@usepipr/runtime 0.4.3 → 0.6.0

package/dist/{official-github-workflow-Bjlu-FL3.mjs → official-github-workflow-B3yeaCgq.mjs}

@@ -16,7 +16,7 @@ export default definePipr((pipr) => {
     provider: "deepseek",
     model: "deepseek-v4-pro",
     apiKey: pipr.secret({ name: "DEEPSEEK_API_KEY" }),
-    options: { thinking: "high" },
+    thinking: "high",
   });
 
   const fallback = pipr.model({
@@ -24,29 +24,29 @@ export default definePipr((pipr) => {
     provider: "deepseek",
     model: "deepseek-v4-pro",
     apiKey: pipr.secret({ name: "DEEPSEEK_API_KEY" }),
-    options: { thinking: "medium" },
+    thinking: "medium",
   });
 
   pipr.config({ publication: { maxInlineComments: 8 } });
 
-  const reviewer = pipr.reviewer({
-    name: "bug-hunter",
-    model: primary,
-    fallbacks: [fallback],
-    instructions: \`
-      Review only defects with a reproducible failure path or a violated
-      repository contract: broken logic, edge cases, concurrency risks, data
-      loss, performance regressions, and behavior changes missing meaningful
-      tests. For API, async, state, and concurrency changes, inspect relevant
-      callers and tests before reporting. Suppress generic maintainability,
-      style-only, and broad refactor feedback.
-    \`,
-    timeout: "7m",
-  });
-
   pipr.review({
     id: "bug-hunter",
-    reviewer,
+    model: primary,
+    fallbacks: [fallback],
+    instructions: {
+      findings: \`
+        Review only defects with a reproducible failure path or a violated
+        repository contract: broken logic, edge cases, concurrency risks, data
+        loss, performance regressions, and behavior changes missing meaningful
+        tests. For API, async, state, and concurrency changes, inspect relevant
+        callers and tests before reporting. Suppress generic maintainability,
+        style-only, and broad refactor feedback.
+      \`,
+      summary: \`
+        Summarize the changed behavior and concrete defect risk. Use merged
+        findings as evidence and omit generic praise or speculative concerns.
+      \`,
+    },
     paths: {
       exclude: ["docs/**", "**/*.md"],
     },
@@ -77,7 +77,7 @@ export default definePipr((pipr) => {
     provider: "deepseek",
     model: "deepseek-v4-pro",
     apiKey: pipr.secret({ name: "DEEPSEEK_API_KEY" }),
-    options: { thinking: "medium" },
+    thinking: "medium",
   });
 
   const changelogOutput = pipr.schema({
@@ -140,7 +140,7 @@ export default definePipr((pipr) => {
     provider: "deepseek",
     model: "deepseek-v4-pro",
     apiKey: pipr.secret({ name: "DEEPSEEK_API_KEY" }),
-    options: { thinking: "high" },
+    thinking: "high",
   });
 
   const ciTriageOutput = pipr.schema({
@@ -241,7 +241,7 @@ export default definePipr((pipr) => {
     provider: "deepseek",
     model: "deepseek-v4-pro",
     apiKey: pipr.secret({ name: "DEEPSEEK_API_KEY" }),
-    options: { thinking: "high" },
+    thinking: "high",
   });
 
   pipr.config({ publication: { maxInlineComments: 5 } });
@@ -249,12 +249,18 @@ export default definePipr((pipr) => {
   pipr.review({
     id: "review",
     model,
-    instructions: \`
-      Review changed behavior for correctness, security, maintainability, and
-      meaningful regression gaps. Focus on concrete impact and compatibility
-      with repository contracts. Return only actionable findings that target
-      valid diff ranges.
-    \`,
+    instructions: {
+      findings: \`
+        Review changed behavior for correctness, security, maintainability, and
+        meaningful regression gaps. Focus on concrete impact and compatibility
+        with repository contracts. Return only actionable findings that target
+        valid diff ranges.
+      \`,
+      summary: \`
+        Summarize the changed behavior, overall risk, and useful reviewer focus.
+        Use merged findings as evidence without introducing new defects.
+      \`,
+    },
     timeout: "10m",
     comment: (result, context) => {
       const inlineFindingSummary =
@@ -281,7 +287,7 @@ export default definePipr((pipr) => {
           "| --- | ---: |",
           \`| Inline findings | \${result.inlineFindings.length} |\`,
           "",
-          context.platform.id === "local" ? localInlineFindingSummary : inlineFindingSummary,
+          context.run.trigger === "local" ? localInlineFindingSummary : inlineFindingSummary,
         ].join("\\n"),
         inlineFindings: result.inlineFindings,
       };
@@ -304,7 +310,7 @@ export default definePipr((pipr) => {
     provider: "deepseek",
     model: "deepseek-v4-pro",
     apiKey: pipr.secret({ name: "DEEPSEEK_API_KEY" }),
-    options: { thinking: "high" },
+    thinking: "high",
   });
 
