@cursor/july 0.1.92 → 0.1.93

package/src/internal/review-comments.ts

@@ -85,77 +85,111 @@ export type ScmReviewTarget = {
   prNumber: number;
 };
 
+/** Optional structured logger for the read/resolve seams (`[asr]`-style). */
+export type ReviewCommentLog = (message: string) => void;
+
 /**
- * One existing inline review comment, provider-neutral.
+ * One inline review-thread comment from a PR-wide listing, provider-neutral.
  *
- * Field names follow Bugbot's `ExistingInlineComment`
- * (`backend/server/src/bugbot/review/applyBugbotPRReview.ts`), which is the
- * shape its resolution judge consumes after normalizing each provider's
- * `getPRComments` output — so the same review logic reads the same way here.
+ * This is the Bugbot listing shape (`minimizePreviousBugBotComments` /
+ * `getBugBotComments` normalize each provider's `getPRComments` output the
+ * same way): a re-review lists everything on the PR and filters on its own
+ * marker, rather than fetching ids it recorded elsewhere.
  */
-export type ExistingReviewComment = {
-  id: number;
+export type ListedReviewComment = {
+  /**
+   * Provider-native comment id, stringified for provider neutrality
+   * (GitHub REST database id in decimal; Origin `cmt_…`).
+   */
+  commentId: string;
+  /** GitHub REST numeric comment id, when the provider exposes one. */
+  numericCommentId?: number;
+  /**
+   * Id of the thread this comment opens, in the form the provider's thread
+   * resolver accepts (GitHub GraphQL thread node id; Origin `cth_…`).
+   */
+  threadId: string;
+  /** Whether the owning thread is already resolved. */
+  resolved: boolean;
   file: string;
   startLine: number;
   endLine: number;
   body: string;
+  /**
+   * Head SHA the comment was filed against (GitHub `originalCommit`; Origin
+   * the thread version's head SHA), when the provider exposes it. This is
+   * the commit a follow-up judge diffs forward from.
+   */
+  commitSha?: string;
+  authorLogin?: string;
+  /**
+   * Whether the SCM attributes the comment to a machine identity — a
+   * GitHub App bot (GraphQL author `__typename: "Bot"`) or an Origin
+   * app/service-account actor. Human accounts are `false`; `undefined`
+   * when the provider did not return an author (e.g. deleted account).
+   * Callers deciding whether a comment is their own must require `true`
+   * AND pin the specific identity (login / app id): body content is
+   * forgeable by any PR participant, and other bots/apps also comment.
+   */
+  authorIsBot?: boolean;
+  /**
+   * Origin app actor id (`app_…`) when the comment was authored by an app
+   * installation. Callers compare it against their own configured app id
+   * to decide the comment is theirs, not merely some app's.
+   */
+  authorAppId?: string;
 };
 
-export type GetReviewCommentsArgs = {
+export type ListReviewCommentsArgs = {
   target: ScmReviewTarget;
-  /** Comment ids to fetch; ids the SCM no longer has are omitted. */
-  commentIds: readonly number[];
   signal?: AbortSignal;
 };
 
 /**
  * Read side of the review-comment seam, mirroring
  * {@link ReviewCommentPublisherImplementation}. Bugbot's equivalent is
- * `IGitProvider.getPRComments`.
- *
- * By id rather than by listing: callers only ever want comments they
- * recorded creating, and a busy PR's comment list runs to thousands, where
- * any page cap silently drops exactly the older comments a re-review needs.
+ * `IGitProvider.getPRComments`: list the PR's inline review threads (their
+ * opening comments) so a re-review can find its own previous comments.
  */
-export type ReviewCommentReaderImplementation = {
-  getReviewComments: (
-    args: GetReviewCommentsArgs
-  ) => Promise<ExistingReviewComment[]>;
+export type ReviewCommentListerImplementation = {
+  listReviewComments: (
+    args: ListReviewCommentsArgs
+  ) => Promise<ListedReviewComment[]>;
 };
 
 export type ResolveReviewThreadsArgs = {
   target: ScmReviewTarget;
-  /** REST comment ids whose threads should be resolved. */
-  commentIds: readonly number[];
+  /** Provider-native thread ids (from {@link ListedReviewComment.threadId}). */
+  threadIds: readonly string[];
   signal?: AbortSignal;
 };
 
 /**
- * Outcome of resolving review threads for a set of comment ids. Callers
- * treat this as best-effort actuation: a failed resolve must not fail the
- * review that already posted.
+ * Outcome of resolving a set of review threads. Callers treat this as
+ * best-effort actuation: a failed resolve must not fail the review that
+ * already posted.
  */
 export type ResolveReviewThreadsResult = {
   requested: number;
   resolved: number;
-  alreadyResolved: number;
-  notFound: number;
   failed: number;
   detail: string;
 };
 
