[netzenbot]

User impact: make setup now asks which agent runs ./run.sh and which runs the scheduled reviews, and make schedules builds the cron jobs from the answers.

The problem

Which agent the cron jobs use was not a setting. The run.sh lines in every profile's schedules.sh carried no agent flag, so scheduled runs used whatever bot.agent said at fire time, and the review sweeps always ran claude. Pointing a deployment at bravebot meant editing a profile by hand, and even then the run died under cron: bravebot is a #!/usr/bin/env node script under nvm, which cron's PATH does not have.

Reproduce

1. In a checkout with a config.json, run make setup and walk through it.
2. After the reviewer account questions there is no question about agents, and at the end no offer to install schedules.
3. Set "agent": "bravebot" in config.json by hand and run ./scripts/sync-schedules.sh --print.

The run.sh lines end ./run.sh 30 with no agent flag and the block's PATH has no nvm directory. Expected: the lines name the agent and the binary's absolute path, and the PATH can find node.

python3 -m pytest tests/test_agent_config.py covers the rendered crontab and the review command for each agent.

The fix

make setup asks for an agent for ./run.sh and one for the scheduled reviews, asks for bravebot's absolute path when either is bravebot, and ends by offering to install the schedules (all, run, review or none, defaulting to what is installed). The answers are stored as bot.agent, reviewer.agent and bot.bravebotBin.

make schedules reads them when it installs. Every run.sh line gets --agent <name> --agent-bin <absolute path> for any agent but claude, so a claude deployment renders the same crontab as before, and the block's PATH gets the binary's directory. The install stops if the binary cannot be found. The review agent is read when each review job fires, through one helper that review-session.sh and reply-to-pings.sh share, so changing it needs no reinstall.

Setup now ends like this:

─── Agents ───
Agent for ./run.sh [claude]: bravebot
Agent for scheduled reviews [claude]: bravebot
Path to the bravebot binary [/home/you/.nvm/versions/node/v24.16.0/bin/bravebot]:

─── Schedules ───
Install schedules? (all/run/review/none) [none]:

And a run line, with bravebot configured:

... && ./scripts/timeout-tree.sh 86340 ./run.sh 30 --agent bravebot --agent-bin /home/you/.nvm/versions/node/v24.16.0/bin/bravebot ; } >> .../logs/run-cron.log 2>&1

What is weaker when bravebot reviews

claude's review session runs under an allowlist and --permission-mode dontAsk, so anything not listed is refused and run is limited to one script. A one-shot bravebot run has nobody to ask: an action needing approval ends the run on status 4, and allow rules decide nothing. The only mode in which a review can write its results file is --dangerously-skip-permissions, which also marks every file the session reads as trusted. The command adds read deny rules for credentials, write deny rules for the bot directory, a sandbox writable only in the work directory, a closed network and a fixed tool list with no fetch tools. docs/review-agents.md lists what is left weaker and what bravebot would need to close it.

Test plan

• make lint — passed
• make test — passed
• make check-reviewdog — no findings (opengrep and pip-audit could not run on this machine)
• Rendered the crontab from the deployment's config with bravebot for both agents: four run lines carry the flags and both blocks' PATH has the nvm directory
• make setup run interactively end to end (not done)
• A review session run by bravebot against a real PR (not done)
• CI passes cleanly