@expo/code-review-cli 0.6.0 → 0.7.0

package/build/core/review.js

@@ -3,7 +3,8 @@ import { prepareAuth } from "./auth.js";
 import { coordinate } from "./coordinator.js";
 import { writeRunLog } from "./log.js";
 import { filterNoise, writePatchWorkspace } from "./noise.js";
-import { addTokenUsage, AgentTimeoutError, assertModelsResolvable, buildOpencodeConfig, CROSS_CUTTING_AGENT, promptAndParse, startOpencode, } from "./opencode.js";
+import { addTokenUsage, AgentTimeoutError, assertModelsResolvable, buildOpencodeConfig, CLAUDE_CODE_ENGINE, CROSS_CUTTING_AGENT, promptAndParse, startOpencode, } from "./opencode.js";
+import { buildEngineMap, claudeTemperatureNote, claudeTokenCredential, startClaudeCode, } from "./claude-code.js";
 import { routeAgents } from "./router.js";
 import { buildCrossCuttingSystem, buildCrossCuttingTask, buildReviewerSystem, buildReviewerTask, NO_TOOLS_INSTRUCTION, } from "./prompts.js";
 import { fingerprintFinding, parseReviewerOutput } from "./schema.js";
@@ -33,18 +34,35 @@ function makeRunId() {
  * thin wrappers that supply a Source and render the result.
  */
 /**
- * Max concurrent reviewer calls: an explicit config value wins; otherwise 3 when a
- * subscription (oauth) credential is configured, else 6. One ChatGPT account
- * handles six parallel streams poorly — requests get parked server-side (the
- * stall signature seen on eas-cli#4084), and several PRs may be reviewing on the
- * same credential at once — so subscription runs trade a little wall-clock for a
- * lot of reliability. Exported for tests.
+ * Max concurrent reviewer calls: an explicit config value wins; otherwise 3 when the
+ * run leans on a subscription credential, else 6. One subscription account handles
+ * six parallel streams poorly — requests get parked server-side (the stall signature
+ * seen on eas-cli#4084), and several PRs may be reviewing on the same credential at
+ * once — so subscription runs trade a little wall-clock for a lot of reliability.
+ *
+ * A subscription run is any of: an oauth (ChatGPT/Codex) entry; OR the Claude Code
+ * engine being in use (an `anthropic/…` model) on an OAUTH credential — a subscription
+ * token OR the local `claude` login fallback (no forwardable token). An anthropic
+ * credential that classifies as an API KEY is metered per-request and does NOT force
+ * the cap. Exported for tests.
  */
-export function effectiveConcurrency(config) {
+export function effectiveConcurrency(config, env = process.env) {
     if (config.chunk.concurrency) {
         return config.chunk.concurrency;
     }
-    return config.auth.some((entry) => entry.mode === "oauth") ? 3 : 6;
+    if (config.auth.some((entry) => entry.mode === "oauth")) {
+        return 3;
+    }
+    if (buildEngineMap(config).usesClaude) {
+        const entry = config.auth.find((auth) => auth.provider === "anthropic");
+        const credential = claudeTokenCredential(entry, env);
+        // No forwardable token ⇒ the `claude` login (a subscription) covers the run; an
+        // "sk-ant-oat…" token is a subscription too. Either caps; an API key does not.
+        if (!credential || credential.kind === "oauth") {
+            return 3;
+        }
+    }
+    return 6;
 }
 export async function runReview(source, options) {
     const { config } = options;
@@ -105,6 +123,18 @@ export async function runReview(source, options) {
     // with a base-SHA checkout the fallback tree is pre-PR content, and silently
     // reviewing/verifying that drops real findings — while a local run falls back to
     // the user's own checkout with a warning.
+    // Resolve each agent's engine BEFORE prepareAuth/readRoot, so the per-engine
+    // startup below can't leak the readRoot worktree or a temp auth dir holding a
+    // live credential (buildEngineMap only inspects config, so nothing needs cleanup
+    // yet at this point). Nothing throws here anymore — one run may drive BOTH the
+    // Claude Code CLI engine and OpenCode at once, inferred per agent from its model.
+    //
+    // Scope the engine set to the SELECTED agents so a run whose passes never touch
+    // Claude doesn't start (and fail on a missing CLI/token for) the Claude Code
+    // engine. An explicit `--agents` subset is known here; routing picks from the full
+    // roster later (its router needs an engine up first), so a routed/all run keeps
+    // the full roster and can drive either engine.
+    const { engineOf, modelOf, usesOpencode, usesClaude } = buildEngineMap(config, explicitAgents ?? config.agents);
     const originalCwd = process.cwd();
     const readRoot = await resolveReadRoot(source, options.mode, progress);
     // Prepare auth BEFORE the chdir below: it doesn't depend on the working directory,
@@ -128,10 +158,21 @@ export async function runReview(source, options) {
         progress("Reviewing the PR-head tree (so reads match the PR, not the checkout).");
