gemcode 0.3.31__tar.gz → 0.3.33__tar.gz

{gemcode-0.3.31/src/gemcode.egg-info → gemcode-0.3.33}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gemcode
-Version: 0.3.31
+Version: 0.3.33
 Summary: Local-first coding agent on Google Gemini + ADK
 Author: GemCode Contributors
 License:                                  Apache License

{gemcode-0.3.31 → gemcode-0.3.33}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "gemcode"
-version = "0.3.31"
+version = "0.3.33"
 description = "Local-first coding agent on Google Gemini + ADK"
 readme = "README.md"
 requires-python = ">=3.11"

{gemcode-0.3.31 → gemcode-0.3.33}/src/gemcode/agent.py

@@ -414,7 +414,7 @@ Never stop mid-task just because the first tool call succeeded. Keep going until
 | `bash("find . -name '*.py'")` | `glob_files("**/*.py")` |
 | `bash("cat file.py")` | `read_file("file.py")` |
 | `bash("grep -r pattern .")` | `grep_content("pattern", "**/*")` |
-| `bash("find . -type f \| head -50")` | `list_directory(".")` + `glob_files("**/*")` |
+| `bash("find . -type f | head -50")` | `list_directory(".")` + `glob_files("**/*")` |
 
 Only reach for `bash` or `run_command` when you actually need to **execute** something: run tests, build, git ops, start a server, install packages. **NEVER** use bash to list or read files.
 
@@ -449,6 +449,13 @@ You have native deep thinking capability — use it actively:
   - For **dev servers**: `bash("npm run dev", background=True, cwd_subdir="frontend")`
   - For **subfolders**: `bash("cargo build --release", cwd_subdir="backend")`
 
+- **`bash_stream`** — streaming version of bash: yields stdout line-by-line in real-time. Use for long-running commands where the user wants to see live progress:
+  - `bash_stream("pytest -v tests/")` — see each test result as it runs
+  - `bash_stream("npm run build")` — watch build progress in real-time
+  - `bash_stream("pip install -r requirements.txt")` — see install progress
+  - `bash_stream("tail -f logs/app.log", timeout_seconds=60)` — live log watching
+  - Prefer `bash_stream` over `bash` whenever the command takes > 5 seconds and progress visibility matters
+
 - **`run_command`** — simple single-executable calls without shell features:
   - `run_command("npm", args=["install", "--legacy-peer-deps"])` — clean npm install
   - `run_command("python3", args=["-m", "pytest", "--version"])` — version check
@@ -556,7 +563,7 @@ When `artifacts ON` (see Runtime facts above):
   - Screenshots from computer_use: save as "screenshot.png" artifact
   - Generated reports/PDFs: save as "report.pdf" artifact
   - Large JSON data: save as "data.json" artifact
-- **Reference** artifacts in instructions via `{artifact.filename?}` template syntax
+- **Reference** artifacts in instructions via artifact.filename template syntax
 - Artifacts are keyed by filename; `user:` prefix = cross-session persistence
 
 ## Code Executor (sandboxed Python)

{gemcode-0.3.31 → gemcode-0.3.33}/src/gemcode/callbacks.py

@@ -157,6 +157,24 @@ def make_before_tool_callback(cfg: GemCodeConfig):
     except Exception:
       pass
 
+    # ── Permission rules (.gemcode/settings.json allow/deny) ──────────────
+    # Evaluated before the normal permission flow so explicit allow/deny rules
+    # override cfg.permission_mode and interactive prompts.
+    try:
+      from gemcode.permissions import check_rules
+      rule_result = check_rules(name, args or {}, cfg.project_root)
+      if rule_result == "deny":
+        return {
+          "error": f"Tool call blocked by .gemcode/settings.json deny rule for '{name}'.",
+          "error_kind": _ERROR_KIND_PERMISSION_DENIED,
+        }
+      if rule_result == "allow":
+        # Explicit allow — skip the normal permission prompt entirely
+        # but still run post-tool hook (logging/audit).
+        pass  # fall through to tool execution
+    except Exception:
+      rule_result = None
+
     streak = 0
     if tool_context is not None:
       try:
@@ -181,6 +199,10 @@ def make_before_tool_callback(cfg: GemCodeConfig):
         "error_kind": _ERROR_KIND_CIRCUIT_BREAKER,
       }
 
