@weareikko/code-review 0.8.2 → 0.8.4

package/README.md

@@ -5,15 +5,19 @@
 [![Size](https://img.shields.io/bundlephobia/minzip/@weareikko/code-review?style=flat&colorB=3e63dd&colorA=414853&label=size)](https://bundlephobia.com/package/@weareikko/code-review)
 ![Codecov](https://img.shields.io/codecov/c/github/weareikko/code-review?style=flat&colorB=3e63dd&colorA=414853)
 
-Run an agent-driven code review in GitLab CI, parse inline comments, post deduplicated merge request discussions, and report per-run token usage and cost.
+Run an agent-driven code review on **GitLab merge requests and GitHub pull requests** — the same review engine on both. It parses inline comments, posts deduplicated review discussions, upserts a summary, and reports per-run token usage and cost. The platform is auto-detected from the environment (GitLab CI vs. GitHub Actions) and can be forced with `--platform github|gitlab`.
 
-The reviewer reads the MR **title and description** as the author's declared intent: it checks the diff against the stated purpose and flags code/intent mismatches (the change does something the description never claimed, or omits something it promised) as a first-class finding. A missing or empty description degrades gracefully — the review still runs.
+The reviewer reads the merge/pull request **title and description** as the author's declared intent: it reads the diff against the stated purpose and surfaces code/intent mismatches (the change does something the description never claimed, or omits something it promised) as a summary note. A missing or empty description degrades gracefully — the review still runs.
 
 ## Requirements
 
 - Node.js `>=24`
-- `git` available in the runtime
-- A pipeline running in a merge request context (`CI_PROJECT_ID`, `CI_MERGE_REQUEST_IID`)
+- `git` available in the runtime (full history — the review diffs against the merge base)
+- A run in one of the two supported contexts, which the tool auto-detects:
+  - **GitLab CI** in a merge-request pipeline (`GITLAB_CI`, `CI_PROJECT_ID`, `CI_MERGE_REQUEST_IID`), or
+  - **GitHub Actions** on a `pull_request` event (`GITHUB_ACTIONS`, `GITHUB_REPOSITORY`, the PR number)
+
+Detection precedence: an explicit `--platform github|gitlab` (or `CODE_REVIEW_PLATFORM`) always wins; otherwise `GITHUB_ACTIONS=true` selects GitHub and `GITLAB_CI=true` (or a present `CI_PROJECT_ID` / `CI_SERVER_URL`) selects GitLab; failing that, the tool infers the platform from whichever side's identifiers are present.
 
 ## Install / Run
 
@@ -79,13 +83,17 @@ review:
       - review-usage.json
 ```
 
-## GitHub Actions
+## GitHub Actions example
+
+On GitHub the same engine reviews **pull requests** — auto-detected from the Actions environment (`GITHUB_ACTIONS`, `GITHUB_REPOSITORY`, the `pull_request` event); pass `--platform github` to force it. Findings post as one batched PR review with inline comments plus an upserted summary comment.
 
-The same reviewer also reviews **GitHub pull requests** — the engine is platform-agnostic and auto-detects GitHub from the Actions environment (`GITHUB_ACTIONS`, `GITHUB_REPOSITORY`, the `pull_request` event). Set `--platform github` to force it.
+### Composite action (recommended)
 
-### Reusable workflow (simplest)
+The bundled composite action is the primary path: it checks out the repository, sets up Node, installs the CLI, and runs the review in one step. It needs:
 
-The quickest way to enable reviews in a repo is the bundled reusable workflow. Add a tiny caller and let it check out the code, install the CLI, and run the review for you:
+- **Permissions:** `pull-requests: write` (to post the review and summary) and `contents: read` (to check out the code). The default `GITHUB_TOKEN` is enough; the action reads it as `${{ github.token }}` by default.
+- **Full git history:** the action checks out the repository by default with `fetch-depth: 0` so the merge-base diff and commit log resolve (tune with `fetch-depth`, or set `checkout: false` and check out yourself first).
+- **A model + its key:** pass the model via the `model` input and the provider's key via the `api-key` input (or expose the provider's standard env var, e.g. `ANTHROPIC_API_KEY`, to the step).
 