 /**
  * Write side of thread resolution, the counterpart of
- * {@link ReviewCommentReaderImplementation}. Bugbot's equivalent is
+ * {@link ReviewCommentListerImplementation}. Bugbot's equivalent is
  * `IGitProvider.resolveReviewThreadForComment` / `resolveThreads`.
  *
  * GitHub only exposes resolve via GraphQL (`resolveReviewThread`). REST
  * has no equivalent. The mutation runs as whatever identity minted the
  * bound GitHub client — for `githubChannel({ cursorAccount })` that is
  * the Cursor installation, the same identity that posted the comments.
+ * Origin exposes resolve on the public REST API
+ * (`PATCH …/pulls/threads/{thread_id}`).
  */
 export type ReviewThreadResolverImplementation = {
-  resolveReviewThreadsForComments: (
+  resolveReviewThreads: (
     args: ResolveReviewThreadsArgs
   ) => Promise<ResolveReviewThreadsResult>;
 };
@@ -169,23 +203,25 @@ export function resolveScmReviewTarget(
 }
 
 /**
- * Reader for a resolved target, mirroring Bugbot's `createPrGitProvider`
+ * Lister for a resolved target, mirroring Bugbot's `createPrGitProvider`
  * dispatch. Returns undefined when the host cannot serve that provider (no
- * GitHub client bound), so callers degrade instead of throwing.
+ * GitHub/Origin client bound), so callers degrade instead of throwing.
  */
-export function createReviewCommentReader(args: {
+export function createReviewCommentLister(args: {
   target: ScmReviewTarget;
   github?: HostGitHubClient;
-}): ReviewCommentReaderImplementation | undefined {
+  origin?: HostOriginReviewClient;
+  log?: ReviewCommentLog;
+}): ReviewCommentListerImplementation | undefined {
   switch (args.target.provider) {
     case "github":
       return args.github === undefined
         ? undefined
-        : createHostGithubReviewCommentReader(args.github);
+        : createHostGithubReviewCommentLister(args.github, args.log);
     case "origin":
-      // Public Origin REST lists discussion comments, not diff-anchored
-      // review threads. Stay undefined until a reader can fetch by id.
-      return undefined;
+      return args.origin === undefined
+        ? undefined
+        : createHostOriginReviewCommentLister(args.origin, args.log);
   }
 }
 
@@ -196,33 +232,39 @@ export function createReviewCommentReader(args: {
 export function createReviewThreadResolver(args: {
   target: ScmReviewTarget;
   github?: HostGitHubClient;
+  origin?: HostOriginReviewClient;
+  log?: ReviewCommentLog;
 }): ReviewThreadResolverImplementation | undefined {
   switch (args.target.provider) {
     case "github":
       return args.github === undefined
         ? undefined
-        : createHostGithubReviewThreadResolver(args.github);
+        : createHostGithubReviewThreadResolver(args.github, args.log);
     case "origin":
-      return undefined;
+      return args.origin === undefined
+        ? undefined
+        : createHostOriginReviewThreadResolver(args.origin, args.log);
   }
 }
 
