fix(terminal-review): stop injecting user-global context into the reviewer session

[stephanbrez]

Problem

The terminal reviewer's system prompt (bundled/prompts/terminal-reviewer/system_prompt.md) declares the original user request and the workspace as its only inputs, and its Forbidden Sources list explicitly bans .claude/skills/, provider subagent definitions, and AGENTS.md shims.

But the runtime violates its own spec: claude-agent-acp defaults to settingSources: ["user", "project", "local"] and leaves the Claude Agent SDK's skill discovery enabled. So every terminal-reviewer session gets the user's global CLAUDE.md, settings.json (including hooks), and skill listings injected into its context before it reads a single instruction. A prompt-level ban cannot un-read what the harness already injected — the reviewer's independence is currently prompt-deep only.

Fix

Pass the adapter's documented NewSessionMeta pass-through on session/new, for the terminal reviewer only:

"_meta": {"claudeCode": {"options": {"settingSources": [], "skills": []}}}

• settingSources: [] — SDK isolation mode: no user/project/local settings.json, no CLAUDE.md files.
• skills: [] — skills are a separate SDK option not governed by settingSources; empty list enables none. This is a context filter, not a sandbox (files stay on disk), but the prompt already forbids reading them — the filter closes the injection channel.

Gated to the claude provider; codex/hermes sessions are unchanged.

Deliberately narrow

Workers and validators are not touched. Global rules files are how users enforce cross-project conventions, and the validator prompt already establishes the source hierarchy (contract defines the evidence floor; skills provide method only). Independence is uniquely the terminal reviewer's requirement.

Non-interactions verified

• _ensure_claude_settings (the defaultMode: auto workaround) is unaffected: the adapter's own SettingsManager loads settings unconditionally from params.cwd and only feeds permission-mode/model resolution — a separate path from the SDK's settingSources.
• Older adapter versions without the _meta.claudeCode.options pass-through ignore _meta entirely — graceful degradation to current behavior.

Consequence worth naming

settingSources: [] also drops the user-global CLAUDE.md, which the Forbidden Sources list doesn't name literally — but the prompt's closed "your only inputs are" list covers it, and settingSources has no finer granularity ("user" is all-or-nothing).

Tests

• Unit: _terminal_reviewer_session_meta returns the isolation options for claude, None for codex/hermes.
• Wiring: run_terminal_review end-to-end via the mock ACP agent, asserting session/new carries the _meta and the handoff round-trips. mock_acp_agent.py grows MOCK_ACP_SESSION_PARAMS_PATH (dump session/new params) and a terminal_review handoff shape — both additive.

uv run pytest: 216 passed, 7 skipped (the pre-existing real-agent smoke skips) on top of main.

🤖 Generated with Claude Code