 ```yml
 name: code-review
@@ -98,19 +106,32 @@ permissions:
 
 jobs:
   review:
-    uses: weareikko/code-review/.github/workflows/code-review.yml@0.8.2 # pin to a release tag
-    secrets: inherit
+    runs-on: ubuntu-latest
+    steps:
+      # Checkout (full history) is bundled — no separate checkout step needed.
+      # Opt out with `checkout: false` if your job already checked out the code.
+      - uses: weareikko/code-review@0.8 # moving minor tag — auto patch updates (see Pinning below)
+        with:
+          model: anthropic/claude-sonnet-4-5
+          api-key: ${{ secrets.ANTHROPIC_API_KEY }}
+          # github-token defaults to ${{ github.token }}
+          # args: --min-severity warn --dry-run
 ```
 
-It reads review settings from repo/org **variables** (`CODE_REVIEW_MODEL`, `CODE_REVIEW_DEPTH`, `CODE_REVIEW_THINKING_LEVEL`, `CODE_REVIEW_VERIFY_MODEL`) and provider credentials from **secrets** named with the `CODE_REVIEW_` prefix (e.g. `CODE_REVIEW_ANTHROPIC_API_KEY`), which the CLI's env shim de-prefixes for the provider. `secrets: inherit` is required so the reusable workflow can see them. Optional `with:` inputs: `model` (overrides the `CODE_REVIEW_MODEL` variable), `version`, `node-version`, `working-directory`, `args`, and `runs-on`.
+Inputs: `model` (required), `api-key`, `github-token` (default `${{ github.token }}`), `version` (npm dist-tag/version, default `latest`), `node-version` (default `24`), `working-directory`, `args` (extra CLI flags forwarded verbatim), `checkout` (default `true` — bundled repository checkout), and `fetch-depth` (default `0` — full history, required for the merge-base diff).
 
-### Composite action
+Because the composite action references your secrets directly (`${{ secrets.ANTHROPIC_API_KEY }}`), it works from **any** repository, including consumers in a different organization from this one.
 
-For more control, use the bundled composite action directly. It needs:
+> **Pinning the ref.** Two moving tags are maintained, each re-pointed to the latest release it covers:
+>
+> - `@0.8` — **minor series**: newest `0.8.x`, patches only. Because a `0.x` minor bump marks a breaking change, this is the non-breaking channel and the recommended pin while the project is pre-1.0.
+> - `@0` — **major series**: newest stable release. **Caveat:** in 0.x a minor bump _is_ a breaking change, so `@0` may advance across breaking releases (`0.8 → 0.9`); it becomes a true semver compatibility boundary only once `1.0` ships.
+>
+> For a frozen build, pin an exact patch (`@0.8.3`) or a commit SHA (immutable; strongest supply-chain posture); to track the tip, use `@main`. GitHub `uses:` refs do not support wildcards, so `@0.8.x` is not valid — use a moving tag instead.
 
-- **Permissions:** `pull-requests: write` (to post the review and summary) and `contents: read` (to check out the code). The default `GITHUB_TOKEN` is enough; the action reads it as `${{ github.token }}` by default.
-- **Full git history:** the bundled checkout uses `fetch-depth: 0` so the merge-base diff and commit log resolve (tune with `fetch-depth`, or set `checkout: false` and check out yourself).
-- **A model + its key:** pass the model via the `model` input and the provider's key via the `api-key` input (or expose the provider's standard env var, e.g. `ANTHROPIC_API_KEY`, to the step).
+### Reusable workflow (same org/enterprise)
+
+The bundled reusable workflow lets a caller enable reviews with no `steps:` of its own — it checks out the code, installs the CLI, and runs the review for you:
 
 ```yml
 name: code-review
@@ -123,24 +144,23 @@ permissions:
 
