@integrity-labs/agt-cli 0.28.834 → 0.28.836

package/dist/assets/review/post-review-findings.mjs

@@ -0,0 +1,589 @@
+#!/usr/bin/env node
+/**
+ * VENDORED (ENG-10001) — THIS MONOREPO COPY IS CANONICAL.
+ *
+ * Reaches managed agent hosts via `provisionReviewPoster()`
+ * (apps/cli/src/lib/review-poster-asset.ts), which copies this file and its
+ * sibling `obiwan-auth.mjs` into the agent's dir at session provision time.
+ *
+ * It is delivered that way, and NOT from `packages/claudecode-plugin-augmented/`,
+ * because the managed fleet never installs that plugin — the ENG-6233 mistake,
+ * recorded in-tree at `apps/cli/src/lib/manager-worker.ts` ("which the managed
+ * fleet never installs"), whose ENG-6268 fix named manager provisioning as "the
+ * actual fleet delivery path".
+ *
+ * Origin: the Smithers Claude Code plugin (~/.claude/plugins/smithers/scripts/).
+ * That copy is now DOWNSTREAM of this one. Do NOT add an equality sync test:
+ * this copy is expected to diverge, and already has — `refuseIdentity()` below
+ * makes a write without the VERIFIED review-bot identity impossible here, while
+ * the plugin copy stays permissive for the human who runs it. A `--min-severity`
+ * floor is the remaining planned divergence (ENG-10001).
+ */
+/**
+ * post-review-findings — deliver `/s:code-review` and `/s:security-review`
+ * findings to a PR as inline threads, and track them across rounds.
+ *
+ * THIS MODULE CAN NEVER SUBMIT A BLOCKING VERDICT, and that is its central
+ * design constraint rather than a setting. Measured on Integrity-Labs/augmented
+ * on 2026-09-03: five PRs are permanently unmergeable and twenty-five more sit
+ * in CHANGES_REQUESTED, because a reviewer that submits CHANGES_REQUESTED can
+ * only clear it by submitting APPROVED — and a clean re-scan submits COMMENTED,
+ * which clears nothing. `dismiss_stale_reviews_on_push` does not rescue this:
+ * GitHub defines it as dismissing review APPROVALS, so it never touches a change
+ * request. The repo's real remedy today is a bot calling the dismissals API by
+ * hand, one review at a time, with a written justification each.
+ *
+ * Nothing is given up by refusing the verdict. `required_approving_review_count`
+ * is 0, so the verdict gates no merge; `required_review_thread_resolution` is
+ * true, so the THREADS do the gating — per finding, and they clear cleanly.
+ *
+ * Because threads gate the merge, a reviewer that opens them must be able to
+ * close them, or it has built a blocker only a human can clear. Hence
+ * `--resolve`, which REQUIRES a reason and posts that reason before resolving.
+ * A reviewer that silently resolves its own findings is worse than one that
+ * never posted.
+ *
+ * Usage:
+ *   post-review-findings.mjs --pr 5409                        # dry run (default)
+ *   post-review-findings.mjs --pr 5409 --post
+ *   post-review-findings.mjs --pr 5409 --status
+ *   post-review-findings.mjs --pr 5409 --resolve <id> --reason "..."
+ */
+
+import { execFileSync } from 'node:child_process';
+import { readFileSync, readdirSync, existsSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { createHash } from 'node:crypto';
+import { join } from 'node:path';
+import { resolveIdentity, redact } from './obiwan-auth.mjs';
+import { realpathSync } from 'node:fs';
+import { pathToFileURL } from 'node:url';
+
+/**
+ * The ONLY review event this module will ever submit.
+ *
+ * Asserted at the point of construction, not merely used as a default — a
+ * default is a value a caller can pass past. `eng-9927-posting-layer.test.mjs`
+ * drives the real `submitReview()` against a stub and reads the event off the
+ * payload it actually built. A source grep for 'REQUEST_CHANGES' would be
+ * satisfied by this very docblock, which is why the proof is behavioural.
