fix(work): name the remedy when verify rejects a shell interpreter

[solomonneas]

Closes #412.

What

verify run rejects shell interpreters (bash, sh, zsh, ...) as verify
executables, which is correct: verify runs argv directly with shell=False, so a
shell interpreter is never a valid executable. But the rejection message
dead-ended at high-risk verification command: bash, while the sibling
shell-metacharacter branch already names its remedy (use --argv-json). A caller
whose check was bash ./script.sh had no pointer to the supported pattern.

Change

• Add a shared _high_risk_command_message helper, used by both the --command
  (_verify_parse_command) and --argv-json (_verify_parse_argv) rejection
  sites so the two stay in sync.
• The message names the supported shape (a resolvable executable, e.g. a
  chmod +x script invoked by its path) and deliberately does not point at
  --argv-json, which applies the same high-risk block and so is not a shell
  escape hatch.

Message-only: the set of accepted and rejected commands is unchanged.

Tests

Adds test_work_verify_run_rejects_shell_interpreter_with_remedy, parametrized
over --command and --argv-json, asserting the rejection carries the remedy
text and does not mention --argv-json.

./scripts/verify green: ruff, ruff-format, mypy, version-sync, managed-snapshot,
and 3502 passed, 3 skipped, coverage 82.42%.

Summary by CodeRabbit

• Bug Fixes

  • Improved and standardized rejection messaging when high-risk shell interpreters are used as verification commands.
  • Ensured consistent, actionable guidance across both supported input formats for specifying the verify executable.

• Tests

  • Added CLI coverage to confirm work verify run rejects these high-risk commands in both --command and --argv-json modes, and that the error details include the recommended remedy without referencing the --argv-json flag.

[coderabbitai]

Caution

Review failed

The pull request is closed.

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: escoffier-labs/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: e95408e6-f5b8-4af7-8d01-dbdbddab783b

📥 Commits

Reviewing files that changed from the base of the PR and between f588957 and c569be3.

📒 Files selected for processing (2)

• src/brigade/work_cmd/verification.py
• tests/test_work_cmd_verification.py

---

📝 Walkthrough

Walkthrough

High-risk verification executable rejections now use a shared message with remediation guidance. A parametrized CLI test covers both --command and --argv-json inputs and verifies rejected receipt statuses and summary content.

Changes

Verification rejection guidance

Layer / File(s)	Summary
Standardize high-risk rejection messages and validate CLI behavior src/brigade/work_cmd/verification.py, tests/test_work_cmd_verification.py	A shared helper provides the rejection text for shell-string and pre-split argv parsing, while a parametrized test verifies rejection statuses, executable identification, remedy text, and omission of --argv-json from summaries.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: adding a remedy to verify rejections for shell interpreters.
Linked Issues check	✅ Passed	The PR matches issue #412 by adding actionable guidance for high-risk executable rejections without changing the blocking policy.
Out of Scope Changes check	✅ Passed	The changes stay focused on the rejection message and test coverage, with no clear unrelated scope added.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/412-verify-highrisk-message

---

_{Comment @coderabbitai help to get the list of available commands.}

[solomonneas]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.