 /**
- * Resolve the review threads that own `commentIds` on `prUrl`.
+ * Resolve `threadIds` on `prUrl`'s PR.
  *
  * No-ops (never throws) when the PR is on an SCM this host cannot write,
- * no client is bound, or `commentIds` is empty. Same degrade-don't-fail
- * posture as {@link createReviewCommentReader}.
+ * no client is bound, or `threadIds` is empty. Same degrade-don't-fail
+ * posture as {@link createReviewCommentLister}.
  */
-export async function resolveReviewThreadsForComments(args: {
+export async function resolveReviewThreads(args: {
   prUrl: string;
-  commentIds: readonly number[];
+  threadIds: readonly string[];
   github?: HostGitHubClient;
+  origin?: HostOriginReviewClient;
   resolver?: ReviewThreadResolverImplementation;
   signal?: AbortSignal;
+  log?: ReviewCommentLog;
 }): Promise<ResolveReviewThreadsResult> {
-  if (args.commentIds.length === 0) {
-    return skippedResolve("no comments to resolve");
+  if (args.threadIds.length === 0) {
+    return skippedResolve("no threads to resolve");
   }
   const target = resolveScmReviewTarget(args.prUrl);
   if (target === undefined) {
@@ -233,17 +275,17 @@ export async function resolveReviewThreadsForComments(args: {
     createReviewThreadResolver({
       target,
       github: args.github,
+      origin: args.origin,
+      log: args.log,
     });
   if (resolver === undefined) {
     return skippedResolve(
-      target.provider === "github"
-        ? "no GitHub client bound to resolve threads"
-        : `no thread resolver for ${target.provider}`
+      `no ${target.provider} client bound to resolve threads`
     );
   }
-  return resolver.resolveReviewThreadsForComments({
+  return resolver.resolveReviewThreads({
     target,
-    commentIds: args.commentIds,
+    threadIds: args.threadIds,
     signal: args.signal,
   });
 }
@@ -251,52 +293,30 @@ export async function resolveReviewThreadsForComments(args: {
 /** Cap on pages pulled per PR; GitHub serves 100 comments per page. */
 const REVIEW_COMMENTS_MAX_PAGES = 5;
 const REVIEW_COMMENTS_PAGE_SIZE = 100;
-/** Cap on review-thread pages when mapping comment ids to GraphQL thread ids. */
+/** Cap on review-thread pages when listing a PR's inline threads. */
 const REVIEW_THREADS_MAX_PAGES = 20;
 const REVIEW_THREADS_PAGE_SIZE = 100;
-
-/**
- * Reads inline review comments through the host GitHub client (Cursor
- * account lease, App installation token, or PAT).
- */
-export function createHostGithubReviewCommentReader(
-  github: HostGitHubClient
-): ReviewCommentReaderImplementation {
-  return {
-    async getReviewComments({ target, commentIds, signal }) {
-      const [owner, repo] = target.repo.split("/", 2);
-      if (owner === undefined || repo === undefined || repo === "") {
-        return [];
-      }
-      const octokit = await github.getOctokit();
-      const comments: ExistingReviewComment[] = [];
-      for (const commentId of commentIds) {
-        signal?.throwIfAborted();
-        try {
-          const response = await octokit.rest.pulls.getReviewComment({
-            owner,
-            repo,
-            comment_id: commentId,
-          });
-          const normalized = normalizeGithubReviewComment(response.data);
-          if (normalized !== undefined) {
-            comments.push(normalized);
-          }
-        } catch {
-          // Deleted or otherwise unreadable: that finding simply has no
-          // prior text to judge, which is the same as it not being there.
-        }
-      }
-      return comments;
-    },
-  };
-}
+/** Cap on Origin comment pages pulled per PR (100 comments per page). */
+const ORIGIN_COMMENTS_MAX_PAGES = 20;
+const ORIGIN_COMMENTS_PAGE_SIZE = 100;
+
+type GithubThreadCommentNode = {
+  databaseId?: number | null;
+  body?: string | null;
+  author?: { login?: string | null; __typename?: string | null } | null;
+  originalCommit?: { oid?: string | null } | null;
+};
 
 type GithubReviewThreadNode = {
   id?: string;
   isResolved?: boolean;
+  path?: string | null;
+  line?: number | null;
+  originalLine?: number | null;
+  startLine?: number | null;
+  originalStartLine?: number | null;
   comments?: {
-    nodes?: Array<{ databaseId?: number | null } | null>;
+    nodes?: Array<GithubThreadCommentNode | null>;
   };
 };
 
@@ -318,112 +338,185 @@ type GithubResolveThreadMutation = {
 };
 
