brindle 0.4.2__tar.gz → 0.4.4__tar.gz

{brindle-0.4.2 → brindle-0.4.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: brindle
-Version: 0.4.2
+Version: 0.4.4
 Summary: Run coding agents in parallel, each on its own git branch, with a supervisor that delegates, reviews, and merges
 Project-URL: Homepage, https://pawdelta.com/brindle/
 Project-URL: Documentation, https://pawdelta.com/brindle/docs/recommended-use
@@ -101,7 +101,7 @@ uv tool install --editable ~/Projects/brindle   # or from a local checkout
 brindle drives Claude Code, so you need that too (`npm install -g @anthropic-ai/claude-code`).
 
 `brindle --version` prints the installed version; the tmux status bar of every brindle
-session shows it too (`brindle 0.4.2`). A session started before an upgrade keeps
+session shows it too (`brindle 0.4.3`). A session started before an upgrade keeps
 running the old code, and shows the old number, until you restart it.
 
 ## Quick start

{brindle-0.4.2 → brindle-0.4.4}/README.md

@@ -70,7 +70,7 @@ uv tool install --editable ~/Projects/brindle   # or from a local checkout
 brindle drives Claude Code, so you need that too (`npm install -g @anthropic-ai/claude-code`).
 
 `brindle --version` prints the installed version; the tmux status bar of every brindle
-session shows it too (`brindle 0.4.2`). A session started before an upgrade keeps
+session shows it too (`brindle 0.4.3`). A session started before an upgrade keeps
 running the old code, and shows the old number, until you restart it.
 
 ## Quick start

{brindle-0.4.2 → brindle-0.4.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "brindle"
-version = "0.4.2"
+version = "0.4.4"
 description = "Run coding agents in parallel, each on its own git branch, with a supervisor that delegates, reviews, and merges"
 readme = "README.md"
 requires-python = ">=3.11"

{brindle-0.4.2 → brindle-0.4.4}/src/brindle/agents.py

@@ -901,6 +901,13 @@ def _launch(db: DB, agent: Agent, ws: Workspace, *, prompt: str | None,
     argv = provider.command(LaunchContext(agent.id, profile, prompt, resume=resume, cwd=ws.path,
                                           mode=agent.mode, plan_first=bool(agent.plan_first),
                                           mcp_recovery=mcp_recovery))
+    if provider.name == "codex":
+        from brindle import codex_hook
+
+        try:
+            codex_hook.tell_untrusted(db, agent, ws.path)  # launched without the hook it couldn't trust
+        except Exception:  # noqa: BLE001 - never stop a launch over this
+            pass
     if prompt or db.pending_count(agent.id):
         _prepare_launch_health(db, agent, ws, profile, m, argv_task=bool(prompt and provider.name != "shell"),
                               submitted_prompt=argv[-1] if prompt and provider.name == "codex" else (prompt or ""))
@@ -1801,7 +1808,10 @@ def flush(db: DB, agent_id: str) -> bool:
                 break
         if delivered:
             return True
-    if db.pending_count(agent_id) == 0 or not db.claim_idle(agent_id):
+    if db.pending_count(agent_id) == 0:
+        return False
+    claimed_at = db.claim_idle(agent_id)
+    if claimed_at is None:
         return False
     if _paste_blocked(agent):
         # Leave it queued: the next flush (a later message, or a resumed
@@ -1816,9 +1826,15 @@ def flush(db: DB, agent_id: str) -> bool:
     assert agent is not None
     from brindle import antigravity
     warmup = agent.provider == "antigravity" and antigravity.WARMUP_END in msg.body
-    baseline = launch_health.before_delivery(db, agent, msg.body) if not warmup else ""
-    tmux.paste(agent.tmux_window, msg.body, lead=message_lead(db, agent, msg.sender_id),
-               server=server_of(agent))
+    try:
+        baseline = launch_health.before_delivery(db, agent, msg.body) if not warmup else ""
+        tmux.paste(agent.tmux_window, msg.body, lead=message_lead(db, agent, msg.sender_id),
+                   server=server_of(agent))
+    except BaseException:
+        # pop_pending claimed this row before the external send. Release the
+        # same row and our idle claim so the next flush can retry it once.
+        db.retry_pending(msg.id, agent_id, claimed_at)
+        raise
     if not warmup:
         launch_health.verify_delivery(db, agent, msg.body, baseline, message_lead(db, agent, msg.sender_id))
     return True
@@ -2143,9 +2159,40 @@ def finish_review(db: DB, reviewer_id: str, ws_id: str) -> None:
 
             learned_rules.refresh_later(ws.repo_root)   # the finding just landed in the history
     finally:
+        # A merge removes the workspace but leaves the session this reviewer
+        # runs in; once the reviewer is gone nobody else would end it.
+        if ws and db.get_workspace(ws_id) is None:
+            _closing_session(reviewer_id).write_text(ws.tmux_session)
         close_later(reviewer_id)
 
