pi-pr-review 1.10.4 → 1.10.6

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [1.10.6](https://github.com/10ego/pi-pr-review/compare/v1.10.5...v1.10.6) (2026-07-17)
+
+
+### Bug Fixes
+
+* **publish:** simplify reliable review posting ([#31](https://github.com/10ego/pi-pr-review/issues/31)) ([7d93560](https://github.com/10ego/pi-pr-review/commit/7d935604b620a51b04708633da7c4dc0850d6096))
+
+## [1.10.5](https://github.com/10ego/pi-pr-review/compare/v1.10.4...v1.10.5) (2026-07-17)
+
+
+### Miscellaneous Chores
+
+* **release:** harden Node 24 automation ([#32](https://github.com/10ego/pi-pr-review/issues/32)) ([6b670b3](https://github.com/10ego/pi-pr-review/commit/6b670b3a1e33f3f2392027ae79c159afd9738690))
+
 ## [1.10.4](https://github.com/10ego/pi-pr-review/compare/v1.10.3...v1.10.4) (2026-07-15)
 
 

package/README.md

@@ -182,21 +182,23 @@ Publishing is off by default.
 /pr-review-config auto_post_reviews=true
 ```
 
-The extension—not the model—owns publishing. It creates one formal review with the event hardcoded to `COMMENT`; it never submits `APPROVE` or `REQUEST_CHANGES`. Before writing, it verifies the current PR head, validates inline anchors, and checks for a review of the same head by the current GitHub identity.
+The extension—not the model—owns publishing. After a successful review, it caches one validated completed review per repository and PR in the current Pi session. `autoPostReviews` and `--comment` publish that cached review after completion; `--no-comment` suppresses publication for the run.
 
-If the agent's final review is not valid exact-contract JSON, the extension logs the validation reason and automatically asks the same agent to correct its completed output once, with all tools disabled and without changing the captured posting authority. A valid correction is cached and publication is attempted under the original flags/config. If that single correction is also invalid or attempts to call a tool, publication stops and reports the error instead of looping. Overlapping input cancels the correction, remains unqueued, and must be retried after the agent settles.
+If the agent's final review is not valid exact-contract JSON, the extension logs the reason and automatically asks the same agent to correct its completed output once, with tools disabled and the original posting authority unchanged. An invalid correction, a tool call, or overlapping input stops publication rather than starting another correction loop.
 
-Closed or merged PRs use a body-only review. Open PRs attach eligible P0–P3 findings as inline comments and keep nits or off-diff findings in the review body. When GitHub omits patch metadata needed to validate an inline anchor, the affected finding remains in the review summary instead of blocking publication. When multiple findings target the same diff anchor, the first is attached inline and later findings remain in the review body so publication neither fails nor drops review content.
+You can publish the cache later with `/pr-review-publish 123`, or directly ask the agent to “post the inline review,” “post it as an inline review,” or “publish the review for PR #123.” The extension handles that request directly before an agent turn. `/pr-review-publish` and a matching direct request publish only the cache; they never start or rerun review agents. Unnumbered direct requests select the latest cached review for the current repository. Only fresh interactive/RPC input can use the direct path.
 
-After a review completes, you can directly ask the agent to “post the inline review” or “post it as an inline review.” The extension handles that request directly before an agent turn, selecting the latest cached review for an unnumbered request or the named PR in “publish the review for PR #123.” Only fresh interactive/RPC input can trigger this path; extension-generated, queued, or steering input cannot. The extension publishes only validated cached content, never replacement model-authored text, and never starts or reruns review agents. A direct request permits stale publication.
+Every authorized publish path builds one `COMMENT` payload and sends at most one GitHub review `POST`; it never submits `APPROVE` or `REQUEST_CHANGES` and never retries a rejected write with a fallback POST. For a current, open PR, the first 50 eligible P0–P3 findings with valid, unique diff anchors are inline. All other findings that pass content validation stay in the top-level review body, including nits, off-diff findings, unavailable diff metadata, duplicate anchors, and overflow. Stale or authorized non-open reviews are body-only.