   const dependencyOutput = pipr.schema({
@@ -404,7 +410,7 @@ export default definePipr((pipr) => {
     provider: "deepseek",
     model: "deepseek-v4-pro",
     apiKey: pipr.secret({ name: "DEEPSEEK_API_KEY" }),
-    options: { thinking: "high" },
+    thinking: "high",
   });
 
   const diagnosticOutput = pipr.schema({
@@ -480,7 +486,7 @@ export default definePipr((pipr) => {
     provider: "deepseek",
     model: "deepseek-v4-pro",
     apiKey: pipr.secret({ name: "DEEPSEEK_API_KEY" }),
-    options: { thinking: "high" },
+    thinking: "high",
   });
 
   pipr.config({ publication: { maxInlineComments: 6 } });
@@ -1063,7 +1069,7 @@ export default definePipr((pipr) => {
     provider: "deepseek",
     model: "deepseek-v4-pro",
     apiKey: pipr.secret({ name: "DEEPSEEK_API_KEY" }),
-    options: { thinking: "high" },
+    thinking: "high",
   });
 
   const askAgent = pipr.agent({
@@ -1109,6 +1115,7 @@ export default definePipr((pipr) => {
 //#region src/config/recipes/multi-agent-review.ts
 const multiAgentReviewRecipe = {
 	id: "multi-agent-review",
+	requiresChecksPermission: true,
 	title: "Multi-agent Review",
 	description: "Security, test, and maintainability agents with an aggregator agent.",
 	sourceTools: [
@@ -1124,7 +1131,7 @@ export default definePipr((pipr) => {
     provider: "deepseek",
     model: "deepseek-v4-pro",
     apiKey: pipr.secret({ name: "DEEPSEEK_API_KEY" }),
-    options: { thinking: "high" },
+    thinking: "high",
   });
 
   const fast = pipr.model({
@@ -1132,7 +1139,7 @@ export default definePipr((pipr) => {
     provider: "deepseek",
     model: "deepseek-v4-pro",
     apiKey: pipr.secret({ name: "DEEPSEEK_API_KEY" }),
-    options: { thinking: "medium" },
+    thinking: "medium",
   });
 
   const specialistPrompt = (input: { manifest: unknown; focus: string }) => pipr.prompt\`
@@ -1222,17 +1229,17 @@ export default definePipr((pipr) => {
 const pluginToolReviewRecipe = {
 	id: "plugin-tool-review",
 	title: "Plugin Tool Review",
-	description: "Typed R2-backed memory plugin for reviewer agents that need durable project context.",
+	description: "Typed R2-backed memory plugin with search-only review and explicit maintainer curation.",
 	sourceTools: ["Cloudflare R2", "Reviewer memory"],
 	configTs: `import { definePipr } from "@usepipr/sdk";
-import { r2MemoryPlugin } from "./r2-memory";
+import { memoryLimits, r2MemoryPlugin } from "./r2-memory";
 
 export default definePipr((pipr) => {
   const model = pipr.model({
     provider: "deepseek",
     model: "deepseek-v4-pro",
     apiKey: pipr.secret({ name: "DEEPSEEK_API_KEY" }),
-    options: { thinking: "high" },
+    thinking: "high",
   });
 
   const memory = pipr.use(
@@ -1277,8 +1284,44 @@ export default definePipr((pipr) => {
     },
   });
 
+  const rememberTask = pipr.task<{ lesson: string }>({
+    name: "remember-review-memory",
+    async run(ctx, input) {
+      if (!ctx.command) {
+        throw new Error("remember-review-memory is a command-only task");
+      }
+      const lesson = input.lesson.trim();
+      if (lesson.length === 0) {
+        await ctx.command.reply("Usage: @pipr remember <lesson...>");
+        return;
+      }
+      if (lesson.length > memoryLimits.bodyCharacters) {
+        await ctx.command.reply(
+          "Reviewer memory must be " + memoryLimits.bodyCharacters + " characters or fewer.",
+        );
+        return;
+      }
+      const stored = await memory.curate(
+        {
+          subject: lesson.slice(0, memoryLimits.subjectCharacters),
+          body: lesson,
+          tags: ["maintainer-curated"],
+        },
+        ctx,
+      );
+      await ctx.command.reply("Stored reviewer memory \`" + stored.id + "\`.");
+    },
+  });
+
   pipr.on.changeRequest({ actions: ["opened", "updated"], task });
   pipr.command({ pattern: "@pipr memory-review", permission: "write", task });
+  pipr.command({
+    pattern: "@pipr remember <lesson...>",
+    permission: "write",
+    description: "Store an explicit maintainer-curated reviewer lesson.",
+    parse: (args) => ({ lesson: args.lesson ?? "" }),
+    task: rememberTask,
+  });
 });
 `,
 	files: [{
@@ -1286,22 +1329,55 @@ export default definePipr((pipr) => {
 		contents: `import { S3Client } from "bun";
 import { definePlugin, type SecretRef, type TaskContext, z } from "@usepipr/sdk";
 