+ */
+export const REVIEW_EVENT = 'COMMENT';
+
+export const REVIEW_DIR = '.smithers/review';
+
+/**
+ * A finding's identity across rounds. Deliberately EXCLUDES the line number: a
+ * finding whose anchor shifted because unrelated code was inserted above it is
+ * the same finding, and keying on line would repost it as new on every push.
+ * File + category + summary is what makes two reports the same claim.
+ */
+export function findingId(f) {
+  return createHash('sha256')
+    .update(`${f.file} ${f.category ?? ''} ${f.summary ?? ''}`)
+    .digest('hex')
+    .slice(0, 12);
+}
+
+/** The marker that makes a posted comment recognisably ours on a later run. */
+export function marker(id) {
+  return `<!-- smithers-finding:${id} -->`;
+}
+
+export function buildBody(f, id) {
+  const sev = String(f.severity ?? 'minor').toUpperCase();
+  const cat = f.category ? ` · ${f.category}` : '';
+  return [
+    `**${sev}${cat}** — ${f.summary}`,
+    '',
+    f.why ?? f.attack ?? '',
+    '',
+    '<sub>Posted by `/s:code-review`. This reviewer never submits a blocking verdict.',
+    'Reply if this is deliberate and it becomes a rule in `docs/reference/review-rules.md`.</sub>',
+    marker(id),
+  ].join('\n');
+}
+
+/** Thin `gh` wrapper. `input` is piped to stdin, for endpoints taking a body. */
+let AUTH_TOKEN = null;
+
+/** Authenticate subsequent gh() calls as this token. Null keeps gh's own auth. */
+export function setAuthToken(t) {
+  AUTH_TOKEN = t || null;
+}
+
+export function gh(args, { json = true, input } = {}) {
+  let out;
+  try {
+    out = execFileSync('gh', args, {
+      encoding: 'utf8',
+      maxBuffer: 64 * 1024 * 1024,
+      // The token goes in the ENVIRONMENT. A command line is world-readable via
+      // `ps` and is copied verbatim into CI logs and SSM run history.
+      ...(AUTH_TOKEN ? { env: { ...process.env, GH_TOKEN: AUTH_TOKEN } } : {}),
+      ...(input === undefined ? {} : { input }),
+    });
+  } catch (e) {
+    // gh echoes the failing request, so an auth error can carry the token.
+    e.message = redact(e.message, AUTH_TOKEN);
+    if (e.stderr) e.stderr = redact(e.stderr, AUTH_TOKEN);
+    throw e;
+  }
+  return json && out.trim() !== '' ? JSON.parse(out) : out;
+}
+
+/**
+ * Lines GitHub will accept an inline comment on: the RIGHT side of each hunk in
+ * the PR diff. A comment on any other line is rejected outright, so this is
+ * what separates a placeable finding from one that needs the summary body.
+ */
+export function commentableLines(patchesByFile) {
+  const ok = new Map();
+  for (const [file, patch] of patchesByFile) {
+    const lines = new Set();
+    let n = 0;
+    for (const l of String(patch ?? '').split('\n')) {
+      const h = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,\d+)? @@/.exec(l);
+      if (h) {
+        n = Number(h[1]);
+        continue;
+      }
+      if (l.startsWith('-')) continue;
+      if (l.startsWith('+') || l.startsWith(' ')) {
+        lines.add(n);
+        n += 1;
+      }
+    }
+    ok.set(file, lines);
+  }
+  return ok;
+}
+
+/**
+ * Read every findings file written for this PR head.
+ *
+ * A document whose review did not COMPLETE is refused rather than contributing
+ * an empty `findings` array. Merged into a real file, an incomplete review's
+ * empty list is indistinguishable from a clean one — the precise conflation
+ * both review commands carry a `status` field to prevent.