         process.chdir(readRoot.dir);
     }
-    progress("Starting OpenCode server…");
-    let handle = null;
+    const starting = [
+        usesClaude ? "Claude Code engine" : null,
+        usesOpencode ? "OpenCode server" : null,
+    ]
+        .filter(Boolean)
+        .join(" + ");
+    progress(`Starting ${starting}…`);
+    // Start each engine the run actually uses. OpenCode first so a claude failure can
+    // close it. Two separate try blocks keep the precise per-engine error messages.
+    let opencodeHandle = null;
+    let claudeHandle = null;
     try {
-        handle = await startOpencode(buildOpencodeConfig(config));
+        if (usesOpencode) {
+            opencodeHandle = await startOpencode(buildOpencodeConfig(config));
+        }
     }
     catch (error) {
         await auth.cleanup();
@@ -139,11 +180,71 @@ export async function runReview(source, options) {
         throw new Error(`Failed to start the OpenCode server. Ensure the \`opencode\` CLI is installed and ` +
             `model credentials are configured (\`ecr doctor\` checks both).\n${errorMessage(error)}`);
     }
-    // Preflight: a model id the server can't resolve would otherwise fail EVERY pass
-    // identically — N indistinguishable coverage gaps, after spending the run's budget
-    // discovering the same fixable thing N times. Throw once, up front, naming the fix.
     try {
-        await assertModelsResolvable(handle, [...config.agents.map((agent) => agent.model), config.coordinator.model], config.auth);
+        if (usesClaude) {
+            claudeHandle = await startClaudeCode(config);
+        }
+    }
+    catch (error) {
+        opencodeHandle?.close();
+        await auth.cleanup();
+        await restoreCwd();
+        throw new Error(`Failed to start the Claude Code engine. Ensure the \`claude\` CLI is installed and ` +
+            `logged into a Max/Team subscription (\`ecr doctor\` checks both).\n${errorMessage(error)}`);
+    }
+    // Build the single carrier handle so every downstream `handle` call is unchanged;
+    // per-agent dispatch happens inside via engineOf. When OpenCode is in use the
+    // carrier is the opencode handle (claude reached via `.claude`); a claude-only run
+    // uses the claude handle itself as the carrier (engineOf maps every id → claude).
+    const engineFn = (agent) => engineOf[agent] ?? "opencode";
+    let handle;
+    if (opencodeHandle) {
+        handle = opencodeHandle;
+        handle.claude = claudeHandle ?? undefined;
+        handle.engineOf = engineFn;
+        const closeOpencode = opencodeHandle.close;
+        handle.close = () => {
+            closeOpencode();
+            claudeHandle?.close(); // claude close is a noop, but keep the composition explicit
+        };
+    }
+    else {
+        handle = claudeHandle; // claude-only: the carrier is the claude handle itself
+        handle.engineOf = engineFn;
+    }
+    // The claude-code engine has no temperature control (the CLI exposes no flag), so
+    // surface a tuned-but-ignored temperature once, here, instead of letting the config
+    // divergence pass silently. Applies whenever any pass is claude-routed.
+    if (usesClaude) {
+        const note = claudeTemperatureNote(config, engineOf);
+        if (note) {
+            progress(`Note: ${note}`);
+        }
+    }
+    // Preflight: a model id an engine can't resolve would otherwise fail EVERY pass
+    // routed to it identically — N indistinguishable coverage gaps, after spending the
+    // run's budget rediscovering the same fixable thing. Throw once, up front, naming
+    // the fix. Split per engine so each engine only ever sees its own model subset: the
+    // OpenCode server never receives an anthropic-claude id (unknown-provider error) and
+    // assertClaudeModels never receives a non-anthropic id (its foreign-id throw).
+    const modelsFor = (eng) => [
+        ...new Set(Object.keys(engineOf)
+            .filter((id) => engineOf[id] === eng)
+            .map((id) => modelOf[id])),
+    ];
+    try {
+        if (opencodeHandle) {
+            const models = modelsFor("opencode");
+            if (models.length > 0) {
+                await assertModelsResolvable(opencodeHandle, models, config.auth);
+            }
+        }
+        if (claudeHandle) {
+            const models = modelsFor("claude-code");
+            if (models.length > 0) {
+                await assertModelsResolvable(claudeHandle, models, config.auth);
+            }
+        }
     }
     catch (error) {
         handle.close();
@@ -172,6 +273,10 @@ export async function runReview(source, options) {
     // log, reported in the log line, and surfaced as a coverage note when it happens.
     const agentModels = {};
     const substituted = new Set();
+    // The buckets whose model was substituted, so the coverage note can name each
+    // one's OWN engine (a mixed run may substitute on either side, for different
