@expo/code-review-cli 0.3.0 → 0.5.0

package/build/core/router.js

@@ -1,27 +1,27 @@
-import { promptAndParse } from './opencode.js';
-import { buildRouterSystem, buildRouterTask } from './prompts.js';
-import { parseRouteOutput } from './schema.js';
+import { promptAndParse } from "./opencode.js";
+import { buildRouterSystem, buildRouterTask } from "./prompts.js";
+import { parseRouteOutput } from "./schema.js";
 /**
  * Ask the model which agents are relevant to the changed files. Agents marked
  * `alwaysRun` are unioned in regardless. Falls back to ALL agents if the router
  * returns nothing usable or errors — a review must never run with zero agents.
  */
 export async function routeAgents(handle, config, files) {
-    const always = config.agents.filter(agent => agent.alwaysRun);
+    const always = config.agents.filter((agent) => agent.alwaysRun);
     try {
         const { value } = await promptAndParse(handle, {
-            agent: 'coordinator',
+            agent: "coordinator",
             system: buildRouterSystem(),
             text: buildRouterTask(config.agents, files),
-            title: 'route',
+            title: "route",
         }, parseRouteOutput);
-        const byId = new Map(config.agents.map(agent => [agent.id, agent]));
+        const byId = new Map(config.agents.map((agent) => [agent.id, agent]));
         const picked = value.agents
-            .map(id => byId.get(id))
+            .map((id) => byId.get(id))
             .filter((agent) => Boolean(agent));
-        const chosenIds = new Set([...picked, ...always].map(agent => agent.id));
+        const chosenIds = new Set([...picked, ...always].map((agent) => agent.id));
         // Preserve config order and dedupe.
-        const chosen = config.agents.filter(agent => chosenIds.has(agent.id));
+        const chosen = config.agents.filter((agent) => chosenIds.has(agent.id));
         if (chosen.length === 0) {
             return { agents: config.agents, routed: false };
         }

package/build/core/schema.js

@@ -1,12 +1,12 @@
-import { createHash } from 'node:crypto';
-import { z } from 'zod';
-import { normalizeCode } from './util.js';
+import { createHash } from "node:crypto";
+import { z } from "zod";
+import { normalizeCode } from "./util.js";
 /** Severity levels, ordered most→least severe for sorting/rendering. */
-export const SEVERITIES = ['critical', 'warning', 'suggestion'];
+export const SEVERITIES = ["critical", "warning", "suggestion"];
 /** Sort rank for severities (0 = most severe). Single source of truth. */
 export const SEVERITY_RANK = { critical: 0, warning: 1, suggestion: 2 };
-export const CATEGORIES = ['correctness', 'quality', 'security', 'secrets'];
-export const DECISIONS = ['approve', 'approve_with_comments', 'request_changes'];
+export const CATEGORIES = ["correctness", "quality", "security", "secrets"];
+export const DECISIONS = ["approve", "approve_with_comments", "request_changes"];
 export const FindingSchema = z.object({
     severity: z.enum(SEVERITIES),
     category: z.enum(CATEGORIES),
@@ -25,7 +25,7 @@ export const FindingSchema = z.object({
 /** A verifier's verdict on whether a finding is real (adversarial refute pass). */
 export const VerdictSchema = z.object({
     verified: z.boolean(),
-    reason: z.string().default(''),
+    reason: z.string().default(""),
 });
 export function parseVerdict(text) {
     return VerdictSchema.parse(extractJsonObject(text));
@@ -60,10 +60,24 @@ const MIN_FP_EVIDENCE_LEN = 12;
  * there's too little evidence to key on.
  */
 export function fingerprintFinding(finding) {
-    const evidence = normalizeCode(finding.evidence ?? '');
+    const evidence = normalizeCode(finding.evidence ?? "");
     const key = evidence.length >= MIN_FP_EVIDENCE_LEN ? evidence : normalizeCode(finding.title);
-    const normalized = ['v2', finding.file, finding.category, key].join('|');
-    return createHash('sha1').update(normalized).digest('hex').slice(0, 12);
+    const normalized = ["v2", finding.file, finding.category, key].join("|");
+    return createHash("sha1").update(normalized).digest("hex").slice(0, 12);
+}
+/**
+ * Namespace a finding's fingerprint by scope so cross-scope dismissals never
+ * collide. The DEFAULT scope (config '.') passes `null` and keeps the plain
+ * fingerprintFinding value, so pre-routing dismissal state carries over unchanged
+ * (risk 9). Non-default scopes hash into the same hex alphabet the dismiss command
+ * sanitizes to (dismiss.ts strips /[^a-f0-9]/), at the same length.
+ */
+export function scopedFingerprint(scopeName, finding) {
+    const fp = fingerprintFinding(finding);
+    if (!scopeName) {
+        return fp;
+    }
+    return createHash("sha1").update(`scope|${scopeName}|${fp}`).digest("hex").slice(0, fp.length);
 }
 /**
  * Extract the JSON payload from an LLM response. Prefers the last fenced
@@ -76,8 +90,8 @@ export function extractJsonObject(text) {
     if (fenceMatches.length > 0) {
         candidates.push(fenceMatches[fenceMatches.length - 1][1].trim());
     }
-    const firstBrace = text.indexOf('{');
-    const lastBrace = text.lastIndexOf('}');
+    const firstBrace = text.indexOf("{");
+    const lastBrace = text.lastIndexOf("}");
     if (firstBrace !== -1 && lastBrace > firstBrace) {
         candidates.push(text.slice(firstBrace, lastBrace + 1));
     }