+ */
+export function loadFindings(dir, pr, head) {
+  const want = `${pr}-${String(head).slice(0, 12)}.`;
+
+  // Three different situations, told apart. REVIEW_DIR is relative to the cwd,
+  // so running this from anywhere but the repo produced a bare ENOENT stack
+  // out of readdirSync — a Node internal frame in place of the one sentence
+  // that says what to do. And an absent directory is not the same as a
+  // directory holding no review for THIS head: the first means no review has
+  // ever run here, the second means the PR moved since the last one.
+  if (!existsSync(dir)) {
+    throw new Error(
+      `no findings directory at ${resolve(dir)} — run /s:code-review from the repo first, ` +
+        'or pass --dir pointing at an existing .smithers/review',
+    );
+  }
+  const out = [];
+  const present = readdirSync(dir).sort();
+  const forThisPr = present.filter((n) => n.startsWith(`${pr}-`));
+  if (!present.some((n) => n.startsWith(want))) {
+    throw new Error(
+      forThisPr.length > 0
+        ? `no review for PR #${pr} at head ${String(head).slice(0, 12)} — found ${forThisPr.join(', ')}. ` +
+          'The PR has moved since it was reviewed; re-run /s:code-review.'
+        : `no review found for PR #${pr} in ${resolve(dir)} — run /s:code-review ${pr} first`,
+    );
+  }
+  for (const name of present) {
+    if (!name.startsWith(want) || !name.endsWith('.json')) continue;
+    const doc = JSON.parse(readFileSync(join(dir, name), 'utf8'));
+    if (doc.status !== 'reviewed') {
+      throw new Error(
+        `${name}: status is "${doc.status}" — refusing to post from an incomplete review`,
+      );
+    }
+    for (const f of doc.findings ?? []) out.push({ ...f, _source: name });
+  }
+  return out;
+}
+
+/**
+ * Split findings into those that can be anchored inline and those that cannot.
+ *
+ * An unanchorable finding is NOT dropped — it is returned for the review body.
+ * A reviewer that silently discards what it could not place reports fewer
+ * findings than it made, with nothing on the wire to say so, which is the same
+ * silent-failure shape these reviews exist to find in other people's code.
+ */
+export function partitionByAnchor(findings, commentable) {
+  const inline = [];
+  const outside = [];
+  for (const f of findings) {
+    const lines = commentable.get(f.file);
+    if (lines && f.line && lines.has(f.line)) inline.push(f);
+    else {
+      outside.push({
+        ...f,
+        _why: lines ? `line ${f.line} is not in the diff` : 'file is not in the diff',
+      });
+    }
+  }
+  return { inline, outside };
+}
+
+/**
+ * Findings already posted on this PR, by id — so a round adds only what is new.
+ * Keyed on the marker, which survives an anchor shift; see {@link findingId}.
+ */
+export function postedIds(comments) {
+  const seen = new Set();
+  for (const c of comments) {
+    const m = /<!-- smithers-finding:([0-9a-f]{12}) -->/.exec(String(c.body ?? ''));
+    if (m) seen.add(m[1]);
+  }
+  return seen;
+}
+
+/**
+ * Build and submit the review.
+ *
+ * The event is read from the frozen constant and re-asserted here, so neither a
+ * caller nor a later edit can widen this into a verdict without the assertion
+ * failing first.
+ */
+export function submitReview({ repo, pr, comments, body, api = gh }) {
+  if (REVIEW_EVENT !== 'COMMENT') {
+    throw new Error(
+      `refusing to submit review event "${REVIEW_EVENT}" — see this module's header`,
+    );
+  }
+  const payload = { event: REVIEW_EVENT, body, comments };
+  api(['api', `repos/${repo}/pulls/${pr}/reviews`, '--method', 'POST', '--input', '-'], {
+    json: false,
+    input: JSON.stringify(payload),
+  });
+  return payload;
+}
+
+/**
+ * Every thread this reviewer opened on a PR, with its resolution state.
