Auto Review

autoreview is an optional bundled plugin tool for the canonical Auto Review skill. The installed helper captures and rechecks repository changes inside the calling session's sandbox. The Gateway runs the selected reviewer through restricted openclaw agent exec, then returns the complete output to the same helper for validation.

Enable

Enable the autoreview plugin and add autoreview to the intended agent's tool policy. If that agent has a sandbox tool allowlist, allow it there too. Existing deny rules still apply.

{  "plugins": { "entries": { "autoreview": { "enabled": true } } },  "tools": { "alsoAllow": ["autoreview"] }}

Install a current canonical Auto Review package in the Gateway user’s ~/.agents/skills/autoreview, through the managed skill installation, or in a skill library. The personal ~/.agents/skills directory is discovered only when the Gateway uses its default state directory; a custom state directory needs a managed installation or skill library. The sandbox must provide /usr/bin/python3 and a protected, read-only copy of the selected package. A repository-local skill named autoreview does not qualify. The tool is unavailable when those bindings or the calling user's model authority are absent. The backend must enforce read-only resource mounts; SSH sandbox file uploads do not qualify. Mounts or tmpfs overlays that replace the selected package also make it unavailable. The original selected package must not be writable through the guest's workspace or mounts. A read-only synchronized copy does not make a guest-writable source trusted. Installer symlinks remain supported when their canonical targets are host-only or read-only; writable aliases of either the original or copied package disqualify it. Move an affected installation to a host-only or read-only location.

The canonical skill discovers the enabled tool and calls it at its required checkpoint. If the tool is unavailable, enable the narrow capability or repair the installation. Do not substitute host shell access or a reviewer child.

Inputs and results

Supply the review target and only explicitly requested overrides. The installed canonical helper owns model, thinking, severity, prompts, pass planning, and review timeout settings. Updating that helper updates its defaults without an OpenClaw release. mode, base, commit, model, thinking, maxPriority, passes, timeoutSeconds, prompt, promptFiles, datasets, sourceContext, and sourceContextFiles map to its matching options. File inputs are relative to the current sandbox repository. The original session deadline and cancellation still apply.

Under Codex, the whole call follows the initiating run's existing execution lifetime, covering preparation, every planned pass, and report completion. It is not shortened to the generic 90-second tool default or 600-second cap. An unlimited initiating run stays unlimited; Stop and authority revocation still cancel the review. The helper's timeout remains a per-pass limit, and an omitted timeout retains openclaw agent exec's 600-second default for each pass. /btw retains its separate ten-minute parent deadline.

An allowed configured reviewer model is preserved. If the caller cannot use that configured preference, the Gateway selects the caller's existing permitted default before execution and the helper records the effective model. An explicit prohibited model override is rejected; an empty permitted selection is an error. There is no model substitution after reviewer execution fails.

The operation fixes the protected helper, engine, interpreter, executable, current sandbox working directory, and private exchange paths. Native openclaw agent exec inherits normal configuration and authentication; per-run overrides enforce the actual sandbox caller's host-execution restrictions without rewriting saved configuration. Sandbox output cannot supply host configuration, credentials, executable paths, or runtime grants. The reviewer gets an empty private workspace, no host tools, no selected skills, and no injected workspace context. Provider credentials stay on the host. No host Git operation substitutes for the sandbox's staged, unstaged, or untracked state.

The result contains the helper-validated report and status. Findings are a completed review. A failed, interrupted, oversized, mismatched, or incomplete execution is an error and never triggers another engine. Stop and model-policy revocation cancel this operation's processes; concurrent calls own separate exchanges and results. This integration supports POSIX sandboxes with the required protected Python helper.

The complete report and status are limited to 8 MiB, below Code Mode's default 10 MiB full-value inbox. Larger results fail with a split-review diagnostic; findings and preserved provider/pass reports are never silently truncated. Lower operator-configured Code Mode limits still apply. Direct tool calls must also fit the initiating model's existing output budget. Larger direct reports fail explicitly with instructions to use Code Mode or split the review.