brindle 0.3.22__tar.gz → 0.3.24__tar.gz

{brindle-0.3.22 → brindle-0.3.24}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: brindle
-Version: 0.3.22
+Version: 0.3.24
 Summary: Run coding agents in parallel, each on its own git branch, with a supervisor that delegates, reviews, and merges
 Project-URL: Homepage, https://pawdelta.com/brindle/
 Project-URL: Documentation, https://pawdelta.com/brindle/docs/recommended-use
@@ -94,7 +94,7 @@ uv tool install --editable ~/Projects/brindle   # or from a local checkout
 brindle drives Claude Code, so you need that too (`npm install -g @anthropic-ai/claude-code`).
 
 `brindle --version` prints the installed version; the tmux status bar of every brindle
-session shows it too (`brindle 0.3.22`). A session started before an upgrade keeps
+session shows it too (`brindle 0.3.24`). A session started before an upgrade keeps
 running the old code, and shows the old number, until you restart it.
 
 ## Quick start
@@ -562,7 +562,7 @@ Autopilot, merge gates and cleanup:
 | `pre_commit` | `true` | run [pre-commit](https://pre-commit.com) over the branch, if the repo uses it |
 | `max_agents` | `4` | workers running at once per session (`0`: no cap) |
 | `check_timeout` | `900` | seconds each check may take |
-| `check_concurrency` | `4` | check runs at once on this machine, across branches; the rest wait their turn (`0`: no cap). A run far past its last duration is reported to the supervisor |
+| `check_concurrency` | half the logical cores, at least 2, at most 6 and 2 GB of RAM per run | check runs at once on this machine, across branches; the rest wait their turn (`0`: no cap). A run far past its last duration is reported to the supervisor |
 | `fable_escalation` | on, unless the worker runs on a cloud account (Bedrock, Vertex or Foundry) | retry a failed heavy task once on `developer-heavy` before handing it to you; `true` turns it on for a cloud account, `false` off |
 | `usage_limit` | `90` | autopilot stops pushing on at this % of your Claude usage limit |
 | `limit_cooldown_minutes` | `300` for Antigravity | how long a provider that hit its limit counts as unavailable |
@@ -1844,6 +1844,13 @@ in the same checkout keeps it running for the new one.
 
 Then a supervisor can `assign` a task to `developer-local`, or the repo config
 can make the free model the reviewer: `"review_profile": "reviewer-local"`.
+When the local model isn't served (Ollama isn't running, or the model isn't
+pulled), the worker starts as the profile's `fallback:` instead, and is recorded
+as that profile: `developer-light` (Haiku) for `developer-local`, `reviewer` for
+`reviewer-local`. A native worker on a hosted model that refuses a request
+retries it on `developer-local`'s model, when that is served on this machine or
+the private network, and keeps the rest of the conversation there; the transcript
+records which model gave each reply.
 Other endpoints, same fields:
 
 | Backend | `api` | `base_url` | Notes |

{brindle-0.3.22 → brindle-0.3.24}/README.md

@@ -63,7 +63,7 @@ uv tool install --editable ~/Projects/brindle   # or from a local checkout
 brindle drives Claude Code, so you need that too (`npm install -g @anthropic-ai/claude-code`).
 
 `brindle --version` prints the installed version; the tmux status bar of every brindle
-session shows it too (`brindle 0.3.22`). A session started before an upgrade keeps
+session shows it too (`brindle 0.3.24`). A session started before an upgrade keeps
 running the old code, and shows the old number, until you restart it.
 
