@usepipr/runtime 0.3.2 → 0.3.5

package/dist/{commands-CQg9QVZt.mjs → commands-DCpIxJkz.mjs}

@@ -13,17 +13,74 @@ import { Buffer as Buffer$1 } from "node:buffer";
 import { spawn } from "node:child_process";
 import { Octokit } from "@octokit/rest";
 import { existsSync, mkdirSync } from "node:fs";
+//#region src/config/package-manifest.ts
+function normalizePackageManifest(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return {};
+	const manifest = {};
+	const rawManifest = value;
+	for (const key of ["dependencies", "devDependencies"]) {
+		const dependencyMap = rawManifest[key];
+		if (dependencyMap === null || typeof dependencyMap !== "object" || Array.isArray(dependencyMap)) continue;
+		const entries = Object.entries(dependencyMap).filter((entry) => typeof entry[1] === "string");
+		if (entries.length > 0) manifest[key] = Object.fromEntries(entries);
+	}
+	return manifest;
+}
+//#endregion
+//#region src/config/scaffold-versions.ts
+const defaultTypesBunVersion = "1.3.14";
+const defaultTypescriptVersion = "6.0.3";
+const defaultScaffoldTypescriptSpec = `typescript@${defaultTypescriptVersion}`;
+//#endregion
 //#region src/config/config-deps.ts
-const runtimeProvidedPackages = new Set(["@usepipr/sdk", "@types/bun"]);
+const runtimeProvidedPackages = /* @__PURE__ */ new Set(["@usepipr/sdk", "@types/bun"]);
 async function installConfigDependencies(configDir, options = {}) {
 	const packageJsonPath = path.join(configDir, "package.json");
-	if (!await fileExists$1(packageJsonPath)) return;
-	if (shouldSkipConfigInstall(JSON.parse(await Bun.file(packageJsonPath).text()))) return;
+	if (!await Bun.file(packageJsonPath).exists()) return;
+	const originalPackageJson = await Bun.file(packageJsonPath).text();
+	const manifest = normalizePackageManifest(JSON.parse(originalPackageJson));
+	const installablePackages = installableDependencySpecs(manifest);
+	if (installablePackages.length === 0) return;
 	const bunLockPath = path.join(configDir, "bun.lock");
-	if (options.frozen && !await fileExists$1(bunLockPath)) throw new Error(`${configDir}: bun.lock is required when .pipr/package.json declares dependencies. Run \`bun install\` in .pipr/ and commit bun.lock.`);
+	const originalBunLock = await Bun.file(bunLockPath).exists() ? await Bun.file(bunLockPath).text() : void 0;
+	if (options.frozen && originalBunLock === void 0) throw new Error(`${configDir}: bun.lock is required when .pipr/package.json declares dependencies. Run \`bun install\` in .pipr/ and commit bun.lock.`);
 	await assertBunAvailable();
-	const args = ["install", "--ignore-scripts"];
-	if (options.frozen) args.push("--frozen-lockfile");
+	const args = configInstallArgs(installablePackages, { frozen: options.frozen === true && !hasRuntimeProvidedDependencies(manifest) });
+	await withSanitizedConfigInstallInputs({
+		packageJsonPath,
+		originalPackageJson,
+		bunLockPath,
+		originalBunLock
+	}, () => runConfigBunInstall(configDir, args));
+}
+function configInstallArgs(installablePackages, options) {
+	return [
+		"install",
+		"--ignore-scripts",
+		"--no-save",
+		...options.frozen ? ["--frozen-lockfile"] : [],
+		...isDefaultScaffoldTypescriptInstall(installablePackages) ? ["--no-verify"] : [],
+		...installablePackages.map((dependency) => dependency.spec)
+	];
+}
+function isDefaultScaffoldTypescriptInstall(installablePackages) {
+	return installablePackages.length === 1 && installablePackages[0]?.spec === defaultScaffoldTypescriptSpec;
+}
+async function withSanitizedConfigInstallInputs(inputs, install) {
+	let wroteInstallInputs = false;
+	try {
+		await Bun.write(inputs.packageJsonPath, sanitizedPackageJsonForConfigInstall(inputs.originalPackageJson));
+		wroteInstallInputs = true;
+		if (inputs.originalBunLock !== void 0) await Bun.write(inputs.bunLockPath, sanitizedBunLockForConfigInstall(inputs.originalBunLock));
+		await install();
+	} finally {
+		if (wroteInstallInputs) {
+			await Bun.write(inputs.packageJsonPath, inputs.originalPackageJson);
+			if (inputs.originalBunLock !== void 0) await Bun.write(inputs.bunLockPath, inputs.originalBunLock);
+		}
+	}
+}
+async function runConfigBunInstall(configDir, args) {
 	const proc = Bun.spawn(["bun", ...args], {
 		cwd: configDir,
 		env: process.env,
@@ -33,9 +90,43 @@ async function installConfigDependencies(configDir, options = {}) {
 	const [exitCode, stderr] = await Promise.all([proc.exited, new Response(proc.stderr).text()]);
 	if (exitCode !== 0) throw new Error(`${configDir}: bun install failed (exit ${exitCode}).` + (stderr.trim().length > 0 ? `\n${stderr.trim()}` : ""));
 }
-function shouldSkipConfigInstall(manifest) {
-	const packages = [...Object.keys(manifest.dependencies ?? {}), ...Object.keys(manifest.devDependencies ?? {})];
-	return packages.length === 0 || packages.every((name) => runtimeProvidedPackages.has(name));
+function installableDependencySpecs(manifest) {
+	return dependencyEntries(manifest).filter(([name]) => !runtimeProvidedPackages.has(name)).map(([name, version]) => ({
+		name,
+		spec: `${name}@${version}`
+	}));
+}
+function hasRuntimeProvidedDependencies(manifest) {
+	return dependencyEntries(manifest).some(([name]) => runtimeProvidedPackages.has(name));
+}
+function dependencyEntries(manifest) {
+	return Object.entries({
+		...manifest.dependencies ?? {},
+		...manifest.devDependencies ?? {}
+	});
+}
+function sanitizedPackageJsonForConfigInstall(packageJson) {
+	const value = JSON.parse(packageJson);
+	for (const key of ["dependencies", "devDependencies"]) {
+		const dependencies = value[key];
+		if (dependencies === null || typeof dependencies !== "object" || Array.isArray(dependencies)) continue;
+		const sanitized = Object.fromEntries(Object.entries(dependencies).filter(([name]) => !runtimeProvidedPackages.has(name)));
+		if (Object.keys(sanitized).length === 0) delete value[key];
+		else value[key] = sanitized;
+	}
+	return `${JSON.stringify(value, null, 2)}\n`;
+}
+function sanitizedBunLockForConfigInstall(lockfile) {
+	let sanitized = lockfile;
+	for (const packageName of runtimeProvidedPackages) {
+		const escapedName = escapeRegExp(packageName);
+		sanitized = sanitized.replace(new RegExp(`^\\s*"${escapedName}":\\s*"[^"]+",\\r?\\n`, "gm"), "");
+		sanitized = sanitized.replace(new RegExp(`^\\s*"${escapedName}":\\s*\\[[^\\n]*\\],\\r?\\n(?:\\r?\\n)?`, "gm"), "");
+	}
+	return sanitized;
+}
+function escapeRegExp(value) {
+	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 async function assertBunAvailable() {
 	try {