 
-Stale publication is also enabled by default through `allowStalePublish: true`; disable it with `/pr-review-config allow_stale_publish=false`. Automatic posting and `/pr-review-publish` without an override use the setting captured when the review starts. The explicit `--allow-stale` flag remains available when the captured setting disabled stale publication:
+The same safety gates apply to every path: captured posting authority, exact repository/PR/review binding, safe locations, no reserved review markers, bounded bodies and payloads, current-head and stale policy, draft and lifecycle checks, non-open authorization, same-head duplicate detection, and a final head check. Unknown or invalid states fail closed before a write.
+
+Stale publication is enabled by default through `allowStalePublish: true`; disable it with `/pr-review-config allow_stale_publish=false`. Automatic posting and `/pr-review-publish` use the setting captured when the review starts unless the command supplies the explicit override:
 
 ```text
 /pr-review-publish 123 --allow-stale
 ```
 
-Inline comments are always disabled for stale reviews because the original anchors may no longer be valid. The stale review is body-only and displays a warning containing both the reviewed and current commit hashes. The cache is stored in the current Pi session, survives extension reloads and session resumes, and is bound to that session instance's ID and creation metadata as well as the repository.
+A matching direct request permits stale publication. Inline comments are always disabled for stale reviews because the original anchors may no longer be valid; the body identifies both the reviewed and current commit. The session-backed cache survives extension reloads and session resumes and remains bound to the originating session instance and repository.
 
 ## Optional verification
 

package/extensions/review-table.ts

@@ -39,9 +39,7 @@ import {
 	type AutoPostResolution,
 	type CompletedReviewRecord,
 	type CompletedReviewSessionIdentity,
-	type RepositoryBinding,
 	type ReviewInvocation,
-	type ReviewLike,
 } from "../lib/pr-review-publish.ts";
 import {
 	ReviewLoopCoordinator,
@@ -379,51 +377,48 @@ function notifyPublishResult(
 	}
 }
 
-async function maybePublishReview(
-	text: string,
-	invocation: ReviewInvocation,
+type ReviewPublicationOrigin =
+	| { readonly kind: "frozen-invocation" }
+	| { readonly kind: "publish-command"; readonly stalePolicy: "frozen" | "allow-stale" }
+	| { readonly kind: "direct-request" };
+
+async function publishCompletedReview(
+	record: CompletedReviewRecord,
+	origin: ReviewPublicationOrigin,
 	ctx: ExtensionContext,
-	expectedRepository?: RepositoryBinding,
 ): Promise<void> {
-	const authority = decideReviewPublication(invocation);
-	if (authority.error) {
-		ctx.ui.notify(`PR review was not posted: ${authority.error}`, "error");
-		return;
-	}
-	if (!authority.publish) return;
-	const parsed = parsePublishableReview(text);
-	if (!parsed.review) {
-		ctx.ui.notify(`PR review was not posted: ${parsed.error}`, "error");
-		return;
-	}
-	const bindingError = validateReviewInvocation(parsed.review, invocation);
-	if (bindingError) {
-		ctx.ui.notify(`PR review was not posted: ${bindingError}`, "error");
+	const decision = origin.kind === "frozen-invocation"
+		? decideReviewPublication(record.invocation)
+		: undefined;
+	if (decision?.error) {
+		ctx.ui.notify(`PR review was not posted: ${decision.error}`, "error");
