fix(review): honour the configured adapter, and let review be pinned apart from the rest (AGT-4292)

[unohee]

TL;DR

openswarm review read the config file for Linear settings and nothing else, so runReviewer fell through to the registry default — codex — whatever the operator had configured. The daemon honours adapter:; the standalone CLI did not. Someone running adapter: codex-responses with an OpenRouter key had no way to review on openrouter.

Review is also the one role worth pinning separately: it is the second opinion, so running it on the same provider as the work it checks is a correlated failure. reviewAdapter: exists so that choice does not force every other role onto another provider.

Precedence

--adapter > OPENSWARM_REVIEW_ADAPTER > config.reviewAdapter > config.adapter > built-in default

An unknown name throws rather than falling through to a lower-precedence source, and lists the valid options the way the registry's own error does — the operator asked for something specific and would otherwise silently get a different provider.

A flag or the environment variable short-circuits before config is read. That is not an optimisation: loadConfig is not a pure read — it engages enableHumanSurfaceReadOnly() and the sandbox executor wiring, and a plain openswarm review never triggered either before this existed.

Why adapterNames.ts is a leaf module

Importing the adapter registry for a string check pulls in codex.ts's module-scope promisify(execFile) and breaks eleven tests that mock node:child_process; putting the constant on core/config.ts breaks a test that mocks that module. Nothing in the source links the copy to the registry, so a test asserts they hold the same names — drift otherwise surfaces as a config that fails validation for an adapter the registry supports.

What the review found that this does NOT fix

Both filed rather than folded in, because bundling an unrelated root cause into an adapter-resolution change is the mistake that cost three review rounds on another PR today:

• AGT-4298 — mcpClient.ts calls loadConfig() unguarded during tool auto-discovery, so review --json | jq is still broken for any review that uses tools. Predates this change. Every test here stubs deps.review, so no test in the suite runs that path.
• AGT-4299 — review --max still resolves via opts.adapter ?? activeAdapter() and ignores reviewAdapter:, while review --debug reports the key as honoured. reviewAdapter is also documented nowhere.

This PR's claim is narrowed accordingly: adapter resolution no longer pollutes stdout, not "the --json contract is clean".

A guard test that passed for the wrong reason

The test named "--json writes the verdict to stdout and keeps prose off it" spied on process.stdout.write while vitest intercepts console.* above that spy — so the pollution this change briefly introduced never reached its capture array and the guard stayed green through it. It now captures both and asserts JSON.parse of the whole capture, which is what jq does.

Review

Layer 2 (independent subagent), two rounds. Round 1 found the stdout regression and the false-green guard; round 2 confirmed both fixed and found AGT-4298/4299 by building and running the real CLI. Layer 1 (openswarm review) is not run on my own commits per standing policy.

mutant	tests killed
remove the console suppression	2
do not propagate --json	2
remove the short-circuit	2
phantom name in ADAPTER_NAMES	1

Gate

tsc --noEmit exit 0 · src/cli/ + src/core/ 1055 passed, exit 0 · oxlint 0 warnings on the changed files.

Closes AGT-4292.

🤖 Generated with Claude Code