+export const memoryLimits = {
+  subjectCharacters: 120,
+  bodyCharacters: 4000,
+  tagCount: 12,
+  tagCharacters: 50,
+  queryCharacters: 500,
+  resultDefault: 5,
+  resultMinimum: 1,
+  resultMaximum: 20,
+  searchObjectMaximum: 2000,
+} as const;
+
+const memorySource = z.strictObject({
+  kind: z.enum(["maintainer-command", "agent-tool"]),
+  runId: z.string().min(1).max(200),
+  platform: z.string().min(1).max(50),
+  changeRequestNumber: z.number().int().nonnegative().optional(),
+  headSha: z.string().min(1).max(200),
+});
+
 const memoryItem = z.strictObject({
-  subject: z.string(),
-  body: z.string(),
-  tags: z.array(z.string()).optional(),
-  updatedAt: z.string().optional(),
+  id: z.string().uuid().optional(),
+  subject: z.string().trim().min(1).max(memoryLimits.subjectCharacters),
+  body: z.string().trim().min(1).max(memoryLimits.bodyCharacters),
+  tags: z
+    .array(z.string().trim().min(1).max(memoryLimits.tagCharacters))
+    .max(memoryLimits.tagCount)
+    .optional(),
+  source: memorySource.optional(),
+  updatedAt: z.string().max(50).optional(),
 });
 
 const memorySearchInput = z.strictObject({
-  query: z.string(),
-  limit: z.number().optional(),
+  query: z.string().trim().min(1).max(memoryLimits.queryCharacters),
+  limit: z
+    .number()
+    .int()
+    .min(memoryLimits.resultMinimum)
+    .max(memoryLimits.resultMaximum)
+    .optional(),
 });
 
 const memoryStoreInput = z.strictObject({
-  subject: z.string(),
-  body: z.string(),
-  tags: z.array(z.string()).optional(),
+  subject: z.string().trim().min(1).max(memoryLimits.subjectCharacters),
+  body: z.string().trim().min(1).max(memoryLimits.bodyCharacters),
+  tags: z
+    .array(z.string().trim().min(1).max(memoryLimits.tagCharacters))
+    .max(memoryLimits.tagCount)
+    .optional(),
 });
 
 type MemoryItem = ReturnType<typeof memoryItem.parse>;
@@ -1328,6 +1404,7 @@ export function r2MemoryPlugin(options: R2MemoryOptions) {
       id: "memory/search-output",
       schema: z.strictObject({
         memories: z.array(memoryItem),
+        skippedObjects: z.number().int().nonnegative(),
       }),
     });
     const storeInput = pipr.schema({
@@ -1339,6 +1416,7 @@ export function r2MemoryPlugin(options: R2MemoryOptions) {
       schema: z.strictObject({
         stored: z.boolean(),
         key: z.string(),
+        id: z.string().uuid(),
       }),
     });
 
@@ -1361,12 +1439,15 @@ export function r2MemoryPlugin(options: R2MemoryOptions) {
         input: storeInput,
         output: storeOutput,
         async run({ input, ctx, signal }) {
-          return await storeMemory(input, ctx, options, signal);
+          return await storeMemory(input, ctx, options, "agent-tool", signal);
         },
         toModelOutput(output) {
           return output;
         },
       }),
+      curate(input: MemoryStoreInput, ctx: TaskContext, signal?: AbortSignal) {
+        return storeMemory(input, ctx, options, "maintainer-command", signal);
+      },
     };
   });
 }
@@ -1376,29 +1457,52 @@ async function searchMemory(
   ctx: TaskContext,
   options: R2MemoryOptions,
   signal?: AbortSignal,
-): Promise<{ memories: MemoryItem[] }> {
+): Promise<{ memories: MemoryItem[]; skippedObjects: number }> {
   signal?.throwIfAborted();
   const bucket = r2Bucket(ctx, options);
-  const listed = await bucket.list({ prefix: memoryPrefix(ctx, options) + "/", maxKeys: 200 });
   const memories: MemoryItem[] = [];
+  let continuationToken: string | undefined;
+  let scannedObjects = 0;
+  let skippedObjects = 0;
 
