-agents](../invoking-cli-agents/SKILL.md)
+for setup, the full parameter list, and the per-agent capability matrix.
+
+## When to Use
+
+- You have made code changes and want a second opinion before committing
+- You want to validate that changes meet requirements before marking work complete
+- You need a security, performance, or correctness review
+- You want to check for regressions or unintended side effects
+
+## Keep the Reviewer Read-Only
+
+A reviewer should not modify the code it reviews. Don't rely on a "don't edit files"
+instruction in the prompt — restrict the tools. But mind how the two controls actually enforce
+(the [core skill](../invoking-cli-agents/SKILL.md#tool-restriction-safety) has the detail):
+
+- **Claude Code / Copilot / Pi** — whitelist read + git tools **and set `auto_approve=False`**.
+  The whitelist is *inert under the default `auto_approve=True`* (`--dangerously-skip-permissions`
+  auto-approves everything), so the `auto_approve=False` is what makes it bite:
+  `allowed_tools=["Read", "Glob", "Grep", "Bash"], auto_approve=False`.
+- **OpenCode** — it ignores `allowed_tools`, but its denylist **is** genuinely enforced (a
+  per-subprocess `OPENCODE_PERMISSION` env var), and deny beats `auto_approve`, so keep the
+  default `auto_approve=True`: `disallowed_tools=["edit"]`.
+- **Codex / Cursor** — **in-library tool scoping gives you nothing here.** They ignore
+  `allowed_tools`, *and* they cannot enforce `disallowed_tools=["edit"]`. Codex can only deny
+  `web_search`; anything else prints
+  `UserWarning: Codex can only deny web_search; ignoring ['edit']` and the reviewer then runs
+  with unrestricted write access. Cursor has no per-call deny at all (its tool policy lives in
+  `.cursor/cli.json`). If a Codex/Cursor reviewer must not write, enforce it outside the
+  library: capture `git diff` yourself and pass it in the prompt, run the reviewer under an
+  OS-level read-only sandbox, and/or use a different agent type when read-only really matters.
+
+**This is defence-in-depth, not a sandbox.** Any reviewer that keeps `bash` (for `git diff`) can
+still write via the shell, and in-library scoping doesn't cover MCP-provided tools. For a *hard*
+guarantee — an untrusted model, or reviewing hostile input that could prompt-inject the reviewer
+— capture `git diff` yourself, pass it in the prompt, remove the shell too
+(`disallowed_tools=["edit", "bash"]`, or `allowed_tools=["Read","Glob","Grep"], auto_approve=False`),
+and/or run under an OS-level read-only mount.
+
+## Review Uncommitted Changes
+
+```python
+from agent_shell.shell import AgentShell
+from agent_shell.models.agent import AgentType
+
+reviewer = AgentShell(agent_type=AgentType.CLAUDE_CODE)
+
+review = await reviewer.execute(
+    cwd="/path/to/project",
+    prompt="""Review the uncommitted changes in this repository.
+Focus on correctness, security, and design.
+Flag issues by severity: CRITICAL, WARNING, or SUGGESTION.""",
+    allowed_tools=["Read", "Glob", "Grep", "Bash"],   # read + git, no edit tool
+    auto_approve=False,                               # required for the whitelist to enforce
+    model="sonnet",
+)
+```
+
+The reviewer will run `git diff` itself, read surrounding code for context, and report findings.
+
+## Handling a Failed Review
+
+A failed reviewer run raises `AgentExecutionError` instead of returning a response — catch it
+so a crashed or rate-limited reviewer doesn't look like a silent "no issues found":
+
+```python
+from agent_shell.models.agent import AgentExecutionError
+
+try:
+    review = await reviewer.execute(
+        cwd="/path/to/project",
+        prompt="Review the uncommitted changes in this repository.",
+        allowed_tools=["Read", "Glob", "Grep", "Bash"],
+        auto_approve=False,
+        model="sonnet",
+    )
+except AgentExecutionError as e:
+    print(f"review failed: {e}")   # e.g. "500 model name=... failed to load"
+    raise
+```
+
+## Review a Specific Commit or Range
+
+Point the reviewer at a particular changeset — only the prompt changes.