@@ -48,9 +139,6 @@ async function assertBunAvailable() {
 		throw new Error("bun is required on PATH to install .pipr/package.json dependencies. Install Bun from https://bun.sh");
 	}
 }
-async function fileExists$1(filePath) {
-	return await Bun.file(filePath).exists();
-}
 //#endregion
 //#region src/config/paths.ts
 function resolveContainedConfigDir(options) {
@@ -365,6 +453,8 @@ async function installTypedSdkStub(configDir) {
 	});
 	await mkdir(sdkRoot, { recursive: true });
 	await Bun.write(path.join(sdkRoot, "package.json"), JSON.stringify({
+		name: "@usepipr/sdk",
+		version: "0.0.0-pipr-runtime",
 		type: "module",
 		types: "./index.d.ts",
 		exports: { ".": {
@@ -425,23 +515,93 @@ const starterTsconfig = `{
 }
 `;
 //#endregion
+//#region src/shared/semver.ts
+const stableSemverPattern = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/;
+function compareStableSemver(left, right) {
+	const leftParts = stableSemverPattern.exec(left);
+	const rightParts = stableSemverPattern.exec(right);
+	if (!leftParts || !rightParts) throw new Error(`cannot compare non-stable semver versions: ${left}, ${right}`);
+	return Number(leftParts[1]) - Number(rightParts[1]) || Number(leftParts[2]) - Number(rightParts[2]) || Number(leftParts[3]) - Number(rightParts[3]);
+}
+//#endregion
+//#region src/shared/version.ts
+const runtimeVersion = "0.3.5";
+//#endregion
+//#region src/config/version-compat.ts
+async function resolveConfigVersionCompatibility(options) {
+	const packageJsonPath = path.join(options.configDirPath, "package.json");
+	let manifest;
+	try {
+		manifest = normalizePackageManifest(await Bun.file(packageJsonPath).json());
+	} catch (error) {
+		if ((error && typeof error === "object" && "code" in error ? error.code : void 0) === "ENOENT") return {
+			kind: "unknown",
+			runtimeVersion
+		};
+		throw error;
+	}
+	const sdkVersion = manifest.dependencies?.["@usepipr/sdk"] ?? manifest.devDependencies?.["@usepipr/sdk"];
+	if (!sdkVersion) return {
+		kind: "unknown",
+		runtimeVersion
+	};
+	const packageJsonLabel = options.configDir === "." ? "package.json" : `${options.configDir}/package.json`;
+	const bunLockLabel = options.configDir === "." ? "bun.lock" : `${options.configDir}/bun.lock`;
+	if (!stableSemverPattern.test(sdkVersion)) return {
+		kind: "uncomparable",
+		runtimeVersion,
+		warning: `${packageJsonLabel} declares @usepipr/sdk as ${JSON.stringify(sdkVersion)}; use an exact version to enable Pipr config version checks.`
+	};
+	if (!stableSemverPattern.test(runtimeVersion)) return {
+		kind: "uncomparable",
+		runtimeVersion,
+		warning: `This Pipr runtime reports version ${runtimeVersion}; skipping Pipr config version checks.`
+	};
+	const comparison = compareStableSemver(runtimeVersion, sdkVersion);
+	if (comparison === 0) return {
+		kind: "matched",
+		runtimeVersion,
+		configVersion: sdkVersion
+	};
+	if (comparison > 0) return {
+		kind: "runtime-newer",
+		runtimeVersion,
+		configVersion: sdkVersion,
+		warning: `${packageJsonLabel} pins @usepipr/sdk ${sdkVersion}, but this Pipr runtime is ${runtimeVersion}. Run \`pipr init --force\` or update ${packageJsonLabel} and ${bunLockLabel} when ready.`
+	};
+	throw new Error(`${packageJsonLabel} pins @usepipr/sdk ${sdkVersion}, but this Pipr runtime is ${runtimeVersion}. Upgrade Pipr before running this config.`);
+}
+//#endregion
 //#region src/config/ts-loader.ts
 async function loadTypescriptConfig(options) {
-	const { projectDir, relativeConfigDir, configDir } = resolveContainedConfigDir(options);
+	const { projectDir, relativeConfigDir } = resolveContainedConfigDir(options);
 	const sourceConfigPath = path.join(projectDir, "config.ts");
-	if (!await fileExists(sourceConfigPath)) throw new Error(`${configDir}/config.ts is required. Run pipr init to create it.`);
+	if (!await Bun.file(sourceConfigPath).exists()) throw new Error(`No Pipr config found at ${sourceConfigPath}.\nRun \`pipr init\` to create one, or pass \`--config-dir <dir>\`.`);
+	const versionCompatibility = await resolveConfigVersionCompatibility({
+		configDirPath: projectDir,
+		configDir: relativeConfigDir
+	});
 	if (options.typecheck) await typecheckTypescriptConfig(path.resolve(options.rootDir), relativeConfigDir);
 	const tempRoot = await mkdtemp(path.join(os.tmpdir(), "pipr-config-"));
 	try {
 		const tempConfigDir = path.join(tempRoot, relativeConfigDir);
-		await copyConfigDirectory(projectDir, tempConfigDir);
+		await cp(projectDir, tempConfigDir, {
+			recursive: true,
+			errorOnExist: false,
+			force: true,
+			filter: (source) => {
+				const relative = path.relative(projectDir, source);
+				return relative !== "node_modules" && !relative.startsWith(`node_modules${path.sep}`);
+			}
+		});
 		await prepareConfigDirectory(tempConfigDir, { frozen: true });
 		const factory = (await import(`${pathToFileURL(path.join(tempConfigDir, "config.ts")).href}?pipr=${Date.now()}`)).default;
 		if (!isPiprConfigFactory(factory)) throw new Error(`${sourceConfigPath}: default export must be created by definePipr()`);
 		return {
 			plan: buildPiprPlan(factory),
 			source: sourceConfigPath,
-			tempRoot
+			tempRoot,
+			versionCompatibility
 		};
 	} finally {
 		await rm(tempRoot, {
@@ -465,13 +625,14 @@ async function typecheckTypescriptConfig(rootDir, relativeConfigDir) {
 			force: true,
 			filter: (source) => {
 				const relative = path.relative(rootDir, source);
-				const first = relative.split(path.sep)[0] ?? "";
-				return !ignoredTypecheckRootEntries.has(first) && relative !== "bun.lock";
+				const parts = relative.split(path.sep);
+				const first = parts[0] ?? "";
+				return !ignoredTypecheckRootEntries.has(first) && !parts.includes("node_modules") && relative !== "bun.lock";
 			}
 		});
 		await prepareConfigDirectory(tempConfigDir, { frozen: true });
 		const tsconfigPath = path.join(tempConfigDir, "tsconfig.json");
-		if (!await fileExists(tsconfigPath)) {
+		if (!await Bun.file(tsconfigPath).exists()) {
 			await mkdir(tempConfigDir, { recursive: true });
 			await Bun.write(tsconfigPath, starterTsconfig);
 		}
@@ -484,25 +645,64 @@ async function typecheckTypescriptConfig(rootDir, relativeConfigDir) {
 	}
 }
 async function typecheckTypescriptConfigWithApi(configDir, tsconfigPath) {
-	const ts = await import("typescript");
+	const { ts, packageRoot } = await loadTypescriptForConfig(configDir);
 	const config = ts.readConfigFile(tsconfigPath, ts.sys.readFile);
 	if (config.error) throw new Error(formatTypeScriptDiagnostics(ts, [config.error], configDir));