+    # If permission rules explicitly allowed this tool call, skip the gate entirely.
+    if rule_result == "allow" and (name in MUTATING_TOOLS or is_computer_tool):
+      return None  # allow without prompting
+
     if name in MUTATING_TOOLS or is_computer_tool:
       if cfg.permission_mode == "strict":
         if is_computer_tool:

gemcode-0.3.33/src/gemcode/permissions.py

@@ -0,0 +1,206 @@
+"""
+Permission rules engine — inspired by Claude Code's allow/deny pattern system.
+
+Users define rules in `.gemcode/settings.json` (project) or `~/.gemcode/settings.json` (global).
+Rules are evaluated for every tool call: deny first, then allow, then default.
+
+Schema:
+{
+  "permissions": {
+    "allow": [
+      "bash(git *)",
+      "bash(npm run *)",
+      "bash(pytest *)",
+      "read_file(*)",
+      "write_file(src/**)"
+    ],
+    "deny": [
+      "bash(rm -rf *)",
+      "bash(curl *)",
+      "bash(wget *)",
+      "read_file(.env)",
+      "read_file(.env.*)",
+      "write_file(secrets/**)"
+    ]
+  }
+}
+
+Pattern syntax (same as Claude Code's permission rules):
+  - "bash"                   — matches ALL bash calls
+  - "bash(*)"                — same as above
+  - "bash(git *)"            — bash calls whose command starts with "git "
+  - "write_file(src/**)"     — write_file calls where path matches src/**
+  - "read_file(.env)"        — exact path match for .env
+  - "*"                      — matches all tool calls
+
+Evaluation order: deny → allow → default (ask/yes_to_all/strict from cfg)
+First matching rule wins.
+
+Files (merged in order — later rules take precedence):
+  1. ~/.gemcode/settings.json     (user-global)
+  2. .gemcode/settings.json       (project-specific, can override global)
+
+Reloaded on every tool call (file is stat-cached to avoid repeated disk reads).
+"""
+
+from __future__ import annotations
+
+import fnmatch
+import json
+import os
+import time
+from pathlib import Path
+from typing import Any
+
+# ── Cache so we don't re-read files every millisecond ────────────────────────
+_file_cache: dict[str, tuple[float, float, list]] = {}  # path → (mtime, stat_time, rules)
+_CACHE_TTL = 2.0  # seconds
+
+
+def _read_settings_rules(path: Path) -> list[dict]:
+  """Read and cache permission rules from a settings file."""
+  path_str = str(path)
+  now = time.monotonic()
+  if path_str in _file_cache:
+    cached_mtime, cached_time, cached_rules = _file_cache[path_str]
+    if now - cached_time < _CACHE_TTL:
+      return cached_rules
+
+  if not path.is_file():
+    _file_cache[path_str] = (0.0, now, [])
+    return []
+
+  try:
+    mtime = path.stat().st_mtime
+    if path_str in _file_cache and _file_cache[path_str][0] == mtime:
+      # File hasn't changed — just refresh the TTL
+      old = _file_cache[path_str]
+      _file_cache[path_str] = (old[0], now, old[2])
+      return old[2]
+
+    data = json.loads(path.read_text(encoding="utf-8", errors="replace"))
+    perms = data.get("permissions") or {}
+    rules: list[dict] = []
+    for pattern in perms.get("deny") or []:
+      rules.append({"action": "deny", "pattern": str(pattern)})
+    for pattern in perms.get("allow") or []:
+      rules.append({"action": "allow", "pattern": str(pattern)})
+    _file_cache[path_str] = (mtime, now, rules)
+    return rules
+  except Exception:
+    _file_cache[path_str] = (0.0, now, [])
+    return []
+
+
+def load_rules(project_root: Path) -> list[dict]:
+  """
+  Load merged rules from user-global and project settings.
+  Order: global first (lower priority), project second (higher priority / overrides).
+  """