 ## Quick start
@@ -531,7 +531,7 @@ Autopilot, merge gates and cleanup:
 | `pre_commit` | `true` | run [pre-commit](https://pre-commit.com) over the branch, if the repo uses it |
 | `max_agents` | `4` | workers running at once per session (`0`: no cap) |
 | `check_timeout` | `900` | seconds each check may take |
-| `check_concurrency` | `4` | check runs at once on this machine, across branches; the rest wait their turn (`0`: no cap). A run far past its last duration is reported to the supervisor |
+| `check_concurrency` | half the logical cores, at least 2, at most 6 and 2 GB of RAM per run | check runs at once on this machine, across branches; the rest wait their turn (`0`: no cap). A run far past its last duration is reported to the supervisor |
 | `fable_escalation` | on, unless the worker runs on a cloud account (Bedrock, Vertex or Foundry) | retry a failed heavy task once on `developer-heavy` before handing it to you; `true` turns it on for a cloud account, `false` off |
 | `usage_limit` | `90` | autopilot stops pushing on at this % of your Claude usage limit |
 | `limit_cooldown_minutes` | `300` for Antigravity | how long a provider that hit its limit counts as unavailable |
@@ -1813,6 +1813,13 @@ in the same checkout keeps it running for the new one.
 
 Then a supervisor can `assign` a task to `developer-local`, or the repo config
 can make the free model the reviewer: `"review_profile": "reviewer-local"`.
+When the local model isn't served (Ollama isn't running, or the model isn't
+pulled), the worker starts as the profile's `fallback:` instead, and is recorded
+as that profile: `developer-light` (Haiku) for `developer-local`, `reviewer` for
+`reviewer-local`. A native worker on a hosted model that refuses a request
+retries it on `developer-local`'s model, when that is served on this machine or
+the private network, and keeps the rest of the conversation there; the transcript
+records which model gave each reply.
 Other endpoints, same fields:
 
 | Backend | `api` | `base_url` | Notes |

{brindle-0.3.22 → brindle-0.3.24}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "brindle"
-version = "0.3.22"
+version = "0.3.24"
 description = "Run coding agents in parallel, each on its own git branch, with a supervisor that delegates, reviews, and merges"
 readme = "README.md"
 requires-python = ">=3.11"

{brindle-0.3.22 → brindle-0.3.24}/src/brindle/agents.py

@@ -26,7 +26,7 @@ from brindle.config import RepoConfig
 from brindle.db import DB, Agent, Workspace
 from brindle.model_availability import ModelAvailabilityChecker, PROVISIONING_TIMEOUT, provisioning_context
 from brindle.pro import route_health
-from brindle.profiles import load_profile, missing_add_dirs
+from brindle.profiles import load_profile, local_fallback, missing_add_dirs
 from brindle.providers import LaunchContext, get_provider, signed_out, unusable
 from brindle.sidebar_follow import (
     SIDEBAR_COLUMNS,
@@ -336,6 +336,9 @@ def spawn(
 
     identity_lock.ensure_workspace(db, ws)   # no new agent in another identity's worktree
     profile = load_profile(profile_name, ws.repo_root)
+    hosted = local_fallback(profile, ws.repo_root)   # its local model isn't up
+    if hosted:
+        profile_name, profile = hosted, load_profile(hosted, ws.repo_root)
     provider = get_provider(provider_name or profile.provider)
     agent_id = new_id()
     # Headless is a Claude Code mode; other CLIs ignore the profile field.
@@ -1355,6 +1358,24 @@ def is_alive(agent: Agent, panes: dict[str, bool] | None = None) -> bool:
     return tmux.window_alive(agent.tmux_window, server=agent.tmux_server or None)
 