 jobs:
   review:
-    runs-on: ubuntu-latest
-    steps:
-      # Checkout (full history) is bundled — opt out with `checkout: false` if
-      # your job already checked out the code with its own options.
-      - uses: weareikko/code-review@main # pin to a release tag in production
-        with:
-          model: anthropic/claude-sonnet-4-5
-          api-key: ${{ secrets.ANTHROPIC_API_KEY }}
-          # github-token defaults to ${{ github.token }}
-          # args: --min-severity warn --dry-run
+    uses: weareikko/code-review/.github/workflows/code-review.yml@0.8 # moving minor tag — auto patch updates
+    secrets: inherit
 ```
 
-Inputs: `model` (required), `api-key`, `github-token` (default `${{ github.token }}`), `version` (npm dist-tag/version, default `latest`), `node-version` (default `24`), `working-directory`, `args` (extra CLI flags forwarded verbatim), `checkout` (default `true` — bundled repository checkout), and `fetch-depth` (default `0` — full history, required for the merge-base diff).
+It reads review settings from repo/org **variables** (`CODE_REVIEW_MODEL`, `CODE_REVIEW_DEPTH`, `CODE_REVIEW_THINKING_LEVEL`, `CODE_REVIEW_VERIFY_MODEL`) and provider credentials from **secrets** named with the `CODE_REVIEW_` prefix (e.g. `CODE_REVIEW_ANTHROPIC_API_KEY`), which the CLI's env shim de-prefixes for the provider. Optional `with:` inputs: `model` (overrides the `CODE_REVIEW_MODEL` variable), `version`, `node-version`, `working-directory`, `args`, and `runs-on`.
 
-Prefer to run the CLI directly (no composite action)? `GITHUB_TOKEN`, `GITHUB_REPOSITORY`, and the PR number are read straight from the Actions environment:
+> **Caveat — `secrets: inherit` is same-organization (or enterprise) only.** Organization secrets are **not** inherited across organizations, so this pattern only works when the caller repository lives in the same org (or enterprise) as `weareikko/code-review`. Cross-organization consumers must use the **composite action** above, which references their own secrets directly. (The reusable workflow relies on `secrets: inherit` and declares no `workflow_call.secrets`, so there is no explicit-secrets path for it.)
+
+### Running the CLI directly
+
+Prefer no action at all? `GITHUB_TOKEN`, `GITHUB_REPOSITORY`, and the PR number are read straight from the Actions environment. Check out the code first (full history) so the merge-base diff resolves:
 
 ```yml
-- uses: actions/setup-node@v4
+- uses: actions/checkout@v5
+  with:
+    fetch-depth: 0
+- uses: actions/setup-node@v5
   with:
     node-version: 24
 - run: npx @weareikko/code-review
@@ -159,17 +179,17 @@ The README covers getting started. Reference material lives in [`docs/`](https:/
 - [Skills](https://github.com/weareikko/code-review/blob/main/docs/skills.md) — built-in, external (`npm:`/`file:`/`git:`), and project auto-discovered review skills.
 - [Multi-stage review](https://github.com/weareikko/code-review/blob/main/docs/multi-stage-review.md) — the staged Find / Verify / Synthesize pipeline behind `--review-depth`.
 - [Observability](https://github.com/weareikko/code-review/blob/main/docs/observability.md) — diagnostics-channel tracing and the opt-in OpenTelemetry bridge (spans, metrics, logs).
-- [Output format](https://github.com/weareikko/code-review/blob/main/docs/output-format.md) — inline-comment shape, MR-level summary note, footer, and duplicate prevention.
+- [Output format](https://github.com/weareikko/code-review/blob/main/docs/output-format.md) — inline-comment shape, the upserted summary (a note on GitLab, an issue comment on GitHub), footer, and duplicate prevention.
 
 ## Configuration
 
-The CLI auto-resolves most values from GitLab CI variables and provider-standard env vars. The two things you must provide are a model and its provider's API key:
+The CLI auto-resolves most values from the CI environment (GitLab CI variables or the GitHub Actions context) and provider-standard env vars. The two things you must provide are a model and its provider's API key:
 
 ```bash
 code-review --model anthropic/claude-sonnet-4-5 --api-key "$ANTHROPIC_API_KEY"
 ```
 
-Equivalently, set `CODE_REVIEW_MODEL` and the provider's key (e.g. `ANTHROPIC_API_KEY`) as CI/CD variables. Common knobs include `--min-severity`, `--thinking`, `--posting-mode draft`, `--no-summary`, and `--dry-run`. See the full [environment-variable and flag reference](https://github.com/weareikko/code-review/blob/main/docs/configuration.md).
+Equivalently, set `CODE_REVIEW_MODEL` and the provider's key (e.g. `ANTHROPIC_API_KEY`) as CI/CD variables (GitLab) or repository/organization variables and secrets (GitHub). Common knobs include `--min-severity`, `--thinking`, `--posting-mode draft`, `--no-summary`, and `--dry-run`. See the full [environment-variable and flag reference](https://github.com/weareikko/code-review/blob/main/docs/configuration.md).
 