 
+def _closing_session(agent_id: str):
+    from brindle.config import brindle_home
+
+    d = brindle_home() / "closing"
+    d.mkdir(parents=True, exist_ok=True)
+    return d / agent_id
+
+
+def close_removed(db: DB, agent_id: str) -> None:
+    """Kill an agent and, when its workspace was removed with the session left
+    running (noted by ``finish_review``), that session too: only brindle's own,
+    unattached session of a workspace that no longer exists."""
+    note = _closing_session(agent_id)
+    try:
+        session = note.read_text().strip()
+        note.unlink()
+    except OSError:
+        session = ""
+    try:
+        kill(db, agent_id)
+    except AgentError:
+        pass
+    if session and db.workspace_by_tmux_session(session) is None \
+            and not tmux.session_attached(session):
+        tmux.kill_session(session)
+
+
 def close_later(agent_id: str, delay: float = 5.0) -> None:
     """Stop an agent shortly, from a detached process: used by an agent's own
     tool call, which must return before its CLI goes away."""
@@ -2914,7 +2961,9 @@ def permission_request_decision(db: DB, agent: Agent, payload: dict,
     """Claude Code's or Codex's PermissionRequest hook: brindle's permission
     policy (brindle.permissions) answers allow or deny, or None to let the CLI
     prompt the person as usual (ask). Off unless the repo or user config
-    sets ``permission_policy: "on"``. Never raises: any failure is ask."""
+    sets ``permission_policy: "on"``, except for a Codex reviewer, whose hook
+    allows what its profile's allowed_tools cover and leaves the rest to
+    Codex (#241). Never raises: any failure is ask."""
     try:
         from brindle import permissions
         from brindle.config import load_repo_config
@@ -2924,7 +2973,11 @@ def permission_request_decision(db: DB, agent: Agent, payload: dict,
         if ws is None:
             return None
         cfg = load_repo_config(ws.repo_root)
-        if cfg.permission_policy != "on":
+        # Policy off: only a Codex reviewer has the hook (codex_hook.launch_flags).
+        # Nobody watches it, so it gets what its allowed_tools cover and
+        # nothing else of brindle's: every other answer is Codex's own.
+        review_only = cfg.permission_policy != "on"
+        if review_only and not (provider == "codex" and agent.mode == "review"):
             return None
         profile_rules = profile_rules_for(agent.profile, ws.repo_root)
         if provider == "codex":
@@ -2945,7 +2998,8 @@ def permission_request_decision(db: DB, agent: Agent, payload: dict,
                 profile = None  # deleted profile: no extra allowances
             if profile is not None:
                 rules += permissions.profile_bash_allows(profile)
-            decision = permissions.decide_all(reqs, checks=cfg.checks, rules=rules)
+            decision = permissions.Decision("ask", "not in the profile's allowed_tools") if review_only \
+                else permissions.decide_all(reqs, checks=cfg.checks, rules=rules)
             if decision.decision == "ask" and len(reqs) == 1:
                 # A deny on one part of a compound command (cd x && <denied>)
                 # wins before any part-by-part allow below.
@@ -2977,6 +3031,8 @@ def permission_request_decision(db: DB, agent: Agent, payload: dict,
                         "deny", f"{decision.reason.removesuffix('; asking the user')}, and this profile "
                         "never asks (permission_mode dontAsk). Don't retry it: do without it, or ask "
                         "your supervisor with the send_message tool (brindle MCP server)")
+            if review_only and decision.decision != "allow":
+                return None  # as Codex would without brindle: its own prompt or refusal
             summary = reqs[0].summary() if len(reqs) == 1 else (
                 f"{reqs[0].tool}: " + ", ".join(r.path or "?" for r in reqs))[:200]
             _record_permission(db, agent, ws, summary, f"{decision.decision}: {decision.reason}")

{brindle-0.4.2 → brindle-0.4.4}/src/brindle/autopilot.py

@@ -12,6 +12,7 @@ is running, its Stop hook tells it to keep going. It stops pushing when:
 - the supervisor calls ``need_user`` (blocked on a decision only the user can
   make), until the user next types something or, for its own question,
   until the supervisor says it's answered,
+- the supervisor calls ``wait_on`` for an outside job, until it ends,
 - it has nudged MAX_NUDGES times in a row with no progress (stalled), or
 - Claude usage is near its limit.
 
@@ -38,6 +39,7 @@ from __future__ import annotations
 
 import json
 import logging
+import math
 import os
 import re
 import subprocess
@@ -57,6 +59,7 @@ GOALS_DIR = "goals"          # .brindle/goals/<session id>.md: each session's ow
 MAX_NUDGES = 3
 NUDGE_BACKOFF = 900.0        # seconds before the same reminder is repeated when nothing has changed
 NUDGE_HEAD = "[brindle autopilot] The goal isn't reached yet, and no workers are running."
+WAIT_ENDED_HEAD = "[brindle autopilot] The job you were waiting on has ended"
 MAX_GOAL_CHARS = 4000        # Claude Code's limit for a /goal condition
 OUTPUT_TAIL_LINES = 30
 
