pi-pr-review 1.7.0 → 1.7.1

package/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "1.7.0"
+  ".": "1.7.1"
 }

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.7.1](https://github.com/10ego/pi-pr-review/compare/v1.7.0...v1.7.1) (2026-07-14)
+
+
+### Bug Fixes
+
+* **publish:** handle direct review requests in extension ([#15](https://github.com/10ego/pi-pr-review/issues/15)) ([e27ffeb](https://github.com/10ego/pi-pr-review/commit/e27ffebb181687a7e38f5ce8f0045b5db76975f4))
+
 ## [1.7.0](https://github.com/10ego/pi-pr-review/compare/v1.6.6...v1.7.0) (2026-07-13)
 
 

package/README.md

@@ -147,7 +147,7 @@ The extension—not the model—owns publishing. It creates one formal review wi
 
 Closed or merged PRs use a body-only review. Open PRs attach eligible P0–P3 findings as inline comments and keep nits or off-diff findings in the review body.
 
-After a review completes, you can directly ask the agent to “post the inline review.” That interactive/RPC input creates one host-side, session- and repository-bound authorization for the extension-owned `pr_review_publish` tool. The authorization is consumed by one matching call; an unnumbered request is restricted to the latest cached review, while “publish the review for PR #123” binds the named PR. The model cannot self-authorize, supply replacement review text, replay the request, or use this tool to rerun review agents. An explicit authorized request permits stale publication.
+After a review completes, you can directly ask the agent to “post the inline review” or “post it as an inline review.” The extension handles that request directly before an agent turn, selecting the latest cached review for an unnumbered request or the named PR in “publish the review for PR #123.” Only fresh interactive/RPC input can trigger this path; extension-generated, queued, or steering input cannot. The extension publishes only validated cached content, never replacement model-authored text, and never starts or reruns review agents. A direct request permits stale publication.
 
 Stale publication is also enabled by default through `allowStalePublish: true`; disable it with `/pr-review-config allow_stale_publish=false`. Automatic posting and `/pr-review-publish` without an override use the setting captured when the review starts. The explicit `--allow-stale` flag remains available when the captured setting disabled stale publication:
 
@@ -214,7 +214,7 @@ The verdict is `request_changes` only when a validated P0 or P1 finding exists.
 - Reviewer subprocesses start with extension discovery disabled, so they cannot recursively invoke this package's agents or verification tool.
 - Reviewers receive the captured diff and are instructed not to modify files.
 - The orchestrator does not check out, commit, or push PR code.
-- GitHub writes require `--comment`, an effective `autoPostReviews: true` setting, or a fresh direct user request that grants one host-side call to the cache-only `pr_review_publish` tool. `allowStalePublish` controls whether an authorized/configured write may be stale; it does not independently authorize a write.
+- GitHub writes require `--comment`, an effective `autoPostReviews: true` setting, the model-free `/pr-review-publish` command, or a narrowly matched direct interactive/RPC publish request handled by the extension before an agent turn. `allowStalePublish` controls whether an invocation/config-authorized write may be stale; it does not independently authorize a write.
 - Publication authority is captured before review or optional verification begins, so PR code cannot enable it mid-run.
 - Multiple model calls run per PR. Use a cheaper `light` model and reserve stronger models for `heavy` passes to control cost.
 - Same-head review markers prevent duplicate publication by the same GitHub identity.

package/extensions/index.ts

@@ -1,13 +1,11 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { ReviewLoopCoordinator } from "../lib/pr-review-loop.ts";
-import { CachedPublishAuthorizationGate } from "../lib/pr-review-publish.ts";
 import registerPrReviewSubagents from "./pr-review-subagent.ts";
 import registerReviewTable from "./review-table.ts";
 
