fix(agent): every run of a command is reviewed — an earlier pass is never reused

The reviewer's pass was reused for the same command line in the same folder while the agent's edit count
had not moved. That count sees only the agent's file tools: `sh check.sh`, then `git switch other-branch`,
then `sh check.sh` reused the first pass although check.sh may have changed — as it may through any command,
or through the person's own terminal. Nothing cheap can establish that the workspace is unchanged, so the
reuse is gone: each run is one review. The design note says so and what it costs.

Author: ndemianc

docs/ASK-WHEN-RISKY.md

@@ -99,11 +99,12 @@ Command line:
   read back from `sessions.dir`, which a folder setting can point anywhere. The earlier goals still
   reach the reviewer, as activity. This errs toward asking.
 
-### Reviewed once, until something changes
+### Every run is reviewed
 
-The same command line in the same folder, with no file edited since it last passed, passes again
-without a second call (`npm test` five times in a row is one review). An edit in between makes it a
-new question, because the command may now run code the reviewer has not seen.
+A command that passed a moment ago is reviewed again. What `sh check.sh` does depends on `check.sh`, which an
+earlier command, a `git switch` or the person in their own terminal may have changed, and nothing the
+extension can cheaply observe says it has not. Reusing a pass would vouch for code the reviewer never saw.
+The price is one review call per run, `npm test` included.
 
 ## Cost and wait
 

extensions/levelcode-ai/agent.js

@@ -862,23 +862,16 @@ function isAgentAuthError(e) {
 /**
  * Ask When Risky: show one command to the reviewer (agentReview.js) and report what it decided.
  *
- * The same command in the same folder, with no file edited since it last passed, passes again without
- * a second review: `npm test` five times in a row is one review. An edit in between makes it a new
- * question, because the command may now run code the reviewer has not seen.
+ * Every run is reviewed, including a command that passed a moment ago. What a command does depends on the
+ * files it runs, and those change in ways no counter here can see: an earlier command, a `git switch`, the
+ * person in their own terminal. Reusing an earlier pass would vouch for code the reviewer has not seen.
  *
  * The review is a real model call on the run's own provider, so in gateway mode it costs credits. Its
  * cost is kept on ctx and added to the run's total, so the response bar's figure includes it.
  * @returns {Promise<{outcome:'allow'|'ask'|'stopped', verdict:any, reason:string, failure:string|null}>}
  */
 async function reviewGate(ctx, action) {
 	const stats = ctx.reviewStats || (ctx.reviewStats = { ran: 0, asked: 0 });
-	const passed = ctx.reviewPassed || (ctx.reviewPassed = new Set());
-	const key = action.cwd + '\n' + (ctx.editCount || 0) + '\n' + action.command;
-	if (passed.has(key)) {
-		stats.ran++;
-		ctx.post({ type: 'agentTool', icon: 'workspace-trusted', text: 'Reviewer · passed this exact command earlier, no edits since' });
-		return { outcome: 'allow', verdict: null, reason: '', failure: null };
-	}
 	const model = ctx.reviewModel || ctx.model;
 	const reasons = !!catalog.modelCaps(model).reasoning;
 	ctx.post({ type: 'agentStatus', text: 'reviewing the command…' });
@@ -903,7 +896,6 @@ async function reviewGate(ctx, action) {
 	if (ctx.dbg) { ctx.dbg('review.done', { outcome: r.outcome, failure: r.failure, risk: r.verdict && r.verdict.risk, authorization: r.verdict && r.verdict.authorization, injection: r.verdict && r.verdict.injection, model, costMicros: r.usage && r.usage.cost_micros }); }
 	if (r.outcome === 'allow') {
 		stats.ran++;
-		passed.add(key);
 		ctx.post({ type: 'agentStatus', text: 'running command…' });
 		ctx.post({ type: 'agentTool', icon: 'workspace-trusted', text: 'Reviewer · ' + r.verdict.risk + ' risk — ' + host.displaySafe(r.reason || 'no reason given') });
 	} else if (r.outcome === 'ask') {

extensions/levelcode-ai/test/agentReviewGate.test.js

@@ -11,7 +11,7 @@
  *   1. Ask When Risky is never looser than Autopilot: a danger-set command asks the person, and the
  *      reviewer is not consulted at all.
  *   2. A command the reviewer does not pass, or cannot judge, asks the person, with the reason on the card.
- *   3. A command the reviewer passes runs without a card, and the run says so.
+ *   3. A command the reviewer passes runs without a card, and the run says so — and every run is reviewed.
  *   4. Default Approvals and Autopilot behave exactly as before: no reviewer call in either.
  *--------------------------------------------------------------------------------------------*/
 // @ts-check
@@ -211,18 +211,14 @@ const reviewerRows = (posted) => posted.filter((m) => m.type === 'agentTool' &&
 			// two agent turns at 1000 each, one review at 250
 			assert.strictEqual(r.done.costMicros, 2250);
 		});
-		await testAsync('REVIEW: the same command twice with no edit between is reviewed once', async () => {
+		await testAsync('REVIEW: the same command twice is reviewed twice — an earlier pass is never reused', async () => {
+			// What `sh check.sh` does depends on check.sh, which an earlier command, a git switch or the person
+			// may have changed with no edit the agent made: nothing here can tell, so nothing is reused.
 			reviewer = verdict('low', 'implied', 'ok');
-			const r = await run('review', [cmd('npm test'), cmd('npm test')]);
-			assert.strictEqual(r.reviews, 1);
-			assert.strictEqual(r.ran.length, 2);
-			assert.match(reviewerRows(r.posted).join('\n'), /passed this exact command earlier, no edits since/);
-		});
-		await testAsync('REVIEW: an edit between them makes it a new question', async () => {
-			reviewer = verdict('low', 'implied', 'ok');
-			const r = await run('review', [cmd('npm test'), { name: 'write_file', input: { path: 'a.js', content: 'x' } }, cmd('npm test')],
-				{ ctx: { applyEdit: async () => true, touched: new Set() } });
-			assert.strictEqual(r.reviews, 2);
+			const r = await run('review', [cmd('sh check.sh'), cmd('git switch other-branch'), cmd('sh check.sh')]);
+			assert.strictEqual(r.reviews, 3);
+			assert.strictEqual(r.ran.length, 3);
+			assert.ok(!reviewerRows(r.posted).some((t) => /earlier/.test(t)), 'a pass was reused');
 		});
 		await testAsync('REVIEW: the person\'s ask_user choices reach the reviewer as theirs', async () => {
 			reviewer = verdict('medium', 'explicit', 'You chose to install it.');