-  for (const object of listed.contents ?? []) {
+  do {
     signal?.throwIfAborted();
-    try {
-      const value = memoryItem.parse(await bucket.file(object.key).json());
-      if (matchesMemory(value, input.query)) {
-        memories.push(value);
+    const listed = await bucket.list({
+      prefix: memoryPrefix(ctx, options) + "/",
+      maxKeys: 200,
+      continuationToken,
+    });
+
+    const objects = (listed.contents ?? []).slice(
+      0,
+      memoryLimits.searchObjectMaximum - scannedObjects,
+    );
+    scannedObjects += objects.length;
+    for (const object of objects) {
+      signal?.throwIfAborted();
+      try {
+        const value = memoryItem.parse(await bucket.file(object.key).json());
+        if (matchesMemory(value, input.query)) {
+          memories.push(value);
+        }
+      } catch {
+        // Exclude malformed or concurrently deleted objects and report the count.
+        skippedObjects += 1;
       }
-    } catch {
-      // Ignore malformed or concurrently deleted memory objects.
     }
-  }
 
-  const limit = Math.min(Math.max(Math.trunc(input.limit ?? 5), 1), 20);
+    continuationToken = listed.isTruncated ? listed.nextContinuationToken : undefined;
+  } while (continuationToken && scannedObjects < memoryLimits.searchObjectMaximum);
+
+  const limit = Math.min(
+    Math.max(Math.trunc(input.limit ?? memoryLimits.resultDefault), memoryLimits.resultMinimum),
+    memoryLimits.resultMaximum,
+  );
   return {
     memories: memories
       .sort((left, right) => (right.updatedAt ?? "").localeCompare(left.updatedAt ?? ""))
       .slice(0, limit),
+    skippedObjects,
   };
 }
 
@@ -1406,14 +1510,53 @@ async function storeMemory(
   input: MemoryStoreInput,
   ctx: TaskContext,
   options: R2MemoryOptions,
+  sourceKind: "maintainer-command" | "agent-tool",
   signal?: AbortSignal,
-): Promise<{ stored: boolean; key: string }> {
+): Promise<{ stored: boolean; key: string; id: string }> {
   signal?.throwIfAborted();
   const bucket = r2Bucket(ctx, options);
-  const entry: MemoryItem = { ...input, updatedAt: new Date().toISOString() };
-  const key = memoryKey(input.subject, ctx, options);
+  const parsedInput = memoryStoreInput.parse(input);
+  const curatedKey =
+    sourceKind === "maintainer-command"
+      ? memoryPrefix(ctx, options) +
+        "/maintainer-command/" +
+        encodeURIComponent(ctx.run.id) +
+        ".json"
+      : undefined;
+
+  const id = curatedKey ? await stableCommandMemoryId(ctx.run.id) : crypto.randomUUID();
+  const entry = memoryItem.parse({
+    ...parsedInput,
+    id,
+    source: {
+      kind: sourceKind,
+      runId: ctx.run.id,
+      platform: ctx.platform.id,
+      changeRequestNumber: ctx.change.number,
+      headSha: ctx.change.head.sha,
+    },
+    updatedAt: new Date().toISOString(),
+  });
+  const key = curatedKey ?? memoryKey(id, parsedInput.subject, ctx, options);
   await bucket.write(key, JSON.stringify(entry, null, 2), { type: "application/json" });
-  return { stored: true, key };
+  return { stored: true, key, id };
+}
+
+async function stableCommandMemoryId(runId: string): Promise<string> {
+  const digest = new Uint8Array(
+    await crypto.subtle.digest(
+      "SHA-256",
+      new TextEncoder().encode("pipr-memory/maintainer-command/" + runId),
+    ),
+  );
+  digest[6] = (digest[6]! & 0x0f) | 0x50;
+  digest[8] = (digest[8]! & 0x3f) | 0x80;
+  const hex = Array.from(digest.slice(0, 16), (byte) => byte.toString(16).padStart(2, "0")).join(
+    "",
+  );
+  return [hex.slice(0, 8), hex.slice(8, 12), hex.slice(12, 16), hex.slice(16, 20), hex.slice(20)].join(
+    "-",
+  );
 }
 
 function r2Bucket(ctx: TaskContext, options: R2MemoryOptions): S3Client {
@@ -1444,14 +1587,26 @@ function cleanPathSegment(value: string): string {
   );
 }
 
-function memoryKey(subject: string, ctx: TaskContext, options: R2MemoryOptions): string {
+function memoryKey(
+  id: string,
+  subject: string,
+  ctx: TaskContext,
+  options: R2MemoryOptions,
+): string {
   const slug = subject
     .toLowerCase()
     .replace(/[^a-z0-9]+/g, "-")
     .replace(/^-|-$/g, "")
     .slice(0, 60);
   return (
-    memoryPrefix(ctx, options) + "/" + new Date().toISOString() + "-" + (slug || "memory") + ".json"
+    memoryPrefix(ctx, options) +
+    "/" +
+    new Date().toISOString() +
+    "-" +
+    id +
+    "-" +
+    (slug || "memory") +
+    ".json"
   );
 }
 
@@ -1488,7 +1643,9 @@ function matchesMemory(item: MemoryItem, query: string): boolean {
 
 This recipe uses Bun's S3-compatible client against Cloudflare R2. R2 credentials are declared with \`pipr.secret(...)\`, then resolved inside tool execution with \`ctx.secret(...)\`. The generated GitHub workflow maps \`PIPR_R2_MEMORY_BUCKET\`, \`PIPR_R2_MEMORY_ENDPOINT\`, \`PIPR_R2_MEMORY_ACCESS_KEY_ID\`, and \`PIPR_R2_MEMORY_SECRET_ACCESS_KEY\` repository secrets into matching runtime environment variables.
 