+
+```python
+review = await reviewer.execute(
+    cwd="/path/to/project",
+    prompt="""Review the changes in commit abc1234.
+Focus on correctness, security, and design.
+Flag issues by severity: CRITICAL, WARNING, or SUGGESTION.""",
+    allowed_tools=["Read", "Glob", "Grep", "Bash"],
+    auto_approve=False,
+    model="sonnet",
+)
+
+# Or a range:  "Review all changes between main and HEAD. ..."
+```
+
+## Follow Up
+
+Use session resumption to ask the reviewer to clarify or elaborate.
+
+```python
+clarification = await reviewer.execute(
+    cwd="/path/to/project",
+    prompt="Explain the security concern in more detail and suggest a specific fix.",
+    allowed_tools=["Read", "Glob", "Grep", "Bash"],
+    auto_approve=False,
+    model="sonnet",
+    session_id=review.session_id,
+)
+```
+
+## Cross-Agent Review
+
+Use a different agent or model than the one that wrote the code for genuine independence.
+OpenCode ignores `allowed_tools`, so restrict it with `disallowed_tools` instead — that deny
+*is* enforced. Don't swap `AgentType.CODEX` or `AgentType.CURSOR` into this example expecting
+the same protection: they drop the deny with only a `UserWarning`.
+
+```python
+reviewer = AgentShell(agent_type=AgentType.OPENCODE)
+
+review = await reviewer.execute(
+    cwd="/path/to/project",
+    prompt="""Review the uncommitted changes in this repository.
+Focus on correctness, security, and design.
+Flag issues by severity: CRITICAL, WARNING, or SUGGESTION.""",
+    disallowed_tools=["edit"],          # enforced: cannot Edit/Write/patch
+    model="github-copilot/gpt-5.4",
+)
+```
+
+> OpenCode reports `cost` as `0.0` for many models — use `output_tokens` if you need a usage
+> figure. And a failed reviewer run raises `AgentExecutionError` rather than returning — wrap
+> the call (see [Handling a Failed Review](#handling-a-failed-review) below), since OpenCode can
+> truncate a review with no terminal event and no error (see the core skill's Error Handling).
+
+## Prompt Patterns
+
+### General Review
+```
+Review the uncommitted changes in this repository.
+Focus on correctness, security, and design.
+Flag issues by severity: CRITICAL, WARNING, or SUGGESTION.
+```
+
+### Focused Security Review
+```
+Review the uncommitted changes for security vulnerabilities only. Check for:
+- SQL injection, XSS, command injection
+- Authentication/authorisation gaps
+- Secrets or credentials in code
+- Unsafe deserialization
+```
+
+### Requirements Validation
+```
+The requirement was: "{original_requirement}"
+
+Review the uncommitted changes and assess whether they fully satisfy the requirement.
+Identify any gaps, missing edge cases, or partial implementations.
+```
+
+### Test Coverage Review
+```
+Review the uncommitted changes and identify test scenarios that are missing.
+For each gap, describe the test case that should exist and why it matters.
+```
+
+## Common Mistakes
+
+| Mistake | Fix |
+|---------|-----|
+| Relying on a "do not modify files" prompt instruction for safety | Enforce it (whitelist + `auto_approve=False`, or `disallowed_tools`) |
+| Whitelisting tools but leaving the default `auto_approve=True` | `--dangerously-skip-permissions` makes the whitelist inert — set `auto_approve=False` |
+| Assuming `allowed_tools` restricts OpenCode, Codex, or Cursor | All three ignore it |
+| `disallowed_tools` to keep a Codex/Cursor reviewer read-only | It only warns; sandbox instead |
+| Believing `disallowed_tools=["edit"]` makes the reviewer read-only | It doesn't — the model writes via `bash`; also deny `bash` (and OS-sandbox for a hard guarantee) |
+| Not giving the reviewer `Bash`/git access | Without it the reviewer can't run `git diff` — keep `bash`, or pass the diff in the prompt |
+| Not catching `AgentExecutionError` | A failed reviewer run raises, it does not return |
+| Reviewing with the same model that wrote the code | Use a different model or agent type for independence |
+| Ignoring the review and committing anyway | At minimum, address all CRITICAL items first |