+  global_rules = _read_settings_rules(Path.home() / ".gemcode" / "settings.json")
+  project_rules = _read_settings_rules(project_root / ".gemcode" / "settings.json")
+  # Deny rules always evaluated first regardless of file order, so combine and re-sort
+  all_rules = global_rules + project_rules
+  # Stable sort: deny rules before allow rules (deny has priority)
+  deny_rules = [r for r in all_rules if r["action"] == "deny"]
+  allow_rules = [r for r in all_rules if r["action"] == "allow"]
+  return deny_rules + allow_rules
+
+
+def _parse_pattern(pattern: str) -> tuple[str, str | None]:
+  """
+  Parse a rule pattern into (tool_glob, arg_glob | None).
+
+  Examples:
+    "bash"            → ("bash", None)
+    "bash(*)"         → ("bash", "*")
+    "bash(git *)"     → ("bash", "git *")
+    "write_file(src/*)→ ("write_file", "src/*")
+    "*"               → ("*", None)
+  """
+  pattern = pattern.strip()
+  paren_open = pattern.find("(")
+  if paren_open == -1:
+    return (pattern, None)
+  tool_glob = pattern[:paren_open].strip()
+  arg_part = pattern[paren_open + 1:]
+  if arg_part.endswith(")"):
+    arg_part = arg_part[:-1]
+  return (tool_glob, arg_part.strip() or None)
+
+
+def _get_primary_arg(tool_name: str, args: dict[str, Any]) -> str:
+  """
+  Extract the primary argument to match against the pattern's arg_glob.
+  For bash: the command string.
+  For file tools: the path argument.
+  For everything else: concatenate all string args.
+  """
+  if tool_name in ("bash", "run_command"):
+    return (
+        args.get("command") or
+        args.get("cmd") or
+        args.get("args", [""])[0] if isinstance(args.get("args"), list) else args.get("args", "")
+    ) or ""
+  # File tools — use first path-like arg
+  for key in ("path", "file_path", "file", "filename", "dest", "src"):
+    val = args.get(key)
+    if val and isinstance(val, str):
+      return val
+  # Fallback: join all string values
+  return " ".join(str(v) for v in args.values() if isinstance(v, str))
+
+
+def check_rules(
+    tool_name: str,
+    args: dict[str, Any],
+    project_root: Path,
+) -> str | None:
+  """
+  Evaluate permission rules for a tool call.
+
+  Returns:
+    "allow"  — explicit allow rule matched → skip normal permission prompts
+    "deny"   — explicit deny rule matched  → block the tool call
+    None     — no rule matched             → use default behavior (cfg.permission_mode)
+  """
+  rules = load_rules(project_root)
+  if not rules:
+    return None
+
+  primary_arg = _get_primary_arg(tool_name, args)
+
+  for rule in rules:
+    tool_glob, arg_glob = _parse_pattern(rule["pattern"])
+
+    # Match tool name
+    if tool_glob != "*" and not fnmatch.fnmatch(tool_name, tool_glob):
+      continue
+
+    # Match argument (if pattern specifies one)
+    if arg_glob is not None and arg_glob != "*":
+      if not fnmatch.fnmatch(primary_arg, arg_glob):
+        continue
+
+    return rule["action"]  # "allow" or "deny"
+
+  return None  # no rule matched
+
+
+def describe_rules(project_root: Path) -> list[str]:
+  """Human-readable rule listing for /permissions output."""
+  rules = load_rules(project_root)
+  if not rules:
+    return ["  (no rules — using default permission_mode)"]
+  lines: list[str] = []
+  deny_rules = [r for r in rules if r["action"] == "deny"]
+  allow_rules = [r for r in rules if r["action"] == "allow"]
+  if deny_rules:
+    lines.append("  deny:")
+    for r in deny_rules:
+      lines.append(f"    ✗  {r['pattern']}")
+  if allow_rules:
+    lines.append("  allow:")
+    for r in allow_rules:
+      lines.append(f"    ✓  {r['pattern']}")
+  return lines