 	const parsed = ts.parseJsonConfigFileContent(config.config, ts.sys, configDir);
 	const bundledTypeRoots = [];
-	if (!await fileExists(path.join(configDir, "node_modules", "@types", "bun", "package.json"))) try {
+	if (!await Bun.file(path.join(configDir, "node_modules", "@types", "bun", "package.json")).exists()) try {
 		const require = createRequire(import.meta.url);
 		bundledTypeRoots.push(path.dirname(path.dirname(require.resolve("@types/bun/package.json"))));
 	} catch {}
 	const configPath = path.join(configDir, "config.ts");
-	const program = ts.createProgram([configPath, ...parsed.fileNames], {
+	const compilerOptions = {
 		...parsed.options,
 		skipLibCheck: true,
-		typeRoots: [...new Set([...parsed.options.typeRoots ?? [], ...bundledTypeRoots])],
-		types: [...new Set([...parsed.options.types ?? [], ...bundledTypeRoots.length ? ["bun"] : []])]
-	});
+		typeRoots: [.../* @__PURE__ */ new Set([...parsed.options.typeRoots ?? [], ...bundledTypeRoots])],
+		types: [.../* @__PURE__ */ new Set([...parsed.options.types ?? [], ...bundledTypeRoots.length ? ["bun"] : []])]
+	};
+	const compilerHost = await createTypescriptCompilerHost(ts, compilerOptions, packageRoot);
+	const program = ts.createProgram([configPath, ...parsed.fileNames], compilerOptions, compilerHost);
 	const diagnostics = [...parsed.errors, ...ts.getPreEmitDiagnostics(program)];
 	if (diagnostics.length > 0) throw new Error(`TypeScript config check failed for ${path.join(configDir, "config.ts")}:\n` + formatTypeScriptDiagnostics(ts, diagnostics, configDir));
 }
+async function loadTypescriptForConfig(configDir) {
+	const localPackageRoot = path.join(configDir, "node_modules", "typescript");
+	const localApiPath = path.join(localPackageRoot, "lib", "typescript.js");
+	if (await fileExists(localApiPath)) return {
+		ts: typescriptApi(await import(pathToFileURL(localApiPath).href)),
+		packageRoot: localPackageRoot
+	};
+	return {
+		ts: typescriptApi(await import("typescript")),
+		packageRoot: await runtimeTypescriptPackageRoot()
+	};
+}
+function typescriptApi(module) {
+	const maybeModule = module;
+	if (typeof maybeModule.createProgram === "function") return maybeModule;
+	if (typeof maybeModule.default?.createProgram === "function") return maybeModule.default;
+	throw new Error("TypeScript module does not expose createProgram");
+}
+async function runtimeTypescriptPackageRoot() {
+	try {
+		const require = createRequire(import.meta.url);
+		const packageRoot = path.dirname(require.resolve("typescript/package.json"));
+		return await fileExists(path.join(packageRoot, "lib", "typescript.js")) ? packageRoot : void 0;
+	} catch {
+		return;
+	}
+}
+async function createTypescriptCompilerHost(ts, compilerOptions, packageRoot) {
+	const compilerHost = ts.createCompilerHost(compilerOptions, true);
+	if (!packageRoot) return compilerHost;
+	const libDir = path.join(packageRoot, "lib");
+	const defaultLibPath = path.join(libDir, ts.getDefaultLibFileName(compilerOptions));
+	if (!await fileExists(defaultLibPath)) return compilerHost;
+	compilerHost.getDefaultLibFileName = () => defaultLibPath;
+	compilerHost.getDefaultLibLocation = () => libDir;
+	return compilerHost;
+}
 function formatTypeScriptDiagnostics(ts, diagnostics, configDir) {
 	return ts.formatDiagnostics(diagnostics, {
 		getCanonicalFileName: (fileName) => fileName,
@@ -510,19 +710,7 @@ function formatTypeScriptDiagnostics(ts, diagnostics, configDir) {
 		getNewLine: () => "\n"
 	});
 }
-async function copyConfigDirectory(sourceDir, targetDir) {
-	await cp(sourceDir, targetDir, {
-		recursive: true,
-		errorOnExist: false,
-		force: true,
-		filter: (source) => !isIgnoredConfigCopyPath(source, sourceDir)
-	});
-}
-function isIgnoredConfigCopyPath(source, configDir) {
-	const relative = path.relative(configDir, source);
-	return relative === "node_modules" || relative.startsWith(`node_modules${path.sep}`);
-}
-const ignoredTypecheckRootEntries = new Set([
+const ignoredTypecheckRootEntries = /* @__PURE__ */ new Set([
 	".fallow",
 	".git",
 	".turbo",
@@ -543,8 +731,10 @@ async function loadRuntimeProject(options) {
 		settings: planToRuntimeSettings(loaded.plan, {
 			source: loaded.source,
 			env: options.env,
-			requireProviderEnv: options.requireProviderEnv
-		})
+			requireProviderEnv: options.requireProviderEnv,
+			warnings: [loaded.versionCompatibility.warning].filter((warning) => warning !== void 0)
+		}),
+		versionCompatibility: loaded.versionCompatibility
 	};
 }
 async function validateProject(options) {
@@ -589,7 +779,7 @@ function planToRuntimeSettings(plan, options) {
 			},
 			limits: plan.limits
 		},
-		warnings: []
+		warnings: options.warnings ?? []
 	});
 }
 function normalizeAutoResolveConfig(options, defaultProvider) {
@@ -2398,6 +2588,14 @@ type CategorizedFinding = {
   suggestedFix?: string;
 };
 
+type ReviewSummary = {
+  headline: string;
+  changeSummary: string[];
+  riskLevel: "low" | "medium" | "high";
+  riskSummary: string;
+  reviewerFocus: string[];
+};
+
 const categorizedFindingSchema = z.strictObject({
   title: z.string(),
   severity: z.enum(["critical", "high", "medium", "low", "nit"]),
@@ -2420,6 +2618,14 @@ const categorizedFindingSchema = z.strictObject({
   suggestedFix: z.string().optional(),
 });
 
+const reviewSummarySchema = z.strictObject({
+  headline: z.string(),
+  changeSummary: z.array(z.string()).min(1).max(4),
+  riskLevel: z.enum(["low", "medium", "high"]),
+  riskSummary: z.string(),
+  reviewerFocus: z.array(z.string()).max(4),
+});
+
 export default definePipr((pipr) => {
   const model = pipr.model({
     provider: "deepseek",
@@ -2433,7 +2639,7 @@ export default definePipr((pipr) => {
   const reviewOutput = pipr.schema({
     id: "review/categorized-findings",
     schema: z.strictObject({
-      summary: z.string(),
+      summary: reviewSummarySchema,
       findings: z.array(categorizedFindingSchema),
     }),
   });
@@ -2449,6 +2655,11 @@ export default definePipr((pipr) => {
       medium for important follow-up, low for minor actionable improvements,
       and nit only for tiny but concrete issues. Include suggestedFix only when
       there is an exact replacement for the selected range.
+
+      Make summary maintainer-facing and scannable: one concrete headline, one
+      to four behavior-focused change bullets, a risk level with rationale, and
+      reviewer focus only for useful human follow-up. Put actionable defects in
+      findings, not only in summary.