 
+LAUNCH_GRACE = 60.0   # seconds a just-spawned agent may go without a window before it counts as dead
+
+
+def alive_or_starting(agent: Agent) -> bool:
+    """``is_alive``, or still being launched: spawn records the agent before
+    its window opens (the launch's checks can take seconds), so one with no
+    window yet is starting, not dead, for LAUNCH_GRACE seconds. A launch known
+    to have failed ends that: spawn deletes the row of one that raised, and
+    launch_health marks one whose CLI died at startup "failed". For the
+    checks that would replace the agent (start another reviewer, forget an
+    auditor), not for ones that talk to its pane."""
+    if is_alive(agent):
+        return True
+    return (runs_process(agent) and not agent.tmux_window and agent.result is None
+            and agent.status not in ("paused", "done", "failed")
+            and time.time() - agent.created_at < LAUNCH_GRACE)
+
+
 def server_of(agent: Agent) -> str | None:
     """The tmux server ``agent``'s window is on (a private socket name, or
     None for the default server), for the ``server`` argument of tmux calls
@@ -1462,7 +1483,9 @@ def one_line(db: DB, message_id: int, body: str, sender_id: str | None) -> str:
         who = f"{sender.profile} {sender_id}" if sender else sender_id
     else:
         who = "brindle"
-    head = first_line(body, 300)
+    # A stuck-worker notice (cull.note_stuck) carries the prompt it waits on in
+    # its first line, which has to arrive whole.
+    head = first_line(body, 1500 if "has been waiting on a prompt for" in body[:200] else 300)
     if not sender_id:
         head = head.removeprefix("[brindle] ")  # the sender tag already says it
     return (f"[{who}] {head} "
@@ -1903,12 +1926,17 @@ def _detach(args: list[str]) -> None:
                      stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
 
 
+# A shell that starts the command after it in the background and exits, so the
+# command is nobody's child (see _detach_orphan).
+ORPHANED = ["/bin/sh", "-c", '"$@" </dev/null >/dev/null 2>&1 &', "sh"]
+
+
 def _detach_orphan(args: list[str]) -> None:
     """Start a brindle helper that outlives this process and its agent: a
     shell starts it in the background and exits, so it is nobody's child.
     Stopping an agent stops every process descended from its MCP server
     (brindle.procs), a helper ``_detach`` started there included."""
-    subprocess.run(["/bin/sh", "-c", '"$@" </dev/null >/dev/null 2>&1 &', "sh", *args],
+    subprocess.run([*ORPHANED, *args],
                    start_new_session=True, stdin=subprocess.DEVNULL,
                    stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, check=False)
 
@@ -1982,28 +2010,30 @@ def submit_review(db: DB, caller_id: str, approved: bool, summary: str) -> str:
         close_later(caller.id)
         return "Audit recorded and sent to the supervisor. You're done."
     # Already recorded: closing this reviewer is its verdict's job, once
-    # whatever the verdict set off is done. Checked before the lock too, which
-    # that work (a merge running the checks) can hold for minutes.
-    recorded = "Your review was already recorded. You're done."
+    # whatever the verdict set off is done.
     if caller.result is not None:
-        return recorded
-    # One verdict at a time per workspace: a second one (the same reviewer
-    # calling twice, or another reviewer of the same branch) waits here, then
-    # finds what the first one did instead of merging alongside it.
-    with pipeline.merge_lock(ws.id):
-        caller = db.get_agent(caller_id)
-        if caller is not None and caller.result is not None:
-            return recorded
-        if caller is None or db.get_workspace(ws.id) is None or not os.path.isdir(ws.path):
-            close_later(caller_id)   # the branch merged (or was removed) meanwhile
-            return "The branch is already merged or removed. You're done."
+        return "Your review was already recorded. You're done."
+    # Recorded without the branch's merge lock: a merge holds it while the
+    # repo's checks run, for minutes, and a verdict waiting on it left the
+    # reviewer's call hanging until its CLI gave up on it, never recorded.
+    # Acting on the verdict (finish_review) takes the lock, apart from the
+    # reviewer, and finds whatever a merge in progress did: a second
+    # reviewer's verdict for a branch that merged meanwhile is dropped there.
+    gone = "The branch is already merged or removed. You're done."
+    if db.get_workspace(ws.id) is None or not os.path.isdir(ws.path):
+        close_later(caller_id)
+        return gone
+    try:
         sha = gates.head(ws)
-        db.add_review(ws.id, sha, caller.id, approved, summary)
-        if approved:
-            db.bump_progress(autopilot.root_of(db, caller.id))
-        pipeline.note_review(db, ws, approved, reviewer=caller)
-        verdict = "APPROVED" if approved else "CHANGES REQUESTED"
-        db.set_result(caller.id, _review_text(ws, sha, approved, summary))
+    except git.GitError:   # removed just now
+        close_later(caller_id)
+        return gone
+    db.add_review(ws.id, sha, caller.id, approved, summary)
+    if approved:
+        db.bump_progress(autopilot.root_of(db, caller.id))
+    pipeline.note_review(db, ws, approved, reviewer=caller)
+    verdict = "APPROVED" if approved else "CHANGES REQUESTED"
+    db.set_result(caller.id, _review_text(ws, sha, approved, summary))
     finish_review_later(caller.id, ws.id)
     return f"Review recorded ({verdict}); brindle takes it from here. You're done."
 