-R2 is object storage, not a search index. The sample lists recent JSON memory objects under \`prefix/repository-owner/repository-name\` and filters them locally, which is enough for small reviewer-memory sets. Change \`prefix\` in \`.pipr/config.ts\` when multiple repositories share one bucket; Pipr still adds the repository scope below it. The generated reviewer treats memory as untrusted historical context and requires current repository evidence for findings. It only searches memory by default. The store tool is available for explicit customization, but full review summaries are not persisted automatically.
+R2 is object storage, not a search index. The sample paginates up to 2,000 JSON memory objects under \`prefix/repository-owner/repository-name\` and filters them locally, which keeps each search bounded and is enough for small reviewer-memory sets. Change \`prefix\` in \`.pipr/config.ts\` when multiple repositories share one bucket; Pipr still adds the repository scope below it. The generated defaults cap subjects at 120 characters, bodies at 4,000 characters, tags at 12 entries of 50 characters, queries at 500 characters, and results at 20. Existing entries without ids or provenance remain readable when they satisfy those bounds. Search results include \`skippedObjects\`, the number of malformed, unavailable, or over-limit objects excluded during that search, so upgrades do not hide incompatible entries without a diagnostic.
+
+The generated reviewer treats memory as untrusted historical context and requires current repository evidence for findings. It only searches memory by default. A repository user with write permission can store one bounded, provenance-bearing lesson with \`@pipr remember <lesson...>\`; re-delivery of the same command run deterministically reuses its stored object and UUID. Full review summaries and human feedback are not persisted automatically; feedback collection, eval generation, scheduling, and proposal pull requests remain user-owned extensions.
 
 `
 };
@@ -1506,7 +1663,7 @@ export default definePipr((pipr) => {
     provider: "deepseek",
     model: "deepseek-v4-pro",
     apiKey: pipr.secret({ name: "DEEPSEEK_API_KEY" }),
-    options: { thinking: "medium" },
+    thinking: "medium",
   });
 
   pipr.config({ publication: { maxInlineComments: 0 } });
@@ -1693,6 +1850,7 @@ function markdownFenceFor(value: string): string {
 //#region src/config/recipes/pr-hygiene.ts
 const prHygieneRecipe = {
 	id: "pr-hygiene",
+	requiresChecksPermission: true,
 	title: "PR Hygiene",
 	description: "Change request hygiene checks for tests, docs, lockfiles, and size.",
 	sourceTools: ["Danger JS"],
@@ -1704,7 +1862,7 @@ export default definePipr((pipr) => {
     provider: "deepseek",
     model: "deepseek-v4-pro",
     apiKey: pipr.secret({ name: "DEEPSEEK_API_KEY" }),
-    options: { thinking: "medium" },
+    thinking: "medium",
   });
 
   pipr.config({ publication: { maxInlineComments: 5 } });
@@ -1852,6 +2010,7 @@ function policyTable(checks: PolicyCheck[]): string {
 //#region src/config/recipes/quality-gate.ts
 const qualityGateRecipe = {
 	id: "quality-gate",
+	requiresChecksPermission: true,
 	title: "Quality Gate",
 	description: "Required review check that fails on blocking correctness and test risks.",
 	sourceTools: ["SonarQube", "Snyk"],
@@ -1863,7 +2022,7 @@ export default definePipr((pipr) => {
     provider: "deepseek",
     model: "deepseek-v4-pro",
     apiKey: pipr.secret({ name: "DEEPSEEK_API_KEY" }),
-    options: { thinking: "high" },
+    thinking: "high",
   });
 
   pipr.config({
@@ -2144,7 +2303,11 @@ const structuredReviewRecipe = {
 		"Greptile"
 	],
 	configTs: `import { definePipr, z } from "@usepipr/sdk";
-import type { ReviewFinding } from "@usepipr/sdk";
+import type {
+  DefaultReviewSummaryManifest,
+  DiffManifest,
+  ReviewFinding,
+} from "@usepipr/sdk";
 
 type ReviewSummary = {
   headline: string;
@@ -2155,7 +2318,7 @@ type ReviewSummary = {
 };
 