package/build/core/step-summary.js

@@ -0,0 +1,18 @@
+import { appendFile } from "node:fs/promises";
+/**
+ * Append a markdown section to the GitHub Actions step summary, so a run's
+ * output survives on the workflow-run page after the PR comment is upserted
+ * away by the next run. No-op outside Actions (GITHUB_STEP_SUMMARY unset).
+ */
+export async function appendStepSummary(markdown) {
+    const file = process.env.GITHUB_STEP_SUMMARY;
+    if (!file) {
+        return;
+    }
+    try {
+        await appendFile(file, `${markdown}\n\n`, "utf8");
+    }
+    catch {
+        // Observability must never break a review.
+    }
+}

package/build/core/suppress.js

@@ -1,6 +1,6 @@
-import { readFile } from 'node:fs/promises';
-import path from 'node:path';
-const DIRECTIVE = 'expo-code-review-ignore';
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+const DIRECTIVE = "expo-code-review-ignore";
 /**
  * Deterministic backstop for the inline `expo-code-review-ignore` directive (which
  * was previously prompt-only, i.e. honored only if the model chose to). Drops a
@@ -20,7 +20,7 @@ export async function applyInlineIgnores(findings, cwd, onProgress) {
             kept.push(finding);
             continue;
         }
-        if (finding.severity === 'critical' || finding.category === 'secrets') {
+        if (finding.severity === "critical" || finding.category === "secrets") {
             kept.push(finding);
             onProgress?.(`  inline-ignore present but NOT honored for ${finding.severity}/${finding.category} "${finding.title}"`);
         }
@@ -40,8 +40,8 @@ async function hasDirectiveNear(finding, cwd, cache) {
         return false;
     }
     const idx = finding.line - 1; // 1-based → 0-based
-    const flagged = lines[idx] ?? '';
-    const above = idx > 0 ? (lines[idx - 1] ?? '') : '';
+    const flagged = lines[idx] ?? "";
+    const above = idx > 0 ? (lines[idx - 1] ?? "") : "";
     return flagged.includes(DIRECTIVE) || above.includes(DIRECTIVE);
 }
 async function readLines(file, cwd, cache) {
@@ -50,7 +50,7 @@ async function readLines(file, cwd, cache) {
     }
     let lines;
     try {
-        lines = (await readFile(path.resolve(cwd, file), 'utf8')).split('\n');
+        lines = (await readFile(path.resolve(cwd, file), "utf8")).split("\n");
     }
     catch {
         lines = null;