 		return;
 	}
-	if (!shouldPublishReview(parsed.review)) return;
-	const headSha = parsed.review.pr?.head_sha;
+	if (decision && !decision.publish) return;
+	const explicitStale = origin.kind === "direct-request" ||
+		(origin.kind === "publish-command" && origin.stalePolicy === "allow-stale");
+	const allowStale = explicitStale || record.invocation.allowStalePublish;
+	const source = decision?.source ?? (origin.kind === "frozen-invocation"
+		? "frozen invocation"
+		: origin.kind === "direct-request"
+			? "direct user request"
+			: origin.stalePolicy === "allow-stale" ? "publish-only --allow-stale" : "publish-only");
+
+	const headSha = record.review.pr?.head_sha;
 	if (typeof headSha !== "string") {
-		ctx.ui.notify("PR review was not posted: final JSON is missing pr.head_sha", "error");
-		return;
-	}
-	if (!expectedRepository) {
-		ctx.ui.notify(
-			"PR review was not posted because its repository identity could not be established before caching; no publish-only cache is available. Rerun /pr-review when GitHub repository lookup is working.",
-			"error",
-		);
+		ctx.ui.notify("PR review was not posted: cached final JSON is missing pr.head_sha", "error");
 		return;
 	}
 	const result = await publishPullReview({
 		cwd: ctx.cwd,
-		prNumber: invocation.prNumber,
+		prNumber: record.invocation.prNumber,
 		headSha,
-		allowNonOpen: invocation.allowNonOpen,
-		allowStale: invocation.allowStalePublish,
-		expectedRepository,
-		review: parsed.review as ReviewLike,
+		allowNonOpen: record.invocation.allowNonOpen,
+		allowStale,
+		expectedRepository: record.repository,
+		review: record.review,
 	});
-	notifyPublishResult(result, authority.source ?? "frozen invocation", ctx);
+	notifyPublishResult(result, source, ctx);
 }
 
 export default function registerReviewTable(
@@ -447,15 +442,41 @@ export default function registerReviewTable(
 		}
 		restoreCompletedReviewBranch(completedReviews, ctx.sessionManager.getBranch(), session);
 	};
-	let pendingCompletion:
-		| {
-				text: string;
-				invocation: ReviewInvocation;
-				repository?: RepositoryBinding;
-				record?: CompletedReviewRecord;
-				session?: CompletedReviewSessionIdentity;
-		  }
-		| undefined;
+	type PendingCompletion =
+		| { readonly record: CompletedReviewRecord; readonly session?: CompletedReviewSessionIdentity }
+		| { readonly error: string };
+	let pendingCompletion: PendingCompletion | undefined;
+	const completionError = (invocation: ReviewInvocation, failure?: string): PendingCompletion | undefined => {
+		const decision = decideReviewPublication(invocation);
+		const error = decision.error ?? (decision.publish ? failure : undefined);
+		return error ? { error } : undefined;
+	};
+	const resolveCompletion = async (
+		parsed: ReturnType<typeof parsePublishableReview>,
+		invocation: ReviewInvocation,
+		ctx: ExtensionContext,
+	): Promise<PendingCompletion | undefined> => {
+		if (!parsed.review) return completionError(invocation, parsed.error ?? "final review JSON is invalid");
+		const bindingError = validateReviewInvocation(parsed.review, invocation);
+		if (bindingError) return completionError(invocation, bindingError);
+		if (!shouldPublishReview(parsed.review)) return completionError(invocation);
+		try {
+			const repository = await resolveRepositoryBinding(ctx.cwd);
+			// Cache before publication preflight; persist after Pi stores the assistant message.