@@ -2273,14 +2303,12 @@ def default_review_profile(cfg: RepoConfig, worker: Agent | None, db: DB | None
 def _local_reviewer_available() -> bool:
     """Whether the built-in ``reviewer-local`` profile's model is served
     right now. Any failure counts as not available."""
-    try:
-        from brindle.native import runner
+    from brindle.native import runner
 
-        endpoint = runner.endpoint_for(load_profile("reviewer-local"))
-        ok, detail = runner.probe(endpoint, timeout=1.0)
+    try:
+        return runner.served(load_profile("reviewer-local"))
     except Exception:
         return False
-    return bool(ok) and "is available" in detail
 
 
 def _review_kill_switch(ws: Workspace) -> None:
@@ -2345,7 +2373,7 @@ def _live_reviewer(db: DB, ws: Workspace, sha: str, profile: str | None = None)
     ``profile``, only one running that profile (a second review by another
     profile is not a duplicate)."""
     for a in db.list_agents(ws.id):
-        if a.mode == "review" and a.result is None and is_alive(a) and a.review_sha == sha \
+        if a.mode == "review" and a.result is None and alive_or_starting(a) and a.review_sha == sha \
                 and (profile is None or a.profile == profile):
             return a
     return None
@@ -2381,7 +2409,9 @@ def start_review(db: DB, caller: Agent | None, ws: Workspace, profile: str | Non
         argv += ["--profile", profile]
     if focus:
         argv += ["--focus", focus]
-    _detach(argv)
+    # Nobody's child: the worker reporting here may be closed while the checks
+    # still run, and stopping it would stop this run too, so no reviewer (#190).
+    _detach([*ORPHANED, *argv])
     return None
 
 
@@ -2397,34 +2427,51 @@ def expected_check_wait(db: DB, ws: Workspace, cfg: RepoConfig) -> float | None:
     return total if cfg.checks else None
 
 
+MOVED_RETRIES = 2   # check runs a branch that keeps moving under them gets again (review_after_checks)
+
+
 def review_after_checks(db: DB, caller_id: str | None, ws: Workspace, profile: str | None = None,
                         focus: str | None = None, cfg: RepoConfig | None = None) -> Agent | None:
     """Run ``cfg.checks`` for ``ws`` (through ``gates.check_summary``: its
     lock and the by-sha cache, so a result a worker's report already warmed
     is instant), then start the reviewer with the results in its prompt.
     Meant to run from a detached process, which outlives the call that
-    started it. Gives up quietly when the branch moves on (the new commit
-    gets its own review), the workspace is gone, or a reviewer is already at
-    work on this commit. Raises ``AgentError`` when the reviewer can't
-    start."""
-    from brindle import gates
+    started it. Gives up quietly when the workspace is gone, a reviewer is
+    already at work on this commit, or the branch moves on to a commit a new
+    report hands to a run of its own. A piped branch that moves on without
+    a new report (its worker committed again, or merged its moved base in)
+    is checked again on its new head, up to ``MOVED_RETRIES`` times, and then
+    goes to the supervisor. Raises ``AgentError`` when the reviewer can't
+    start. Holds ``pipeline.review_run`` throughout, so the sweep can tell
+    this run at work (queued for a slot, say) from one that died."""
+    from brindle import gates, pipeline
     from brindle.config import load_repo_config
 