package/build/core/tools.js

@@ -1,16 +1,16 @@
 /** The OpenCode tool names the reviewer toggles. Single source of truth so the
  * agent and coordinator tool maps can't drift apart. */
 export const TOOL_NAMES = [
-    'read',
-    'grep',
-    'glob',
-    'list',
-    'bash',
-    'write',
-    'edit',
-    'patch',
+    "read",
+    "grep",
+    "glob",
+    "list",
+    "bash",
+    "write",
+    "edit",
+    "patch",
 ];
 /** Build a full tool map with only the listed tools enabled. */
 export function toolMap(enabled) {
-    return Object.fromEntries(TOOL_NAMES.map(name => [name, enabled.includes(name)]));
+    return Object.fromEntries(TOOL_NAMES.map((name) => [name, enabled.includes(name)]));
 }

package/build/core/util.js

@@ -1,5 +1,5 @@
 export function sleep(ms) {
-    return new Promise(resolve => setTimeout(resolve, ms));
+    return new Promise((resolve) => setTimeout(resolve, ms));
 }
 /** Extract a human-readable message from an unknown thrown value. */
 export function errorMessage(error) {
@@ -7,5 +7,5 @@ export function errorMessage(error) {
 }
 /** Collapse whitespace + lowercase — for tolerant code matching / fingerprinting. */
 export function normalizeCode(text) {
-    return text.replace(/\s+/g, ' ').trim().toLowerCase();
+    return text.replace(/\s+/g, " ").trim().toLowerCase();
 }

