pi-pr-review 1.17.2 → 1.17.4

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [1.17.4](https://github.com/10ego/pi-pr-review/compare/v1.17.3...v1.17.4) (2026-09-01)
+
+
+### Bug Fixes
+
+* **review:** default heavy attempts to twelve minutes ([#130](https://github.com/10ego/pi-pr-review/issues/130)) ([7a3af3b](https://github.com/10ego/pi-pr-review/commit/7a3af3b3bf9f5beb0a8c309c3e7524f782a1d88f))
+
+## [1.17.3](https://github.com/10ego/pi-pr-review/compare/v1.17.2...v1.17.3) (2026-08-31)
+
+
+### Bug Fixes
+
+* **review:** preserve validated confidence ratings ([#128](https://github.com/10ego/pi-pr-review/issues/128)) ([27843b7](https://github.com/10ego/pi-pr-review/commit/27843b7c6469827e65fc5d7c69511b20be3615ba))
+
 ## [1.17.2](https://github.com/10ego/pi-pr-review/compare/v1.17.1...v1.17.2) (2026-08-31)
 
 

package/README.md

@@ -175,7 +175,7 @@ Example:
   },
   "tools": ["read", "bash", "grep", "find", "ls"],
   "deadlines": {
-    "attemptMs": { "light": 180000, "medium": 360000, "heavy": 480000 },
+    "attemptMs": { "light": 180000, "medium": 360000, "heavy": 720000 },
     "fallbackAttemptMs": 180000,
     "batchMs": 720000,
     "synthesisMs": 60000,
@@ -191,7 +191,7 @@ Example:
 }
 ```
 
-Every invocation has a host-owned monotonic 15-minute hard cap, including the two GitHub identity/lifecycle preflights, parent orchestration, synthesis, termination grace, and reserved cleanup. The dependent preflight calls share the one invocation budget, so they cannot each add an independent command timeout before review timing begins. The reviewer batch window activates once, at the first reviewer dispatch: preflight and diff capture remain charged to the total cap but cannot exhaust `batchMs` before any reviewer starts. The activated batch is still truncated by the original total deadline and its synthesis/termination/cleanup reserves. Defaults bound light/medium/heavy attempts to 3/6/8 minutes, a fallback attempt to 3 minutes, and the concurrent batch to 12 minutes. The complete `deadlines` object may be replaced at user scope or by a trusted project; partial, malformed, non-integer, out-of-range, or internally inconsistent objects are rejected as a unit and the last valid/default finite budget remains active. Supported inclusive ranges are: attempts 30–720 seconds, fallback 30–360 seconds, batch 60–840 seconds, synthesis 10–120 seconds, total 120–1200 seconds, TERM grace 0.1–15 seconds, cleanup reserve 1–30 seconds, and minimum useful fallback 10–120 seconds. Minimum fallback must not exceed its attempt cap, and batch + synthesis + termination grace + cleanup must fit inside total.
+Every invocation has a host-owned monotonic 15-minute hard cap, including the two GitHub identity/lifecycle preflights, parent orchestration, synthesis, termination grace, and reserved cleanup. The dependent preflight calls share the one invocation budget, so they cannot each add an independent command timeout before review timing begins. The reviewer batch window activates once, at the first reviewer dispatch: preflight and diff capture remain charged to the total cap but cannot exhaust `batchMs` before any reviewer starts. The activated batch is still truncated by the original total deadline and its synthesis/termination/cleanup reserves. Defaults bound light/medium/heavy attempts to 3/6/12 minutes, a fallback attempt to 3 minutes, and the concurrent batch to 12 minutes. The complete `deadlines` object may be replaced at user scope or by a trusted project; partial, malformed, non-integer, out-of-range, or internally inconsistent objects are rejected as a unit and the last valid/default finite budget remains active. Supported inclusive ranges are: attempts 30–720 seconds, fallback 30–360 seconds, batch 60–840 seconds, synthesis 10–120 seconds, total 120–1200 seconds, TERM grace 0.1–15 seconds, cleanup reserve 1–30 seconds, and minimum useful fallback 10–120 seconds. Minimum fallback must not exceed its attempt cap, and batch + synthesis + termination grace + cleanup must fit inside total.
 
 A timed-out or retryable quota/rate-limit/capacity lane may start at most one configured fallback attempt. It starts only when at least `minimumFallbackMs` plus cleanup reserve remains; the host never changes the configured model, thinking level, or tool policy to save time. If a tier is unset, its existing nearest-configured-tier/Pi-default behavior is unchanged.
 
@@ -293,7 +293,7 @@ Each finding includes:
 
 - severity: `P0`, `P1`, `P2`, `P3`, or `nit`;
 - whether it blocks the verdict;
-- an explanation and confidence score;
+- an explanation and independently validated confidence score (the host preserves the supplied 0.0–1.0 value instead of manufacturing `1.00`; scoreless or malformed current Markdown degrades fail-closed, and pre-fix cached completion records are invalidated);
 - a diff-anchored file and line range when available.
 
 | Severity | Meaning |

package/lib/pr-review-deadlines.ts

@@ -18,7 +18,7 @@ export interface ReviewDeadlineConfig {
 
 /** Conservative initial caps; the 15 minute invocation cap makes 30 minute reviews impossible. */
 export const DEFAULT_REVIEW_DEADLINES: Readonly<ReviewDeadlineConfig> = Object.freeze({
-	attemptMs: Object.freeze({ light: 180_000, medium: 360_000, heavy: 480_000 }),
+	attemptMs: Object.freeze({ light: 180_000, medium: 360_000, heavy: 720_000 }),
 	fallbackAttemptMs: 180_000,
 	batchMs: 720_000,
 	synthesisMs: 60_000,

package/lib/pr-review-markdown.ts

@@ -384,14 +384,18 @@ function parseFindings(text: string): { findings: ReviewFindingLike[]; count: nu
 		const severity = explicitSeverity?.toLowerCase() === "nit" ? "nit" : explicitSeverity?.toUpperCase();
 		const normalizedTag = tagged?.toLowerCase() === "nit" ? "nit" : tagged?.toUpperCase();
 		const rationale = field(block, "Rationale") ?? field(block, "Why");
+		const confidenceText = field(block, "Confidence");