     \`,
     output: reviewOutput,
     tools: pipr.tools.readOnly,
@@ -2477,18 +2688,24 @@ export default definePipr((pipr) => {
       });
       await ctx.comment({
         main: [
-          result.summary,
+          "## Summary",
           "",
-          "## Findings",
+          \`**\${result.summary.headline}**\`,
           "",
-          findingsTable(result.findings),
+          summaryTable(result.summary, result.findings.length),
+          "",
+          "## What Changed",
+          "",
+          bulletList(result.summary.changeSummary, "No changed behavior summarized."),
+          "",
+          "## Reviewer Focus",
           "",
-          "<details>",
-          "<summary>Finding rationales</summary>",
+          bulletList(result.summary.reviewerFocus, "No special reviewer focus."),
           "",
-          findingRationales(result.findings),
+          "## Findings",
           "",
-          "</details>",
+          findingsTable(result.findings),
+          ...(result.findings.length > 0 ? ["", findingRationalesBlock(result.findings)] : []),
         ].join("\\n"),
         inlineFindings,
       });
@@ -2499,6 +2716,23 @@ export default definePipr((pipr) => {
   pipr.command({ pattern: "@pipr review", permission: "write", task });
 });
 
+function summaryTable(summary: ReviewSummary, findingCount: number): string {
+  return [
+    "| Outcome | Risk | Risk summary |",
+    "| --- | --- | --- |",
+    \`| \${findingOutcome(findingCount)} | \${labelValue(summary.riskLevel)} | \${tableCell(
+      summary.riskSummary,
+    )} |\`,
+  ].join("\\n");
+}
+
+function findingOutcome(findingCount: number): string {
+  if (findingCount === 0) {
+    return "No findings";
+  }
+  return findingCount === 1 ? "1 finding" : \`\${findingCount} findings\`;
+}
+
 function findingsTable(findings: CategorizedFinding[]): string {
   if (findings.length === 0) {
     return [
@@ -2519,22 +2753,48 @@ function findingsTable(findings: CategorizedFinding[]): string {
   ].join("\\n");
 }
 
-function findingRationales(findings: CategorizedFinding[]): string {
+function findingRationalesBlock(findings: CategorizedFinding[]): string {
   if (findings.length === 0) {
-    return "No findings.";
+    return "";
   }
-  return findings
-    .map((finding, index) =>
-      [
-        \`### \${index + 1}. \${finding.title}\`,
-        "",
-        \`**Severity:** \${finding.severity.charAt(0).toUpperCase() + finding.severity.slice(1)}\`,
-        \`**Category:** \${finding.category.replaceAll("-", " ")}\`,
-        "",
-        finding.rationale,
-      ].join("\\n"),
-    )
-    .join("\\n\\n");
+  return [
+    "<details>",
+    "<summary>Finding rationales</summary>",
+    "",
+    findings
+      .map((finding, index) =>
+        [
+          \`### \${index + 1}. \${finding.title}\`,
+          "",
+          \`**Severity:** \${labelValue(finding.severity)}\`,
+          \`**Category:** \${labelValue(finding.category)}\`,
+          "",
+          finding.rationale,
+        ].join("\\n"),
+      )
+      .join("\\n\\n"),
+    "",
+    "</details>",
+  ].join("\\n");
+}
+
+function bulletList(items: string[], emptyText: string): string {
+  if (items.length === 0) {
+    return emptyText;
+  }
+  return items.map((item) => \`- \${lineText(item)}\`).join("\\n");
+}
+
+function labelValue(value: string): string {
+  return value.replaceAll("-", " ").replace(/^./, (char) => char.toUpperCase());
+}
+
+function lineText(value: string): string {
+  return value.replaceAll("\\n", " ").trim();
+}
+
+function tableCell(value: string): string {
+  return lineText(value).replaceAll("|", "\\\\|");
 }
 `
 };
@@ -2552,15 +2812,25 @@ const securitySastRecipe = {
 	configTs: `import { definePipr } from "@usepipr/sdk";
 import type { ReviewFinding } from "@usepipr/sdk";
 
+type SecuritySummary = {
+  headline: string;
+  riskLevel: "low" | "medium" | "high";
+  riskSummary: string;
+  reviewerFocus: string[];
+};
+
+type SecurityRisk = {
+  title: string;
+  category: "auth" | "injection" | "secret" | "crypto" | "data-exposure" | "other";
+  severity: "low" | "medium" | "high" | "critical";
+  rationale: string;
+  finding?: ReviewFinding;
+};
+
 type SecurityReview = {
-  summary: string;
-  risks: Array<{
-    title: string;
-    category: "auth" | "injection" | "secret" | "crypto" | "data-exposure" | "other";
-    severity: "low" | "medium" | "high" | "critical";
-    rationale: string;
-    finding?: ReviewFinding;
-  }>;
+  summary: SecuritySummary;
+  risks: SecurityRisk[];
+  diagramMermaid?: string;
 };
 
 export default definePipr((pipr) => {
@@ -2578,7 +2848,20 @@ export default definePipr((pipr) => {
       additionalProperties: false,
       required: ["summary", "risks"],
       properties: {
-        summary: { type: "string" },
+        summary: {
+          type: "object",
+          additionalProperties: false,
+          required: ["headline", "riskLevel", "riskSummary", "reviewerFocus"],
+          properties: {
+            headline: { type: "string" },
+            riskLevel: { type: "string", enum: ["low", "medium", "high"] },
+            riskSummary: { type: "string" },
+            reviewerFocus: {
+              type: "array",
+              items: { type: "string" },
+            },
+          },
+        },
         risks: {
           type: "array",
           items: {
@@ -2610,6 +2893,7 @@ export default definePipr((pipr) => {
             },
           },
         },
+        diagramMermaid: { type: "string" },
       },
     },
   });
@@ -2621,6 +2905,11 @@ export default definePipr((pipr) => {
       Review for exploitable security issues only. Focus on auth bypasses,
       injection, unsafe deserialization, secret exposure, cryptography misuse,
       authorization gaps, and data exposure. Do not report hypothetical style issues.
+      Make summary maintainer-facing and scannable with a concrete headline,
+      risk level, risk rationale, and only useful security follow-up. Set
+      diagramMermaid only when a high or critical risk has a concrete source-to-sink
+      path and a small Mermaid flowchart clarifies it. Do not include Markdown
+      fences in diagramMermaid.
     \`,
     output: securityOutput,
     tools: pipr.tools.readOnly,
@@ -2636,14 +2925,40 @@ export default definePipr((pipr) => {
     async run(ctx) {
       const manifest = await ctx.change.diffManifest({ compressed: true });
       const result = await ctx.pi.run(security, { manifest });
-      const inlineFindings = result.risks.flatMap((risk) => (risk.finding ? [risk.finding] : []));
-      if (result.risks.some((risk) => risk.severity === "critical" || risk.severity === "high")) {
+      const inlineFindings: ReviewFinding[] = result.risks.flatMap((risk) =>
+        risk.finding ? [risk.finding] : [],
+      );
+      const hasHighOrCriticalRisk = result.risks.some(isHighOrCriticalRisk);
+      const hasConcreteHighOrCriticalRisk = result.risks.some(
+        (risk) => isHighOrCriticalRisk(risk) && risk.finding,
+      );
+      if (hasHighOrCriticalRisk) {
         ctx.check.fail("High or critical security risk found.");
       } else {
         ctx.check.pass("No high or critical security risks found.");
       }
       await ctx.comment({
-        main: result.summary,
+        main: [
+          "## Summary",
+          "",
+          \`**\${result.summary.headline}**\`,
+          "",
+          securityStatusTable(result.summary, result.risks),
+          "",
+          result.summary.riskSummary,
+          "",
+          "## Reviewer Focus",
+          "",
+          bulletList(result.summary.reviewerFocus, "No special security follow-up."),
+          "",
+          "## Security Risks",
+          "",
+          securityRisksTable(result.risks),
+          ...(result.risks.length > 0 ? ["", riskRationalesBlock(result.risks)] : []),
+          ...(hasConcreteHighOrCriticalRisk && result.diagramMermaid?.trim()
+            ? ["", attackPathDiagramBlock(result.diagramMermaid, hasConcreteHighOrCriticalRisk)]
+            : []),
+        ].join("\\n"),