package/build/core/verify.js

@@ -1,9 +1,9 @@
-import { readFile } from 'node:fs/promises';
-import path from 'node:path';
-import { parseVerdict } from './schema.js';
-import { addTokenUsage, promptAndParse, VERIFIER_AGENT } from './opencode.js';
-import { buildVerifierSystem, buildVerifierTask } from './prompts.js';
-import { errorMessage, normalizeCode } from './util.js';
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { parseVerdict } from "./schema.js";
+import { addTokenUsage, promptAndParse, VERIFIER_AGENT } from "./opencode.js";
+import { buildVerifierSystem, buildVerifierTask } from "./prompts.js";
+import { errorMessage, normalizeCode } from "./util.js";
 // Verification runs after coordination (a serial tail step); keep it short. It
 // runs criticals in parallel, so this bounds the added latency regardless of count.
 const VERIFY_TIMEOUT_MS = 3 * 60 * 1000;
@@ -18,9 +18,9 @@ const MIN_EVIDENCE_LEN = 12;
 export function evidenceFragments(evidence) {
     return evidence
         .split(/\r?\n|…|\.\.\./)
-        .map(line => line.replace(/^[+\-\s]*/, '').replace(/^(\/\/+|#+|\*+|\/\*)\s?/, ''))
+        .map((line) => line.replace(/^[+\-\s]*/, "").replace(/^(\/\/+|#+|\*+|\/\*)\s?/, ""))
         .map(normalizeCode)
-        .filter(fragment => fragment.length >= MIN_EVIDENCE_LEN);
+        .filter((fragment) => fragment.length >= MIN_EVIDENCE_LEN);
 }
 /**
  * Does the finding's `evidence` correspond to code in the file?
@@ -36,28 +36,28 @@ export function evidenceFragments(evidence) {
 export function matchEvidence(evidence, content) {
     const normEvidence = normalizeCode(evidence);
     if (normEvidence.length < MIN_EVIDENCE_LEN) {
-        return 'unknown';
+        return "unknown";
     }
     const normContent = normalizeCode(content);
     if (normContent.includes(normEvidence)) {
-        return 'present';
+        return "present";
     }
     const fragments = evidenceFragments(evidence);
     if (fragments.length === 0) {
-        return 'unknown';
+        return "unknown";
     }
-    return fragments.some(fragment => normContent.includes(fragment)) ? 'present' : 'absent';
+    return fragments.some((fragment) => normContent.includes(fragment)) ? "present" : "absent";
 }
 /** Read the cited file and grade the evidence against it (see matchEvidence). */
 async function evidencePresence(finding, cwd) {
     let content;
     try {
-        content = await readFile(path.resolve(cwd, finding.file), 'utf8');
+        content = await readFile(path.resolve(cwd, finding.file), "utf8");
     }
     catch {
-        return 'unknown';
+        return "unknown";
     }
-    return matchEvidence(finding.evidence ?? '', content);
+    return matchEvidence(finding.evidence ?? "", content);
 }
 /**
  * Guard against hallucinated findings before they're surfaced, WITHOUT silently
@@ -81,6 +81,7 @@ async function evidencePresence(finding, cwd) {
 export async function verifyFindings(handle, findings, cwd, onProgress) {
     const dropped = [];
     let cost = 0;
+    let model;
     const tokens = {};
     // Phase 1 — deterministic quote-grounding for every finding.
     const checked = await Promise.all(findings.map(async (finding) => ({ finding, presence: await evidencePresence(finding, cwd) })));
@@ -88,42 +89,43 @@ export async function verifyFindings(handle, findings, cwd, onProgress) {
     const verdicts = new Map();
     const toVerify = [];
     for (const { finding, presence } of checked) {
-        if (presence === 'absent' || finding.severity === 'critical') {
+        if (presence === "absent" || finding.severity === "critical") {
             toVerify.push({ finding, presence });
         }
         else {
-            verdicts.set(finding, 'keep'); // grounded (or uncheckable) non-critical
+            verdicts.set(finding, "keep"); // grounded (or uncheckable) non-critical
         }
     }
     // Phase 2 — LLM verify (parallel). Refuted → drop; verified or errored → keep.
     await Promise.all(toVerify.map(async ({ finding, presence }, index) => {
         try {
-            const { value, cost: verifyCost, tokens: verifyTokens } = await promptAndParse(handle, {
+            const { value, cost: verifyCost, tokens: verifyTokens, model: verifyModel, } = await promptAndParse(handle, {
                 agent: VERIFIER_AGENT,
                 system: buildVerifierSystem(),
-                text: buildVerifierTask(finding, { evidenceUngrounded: presence === 'absent' }),
+                text: buildVerifierTask(finding, { evidenceUngrounded: presence === "absent" }),
                 title: `verify-${index}`,
                 maxWaitMs: VERIFY_TIMEOUT_MS,
                 finalizeOnTimeout: true,
             }, parseVerdict);
             cost += verifyCost;
             addTokenUsage(tokens, verifyTokens);
+            model = verifyModel ?? model;
             if (value.verified) {
-                verdicts.set(finding, 'keep');
+                verdicts.set(finding, "keep");
             }
             else {
-                verdicts.set(finding, 'drop');
-                dropped.push({ finding, reason: value.reason || 'refuted by verifier' });
-                onProgress?.(`  verify: dropped ${finding.severity} "${finding.title}" — ${value.reason || 'refuted by verifier'}`);
+                verdicts.set(finding, "drop");
+                dropped.push({ finding, reason: value.reason || "refuted by verifier" });
+                onProgress?.(`  verify: dropped ${finding.severity} "${finding.title}" — ${value.reason || "refuted by verifier"}`);
             }
         }
         catch (error) {
             // Fail open: keep the finding if verification itself failed.
-            verdicts.set(finding, 'keep');
+            verdicts.set(finding, "keep");
             onProgress?.(`  verify: could not verify "${finding.title}" (${errorMessage(error)}); keeping it`);
         }
     }));
     // Preserve original order.
-    const kept = findings.filter(finding => verdicts.get(finding) === 'keep');
-    return { kept, dropped, cost, tokens };
+    const kept = findings.filter((finding) => verdicts.get(finding) === "keep");
+    return { kept, dropped, cost, tokens, model };
 }