+			const record = completedReviews.remember(parsed.review, invocation, repository);
+			const session = sessionIdentity(ctx);
+			if (!session) {
+				ctx.ui.notify("Completed review cache will not survive reload: session identity is unavailable", "warning");
+			}
+			return session ? { record, session } : { record };
+		} catch (error) {
+			ctx.ui.notify(`Completed review is not available to publish-only: ${String(error)}`, "warning");
+			return completionError(
+				invocation,
+				"its repository identity could not be established before caching; no publish-only cache is available. Rerun /pr-review when GitHub repository lookup is working.",
+			);
+		}
+	};
 	let outputRepairAttempted = false;
 	let outputRepairCancelled = false;
 	const telemetryTracker = new ReviewTelemetryTracker();
@@ -469,44 +490,24 @@ export default function registerReviewTable(
 		}
 	};
 
-	type CachedPublication =
-		| { result: Awaited<ReturnType<typeof publishPullReview>> }
-		| { error: string };
-	const publishCachedReview = async (
+	type CachedReviewResolution = { record: CompletedReviewRecord } | { error: string };
+	const resolveCachedReview = async (
 		requestedPrNumber: number | undefined,
-		allowStaleOverride: boolean | undefined,
 		ctx: ExtensionContext,
-	): Promise<CachedPublication> => {
-		let repository: RepositoryBinding;
+	): Promise<CachedReviewResolution> => {
 		try {
-			repository = await resolveRepositoryBinding(ctx.cwd);
-		} catch (error) {
-			return { error: `Cannot resolve the current GitHub repository: ${String(error)}` };
-		}
-		const completed = requestedPrNumber === undefined
-			? completedReviews.latest(repository)
-			: completedReviews.get(requestedPrNumber, repository);
-		if (!completed) {
+			const repository = await resolveRepositoryBinding(ctx.cwd);
+			const record = requestedPrNumber === undefined
+				? completedReviews.latest(repository)
+				: completedReviews.get(requestedPrNumber, repository);
+			if (record) return { record };
 			const target = requestedPrNumber === undefined ? "the latest PR" : `PR #${requestedPrNumber}`;
 			return {
 				error: `No completed review for ${target} is cached for this repository in the current extension session. Publishing never starts or reruns a review.`,
 			};
+		} catch (error) {
+			return { error: `Cannot resolve the current GitHub repository: ${String(error)}` };
 		}
-		const prNumber = completed.invocation.prNumber;
-		const headSha = completed.review.pr?.head_sha;
-		if (typeof headSha !== "string") return { error: "Cached PR review is missing pr.head_sha" };
-		const allowStale = allowStaleOverride ?? completed.invocation.allowStalePublish;
-		return {
-			result: await publishPullReview({
-				cwd: ctx.cwd,
-				prNumber,
-				headSha,
-				allowNonOpen: completed.invocation.allowNonOpen,
-				allowStale,
-				expectedRepository: completed.repository,
-				review: completed.review,
-			}),
-		};
 	};
 
 	pi.registerCommand("pr-review-publish", {
@@ -535,20 +536,15 @@ export default function registerReviewTable(
 				);
 				return;
 			}
-			const published = await publishCachedReview(
-				parsed.prNumber,
-				parsed.allowStale ? true : undefined,
-				ctx,
-			);
-			if ("error" in published) {
-				ctx.ui.notify(published.error, "error");
+			const resolved = await resolveCachedReview(parsed.prNumber, ctx);
+			if ("error" in resolved) {
+				ctx.ui.notify(resolved.error, "error");
 				return;
 			}
-			notifyPublishResult(
-				published.result,
-				parsed.allowStale ? "publish-only --allow-stale" : "publish-only",
-				ctx,
-			);
+			await publishCompletedReview(resolved.record, {
+				kind: "publish-command",
+				stalePolicy: parsed.allowStale ? "allow-stale" : "frozen",
+			}, ctx);
 		},
 	});
 
@@ -630,9 +626,9 @@ export default function registerReviewTable(
 				);
 				return { action: "handled" as const };
 			}
-			const published = await publishCachedReview(directPublish.prNumber, true, ctx);
-			if ("error" in published) ctx.ui.notify(published.error, "error");
-			else notifyPublishResult(published.result, "direct user request", ctx);
+			const resolved = await resolveCachedReview(directPublish.prNumber, ctx);
+			if ("error" in resolved) ctx.ui.notify(resolved.error, "error");
+			else await publishCompletedReview(resolved.record, { kind: "direct-request" }, ctx);
 			return { action: "handled" as const };
 		}
