Strip shell-only grep directive from local-mode adapted prompt

The CI prompt at `.github/codex/prompts/pr_review.md:54` contains a
literal "Command to check: \`grep -n \"pattern\" diff_diff/*.py\`"
directive under Pattern Consistency. The local Responses-API path has
no shell access, so the model would either hallucinate having run grep
or silently skip the pattern-consistency check while still claiming
completeness.

This bug pre-dates PR #404 (the grep directive has been in the prompt
for as long as the local script has existed). PR #404's `9b76cd4`
follow-up addressed shell-access claims inside the Mandate substitution
specifically, but the older, standalone `Command to check:` line was
never neutralized. Reverting #404 didn't introduce this — but neither
does it fix it.

Adds a `_SUBSTITUTIONS` entry that replaces the directive with a
static-context note: "Verify by inspecting the loaded source files (no
shell access in this path; do not claim to have run \`grep\`)".

Also adds `test_strips_shell_grep_directive_from_real_prompt` that
verifies the directive IS in the unadapted CI prompt and IS NOT in the
local-adapted output, with "no shell access" wording in its place.

170 tests pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: igerber

.claude/scripts/openai_review.py

@@ -911,6 +911,15 @@ def estimate_cost(
         "If the PR fixes a pattern bug",
         "If the changes fix a pattern bug",
     ),
+    # Strip the shell-only `grep` directive — the local Responses API path
+    # has no shell access and would either hallucinate having run grep or
+    # silently skip the check. Replace with a static-context directive that
+    # scopes the check to the loaded source files.
+    (
+        '   - Command to check: `grep -n "pattern" diff_diff/*.py`',
+        "   - Verify by inspecting the loaded source files (no shell access "
+        "in this path; do not claim to have run `grep`)",
+    ),
     (
         "the PR has prior AI review comments",
         "there is a previous review",

tests/test_openai_review.py

@@ -221,6 +221,23 @@ def test_all_substitutions_apply_to_real_prompt(self, review_mod, capsys):
         captured = capsys.readouterr()
         assert "Warning: prompt substitution did not match" not in captured.err
 
+    def test_strips_shell_grep_directive_from_real_prompt(self, review_mod):
+        """The local path has no shell access — the literal `grep` directive
+        in pr_review.md must be neutralized so the model doesn't claim to
+        have run it."""
+        assert _SCRIPT_PATH is not None
+        repo_root = _SCRIPT_PATH.parent.parent.parent
+        prompt_path = repo_root / ".github" / "codex" / "prompts" / "pr_review.md"
+        if not prompt_path.exists():
+            pytest.skip("pr_review.md not found")
+        source = prompt_path.read_text()
+        # Sanity: the directive IS present in the unadapted CI prompt.
+        assert 'Command to check: `grep -n "pattern" diff_diff/*.py`' in source
+        # After local adaptation: directive is gone, no-shell-access note is in.
+        adapted = review_mod._adapt_review_criteria(source)
+        assert 'Command to check: `grep' not in adapted
+        assert "no shell access" in adapted
+
 
 # ---------------------------------------------------------------------------
 # compile_prompt