feat(agent): add proactive pull request review

[RedStar071]

Summary

• Add opt-in proactive reviews for pull-request lifecycle events and local CLI runs with --proactive.
• Analyze the pull-request merge-base diff, validate findings against changed files, and publish structured severity, confidence, evidence, and change-risk data.
• Gate automatic fixes through repository policy, confidence, risk classification, native verification checks, and runner isolation.

Why

Closes#9.

Proactive review belongs across the existing package boundaries: GitHub normalizes webhook events, the runner obtains repository diffs, the agent validates and authorizes findings, config owns repository policy, and the CLI/server remain presentation and transport adapters.

Verification

• aube run check:repo
• aube run lint:ci
• aube run typecheck
• aube test
• aube run build

All 192 tests pass after rebasing on the current origin/main.

Safety and compatibility

• I added or updated deterministic tests for changed behavior.
• I preserved observe mode as read-only, or explained the policy change above.
• Runtime commands and target-repository writes remain inside the runner boundary.
• I did not expose secrets, tokens, personal data, or untrusted output in logs.
• I updated documentation and Agent Skills when workflows or boundaries changed.

Reviewer notes

• Proactive webhook processing is disabled by default and requires repository opt-in.
• High-impact changes always stop for human approval; executable source is conservatively classified as at least behavioral.
• The shared review contracts now include pull-request base SHAs, proactive triggers, and change-risk metadata; package versions move to 0.2.0.
• A separate build commit normalizes LF handling and Skilld symlink checks for Windows worktrees.

---

^{Need help on this PR? Tag @codesmith with what you need. Autofix is enabled.}

Confidence Score: 3/5

Not safe to merge until local review coverage includes all pending changes and automated edits are limited to evidence-supported files.

Both reported failures were reproduced through focused execution: an isolated Git fixture demonstrated omitted local changes, and an AgentZero harness demonstrated a successful write to a peer diff file not named by the finding.

Files Needing Attention:packages/runner/src/boundary.ts needs range-less local context collection that includes staged and untracked content; packages/agent/src/agent.ts and its change-scoping helper need write authorization limited to validated finding files.

T-Rex Logs

What T-Rex did

• Generated the initial P1 finding proof and captured the fixture source output, clean repository baseline, and staged/untracked fixture state to support verification.
• Built a focused reproduction harness and validated the focused reproduction outputs, including the peer-diff scope bypass and the existing agent tests.
• Filed a third P1 finding-proof and noted that no additional artifacts were provided for this proof.
• Validated the general contract behavior: baseline shows empty status, reviewFiles, and diff, while the fixture report included staged.txt and untracked.txt entries and the review context remained empty.

_{Ran code and verified through T-Rex}

Prompt To Fix All With AI

### Issue 1
packages/runner/src/boundary.ts:163
**Local review omits pending changes**
With no revision range, the local proactive-review path executes plain `git diff`, which excludes index-only changes and untracked files. The reproduced fixture showed `A staged.txt` and `?? untracked.txt` in Git status while the changed-file list and diff context were both empty, so `zero review --proactive` cannot review those pending changes. Build range-less local context from status, staged content, working-tree content, and approved untracked files while retaining the current base/head behavior for pull-request reviews.
### Issue 2
packages/agent/src/agent.ts:138-142
**Autofix scope exceeds validated finding**
For proactive runs, `effectiveInput.files` contains every file in the review diff and is passed to `scopeChanges`, allowing any changed file to be written even if the accepted finding and evidence name another file. The executed flow accepted a finding limited to `src/supported.ts` but wrote and verified `src/diff-peer.ts` because it was also in the review-file list. Restrict planned writes to files supported by the finding, or require separately validated evidence before authorizing any additional file.
---
For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "feat(agent): add proactive pull request ..." | Re-trigger Greptile}

Greptile also left 2 inline comments on this PR.

Context used:

• Context used - CLAUDE.md (source)

[greptile-apps]

Local review omits pending changes

With no revision range, the local proactive-review path executes plain git diff, which excludes index-only changes and untracked files. The reproduced fixture showed A staged.txt and ?? untracked.txt in Git status while the changed-file list and diff context were both empty, so zero review --proactive cannot review those pending changes. Build range-less local context from status, staged content, working-tree content, and approved untracked files while retaining the current base/head behavior for pull-request reviews.

Artifacts

Temporary Git fixture source

• Authored Node fixture creates an isolated repository and invokes the exact empty-range `git diff` argument forms from the runner; the takeaway is that the reproduction is focused and independently executable.

Captured fixture source output

• Captured output of `cat trex-artifacts/proactive-empty-range-fixture.mjs` includes the command, working directory, full source, and exit code; the takeaway is that the uploaded test source exactly matches the executed fixture.

Clean repository baseline output

• Executed baseline fixture reports empty porcelain status, empty review files, and empty diff with exit code 0; the takeaway is that the control case behaves as expected.

Staged and untracked fixture output

• Executed changed fixture reports `A staged.txt` and `?? untracked.txt` but empty review files and diff context with exit code 0; the takeaway is that both change types are omitted.

_{Ran code and verified through T-Rex}

Prompt To Fix With AI

This is a comment left during a code review.
Path: packages/runner/src/boundary.ts
Line: 163
Comment:
**Local review omits pending changes**
With no revision range, the local proactive-review path executes plain `git diff`, which excludes index-only changes and untracked files. The reproduced fixture showed `A staged.txt` and `?? untracked.txt` in Git status while the changed-file list and diff context were both empty, so `zero review --proactive` cannot review those pending changes. Build range-less local context from status, staged content, working-tree content, and approved untracked files while retaining the current base/head behavior for pull-request reviews.
---
For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

[greptile-apps]

Autofix scope exceeds validated finding

For proactive runs, effectiveInput.files contains every file in the review diff and is passed to scopeChanges, allowing any changed file to be written even if the accepted finding and evidence name another file. The executed flow accepted a finding limited to src/supported.ts but wrote and verified src/diff-peer.ts because it was also in the review-file list. Restrict planned writes to files supported by the finding, or require separately validated evidence before authorizing any additional file.

Context Used: CLAUDE.md (source)

Artifacts

Focused reproduction harness

• A fake model and runner execute the real AgentZero flow for a supported-file control and a peer-diff-file attempt; takeaway: it isolates the claimed authorization path.

Supported-file control output

• The fake proactive AgentZero run validates a finding for src/supported.ts and writes only src/supported.ts with exit code 0; takeaway: the baseline in-scope edit succeeds.

Peer-diff scope bypass output

• The fake proactive AgentZero run retains a finding only for src/supported.ts but writes src/diff-peer.ts and reports a completed verified result with exit code 0; takeaway: the unsupported peer-diff edit is written.

Existing agent tests output

• Vitest ran packages/agent/src/agent.test.ts with all 36 tests passing and exit code 0; takeaway: the existing suite passes without catching the reproduced bypass.

_{Ran code and verified through T-Rex}

Prompt To Fix With AI

This is a comment left during a code review.
Path: packages/agent/src/agent.ts
Line: 138-142
Comment:
**Autofix scope exceeds validated finding**
For proactive runs, `effectiveInput.files` contains every file in the review diff and is passed to `scopeChanges`, allowing any changed file to be written even if the accepted finding and evidence name another file. The executed flow accepted a finding limited to `src/supported.ts` but wrote and verified `src/diff-peer.ts` because it was also in the review-file list. Restrict planned writes to files supported by the finding, or require separately validated evidence before authorizing any additional file.
**Context Used:** CLAUDE.md ([source](https://github.com/wolfstar-project/agent-zero/blob/main/CLAUDE.md))
---
For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.