@@ -118,6 +121,12 @@ to be asked each step.
   depend on it: call `need_user` with the question, ask it, keep working the
   rest, and report the blocked item with it. Stop only when nothing else is
   left; once the user answers, call `need_user(answered=true)`.
+- If the next step waits on an outside job, call `wait_on(pid=..., note=...)`
+  or `wait_on(until=..., note=...)` (Unix timestamp in seconds); `path=...`
+  can watch for a completion file. Autopilot holds reminders and stall counting,
+  then wakes you once when the process exits, the time arrives, or the file
+  appears. If several are given, the first to finish ends the wait. An existing
+  wait is kept if you call again. Keep working on independent steps meanwhile.
 - When a milestone passes, tell the user in one line.
 - If a message says autopilot is off, stop driving: wait for the user's
   instructions.
@@ -853,6 +862,8 @@ def profile_weight(name: str, cfg: RepoConfig | None = None, repo_root: str | No
         m = effective_profile_model(p, repo_root).lower()
         if any(h in m for h in ("fable", "opus", "o3", "deepseek-r1", "astra")):
             return "heavy"
+        if "sonnet" in m:
+            return "medium"
         if getattr(p, "effort", None) in ("high", "xhigh", "max"):
             return "heavy"
         if "-heavy" in name:
@@ -890,8 +901,9 @@ def choose_profile(db: DB, caller_id: str, repo_root: str, requested: str | None
                    weight: str | None = None, why: list[str] | None = None,
                    decision: dict | None = None) -> tuple[str, bool]:
     """The worker profile for a delegation, and whether learning chose it:
-    ``requested`` if given, else the first unverified milestone's profile in
-    the caller's session, else the repo's routing for ``weight`` (available
+    ``requested`` if given, else (when no ``weight`` is given) the first
+    unverified milestone's profile in the caller's session, else the repo's
+    routing for ``weight`` (available
     candidates only, the hosted learner choosing among them), else the hosted
     learner's pick among ``learning_candidates``, else the repo's
     ``default_agent``. Raises AutopilotError if it doesn't exist. An
@@ -916,7 +928,10 @@ def choose_profile(db: DB, caller_id: str, repo_root: str, requested: str | None
     routed: dict = {}
     if not name:
         pending = next((m for m in db.milestones(root_of(db, caller_id)) if m.status != "passed"), None)
-        if pending and pending.profile:
+        if pending and pending.profile and weight:
+            if why is not None:
+                why.append(f"weight {weight} overrides milestone profile {pending.profile.strip()}")
+        elif pending and pending.profile:
             m_profile = pending.profile.strip()
             if ceiling and weight_order[profile_weight(m_profile, cfg, repo_root)] > weight_order[ceiling]:
                 candidates = cfg.routing.get(ceiling, [cfg.default_agent])
@@ -1048,6 +1063,52 @@ def need_user(db: DB, root_id: str, question: str, ask: bool = False) -> None:
                         question=note if ask else None)
 
 
+def wait_on(db: DB, root_id: str, pid: int | None = None, until: float | None = None,
+            note: str = "", path: str | None = None) -> None:
+    """Declare a session wait; any supplied completion condition ends it."""
+    if pid is None and until is None and not path:
+        raise AutopilotError("Give a pid, an until Unix timestamp, or a completion file path.")
+    if pid is not None and not 0 < pid <= 2**31 - 1:
+        raise AutopilotError("pid must be a positive process id.")
+    if until is not None and (not math.isfinite(until) or until < 0):
+        raise AutopilotError("until must be a finite Unix timestamp in seconds.")
+    db.set_external_wait(root_id, json.dumps({"pid": pid, "until": until,
+                                            "path": path or None, "note": note.strip()[:500]}))
+
+
+def wait_summary(ap: Autopilot) -> str | None:
+    if not ap.external_wait:
+        return None
+    wait = json.loads(ap.external_wait)
+    parts = []
+    if wait["pid"] is not None:
+        parts.append(f"pid {wait['pid']}")
+    if wait["until"] is not None:
+        parts.append(f"until {wait['until']:g}")
+    if wait["path"]:
+        parts.append(f"file {wait['path']}")
+    return f"waiting on {wait['note'] or 'outside job'} ({', '.join(parts)})"
+
+
+def wait_ended(db: DB, ap: Autopilot, now: float | None = None) -> str | None:
+    """Queue one durable completion notice from either a Stop hook or sweep."""
+    from brindle import agents, identity_lock, procs
+
+    if not ap.external_wait:
+        return None
+    now = time.time() if now is None else now
+    wait = json.loads(ap.external_wait)
+    ended = ((wait["until"] is not None and now >= wait["until"])
+             or (wait["path"] is not None and Path(wait["path"]).exists())
+             or (wait["pid"] is not None and not procs.alive(wait["pid"])))
+    if not ended:
+        return None
+    identity_lock.ensure(agents.get(db, ap.root_id))
+    note = f": {wait['note']}" if wait["note"] else ""
+    message = f"{WAIT_ENDED_HEAD}{note}. Continue with the next step."
+    return message if db.finish_external_wait(ap.root_id, ap.external_wait, now, message) else None
+
+
 def held(ap: Autopilot) -> bool:
     """Autopilot waits on the supervisor's open question, and nothing has
     blocked it since (that would have replaced the note)."""
@@ -1517,7 +1578,7 @@ def work_state(db: DB, root_id: str) -> str | None:
     ap = db.get_autopilot(root_id)
     if ap is not None and checking(ap):
         return "checking"
-    if (ap is not None and ap.state == "usage_paused") or login_pause.paused(db, root_id):
+    if (ap is not None and (ap.state == "usage_paused" or ap.external_wait)) or login_pause.paused(db, root_id):
         return "waiting"
     live = active_workers(db, root_id)
     if any(a.status != "waiting" for a in live):
@@ -1543,6 +1604,8 @@ def progress(db: DB, root_id: str, *, in_flight: bool = True) -> str:
                 "user's request (ask what we're building only if there is no request).")
     done, total = counts(db, root_id)
     lines = [f"{head}. Goal: {ap.goal}", f"{done} of {total} milestones verified."]
+    if waiting := wait_summary(ap):
+        lines.append(waiting)
     ms = db.milestones(root_id)
     w = work_state(db, root_id) if in_flight and any(m.status == "failed" for m in ms) else None
     for m in ms:
@@ -1787,7 +1850,10 @@ def usage_resume(db: DB, root_id: str, now: float | None = None) -> str | None:
 