     cfg = cfg or load_repo_config(ws.repo_root)
-    sha = gates.head(ws)
-    if _live_reviewer(db, ws, sha, profile):
-        return None
-    try:
-        summary = gates.check_summary(db, ws, cfg, cancel=lambda: gates.head(ws) != sha)
-    except gates.Abandoned:
-        return None
-    except Exception as e:  # noqa: BLE001 - the review goes ahead, saying so
-        summary = f"(running the checks crashed: {e})"
-    if db.get_workspace(ws.id) is None or gates.head(ws) != sha:
-        return None
-    caller = db.get_agent(caller_id) if caller_id else None
-    text = f"Checks for {ws.branch} at {sha[:8]}:\n\n{summary}" if summary else None
-    return request_review(db, caller, ws, profile, focus, cfg, check_summary=text)
+    with pipeline.review_run(ws.id):
+        since = pipeline.review_claim(db, ws)
+        for _attempt in range(MOVED_RETRIES + 1):
+            sha = gates.head(ws)
+            if _live_reviewer(db, ws, sha, profile):
+                return None
+            try:
+                summary = gates.check_summary(db, ws, cfg, cancel=lambda sha=sha: gates.head(ws) != sha)
+            except gates.Abandoned:
+                summary = None
+            except Exception as e:  # noqa: BLE001 - the review goes ahead, saying so
+                summary = f"(running the checks crashed: {e})"
+            if db.get_workspace(ws.id) is None:
+                return None
+            if gates.head(ws) == sha:
+                break
+            if not pipeline.still_claimed(db, ws, since):
+                return None
+        else:
+            pipeline.on_moved_during_checks(db, ws)
+            return None
+        caller = db.get_agent(caller_id) if caller_id else None
+        text = f"Checks for {ws.branch} at {sha[:8]}:\n\n{summary}" if summary else None
+        return request_review(db, caller, ws, profile, focus, cfg, check_summary=text)
 
 
 def request_review(db: DB, caller: Agent | None, ws: Workspace, profile: str | None = None,
@@ -2449,7 +2496,7 @@ def request_review(db: DB, caller: Agent | None, ws: Workspace, profile: str | N
     cfg = cfg or load_repo_config(ws.repo_root)
     sha = gates.head(ws)
     for old in db.list_agents(ws.id):
-        if old.mode != "review" or old.result is not None or not is_alive(old):
+        if old.mode != "review" or old.result is not None or not alive_or_starting(old):
             continue
         if old.unreported_noted:
             continue   # it stopped without a verdict: not the reviewer of anything
@@ -3322,7 +3369,9 @@ def tell_parent_unreported(db: DB, agent: Agent) -> bool:
     if agent.mode == "review" and ws is not None and os.path.isdir(ws.path):
         from brindle import gates
 
-        if db.latest_review(ws.id, gates.head(ws)):
+        # Its own verdict only: another reviewer's (a second review's) says
+        # nothing about whether this one's call got through.
+        if any(r.reviewer_id == agent.id for r in db.reviews_at(ws.id, gates.head(ws))):
             return False  # its verdict for the current commit is already recorded
     if agent.unreported_noted:
         return False  # the supervisor was told about this stop; cleared once it resumes

{brindle-0.3.22 → brindle-0.3.24}/src/brindle/antigravity.py

@@ -110,7 +110,9 @@ def binary() -> str:
     explicit = os.environ.get("BRINDLE_AGY_BIN")
     if explicit:
         return explicit
-    return shutil.which("agy") or (BUNDLED if os.path.exists(BUNDLED) else "agy")
+    from brindle.providers import which_cli
+
+    return which_cli("agy") or (BUNDLED if os.path.exists(BUNDLED) else "agy")
 
 
 def tool_names() -> list[str]:

{brindle-0.3.22 → brindle-0.3.24}/src/brindle/autopilot.py

@@ -54,6 +54,7 @@ log = logging.getLogger(__name__)
 GOALS_FILE = "goals.md"
 GOALS_DIR = "goals"          # .brindle/goals/<session id>.md: each session's own goal
 MAX_NUDGES = 3
+NUDGE_BACKOFF = 900.0        # seconds before the same reminder is repeated when nothing has changed
 MAX_GOAL_CHARS = 4000        # Claude Code's limit for a /goal condition
 OUTPUT_TAIL_LINES = 30
 