+    // reasons — a CLI usage-limit downgrade vs. OpenCode's silent default fallback).
+    const substitutedBuckets = new Set();
     const trackModel = (bucket, configured, actual) => {
         if (!actual) {
             return;
@@ -179,6 +284,7 @@ export async function runReview(source, options) {
         agentModels[bucket] = actual;
         if (configured && actual !== configured) {
             substituted.add(`${bucket}: configured ${configured}, ran ${actual}`);
+            substitutedBuckets.add(bucket);
         }
     };
     try {
@@ -448,10 +554,20 @@ export async function runReview(source, options) {
             for (const line of substituted) {
                 progress(`  ⚠ model substituted — ${line}`);
             }
+            const subEngines = new Set([...substitutedBuckets].map((bucket) => engineOf[bucket] ?? "opencode"));
+            const why = [];
+            if (subEngines.has(CLAUDE_CODE_ENGINE)) {
+                why.push("The Claude Code CLI answered with a different model than configured (usage-limit " +
+                    "downgrades do this on a subscription), so these findings may come from a weaker " +
+                    "model than intended — check the configured model ids and the subscription's limits.");
+            }
+            if (subEngines.has("opencode")) {
+                why.push("OpenCode silently falls back to a default model when the configured id is empty or " +
+                    "unusable, so these findings may come from a different (possibly much weaker) model " +
+                    "than intended — check the agents' `model`, `coordinator.model`, REVIEWER_MODEL, and the provider credential.");
+            }
             incomplete.push(`Some passes did not run on the configured model (${[...substituted].join("; ")}). ` +
-                `OpenCode silently falls back to a default model when the configured id is empty or ` +
-                `unusable, so these findings may come from a different (possibly much weaker) model ` +
-                `than intended — check the agents' \`model\`, \`coordinator.model\`, REVIEWER_MODEL, and the provider credential.`);
+                why.join(" "));
         }
         // Note: routine noise filtering (lockfiles, generated, binary) is expected and
         // NOT a coverage gap — it stays in the run log (filteredFiles), not the
@@ -545,10 +661,22 @@ export async function runReview(source, options) {
         // Surface provider throttling as a fact about the run: passes already waited or
         // backed off, but the operator should still SEE that it happened (a run that
         // was rate-limited is slower and may carry partial passes — that's the cause).
-        await handle.rateLimit.check();
-        if (handle.rateLimit.events > 0) {
-            progress(`  ⚠ provider rate-limited this run ${handle.rateLimit.events} time(s) ` +
-                `(429s in the OpenCode server log) — passes waited it out rather than failing`);
+        // Sum both engines' watches; name a cause only for an engine whose watch fired
+        // (claude events arrive via note() in runClaudePrompt; opencode via its server log).
+        await opencodeHandle?.rateLimit.check();
+        const rlOpencode = opencodeHandle?.rateLimit.events ?? 0;
+        const rlClaude = claudeHandle?.rateLimit.events ?? 0;
+        const rlTotal = rlOpencode + rlClaude;
+        if (rlTotal > 0) {
+            const causes = [];
+            if (rlClaude > 0) {
+                causes.push("subscription rate/usage limits reported by the Claude Code CLI");
+            }
+            if (rlOpencode > 0) {
+                causes.push("429s in the OpenCode server log");
+            }
+            progress(`  ⚠ provider rate-limited this run ${rlTotal} time(s) (${causes.join("; ")}) ` +
+                `— passes waited it out rather than failing`);
         }
         // Every pass says which model actually answered it — in the job log, the step
         // summary table, and the run log — so a wrong or substituted model is always
@@ -570,7 +698,12 @@ export async function runReview(source, options) {
             agentFindings,
             coverageNotes,
             verifierDropped,
-            ...(handle.rateLimit.events > 0 ? { rateLimitEvents: handle.rateLimit.events } : {}),
+            ...(rlTotal > 0
+                ? {
+                    rateLimitEvents: rlTotal,
+                    rateLimitByEngine: { opencode: rlOpencode, claudeCode: rlClaude },
+                }
+                : {}),
             durationMs: Date.now() - started,
             decision: output.decision,
             findingCount: output.findings.length,
@@ -595,7 +728,7 @@ export async function runReview(source, options) {
         throw error;
     }
     finally {
-        handle?.close();
+        handle.close();
         await auth.cleanup();
         await restoreCwd();
     }