 def usage_sweep(db: DB, now: float | None = None) -> list[str]:
     """One pass over every autopilot session: stop workers at the limit,
-    resume them after the reset. Called from the cull sweep."""
+    resume them after the reset, and wake completed outside waits.
+    Called from the cull sweep."""
+    from brindle import agents, identity_lock, login_pause, tmux
+
     done = []
     for root in db.list_agents():
         if root.mode != "interactive" or root.status in ("paused", "done"):
@@ -1800,6 +1866,20 @@ def usage_sweep(db: DB, now: float | None = None) -> list[str]:
             cfg = load_repo_config(ws.repo_root) if ws else RepoConfig()
             if over_limit(db, root.id, cfg):
                 done.append(f"usage limit reached: {root.id} is {db.get_autopilot(root.id).state}")
+            elif ((ap.external_wait or db.outstanding(root.id, WAIT_ENDED_HEAD))
+                  and not login_pause.paused(db, root.id) and not proposing(ap)):
+                try:
+                    message = wait_ended(db, ap, now)
+                    if db.outstanding(root.id, WAIT_ENDED_HEAD):
+                        identity_lock.ensure(root)
+                        if agents.is_alive(root):
+                            agents.flush(db, root.id)
+                    if message:
+                        done.append(message)
+                except (agents.AgentError, tmux.TmuxError):
+                    # Keep the wait, or its already queued notice, for retry.
+                    # Other sessions and the cull sweep's login recovery must run.
+                    log.debug("outside wait delivery deferred for %s", root.id, exc_info=True)
         elif ap.state == "usage_paused":
             line = usage_resume(db, root.id, now)
             if line:
@@ -1849,6 +1929,12 @@ def on_stop(db: DB, agent: Agent, payload: dict) -> dict | None:
 
     if over_limit(db, agent.id, cfg):
         return None  # workers included: they'd keep burning usage
+    if ap.external_wait:
+        try:
+            wait_ended(db, ap)
+        except agents.AgentError:
+            log.debug("outside wait completion deferred for %s", agent.id, exc_info=True)
+        return None  # the durable inbox notice wakes it, including after a failed delivery
     if checking(ap):
         return None  # the check's result arrives as a message and wakes it up
     working, stalled = split_workers(db, agent.id, screen=True)
@@ -1857,7 +1943,7 @@ def on_stop(db: DB, agent: Agent, payload: dict) -> dict | None:
     if any(agents.runs_process(a) for a in working
             if getattr(a, "plan_state", None) != "proposed"):
         return None  # their results arrive as messages and wake it up
-    if db.outstanding(agent.id, NUDGE_HEAD):
+    if db.outstanding(agent.id, NUDGE_HEAD) or db.outstanding(agent.id, WAIT_ENDED_HEAD):
         return None  # (#209) the last reminder is still queued or unread: never pile up another
     now = time.time()
     if (ap.nudged_at == ap.progress and ap.nudged_time is not None
@@ -1908,7 +1994,8 @@ def nudge(db: DB, ap: Autopilot, cfg: RepoConfig,
         f"unverified milestone and assign workers (at most {cfg.max_agents or 'any number'} "
         "at once), get finished branches reviewed and merged, and call check_milestone. "
         "If you need a decision only the user can make, call need_user with the question, "
-        "then ask it."
+        "then ask it. If the next step waits on an outside job, call wait_on with its pid, "
+        "an until Unix timestamp, or a completion file path, and a note."
     )
 
 

brindle-0.4.4/src/brindle/builtin_agents/developer-sonnet.md

@@ -0,0 +1,7 @@
+---
+name: developer-sonnet
+description: Implements a light or medium task on its own branch, on Sonnet with high effort (the baseline of the light and medium tiers of weight routing)
+extends: developer
+model: sonnet
+effort: high
+---