+ *
+ * You cannot act on feedback you cannot enumerate. Without this the finding ids
+ * lived only in the output of the run that posted them, so resolving one meant
+ * re-deriving the id or reading it out of an HTML comment in the PR.
+ */
+export async function listFindingThreads({ repo, pr, api = gh }) {
+  const [owner, name] = repo.split('/');
+  const q = `query($owner:String!,$name:String!,$pr:Int!){repository(owner:$owner,name:$name){pullRequest(number:$pr){reviewThreads(first:100){pageInfo{hasNextPage} nodes{id isResolved isOutdated path line comments(first:1){nodes{body author{login} url}}}}}}}`;
+  const res = api(['api', 'graphql', '-f', `query=${q}`, '-F', `owner=${owner}`, '-F', `name=${name}`, '-F', `pr=${pr}`]);
+  const conn = res.data.repository.pullRequest.reviewThreads;
+  if (conn.pageInfo.hasNextPage) {
+    throw new Error('more than 100 review threads — refusing to report a partial list');
+  }
+  const out = [];
+  for (const t of conn.nodes) {
+    const body = String(t.comments?.nodes?.[0]?.body ?? '');
+    const m = /<!-- smithers-finding:([0-9a-f]{12}) -->/.exec(body);
+    if (!m) continue;
+    out.push({
+      id: m[1],
+      resolved: t.isResolved,
+      outdated: t.isOutdated,
+      path: t.path,
+      line: t.line,
+      summary: body.split('\n')[0].replace(/\*\*/g, '').slice(0, 88),
+      url: t.comments?.nodes?.[0]?.url,
+    });
+  }
+  return out;
+}
+
+/**
+ * Resolve one finding's thread, with the reason posted into the thread first.
+ *
+ * The reason is REQUIRED. Resolving is how a merge blocker this tool created is
+ * cleared, so an unexplained resolve is indistinguishable from the tool hiding
+ * a finding it could not answer.
+ */
+export function resolveFinding({ repo, pr, id, reason, api = gh }) {
+  if (!reason || !String(reason).trim()) {
+    throw new Error('--resolve requires --reason: an unexplained resolve hides the finding it closes');
+  }
+  const [owner, name] = repo.split('/');
+  const q = `query($owner:String!,$name:String!,$pr:Int!){repository(owner:$owner,name:$name){pullRequest(number:$pr){reviewThreads(first:100){pageInfo{hasNextPage} nodes{id isResolved comments(first:1){nodes{body databaseId}}}}}}}`;
+  const res = api(['api', 'graphql', '-f', `query=${q}`, '-F', `owner=${owner}`, '-F', `name=${name}`, '-F', `pr=${pr}`]);
+  const conn = res.data.repository.pullRequest.reviewThreads;
+  if (conn.pageInfo.hasNextPage) {
+    throw new Error('more than 100 review threads — refusing to resolve from a truncated read');
+  }
+  const thread = conn.nodes.find((t) =>
+    String(t.comments?.nodes?.[0]?.body ?? '').includes(marker(id)),
+  );
+  if (!thread) throw new Error(`no thread found carrying finding ${id}`);
+  if (thread.isResolved) return { id, alreadyResolved: true };
+
+  const commentId = thread.comments.nodes[0].databaseId;
+  api(
+    ['api', `repos/${repo}/pulls/${pr}/comments/${commentId}/replies`, '--method', 'POST', '--input', '-'],
+    { json: false, input: JSON.stringify({ body: `Resolved: ${reason}` }) },
+  );
+
+  // GITHUB APPS CANNOT RESOLVE REVIEW THREADS. Measured, not assumed: with
+  // `pull_requests: write` the App reads threads and posts replies fine, and
+  // `resolveReviewThread` returns "Resource not accessible by integration".
+  // There is no permission that grants it — the mutation requires a user.
