/astra-review now runs on Opus (model: opus). Opus verifies findings,
checks every diff, and runs the tests; fixes go to a Fable subagent.
When that Agent call fails with a rate_limit / HTTP 429 API error, the
command switches to Astra for the rest of the session:
- astra-review.js --fix-findings <file> sends confirmed findings to
Codex in a workspace-write sandbox with the review isolation intact
(no web search, MCP disabled, user config ignored, no API keys) and
/tmp, $TMPDIR, and the network excluded from the writable roots.
- New scripts/lib/astra-review/fix.js builds the fix prompt, validates
the structured fix result, and formats the report.
- codex.js shares one exec runner between review and fix; the sandbox
is allowlisted (danger-full-access is refused).
- The command snapshots git diff and untracked files before any writer
runs, so Opus reverts only the writer's hunks and never the user's
uncommitted work.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Findings from three /astra-review rounds on the previous commit:
- writeReport: write to an exclusively created 0600 temp file in the
destination directory and rename it into place. Removes the lstat/write
race, replaces (never follows) a pre-existing symlink, and tightens
permissions on an existing world-readable report. Full-write semantics via
writeFileSync on the descriptor; temp file removed on any failure.
- scope: normalize the git toplevel and cwd with path.resolve before
realpath (git reports forward slashes on Windows) and display file paths
git-style with forward slashes.
- tests: build fixture roots with path.resolve/path.join so containment
checks hold on Windows; skip POSIX permission and symlink assertions where
the platform cannot support them.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