package/build/core/schema.js

@@ -112,7 +112,12 @@ export function extractJsonObject(text) {
             lastError = error;
         }
     }
-    throw new Error(`Could not extract JSON from model response: ${lastError instanceof Error ? lastError.message : String(lastError)}`);
+    throw new Error(lastError === undefined
+        ? // No candidate was even tried: the response held no {...} block at all —
+            // empty output, or prose/pseudo-tool-call text with no JSON in it.
+            `Could not extract JSON from model response: no JSON object found in ` +
+                `${text.trim() === "" ? "an EMPTY response" : `a ${text.length}-char response with no {...}`}`
+        : `Could not extract JSON from model response: ${lastError instanceof Error ? lastError.message : String(lastError)}`);
 }
 /** The router's choice of which agent ids to run. */
 export const RouteOutputSchema = z.object({

package/build/core/scrub.js

@@ -1,4 +1,4 @@
-import { readdir, rm } from "node:fs/promises";
+import { readdir, realpath, rm } from "node:fs/promises";
 import path from "node:path";
 /**
  * Ambient runtime configuration the OpenCode server (and the Claude-compatible
@@ -60,3 +60,61 @@ export async function scrubAmbientRuntimeConfig(root) {
     await walk(root);
     return removed.sort();
 }
+/**
+ * Remove symlinks whose fully resolved target lies outside the materialized tree.
+ *
+ * The model runtime's read tools are path-scoped by the LITERAL path argument
+ * (buildClaudeArgs' permission rules, and equally OpenCode's project-root
+ * containment), but the fs layer underneath follows symlinks — so a PR-committed
+ * link (`docs/notes.md -> ~/.claude/.credentials.json`) passes the in-tree check
+ * and reads the out-of-tree target. Git can only materialize regular files,
+ * directories, and symlinks, so stripping escaping symlinks here closes the whole
+ * class.
+ *
+ * Fail closed: a link whose target cannot be resolved (broken, or a chain that
+ * leaves the tree at any hop) is removed too — the target could come into
+ * existence later, and a broken link has no legitimate review value. In-tree
+ * links survive (realpath resolves chains, so an in-tree alias of an in-tree
+ * file is provably contained). Unlike the config scrub, this walk descends into
+ * node_modules (a committed one is attacker content); `.git` stays skipped — in
+ * a worktree it is an ECR-created gitdir link, not PR content.
+ *
+ * Must only ever run on a tree ECR created and will delete. Returns the
+ * repo-relative paths removed so callers can log them.
+ */
+export async function removeEscapingSymlinks(root) {
+    // realpath the boundary itself: tmpdir-based roots are often behind symlinks
+    // (macOS /var -> /private/var), and containment must compare resolved paths.
+    const boundary = await realpath(root);
+    const removed = [];
+    const walk = async (dir) => {
+        const entries = await readdir(dir, { withFileTypes: true });
+        for (const entry of entries) {
+            const full = path.join(dir, entry.name);
+            if (entry.isSymbolicLink()) {
+                let contained = false;
+                try {
+                    const target = await realpath(full);
+                    contained = target === boundary || target.startsWith(boundary + path.sep);
+                }
+                catch {
+                    // Unresolvable link: leave `contained` false (fail closed).
+                }
+                if (!contained) {
+                    await rm(full, { force: true });
+                    // Relative to the RESOLVED boundary — the walk runs there, and the
+                    // caller's `root` may itself sit behind a symlink (macOS /var).
+                    removed.push(path.relative(boundary, full));
+                }
+                // In-tree directory links are kept but never descended: their contents
+                // are walked once via the real path, and descending would loop on cycles.
+                continue;
+            }
+            if (entry.isDirectory() && entry.name !== ".git") {
+                await walk(full);
+            }
+        }
+    };
+    await walk(boundary);
+    return removed.sort();
+}