 ## Providers
 
@@ -182,7 +202,7 @@ Equivalently, set `CODE_REVIEW_MODEL` and the provider's key (e.g. `ANTHROPIC_AP
   - parsed comment payload
   - computed fingerprints
   - duplicate status
-  - final GitLab discussion payload
+  - final platform-specific posting payload (a GitLab discussion payload, or a GitHub review-comment payload)
 - `review-usage.json`: token and cost breakdown for the run (`tokens.{input,output,cacheRead,cacheWrite,total}`, `cost.{input,output,cacheRead,cacheWrite,total}`, `model`)
 
 The CLI also prints a one-line summary at the end of the run:
@@ -198,15 +218,17 @@ Use these files for CI debugging and auditing.
 - **`Node.js >=24 is required`**
   - Use `node:24` (or newer) in CI.
 - **`Missing required configuration`**
-  - Provide required flags or ensure CI vars are available (`CI_PROJECT_ID`, `CI_MERGE_REQUEST_IID`, token, API key).
+  - Provide required flags or ensure the platform's identifiers/token are available: on GitLab `CI_PROJECT_ID`, `CI_MERGE_REQUEST_IID`, and a GitLab token; on GitHub `GITHUB_REPOSITORY`, the PR number, and `GITHUB_TOKEN`. A model and its API key are required on both.
+- **`Could not detect the review platform` / `Ambiguous review platform`**
+  - Set `--platform github|gitlab` (or `CODE_REVIEW_PLATFORM`) to force the platform.
 - **`--min-severity must be one of: info, warn, critical`**
   - Fix `--min-severity` or `CODE_REVIEW_MIN_SEVERITY`.
 - **Git history errors / merge-base failures**
-  - Set `GIT_DEPTH: 0`.
+  - Fetch full history: `GIT_DEPTH: 0` on GitLab, `fetch-depth: 0` on `actions/checkout` (the composite action does this by default).
   - Ensure source and target branches are fetchable from `origin`.
-- **GitLab API 401/403 when posting**
-  - Ensure token has rights to read MR metadata/discussions and create MR discussions.
-  - If using `CI_JOB_TOKEN`, ensure your GitLab project settings allow required API access.
+- **API 401/403 when posting**
+  - GitLab: ensure the token can read MR metadata/discussions and create MR discussions; with `CI_JOB_TOKEN`, check that project settings allow the required API access.
+  - GitHub: ensure the token has `pull-requests: write` (the default `GITHUB_TOKEN` with that permission is enough).
 - **No comments posted**
   - Check `review-comments.json` for `duplicate: true` or empty parsed comments.
   - Run with `--dry-run` and inspect `code-review.md` formatting (`== Inline Comments ==`).