 const categorizedFindingSchema = z.strictObject({
-  title: z.string().regex(/^[^\\r\\n]+$/),
+  title: z.string().min(1).max(160),
   severity: z.enum(["critical", "high", "medium", "low"]),
   category: z.enum([
     "correctness",
@@ -2166,24 +2329,121 @@ const categorizedFindingSchema = z.strictObject({
     "maintainability",
     "documentation",
   ]),
-  rationale: z.string(),
-  body: z.string(),
-  path: z.string(),
-  rangeId: z.string(),
+  rationale: z.string().min(1).max(1200),
+  body: z.string().min(1).max(700),
+  path: z.string().min(1),
+  rangeId: z.string().min(1),
   side: z.enum(["RIGHT", "LEFT"]),
   startLine: z.number().int().positive(),
   endLine: z.number().int().positive(),
-  suggestedFix: z.string().optional(),
+  suggestedFix: z.string().min(1).optional(),
 });
+type CategorizedFinding = ReviewFinding & {
+  title: string;
+  severity: "critical" | "high" | "medium" | "low";
+  category:
+    | "correctness"
+    | "security"
+    | "reliability"
+    | "performance"
+    | "test-coverage"
+    | "maintainability"
+    | "documentation";
+  rationale: string;
+};
 
 const reviewSummarySchema = z.strictObject({
-  headline: z.string(),
-  changeSummary: z.array(z.string()).min(1).max(4),
+  headline: z.string().min(1).max(160),
+  changeSummary: z.array(z.string().min(1).max(500)).min(1).max(4),
   riskLevel: z.enum(["low", "medium", "high"]),
-  riskSummary: z.string(),
-  reviewerFocus: z.array(z.string()).max(4),
+  riskSummary: z.string().min(1).max(500),
+  reviewerFocus: z.array(z.string().min(1).max(500)).max(4),
 });
 
+const severityRank = { critical: 0, high: 1, medium: 2, low: 3 } as const;
+
+function hasCommentableAnchor(
+  finding: ReviewFinding,
+  manifest: DiffManifest,
+): boolean {
+  const range = manifest.files
+    .find((file) => file.path === finding.path)
+    ?.commentableRanges.find(
+      (candidate) =>
+        candidate.id === finding.rangeId &&
+        candidate.path === finding.path &&
+        candidate.side === finding.side,
+    );
+  return Boolean(
+    range &&
+      finding.startLine <= finding.endLine &&
+      finding.startLine >= range.startLine &&
+      finding.endLine <= range.endLine,
+  );
+}
+
+function deduplicateFindings(findings: CategorizedFinding[]): CategorizedFinding[] {
+  const seen = new Set<string>();
+  return findings.filter((finding) => {
+    const key = JSON.stringify([
+      finding.path,
+      finding.rangeId,
+      finding.side,
+      finding.startLine,
+      finding.endLine,
+      finding.body,
+    ]);
+    if (seen.has(key)) {
+      return false;
+    }
+    seen.add(key);
+    return true;
+  });
+}
+
+function summaryManifest(manifest: DiffManifest): DefaultReviewSummaryManifest {
+  const files: DefaultReviewSummaryManifest["files"][number][] = [];
+  let serializedCharacters = 0;
+
+  for (const file of manifest.files) {
+    const projected = {
+      path: file.path.slice(0, 1_000),
+      ...(file.previousPath
+        ? { previousPath: file.previousPath.slice(0, 1_000) }
+        : {}),
+      status: file.status,
+      ...(file.language ? { language: file.language.slice(0, 100) } : {}),
+      additions: file.additions,
+      deletions: file.deletions,
+      ...(file.changedSymbols?.length
+        ? {
+            changedSymbols: file.changedSymbols
+              .slice(0, 20)
+              .map((symbol) => symbol.slice(0, 200)),
+          }
+        : {}),
+      ...(file.excludedReason
+        ? { excludedReason: file.excludedReason.slice(0, 500) }
+        : {}),
+    };
+    const projectedCharacters = JSON.stringify(projected).length;
+    if (serializedCharacters + projectedCharacters > 40_000) {
+      continue;
+    }
+    files.push(projected);
+    serializedCharacters += projectedCharacters;
+  }
+
+  return {
+    baseSha: manifest.baseSha,
+    headSha: manifest.headSha,
+    mergeBaseSha: manifest.mergeBaseSha,
+    fileCount: manifest.files.length,
+    omittedFileCount: manifest.files.length - files.length,
+    files,
+  };
+}
+
 function escapeInlineCommentHtml(value: string): string {
   return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
 }
@@ -2193,21 +2453,33 @@ export default definePipr((pipr) => {
     provider: "deepseek",
     model: "deepseek-v4-pro",
     apiKey: pipr.secret({ name: "DEEPSEEK_API_KEY" }),
-    options: { thinking: "high" },
+    thinking: "high",
   });
 
-  pipr.config({ publication: { maxInlineComments: 8 } });
+  pipr.config({
+    publication: {
+      maxInlineComments: 8,
+      autoResolve: {
+        enabled: true,
+        synchronize: true,
+        userReplies: {
+          enabled: true,
+          respondWhenStillValid: true,
+          allowedActors: "write",
+        },
+      },
+    },
+  });
 