         inlineFindings,
       });
     },
@@ -2652,6 +2967,122 @@ export default definePipr((pipr) => {
   pipr.on.changeRequest({ actions: ["opened", "updated", "reopened", "ready"], task });
   pipr.command({ pattern: "@pipr security", permission: "write", task });
 });
+
+function securityStatusTable(summary: SecuritySummary, risks: SecurityRisk[]): string {
+  return [
+    "| Status | Summary risk | Max severity | Risks |",
+    "| --- | --- | --- | ---: |",
+    \`| \${risks.some(isHighOrCriticalRisk) ? "Fail" : "Pass"} | \${labelValue(
+      summary.riskLevel,
+    )} | \${maxSeverity(risks)} | \${risks.length} |\`,
+  ].join("\\n");
+}
+
+function securityRisksTable(risks: SecurityRisk[]): string {
+  if (risks.length === 0) {
+    return [
+      "| Severity | Category | Title |",
+      "| --- | --- | --- |",
+      "| - | - | No security risks found. |",
+    ].join("\\n");
+  }
+  return [
+    "| Severity | Category | Title |",
+    "| --- | --- | --- |",
+    ...risks.map(
+      (risk) =>
+        \`| \${labelValue(risk.severity)} | \${tableCell(risk.category)} | \${tableCell(risk.title)} |\`,
+    ),
+  ].join("\\n");
+}
+
+function riskRationalesBlock(risks: SecurityRisk[]): string {
+  if (risks.length === 0) {
+    return "";
+  }
+  return [
+    "<details>",
+    "<summary>Risk rationales</summary>",
+    "",
+    risks
+      .map((risk, index) =>
+        [
+          \`### \${index + 1}. \${risk.title}\`,
+          "",
+          \`**Severity:** \${labelValue(risk.severity)}\`,
+          \`**Category:** \${labelValue(risk.category)}\`,
+          "",
+          risk.rationale,
+        ].join("\\n"),
+      )
+      .join("\\n\\n"),
+    "",
+    "</details>",
+  ].join("\\n");
+}
+
+function attackPathDiagramBlock(
+  diagramMermaid: string | undefined,
+  hasConcreteHighOrCriticalRisk: boolean,
+): string {
+  const diagram = diagramMermaid?.trim();
+  if (!diagram || !hasConcreteHighOrCriticalRisk) {
+    return "";
+  }
+  const fence = markdownFenceFor(diagram);
+  return [
+    "<details>",
+    "<summary>Attack path diagram</summary>",
+    "",
+    \`\${fence}mermaid\`,
+    diagram,
+    fence,
+    "",
+    "</details>",
+  ].join("\\n");
+}
+
+function maxSeverity(risks: SecurityRisk[]): string {
+  const order: SecurityRisk["severity"][] = ["low", "medium", "high", "critical"];
+  const severity = risks.reduce<SecurityRisk["severity"] | undefined>((current, risk) => {
+    if (!current || order.indexOf(risk.severity) > order.indexOf(current)) {
+      return risk.severity;
+    }
+    return current;
+  }, undefined);
+  return severity ? labelValue(severity) : "None";
+}
+
+function isHighOrCriticalRisk(risk: SecurityRisk): boolean {
+  return risk.severity === "high" || risk.severity === "critical";
+}
+
+function bulletList(items: string[], emptyText: string): string {
+  if (items.length === 0) {
+    return emptyText;
+  }
+  return items.map((item) => \`- \${lineText(item)}\`).join("\\n");
+}
+
+function labelValue(value: string): string {
+  return value.replaceAll("-", " ").replace(/^./, (char) => char.toUpperCase());
+}
+
+function lineText(value: string): string {
+  return value.replaceAll("\\n", " ").trim();
+}
+
+function tableCell(value: string): string {
+  return lineText(value).replaceAll("|", "\\\\|");
+}
+
+function markdownFenceFor(value: string): string {
+  const longestBacktickRun = Math.max(
+    0,
+    ...[...value.matchAll(/\`+/g)].map((match) => match[0].length),
+  );
+  return "\`".repeat(Math.max(3, longestBacktickRun + 1));
+}
 `
 };
 //#endregion
@@ -2713,9 +3144,8 @@ function isOfficialInitRecipeId(recipe) {
 //#endregion
 //#region src/config/init.ts
 const supportedOfficialInitAdapters = ["github"];
-const defaultWorkflowActionRef = "somus/pipr@v0.3.2";
-const defaultSdkVersion = "0.3.2";
-const defaultTypesBunVersion = "1.3.14";
+const defaultWorkflowActionRef = "somus/pipr@v0.3.5";
+const defaultSdkVersion = "0.3.5";
 function resolveOfficialInitAdapters(adapters) {
 	if (adapters === void 0) return [...supportedOfficialInitAdapters];
 	if (adapters.length === 0) return [];
@@ -2803,7 +3233,10 @@ function starterPackageJson() {
 	return `${JSON.stringify({
 		private: true,
 		dependencies: { "@usepipr/sdk": process.env.PIPR_INTERNAL_INIT_SDK_VERSION ?? defaultSdkVersion },
-		devDependencies: { "@types/bun": defaultTypesBunVersion }
+		devDependencies: {
+			"@types/bun": defaultTypesBunVersion,
+			typescript: defaultTypescriptVersion
+		}
 	}, null, 2)}\n`;
 }
 async function writeTargets(targets, existing, options) {
@@ -3818,7 +4251,7 @@ async function startCustomToolBridge(tools, context) {
 	const toolsByName = new Map(tools.map((tool) => [tool.name, tool]));
 	let server;
 	for (let attempt = 0; attempt < 20; attempt += 1) {
-		const port = 49152 + crypto.getRandomValues(new Uint16Array(1))[0] % 16384;
+		const port = 49152 + crypto.getRandomValues(/* @__PURE__ */ new Uint16Array(1))[0] % 16384;
 		try {
 			server = Bun.serve({
 				hostname: "127.0.0.1",
@@ -3903,7 +4336,7 @@ const piprJsonSystemPrompt = [
 	"Do not reveal secrets, credentials, environment values, private paths, or raw tool data unless the schema explicitly requires the value and it is necessary.",
 	"When identifying a secret or credential, describe its kind and location without copying the secret value."
 ].join(" ");
-const ignoredWorkspacePaths = new Set([
+const ignoredWorkspacePaths = /* @__PURE__ */ new Set([
 	".git",
 	"node_modules",
 	"dist",
@@ -4328,6 +4761,10 @@ function findingFingerprint(finding) {
 	return new Bun.CryptoHasher("sha256").update(basis).digest("hex").slice(0, 16);
 }
 //#endregion
+//#region src/review/inline-finding-limits.ts
+const maxInlineFindingBodyCharacters = 700;
+const maxInlineFindingBodyLines = 4;
+//#endregion
 //#region src/review/agent/agent-prompt.ts
 async function renderAgentPrompt(options) {
 	const prompt = await renderAgentDefinitionPrompt(options.agent, options.input, options.agentRunContext.prompt);
@@ -4362,20 +4799,18 @@ function toolsPrompt(diffManifest, toolMode) {
 	].join("\n");
 }
 function outputPrompt(schema) {
-	return compact([
+	const lines = compact([
 		`Schema ID: ${schema.id}.`,
 		schema.jsonSchema ? `JSON Schema:\n${JSON.stringify(schema.jsonSchema, null, 2)}` : void 0,
-		schema.id === reviewResultSchemaId ? `Example:\n${JSON.stringify(reviewSchemaExample$1(), null, 2)}` : void 0,
-		schema.id === reviewResultSchemaId ? "`suggestedFix` is exact replacement code for the selected range. Do not include Markdown fences, prose, or labels in `suggestedFix`." : void 0,
-		schema.id === reviewResultSchemaId ? "GitHub applies `suggestedFix` to the selected `startLine` through `endLine`. Select the smallest contiguous line span that the replacement code should replace." : void 0,
-		schema.id === reviewResultSchemaId ? "If a fix changes only part of a line, select that whole line and put the full replacement line in `suggestedFix`. If a fix changes multiple lines, select exactly those original lines and put the full replacement block in `suggestedFix`." : void 0,
-		schema.id === reviewResultSchemaId ? "Do not select a larger enclosing block to replace a smaller statement, and do not select one line when the replacement is for a multi-line section. Omit `suggestedFix` if the exact replacement range is uncertain." : void 0,
-		schema.id === reviewResultSchemaId ? "Omit `suggestedFix` for broad rewrites, generated docs/pages, uncertain ranges, or changes better described in prose." : void 0,
 		"Return exactly one JSON value matching the schema.",
 		"The first non-whitespace character must be { or [ and the last non-whitespace character must be } or ].",
-		"Do not include Markdown, code fences, prose, explanations, or leading/trailing text.",
-		schema.id === reviewResultSchemaId ? "For inlineFindings, use only fields shown in the schema and only exact Diff Manifest commentable ranges. If no exact range applies, omit the finding." : void 0
-	]).join("\n\n");
+		"Do not include Markdown, code fences, prose, explanations, or leading/trailing text."