+  //
+  // So the design goal "whatever opens a blocker can close it" is NOT
+  // achievable by the App, and pretending otherwise would leave threads open
+  // with a reply claiming they were resolved. The reply is posted as the bot,
+  // because it is the reviewer's statement; the resolve falls back to the
+  // caller's own gh credentials, because deciding a finding is addressed is a
+  // human judgement and should be attributed to the human who made it.
+  //
+  // The consequence is worth stating plainly rather than hiding in a retry: an
+  // UNATTENDED run cannot resolve anything. It can post findings and it can
+  // post the reason; a person has to close the thread.
+  const mutation = `mutation{resolveReviewThread(input:{threadId:"${thread.id}"}){thread{isResolved}}}`;
+  try {
+    api(['api', 'graphql', '-f', `query=${mutation}`]);
+    return { id, resolved: true, reason, resolvedBy: 'app' };
+  } catch (e) {
+    if (!/not accessible by integration/i.test(String(e.stderr ?? e.message))) throw e;
+  }
+  const prev = AUTH_TOKEN;
+  setAuthToken(null); // the caller's own gh auth
+  try {
+    api(['api', 'graphql', '-f', `query=${mutation}`]);
+    return { id, resolved: true, reason, resolvedBy: 'you (the App cannot resolve threads)' };
+  } catch (e) {
+    return {
+      id,
+      resolved: false,
+      reason,
+      note:
+        'the reason was posted, but the thread is still open: GitHub Apps cannot resolve ' +
+        'review threads and your own gh credentials could not either. Resolve it in the UI.',
+    };
+  } finally {
+    setAuthToken(prev);
+  }
+}
+
+// ---------------------------------------------------------------------------
+// CLI
+// ---------------------------------------------------------------------------
+
+export function parseArgs(argv) {
+  const a = { post: false, status: false };
+  for (let i = 0; i < argv.length; i += 1) {
+    const k = argv[i];
+    if (k === '--post') a.post = true;
+    else if (k === '--status') a.status = true;
+    else if (k === '--pr') a.pr = Number(argv[++i]);
+    else if (k === '--repo') a.repo = argv[++i];
+    else if (k === '--dir') a.dir = argv[++i];
+    else if (k === '--resolve') a.resolve = argv[++i];
+    else if (k === '--reason') a.reason = argv[++i];
+  }
+  return a;
+}
+
+/**
+ * Which modes may run against a PR in this state — one place, so the answer
+ * cannot differ between the branches that ask it.
+ *
+ * The carve-out for `--status` was added because a read-only listing is useful
+ * on a closed PR. Written as `!a.status` it was too wide: `--resolve` returns
+ * BEFORE the status branch, so `--status --resolve <id>` satisfied the
+ * carve-out and then took a reply through the door on a merged PR — the very
+ * defect the carve-out was written alongside, one argument along (CodeRabbit,
+ * #156). Read-only therefore means `--status` and NOTHING ELSE.
+ *
+ * The conflicting pair is refused outright rather than silently resolved in
+ * `--resolve`'s favour, because a flag that is accepted and then ignored is
+ * indistinguishable from one that was honoured.
+ *
+ * Returns a refusal message, or null to proceed.
+ */
+export function refuseMode({ state, status, resolve, pr }) {
+  if (status && resolve) {
+    return '--status and --resolve are separate modes: --resolve runs first and --status would be ignored. Pick one.';
+  }
+  const readOnly = Boolean(status) && !resolve;
+  if (state !== 'OPEN' && !readOnly) {
+    return (
+      `PR #${pr} is ${state} — refusing to write to it. Findings and replies on a ` +
+      'closed PR reach no one; if they still matter, they belong on a follow-up.'
+    );
+  }
+  return null;
+}
+
+/**
+ * Whether this identity may WRITE. Deliberately a second function rather than
+ * another clause in refuseMode(): they gate different axes, and their read-only
+ * sets genuinely differ.