package/dist/{cli-DBkaU14C.js → cli-FDpPZaNn.js}

@@ -155,6 +155,20 @@ function parseNextLink(header) {
 	}
 	return null;
 }
+var REVIEW_THREADS_QUERY = `
+  query ($owner: String!, $repo: String!, $pull: Int!, $cursor: String) {
+    repository(owner: $owner, name: $repo) {
+      pullRequest(number: $pull) {
+        reviewThreads(first: 100, after: $cursor) {
+          pageInfo { hasNextPage endCursor }
+          nodes {
+            isResolved
+            comments(first: 100) { nodes { databaseId } }
+          }
+        }
+      }
+    }
+  }`;
 var GitHubClient = class {
 	base;
 	token;
@@ -290,6 +304,65 @@ var GitHubClient = class {
 	getCurrentUser() {
 		return this.request("/user");
 	}
+	/**
+	* Derive the GraphQL endpoint from the REST base. github.com exposes GraphQL
+	* at `<origin>/graphql`, while GitHub Enterprise Server exposes it at
+	* `<origin>/api/graphql` (its REST base is `<origin>/api/v3`).
+	*/
+	graphqlEndpoint() {
+		if (this.base.endsWith("/api/v3")) return `${this.base.slice(0, -7)}/api/graphql`;
+		return `${this.base}/graphql`;
+	}
+	async graphql(query, variables) {
+		const url = this.graphqlEndpoint();
+		const response = await this.fetchWithTimeout(url, {
+			method: "POST",
+			headers: this.headers({ "Content-Type": "application/json" }),
+			body: JSON.stringify({
+				query,
+				variables
+			})
+		}, "POST", "/graphql");
+		if (!response.ok) this.failure("POST", "/graphql", response, await response.text());
+		const text = await response.text();
+		const parsed = JSON.parse(text);
+		if (parsed.errors && parsed.errors.length > 0) throw new GitHubApiError(`GitHub API POST /graphql failed: ${parsed.errors.map((e) => e.message ?? "").join("; ")}`, {
+			method: "POST",
+			path: "/graphql",
+			responseBody: text,
+			hint: "Ensure the token can read pull-request review threads (pull-requests: read / repo scope)."
+		});
+		return parsed.data;
+	}
+	/**
+	* Return the database IDs of review comments that belong to a **resolved**
+	* review thread. GitHub's REST comment endpoints omit thread-resolution state;
+	* it is only exposed via GraphQL `reviewThreads.isResolved`. Callers use this
+	* set to mark normalized notes resolved so resolved threads are excluded from
+	* summary carry-over and prior-thread context. Paginates over threads.
+	*/
+	async listResolvedReviewCommentIds(owner, repo, pull) {
+		const resolved = /* @__PURE__ */ new Set();
+		let cursor = null;
+		let hasNext = true;
+		while (hasNext) {
+			const threads = (await this.graphql(REVIEW_THREADS_QUERY, {
+				owner,
+				repo,
+				pull,
+				cursor
+			})).repository?.pullRequest?.reviewThreads;
+			if (!threads) break;
+			for (const thread of threads.nodes ?? []) {
+				if (!thread.isResolved) continue;
+				for (const comment of thread.comments?.nodes ?? []) if (typeof comment.databaseId === "number") resolved.add(comment.databaseId);
+			}
+			hasNext = threads.pageInfo?.hasNextPage ?? false;
+			cursor = threads.pageInfo?.endCursor ?? null;
+			if (!cursor) hasNext = false;
+		}
+		return resolved;
+	}
 };
 //#endregion
 //#region src/fingerprints.ts
@@ -439,7 +512,12 @@ function buildSizeNoticeBlock(notice) {
 	if (sizeSkippedFiles.length > 0) {
 		const fileList = sizeSkippedFiles.map((file) => `- \`${file.path}\` (${formatChars(file.chars)})`).join("\n");
 		const cov = notice.coverage;
-		const coverageLine = cov && cov.totalLines > 0 ? `> **Partial review — ~${Math.round(cov.reviewedLines / cov.totalLines * 100)}% of changed lines reviewed** (${cov.reviewedLines} of ${cov.totalLines}). The files below were NOT reviewed; their absence from the findings is not a clean bill of health.` : `> **${sizeSkippedFiles.length} file(s) were not reviewed** — the diff exceeded the size budget, so these files were dropped from the review:`;
+		const retrieved = notice.retrieved === true;
+		let coverageLine;
+		if (cov && cov.totalLines > 0) {
+			const pct = Math.round(cov.reviewedLines / cov.totalLines * 100);