-  const reviewOutput = pipr.schema({
+  const findingsOutput = pipr.schema({
     id: "review/categorized-findings",
     schema: z.strictObject({
-      summary: reviewSummarySchema,
-      findings: z.array(categorizedFindingSchema),
+      inlineFindings: z.array(categorizedFindingSchema),
     }),
   });
 
-  const reviewer = pipr.agent({
-    name: "reviewer",
+  const findingsReviewer = pipr.agent({
+    name: "findings-reviewer",
     model,
     instructions: \`
       Review the change request diff for correctness, security, reliability,
@@ -2217,30 +2489,67 @@ export default definePipr((pipr) => {
       concrete non-blocking defects; and low for small but actionable issues. Each
       rationale must connect repository evidence to the defect and its concrete
       impact. Keep each finding title to one line. Put supporting evidence and
-      reasoning in rationale instead of appending it to the body.
-
-      Make summary maintainer-facing and scannable: one concrete headline, one
-      to four behavior-focused change bullets, a risk level with rationale, and
-      reviewer focus only for useful human follow-up.
+      reasoning in rationale instead of appending it to the body. Return no more
+      than 20 findings for each diff shard.
+      Never copy secret-looking literals into title, body, rationale, or
+      suggestedFix. Describe only the secret kind and location.
     \`,
-    output: reviewOutput,
+    output: findingsOutput,
     tools: pipr.tools.readOnly,
     retry: { invalidOutput: 1, transientFailure: 1 },
     timeout: "10m",
     prompt: () => "Review this change with severity and category metadata.",
   });
 
+  const summaryOutput = pipr.schema({
+    id: "review/rich-summary",
+    schema: reviewSummarySchema,
+  });
+
+  const summaryReviewer = pipr.agent({
+    name: "summary-reviewer",
+    model,
+    instructions: \`
+      Make the summary maintainer-facing and scannable: one concrete headline,
+      one to four behavior-focused change bullets, a risk level with rationale,
+      and reviewer focus only for useful human follow-up. Use the selected
+      findings as evidence, but do not invent additional defects or copy
+      secret-looking literals into any summary field.
+    \`,
+    output: summaryOutput,
+    tools: pipr.tools.readOnly,
+    retry: { invalidOutput: 1, transientFailure: 1 },
+    timeout: "10m",
+    prompt: ({ inlineFindings, manifestSummary }) =>
+      pipr.prompt\`
+        Summarize this change using the selected findings.
+
+        \${pipr.section("Scoped compressed manifest", pipr.json(manifestSummary, { maxCharacters: 60_000 }))}
+
+        \${pipr.section("Selected findings", pipr.json(inlineFindings, { maxCharacters: 60_000 }))}
+      \`,
+  });
+
   const task = pipr.task({
     name: "review",
     async run(ctx) {
       const manifest = await ctx.change.diffManifest({ compressed: true });
-      const result = await ctx.pi.run(reviewer, { manifest });
-      const inlineFindings: ReviewFinding[] = result.findings.map((finding) => {
+      const result = await ctx.pi.run(findingsReviewer, { manifest });
+      const selectedFindings = deduplicateFindings(
+        result.inlineFindings.filter((finding) => hasCommentableAnchor(finding, manifest)),
+      )
+        .sort((left, right) => severityRank[left.severity] - severityRank[right.severity])
+        .slice(0, 8);
+      const summary = await ctx.pi.run(summaryReviewer, {
+        manifestSummary: summaryManifest(manifest),
+        inlineFindings: selectedFindings,
+      });
+      const inlineFindings: ReviewFinding[] = selectedFindings.map((finding) => {
         const severity = finding.severity.charAt(0).toUpperCase() + finding.severity.slice(1);
         const category = finding.category.replaceAll("-", " ");
         return {
           body: [
-            \`**\${severity} \${category}:** \${escapeInlineCommentHtml(finding.title)}\`,
+            \`**\${severity} \${category}:** \${escapeInlineCommentHtml(lineText(finding.title))}\`,
             "",
             escapeInlineCommentHtml(finding.body),
             "",
@@ -2263,17 +2572,17 @@ export default definePipr((pipr) => {
         main: [
           "## Summary",
           "",
-          \`**\${result.summary.headline}**\`,
+          \`**\${lineText(summary.headline)}**\`,
           "",
-          summaryTable(result.summary),
+          summaryTable(summary),
           "",
           "## What Changed",
           "",
-          bulletList(result.summary.changeSummary, "No changed behavior summarized."),
+          bulletList(summary.changeSummary, "No changed behavior summarized."),
           "",
           "## Reviewer Focus",
           "",
-          bulletList(result.summary.reviewerFocus, "No special reviewer focus."),
+          bulletList(summary.reviewerFocus, "No special reviewer focus."),
           "",
         ].join("\\n"),
         inlineFindings,
@@ -2307,7 +2616,7 @@ function labelValue(value: string): string {
 }
 