package/build/reporters/github.js

@@ -1,11 +1,12 @@
-import { writeFile, mkdtemp, rm } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import path from 'node:path';
-import { run } from '../core/exec.js';
-import { parseUnifiedDiff } from '../core/diff.js';
-import { buildDiffLineIndex, commentMarker, parseReviewState, renderMarkdown } from '../core/render.js';
-import { fingerprintFinding } from '../core/schema.js';
-const MAINTAINER_ASSOCIATIONS = new Set(['OWNER', 'MEMBER', 'COLLABORATOR']);
+import { writeFile, mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { run } from "../core/exec.js";
+import { parseUnifiedDiff } from "../core/diff.js";
+import { buildDiffLineIndex, commentMarker, parseReviewState, renderAggregateMarkdown, renderMarkdown, } from "../core/render.js";
+import { fingerprintFinding, scopedFingerprint } from "../core/schema.js";
+import { appendStepSummary } from "../core/step-summary.js";
+const MAINTAINER_ASSOCIATIONS = new Set(["OWNER", "MEMBER", "COLLABORATOR"]);
 /**
  * Maintains exactly one PR comment, updating it in place across re-reviews (and
  * cleaning up duplicates) so the review converges instead of churning. Runs the
@@ -20,9 +21,9 @@ export class GitHubReporter {
     }
     async checkBreakGlass() {
         const comments = await this.fetchAllComments();
-        return comments.some(comment => typeof comment.body === 'string' &&
+        return comments.some((comment) => typeof comment.body === "string" &&
             comment.body.includes(this.options.breakGlassMarker) &&
-            MAINTAINER_ASSOCIATIONS.has(comment.author_association ?? ''));
+            MAINTAINER_ASSOCIATIONS.has(comment.author_association ?? ""));
     }
     async postSkipNote() {
         await this.upsertComment(`${this.marker}\n🤖 AI review skipped via \`${this.options.breakGlassMarker}\`.`);
@@ -37,6 +38,38 @@ export class GitHubReporter {
         const link = await this.linkContextAsync();
         await this.upsertComment(renderMarkdown(review, this.options.commentTag, dismissed, link));
     }
+    /** Post/update the aggregate multi-scope comment (comment:'single' mode). */
+    async reportAggregate(results, unmatchedFiles) {
+        const existing = await this.findExistingComment();
+        const dismissed = existing
+            ? (parseReviewState(existing.body, this.options.commentTag)?.dismissed ?? [])
+            : [];
+        const link = await this.linkContextAsync();
+        await this.upsertComment(renderAggregateMarkdown(results, this.options.commentTag, dismissed, link, {
+            unmatchedFiles,
+        }));
+    }
+    /**
+     * The embedded review state of the existing reviewer comment, or null when no
+     * comment (or no parseable state) exists. A partial ci run (--scopes) uses this
+     * to carry the non-rerun scopes' previous results into the new aggregate.
+     */
+    async readState() {
+        const existing = await this.findExistingComment();
+        return existing ? parseReviewState(existing.body, this.options.commentTag) : null;
+    }
+    /**
+     * Delete every comment carrying THIS reporter's full marker (stale-scope cleanup /
+     * mode switch). Only ever touches its own marker — `<!-- tag -->` is not a substring
+     * of `<!-- tag:scope -->`, so root vs scoped markers can't cross-match (the
+     * reviewdog #1911 lesson).
+     */
+    async clear() {
+        const marked = (await this.fetchAllComments()).filter((comment) => comment.body?.includes(this.marker));
+        for (const comment of marked) {
+            await this.deleteComment(comment.id);
+        }
+    }
     /**
      * PR context for turning finding locations into links: the set of lines actually
      * in the diff (for in-diff findings → diff-anchor links) and the base commit SHA
@@ -44,13 +77,18 @@ export class GitHubReporter {
      * soft — a missing piece just degrades to a plain-text location, never a dead link.
      */
     async linkContextAsync() {
+        // A prebuilt context (ci fan-out, one fetch shared across scopes) wins — skip
+        // the two `gh` calls entirely.
+        if (this.options.linkContext) {
+            return this.options.linkContext;
+        }