@@ -1817,12 +1818,15 @@ def on_stop(db: DB, agent: Agent, payload: dict) -> dict | None:
 
     if login_pause.paused(db, agent.id):
         return None  # only the person can renew the login; a nudge would just fail
+    if proposing(ap):
+        return None  # brindle's own dialog is asking the user to approve checks
     if ap.state == "auditing":
         if ap.auditor_id:
             auditor = db.get_agent(ap.auditor_id)
-            if auditor is None or auditor.status in ("paused", "done") or not agents.is_alive(auditor) or auditor.result is not None:
-                # Auditor was spawned but is no longer running (dead or crashed without verdict).
-                # Reset state to running so autopilot can recover.
+            if auditor is None or auditor.status in ("paused", "done") or not agents.alive_or_starting(auditor) \
+                    or auditor.result is not None:
+                # Auditor was spawned but is no longer running (dead or crashed without verdict;
+                # one still starting isn't). Reset state to running so autopilot can recover.
                 db.update_autopilot(agent.id, state="running", auditor_id=None)
                 ap = db.get_autopilot(agent.id)
             else:
@@ -1856,12 +1860,16 @@ def on_stop(db: DB, agent: Agent, payload: dict) -> dict | None:
         # One reminder per step: never counts toward stalling.
         db.update_autopilot(agent.id, nudges=0, nudged_at=ap.progress)
         return {"decision": "block", "reason": nudge(db, ap, cfg, working, stalled)}
+    now = time.time()
+    if (ap.nudged_at == ap.progress and ap.nudged_time is not None
+            and now - ap.nudged_time < NUDGE_BACKOFF):
+        return None  # (#177) already reminded since the last step: it's legitimately waiting
     nudges = ap.nudges if ap.nudged_at == ap.progress else 0
     if nudges >= MAX_NUDGES:
         db.update_autopilot(agent.id, state="stalled", nudges=0,
                             note=f"no progress after {MAX_NUDGES} reminders to keep going")
         return None
-    db.update_autopilot(agent.id, nudges=nudges + 1, nudged_at=ap.progress)
+    db.update_autopilot(agent.id, nudges=nudges + 1, nudged_at=ap.progress, nudged_time=now)
     return {"decision": "block", "reason": nudge(db, ap, cfg, working, stalled)}
 
 
@@ -1911,12 +1919,112 @@ def nudge(db: DB, ap: Autopilot, cfg: RepoConfig,
 
 
 NO_CHECKS = """- This repo has no `checks` in .brindle/config.json, so nothing verifies a
-  branch before it merges. Before the first `assign`, propose a check command
-  to the user{suggestion}, and once they agree add it to `checks` in
-  .brindle/config.json (create the file if needed) and commit it.
+  branch before it merges. Before the first `assign`, call `add_checks` with
+  the check command you propose{suggestion}. brindle itself asks the user to
+  approve it (and to allow its commands in .claude/settings.local.json) and
+  writes what they accept; don't ask them yourself. Then commit
+  .brindle/config.json.
 """
 