+		const confidence = confidenceText === undefined ? undefined : Number(confidenceText.trim());
+		const validConfidence = confidenceText !== undefined &&
+			/^(?:0(?:\.\d+)?|1(?:\.0+)?)$/.test(confidenceText.trim()) && Number.isFinite(confidence);
 		const location = parseLocation(field(block, "Location"));
 		const recognizedFieldCount = fieldCount(block, "Severity") + fieldCount(block, "Rationale") +
-			fieldCount(block, "Why") + fieldCount(block, "Location");
-		const unconsumed = block.replace(/^\*\*(?:Severity|Rationale|Why|Location):\*\*.*$/gim, "").trim();
+			fieldCount(block, "Why") + fieldCount(block, "Confidence") + fieldCount(block, "Location");
+		const unconsumed = block.replace(/^\*\*(?:Severity|Rationale|Why|Confidence|Location):\*\*.*$/gim, "").trim();
 		if (
-			!explicitSeverity || !rationale?.trim() || recognizedFieldCount < 2 || unconsumed ||
+			!explicitSeverity || !rationale?.trim() || recognizedFieldCount < 2 || unconsumed || !validConfidence ||
 			fieldCount(block, "Severity") !== 1 || fieldCount(block, "Rationale") + fieldCount(block, "Why") !== 1 ||
-			fieldCount(block, "Location") > 1
+			fieldCount(block, "Confidence") !== 1 || fieldCount(block, "Location") > 1
 		) {
 			complete = false;
 			continue;
@@ -410,7 +414,7 @@ function parseFindings(text: string): { findings: ReviewFindingLike[]; count: nu
 			severity,
 			blocking: severity === "P0" || severity === "P1",
 			body: rationale,
-			confidence_score: 1,
+			confidence_score: confidence,
 			code_location: location.location,
 		});
 	}
@@ -470,7 +474,6 @@ function syntheticReview(
 		verdict,
 		overall_correctness: verdict === "request_changes" ? "patch is incorrect" : "patch is correct",
 		overall_explanation: overview.split(/\n\n|\n/)[0] ?? "Review completed.",
-		overall_confidence_score: 1,
 	};
 }
 

package/lib/pr-review-publish.ts

@@ -596,7 +596,7 @@ export interface CompletedReviewSessionIdentity {
 }
 
 export interface PersistedCompletedReview {
-	schemaVersion: 2;
+	schemaVersion: 3;
 	session: CompletedReviewSessionIdentity;
 	invocation: ReviewInvocation;
 	repository: RepositoryBinding;
@@ -819,7 +819,7 @@ export class CompletedReviewCache {
 		const digest = reviewHash(record.review);
 		const useReference = !!reviewEntryId && !!referencedReview && reviewHash(referencedReview) === digest;
 		return {
-			schemaVersion: 2,
+			schemaVersion: 3,
 			session: { ...session },
 			invocation: { ...record.invocation, autoPost: { ...record.invocation.autoPost } },
 			repository: { ...record.repository },
@@ -849,7 +849,7 @@ export class CompletedReviewCache {
 	): boolean {
 		if (
 			!isObject(value) ||
-			value.schemaVersion !== 2 ||
+			value.schemaVersion !== 3 ||
 			!validSessionIdentity(value.session) ||
 			!sameSessionIdentity(value.session, session) ||
 			!validRepositoryBinding(value.repository)
@@ -866,7 +866,7 @@ export class CompletedReviewCache {
 		const candidate = hasReference ? referencedReview : value.review;
 		let parsed: PublishableReviewParseResult;
 		try {
-			parsed = parsePublishableReview(JSON.stringify(candidate));
+			parsed = canonicalReviewSnapshot(candidate as ReviewLike);
 		} catch {
 			return false;
 		}
@@ -1083,7 +1083,10 @@ function publishableReviewEnvelope(text: string): { text: string; source: "json"
  * Publication accepts one complete JSON object. A single surrounding Markdown code
  * fence is tolerated for compatibility but remains distinguishable from exact JSON.
  */
-export function parsePublishableReview(text: string): PublishableReviewParseResult {
+export function parsePublishableReview(
+	text: string,
+	options: { allowMissingOverallConfidence?: boolean } = {},
+): PublishableReviewParseResult {
 	const envelope = publishableReviewEnvelope(text);
 	let value: unknown;
 	try {
@@ -1140,7 +1143,11 @@ export function parsePublishableReview(text: string): PublishableReviewParseResu
 	if (!new Set(["patch is correct", "patch is incorrect"]).has(String(value.overall_correctness))) {
 		return { error: "overall_correctness is invalid" };
 	}
-	if (!isConfidence(value.overall_confidence_score)) {
+	if (
+		value.overall_confidence_score !== undefined
+			? !isConfidence(value.overall_confidence_score)
+			: !options.allowMissingOverallConfidence
+	) {
 		return { error: "overall_confidence_score is invalid" };
 	}
 	return { review: value as unknown as ReviewLike, source: envelope.source };
@@ -1421,7 +1428,10 @@ export function canonicalReviewSnapshot(review: ReviewLike): PublishableReviewPa
 	if (typeof serialized !== "string") {
 		return { error: "review could not be serialized for publication" };
 	}
-	return parsePublishableReview(serialized);
+	// Host-synthesized canonical Markdown has no manufactured overall score,
+	// but every parsed finding still requires its validated numeric confidence.
+	// Assistant-authored strict JSON requires both at its public parse boundary.
+	return parsePublishableReview(serialized, { allowMissingOverallConfidence: true });
 }
 
 export function validateInlineComments(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-pr-review",
-  "version": "1.17.2",
+  "version": "1.17.4",
   "description": "Parallel AI code review for GitHub pull requests in the Pi coding agent, with model-agnostic tiered subagents, structured findings, optional verification, and host-gated COMMENT or qualified APPROVE publishing.",
   "keywords": [
     "pi-package",

package/prompts/pr-review.md

@@ -222,6 +222,7 @@ Return Markdown using these stable headings. Do not emit a GitHub API payload an
 ### [P1] Imperative finding title
 **Severity:** P1
 **Rationale:** Concise Markdown explaining the trigger, impact, and source-grounded evidence.
+**Confidence:** 0.92
 **Location:** `path/to/file.ts:10-12 RIGHT`
 
 ## Lane completeness
@@ -231,6 +232,6 @@ Return Markdown using these stable headings. Do not emit a GitHub API payload an
 <useful strengths plus concise correctness, security, or performance notes>
 ```
 