 /**
- * Resolves inline review threads through the host GitHub client (Cursor
- * account lease, App installation token, or PAT). GitHub GraphQL has no
- * comment→thread field, so this pages the PR's review threads and matches
- * each REST comment id by `databaseId` — the same approach as Bugbot's
- * `resolveReviewThreadForComment`.
+ * Repo-scope header for GraphQL calls through the Cursor github-proxy.
+ *
+ * The proxy authorizes each call from `x-cursor-github-repos`, which the
+ * channel Octokit derives from REST URLs (`/repos/{owner}/{repo}/…`).
+ * GraphQL posts to `/graphql` — no repo in the URL — so without this
+ * explicit header every GraphQL call is rejected in proxy mode. Harmless
+ * against api.github.com, which ignores unknown headers.
  */
-export function createHostGithubReviewThreadResolver(
-  github: HostGitHubClient
-): ReviewThreadResolverImplementation {
+function githubGraphqlScopeHeaders(repo: string): Record<string, string> {
+  return { "x-cursor-github-repos": repo.toLowerCase() };
+}
+
+/**
+ * GitHub review thread → {@link ListedReviewComment} (its opening comment).
+ *
+ * Prefers the `original*` line fields — the position as of the review the
+ * thread belongs to. `line` drifts as the PR gains commits, so a caller
+ * correlating a comment with the review that produced it needs the original
+ * position, the same fields Bugbot carries on `PullRequestCommentOutput`.
+ */
+export function listedCommentFromGithubThread(
+  thread: GithubReviewThreadNode
+): ListedReviewComment | undefined {
+  const opener = thread.comments?.nodes?.[0];
+  if (
+    thread.id === undefined ||
+    thread.id === "" ||
+    opener === null ||
+    opener === undefined ||
+    opener.databaseId === undefined ||
+    opener.databaseId === null ||
+    typeof opener.body !== "string" ||
+    typeof thread.path !== "string" ||
+    thread.path === ""
+  ) {
+    return undefined;
+  }
+  // Take both lines from the same position set. Mixing them (original end
+  // line with the drifted current start line) would describe a range that
+  // never existed in either revision.
+  const original = thread.originalLine ?? undefined;
+  const endLine = original ?? thread.line ?? undefined;
+  if (endLine === undefined) {
+    return undefined;
+  }
+  const startLine =
+    (original === undefined ? thread.startLine : thread.originalStartLine) ??
+    endLine;
+  const commitSha = opener.originalCommit?.oid ?? undefined;
+  const authorLogin = opener.author?.login ?? undefined;
+  const authorType = opener.author?.__typename ?? undefined;
   return {
-    async resolveReviewThreadsForComments({ target, commentIds, signal }) {
-      const uniqueIds = [...new Set(commentIds.filter((id) => id > 0))];
-      if (uniqueIds.length === 0) {
-        return skippedResolve("no comments to resolve");
-      }
+    commentId: String(opener.databaseId),
+    numericCommentId: opener.databaseId,
+    threadId: thread.id,
+    resolved: thread.isResolved === true,
+    file: thread.path,
+    startLine,
+    endLine,
+    body: opener.body,
+    ...(commitSha === undefined ? {} : { commitSha }),
+    ...(authorLogin === undefined ? {} : { authorLogin }),
+    ...(authorType === undefined ? {} : { authorIsBot: authorType === "Bot" }),
+  };
+}
+
+/**
+ * Lists the PR's inline review threads (their opening comments) through the
+ * host GitHub client (Cursor account lease, App installation token, or
+ * PAT). One paged GraphQL query yields, per thread: the resolvable thread
+ * node id, its resolution state, the opener's body/position, and the commit
+ * it was filed against — everything a Bugbot-style re-review needs.
+ */
+export function createHostGithubReviewCommentLister(
+  github: HostGitHubClient,
+  log?: ReviewCommentLog
+): ReviewCommentListerImplementation {
+  return {
+    async listReviewComments({ target, signal }) {
       const [owner, repo] = target.repo.split("/", 2);
       if (owner === undefined || repo === undefined || repo === "") {
-        return skippedResolve("unparseable owner/repo from PR URL");
+        log?.(`github list: unparseable owner/repo "${target.repo}"`);
+        return [];
       }
-
-      try {
-        const octokit = await github.getOctokit();
-        const wanted = new Set(uniqueIds);
-        const matched = new Map<
-          number,
-          { threadId: string; isResolved: boolean }
-        >();
-
-        let cursor: string | null = null;
-        for (let page = 0; page < REVIEW_THREADS_MAX_PAGES; page++) {
-          signal?.throwIfAborted();
-          const response = (await octokit.graphql(REVIEW_THREADS_FOR_PR_QUERY, {
+      const octokit = await github.getOctokit();
+      const comments: ListedReviewComment[] = [];
+      let threadCount = 0;
+      let cursor: string | null = null;
+      for (let page = 0; page < REVIEW_THREADS_MAX_PAGES; page++) {
+        signal?.throwIfAborted();
+        const response = (await octokit.graphql(
+          REVIEW_THREAD_COMMENTS_FOR_PR_QUERY,
+          {
             owner,
             repo,
             number: target.prNumber,
             cursor,
-          })) as GithubReviewThreadsQuery;
-          const reviewThreads = response.repository?.pullRequest?.reviewThreads;
-          for (const thread of reviewThreads?.nodes ?? []) {
-            if (thread?.id === undefined || thread.id === "") {
-              continue;
-            }
-            for (const comment of thread.comments?.nodes ?? []) {
-              const databaseId = comment?.databaseId;
-              if (
-                databaseId !== undefined &&
-                databaseId !== null &&
-                wanted.has(databaseId) &&
-                !matched.has(databaseId)
-              ) {
-                matched.set(databaseId, {
-                  threadId: thread.id,
-                  isResolved: thread.isResolved === true,
-                });
-              }
-            }
+            headers: githubGraphqlScopeHeaders(target.repo),
           }
-          if (matched.size === wanted.size) {
-            break;
+        )) as GithubReviewThreadsQuery;
+        const reviewThreads = response.repository?.pullRequest?.reviewThreads;
+        for (const thread of reviewThreads?.nodes ?? []) {
+          if (thread === null || thread === undefined) {
+            continue;
           }
-          const pageInfo = reviewThreads?.pageInfo;
-          if (pageInfo?.hasNextPage !== true || !pageInfo.endCursor) {
-            break;
+          threadCount += 1;
+          const listed = listedCommentFromGithubThread(thread);
+          if (listed !== undefined) {
+            comments.push(listed);
           }
-          cursor = pageInfo.endCursor;
         }
+        const pageInfo = reviewThreads?.pageInfo;
+        if (pageInfo?.hasNextPage !== true || !pageInfo.endCursor) {
+          break;
+        }
+        cursor = pageInfo.endCursor;
+      }
+      log?.(
+        `github list: ${target.repo}#${target.prNumber} has ${threadCount} review thread(s), ${comments.length} with a normalizable opening comment`
+      );
+      return comments;
+    },
+  };
+}
 
