feat(setup): configure other models as adversarial reviewers, with per-harness commands

[potiuk]

PR 2 of 4. Follows #1368 (merged), which added the tool and plugin. PR 3 and PR 4 stack on this one.

Summary

• Per-harness commands. adversarial-review commands --harness claude|codex|gemini|copilot prints each harness's command file from one template:
  • The Claude Code command ships in the plugin as /magpie-adversarial-review:adversarial-review.
  • Codex and Gemini get user-level files: ~/.codex/prompts/… and ~/.gemini/commands/….
  • Copilot gets the one-line invocation.
  • No command bakes a plugin version in; a plugin upgrade leaves them valid.
• setup config adversarial-review (Step 3c). It runs detect, pre-ticks every available model CLI except the harness's own, and writes .apache-magpie-local/adversarial-review.md. It then offers the command files. It runs only when named, never from a skill's pre-flight. Home-directory writes are the one, named exception to config's write boundary.
• verify 8i flags configured reviewers whose CLI has gone. adopt 4a always treats the file as personal.
• Sandbox exclusion. One excludedCommands entry names the installed plugin's single-line invocation, and the plugin cache is Edit-denied. There is deliberately no allow: each run sends the change to other model providers and keeps its prompt. The settings baseline and expected.json change in lockstep. isolated-setup-install Step R wires the entry, and isolated-setup-verify check 14 verifies it.

Type of change

• Skill change (.claude/skills/<name>/) — eval fixtures updated below
• Python package (tools/*/ with pyproject.toml)
• Cross-cutting (RFC, AGENTS.md, sandbox, privacy-LLM)
• Documentation (docs/, README.md, CONTRIBUTING.md)
• Project template (projects/_template/)

Test plan

• prek run --all-files passes
• For Python packages touched: pytest (140 tests), ruff check and mypy pass for tools/adversarial-review
• For skill behaviour changes: new eval suite setup/step-config-adversarial (5 cases). It covers the named run, a plain run, a pre-flight entry, a missing plugin, and only self available.
• Other:
  • A test renders every harness's command and checks the invocation against the adversarial-review exclusion pattern in tools/sandbox-lint/expected.json. A quoted or ~-expanded path would silently stay sandboxed.
  • The shipped Claude Code command is pinned byte-for-byte to its generator.
  • The config template is pinned as parseable.
  • sandbox-lint passes (settings and baseline match).
  • The tool refuses a --body-file or diff: path outside the repository or a temporary directory, so an approved run cannot send ~/.ssh to a model.

RFC-AI-0004 compliance

• HITL: config Step 3c proposes and writes only what the user ticks. The tool has no allow rule, so every run keeps its permission prompt.
• Sandbox: one narrow exclusion, for the single-line plugin invocation only, with an Edit deny on the plugin cache. The residual glob caveat is documented in Step R.
• Vendor neutrality: commands for four harnesses from one template.
• Conversational + correctable: configuration lives in adversarial-review.md (personal, with an optional project default).

Linked issues

Follows #1368.

Notes for reviewers (optional)

• Exclusion form: the exclusion only matches the command spelled with a literal ~ and an unquoted path. Every place that tells an agent how to run the tool now uses that exact form.
• Codex: Codex's default workspace-write sandbox has no network, so the Codex and Gemini commands tell the agent to ask for the one command to run outside its sandbox.

🤖 Generated with Claude Code