v0.8.64: Add natural-language auto-review policy and a pre-push review gate

[Hmbown]

Research signal

Cursor's recent SDK and review work points at a useful middle ground between manual approvals and unchecked autonomous execution.

Sources checked:

• Cursor changelog, Bugbot /review, Security Review, auto-review, custom tools, JSONL stores, nested subagents: https://cursor.com/changelog
• Cursor Bugbot product page: https://cursor.com/bugbot
• Cursor Cloud Agents docs, hooks support: https://cursor.com/docs/cloud-agent

Two ideas are especially relevant:

1. Local/headless agents can route tool calls through auto-review instead of blindly running everything.
2. /review can run before a push and then sync with PR review state so duplicate review work is avoided.

CodeWhale substrate

CodeWhale has stronger local-first safety primitives already:

• approval modes and sandbox execution
• pre/post tool hooks in the architecture
• /review CLI/TUI surface for structured code review
• side-git snapshots and /restore
• Proposal: universal PreToolUse/PostToolUse hook layer for Cancel/Pause/Resume across all action types #1917 tracks a universal PreToolUse/PostToolUse lifecycle layer
• Enhancement: add Gherkin acceptance E2E coverage for tool lifecycle #2886 tracks Gherkin/E2E coverage for tool lifecycle

The missing layer is a policy-driven review gate that decides what can run automatically, what needs human review, and what must be blocked or converted to a question.

Proposal

Add an AutoReviewPolicy layer for tool calls and a pre-push review gate.

Policy inputs:

• tool name and normalized action kind: read, write, shell, network, git, MCP, browser, secret, publish, destructive.
• cwd/workspace trust, branch, dirty state, and sandbox mode.
• current user intent and active approval mode.
• natural-language allow/block policy from config, project policy, or managed policy.
• hook result from PreToolUse/PostToolUse once Proposal: universal PreToolUse/PostToolUse hook layer for Cancel/Pause/Resume across all action types #1917 lands.

Policy outputs:

• allow automatically
• request normal approval
• request clarification (v0.8.62: Add first-class clarification question requests for agents #3102)
• block with reason
• require review/checkpoint before continuing

/review gate

Make /review useful before a push or PR, not only after the fact:

• Review the current diff or target branch.
• Run configured local checks where safe.
• Emit a durable review receipt with diff fingerprint, checks run, findings, and unresolved risk.
• If a PR is later created from the same diff, expose the receipt in the PR body/comment or through a local handoff so reviewers know what was already checked.

Acceptance criteria

• AutoReviewPolicy has a typed evaluation API and is covered by unit tests for allow, hold-for-review, block, and ask-user outcomes.
• Policy can be configured with explicit allow/block rules plus optional natural-language guidance, with deterministic fallback when classification is unavailable.
• Headless/background runs cannot bypass policy just because no TUI approval prompt exists.
• Tool-call review decisions are logged with enough context to debug why something ran or paused.
• /review can run against the current diff before push and write a durable review receipt.
• The receipt includes diff fingerprint, model/provider, checks run, findings, and unresolved risk.
• Tests cover a destructive shell command, a read-only inspection, an MCP call, a git push/publish-like action, and a pre-push diff review.
• Documentation explains how this relates to existing approval modes, Proposal: universal PreToolUse/PostToolUse hook layer for Cancel/Pause/Resume across all action types #1917 hooks, and human PR review.

Non-goals

• Do not auto-merge or auto-push from /review.
• Do not claim a review receipt replaces human maintainer review.
• Do not send private code to hosted review services by default.

[Hmbown]

Related Cursor-harness follow-up issues filed from the same research pass:

• v0.8.60: Add agent run ledger with follow-up, takeover, and artifact receipts #3142
• v0.8.59: Add prompt source map and context-usage report for rules, tools, memory, and skills #3143
• v0.8.63: Add visual inspection artifacts for browser and UI tasks #3145