         const link = { repo: this.options.repo, prNumber: this.options.prNumber };
-        const prArgs = [String(this.options.prNumber), '--repo', this.options.repo];
+        const prArgs = [String(this.options.prNumber), "--repo", this.options.repo];
         const cwd = this.options.cwd;
         await Promise.all([
             (async () => {
                 try {
-                    const { stdout } = await run('gh', ['pr', 'diff', ...prArgs], { cwd });
+                    const { stdout } = await run("gh", ["pr", "diff", ...prArgs], { cwd });
                     link.diffLines = buildDiffLineIndex(parseUnifiedDiff(stdout));
                 }
                 catch {
@@ -59,7 +97,9 @@ export class GitHubReporter {
             })(),
             (async () => {
                 try {
-                    const { stdout } = await run('gh', ['pr', 'view', ...prArgs, '--json', 'baseRefOid'], { cwd });
+                    const { stdout } = await run("gh", ["pr", "view", ...prArgs, "--json", "baseRefOid"], {
+                        cwd,
+                    });
                     const oid = JSON.parse(stdout).baseRefOid;
                     if (oid) {
                         link.baseSha = oid;
@@ -79,30 +119,38 @@ export class GitHubReporter {
     async applyDismissal(add, remove, by, reason) {
         const existing = await this.findExistingComment();
         if (!existing) {
-            throw new Error('No reviewer comment found on this PR yet — run a review first.');
+            throw new Error("No reviewer comment found on this PR yet — run a review first.");
         }
         const state = parseReviewState(existing.body, this.options.commentTag);
         if (!state) {
-            throw new Error('The reviewer comment has no embedded state (posted before dismissals existed); re-run a review first.');
+            throw new Error("The reviewer comment has no embedded state (posted before dismissals existed); re-run a review first.");
         }
-        const validFps = new Set(state.review.findings.map(fingerprintFinding));
-        const matched = add.filter(fp => validFps.has(fp));
-        const unmatched = add.filter(fp => !validFps.has(fp));
-        let dismissed = state.dismissed.filter(record => !remove.includes(record.fp));
+        // Scope-aware validity: on an aggregate comment the ids are scope-namespaced, so
+        // validate against every scope's scoped fingerprints; otherwise the plain ones.
+        const isAggregate = Array.isArray(state.scopes) && state.scopes.length > 0;
+        const validFps = isAggregate
+            ? new Set(state.scopes.flatMap((scope) => scope.review.findings.map((finding) => scopedFingerprint(scope.isDefault ? null : scope.scope, finding))))
+            : new Set(state.review.findings.map(fingerprintFinding));
+        const matched = add.filter((fp) => validFps.has(fp));
+        const unmatched = add.filter((fp) => !validFps.has(fp));
+        const dismissed = state.dismissed.filter((record) => !remove.includes(record.fp));
         for (const fp of matched) {
-            if (!dismissed.some(record => record.fp === fp)) {
+            if (!dismissed.some((record) => record.fp === fp)) {
                 dismissed.push({ fp, by, reason });
             }
         }
         const link = await this.linkContextAsync();
-        await this.patchComment(existing.id, renderMarkdown(state.review, this.options.commentTag, dismissed, link));
+        const body = isAggregate
+            ? renderAggregateMarkdown(state.scopes, this.options.commentTag, dismissed, link)
+            : renderMarkdown(state.review, this.options.commentTag, dismissed, link);
+        await this.patchComment(existing.id, body);
         return { dismissedCount: dismissed.length, matched, unmatched };
     }
     /** Newest reviewer-tagged comment (id + body), or null if none posted yet. */
     async findExistingComment() {
-        const marked = (await this.fetchAllComments()).filter(comment => comment.body?.includes(this.marker));
+        const marked = (await this.fetchAllComments()).filter((comment) => comment.body?.includes(this.marker));
         const keep = marked[marked.length - 1];