-Repeat the `###` finding block for every confirmed finding. Omit `Location` when no safe diff location exists. Use `No findings.` under `## Findings` when empty. The extension retains the complete raw synthesis even when some or all finding blocks cannot be parsed. Canonical heading discovery ignores heading-like content in CommonMark fenced-code and HTML-block contexts. It validates safe P0–P3 anchors for inline placement, preserves ambiguous or unparsed substantive content in exactly one sanitized body-only `COMMENT`, and degrades malformed synthesis the same way; if synthesis is absent, it assembles a deterministic body-only review from retained lane artifacts. Optional formatting repair can never block this fallback.
+Repeat the `###` finding block for every confirmed finding. `Confidence` is the independently validated numeric confidence for that finding from 0.0 through 1.0; do not use a fixed default. Omit `Location` when no safe diff location exists. Use `No findings.` under `## Findings` when empty. The extension retains the complete raw synthesis even when some or all finding blocks cannot be parsed. Canonical heading discovery ignores heading-like content in CommonMark fenced-code and HTML-block contexts. It validates safe P0–P3 anchors for inline placement, preserves ambiguous or unparsed substantive content in exactly one sanitized body-only `COMMENT`, and degrades malformed synthesis the same way; if synthesis is absent, it assembles a deterministic body-only review from retained lane artifacts. Optional formatting repair can never block this fallback.
 
 Host code captures repository, PR, reviewed head, lifecycle, posting authority, stale policy, and invocation identity before review execution, serializes the single GitHub request with `JSON.stringify`, sanitizes reserved markers, enforces payload limits, appends the canonical marker, and performs duplicate/stale/draft/lifecycle/final-head checks. The assistant's semantic `approve` is only one input to the host gates; assistant text cannot directly choose `APPROVE`, `REQUEST_CHANGES`, commit ID, API path, repository, or hostname. Parent candidate validation must gather all independent evidence in one wave and use at most one dependency-driven follow-up, as specified in Step 7.