Codex review: needs real behavior proof before merge. Reviewed June 29, 2026, 11:29 AM ET / 15:29 UTC.

Summary
The PR changes strict inline-eval interpreter matching and adds regression coverage for versioned Python/PyPy, PHP inline flags, Rscript eval, gateway denial, and strict allow-always persistence.

PR surface: Source +13, Tests +120. Total +133 across 4 files.

Reproducibility: yes. from source and related proof: the original gap was exact interpreter matching feeding strictInlineEval, and #96216 already demonstrates the fixed node-host denial and one-shot allow-always path. I did not run tests because this review is read-only.

Review metrics: 1 noteworthy metric.

• Approval detector surface: 1 runtime detector changed after current-main fix. The branch is not tests-only against current main, so maintainers need to review a security-sensitive detector shape change rather than only added coverage.

Stored data model
Persistent data-model change detected: serialized state: src/infra/exec-approvals-allow-always.test.ts. Confirm migration or upgrade compatibility proof before merge.

Root-cause cluster
Relationship: partial_overlap
Canonical: #96216
Summary: The merged PR owns the runtime detector hardening; this PR overlaps that work and adds additional test coverage on adjacent gateway and persistence paths.

Members:

• canonical: fix(exec): gate versioned inline interpreters #96216 - Merged on June 24, 2026 with the shared detector hardening and production-handler proof for the same strict inline-eval boundary.
• adjacent_distinct: Route allow-always through command authorization planner #80922 - Open broader command authorization planner work touches allow-always and strict inline-eval behavior but is not a canonical fix for this branch's duplicate detector change.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🧂 unranked krab
Proof: 🦪 silver shellfish
Patch quality: 🧂 unranked krab
Result: blocked until real behavior proof from a real setup is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• Refresh on current main and remove the duplicate production detector changes unless a maintainer chooses that contract.
• [P1] Add redacted terminal, log, or live-output proof from a real gateway or node-host denial path, with private endpoints, IPs, keys, and phone numbers redacted.

Proof guidance:

• [P1] Needs real behavior proof before merge: The latest evidence lists tests, CI, review artifacts, and GHSA gates, but it explicitly says live interpreter execution through a real gateway or node host was not tested; external runtime-boundary PRs still need redacted terminal/log/live output before merge. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Risk before merge

• [P1] The runtime detector edit adds a second per-spec versioned-name path even though current main already handles version suffixes centrally, so future interpreter additions could drift between the two concepts.
• [P1] The PR changes a strict exec approval boundary with compatibility and security impact; strictInlineEval users can see different approval prompts or allow-always persistence behavior if the detector shape changes.
• [P1] The latest contributor proof is still test/CI/GHSA-gate focused and explicitly says no live interpreter execution through a real gateway or node host was tested for this branch.

Maintainer options:

1. Refresh to unique regression coverage (recommended)
   Remove the duplicate versionedNames runtime path, keep only tests that add coverage beyond current main, and add redacted terminal output from a real gateway or node-host denial path.
2. Adopt per-spec version matching deliberately
   If maintainers want versionedNames as the new detector contract, document why it replaces the current central suffix helper and add compatibility coverage for the existing strictInlineEval cases before merge.
3. Pause as superseded after extracting tests
   If the extra tests are not worth adopting, close this branch as overlap with the merged detector fix after linking fix(exec): gate versioned inline interpreters #96216.

Next step before merge

• [P1] The protected maintainer label, security-sensitive approval boundary, and choice between coverage-only refresh versus a new detector contract need maintainer handling rather than an automated repair lane.

Security
Needs attention: The diff has no supply-chain issue, but it changes a security-sensitive exec approval detector in a way that duplicates current-main behavior and needs maintainer attention before merge.

Review findings

• [P1] Drop the duplicate versioned interpreter path — src/infra/command-analysis/inline-eval.ts:18-20

@clawsweeper re-review

Updated after the earlier review: this head now includes the production inline-eval detector change in src/infra/command-analysis/inline-eval.ts, direct detector coverage, strict allow-always persistence coverage, and gateway denial coverage for the reported carrier forms. The PR body evidence has been refreshed for head 07357d6ffeaa5ed757b0ae65f700b86764f7a590.

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Verification before merge:

Behavior addressed: strict inline-eval detection now recognizes versioned Python/PyPy interpreter names, PHP inline flags, and R/Rscript eval forms so those inline-code commands stay on the existing approval path.
Real environment tested: local source checkout and GitHub Actions PR checks; no delegated remote provider was used.
Exact steps or command run after this patch:

• node scripts/run-vitest.mjs src/infra/command-analysis/inline-eval.test.ts src/infra/command-analysis/risks.test.ts src/infra/exec-approvals-allow-always.test.ts src/agents/bash-tools.exec-host-gateway.test.ts
• auto-pr.sh issue 790 --run-stage ghsa_dry_run
• scripts/pr review-validate-artifacts 97833
• timeout 1800 .agents/skills/autoreview/scripts/autoreview --mode branch --base origin/main
• auto-pr.sh issue 790 --run-stage ghsa_real_gate
  Evidence after fix:
• Focused local validation passed: 3 Vitest shards, 152 tests.
• review-pr: passed, READY FOR /prepare-pr with 0 findings; autoreview: passed with no accepted/actionable findings.
• GHSA dry-run: passed; GHSA real gate: passed.
• GitHub CI for head 07357d6ffeaa5ed757b0ae65f700b86764f7a590: no failing or pending status checks.
  Observed result after fix: the detector, allow-always persistence, and gateway denial paths all cover the reported interpreter forms without allowing reusable strict-inline-eval approval persistence.
  What was not tested: live interpreter execution through a real gateway/node host; no known untested critical path for the detector and approval-boundary logic covered here.

Regression Risk:
Low. The affected boundary is the existing exec approval guardrail under strictInlineEval; this does not change auth, sandboxing, config, storage, provider, plugin, channel, dependency, migration, or protocol surfaces. SECURITY.md treats this class as hardening inside the trusted-operator exec approval model, and targeted tests plus CI bound the compatibility risk.

Best fix verdict: appropriate. The detector table owns interpreter spelling and inline-flag classification, while gateway tests verify enforcement after detection; moving this into auth, sandbox, provider, plugin, or channel policy would be the wrong layer.

User behavior change:
Before, some inline interpreter spellings could avoid strict inline-eval classification. After, versioned Python/PyPy forms, PHP inline flags, and R/Rscript eval forms are classified consistently; operators may see approval prompts for those commands when strictInlineEval is enabled. No config shape, default setting, provider/plugin/channel behavior, storage, migration, or persisted credential behavior changes.