{brindle-0.4.2 → brindle-0.4.4}/src/brindle/builtin_agents/reviewer-codex.md

@@ -3,7 +3,7 @@ name: reviewer-codex
 description: Reviews a branch's changes for bugs and risks without editing code, using Codex for a second model's view
 provider: codex
 permission_mode: dontAsk  # nobody watches a reviewer: refuse what allowed_tools doesn't cover, never prompt
-allowed_tools: Bash(git status:*), Bash(git ls-files:*), Bash(git stash list), Bash(git diff:*), Bash(git log:*), Bash(git show:*), Bash(git merge-base:*), Bash(pytest:*), Bash(python -m pytest:*), Bash(python3 -m pytest:*), Bash(python -m unittest:*), Bash(python3 -m unittest:*), Bash(uv run:*), Bash(npm test:*), Bash(npm run:*), Bash(pnpm test:*), Bash(pnpm run:*), Bash(yarn test:*), Bash(yarn run:*), Bash(cargo test:*), Bash(cargo check:*), Bash(cargo clippy:*), Bash(go test:*), Bash(go vet:*), Bash(make:*), Bash(swift test:*), Bash(ls:*), Bash(pwd), Bash(cat:*), Bash(tail:*), Bash(head:*), Bash(grep:*), Bash(wc:*)
+allowed_tools: Bash(git status:*), Bash(git ls-files:*), Bash(git stash list), Bash(git diff:*), Bash(git log:*), Bash(git show:*), Bash(git merge-base:*), Bash(gh issue view:*), Bash(gh pr view:*), Bash(gh pr diff:*), Bash(pytest:*), Bash(python -m pytest:*), Bash(python3 -m pytest:*), Bash(python -m unittest:*), Bash(python3 -m unittest:*), Bash(uv run:*), Bash(npm test:*), Bash(npm run:*), Bash(pnpm test:*), Bash(pnpm run:*), Bash(yarn test:*), Bash(yarn run:*), Bash(cargo test:*), Bash(cargo check:*), Bash(cargo clippy:*), Bash(go test:*), Bash(go vet:*), Bash(make:*), Bash(swift test:*), Bash(ls:*), Bash(pwd), Bash(cat:*), Bash(tail:*), Bash(head:*), Bash(grep:*), Bash(wc:*)
 ---
 You are a code reviewer running under brindle. Your prompt gives you the
 worker's original task and its finish line, and, if the repo has checks

{brindle-0.4.2 → brindle-0.4.4}/src/brindle/builtin_agents/reviewer-gemini.md

@@ -5,7 +5,7 @@ provider: antigravity
 model: gemini-4-argon
 effort: high
 permission_mode: dontAsk  # nobody watches a reviewer: refuse what allowed_tools doesn't cover, never prompt
-allowed_tools: Bash(git status:*), Bash(git ls-files:*), Bash(git stash list), Bash(git diff:*), Bash(git log:*), Bash(git show:*), Bash(git merge-base:*), Bash(git ls-tree:*), Bash(git rev-parse:*), Bash(git cat-file:*), Bash(git grep:*), Bash(git blame:*), Bash(pytest:*), Bash(python -m pytest:*), Bash(python3 -m pytest:*), Bash(python -m unittest:*), Bash(python3 -m unittest:*), Bash(uv run:*), Bash(npm test:*), Bash(npm run:*), Bash(pnpm test:*), Bash(pnpm run:*), Bash(yarn test:*), Bash(yarn run:*), Bash(cargo test:*), Bash(cargo check:*), Bash(cargo clippy:*), Bash(go test:*), Bash(go vet:*), Bash(make:*), Bash(swift test:*), Bash(ls:*), Bash(pwd), Bash(cat:*), Bash(tail:*), Bash(head:*), Bash(grep:*), Bash(rg:*), Bash(wc:*), Bash(bq show:*), Bash(bq ls:*), Bash(bq query --use_legacy_sql=false --dry_run:*), Bash(bq query --dry_run:*)
+allowed_tools: Bash(git status:*), Bash(git ls-files:*), Bash(git stash list), Bash(git diff:*), Bash(git log:*), Bash(git show:*), Bash(git merge-base:*), Bash(gh issue view:*), Bash(gh pr view:*), Bash(gh pr diff:*), Bash(git ls-tree:*), Bash(git rev-parse:*), Bash(git cat-file:*), Bash(git grep:*), Bash(git blame:*), Bash(pytest:*), Bash(python -m pytest:*), Bash(python3 -m pytest:*), Bash(python -m unittest:*), Bash(python3 -m unittest:*), Bash(uv run:*), Bash(npm test:*), Bash(npm run:*), Bash(pnpm test:*), Bash(pnpm run:*), Bash(yarn test:*), Bash(yarn run:*), Bash(cargo test:*), Bash(cargo check:*), Bash(cargo clippy:*), Bash(go test:*), Bash(go vet:*), Bash(make:*), Bash(swift test:*), Bash(ls:*), Bash(pwd), Bash(cat:*), Bash(tail:*), Bash(head:*), Bash(grep:*), Bash(rg:*), Bash(wc:*), Bash(bq show:*), Bash(bq ls:*), Bash(bq query --use_legacy_sql=false --dry_run:*), Bash(bq query --dry_run:*)
 ---
 You are a code reviewer running under brindle. Your prompt gives you the
 worker's original task and its finish line, and, if the repo has checks

