Orchestration follow-up: finishing-command sandbox allowlist + scheduledFollowups upsert (ADE-131)

[arul28]

Implements the two bookkept P2s from PR #878 (merged as 78556e6), tracked in Linear ADE-131.

FIX 1 — Finishing-command sandbox allowlist

The finishing worker (manifest.finishing.mode === "pr") must run git push, gh pr create/view, and ade commands (Linear sync, deeplink mint, asset registration, ade actions run chat.createScheduledWork). Under blockByDefault: true the orchestration sandbox's safe list contained none of these.

• buildOrchestrationSandboxConfig now accepts { allowFinishingCommands } and, when set, appends a narrow safe list — git push, gh pr <sub>, ade <sub> only. Everything dangerous stays in blockedCommands (checked first).
• Scoped at the call site to orchestrator-worker sessions only — never validators. The finishing role isn't tagged separately at sandbox-build time (it's a plain worker spawned via spawnAgent), so the allowance is worker-wide by necessity, documented inline.

Does the block actually bite? For real finishing workers, no. They're spawned as native-provider workers (Claude Bash, Codex shell, …) whose shell bypasses this TS sandbox entirely (SKILL §4 step 5 / §4.5), so they could already push/gh/ade. This allowance only governs the ADE-SDK createBashTool / checkWorkerSandbox path; fixed for consistency so a finishing worker driven through that path can also finish a run.

FIX 2 — scheduledFollowups upsert

recordScheduledFollowup appended a new row every call, so a follow-up first recorded pending then armed to scheduled accumulated duplicate rows while the original stayed permanently pending.

• Now upserts by id: re-recording an existing id merges onto the same lifecycle row (arming stamps scheduledWorkId + "scheduled" in place via a predicate-addressed replace), preserves createdAt, and merges scheduling identity so a late update can't drop it.
• Never regresses a terminal (fired/cancelled) status back to an earlier state.
• The tool now accepts and echoes the follow-up id so callers can target the same row when arming/firing.

Tests

• orchestrationTools.test.ts: finishing commands blocked without the allowance; git push / gh pr create / gh pr view / ade … allowed with it; unrelated gh subcommands, piped-shell, and rm -rf / stay blocked.
• orchestrationService.test.ts: record intent → re-record same id with scheduledWorkId → exactly one row, status scheduled, createdAt preserved; fired entry not regressed by a late pending update.
• Full suites green: npx vitest run src/main/services/orchestration src/main/services/ai/tools — 496 passing + my 3 new tests (one pre-existing parallel-temp-dir flake in spawnAgent > delivers persisted outbox entries, reproduces identically on clean main). tsc --noEmit clean (only pre-existing ../ade-cli module-resolution noise).

🤖 Generated with Claude Code

Greptile Summary

This PR updates orchestration finishing and scheduled follow-up handling. The main changes are:

• Adds an opt-in sandbox allowlist for finishing-worker commands: git push, gh pr, and ade.
• Scopes the finishing command allowance to orchestration workers, not validators.
• Changes scheduled follow-up recording to upsert by returned id.
• Preserves existing follow-up createdAt, scheduling identity, and terminal statuses during lifecycle updates.
• Adds tests for command sandbox behavior and scheduled follow-up upsert behavior.

Confidence Score: 5/5

This PR is safe to merge with minimal risk.

The changes are narrowly scoped and keep blocked-command and protected-file sandbox checks ahead of the new allowlist. The scheduled follow-up change preserves existing lifecycle data and includes tests for the updated upsert behavior. No blocking correctness or security issues were identified in the changed paths.

No files require special attention.

T-Rex Logs

What T-Rex did

• The desktop orchestration log shows the Vitest command completed successfully with exit code 0 and both targeted suites passed.

_{Ran code and verified through T-Rex}

Important Files Changed

Filename	Overview
apps/desktop/src/main/services/ai/tools/orchestrationRuntime.ts	Adds an opt-in finishing-worker sandbox allowlist while preserving protected-file and block-by-default behavior.
apps/desktop/src/main/services/ai/tools/orchestrationTools.ts	Threads the finishing command allowance only into worker toolsets and returns scheduled follow-up ids from the record tool.
apps/desktop/src/main/services/orchestration/orchestrationService.ts	Changes scheduled follow-up recording to upsert by id, preserve lifecycle identity, and avoid terminal-state regression.
apps/desktop/src/main/services/ai/tools/orchestrationTools.test.ts	Covers default blocking and opt-in allowance for finishing commands, including blocked dangerous commands.
apps/desktop/src/main/services/orchestration/orchestrationService.test.ts	Adds coverage for scheduled follow-up upsert behavior, createdAt preservation, and terminal status non-regression.

Sequence Diagram

sequenceDiagram
participant Worker as Orchestrator worker
participant Tools as Orchestration tools
participant Sandbox as Worker sandbox
participant Service as Orchestration service
participant Manifest as Bundle manifest

Worker->>Tools: create toolset(interactionMode)
Tools->>Sandbox: build config(allowFinishingCommands for workers)
Worker->>Sandbox: run finishing command
Sandbox-->>Worker: allow git push / gh pr / ade when opted in

Worker->>Tools: recordScheduledFollowup(summary)
Tools->>Service: recordScheduledFollowup(no id)
Service->>Manifest: add pending row with generated id
Service-->>Tools: followupId
Worker->>Tools: recordScheduledFollowup(id, scheduledWorkId)
Tools->>Service: recordScheduledFollowup(same id)
Service->>Manifest: replace matching row, preserve createdAt
Service-->>Worker: same id + etag

Loading

_{Reviews (1): Last reviewed commit: "fix(orchestration): finishing-command sa..." | Re-trigger Greptile}

[linear-code]

ADE-131

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
ade	Ignored		Jul 23, 2026 6:23am

[coderabbitai]

Warning

Review limit reached

@arul28, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 21 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 08c5cab9-ede5-4dc2-9184-646d2003c0a9

📥 Commits

Reviewing files that changed from the base of the PR and between e0f2ffd and 030ab08.

📒 Files selected for processing (5)

• apps/desktop/src/main/services/ai/tools/orchestrationRuntime.ts
• apps/desktop/src/main/services/ai/tools/orchestrationTools.test.ts
• apps/desktop/src/main/services/ai/tools/orchestrationTools.ts
• apps/desktop/src/main/services/orchestration/orchestrationService.test.ts
• apps/desktop/src/main/services/orchestration/orchestrationService.ts

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ade/orch-followup-ade131

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}