+ *
+ * refuseMode asks "may this MODE touch a PR in this STATE", and there a dry run
+ * counts as a write, because computing findings against a closed PR is pointless
+ * work. Here a dry run is a READ — it posts nothing, so who we are cannot matter
+ * — and refusing it would deny an operator the one command that shows what the
+ * misconfiguration would have done. So `willWrite` is `--post || --resolve`, and
+ * nothing else. Folding the two together would force one of those two readings
+ * onto the other.
+ *
+ * FAIL CLOSED, WITH NO OVERRIDE FLAG. There is deliberately no
+ * `--allow-fallback-identity`. This copy's only caller is an unattended agent,
+ * so any escape hatch is one the AGENT can take, and an agent writing under an
+ * identity nobody chose is the exact thing being guarded. A documented bypass of
+ * a fail-closed check is not a fail-closed check.
+ *
+ * AND THE FALLBACK IS NOT WHAT IT LOOKS LIKE ON A HOST. The obvious reading —
+ * "it would post as the operator" — is a workstation reading. ENG-7506
+ * materialises the Augmented App's installation token into the agent session as
+ * GITHUB_ACCESS_TOKEN and GITHUB_TOKEN, and `gh` reads GITHUB_TOKEN. So a
+ * fallback write from a managed agent posts as the PLATFORM's bot, on a review
+ * the platform did not make. Unattributable rather than misattributed, which is
+ * no better: nobody can mute it, and nobody can tell whose claim it is.
+ *
+ * Returns a refusal message, or null to proceed.
+ */
+export function refuseIdentity({ kind, willWrite }) {
+  if (!willWrite || kind === 'app') return null;
+  return (
+    'refusing to write as anything but the review bot: OBIWAN_APP_ID / OBIWAN_PRIVATE_KEY ' +
+    'are not configured, so --post and --resolve would write under whatever credentials ' +
+    '`gh` happens to hold. Configure the App (see obiwan-auth.mjs), or drop --post to see ' +
+    'what would have been posted.'
+  );
+}
+
+async function main() {
+  const a = parseArgs(process.argv.slice(2));
+  if (!a.pr) throw new Error('--pr is required');
+  const repo = a.repo ?? gh(['repo', 'view', '--json', 'nameWithOwner'], {}).nameWithOwner;
+  const dir = a.dir ?? REVIEW_DIR;
+
+  // Resolve identity before anything is written, and print it. A reviewer that
+  // posts under the operator's name when the App is misconfigured has produced
+  // the exact outcome the App exists to prevent, so the fallback is announced
+  // rather than merely permitted.
+  const identity = await resolveIdentity({ repo });
+  setAuthToken(identity.token);
+  console.log(
+    identity.kind === 'app'
+      ? `identity: ${identity.why} (token expires ${identity.expiresAt})`
+      : `identity: FALLBACK — whatever \`gh\` already holds, which is NOT the review bot ` +
+          `(${identity.why}); reads are fine, --post and --resolve will refuse`,
+  );
+
+  // Before the PR is even read, so a misconfigured machine learns it from the
+  // first line of output rather than after a full scan it cannot deliver.
+  const identityRefusal = refuseIdentity({
+    kind: identity.kind,
+    willWrite: Boolean(a.post) || Boolean(a.resolve),
+  });
+  if (identityRefusal) throw new Error(identityRefusal);
+
+  // Read PR state BEFORE the --resolve branch, not after it (CodeRabbit, #156).
+  // --resolve returned early, and resolveFinding posts a reply before it
+  // resolves — so a merged PR could still take a bot comment through this door
+  // while the posting door refused. The same defect, one branch along, which is
+  // what a guard placed at one call site rather than at the boundary tends to
+  // leave behind. What may run against which state now lives in refuseMode(),
+  // so the answer is one function rather than a condition per branch.