{brindle-0.4.2 → brindle-0.4.4}/src/brindle/builtin_agents/reviewer-local.md

@@ -8,7 +8,7 @@ model: qwen3-coder:30b
 context_tokens: 32k
 fallback: reviewer                 # hosted, when Ollama isn't running or the model isn't pulled
 permission_mode: dontAsk           # nobody watches a reviewer: refuse what allowed_tools doesn't cover
-allowed_tools: Bash(git status:*), Bash(git ls-files:*), Bash(git stash list), Bash(git diff:*), Bash(git log:*), Bash(git show:*), Bash(git merge-base:*), Bash(pytest:*), Bash(python -m pytest:*), Bash(python3 -m pytest:*), Bash(python -m unittest:*), Bash(python3 -m unittest:*), Bash(uv run:*), Bash(npm test:*), Bash(npm run:*), Bash(pnpm test:*), Bash(pnpm run:*), Bash(yarn test:*), Bash(yarn run:*), Bash(cargo test:*), Bash(cargo check:*), Bash(cargo clippy:*), Bash(go test:*), Bash(go vet:*), Bash(make:*), Bash(swift test:*), Bash(ls:*), Bash(pwd), Bash(cat:*), Bash(tail:*), Bash(head:*), Bash(grep:*), Bash(wc:*)
+allowed_tools: Bash(git status:*), Bash(git ls-files:*), Bash(git stash list), Bash(git diff:*), Bash(git log:*), Bash(git show:*), Bash(git merge-base:*), Bash(gh issue view:*), Bash(gh pr view:*), Bash(gh pr diff:*), Bash(pytest:*), Bash(python -m pytest:*), Bash(python3 -m pytest:*), Bash(python -m unittest:*), Bash(python3 -m unittest:*), Bash(uv run:*), Bash(npm test:*), Bash(npm run:*), Bash(pnpm test:*), Bash(pnpm run:*), Bash(yarn test:*), Bash(yarn run:*), Bash(cargo test:*), Bash(cargo check:*), Bash(cargo clippy:*), Bash(go test:*), Bash(go vet:*), Bash(make:*), Bash(swift test:*), Bash(ls:*), Bash(pwd), Bash(cat:*), Bash(tail:*), Bash(head:*), Bash(grep:*), Bash(wc:*)
 ---
 You are a code reviewer running under brindle. Your prompt gives you the
 worker's original task and its finish line, and, if the repo has checks

{brindle-0.4.2 → brindle-0.4.4}/src/brindle/builtin_agents/reviewer-opencode.md

@@ -3,7 +3,7 @@ name: reviewer-opencode
 description: Reviews a branch's changes for bugs and risks without editing code, using OpenCode for another model's view
 provider: opencode
 permission_mode: dontAsk  # nobody watches a reviewer: refuse what allowed_tools doesn't cover, never prompt
-allowed_tools: Bash(git status:*), Bash(git ls-files:*), Bash(git stash list), Bash(git diff:*), Bash(git log:*), Bash(git show:*), Bash(git merge-base:*), Bash(pytest:*), Bash(python -m pytest:*), Bash(python3 -m pytest:*), Bash(python -m unittest:*), Bash(python3 -m unittest:*), Bash(uv run:*), Bash(npm test:*), Bash(npm run:*), Bash(pnpm test:*), Bash(pnpm run:*), Bash(yarn test:*), Bash(yarn run:*), Bash(cargo test:*), Bash(cargo check:*), Bash(cargo clippy:*), Bash(go test:*), Bash(go vet:*), Bash(make:*), Bash(swift test:*), Bash(ls:*), Bash(pwd), Bash(cat:*), Bash(tail:*), Bash(head:*), Bash(grep:*), Bash(wc:*)
+allowed_tools: Bash(git status:*), Bash(git ls-files:*), Bash(git stash list), Bash(git diff:*), Bash(git log:*), Bash(git show:*), Bash(git merge-base:*), Bash(gh issue view:*), Bash(gh pr view:*), Bash(gh pr diff:*), Bash(pytest:*), Bash(python -m pytest:*), Bash(python3 -m pytest:*), Bash(python -m unittest:*), Bash(python3 -m unittest:*), Bash(uv run:*), Bash(npm test:*), Bash(npm run:*), Bash(pnpm test:*), Bash(pnpm run:*), Bash(yarn test:*), Bash(yarn run:*), Bash(cargo test:*), Bash(cargo check:*), Bash(cargo clippy:*), Bash(go test:*), Bash(go vet:*), Bash(make:*), Bash(swift test:*), Bash(ls:*), Bash(pwd), Bash(cat:*), Bash(tail:*), Bash(head:*), Bash(grep:*), Bash(wc:*)
 ---
 You are a code reviewer running under brindle. Your prompt gives you the
 worker's original task and its finish line, and, if the repo has checks