 
+PROPOSAL_TTL = 30 * 60   # seconds a check proposal may hold autopilot (see proposing)
+
+
+SAFE_ALLOW = re.compile(r"[A-Za-z0-9_./ =,@+-]+")   # no wildcard, quote, $, &, redirect or newline
+# Programs whose only job is checking code. Exact, case-sensitive matches: anything
+# else (wrappers, shells, package runners, interpreters) is refused.
+CHECK_PROGRAMS = {"pytest", "ruff", "mypy", "shellcheck", "eslint", "tsc",
+                  "flake8", "pyright", "golangci-lint"}
+# Toolchains run code through many subcommands (go run, cargo install, ...): only these.
+CHECK_SUBCOMMANDS = {"go": {"test", "vet"}, "cargo": {"test", "check", "clippy", "fmt"}}
+# Flags allowed on those subcommands; any other flag can name a program to run (-exec, -toolexec, --config ...).
+HARMLESS_FLAGS = {"-v", "-q", "-race", "--check", "--all-targets", "--workspace"}
+CHECK_MODULES = {"pytest", "mypy", "ruff", "unittest"}   # the only `python -m` targets allowed
+
+
+def _runs_arbitrary(c: str) -> bool:
+    """True unless the command runs a known check program. ``NAME=VALUE`` prefixes
+    and paths are refused; ``uv run`` is looked through to the program it runs."""
+    argv = c.split()
+    if argv[:1] == ["uv"] and argv[1:2] == ["run"]:
+        argv = argv[2:]
+    if not argv or "=" in argv[0] or argv[0] not in {*CHECK_PROGRAMS, *CHECK_SUBCOMMANDS, "python", "python3"}:
+        return True
+    if argv[0] in CHECK_SUBCOMMANDS:
+        return (argv[1:2] == [] or argv[1] not in CHECK_SUBCOMMANDS[argv[0]]
+                or any(a.startswith("-") and a not in HARMLESS_FLAGS for a in argv[2:]))
+    if argv[0] in CHECK_PROGRAMS:
+        return False
+    return argv[1:2] != ["-m"] or argv[2:3] == [] or argv[2] not in CHECK_MODULES
+
+
+def allow_rules(checks: list[str]) -> tuple[list[str], str | None]:
+    """One narrow Bash allow rule per command in ``checks``, or none and why."""
+    commands = [c.strip() for check in checks for c in re.split(r"&&|\|\||;|\|", check)]
+    unsafe = [c for c in commands if c and (
+        not SAFE_ALLOW.fullmatch(c) or _runs_arbitrary(c))]
+    if unsafe:
+        return [], (f"{unsafe[0]!r} has a wildcard, substitution, redirect or a binary "
+                    "that runs arbitrary code")
+    return list(dict.fromkeys(f"Bash({c})" for c in commands if c)), None
+
+
+def propose_checks(db: DB, root_id: str, checks: list[str]) -> tuple[str, list[str]]:
+    """Record ``checks`` as awaiting the user's answer in brindle's dialog (no
+    nudge meanwhile, see on_stop). Returns the dialog's text and the allow
+    rules it offers."""
+    rules, refusal = allow_rules(checks)
+    db.update_autopilot(root_id, proposal=json.dumps(
+        {"checks": checks, "rules": rules, "at": time.time()}))
+    text = ("brindle: run these checks on every branch before it merges "
+            "(saved to .brindle/config.json)?\n" + "\n".join(f"  {c}" for c in checks))
+    if rules:
+        text += ("\n\nAlso allow their commands without a permission prompt "
+                 "(.claude/settings.local.json):\n" + "\n".join(f"  {r}" for r in rules))
+    else:
+        text += f"\n\nbrindle won't offer to allow their commands: {refusal}."
+    return text, rules
+
+
+def proposing(ap: Autopilot) -> bool:
+    """A check proposal is waiting on the user. One older than PROPOSAL_TTL
+    is a dialog whose server died: it no longer holds autopilot."""
+    try:
+        at = float(json.loads(ap.proposal or "{}").get("at") or 0)
+    except (ValueError, TypeError, AttributeError):
+        return False
+    return time.time() - at < PROPOSAL_TTL
+
+
+def add_checks(repo_root: str, checks: list[str], allow: bool = False) -> str:
+    """Add approved ``checks`` to .brindle/config.json and, with ``allow``, one
+    narrow Bash allow rule per command in them to .claude/settings.local.json."""
+    from brindle.config import CONFIG_FILE, _read_json
+
+    root = Path(config_root(repo_root))
+    path = root / CONFIG_DIR / CONFIG_FILE
+    data = _read_json(path)
+    data["checks"] = [*(c for c in data.get("checks") or [] if c not in checks), *checks]
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(json.dumps(data, indent=2) + "\n", encoding="utf-8")
+    text = f"Added {len(checks)} check(s) to {path}."
+    if not allow:
+        return text
+    rules, refusal = allow_rules(checks)
+    if refusal:
+        return f"{text} Did not allow any commands: {refusal}. The user can add rules themselves."
+    settings_path = root / ".claude" / "settings.local.json"
+    settings = _read_json(settings_path)
+    perms = settings.setdefault("permissions", {})
+    allowed = perms.setdefault("allow", [])
+    for rule in rules:
+        if rule not in allowed:
+            allowed.append(rule)
+    settings_path.parent.mkdir(parents=True, exist_ok=True)
+    settings_path.write_text(json.dumps(settings, indent=2) + "\n", encoding="utf-8")
+    return f"{text} Allowed their commands in {settings_path}."
+
+
 def guide(cfg: RepoConfig, repo_root: str | None = None) -> str:
     text = GUIDE.format(max_agents=cfg.max_agents or "any number of")
     if repo_root and not cfg.checks:

{brindle-0.3.22 → brindle-0.3.24}/src/brindle/builtin_agents/developer-local.md

@@ -6,6 +6,7 @@ api: openai                        # Ollama's OpenAI-compatible endpoint
 base_url: http://localhost:11434/v1
 model: qwen3-coder:30b             # ollama pull qwen3-coder:30b (19 GB; needs ~24 GB of memory)
 context_tokens: 32k                # Ollama's default window is smaller: set OLLAMA_CONTEXT_LENGTH=40960 for `ollama serve`
+fallback: developer-light          # hosted Haiku, when Ollama isn't running or the model isn't pulled
 permission_mode: acceptEdits       # edits are free; commands need a rule below
 allowed_tools: Bash(git add:*), Bash(git commit:*), Bash(git status:*), Bash(git ls-files:*), Bash(git diff:*), Bash(git log:*), Bash(git show:*), Bash(git rev-parse:*), Bash(git branch:*), Bash(pytest:*), Bash(python -m pytest:*), Bash(python3 -m pytest:*), Bash(python -m unittest:*), Bash(python3 -m unittest:*), Bash(uv run:*), Bash(uv sync:*), Bash(npm test:*), Bash(npm run:*), Bash(npm ci:*), Bash(pnpm test:*), Bash(pnpm run:*), Bash(pnpm install:*), Bash(yarn test:*), Bash(yarn run:*), Bash(cargo build:*), Bash(cargo test:*), Bash(cargo check:*), Bash(cargo clippy:*), Bash(go build:*), Bash(go test:*), Bash(go vet:*), Bash(make:*), Bash(swift build:*), Bash(swift test:*), Bash(ls:*), Bash(pwd), Bash(cat:*), Bash(tail:*), Bash(head:*), Bash(grep:*), Bash(wc:*)
 ---

{brindle-0.3.22 → brindle-0.3.24}/src/brindle/builtin_agents/reviewer-local.md

@@ -6,6 +6,7 @@ api: openai
 base_url: http://localhost:11434/v1
 model: qwen3-coder:30b
 context_tokens: 32k
+fallback: reviewer                 # hosted, when Ollama isn't running or the model isn't pulled
 permission_mode: dontAsk           # nobody watches a reviewer: refuse what allowed_tools doesn't cover
 allowed_tools: Bash(git status:*), Bash(git ls-files:*), Bash(git stash list), Bash(git diff:*), Bash(git log:*), Bash(git show:*), Bash(git merge-base:*), Bash(pytest:*), Bash(python -m pytest:*), Bash(python3 -m pytest:*), Bash(python -m unittest:*), Bash(python3 -m unittest:*), Bash(uv run:*), Bash(npm test:*), Bash(npm run:*), Bash(pnpm test:*), Bash(pnpm run:*), Bash(yarn test:*), Bash(yarn run:*), Bash(cargo test:*), Bash(cargo check:*), Bash(cargo clippy:*), Bash(go test:*), Bash(go vet:*), Bash(make:*), Bash(swift test:*), Bash(ls:*), Bash(pwd), Bash(cat:*), Bash(tail:*), Bash(head:*), Bash(grep:*), Bash(wc:*)
 ---