+	]);
+	if (schema.id === reviewResultSchemaId) {
+		lines.splice(2, 0, `Example:\n${JSON.stringify(reviewSchemaExample$1(), null, 2)}`, "`suggestedFix` is exact replacement code for the selected range. Do not include Markdown fences, prose, or labels in `suggestedFix`.", "GitHub applies `suggestedFix` to the selected `startLine` through `endLine`. Select the smallest contiguous line span that the replacement code should replace.", "If a fix changes only part of a line, select that whole line and put the full replacement line in `suggestedFix`. If a fix changes multiple lines, select exactly those original lines and put the full replacement block in `suggestedFix`.", "Do not select a larger enclosing block to replace a smaller statement, and do not select one line when the replacement is for a multi-line section. Omit `suggestedFix` if the exact replacement range is uncertain.", "Omit `suggestedFix` for broad rewrites, generated docs/pages, uncertain ranges, or changes better described in prose.");
+		lines.push("For inlineFindings, use only fields shown in the schema and only exact Diff Manifest commentable ranges. If no exact range applies, omit the finding.", `For inlineFindings.body, write the exact inline comment body. Use one short paragraph, at most two sentences, and at most 700 characters. Treat 700 as a hard ceiling, not a target; prefer 250-450 characters when possible.`);
+	}
+	return lines.join("\n\n");
 }
 function reviewPolicyPrompt(schema) {
 	if (schema.id !== reviewResultSchemaId) return;
@@ -4383,7 +4818,9 @@ function reviewPolicyPrompt(schema) {
 		"Review only changed behavior.",
 		"Report only actionable defects, security risks, regressions, or meaningful test gaps.",
 		"Put each actionable issue in inlineFindings. Do not leave actionable defects or test gaps only in the summary.",
-		"Keep each inline finding body to one short paragraph, at most two sentences, and under 700 characters.",
+		"Inline finding bodies are final code-review comments, not analysis notes.",
+		`State the concrete defect and user-visible or runtime impact directly. Keep each body to one short paragraph, at most two sentences, and at most 700 characters.`,
+		"Do not include step-by-step reasoning, broad context, praise, restated diff, alternatives, or code snippets unless they are necessary to identify the defect.",
 		"Omit speculative, style-only, broad refactor, external-fact, and out-of-diff findings.",
 		"Use read tools when more context is needed. If evidence is insufficient, omit the finding.",
 		"Emit one inline finding per issue, anchored to the exact Diff Manifest commentable range.",
@@ -4798,67 +5235,17 @@ function buildRepairPrompt(options) {
 	].join("\n\n");
 }
 //#endregion
-//#region package.json
-var version = "0.3.2";
-//#endregion
 //#region src/review/comment-branding.ts
-const piprLogoUrl = "https://pipr.run/apple-touch-icon.png";
+const piprLogoUrl = "https://pipr.run/images/pipr/pipr-mark.svg";
 const piprRepositoryUrl = "https://github.com/somus/pipr";
 const mainCommentTitle = `# <img src="${piprLogoUrl}" width="22" height="22" alt=""> Pipr Review`;
-const mainCommentTitles = new Set([
+const mainCommentTitles = /* @__PURE__ */ new Set([
 	"# pipr Review",
 	"# Pipr Review",
 	mainCommentTitle
 ]);
 const escapedRepositoryUrl = piprRepositoryUrl.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-const mainCommentAttributionPattern = new RegExp(`^<sub>Review generated by \\[Pipr\\]\\(${escapedRepositoryUrl}\\) for commit \`[^\`]+\`\\.</sub>$`);
-//#endregion
-//#region src/review/inline-publication-policy.ts
-const maxSuggestedFixSelectedLines = 12;
-const maxSuggestedFixReplacementLines = 20;
-function inlinePublicationDecision(options) {
-	if (options.existing.markers.has(options.marker) || hasExistingInlinePublicationLocation(options.existing.locations, options.location)) return "skip";
-	return "post";
-}
-function isPublishableSuggestedFixSelection(selection) {
-	const suggestedLines = normalizedSuggestedFixLines(selection.suggestedFix);
-	const selectedLineCount = selection.endLine - selection.startLine + 1;
-	if (selection.side !== "RIGHT" || selection.kind === "deleted" || selectedLineCount > maxSuggestedFixSelectedLines || suggestedLines.length > maxSuggestedFixReplacementLines) return false;
-	const originalLines = selectedPreviewLines(selection, selectedLineCount);
-	return Boolean(originalLines && !hasUnchangedSelectionEdge(originalLines, suggestedLines) && !suggestionIncludesUnselectedContext(selection, selectedLineCount, suggestedLines));
-}
-function hasExistingInlinePublicationLocation(existing, location) {
-	return existing.some((comment) => {
-		if (comment.path !== location.path || comment.commitId !== location.commitId || comment.side !== location.side) return false;
-		return comment.startLine <= location.endLine && location.startLine <= comment.endLine;
-	});
-}
-function normalizedSuggestedFixLines(value) {
-	const normalized = value.replace(/\r\n/g, "\n").replace(/\r/g, "\n");
-	const withoutFinalNewline = normalized.endsWith("\n") ? normalized.slice(0, -1) : normalized;
-	return withoutFinalNewline.length === 0 ? [] : withoutFinalNewline.split("\n");
-}
-function selectedPreviewLines(selection, selectedLineCount) {
-	if (!selection.preview) return;
-	const offset = selection.startLine - selection.rangeStartLine;
-	if (offset < 0) return;
-	const previewLines = selection.preview.replace(/\r\n/g, "\n").replace(/\r/g, "\n").split("\n");
-	if (offset + selectedLineCount > previewLines.length) return;
-	return previewLines.slice(offset, offset + selectedLineCount);
-}
-function suggestionIncludesUnselectedContext(selection, selectedLineCount, suggestedLines) {
-	if (!selection.preview || suggestedLines.length <= selectedLineCount) return false;
-	const offset = selection.startLine - selection.rangeStartLine;
-	if (offset < 0) return false;
-	const previewLines = selection.preview.replace(/\r\n/g, "\n").replace(/\r/g, "\n").split("\n");
-	return [offset > 0 ? previewLines[offset - 1] : void 0, previewLines[offset + selectedLineCount]].filter((line) => Boolean(line?.trim())).some((line) => suggestedLines.includes(line));
-}
-function hasUnchangedSelectionEdge(originalLines, suggestedLines) {
-	const firstLineUnchanged = originalLines[0] === suggestedLines[0];
-	const lastLineUnchanged = originalLines.at(-1) === suggestedLines.at(-1);
-	if (originalLines.length === suggestedLines.length || originalLines.length === 1) return firstLineUnchanged || lastLineUnchanged;
-	return firstLineUnchanged && lastLineUnchanged;
-}
+const mainCommentAttributionPattern = new RegExp(`^<sub>Review generated by \\[Pipr\\]\\(${escapedRepositoryUrl}\\) for commit \`[^\`]+\`\\.(?: Config SDK \\d+\\.\\d+\\.\\d+ is behind (?:Pipr \\d+\\.\\d+\\.\\d+|\\[Pipr \\d+\\.\\d+\\.\\d+\\]\\(${escapedRepositoryUrl}/releases/tag/v\\d+\\.\\d+\\.\\d+\\))\\.)?</sub>$`);
 //#endregion
 //#region src/review/prior-state.ts
 const mainCommentMarker = "pipr:main-comment";
@@ -5117,8 +5504,50 @@ function hashParts(parts) {
 	return new Bun.CryptoHasher("sha256").update(parts.join("\n")).digest("hex").slice(0, 16);
 }
 //#endregion
+//#region src/review/suggested-fix-publication-policy.ts