-        const toResolve = [
-          ...new Map(
-            [...matched.values()]
-              .filter((thread) => !thread.isResolved)
-              .map((thread) => [thread.threadId, thread.threadId])
-          ).values(),
-        ];
-        let resolved = 0;
-        let failed = 0;
-        for (const threadId of toResolve) {
+/**
+ * Resolves inline review threads by GraphQL thread node id through the host
+ * GitHub client (Cursor account lease, App installation token, or PAT) —
+ * the id the lister already returned, so no comment→thread mapping pass is
+ * needed. Same mutation as Bugbot's `resolveReviewThreadForComment`.
+ */
+export function createHostGithubReviewThreadResolver(
+  github: HostGitHubClient,
+  log?: ReviewCommentLog
+): ReviewThreadResolverImplementation {
+  return {
+    async resolveReviewThreads({ target, threadIds, signal }) {
+      const uniqueIds = [...new Set(threadIds.filter((id) => id !== ""))];
+      if (uniqueIds.length === 0) {
+        return skippedResolve("no threads to resolve");
+      }
+      let resolved = 0;
+      let failed = 0;
+      try {
+        const octokit = await github.getOctokit();
+        for (const threadId of uniqueIds) {
           signal?.throwIfAborted();
           try {
             const mutation = (await octokit.graphql(
               RESOLVE_REVIEW_THREAD_MUTATION,
-              { threadId }
+              {
+                threadId,
+                headers: githubGraphqlScopeHeaders(target.repo),
+              }
             )) as GithubResolveThreadMutation;
             if (mutation.resolveReviewThread?.thread?.isResolved === true) {
               resolved += 1;
+              log?.(`github resolve: thread ${threadId} resolved`);
             } else {
               failed += 1;
+              log?.(
+                `github resolve: thread ${threadId} mutation did not mark the thread resolved`
+              );
+            }
+          } catch (error) {
+            if (signal?.aborted) {
+              throw error;
             }
-          } catch {
             failed += 1;
+            log?.(
+              `github resolve: thread ${threadId} failed: ${error instanceof Error ? error.message : String(error)}`
+            );
           }
         }
-
-        const alreadyResolved = new Set(
-          [...matched.values()]
-            .filter((thread) => thread.isResolved)
-            .map((thread) => thread.threadId)
-        ).size;
-        const notFound = wanted.size - matched.size;
         return {
           requested: uniqueIds.length,
           resolved,
-          alreadyResolved,
-          notFound,
           failed,
-          detail: `resolved ${resolved} of ${toResolve.length} open thread(s) for ${uniqueIds.length} comment(s) via host GitHub (${alreadyResolved} already resolved, ${notFound} not found, ${failed} failed)`,
+          detail: `resolved ${resolved} of ${uniqueIds.length} thread(s) on ${target.repo}#${target.prNumber} via host GitHub (${failed} failed)`,
         };
       } catch (error) {
         if (signal?.aborted) {
@@ -431,10 +524,8 @@ export function createHostGithubReviewThreadResolver(
         }
         return {
           requested: uniqueIds.length,
-          resolved: 0,
-          alreadyResolved: 0,
-          notFound: 0,
-          failed: uniqueIds.length,
+          resolved,
+          failed: uniqueIds.length - resolved,
           detail: `host GitHub thread resolve failed: ${error instanceof Error ? error.message : String(error)}`,
         };
       }
@@ -442,8 +533,8 @@ export function createHostGithubReviewThreadResolver(
   };
 }
 
