roborev: Combined Review

Verdict: Changes are directionally good, but there are 3 Medium-severity issues to address before merge.

Medium

1. No compatibility fallback for new stdin prompt mode

   • Refs: internal/agent/copilot.go:79, internal/agent/droid.go:98, internal/agent/opencode.go:118, internal/agent/cursor.go:107
   • Issue: These agents now send prompts via stdin without a capability/version fallback. Older or variant CLIs that require positional/flag prompt input may fail or become interactive.
   • Recommendation: Add per-agent capability detection (or version gating) and fallback to prior argument-based prompt mode when stdin prompt mode is unsupported.

2. ClaudeAgent appears not migrated to stdin prompt handling

   • Refs: internal/agent/claude.go
   • Issue: ClaudeAgent is inconsistent with other agents and appears to still pass prompt content via command arguments, keeping process-list exposure and argument-length risk.
   • Recommendation: If supported by the Claude CLI, pipe prompt via cmd.Stdin and remove prompt text from command arguments.

3. Some stdin-piped agents lack WaitDelay

   • Refs: internal/agent/copilot.go:85, internal/agent/droid.go:104, internal/agent/opencode.go:131
   • Issue: These subprocesses now use pipes but do not set cmd.WaitDelay, increasing hang risk if pipe closure/drain behavior is abnormal.
   • Recommendation: Set cmd.WaitDelay consistently for these agents, matching the safer pattern used elsewhere.

Synthesized from 4 reviews (agents: codex, gemini | types: security, default)

roborev: Combined Review

Verdict: Changes are mostly positive, but there are 2 Medium-severity functional regressions to address before merge.

Medium

1. Potential Copilot prompt delivery regression

   • File: internal/agent/copilot.go:79
   • Issue: Prompt transport was changed to stdin only, and --prompt was removed. If Copilot CLI still requires --prompt for non-interactive mode, prompts may be ignored or the process may hang waiting for interaction.
   • Suggested fix: Keep an explicit --prompt path, or add CLI capability detection/fallback between flag-based and stdin-based prompt input.

2. Potential OpenCode invocation semantic mismatch

   • File: internal/agent/opencode.go:118
   • Issue: Code now pipes prompt via stdin and no longer passes positional message args, while comments/documented usage indicate opencode run [message..]. If message args (or explicit stdin marker) are required, behavior may regress.
   • Suggested fix: Use the CLI’s documented explicit stdin form (if supported), or retain positional prompt passing with guarded fallback for large prompts.

Notes

• No Critical or High findings were reported.
• Security-focused reviews reported no security vulnerabilities in this diff.

Synthesized from 4 reviews (agents: gemini, codex | types: security, default)

roborev: Combined Review

Potential regression risk identified: 1 Medium issue; no Critical/High findings and no new security vulnerabilities reported.

Medium

1. Potential non-interactive regression for Copilot invocation
   • File: internal/agent/copilot.go:79
   • Prompt transport changed from explicit --prompt to stdin only (cmd.Stdin = strings.NewReader(prompt)). If some installed Copilot CLI versions still require --prompt for non-interactive execution, this may fail or hang.
   • Suggested fix: add compatibility fallback (e.g., retry with --prompt on usage/error output, or gate by CLI capability check).

Synthesized from 4 reviews (agents: codex, gemini | types: security, default)

Merging this. check-agents with stdin piping works correctly here, but if there are any regressions around this I'll certainly patch them ASAP

❯ roborev check-agents                                                                       🐹 v1.25.5 06:39:02 
  ? claude-code    claude (/Users/wesm/.local/bin/claude) ... OK (2 bytes)
  ? codex          codex (/opt/homebrew/bin/codex) ... OK (2 bytes)
  ? copilot        copilot (/opt/homebrew/bin/copilot) ... OK (4 bytes)
  ? cursor         agent (/Users/wesm/.local/bin/agent) ... OK (3 bytes)
  ? droid          droid (/Users/wesm/.local/bin/droid) ... OK (3 bytes)
  ? gemini         gemini (/opt/homebrew/bin/gemini) ... OK (2 bytes)
  ? opencode       opencode (/opt/homebrew/bin/opencode) ... OK (2 bytes)

7 passed, 0 failed, 0 skipped