+const maxSuggestedFixSelectedLines = 12;
+const maxSuggestedFixReplacementLines = 20;
+function isPublishableSuggestedFixSelection(selection) {
+	const suggestedLines = normalizedSuggestedFixLines(selection.suggestedFix);
+	const selectedLineCount = selection.endLine - selection.startLine + 1;
+	if (selection.side !== "RIGHT" || selection.kind === "deleted" || selectedLineCount > maxSuggestedFixSelectedLines || suggestedLines.length > maxSuggestedFixReplacementLines) return false;
+	const originalLines = selectedPreviewLines(selection, selectedLineCount);
+	if (!originalLines) return false;
+	const structuralEdgePattern = /^([{}[\]()<>]+)[;,]?$/;
+	const firstOriginalEdge = originalLines[0]?.trim().match(structuralEdgePattern)?.[1];
+	const firstSuggestedEdge = suggestedLines[0]?.trim().match(structuralEdgePattern)?.[1];
+	const lastOriginalEdge = originalLines.at(-1)?.trim().match(structuralEdgePattern)?.[1];
+	const lastSuggestedEdge = suggestedLines.at(-1)?.trim().match(structuralEdgePattern)?.[1];
+	return (firstOriginalEdge === void 0 || firstOriginalEdge === firstSuggestedEdge) && (lastOriginalEdge === void 0 || lastOriginalEdge === lastSuggestedEdge) && !hasUnchangedSelectionEdge(originalLines, suggestedLines) && !suggestionIncludesUnselectedContext(selection, selectedLineCount, suggestedLines);
+}
+function normalizedSuggestedFixLines(value) {
+	const normalized = value.replace(/\r\n/g, "\n").replace(/\r/g, "\n");
+	const withoutFinalNewline = normalized.endsWith("\n") ? normalized.slice(0, -1) : normalized;
+	return withoutFinalNewline.length === 0 ? [] : withoutFinalNewline.split("\n");
+}
+function selectedPreviewLines(selection, selectedLineCount) {
+	if (!selection.preview) return;
+	const offset = selection.startLine - selection.rangeStartLine;
+	if (offset < 0) return;
+	const previewLines = selection.preview.replace(/\r\n/g, "\n").replace(/\r/g, "\n").split("\n");
+	if (offset + selectedLineCount > previewLines.length) return;
+	return previewLines.slice(offset, offset + selectedLineCount);
+}
+function suggestionIncludesUnselectedContext(selection, selectedLineCount, suggestedLines) {
+	if (!selection.preview || suggestedLines.length <= selectedLineCount) return false;
+	const offset = selection.startLine - selection.rangeStartLine;
+	if (offset < 0) return false;
+	const previewLines = selection.preview.replace(/\r\n/g, "\n").replace(/\r/g, "\n").split("\n");
+	return [offset > 0 ? previewLines[offset - 1] : void 0, previewLines[offset + selectedLineCount]].filter((line) => Boolean(line?.trim())).some((line) => suggestedLines.includes(line));
+}
+function hasUnchangedSelectionEdge(originalLines, suggestedLines) {
+	const firstLineUnchanged = originalLines[0] === suggestedLines[0];
+	const lastLineUnchanged = originalLines.at(-1) === suggestedLines.at(-1);
+	if (originalLines.length === suggestedLines.length || originalLines.length === 1) return firstLineUnchanged || lastLineUnchanged;
+	return firstLineUnchanged && lastLineUnchanged;
+}
+//#endregion
 //#region src/review/comment.ts
-const runtimeVersion = version;
 const inlinePublicationItemSchema = z.strictObject({
 	finding: reviewFindingSchema,
 	range: commentableRangeSchema,
@@ -5165,6 +5594,7 @@ const threadActionSchema = z.strictObject({
 const threadActionsSchema = z.array(threadActionSchema);
 const publicationMetadataSchema = z.strictObject({
 	runtimeVersion: z.string().min(1),
+	configVersion: z.string().min(1).optional(),
 	trustedConfigSha: z.string().min(1).optional(),
 	trustedConfigHash: z.string().min(1).optional(),
 	reviewedHeadSha: z.string().min(1),
@@ -5184,8 +5614,6 @@ const publicationPlanSchema = z.strictObject({
 	reviewState: priorReviewStateSchema,
 	threadActions: threadActionsSchema
 });
-const maxInlineFindingBodyCharacters = 700;
-const maxInlineFindingBodyLines = 4;
 function buildPublicationPlan(options) {
 	const reviewState = options.reviewState ?? buildPriorReviewState({
 		findings: options.inlineItems.map((item) => item.finding),
@@ -5202,7 +5630,7 @@ function buildPublicationPlan(options) {
 			event: options.event,
 			reviewState,
 			main: options.main,
-			reviewedHeadSha: metadata.reviewedHeadSha
+			metadata
 		}),
 		mainMarker: mainCommentMarker,
 		changeNumber: options.event.change.number,
@@ -5256,9 +5684,9 @@ function findingWithPublishableBody(finding) {
 	};
 }
 function conciseInlineFindingBody(value) {
-	const body = redactPotentialSecrets((value.replace(/\r\n/g, "\n").replace(/\r/g, "\n").trim().split(/\n{2,}/)[0] ?? value).split("\n").slice(0, maxInlineFindingBodyLines).join("\n").trim());
-	if (body.length <= maxInlineFindingBodyCharacters) return body;
-	return `${body.slice(0, maxInlineFindingBodyCharacters).trimEnd()}...`;
+	const body = redactPotentialSecrets((value.replace(/\r\n/g, "\n").replace(/\r/g, "\n").trim().split(/\n{2,}/)[0] ?? value).split("\n").slice(0, 4).join("\n").trim());
+	if (body.length <= 700) return body;
+	return `${body.slice(0, 700).trimEnd()}...`;
 }
 function findingWithPublishableSuggestedFix(finding, range) {
 	if (!finding.suggestedFix) return finding;
@@ -5290,10 +5718,19 @@ function renderMainComment(options) {
 		"",
 		redactPotentialSecrets(options.main),
 		"",
-		`<sub>Review generated by [Pipr](${piprRepositoryUrl}) for commit \`${options.reviewedHeadSha.slice(0, 7)}\`.</sub>`,
+		renderMainCommentAttribution(options.metadata),
 		""
 	].join("\n");
 }
+function renderMainCommentAttribution(metadata) {
+	const configNotice = configVersionNotice(metadata);
+	return `<sub>Review generated by [Pipr](${piprRepositoryUrl}) for commit \`${metadata.reviewedHeadSha.slice(0, 7)}\`.${configNotice}</sub>`;
+}
+function configVersionNotice(metadata) {
+	if (!metadata.configVersion || !stableSemverPattern.test(metadata.runtimeVersion) || !stableSemverPattern.test(metadata.configVersion) || compareStableSemver(metadata.runtimeVersion, metadata.configVersion) <= 0) return "";
+	const releaseUrl = `${piprRepositoryUrl}/releases/tag/v${metadata.runtimeVersion}`;
+	return ` Config SDK ${metadata.configVersion} is behind [Pipr ${metadata.runtimeVersion}](${releaseUrl}).`;
+}
 function renderInlineBody(finding, findingId, reviewedHeadSha) {
 	const findingBody = startsWithStructuredMarkdown(finding.body) ? finding.body : [
 		"**Issue**",
@@ -5725,9 +6162,9 @@ function trackResultFindingScope(state, value, paths) {
 	const parsed = agentInlineFindingsOutputSchema.safeParse(value);
 	if (parsed.success) state.findingScopes.set(parsed.data.inlineFindings, paths);
 }
-function collectedReview(output) {
+function collectedReview(output, summaryBody) {
 	return {
-		summary: { body: "Review completed." },
+		summary: { body: summaryBody },
 		inlineFindings: output.findings.map((item) => item.finding)
 	};
 }
@@ -5768,7 +6205,8 @@ async function runTaskRuntime(options) {
 			reason: options.emptyTasksReason,
 			taskName: options.taskName,
 			trustedConfigSha: options.trustedConfigSha,
-			trustedConfigHash: options.trustedConfigHash
+			trustedConfigHash: options.trustedConfigHash,
+			versionCompatibility: options.versionCompatibility
 		});
 	}
 	const selectedTasks = tasks.map((task) => task.name);
@@ -5863,7 +6301,8 @@ async function runTaskRuntime(options) {
 	});