 function lineText(value: string): string {
-  return value.replaceAll("\\n", " ").trim();
+  return value.replace(/\\r\\n?|\\n/g, " ").trim();
 }
 
 function tableCell(value: string): string {
@@ -2319,6 +2628,7 @@ function tableCell(value: string): string {
 //#region src/config/recipes/security-sast.ts
 const securitySastRecipe = {
 	id: "security-sast",
+	requiresChecksPermission: true,
 	title: "Security SAST",
 	description: "Security review with custom severity and category output.",
 	sourceTools: [
@@ -2354,7 +2664,7 @@ export default definePipr((pipr) => {
     provider: "deepseek",
     model: "deepseek-v4-pro",
     apiKey: pipr.secret({ name: "DEEPSEEK_API_KEY" }),
-    options: { thinking: "high" },
+    thinking: "high",
   });
 
   const securityOutput = pipr.jsonSchema<SecurityReview>({
@@ -2693,6 +3003,9 @@ function officialInitRecipeFiles(recipe) {
 function officialInitRecipeWorkflowEnvSecrets(recipe) {
 	return resolveOfficialInitRecipe(recipe).workflowEnvSecrets ?? [];
 }
+function officialInitRecipeRequiresChecksPermission(recipe) {
+	return resolveOfficialInitRecipe(recipe).requiresChecksPermission ?? false;
+}
 function resolveOfficialInitRecipe(recipe) {
 	const id = recipe ?? "default-review";
 	if (!isOfficialInitRecipeId(id)) throw new Error(`Unsupported pipr init recipe '${id}'. Supported recipes: ${supportedOfficialInitRecipes.join(", ")}.`);
@@ -2703,7 +3016,7 @@ function isOfficialInitRecipeId(recipe) {
 }
 //#endregion
 //#region src/config/official-github-workflow.ts
-const defaultWorkflowActionRef = "somus/pipr@v0.4.3";
+const defaultWorkflowActionRef = "somus/pipr@v0.6.0";
 /** Internal shared renderer for `pipr init` and generated recipe docs. */
 function renderOfficialGithubWorkflow(options = {}) {
 	const relativeConfigDir = options.relativeConfigDir ?? ".pipr";
@@ -2712,25 +3025,19 @@ function renderOfficialGithubWorkflow(options = {}) {
 		"",
 		"on:",
 		"  pull_request:",
+		"    types: [opened, synchronize, reopened, ready_for_review]",
 		"  issue_comment:",
 		"    types: [created]",
 		"  pull_request_review_comment:",
 		"    types: [created]",
 		"",
 		"permissions:",
-		"  contents: write",
+		"  contents: read",
 		"  pull-requests: write",
-		"  issues: write",
-		"  checks: write",
-		"",
-		"jobs:",
-		"  review:",
-		"    runs-on: ubuntu-latest",
-		"    steps:",
-		"      - uses: actions/checkout@v6",
-		"        with:",
-		"          fetch-depth: 0"
+		"  issues: write"
 	];
+	if (officialInitRecipeRequiresChecksPermission(options.recipe)) lines.push("  checks: write");
+	lines.push("", "jobs:", "  review:", "    runs-on: ubuntu-latest", "    steps:", "      - uses: actions/checkout@v6", "        with:", "          fetch-depth: 0");
 	if (!options.minimal) lines.push("      - uses: actions/cache@v4", "        with:", "          path: /home/runner/work/_temp/_github_home/.bun/install/cache", `          key: pipr-bun-${githubExpression(`hashFiles('${relativeConfigDir}/bun.lock')`)}`);
 	lines.push(`      - uses: ${defaultWorkflowActionRef}${options.includeReleasePleaseVersionMarker ? " # x-release-please-version" : ""}`, "        env:", `          DEEPSEEK_API_KEY: ${githubExpression("secrets.DEEPSEEK_API_KEY")}`, `          GITHUB_TOKEN: ${githubExpression("github.token")}`);
 	for (const secret of officialInitRecipeWorkflowEnvSecrets(options.recipe)) lines.push(`          ${secret.env}: ${githubExpression(`secrets.${secret.secret}`)}`);
@@ -2748,4 +3055,4 @@ function githubExpression(expression) {
 //#endregion
 export { officialInitRecipeWorkflowEnvSecrets as a, officialInitRecipeFiles as i, listOfficialInitRecipes as n, supportedOfficialInitRecipes as o, officialInitRecipeConfigTs as r, renderOfficialGithubWorkflow as t };
 
-//# sourceMappingURL=official-github-workflow-Bjlu-FL3.mjs.map
+//# sourceMappingURL=official-github-workflow-B3yeaCgq.mjs.map