 /** Register the package behind one shared, session-scoped review-loop authority. */
 export default function registerPrReview(pi: ExtensionAPI) {
 	const loopCoordinator = new ReviewLoopCoordinator(pi);
-	const publishAuthorization = new CachedPublishAuthorizationGate();
-	registerPrReviewSubagents(pi, loopCoordinator, () => publishAuthorization.clear());
-	registerReviewTable(pi, loopCoordinator, publishAuthorization);
+	registerPrReviewSubagents(pi, loopCoordinator);
+	registerReviewTable(pi, loopCoordinator);
 }

package/extensions/pr-review-subagent.ts

@@ -987,7 +987,6 @@ const ReviewSubagentsParams = Type.Object({
 export default function registerPrReviewSubagents(
 	pi: ExtensionAPI,
 	loopCoordinator = new ReviewLoopCoordinator(pi),
-	revokePublishAuthorization: () => void = () => {},
 ) {
 	// Resolve security-sensitive executables only from the PATH trusted when this
 	// extension starts, never from a later mutable process environment.
@@ -1329,7 +1328,6 @@ export default function registerPrReviewSubagents(
 		handler: async (args, ctx) => {
 			// Extension commands execute before input events, so revoke explicitly.
 			loopCoordinator.clear();
-			revokePublishAuthorization();
 			const raw = (args ?? "").trim();
 			const parsed = parseConfigArgs(raw);
 			if (parsed.errors.length) {

package/extensions/review-table.ts

@@ -18,15 +18,14 @@ import {
 	type ExtensionContext,
 	getAgentDir,
 } from "@earendil-works/pi-coding-agent";
-import { Type } from "typebox";
 import {
 	classifyAssistantCompletion,
-	CachedPublishAuthorizationGate,
 	COMPLETED_REVIEW_BRANCH_ANCHOR_TYPE,
 	COMPLETED_REVIEW_ENTRY_TYPE,
 	CompletedReviewCache,
 	decideReviewPublication,
 	isNonOpenConfirmationPrompt,
+	parseDirectPublishRequest,
 	parsePublishExistingArgs,
 	parsePublishMode,
 	parsePublishableReview,
@@ -429,7 +428,6 @@ async function maybePublishReview(
 export default function registerReviewTable(
 	pi: ExtensionAPI,
 	loopCoordinator = new ReviewLoopCoordinator(pi),
-	publishAuthorization = new CachedPublishAuthorizationGate(),
 ) {
 	const completedReviews = new CompletedReviewCache();
 	const sessionIdentity = (ctx: ExtensionContext): CompletedReviewSessionIdentity | undefined => {
@@ -471,10 +469,9 @@ export default function registerReviewTable(
 		| { result: Awaited<ReturnType<typeof publishPullReview>> }
 		| { error: string };
 	const publishCachedReview = async (
-		prNumber: number,
+		requestedPrNumber: number | undefined,
 		allowStaleOverride: boolean | undefined,
 		ctx: ExtensionContext,
-		requireLatest = false,
 	): Promise<CachedPublication> => {
 		let repository: RepositoryBinding;
 		try {
@@ -482,17 +479,16 @@ export default function registerReviewTable(
 		} catch (error) {
 			return { error: `Cannot resolve the current GitHub repository: ${String(error)}` };
 		}
-		const completed = completedReviews.get(prNumber, repository);
-		if (requireLatest && completedReviews.latest(repository)?.invocation.prNumber !== prNumber) {
-			return {
-				error: `PR #${prNumber} is not the latest completed review cached for this repository. Name the PR number in the direct publish request to select it explicitly.`,
-			};
-		}
+		const completed = requestedPrNumber === undefined
+			? completedReviews.latest(repository)
+			: completedReviews.get(requestedPrNumber, repository);
 		if (!completed) {
+			const target = requestedPrNumber === undefined ? "the latest PR" : `PR #${requestedPrNumber}`;
 			return {
-				error: `No completed review for PR #${prNumber} is cached for this repository in the current extension session. Publishing never starts or reruns a review.`,
+				error: `No completed review for ${target} is cached for this repository in the current extension session. Publishing never starts or reruns a review.`,
 			};
 		}
+		const prNumber = completed.invocation.prNumber;
 		const headSha = completed.review.pr?.head_sha;
 		if (typeof headSha !== "string") return { error: "Cached PR review is missing pr.head_sha" };
 		const allowStale = allowStaleOverride ?? completed.invocation.allowStalePublish;
@@ -509,79 +505,11 @@ export default function registerReviewTable(
 		};
 	};
 