+			coverageLine = retrieved ? `> **Large diff — ~${pct}% of changed lines fit the inline budget** (${cov.reviewedLines} of ${cov.totalLines}). The files below exceeded it and were staged for on-demand retrieval; see the review summary for which were read. Absence from the findings is not a clean bill of health.` : `> **Partial review — ~${pct}% of changed lines reviewed** (${cov.reviewedLines} of ${cov.totalLines}). The files below were NOT reviewed; their absence from the findings is not a clean bill of health.`;
+		} else coverageLine = retrieved ? `> **${sizeSkippedFiles.length} file(s) exceeded the size budget** — their diffs were staged for on-demand retrieval; see the review summary for which were read:` : `> **${sizeSkippedFiles.length} file(s) were not reviewed** — the diff exceeded the size budget, so these files were dropped from the review:`;
 		blocks.push([
 			`> [!WARNING]`,
 			coverageLine,
@@ -470,7 +548,7 @@ function buildSummaryBody(summary, costFooter, options = {}) {
 	return `${withFooter}\n\n${buildSummaryHistoryBlock(historyEntries)}`;
 }
 function buildReviewedCommitFooter(commitSha) {
-	return `Reviewed by ${PRODUCT_LINK} v0.8.2 for commit ${commitSha}.`;
+	return `Reviewed by ${PRODUCT_LINK} v0.8.4 for commit ${commitSha}.`;
 }
 function extractReviewedCommitSha(body) {
 	return REVIEWED_COMMIT_FOOTER_PATTERN.exec(body)?.[1] ?? null;
@@ -863,6 +941,7 @@ var BOOLEAN_FLAGS = new Set([
 	"no-summary",
 	"force-review",
 	"retrieve-skipped",
+	"no-retrieve-skipped",
 	"verbose",
 	"help",
 	"version"
@@ -921,6 +1000,22 @@ function resolvePostSummary(args, env) {
 	}
 	return true;
 }
+function resolveRetrieveSkipped(args, env) {
+	if (args.noRetrieveSkipped === true) return false;
+	if (args.retrieveSkipped === true) return true;
+	const raw = env.CODE_REVIEW_RETRIEVE_SKIPPED;
+	if (typeof raw === "string") {
+		const normalized = raw.trim().toLowerCase();
+		if ([
+			"0",
+			"false",
+			"no",
+			"off"
+		].includes(normalized)) return false;
+		if (normalized.length > 0) return true;
+	}
+	return true;
+}
 function normalizeChoice(value) {
 	return String(value ?? "").trim().toLowerCase();
 }
@@ -1124,7 +1219,7 @@ function resolveConfig(argv = process.argv.slice(2), env = process.env) {
 		maxDiffChars,
 		decomposeHintLines,
 		diffContext,
-		retrieveSkipped: toBoolean(args.retrieveSkipped) || toBoolean(env.CODE_REVIEW_RETRIEVE_SKIPPED),
+		retrieveSkipped: resolveRetrieveSkipped(args, env),
 		reviewFile: String(args.reviewFile ?? "code-review.md"),
 		output: String(args.output ?? "review-comments.json"),
 		dryRun: toBoolean(args.dryRun),
@@ -3715,10 +3810,10 @@ function buildUserPrompt(diff, skippedFiles = [], commitLog, priorThreads, inten
 	if (commitLog?.trim()) parts.push(`Commits in this MR (oldest first):\n<commits>\n${commitLog.trim()}\n</commits>`);
 	parts.push(`Review this diff:\n<diff>\n${diff}\n</diff>`);
 	if (retrievableSkipped && retrievableSkipped.length > 0) parts.push(renderRetrievableSkippedBlock(retrievableSkipped));
-	else if (skippedFiles.length > 0) parts.push(`<skipped_files>\n${skippedFiles.map((file) => `- ${file}`).join("\n")}\n</skipped_files>\nThe above files were not included because the diff exceeded the size limit. Mention them explicitly in your summary as not reviewed.`);
+	else if (skippedFiles.length > 0) parts.push(`<skipped_files>\n${skippedFiles.map((file) => `- ${file}`).join("\n")}\n</skipped_files>\nThe above files were not included because the diff exceeded the size limit. They are already surfaced to the reader in the MR summary, so do not re-list them; just do not assume they are clean, since you did not see them.`);
 	if (coverage && coverage.totalLines > 0 && coverage.reviewedLines < coverage.totalLines) {
 		const pct = Math.round(coverage.reviewedLines / coverage.totalLines * 100);