-const REVIEW_THREADS_FOR_PR_QUERY = `
-query ReviewThreadsForPr(
+const REVIEW_THREAD_COMMENTS_FOR_PR_QUERY = `
+query ReviewThreadCommentsForPr(
   $owner: String!
   $repo: String!
   $number: Int!
@@ -455,8 +546,18 @@ query ReviewThreadsForPr(
         nodes {
           id
           isResolved
-          comments(first: ${REVIEW_THREADS_PAGE_SIZE}) {
-            nodes { databaseId }
+          path
+          line
+          originalLine
+          startLine
+          originalStartLine
+          comments(first: 1) {
+            nodes {
+              databaseId
+              body
+              author { login __typename }
+              originalCommit { oid }
+            }
           }
         }
         pageInfo { hasNextPage endCursor }
@@ -474,46 +575,241 @@ mutation ResolveReviewThread($threadId: ID!) {
 }
 `;
 
-type GithubReviewCommentLike = {
-  id: number;
-  path: string;
-  body: string;
-  line?: number | null;
-  start_line?: number | null;
-  original_line?: number | null;
-  original_start_line?: number | null;
+const GITHUB_VIEWER_LOGIN_QUERY = `
+query ViewerLogin {
+  viewer { login }
+}
+`;
+
+/**
+ * The login the bound GitHub client itself acts as — the identity its posts
+ * appear under. Works for installation tokens too (GraphQL `viewer` returns
+ * the app's bot, e.g. `cursor[bot]`), so a reader can trust comments whose
+ * author is provably the same identity it posts with, across every
+ * environment's app (prod/staging/cloud-dev/custom) without hardcoding.
+ * `repo` scopes the call through the Cursor github-proxy (the minted token
+ * — and so the viewer — is per-repo there). Best-effort: `undefined` when
+ * the lookup fails.
+ */
+export async function fetchGithubSelfLogin(
+  github: HostGitHubClient,
+  args: { repo: string; signal?: AbortSignal; log?: ReviewCommentLog }
+): Promise<string | undefined> {
+  try {
+    const octokit = await github.getOctokit();
+    args.signal?.throwIfAborted();
+    const response = (await octokit.graphql(GITHUB_VIEWER_LOGIN_QUERY, {
+      headers: githubGraphqlScopeHeaders(args.repo),
+    })) as {
+      viewer?: { login?: string | null } | null;
+    };
+    const login = response.viewer?.login;
+    return typeof login === "string" && login !== "" ? login : undefined;
+  } catch (error) {
+    if (args.signal?.aborted) {
+      throw error;
+    }
+    args.log?.(
+      `github viewer lookup failed: ${error instanceof Error ? error.message : String(error)}`
+    );
+    return undefined;
+  }
+}
+
+type OriginThreadJson = {
+  id?: string;
+  path?: string;
+  startLine?: number;
+  endLine?: number;
+  resolvedAt?: string;
+  version?: { headSha?: string };
 };
 