package/build/core/throttle.js

@@ -56,6 +56,16 @@ export class RateLimitWatch {
     constructor(file = opencodeLogFile()) {
         this.file = file;
     }
+    /**
+     * Record rate-limit evidence directly, for an engine that has no log file to
+     * scan (the Claude Code CLI surfaces limits per-invocation, not in a log the
+     * way the OpenCode server does). Feeds the same `events`/`recentlyLimited`
+     * signals `check()` would.
+     */
+    note(count = 1) {
+        this.events += count;
+        this.lastSeenAt = Date.now();
+    }
     /** Scan newly-appended log lines for rate-limit evidence. */
     async check() {
         try {

package/build/core/util.js

@@ -5,6 +5,23 @@ export function sleep(ms) {
 export function errorMessage(error) {
     return error instanceof Error ? error.message : String(error);
 }
+/**
+ * A failure reason safe to post into a PUBLIC PR comment (see `ecr ci`'s failure
+ * notices). `run` (core/exec.ts) throws "Command failed: <cmd> <argv>\n<stderr>" (and
+ * "Command output exceeded …"), which embeds a subprocess's full command line, its
+ * stderr, and absolute runner paths — CI-internal detail of no use to a PR author and
+ * exactly the kind of thing that must not leak into an attacker-visible artifact. Those
+ * shapes collapse to a generic pointer at the workflow log; our own (argv/path-free)
+ * error messages pass through, since they are the actionable ones the fail-fast design
+ * means to surface. Every call site still writes the FULL reason to the job's stderr.
+ */
+export function publicFailureReason(error) {
+    const message = errorMessage(error);
+    if (/^Command (failed|output exceeded)\b/.test(message)) {
+        return "a subprocess (gh, git, or the model CLI) failed — see the workflow logs for details";
+    }
+    return message;
+}
 /** Collapse whitespace + lowercase — for tolerant code matching / fingerprinting. */
 export function normalizeCode(text) {
     return text.replace(/\s+/g, " ").trim().toLowerCase();

package/build/core/verify.js

@@ -1,5 +1,6 @@
 import { readFile } from "node:fs/promises";
 import path from "node:path";
+import { pathInside } from "./exec.js";
 import { parseVerdict } from "./schema.js";
 import { addTokenUsage, promptAndParse, VERIFIER_AGENT } from "./opencode.js";
 import { buildVerifierSystem, buildVerifierTask } from "./prompts.js";
@@ -50,9 +51,20 @@ export function matchEvidence(evidence, content) {
 }
 /** Read the cited file and grade the evidence against it (see matchEvidence). */
 async function evidencePresence(finding, cwd) {
+    // finding.file is an unconstrained, LLM-authored string produced over untrusted PR
+    // content, so a prompt-injected finding could point it at a host secret. path.resolve
+    // IGNORES cwd when finding.file is already absolute (e.g. ~/.claude/.credentials.json),
+    // and `..` segments escape upward — either would make this raw readFile reach outside
+    // the reviewed tree with the host user's privileges, and the present/absent grading
+    // would leak a content-oracle back into the review. Confine the read to cwd (the
+    // materialized PR-head tree); anything outside is uncheckable, never read.
+    const resolved = path.resolve(cwd, finding.file);
+    if (!pathInside(resolved, cwd)) {
+        return "unknown";
+    }
     let content;
     try {
-        content = await readFile(path.resolve(cwd, finding.file), "utf8");
+        content = await readFile(resolved, "utf8");
     }
     catch {
         return "unknown";