{brindle-0.4.2 → brindle-0.4.4}/src/brindle/builtin_agents/reviewer.md

@@ -7,7 +7,7 @@ effort: medium
 strict_mcp: true
 setting_sources: project,local
 permission_mode: dontAsk  # nobody watches a reviewer: refuse what allowed_tools doesn't cover, never prompt
-allowed_tools: Bash(git status:*), Bash(git ls-files:*), Bash(git stash list), Bash(git diff:*), Bash(git log:*), Bash(git show:*), Bash(git merge-base:*), Bash(git ls-tree:*), Bash(git rev-parse:*), Bash(git cat-file:*), Bash(git grep:*), Bash(git blame:*), Bash(pytest:*), Bash(python -m pytest:*), Bash(python3 -m pytest:*), Bash(python -m unittest:*), Bash(python3 -m unittest:*), Bash(uv run:*), Bash(npm test:*), Bash(npm run:*), Bash(pnpm test:*), Bash(pnpm run:*), Bash(yarn test:*), Bash(yarn run:*), Bash(cargo test:*), Bash(cargo check:*), Bash(cargo clippy:*), Bash(go test:*), Bash(go vet:*), Bash(make:*), Bash(swift test:*), Bash(ls:*), Bash(pwd), Bash(cat:*), Bash(tail:*), Bash(head:*), Bash(grep:*), Bash(rg:*), Bash(wc:*), Bash(bq show:*), Bash(bq ls:*), Bash(bq query --use_legacy_sql=false --dry_run:*), Bash(bq query --dry_run:*)
+allowed_tools: Bash(git status:*), Bash(git ls-files:*), Bash(git stash list), Bash(git diff:*), Bash(git log:*), Bash(git show:*), Bash(git merge-base:*), Bash(gh issue view:*), Bash(gh pr view:*), Bash(gh pr diff:*), Bash(git ls-tree:*), Bash(git rev-parse:*), Bash(git cat-file:*), Bash(git grep:*), Bash(git blame:*), Bash(pytest:*), Bash(python -m pytest:*), Bash(python3 -m pytest:*), Bash(python -m unittest:*), Bash(python3 -m unittest:*), Bash(uv run:*), Bash(npm test:*), Bash(npm run:*), Bash(pnpm test:*), Bash(pnpm run:*), Bash(yarn test:*), Bash(yarn run:*), Bash(cargo test:*), Bash(cargo check:*), Bash(cargo clippy:*), Bash(go test:*), Bash(go vet:*), Bash(make:*), Bash(swift test:*), Bash(ls:*), Bash(pwd), Bash(cat:*), Bash(tail:*), Bash(head:*), Bash(grep:*), Bash(rg:*), Bash(wc:*), Bash(bq show:*), Bash(bq ls:*), Bash(bq query --use_legacy_sql=false --dry_run:*), Bash(bq query --dry_run:*)
 ---
 You are a code reviewer running under brindle. Your prompt gives you the
 worker's original task and its finish line, and, if the repo has checks

{brindle-0.4.2 → brindle-0.4.4}/src/brindle/cli.py

@@ -3080,10 +3080,7 @@ def quit_cmd(root_id: str) -> None:
 @app.command("_close", hidden=True)
 def close_cmd(agent_id: str, delay: float = typer.Option(0.0)) -> None:
     time.sleep(delay)
-    try:
-        agents.kill(_helper_db(), agent_id)
-    except agents.AgentError:
-        pass
+    agents.close_removed(_helper_db(), agent_id)
 
 
 @app.command("_finish-review", hidden=True)

{brindle-0.4.2 → brindle-0.4.4}/src/brindle/codex_hook.py

@@ -15,7 +15,8 @@ and only brindle's own Codex agents get it. The key is then always
 same for every agent (the hook finds its agent from ``BRINDLE_AGENT_ID``, which
 Codex passes through), so one trust covers every worktree brindle ever creates.
 A changed command (brindle installed somewhere else, a different BRINDLE_HOME)
-is a new hook to Codex.
+or timeout (another build of brindle) is a new hook to Codex, so brindle
+records the whole definition it trusted, not just the command.
 
 brindle trusts its own hook the first time a Codex agent needs it (``ensure``),
 and again after it moves, so there's no setup step; it says so once at
@@ -35,6 +36,7 @@ import json
 import os
 import queue
 import shlex
+import signal
 import subprocess
 import threading
 import time
@@ -88,10 +90,11 @@ TRUSTED, MOVED, NEW, REMOVED = "trusted", "moved", "new", "removed"
 
 
 def status(command: str | None = None) -> str:
-    """Where brindle's hook stands with Codex: TRUSTED (this exact command, and
-    Codex's config still says so), MOVED (trusted, but brindle's command has
-    changed since: a reinstall, another BRINDLE_HOME), NEW (never trusted) or
-    REMOVED (trusted once, then the trust was taken out of Codex's config)."""
+    """Where brindle's hook stands with Codex: TRUSTED (this exact hook, and
+    Codex's config still says so), MOVED (trusted, but brindle's hook has
+    changed since: a reinstall, another BRINDLE_HOME, another timeout), NEW
+    (never trusted) or REMOVED (trusted once, then the trust was taken out of
+    Codex's config)."""
     import tomllib
 
     from brindle import permissions
@@ -111,7 +114,11 @@ def status(command: str | None = None) -> str:
     entry = state.get(rec["key"]) if isinstance(state, dict) else None
     if not (isinstance(entry, dict) and entry.get("trusted_hash") == rec["hash"]):
         return REMOVED
-    return TRUSTED if rec["command"] == command else MOVED
+    # Codex's hash covers the whole definition, not just the command: a trust
+    # recorded for another timeout (another build of brindle) is for another
+    # hook, and so is one recorded before brindle kept the definition (it can't
+    # tell what that was for), so ensure() trusts it again once.
+    return TRUSTED if rec.get("definition") == config_flags(command)[1] else MOVED
 
 
 def trusted(command: str | None = None) -> bool:
@@ -148,13 +155,22 @@ def policy_on(cwd: str | None) -> bool:
         return False
 