 	if (commandResponse) return commandResponse;
 	assertReviewCommentOutput(output, options.commandInvocation !== void 0);
-	const validated = validateReviewResult(collectedReview(output), diffManifest, {
+	const main = typeof output.comment.value === "string" ? output.comment.value : output.comment.value.main ?? "Review completed.";
+	const validated = validateReviewResult(collectedReview(output, main), diffManifest, {
 		expectedHeadSha: options.event.change.head.sha,
 		pathScopeForFinding: (_finding, index) => output.findings[index]?.paths
 	});
@@ -5877,7 +6316,7 @@ async function runTaskRuntime(options) {
 	});
 	const publishing = buildCommentPublishingPlan({
 		event: options.event,
-		main: typeof output.comment.value === "string" ? output.comment.value : output.comment.value.main ?? "Review completed.",
+		main,
 		validated,
 		manifest: diffManifest,
 		maxInlineComments: config.publication.maxInlineComments,
@@ -5885,6 +6324,7 @@ async function runTaskRuntime(options) {
 		threadActions: verifier.threadActions,
 		metadata: {
 			runtimeVersion,
+			configVersion: options.versionCompatibility?.configVersion,
 			trustedConfigSha: options.trustedConfigSha,
 			trustedConfigHash: options.trustedConfigHash,
 			reviewedHeadSha: options.event.change.head.sha,
@@ -6075,6 +6515,7 @@ function skippedTaskRuntimeResult(options) {
 		maxInlineComments: options.config.publication.maxInlineComments,
 		metadata: {
 			runtimeVersion,
+			configVersion: options.versionCompatibility?.configVersion,
 			trustedConfigSha: options.trustedConfigSha,
 			trustedConfigHash: options.trustedConfigHash,
 			reviewedHeadSha: options.event.change.head.sha,
@@ -6143,7 +6584,7 @@ const githubRepositoryPermissionResponseSchema = z.looseObject({
 	permission: z.string().min(1),
 	role_name: z.string().min(1).optional()
 });
-const permissionLevels = new Set([
+const permissionLevels = /* @__PURE__ */ new Set([
 	"read",
 	"triage",
 	"write",
@@ -6802,6 +7243,18 @@ async function loadGitHubPriorMainComment(options) {
 	}), "pipr:main-comment", options.change.change.number, ownerLogin)?.body ?? void 0;
 }
 //#endregion
+//#region src/review/inline-publication-policy.ts
+function inlinePublicationDecision(options) {
+	if (options.existing.markers.has(options.marker) || hasExistingInlinePublicationLocation(options.existing.locations, options.location)) return "skip";
+	return "post";
+}
+function hasExistingInlinePublicationLocation(existing, location) {
+	return existing.some((comment) => {
+		if (comment.path !== location.path || comment.commitId !== location.commitId || comment.side !== location.side) return false;
+		return comment.startLine <= location.endLine && location.startLine <= comment.endLine;
+	});
+}
+//#endregion
 //#region src/hosts/github/inline.ts
 const githubReviewCommentLocationSchema = z.strictObject({
 	path: z.string().min(1),
@@ -7389,6 +7842,10 @@ function logTrustedRuntime(log, runtime) {
 		tasks: runtime.plan.tasks.length,
 		commands: runtime.plan.commands.length
 	});
+	logConfigWarnings(log, runtime.settings.warnings);
+}
+function logConfigWarnings(log, warnings) {
+	for (const warning of warnings) log.warning("config warning", { warning });
 }
 function addProviderSecrets(log, config, env) {
 	for (const provider of config.providers) log.addSecret((env ?? process.env)[provider.apiKeyEnv]);
@@ -7584,6 +8041,7 @@ async function runTrustedReviewAndPublish(options) {
 			event: options.event,
 			env: options.options.env,
 			plan: options.trustedRuntime.plan,
+			versionCompatibility: options.trustedRuntime.versionCompatibility,
 			taskName: options.taskName,
 			taskInput: options.taskInput,
 			commandInvocation: options.commandInvocation,
@@ -7655,7 +8113,8 @@ async function runTrustedReviewAndPublish(options) {
 async function loadRuntimeProjectFromGitCommit(options) {
 	const configDir = resolveContainedConfigDir(options);
 	const files = listConfigFilesAtCommit(options.rootDir, options.commitSha, configDir.gitPath);
-	if (files.length === 0) throw new Error(`${configDir.configDir}/config.ts is required at base commit ${options.commitSha}`);
+	const configPath = configDir.gitPath === "." ? "config.ts" : `${configDir.gitPath}/config.ts`;
+	if (files.length === 0 || !files.some((file) => file.path === configPath)) throw new Error(`No Pipr config found at ${configPath} in base commit ${options.commitSha}. Run \`pipr init\` and commit the generated config.`);
 	const tempRoot = await mkdtemp(path.join(os.tmpdir(), "pipr-base-config-"));
 	try {
 		const hash = new Bun.CryptoHasher("sha256");
@@ -8193,7 +8652,10 @@ async function runInspectCommand(options) {
 		...options,
 		requireProviderEnv: false
 	});
-	return inspectRuntimePlan(runtime.plan, runtime.settings.source);
+	return {
+		...inspectRuntimePlan(runtime.plan, runtime.settings.source),
+		warnings: runtime.settings.warnings
+	};
 }
 /** Loads the runtime config and pull request event without running review publication. */
 async function runDryRunCommand(options) {
@@ -8212,7 +8674,8 @@ async function runDryRunCommand(options) {
 	});
 	return {
 		configSource: runtime.settings.source,
-		event
+		event,
+		warnings: runtime.settings.warnings
 	};
 }
 /** Runs configured change-request tasks against local Git base and head revisions. */
@@ -8237,6 +8700,7 @@ async function runLocalReviewCommand(options) {
 		tasks: runtime.plan.tasks.length,
 		commands: runtime.plan.commands.length
 	});
+	if (log) logConfigWarnings(log, runtime.settings.warnings);
 	const selectedTasks = selectLocalReviewTasks(runtime.plan);
 	const includeWorkingTree = options.headSha === void 0;
 	const headSha = options.headSha ?? runGit$1(["rev-parse", "HEAD"], options.rootDir).trim();
@@ -8259,6 +8723,7 @@ async function runLocalReviewCommand(options) {
 		event,
 		env: options.env,
 		plan: runtime.plan,
+		versionCompatibility: runtime.versionCompatibility,
 		selectedTasks,
 		emptyTasksReason: "No change-request tasks are configured for local review",
 		piExecutable: options.piExecutable,
@@ -8309,6 +8774,6 @@ async function runActionCommandWithDependencies(options) {
 	});
 }
 //#endregion
-export { runInspectCommand as a, PublicationError as c, listOfficialInitRecipes as d, supportedOfficialInitRecipes as f, piThinkingLevels as g, piRequiredCliFlags as h, runInitCommand as i, isPublishableSuggestedFixSelection as l, piReadOnlyToolNames as m, runActionCommandWithDependencies as n, runLocalReviewCommand as o, piBuiltinToolNames as p, runDryRunCommand as r, runValidateCommand as s, runActionCommand as t, supportedOfficialInitAdapters as u };
+export { piRequiredCliFlags as _, runInspectCommand as a, PublicationError as c, maxInlineFindingBodyLines as d, supportedOfficialInitAdapters as f, piReadOnlyToolNames as g, piBuiltinToolNames as h, runInitCommand as i, isPublishableSuggestedFixSelection as l, supportedOfficialInitRecipes as m, runActionCommandWithDependencies as n, runLocalReviewCommand as o, listOfficialInitRecipes as p, runDryRunCommand as r, runValidateCommand as s, runActionCommand as t, maxInlineFindingBodyCharacters as u, piThinkingLevels as v };
 
-//# sourceMappingURL=commands-CQg9QVZt.mjs.map
+//# sourceMappingURL=commands-DCpIxJkz.mjs.map