{gemcode-0.3.31 → gemcode-0.3.33}/src/gemcode/repl_commands.py

@@ -70,6 +70,10 @@ def format_model_lines(cfg: GemCodeConfig) -> list[str]:
 
 
 def format_permissions_lines(cfg: GemCodeConfig) -> list[str]:
+  from gemcode.permissions import describe_rules
+  rules_lines = describe_rules(cfg.project_root)
+  settings_file = cfg.project_root / ".gemcode" / "settings.json"
+  global_settings = os.path.expanduser("~/.gemcode/settings.json")
   ac = cfg.allow_commands
   if ac is None:
     preview = "(default allowlist)"
@@ -78,14 +82,23 @@ def format_permissions_lines(cfg: GemCodeConfig) -> list[str]:
     preview = ", ".join(names[:16])
     if len(names) > 16:
       preview += f", … (+{len(names) - 16} more)"
-  return [
+  lines = [
       "Permissions:",
-      f"  permission_mode: {cfg.permission_mode}",
-      f"  yes_to_all: {cfg.yes_to_all}",
-      f"  interactive_permission_ask: {getattr(cfg, 'interactive_permission_ask', False)}",
-      f"  interactive_hitl_sticky_session: {getattr(cfg, 'interactive_hitl_sticky_session', True)}",
-      f"  allow_commands: {preview}",
+      f"  permission_mode       : {cfg.permission_mode}",
+      f"  yes_to_all            : {cfg.yes_to_all}",
+      f"  interactive_permission: {getattr(cfg, 'interactive_permission_ask', False)}",
+      f"  hitl_sticky_session   : {getattr(cfg, 'interactive_hitl_sticky_session', True)}",
+      f"  allow_commands        : {preview}",
+      "",
+      "  Settings-based rules (deny first, then allow):",
+      f"  Project: {settings_file} ({'exists' if settings_file.exists() else 'not found'})",
+      f"  Global : {global_settings} ({'exists' if os.path.exists(global_settings) else 'not found'})",
   ]
+  lines.extend(rules_lines)
+  lines.append("")
+  lines.append("  To add rules, create .gemcode/settings.json:")
+  lines.append('  { "permissions": { "allow": ["bash(git *)"], "deny": ["bash(rm -rf *)"] } }')
+  return lines
 
 
 def format_memory_lines(cfg: GemCodeConfig) -> list[str]:
@@ -201,10 +214,16 @@ def slash_help_lines() -> list[str]:
       "  /help                 Show this help",
       "  /status               Full status: model, capabilities, thinking, limits",
       "  /config               All active config fields (model, caps, context, thinking)",
-      "  /session              Print current session id",
-      "  /session new          Start a new session id (history reset)",
+      "  /session              Print current session id and name",
+      "  /session list         List all sessions (most recent first)",
+      "  /session name <n>     Name the current session",
+      "  /session resume <n>   Resume session by name, ID prefix, or full UUID",
+      "  /session new          Start a fresh session (history reset)",
       "  /clear                Alias for /session new",
-      "  /compact              Force autocompact now (summarize history)",
+      "  /compact              Force context compaction now (summarize history)",
+      "  /compact <focus>      Compact with custom focus, e.g. /compact test output",
+      "  /review               Parallel code review: security + style + correctness",
+      "  /review <path>        Review a specific file or directory",
       "  /context              Show context pressure + last prompt tokens",
       "  /audit [N]            Tail of .gemcode/audit.log (default 40 lines)",
       "  /tools                List tool inventory for this config",

{gemcode-0.3.31 → gemcode-0.3.33}/src/gemcode/repl_slash.py

@@ -155,6 +155,39 @@ async def process_repl_slash(
     return ReplSlashResult(skip_model_turn=True)
 
