Release 0.13.3: judge CLIs run isolated from the repository under review

.claude-plugin/marketplace.json

@@ -8,7 +8,7 @@
     {
       "name": "metareview",
       "description": "Internal review harness, adversarial gates, and post-merge learning for coding agents",
-      "version": "0.13.2",
+      "version": "0.13.3",
       "source": "./",
       "author": {
         "name": "David Sifry"

.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "metareview",
-  "version": "0.13.2",
+  "version": "0.13.3",
   "description": "Go-based metaswarm-compatible internal review harness for plans, specs, decompositions, task-done code review, acceptance evidence, PR readiness, and post-merge learning. Packaged releases use bin/metareview; source checkout mode requires Go 1.26+, plus FSM workflow runs (metareview fsm).",
   "author": {
     "name": "David Sifry"

.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "metareview",
-  "version": "0.13.2",
+  "version": "0.13.3",
   "description": "Go-based metaswarm-compatible internal review harness for plans, specs, decompositions, task-done code review, acceptance evidence, PR readiness, and post-merge learning, plus FSM workflow runs (metareview fsm).",
   "author": {
     "name": "David Sifry"

CHANGELOG.md

@@ -1,5 +1,28 @@
 # Changelog
 
+## 0.13.3 - 2026-09-26
+
+### Security
+
+- **The `claude-cli/` and `codex/` judges no longer run inside the repository under review.** Each
+  judge attempt now starts the model CLI in a fresh, empty, private temp directory, removed after
+  the call. Before, the CLI inherited metareview's working directory, which is normally the
+  repository being reviewed, and in headless mode a CLI can still load that repository's
+  project-level configuration without the interactive trust prompt. Disabling tools does not
+  switch that configuration off. So reviewing an untrusted checkout, such as a fork's PR branch,
+  was not isolated from it. The Claude judge also passes `--setting-sources user
+  --strict-mcp-config`. The Codex judge passes `-c project_doc_max_bytes=0`, which also covers the
+  escalation path's materialized evidence tree (still honoured as an explicit work dir). If no
+  private directory can be made, the attempt fails as a transport error and nothing is spawned in
+  the caller's directory. The directory is created under the user's own cache directory
+  (`os.UserCacheDir`), not a shared temp dir, because Codex walks up from its working directory to
+  a `.git` root and loads repo-scoped skills it finds there. There is no temp-dir fallback: without
+  a usable cache directory the judge attempt fails (the CLI judges need `$HOME` for their OAuth
+  session anyway). Judge calls also no longer persist sessions: Claude gets
+  `--no-session-persistence` and Codex `--ephemeral`, so a judge's full prompt and diff are no
+  longer written into the user's session transcripts. Reported while reviewing #165; plan in #167
+  (W0).
+
 ## 0.13.2 - 2026-09-26
 
 ### Fixed