 		if (loopCoordinator.phase() === "awaiting_confirmation") {
@@ -699,24 +695,21 @@ export default function registerReviewTable(
 		const pending = pendingCompletion;
 		pendingCompletion = undefined;
 		if (!pending) return;
-		if (pending.record && pending.session) {
+		if ("error" in pending) {
+			ctx.ui.notify(`PR review was not posted: ${pending.error}`, "error");
+			return;
+		}
+		if (pending.session) {
 			const currentSession = sessionIdentity(ctx);
-			if (
-				!currentSession ||
-				currentSession.id !== pending.session.id ||
-				currentSession.startedAt !== pending.session.startedAt
-			) {
+			if (!currentSession || currentSession.id !== pending.session.id || currentSession.startedAt !== pending.session.startedAt) {
 				ctx.ui.notify("Completed review was not persisted or posted because the session identity changed", "warning");
 				return;
 			}
 			const leaf = ctx.sessionManager.getLeafEntry();
-			const leafText = leaf?.type === "message" && leaf.message.role === "assistant"
-				? assistantText(leaf.message as { content?: MessagePart[] })
-				: "";
-			const leafReview = parsePublishableReview(leafText).review;
-			const reviewEntryId = leaf?.type === "message" && leaf.message.role === "assistant" && leafReview
-				? leaf.id
+			const leafReview = leaf?.type === "message" && leaf.message.role === "assistant"
+				? parsePublishableReview(assistantText(leaf.message as { content?: MessagePart[] })).review
 				: undefined;
+			const reviewEntryId = leafReview ? leaf?.id : undefined;
 			try {
 				// Persist before any GitHub preflight so a failed post always remains retryable.
 				pi.appendEntry(
@@ -727,7 +720,7 @@ export default function registerReviewTable(
 				ctx.ui.notify(`Completed review cache will not survive an extension reload: ${String(error)}`, "warning");
 			}
 		}
-		await maybePublishReview(pending.text, pending.invocation, ctx, pending.repository);
+		await publishCompletedReview(pending.record, { kind: "frozen-invocation" }, ctx);
 	});
 
 	pi.on("message_end", async (event, ctx) => {
@@ -777,7 +770,7 @@ export default function registerReviewTable(
 			return;
 		}
 
-		let publishable = active ? parsePublishableReview(text) : undefined;
+		const publishable = active ? parsePublishableReview(text) : undefined;
 		if (active && !publishable?.review && !outputRepairAttempted) {
 			const error = publishable?.error ?? "final review JSON is invalid";
 			if (loopCoordinator.suspendToolsForRepair()) {
@@ -810,36 +803,19 @@ export default function registerReviewTable(
 			outputRepairCancelled = false;
 			persistTelemetry("terminal_response");
 		}
-		const review = text.trim() ? parseReview(text) : null;
-		if (invocation) {
-			publishable ??= parsePublishableReview(text);
-			let repository: RepositoryBinding | undefined;
-			let record: CompletedReviewRecord | undefined;
-			let session: CompletedReviewSessionIdentity | undefined;
-			if (
-				publishable.review &&
-				!validateReviewInvocation(publishable.review, invocation) &&
-				shouldPublishReview(publishable.review)
-			) {
-				try {
-					repository = await resolveRepositoryBinding(ctx.cwd);
-					// Cache before publication preflight; persist after Pi stores the assistant message.
-					record = completedReviews.remember(publishable.review, invocation, repository);
-					session = sessionIdentity(ctx);
-					if (!session) {
-						ctx.ui.notify("Completed review cache will not survive reload: session identity is unavailable", "warning");
-					}
-				} catch (error) {
-					ctx.ui.notify(`Completed review is not available to publish-only: ${String(error)}`, "warning");
-				}
-			}
-			pendingCompletion = { text, invocation, repository, record, session };
-		}
+		const review = publishable?.review
+			? publishable.review as Review
+			: active
+				? null
+				: text.trim()
+					? parseReview(text)
+					: null;
+		if (invocation) pendingCompletion = await resolveCompletion(publishable!, invocation, ctx);
 		if (!review) return; // not a renderable /pr-review JSON payload — leave untouched
 
 		// Keep raw JSON for automation; only prettify for interactive terminals.
 		if (ctx.mode !== "tui") return;
-		const nonText = (event.message.content as MessagePart[]).filter((p) => p.type !== "text");
+		const nonText = event.message.content.filter((part) => part.type !== "text");
 		return {
 			message: {
 				...event.message,