   # ── /init ─────────────────────────────────────────────────────────────────
+  # ── /review ───────────────────────────────────────────────────────────────
+  if name == "review":
+    scope = (sc.args or "").strip()
+    # Build a prompt that includes the diff/files as context for the pipeline.
+    # We dispatch this as a model_prompt so the main agent runs the review pipeline.
+    if scope:
+      review_prompt = (
+        f"Run a parallel code review on: {scope}\n\n"
+        "Use the review_code tool if available, or:\n"
+        "1. If it's a file/directory, read the relevant files with read_file/list_directory\n"
+        "2. Run `bash('git diff HEAD -- " + scope + "')` to see recent changes\n"
+        "3. Produce a parallel code review using your SecurityReviewer, StyleReviewer, "
+        "and CorrectnessReviewer sub-agents (via run_subtask with focus='security'/'style'/'correctness'), "
+        "then synthesize the findings into a structured report with: Critical Issues, Suggestions, Verdict."
+      )
+    else:
+      review_prompt = (
+        "Run a parallel code review on the current changes.\n\n"
+        "Steps:\n"
+        "1. Run `bash('git diff HEAD')` to see unstaged changes, and "
+        "`bash('git diff --cached')` for staged changes\n"
+        "2. If no git diff, run `bash('git diff HEAD~1')` for the last commit\n"
+        "3. Run THREE parallel sub-reviews using run_subtask:\n"
+        "   - Security review (auth, injections, secrets, validation)\n"
+        "   - Style review (readability, naming, DRY, docs)\n"
+        "   - Correctness review (logic, error handling, edge cases, tests)\n"
+        "4. Synthesize into a final report: Critical Issues / Suggestions / Verdict\n\n"
+        "Run all three sub-reviews simultaneously using run_subtask for maximum speed."
+      )
+    out("Running parallel code review (security + style + correctness)…")
+    out()
+    return ReplSlashResult(model_prompt=review_prompt)
+
   # ── /notes ────────────────────────────────────────────────────────────────
   if name == "notes":
     sub = (sc.args or "").strip().lower()
@@ -366,12 +399,76 @@ async def process_repl_slash(
     return ReplSlashResult(skip_model_turn=True)
 
   if name in ("session", "clear"):
-    if name == "clear" or sc.args.strip().lower() in ("new", "reset"):
+    args_lower = (sc.args or "").strip().lower()
+    args_raw = (sc.args or "").strip()
+
+    # /clear or /session new — start fresh session
+    if name == "clear" or args_lower in ("new", "reset"):
       new_id = str(uuid.uuid4())
       out(f"new session_id: {new_id}")
       out()
       return ReplSlashResult(skip_model_turn=True, new_session_id=new_id)
+
+    # /session list — show recent sessions
+    if args_lower in ("list", "ls", "history"):
+      from gemcode.session_store import list_sessions, format_session_list
+      sessions = list_sessions(cfg.project_root)
+      out("Recent sessions (most recent first):")
+      out("─" * 55)
+      for line in format_session_list(sessions):
+        out(line)
+      out()
+      out("  /session resume <id|name>  — resume a session")
+      out("  /session name <name>        — name current session")
+      out()
+      return ReplSlashResult(skip_model_turn=True)
+
+    # /session name <name> — give a name to the current session
+    if args_lower.startswith("name "):
+      new_name = args_raw[5:].strip()
+      if not new_name:
+        out("Usage: /session name <name>")
+        return ReplSlashResult(skip_model_turn=True)
+      from gemcode.session_store import name_session
+      name_session(cfg.project_root, session_id, new_name)
+      out(f"Session named: '{new_name}'")
+      out(f"Session id   : {session_id[:8]}…")
+      out()
+      return ReplSlashResult(skip_model_turn=True)
+
+    # /session resume <id|name> — switch to a different session
+    if args_lower.startswith("resume ") or args_lower.startswith("r "):
+      query = args_raw.split(None, 1)[1].strip() if " " in args_raw else ""
+      if not query:
+        out("Usage: /session resume <session-id|name|prefix>")
+        return ReplSlashResult(skip_model_turn=True)
+      from gemcode.session_store import find_session
+      found = find_session(cfg.project_root, query)
+      if found is None:
+        out(f"No session found matching '{query}'.")
+        out("Use /session list to see available sessions.")
+        out()
+        return ReplSlashResult(skip_model_turn=True)
+      if found == session_id:
+        out(f"Already in session {found[:8]}.")
+        out()
+        return ReplSlashResult(skip_model_turn=True)
+      out(f"Resuming session {found[:8]}…")
+      out()
+      return ReplSlashResult(skip_model_turn=True, new_session_id=found)
+
+    # Default: show current session info
+    from gemcode.session_store import get_session_name, touch_session
+    touch_session(cfg.project_root, session_id)
+    session_name = get_session_name(cfg.project_root, session_id)
     out(f"session_id: {session_id}")
+    if session_name:
+      out(f"name      : {session_name}")
+    out()
+    out("  /session list              — list all sessions")
+    out("  /session name <name>       — name this session")
+    out("  /session resume <id|name>  — resume another session")
+    out("  /session new               — start a fresh session")
     out()
     return ReplSlashResult(skip_model_turn=True)
 