 /**
- * GitHub review comment → {@link ExistingReviewComment}.
- *
- * Prefers the `original_*` fields — the path/lines/commit as of the review
- * the comment belongs to. `line` drifts as the PR gains commits, so a
- * caller correlating a comment with the review that produced it needs the
- * original position, the same fields Bugbot carries on
- * `PullRequestCommentOutput`.
+ * Public `OriginActor` proto3 JSON: a `user` / `app` / `serviceAccount`
+ * oneof (see `origin_actor.proto`).
  */
-export function normalizeGithubReviewComment(
-  comment: GithubReviewCommentLike
-): ExistingReviewComment | undefined {
-  // Take both lines from the same position set. Mixing them (original end
-  // line with the drifted current start line) would describe a range that
-  // never existed in either revision.
-  const original = comment.original_line ?? undefined;
-  const endLine = original ?? comment.line ?? undefined;
-  if (endLine === undefined || endLine === null) {
+type OriginActorJson = {
+  user?: { id?: string; email?: string };
+  app?: { id?: string; slug?: string };
+  serviceAccount?: { id?: string };
+};
+
+type OriginCommentJson = {
+  id?: string;
+  body?: string;
+  thread?: OriginThreadJson;
+  author?: OriginActorJson;
+};
+
+type OriginListCommentsJson = {
+  comments?: Array<OriginCommentJson | null>;
+  nextPageToken?: string;
+};
+
+/**
+ * Origin public comment → {@link ListedReviewComment}. Only line-anchored
+ * threads qualify (general-discussion and file-level threads carry no
+ * position a review finding can be pinned to).
+ */
+export function listedCommentFromOriginComment(
+  comment: OriginCommentJson
+): ListedReviewComment | undefined {
+  const thread = comment.thread;
+  if (
+    typeof comment.id !== "string" ||
+    comment.id === "" ||
+    typeof comment.body !== "string" ||
+    thread === undefined ||
+    typeof thread.id !== "string" ||
+    thread.id === "" ||
+    typeof thread.path !== "string" ||
+    thread.path === "" ||
+    typeof thread.startLine !== "number" ||
+    thread.startLine <= 0
+  ) {
     return undefined;
   }
-  const startLine =
-    (original === undefined
-      ? comment.start_line
-      : comment.original_start_line) ?? endLine;
+  const startLine = thread.startLine;
+  const endLine =
+    typeof thread.endLine === "number" && thread.endLine >= startLine
+      ? thread.endLine
+      : startLine;
+  const commitSha = thread.version?.headSha;
+  const author = comment.author;
+  const authorLogin = author?.app?.slug ?? author?.user?.email;
+  // App and service-account actors are machine identities; only a `user`
+  // actor is a human PR participant.
+  const authorIsBot =
+    author === undefined
+      ? undefined
+      : author.app !== undefined || author.serviceAccount !== undefined;
+  const authorAppId = author?.app?.id;
   return {
-    id: comment.id,
-    file: comment.path,
+    commentId: comment.id,
+    threadId: thread.id,
+    resolved: typeof thread.resolvedAt === "string" && thread.resolvedAt !== "",
+    file: thread.path,
     startLine,
     endLine,
     body: comment.body,
+    ...(typeof commitSha === "string" && commitSha !== "" ? { commitSha } : {}),
+    ...(typeof authorLogin === "string" && authorLogin !== ""
+      ? { authorLogin }
+      : {}),
+    ...(authorIsBot === undefined ? {} : { authorIsBot }),
+    ...(typeof authorAppId === "string" && authorAppId !== ""
+      ? { authorAppId }
+      : {}),
+  };
+}
+
+/**
+ * Lists the PR's inline review threads through the Origin public REST API
+ * (`GET …/pulls/{n}/comments`, paged). The flattened comment list is
+ * ordered by creation time, so the first comment seen per thread is the
+ * thread opener; replies are dropped.
+ */
+export function createHostOriginReviewCommentLister(
+  origin: HostOriginReviewClient,
+  log?: ReviewCommentLog
+): ReviewCommentListerImplementation {
+  return {
+    async listReviewComments({ target, signal }) {
+      const [owner, repo] = target.repo.split("/", 2);
+      if (owner === undefined || repo === undefined || repo === "") {
+        log?.(`origin list: unparseable owner/repo "${target.repo}"`);
+        return [];
+      }
+      const basePath = `/v1/origin/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/pulls/${target.prNumber}/comments`;
+      const comments: ListedReviewComment[] = [];
+      const seenThreads = new Set<string>();
+      let totalComments = 0;
+      let pageToken = "";
+      for (let page = 0; page < ORIGIN_COMMENTS_MAX_PAGES; page++) {
+        signal?.throwIfAborted();
+        const query =
+          pageToken === ""
+            ? `?pageSize=${ORIGIN_COMMENTS_PAGE_SIZE}`
+            : `?pageSize=${ORIGIN_COMMENTS_PAGE_SIZE}&pageToken=${encodeURIComponent(pageToken)}`;
+        const response = (await origin.request({
+          method: "GET",
+          path: `${basePath}${query}`,
+        })) as OriginListCommentsJson | null | undefined;
+        for (const comment of response?.comments ?? []) {
+          if (comment === null || comment === undefined) {
+            continue;
+          }
+          totalComments += 1;
+          const listed = listedCommentFromOriginComment(comment);
+          if (listed === undefined || seenThreads.has(listed.threadId)) {
+            // Not line-anchored, or a reply on a thread whose opener was
+            // already taken (the list is oldest-first).
+            continue;
+          }
+          seenThreads.add(listed.threadId);
+          comments.push(listed);
+        }
+        pageToken = response?.nextPageToken ?? "";
+        if (pageToken === "") {
+          break;
+        }
+      }
+      log?.(
+        `origin list: ${target.repo}#${target.prNumber} has ${totalComments} comment(s), ${comments.length} line-anchored thread opener(s)`
+      );
+      return comments;
+    },
+  };
+}
+
+/**
+ * Resolves Origin comment threads through the public REST API
+ * (`PATCH …/pulls/threads/{thread_id}` with `resolved: true`).
+ */
+export function createHostOriginReviewThreadResolver(
+  origin: HostOriginReviewClient,
+  log?: ReviewCommentLog
+): ReviewThreadResolverImplementation {
+  return {
+    async resolveReviewThreads({ target, threadIds, signal }) {
+      const uniqueIds = [...new Set(threadIds.filter((id) => id !== ""))];
+      if (uniqueIds.length === 0) {
+        return skippedResolve("no threads to resolve");
+      }
+      const [owner, repo] = target.repo.split("/", 2);
+      if (owner === undefined || repo === undefined || repo === "") {
+        return skippedResolve("unparseable owner/repo from PR URL");
+      }
+      let resolved = 0;
+      let failed = 0;
+      for (const threadId of uniqueIds) {
+        signal?.throwIfAborted();
+        try {
+          await origin.request({
+            method: "PATCH",
+            path: `/v1/origin/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/pulls/threads/${encodeURIComponent(threadId)}`,
+            body: { resolved: true },
+          });
+          resolved += 1;
+          log?.(`origin resolve: thread ${threadId} resolved`);
+        } catch (error) {
+          if (signal?.aborted) {
+            throw error;
+          }
+          failed += 1;
+          log?.(
+            `origin resolve: thread ${threadId} failed: ${error instanceof Error ? error.message : String(error)}`
+          );
+        }
+      }
+      return {
+        requested: uniqueIds.length,
+        resolved,
+        failed,
+        detail: `resolved ${resolved} of ${uniqueIds.length} thread(s) on ${target.repo}#${target.prNumber} via host Origin (${failed} failed)`,
+      };
+    },
   };
 }
 