 
-def launch_flags(cwd: str | None) -> list[str]:
+def launch_flags(cwd: str | None, review: bool = False) -> list[str]:
     """The flags a Codex agent in ``cwd`` launches with: brindle's hook when the
-    repo's policy is on and the person trusted the hook; else none."""
+    repo's policy is on and the person trusted the hook; else none. A reviewer
+    gets it with the policy off too (nobody watches its prompts; the hook only
+    allows what its allowed_tools cover, #241), but only a hook trusted
+    already: with the policy off brindle never trusts a NEW one itself, and a
+    REMOVED trust stays removed."""
     try:
         if not policy_on(cwd):
-            return []
-        command = hook_command()
+            if not review:
+                return []
+            command = hook_command()
+            if status(command) not in (TRUSTED, MOVED):
+                return []
+        else:
+            command = hook_command()
         return config_flags(command) if ensure(command=command) == TRUSTED else []
     except Exception:  # noqa: BLE001 - never stop a launch over this
         return []
@@ -178,6 +194,31 @@ def launch_warning(provider: str, cwd: str | None) -> str | None:
             f"({why}), so Codex asks for approvals itself. Ask the user to run `{INSTALL}`")
 
 
+UNTRUSTED = ("brindle couldn't trust its own Codex permission hook (new, or changed by an upgrade), "
+             "so Codex agents start without it and Codex asks for approvals itself. "
+             f"Ask the user to run `{INSTALL}`.")
+
+
+def tell_untrusted(db, agent, cwd: str | None) -> bool:
+    """Tell ``agent``'s supervisor, once, that brindle couldn't trust its hook,
+    so this Codex agent started without it: nobody may watch a reviewer's pane
+    to find out otherwise. A trust the person removed stays theirs to give
+    back (launch_warning, doctor), not news."""
+    if agent.provider != "codex" or not agent.parent_id or not policy_on(cwd) \
+            or status() not in (NEW, MOVED):
+        return False
+    if db.conn.execute("SELECT 1 FROM inbox WHERE agent_id=? AND instr(body, ?) > 0",
+                       (agent.parent_id, UNTRUSTED)).fetchone():
+        return False
+    from brindle import agents
+
+    try:
+        agents.send_message(db, agent.parent_id, UNTRUSTED)
+    except agents.AgentError:
+        db.enqueue(agent.parent_id, UNTRUSTED, None)
+    return True
+
+
 # -- asking Codex itself ---------------------------------------------------------------
 
 
@@ -188,7 +229,8 @@ class _AppServer:
         self.timeout = timeout
         try:
             self.proc = subprocess.Popen([binary, "app-server", *flags], stdin=subprocess.PIPE,
-                                         stdout=subprocess.PIPE, stderr=subprocess.DEVNULL, text=True)
+                                         stdout=subprocess.PIPE, stderr=subprocess.DEVNULL, text=True,
+                                         start_new_session=True)
         except OSError as e:
             raise CodexHookError(f"couldn't run {binary}: {e}") from e
         self.lines: queue.Queue = queue.Queue()
@@ -239,6 +281,14 @@ class _AppServer:
                 return result
 
     def close(self) -> None:
+        # The app-server leads its own process group (see __init__): kill the
+        # group so nothing it spawned outlives it.
+        pid = getattr(self.proc, "pid", None)
+        if pid:
+            try:
+                os.killpg(pid, signal.SIGKILL)
+            except OSError:
+                pass
         try:
             self.proc.kill()
         except OSError:
@@ -290,5 +340,6 @@ def trust(binary: str, state: HookState) -> HookState:
     if after.status != "trusted":
         raise CodexHookError(f"Codex still reports the hook as {after.status}")
     with permissions.editing() as store:
-        store.codex_hook = {"command": after.command, "key": after.key, "hash": after.hash}
+        store.codex_hook = {"command": after.command, "key": after.key, "hash": after.hash,
+                            "definition": config_flags(after.command)[1]}
     return after

{brindle-0.4.2 → brindle-0.4.4}/src/brindle/config.py

@@ -80,8 +80,8 @@ def normalize_weight(weight: str | None) -> str | None:
 # Nothing here prefers another provider for its own sake: all-Claude, all-Codex
 # or all-Gemini may well be best, and that's the learner's call.
 DEFAULT_ROUTING = {
-    "light": ["developer-light", "developer", "developer-codex", "developer-local"],
-    "medium": ["developer", "developer-codex", "developer-heavy"],
+    "light": ["developer-sonnet", "developer-light", "developer", "developer-codex", "developer-local"],
+    "medium": ["developer-sonnet", "developer", "developer-codex", "developer-heavy"],
     "heavy": ["developer-heavy", "developer-gemini", "developer", "developer-codex"],
     "advanced": ["developer-fable", "developer-heavy", "developer-gemini"],
 }