-        return keep ? { id: keep.id, body: keep.body ?? '' } : null;
+        return keep ? { id: keep.id, body: keep.body ?? "" } : null;
     }
     // Safety cap on pagination (100/page): 30 pages = 3000 comments. Bounds a
     // pathological PR; virtually every real PR exits far earlier.
@@ -118,14 +166,14 @@ export class GitHubReporter {
     async fetchAllComments() {
         const all = [];
         for (let page = 1; page <= GitHubReporter.MAX_COMMENT_PAGES; page++) {
-            const { stdout } = await run('gh', [
-                'api',
-                '-X',
-                'GET',
+            const { stdout } = await run("gh", [
+                "api",
+                "-X",
+                "GET",
                 `repos/${this.options.repo}/issues/${this.options.prNumber}/comments`,
-                '-f',
-                'per_page=100',
-                '-f',
+                "-f",
+                "per_page=100",
+                "-f",
                 `page=${page}`,
             ], { cwd: this.options.cwd });
             let batch;
@@ -151,23 +199,27 @@ export class GitHubReporter {
      * is the newest and is the keeper.
      */
     async upsertComment(body) {
-        const marked = (await this.fetchAllComments()).filter(comment => comment.body?.includes(this.marker));
+        const marked = (await this.fetchAllComments()).filter((comment) => comment.body?.includes(this.marker));
         if (marked.length === 0) {
             await this.createComment(body);
-            return;
         }
-        const keep = marked[marked.length - 1];
-        const duplicates = marked.slice(0, -1);
-        await this.patchComment(keep.id, body);
-        for (const duplicate of duplicates) {
-            await this.deleteComment(duplicate.id);
+        else {
+            const keep = marked[marked.length - 1];
+            const duplicates = marked.slice(0, -1);
+            await this.patchComment(keep.id, body);
+            for (const duplicate of duplicates) {
+                await this.deleteComment(duplicate.id);
+            }
         }
+        // Mirror the exact posted body into the Actions step summary: the PR comment
+        // is upserted in place, so this is the only per-run record of what was posted.
+        await appendStepSummary(`### 🤖 AI review — posted comment\n\n${body}`);
     }
     async withBodyFile(body, fn) {
-        const dir = await mkdtemp(path.join(tmpdir(), 'ecr-'));
-        const jsonPath = path.join(dir, 'comment.json');
+        const dir = await mkdtemp(path.join(tmpdir(), "ecr-"));
+        const jsonPath = path.join(dir, "comment.json");
         try {
-            await writeFile(jsonPath, JSON.stringify({ body }), 'utf8');
+            await writeFile(jsonPath, JSON.stringify({ body }), "utf8");
             return await fn(jsonPath);
         }
         finally {
@@ -175,26 +227,26 @@ export class GitHubReporter {
         }
     }
     async createComment(body) {
-        await this.withBodyFile(body, jsonPath => run('gh', [
-            'api',
-            '-X',
-            'POST',
+        await this.withBodyFile(body, (jsonPath) => run("gh", [
+            "api",
+            "-X",
+            "POST",
             `repos/${this.options.repo}/issues/${this.options.prNumber}/comments`,
-            '--input',
+            "--input",
             jsonPath,
         ], { cwd: this.options.cwd }));
     }
     async patchComment(commentId, body) {
-        await this.withBodyFile(body, jsonPath => run('gh', [
-            'api',
-            '-X',
-            'PATCH',
+        await this.withBodyFile(body, (jsonPath) => run("gh", [
+            "api",
+            "-X",
+            "PATCH",
             `repos/${this.options.repo}/issues/comments/${commentId}`,
-            '--input',
+            "--input",
             jsonPath,
         ], { cwd: this.options.cwd }));
     }
     async deleteComment(commentId) {
-        await run('gh', ['api', '-X', 'DELETE', `repos/${this.options.repo}/issues/comments/${commentId}`], { cwd: this.options.cwd });
+        await run("gh", ["api", "-X", "DELETE", `repos/${this.options.repo}/issues/comments/${commentId}`], { cwd: this.options.cwd });
     }
 }