package/build/reporters/github.js

@@ -1,12 +1,30 @@
 import { writeFile, mkdtemp, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import path from "node:path";
-import { run } from "../core/exec.js";
+import { resolveTrustedTool, run } from "../core/exec.js";
 import { parseUnifiedDiff } from "../core/diff.js";
 import { buildDiffLineIndex, commentMarker, parseReviewState, renderAggregateMarkdown, renderMarkdown, } from "../core/render.js";
 import { fingerprintFinding, scopedFingerprint } from "../core/schema.js";
 import { appendStepSummary } from "../core/step-summary.js";
 const MAINTAINER_ASSOCIATIONS = new Set(["OWNER", "MEMBER", "COLLABORATOR"]);
+/**
+ * The reviewer's OWN marker comments, oldest-first: carrying the marker AND authored
+ * by `ownLogin`. The body marker alone is not identity — it defaults to a hardcoded,
+ * public literal and is readable in the base-branch config, so anyone who can comment
+ * on the PR (the untrusted PR author included) could post a comment carrying it plus a
+ * forged embedded review state; a newest-marker-wins lookup would then adopt that
+ * state and carry its `dismissed` list forward, silently suppressing real findings.
+ * GitHub sets a comment's author from the authenticated identity and it cannot be
+ * spoofed, so matching on author closes that. When `ownLogin` is null the author
+ * cannot be confirmed, so NOTHING is treated as ours (fail closed). Pure; exported for
+ * tests.
+ */
+export function selectOwnComments(comments, marker, ownLogin) {
+    if (!ownLogin) {
+        return [];
+    }
+    return comments.filter((comment) => comment.body?.includes(marker) && comment.user?.login === ownLogin);
+}
 /**
  * Maintains exactly one PR comment, updating it in place across re-reviews (and
  * cleaning up duplicates) so the review converges instead of churning. Runs the
@@ -15,10 +33,48 @@ const MAINTAINER_ASSOCIATIONS = new Set(["OWNER", "MEMBER", "COLLABORATOR"]);
 export class GitHubReporter {
     options;
     marker;
+    /** Memoized login of the account this reporter posts as (see resolveOwnLogin). */
+    ownLoginResolution;
     constructor(options) {
         this.options = options;
         this.marker = commentMarker(options.commentTag);
     }
+    /**
+     * The login of the account this reporter comments as, so its own comment is
+     * recognized by AUTHOR (see selectOwnComments for why the body marker is not enough).
+     * Resolution: `gh api user` (a user/PAT token), else the scaffolded workflow's default
+     * GITHUB_TOKEN identity, `github-actions[bot]`, when running under Actions — an
+     * installation token can't read `/user`. Null when neither is available, which makes
+     * selectOwnComments treat no comment as ours (fail closed). Memoized: the identity is
+     * stable for the process, and every reporter method consults it.
+     */
+    resolveOwnLogin() {
+        this.ownLoginResolution ??= (async () => {
+            try {
+                const gh = await resolveTrustedTool("gh");
+                const { stdout } = await run(gh, ["api", "user", "--jq", ".login"], {
+                    cwd: this.options.cwd,
+                });
+                const login = stdout.trim();
+                if (login) {
+                    return login;
+                }
+            }
+            catch {
+                // The default GITHUB_TOKEN is an installation token: `/user` returns 403.
+            }
+            return process.env.GITHUB_ACTIONS ? "github-actions[bot]" : null;
+        })();
+        return this.ownLoginResolution;
+    }
+    /** This reporter's own marker comments, author-verified (see selectOwnComments). */
+    async ownComments() {
+        const [comments, ownLogin] = await Promise.all([
+            this.fetchAllComments(),
+            this.resolveOwnLogin(),
+        ]);
+        return selectOwnComments(comments, this.marker, ownLogin);
+    }
     async checkBreakGlass() {
         const comments = await this.fetchAllComments();
         return comments.some((comment) => typeof comment.body === "string" &&
@@ -65,8 +121,9 @@ export class GitHubReporter {
      * reviewdog #1911 lesson).
      */
     async clear() {
-        const marked = (await this.fetchAllComments()).filter((comment) => comment.body?.includes(this.marker));
-        for (const comment of marked) {