@@ -418,12 +515,36 @@ async def process_repl_slash(
     return ReplSlashResult(skip_model_turn=True)
 
   if name == "compact":
+    focus = (sc.args or "").strip()
     os.environ["GEMCODE_AUTOCOMPACT_FORCE"] = "1"
+    if focus:
+      compact_prompt = (
+        f"Compact the conversation history now. Focus on preserving: {focus}\n\n"
+        "Create a concise summary that retains:\n"
+        "- All decisions, conclusions, and code changes made\n"
+        f"- Special attention to: {focus}\n"
+        "- Any open tasks or blockers\n"
+        "- Key file paths and architecture insights\n\n"
+        "After summarizing, reply with a brief confirmation of what was preserved."
+      )
+    else:
+      compact_prompt = (
+        "Compact the conversation history now.\n\n"
+        "Create a concise summary preserving:\n"
+        "- All decisions, conclusions, and code changes made\n"
+        "- Any open tasks or next steps\n"
+        "- Key file paths, commands, and architecture insights\n"
+        "- Error messages and their resolutions\n\n"
+        "After summarizing, reply with a brief confirmation. "
+        "Tip: use `/compact <focus>` to specify what to prioritize, e.g. `/compact test output and error messages`"
+      )
+    out("Compacting context history…")
+    if focus:
+      out(f"Focus: {focus}")
+    out()
     return ReplSlashResult(
         skip_model_turn=False,
-        model_prompt=(
-            "Compact the conversation history now. Reply with: Compacted."
-        ),
+        model_prompt=compact_prompt,
     )
 
   if name in ("exit", "quit"):