-		parts.push(`<coverage>You reviewed ${coverage.reviewedLines} of ${coverage.totalLines} changed lines (~${pct}%). The rest were dropped for the size budget and you did NOT see them. State this partial coverage in your summary and do not imply the unreviewed files are clean — their absence from your findings is not a clearance.</coverage>`);
+		parts.push(`<coverage>You reviewed ${coverage.reviewedLines} of ${coverage.totalLines} changed lines (~${pct}%). The rest were dropped for the size budget and you did NOT see them. The MR summary already reports this partial coverage to the reader, so do not restate it; just do not imply the unreviewed files are clean — their absence from your findings is not a clearance.</coverage>`);
 	}
 	if (priorThreads && priorThreads.length > 0) {
 		const block = renderPriorThreadsBlock(priorThreads);
@@ -3950,13 +4045,14 @@ async function runReview(config, options) {
 		reviewedLines: reviewedChangedLines,
 		totalLines: reviewedChangedLines + skippedChangedLines
 	} : void 0;
+	const retrievableSkipped = config.retrieveSkipped && sizeSkippedSections.length > 0 ? await writeSkippedDiffs(cwd, sizeSkippedSections) : [];
+	if (retrievableSkipped.length > 0) logger.info(`Staged ${retrievableSkipped.length} dropped-file diff(s) on disk for retrieval.`);
 	const sizeNotice = {
 		sizeSkippedFiles,
 		decomposeHint,
-		coverage
+		coverage,
+		retrieved: retrievableSkipped.length > 0
 	};
-	const retrievableSkipped = config.retrieveSkipped && sizeSkippedSections.length > 0 ? await writeSkippedDiffs(cwd, sizeSkippedSections) : [];
-	if (retrievableSkipped.length > 0) logger.info(`Staged ${retrievableSkipped.length} dropped-file diff(s) on disk for retrieval.`);
 	const context = await loadReviewContext(cwd, config.skills, (msg) => logger.warn(msg), { refreshGitSkills: config.refreshGitSkills });
 	const systemPrompt = buildJSONSystemPrompt(context, minSeverity);
 	const userPrompt = buildUserPrompt(diff, skippedFiles, options.commitLog, options.priorThreads, options.intent, coverage, retrievableSkipped);
@@ -4836,7 +4932,7 @@ async function loadDefaultRuntime() {
 	const [sdkNode, resources, semconv] = modules;
 	const serviceResource = resources.resourceFromAttributes({
 		[semconv.ATTR_SERVICE_NAME ?? "service.name"]: SERVICE_NAME,
-		[semconv.ATTR_SERVICE_VERSION ?? "service.version"]: "0.8.2"
+		[semconv.ATTR_SERVICE_VERSION ?? "service.version"]: "0.8.4"
 	});
 	process.env.OTEL_METRICS_EXPORTER = process.env.OTEL_METRICS_EXPORTER ?? "otlp";
 	process.env.OTEL_LOGS_EXPORTER = process.env.OTEL_LOGS_EXPORTER ?? "otlp";
@@ -5268,7 +5364,7 @@ function boldCommentTitle(body) {
 */
 function buildCommentBody(body, commitSha, confidence) {
 	const confidenceLine = `_Confidence: ${confidence}._`;
-	const footer = `<sub>Reviewed by ${PRODUCT_LINK} v0.8.2 for commit ${commitSha}.</sub>`;
+	const footer = `<sub>Reviewed by ${PRODUCT_LINK} v0.8.4 for commit ${commitSha}.</sub>`;
 	return `${boldCommentTitle(body.trim())}\n\n${confidenceLine}\n\n---\n\n${footer}`;
 }
 function buildPayload(comment, body, refs, resolved) {
@@ -5431,8 +5527,12 @@ function reviewCommentPosition(comment) {
 * The fingerprint markers, summary marker, and reviewed-commit footer are HTML
 * comments that render identically on GitHub, so `extractExistingFingerprints`,
 * `findExistingSummaryNote`, and the reviewed-commit scan all work as-is.
+*
+* `resolvedCommentIds` carries the database ids of comments in resolved review
+* threads (from the GraphQL `reviewThreads` query, since REST omits resolution),
+* so each note gets a `resolved` flag mirroring GitLab's per-note field.
 */
-function normalizeGitHubDiscussions(reviewComments, issueComments) {
+function normalizeGitHubDiscussions(reviewComments, issueComments, resolvedCommentIds = /* @__PURE__ */ new Set()) {
 	const threads = /* @__PURE__ */ new Map();
 	const order = [];
 	for (const comment of reviewComments) {
@@ -5446,6 +5546,7 @@ function normalizeGitHubDiscussions(reviewComments, issueComments) {
 		notes.push({
 			id: comment.id,
 			body: comment.body ?? "",
+			resolved: resolvedCommentIds.has(comment.id),
 			position: reviewCommentPosition(comment)