+  const view = gh(['pr', 'view', String(a.pr), '--repo', repo, '--json', 'headRefOid,state']);
+  const refusal = refuseMode({ state: view.state, status: a.status, resolve: a.resolve, pr: a.pr });
+  if (refusal) throw new Error(refusal);
+
+  if (a.resolve) {
+    console.log(JSON.stringify(resolveFinding({ repo, pr: a.pr, id: a.resolve, reason: a.reason }), null, 2));
+    return;
+  }
+
+  if (a.status) {
+    const threads = await listFindingThreads({ repo, pr: a.pr });
+    console.log(`\n${threads.length} thread(s) opened by this reviewer:`);
+    for (const t of threads) {
+      const mark = t.resolved ? 'RESOLVED' : t.outdated ? 'OUTDATED' : 'OPEN    ';
+      console.log(`  ${mark}  ${t.id}  ${t.path}:${t.line ?? '-'}  ${t.summary}`);
+    }
+    const open = threads.filter((t) => !t.resolved).length;
+    if (open > 0) {
+      console.log(
+        `\n${open} open. Resolve one only once it is ADDRESSED or judged not to apply:\n` +
+          `  post-review-findings.mjs --pr ${a.pr} --resolve <id> --reason "what changed, or why it does not apply"\n` +
+          'The reason is posted into the thread before it closes — a resolve with no\n' +
+          'explanation is indistinguishable from the reviewer hiding a finding.',
+      );
+    }
+    return;
+  }
+  // A merged or closed PR takes comments happily and shows them to nobody.
+  const head = view.headRefOid;
+  const findings = loadFindings(dir, a.pr, head);
+  // --slurp (gh >= 2.44) is REQUIRED with --paginate here: without it gh emits
+  // one JSON array PER PAGE, and gh()'s JSON.parse of the concatenation throws
+  // `Unexpected token [`. That makes --post fail on exactly the large PRs it is
+  // most needed on, and never on the small ones it gets tested against.
+  const files = gh(['api', `repos/${repo}/pulls/${a.pr}/files`, '--paginate', '--slurp']).flat();
+  const commentable = commentableLines(files.map((f) => [f.filename, f.patch]));
+  const { inline, outside } = partitionByAnchor(findings, commentable);
+
+  const existing = gh(['api', `repos/${repo}/pulls/${a.pr}/comments`, '--paginate', '--slurp']).flat();
+  // ENG-10001 (CodeRabbit, major): `/pulls/{n}/comments` returns INLINE review
+  // comments only. An outside-diff finding's marker is written into the review
+  // BODY (see the `<details>` block below), which that endpoint never returns —
+  // so deduping on inline comments alone reposts every outside-diff finding on
+  // each --post, and undercounts "already posted". Reviews carry `.body` too,
+  // so postedIds reads both without change.
+  const reviews = gh(['api', `repos/${repo}/pulls/${a.pr}/reviews`, '--paginate', '--slurp']).flat();
+  const already = postedIds([...existing, ...reviews]);
+  const newInline = inline.filter((f) => !already.has(findingId(f)));
+  const newOutside = outside.filter((f) => !already.has(findingId(f)));
+
+  console.log(`PR #${a.pr} @ ${head.slice(0, 9)} — ${findings.length} finding(s) loaded`);
+  console.log(`  inline-anchorable: ${inline.length}   outside-diff: ${outside.length}`);
+  console.log(`  already posted:    ${inline.length + outside.length - newInline.length - newOutside.length}`);
+  console.log(`  would post now:    ${newInline.length} inline + ${newOutside.length} in the body\n`);
+  for (const f of newInline) console.log(`  [inline] ${f.file}:${f.line}  ${findingId(f)}  ${f.summary.slice(0, 78)}`);