gemcode-0.3.33/src/gemcode/review_agent.py

@@ -0,0 +1,142 @@
+"""
+Parallel code-review pipeline using ADK SequentialAgent + ParallelAgent.
+
+Inspired by the ADK community financial-advisor pattern:
+  ParallelAgent (3 specialist reviewers run simultaneously)
+    → SecurityReviewer   (writes to state["security_findings"])
+    → StyleReviewer      (writes to state["style_findings"])
+    → CorrectnessReviewer(writes to state["correctness_findings"])
+  → SynthesisAgent (reads all three state keys and produces final report)
+
+The pipeline is wrapped in a SequentialAgent:
+  ParallelReviewers → Synthesizer
+
+Called from the /review slash command with an optional scope argument:
+  /review            — review recent git diff (staged + unstaged changes)
+  /review src/auth/  — review a specific directory
+  /review file.py    — review a specific file
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+_GEMINI_FLASH = "gemini-2.5-flash"
+_GEMINI_PRO = "gemini-2.5-pro"
+
+
+def build_review_pipeline(model: str | None = None) -> Any:
+  """
+  Build and return a SequentialAgent [ParallelReviewers → Synthesizer].
+
+  The pipeline is stateless — pass the diff/files as the initial prompt.
+  Uses flash for the three parallel reviewers (fast + cheap) and the
+  provided model (or flash) for the final synthesis.
+  """
+  try:
+    from google.adk.agents import LlmAgent, SequentialAgent, ParallelAgent
+  except ImportError as e:
+    raise ImportError("google-adk is required for /review") from e
+
+  synthesizer_model = model or _GEMINI_FLASH
+
+  security_reviewer = LlmAgent(
+      name="SecurityReviewer",
+      model=_GEMINI_FLASH,
+      include_contents="none",  # Stateless — only sees what's injected via state
+      instruction="""You are a security-focused code reviewer.
+Review the code changes provided in the message. Focus exclusively on:
+- Authentication/authorization bypasses
+- Injection vulnerabilities (SQL, command, path traversal)
+- Secrets or credentials in code
+- Insecure deserialization or parsing
+- Missing input validation or sanitization
+- Race conditions affecting security
+- Dangerous use of eval/exec/subprocess
+
+For each issue: SEVERITY (Critical/High/Medium/Low), FILE+LINE if visible, description, fix suggestion.
+If no security issues found, say "No security issues found."
+Be concise — max 300 words. Output ONLY your security findings.""",
+      output_key="security_findings",
+  )
+
+  style_reviewer = LlmAgent(
+      name="StyleReviewer",
+      model=_GEMINI_FLASH,
+      include_contents="none",
+      instruction="""You are a code style and readability reviewer.
+Review the code changes provided in the message. Focus exclusively on:
+- Code readability and clarity
+- Naming conventions (variables, functions, classes)
+- DRY violations and unnecessary duplication
+- Function/method length and complexity
+- Missing or poor documentation/comments
+- Inconsistent formatting or style
+- Dead code or unused imports
+
+For each issue: SEVERITY (High/Medium/Low), FILE+LINE if visible, description, suggestion.
+If no style issues found, say "No style issues found."
+Be concise — max 300 words. Output ONLY your style findings.""",
+      output_key="style_findings",
+  )
+
+  correctness_reviewer = LlmAgent(
+      name="CorrectnessReviewer",
+      model=_GEMINI_FLASH,
+      include_contents="none",
+      instruction="""You are a correctness-focused code reviewer.
+Review the code changes provided in the message. Focus exclusively on:
+- Logic errors and off-by-one bugs
+- Null/undefined pointer dereferences
+- Incorrect error handling or exception swallowing
+- Type mismatches or coercion issues
+- Missing edge case handling
+- Resource leaks (file handles, connections, memory)
+- Incorrect algorithm implementation
+- Broken tests or missing test coverage
+
+For each issue: SEVERITY (Critical/High/Medium/Low), FILE+LINE if visible, description, fix suggestion.
+If no correctness issues found, say "No correctness issues found."
+Be concise — max 300 words. Output ONLY your correctness findings.""",
+      output_key="correctness_findings",
+  )
+
+  synthesizer = LlmAgent(
+      name="ReviewSynthesizer",
+      model=synthesizer_model,
+      include_contents="none",
+      instruction="""You are a senior engineering lead synthesizing a code review.
+
+You have three specialist review reports in state:
+- Security findings: {security_findings}
+- Style findings:   {style_findings}
+- Correctness:      {correctness_findings}
+
+Produce a clear, actionable code review report:
+
+## Code Review Summary
+
+### Critical / Must Fix
+[List only Critical and High severity issues from all reviewers, grouped by file if possible]
+
+### Suggestions
+[List Medium/Low severity issues worth addressing, grouped by category]
+
+### Verdict
+[One of: APPROVE / APPROVE WITH MINOR CHANGES / REQUEST CHANGES — with 1-2 sentence justification]
+
+Keep the report under 500 words. Be direct and developer-friendly.""",
+  )
+
+  parallel_reviewers = ParallelAgent(
+      name="ParallelReviewers",
+      sub_agents=[security_reviewer, style_reviewer, correctness_reviewer],
+  )
+
+  pipeline = SequentialAgent(
+      name="CodeReviewPipeline",
+      description="Parallel code review: security + style + correctness, then synthesis.",
+      sub_agents=[parallel_reviewers, synthesizer],
+  )
+
+  return pipeline