 		});
 	}
@@ -5512,8 +5613,12 @@ var GitHubPlatform = class {
 		return refs;
 	}
 	async getDiscussions() {
-		const [reviewComments, issueComments] = await Promise.all([this.client.listReviewComments(this.owner, this.repo, this.pull), this.client.listIssueComments(this.owner, this.repo, this.pull)]);
-		return normalizeGitHubDiscussions(reviewComments, issueComments);
+		const [reviewComments, issueComments, resolvedCommentIds] = await Promise.all([
+			this.client.listReviewComments(this.owner, this.repo, this.pull),
+			this.client.listIssueComments(this.owner, this.repo, this.pull),
+			this.client.listResolvedReviewCommentIds(this.owner, this.repo, this.pull)
+		]);
+		return normalizeGitHubDiscussions(reviewComments, issueComments, resolvedCommentIds);
 	}
 	buildComments(comments, diff, refs, existingFingerprints) {
 		this.commitId = refs.head_sha;
@@ -5984,9 +6089,10 @@ Options:
                           context aids reasoning but inflates tokens and fits fewer files in
                           the budget; less fits more. 0 = built-in default (20).
                           (env: CODE_REVIEW_DIFF_CONTEXT)
-  --retrieve-skipped      Stage diffs for files dropped by the size budget on disk so the
-                          reviewer can read them on demand instead of losing them.
-                          (env: CODE_REVIEW_RETRIEVE_SKIPPED=true)
+  --no-retrieve-skipped   Disable staging diffs for files dropped by the size budget on disk.
+                          Retrieval is on by default: dropped diffs are staged so the reviewer
+                          can read them on demand instead of losing them.
+                          (env: CODE_REVIEW_RETRIEVE_SKIPPED=0)
   --min-severity <level>  info, warn, or critical (default: info)
   --thinking <level>      off, minimal, low, medium, high, or xhigh (default: off).
                           Higher levels add billable thinking tokens at the model output rate.
@@ -6346,10 +6452,10 @@ async function main(argv = process.argv.slice(2)) {
 		return;
 	}
 	if (argv.includes("--version") || argv.includes("-v")) {
-		console.log("0.8.2");
+		console.log("0.8.4");
 		return;
 	}
-	process.stderr.write(`[code-review] @weareikko/code-review v0.8.2\n`);
+	process.stderr.write(`[code-review] @weareikko/code-review v0.8.4\n`);
 	assertNodeVersion();
 	applyCodeReviewEnvPrefix();
 	applyDefaultCacheRetention();
@@ -6372,4 +6478,4 @@ if (isDirectRun()) main().catch((error) => {
 //#endregion
 export { normalizeBody as $, SUMMARY_HISTORY_END as A, buildSummaryHistoryEntries as B, createDiagnosticContext as C, traceDiagnosticPhase as D, traceDiagnostic as E, SUMMARY_MARKER as F, findExistingSummaryNoteId as G, extractSummaryHistoryEntries as H, buildArchivedSummaryEntry as I, upsertSummaryNote as J, stripSummaryHistory as K, buildReviewedCommitFooter as L, SUMMARY_HISTORY_ENTRY_START as M, SUMMARY_HISTORY_LIMIT as N, normalizeSeverity as O, SUMMARY_HISTORY_START as P, fingerprints as Q, buildSizeNoticeBlock as R, DIAGNOSTIC_CHANNEL_PREFIX as S, diagnosticChannels as T, findExistingReviewedCommitSha as U, extractReviewedCommitSha as V, findExistingSummaryNote as W, extractDiffHunkContext as X, appendFingerprintMarkers as Y, extractExistingFingerprints as Z, resolveNpmSkillDir as _, main as a, parseReviewMarkdownWithWarnings as b, buildGeneratedComments as c, startOtelBridge as d, sha256 as et, filterDiff as f, parseSkillSpec as g, loadNamedSkill as h, formatUsageLine as i, SUMMARY_HISTORY_ENTRY_END as j, toGitLabReviewSeverity as k, buildPayload as l, gitSkillCacheKey as m, formatPerModelUsage as n, run as o, runReview as p, stripSummaryMarker as q, formatSkillsFooter as r, withHttpStamping as s, countPostedBySeverity as t, isOtelEnabled as u, resolveSkillCacheDir as v, createDiagnosticRunId as w, DIAGNOSTIC_CHANNEL_NAMES as x, parseReviewMarkdown as y, buildSummaryBody as z };
 
-//# sourceMappingURL=cli-DBkaU14C.js.map
+//# sourceMappingURL=cli-FDpPZaNn.js.map