+  for (const f of newOutside) console.log(`  [body]   ${f.file}  ${findingId(f)}  (${f._why})  ${f.summary.slice(0, 60)}`);
+
+  if (!a.post) {
+    console.log(`\nDRY RUN — nothing posted. Re-run with --post to deliver.`);
+    return;
+  }
+  if (newInline.length + newOutside.length === 0) {
+    console.log('Nothing new to post.');
+    return;
+  }
+
+  const comments = newInline.map((f) => ({
+    path: f.file,
+    line: f.line,
+    side: 'RIGHT',
+    body: buildBody(f, findingId(f)),
+  }));
+  const bodyParts = [
+    `**${newInline.length + newOutside.length} finding(s)** from \`/s:code-review\` and \`/s:security-review\`.`,
+    '',
+    'This reviewer never submits a blocking verdict — see `scripts/post-review-findings.mjs`.',
+  ];
+  if (newOutside.length > 0) {
+    bodyParts.push('', `<details><summary>${newOutside.length} finding(s) outside the diff range</summary>`, '');
+    for (const f of newOutside) bodyParts.push(`- \`${f.file}\` — ${f.summary}\n\n  ${f.why ?? f.attack ?? ''}\n\n  ${marker(findingId(f))}`);
+    bodyParts.push('', '</details>');
+  }
+  submitReview({ repo, pr: a.pr, comments, body: bodyParts.join('\n') });
+  console.log(`Posted ${comments.length} inline + ${newOutside.length} in the body, as COMMENT.`);
+}
+
+/**
+ * Entrypoint check via the REAL path.
+ *
+ * `~/.claude/plugins/smithers` is a symlink, and Node gives `import.meta.url`
+ * the resolved target while `process.argv[1]` keeps the symlink the caller
+ * typed. Comparing them directly meant the CLI never ran when invoked the only
+ * way anyone invokes it — exiting 0, printing nothing, with no error to say the
+ * work had not happened. Proved by `--cli-symlink` in this module's test.
+ */
+if (process.argv[1] && import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href) main();

package/dist/bin/agt.js

@@ -40,7 +40,7 @@ import {
   success,
   table,
   warn
-} from "../chunk-LLIAJK4F.js";
+} from "../chunk-E6B43IJZ.js";
 import {
   getProjectDir,
   isSessionResumeDisabled,
@@ -5467,7 +5467,7 @@ import { execFileSync, execSync } from "child_process";
 import { existsSync as existsSync11, realpathSync as realpathSync2 } from "fs";
 import chalk18 from "chalk";
 import ora16 from "ora";
-var cliVersion = true ? "0.28.834" : "dev";
+var cliVersion = true ? "0.28.836" : "dev";
 async function fetchLatestVersion() {
   const host2 = getHost();
   if (!host2) return null;
@@ -6658,7 +6658,7 @@ function handleError(err) {
 }
 
 // src/bin/agt.ts
-var cliVersion2 = true ? "0.28.834" : "dev";
+var cliVersion2 = true ? "0.28.836" : "dev";
 var program = new Command();
 program.name("agt").description("Augmented CLI \u2014 agent provisioning and management").version(cliVersion2).option("--json", "Emit machine-readable JSON output (suppress spinners and colors)").option("--skip-update-check", "Skip the automatic update check on startup");
 program.hook("preAction", async (thisCommand, actionCommand) => {

package/dist/{chunk-LLIAJK4F.js → chunk-E6B43IJZ.js}

@@ -6537,7 +6537,7 @@ function exchangeFailureKind(err) {
 }
 
 // src/lib/api-client.ts
-var agtCliVersion = true ? "0.28.834" : "dev";
+var agtCliVersion = true ? "0.28.836" : "dev";
 var lastConfigHash = null;
 function setConfigHash(hash) {
   lastConfigHash = hash && hash.length > 0 ? hash : null;
@@ -10895,4 +10895,4 @@ export {
   managerInstallSystemUnitCommand,
   managerUninstallSystemUnitCommand
 };
-//# sourceMappingURL=chunk-LLIAJK4F.js.map
+//# sourceMappingURL=chunk-E6B43IJZ.js.map