+        // Only ever delete comments WE authored — never touch a look-alike posted by
+        // someone else (see selectOwnComments).
+        for (const comment of await this.ownComments()) {
             await this.deleteComment(comment.id);
         }
     }
@@ -88,7 +145,8 @@ export class GitHubReporter {
         await Promise.all([
             (async () => {
                 try {
-                    const { stdout } = await run("gh", ["pr", "diff", ...prArgs], { cwd });
+                    const gh = await resolveTrustedTool("gh");
+                    const { stdout } = await run(gh, ["pr", "diff", ...prArgs], { cwd });
                     link.diffLines = buildDiffLineIndex(parseUnifiedDiff(stdout));
                 }
                 catch {
@@ -97,7 +155,8 @@ export class GitHubReporter {
             })(),
             (async () => {
                 try {
-                    const { stdout } = await run("gh", ["pr", "view", ...prArgs, "--json", "baseRefOid"], {
+                    const gh = await resolveTrustedTool("gh");
+                    const { stdout } = await run(gh, ["pr", "view", ...prArgs, "--json", "baseRefOid"], {
                         cwd,
                     });
                     const oid = JSON.parse(stdout).baseRefOid;
@@ -146,10 +205,10 @@ export class GitHubReporter {
         await this.patchComment(existing.id, body);
         return { dismissedCount: dismissed.length, matched, unmatched };
     }
-    /** Newest reviewer-tagged comment (id + body), or null if none posted yet. */
+    /** Newest comment WE authored carrying our marker (id + body), or null if none. */
     async findExistingComment() {
-        const marked = (await this.fetchAllComments()).filter((comment) => comment.body?.includes(this.marker));
-        const keep = marked[marked.length - 1];
+        const own = await this.ownComments();
+        const keep = own[own.length - 1];
         return keep ? { id: keep.id, body: keep.body ?? "" } : null;
     }
     // Safety cap on pagination (100/page): 30 pages = 3000 comments. Bounds a
@@ -165,8 +224,9 @@ export class GitHubReporter {
      */
     async fetchAllComments() {
         const all = [];
+        const gh = await resolveTrustedTool("gh");
         for (let page = 1; page <= GitHubReporter.MAX_COMMENT_PAGES; page++) {
-            const { stdout } = await run("gh", [
+            const { stdout } = await run(gh, [
                 "api",
                 "-X",
                 "GET",
@@ -199,7 +259,10 @@ export class GitHubReporter {
      * is the newest and is the keeper.
      */
     async upsertComment(body) {
-        const marked = (await this.fetchAllComments()).filter((comment) => comment.body?.includes(this.marker));
+        // Update/clean up only comments WE authored, never a look-alike posted by
+        // someone else (see selectOwnComments) — otherwise the newest forged marker
+        // comment would be adopted as "ours" and edited/patched in its place.
+        const marked = await this.ownComments();
         if (marked.length === 0) {
             await this.createComment(body);
         }
@@ -227,7 +290,8 @@ export class GitHubReporter {
         }
     }
     async createComment(body) {
-        await this.withBodyFile(body, (jsonPath) => run("gh", [
+        const gh = await resolveTrustedTool("gh");
+        await this.withBodyFile(body, (jsonPath) => run(gh, [
             "api",
             "-X",
             "POST",
@@ -237,7 +301,8 @@ export class GitHubReporter {
         ], { cwd: this.options.cwd }));
     }
     async patchComment(commentId, body) {
-        await this.withBodyFile(body, (jsonPath) => run("gh", [
+        const gh = await resolveTrustedTool("gh");
+        await this.withBodyFile(body, (jsonPath) => run(gh, [
             "api",
             "-X",
             "PATCH",
@@ -247,6 +312,7 @@ export class GitHubReporter {
         ], { cwd: this.options.cwd }));
     }
     async deleteComment(commentId) {
-        await run("gh", ["api", "-X", "DELETE", `repos/${this.options.repo}/issues/comments/${commentId}`], { cwd: this.options.cwd });
+        const gh = await resolveTrustedTool("gh");
+        await run(gh, ["api", "-X", "DELETE", `repos/${this.options.repo}/issues/comments/${commentId}`], { cwd: this.options.cwd });
     }
 }