@@ -606,9 +902,12 @@ export function createReviewCommentPublisher(args: {
 /**
  * Posts a COMMENT-verdict Origin review through the public REST API.
  *
- * Public Origin REST has no diff-anchored review comments (those are an
- * internal CreateCommentThread RPC). Inline comments in the request are
- * folded into the review body so findings still land on the PR.
+ * Inline comments post as diff-anchored threads via the review's
+ * `comments` field (`ReviewCommentInput` with an `InlineCommentAnchor`).
+ * Origin rejects the whole request with INVALID_ARGUMENT when any anchor
+ * is off the reviewed version's diff — the caller's body-only retry (the
+ * same fallback GitHub's 422 takes) then folds the findings into the
+ * review body.
  */
 export function createHostOriginReviewPublisher(
   origin: HostOriginReviewClient
@@ -879,15 +1178,20 @@ async function postReviewViaHostOrigin(
       path: `/v1/origin/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/pulls/${target.prNumber}/reviews`,
       body: {
         verdict: "comment",
-        body: originReviewBody(args),
+        body: args.message,
+        comments: args.comments.map(toOriginReviewCommentInput),
       },
     });
+    const inlineCommentCount = args.comments.length;
     return {
       posted: true,
       publisher: "host_origin",
-      mode: "review_body_only",
-      inlineCommentCount: 0,
-      detail: `posted Origin review on ${target.repo}#${target.prNumber}`,
+      mode:
+        inlineCommentCount > 0
+          ? "review_with_inline_comments"
+          : "review_body_only",
+      inlineCommentCount,
+      detail: `posted Origin review on ${target.repo}#${target.prNumber} with ${inlineCommentCount} inline comment(s)`,
     };
   } catch (error) {
     if (args.signal?.aborted) {
@@ -899,32 +1203,41 @@ async function postReviewViaHostOrigin(
   }
 }
 
-/**
- * Origin's public CreatePullRequestReview has a body, not inline comments.
- * Fold attempted anchors into the summary so findings are not dropped.
- */
-function originReviewBody(args: ReviewCommentPostArgs): string {
-  if (args.comments.length === 0) {
-    return args.message;
-  }
-  const sections = args.comments.map((comment) => {
-    const location =
-      comment.start_line !== undefined &&
-      comment.start_line > 0 &&
-      comment.start_line !== comment.line
-        ? `${comment.file}:${comment.start_line}-${comment.line}`
-        : `${comment.file}:${comment.line}`;
-    return `### \`${location}\`\n\n${comment.body}`;
-  });
-  return [args.message, ...sections].join("\n\n");
+type OriginReviewCommentInput = {
+  body: string;
+  inline: {
+    path: string;
+    side: "right";
+    startLine: number;
+    endLine?: number;
+  };
+};
+
+/** Provider-neutral inline comment → Origin `ReviewCommentInput`. */
+function toOriginReviewCommentInput(
+  comment: ReviewInlineComment
+): OriginReviewCommentInput {
+  const startLine =
+    comment.start_line !== undefined &&
+    comment.start_line > 0 &&
+    comment.start_line < comment.line
+      ? comment.start_line
+      : comment.line;
+  return {
+    body: comment.body,
+    inline: {
+      path: comment.file,
+      side: "right",
+      startLine,
+      ...(startLine === comment.line ? {} : { endLine: comment.line }),
+    },
+  };
 }
 
 function skippedResolve(detail: string): ResolveReviewThreadsResult {
   return {
     requested: 0,
     resolved: 0,
-    alreadyResolved: 0,
-    notFound: 0,
     failed: 0,
     detail,
   };