-	pi.registerTool({
-		name: "pr_review_publish",
-		label: "Publish Cached PR Review",
-		description: [
-			"Publish a completed PR review cached by this extension after a fresh direct interactive or RPC user request authorizes one call.",
-			"Accepts only a PR number: review content, repository binding, and reviewed head come from the validated extension cache.",
-			"Never starts or reruns review agents. An explicit user request authorizes safe stale publication as a body-only review with the reviewed and current commit hashes disclosed.",
-		].join(" "),
-		promptSnippet: "Publish an extension-cached completed PR review when the user explicitly asks to post it",
-		promptGuidelines: [
-			"Call pr_review_publish only in the agent turn started by the user's direct publish request; the extension enforces a one-shot host-side authorization.",
-			"Do not call it during the /pr-review run itself; --comment and autoPostReviews are handled by the extension after final JSON.",
-			"This tool cannot accept model-authored review text; stale inline anchors are never posted.",
-		],
-		parameters: Type.Object(
-			{
-				pr_number: Type.Integer({
-					minimum: 1,
-					description: "PR number whose completed cached review should be published; stale reviews degrade to disclosed body-only comments.",
-				}),
-			},
-			{ additionalProperties: false },
-		),
-		async execute(_toolCallId, params, _signal, _onUpdate, ctx) {
-			if (loopCoordinator.peek()) {
-				return {
-					content: [{ type: "text", text: "A /pr-review run is still active; finish or cancel it before publishing its cached result." }],
-					isError: true,
-					details: { status: "active_review" },
-				};
-			}
-			const authorization = publishAuthorization.consume(params.pr_number, ctx);
-			if (!authorization.authorized) {
-				return {
-					content: [{
-						type: "text",
-						text: "Cached review publication requires a fresh direct user request such as ‘post the inline review’ or ‘publish the review for PR #123’.",
-					}],
-					isError: true,
-					details: { status: "unauthorized" },
-				};
-			}
-			const published = await publishCachedReview(
-				params.pr_number,
-				true,
-				ctx,
-				authorization.requireLatest,
-			);
-			if ("error" in published) {
-				return {
-					content: [{ type: "text", text: published.error }],
-					isError: true,
-					details: { status: "error", message: published.error },
-				};
-			}
-			const result = published.result;
-			const succeeded = result.status === "posted" ||
-				result.status === "posted_degraded" ||
-				result.status === "skipped_duplicate";
-			return {
-				content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
-				...(!succeeded ? { isError: true } : {}),
-				details: result,
-			};
-		},
-	});
-
 	pi.registerCommand("pr-review-publish", {
 		description: "Publish a completed review from this session without rerunning the model",
 		handler: async (args, ctx) => {
 			// Extension commands execute before input hooks, so every invocation —
-			// including malformed arguments — must revoke active review and model-tool authority.
-			publishAuthorization.clear();
+			// including malformed arguments — must revoke active review authority.
 			const active = loopCoordinator.peek();
 			if (active) {
 				loopCoordinator.clear();
@@ -621,7 +549,6 @@ export default function registerReviewTable(
 
 	const revokeActiveLoop = () => {
 		loopCoordinator.clear();
-		publishAuthorization.clear();
 		pendingCompletion = undefined;
 		telemetryTracker.clear();
 	};
@@ -638,7 +565,6 @@ export default function registerReviewTable(
 
 	pi.on("session_tree", (event, ctx) => {
 		loopCoordinator.clear();
-		publishAuthorization.clear();
 		pendingCompletion = undefined;
 		restoreCompletedReviews(ctx);
 		telemetryTracker.clear();
@@ -652,10 +578,29 @@ export default function registerReviewTable(
 		}
 	});
 
-	pi.on("input", (event, ctx) => {
+	pi.on("input", async (event, ctx) => {
 		const source = event.source as ReviewLoopInputSource;
-		if (loopCoordinator.peek()) publishAuthorization.clear();
-		else publishAuthorization.observe(event.text, source, event.streamingBehavior, ctx);
+		const directPublish = parseDirectPublishRequest(event.text);
+		if (
+			(source === "interactive" || source === "rpc") &&
+			event.streamingBehavior === undefined &&
+			directPublish.matched
+		) {
+			const active = loopCoordinator.peek();
+			if (active) {
+				loopCoordinator.clear();
+				persistTelemetry("cleared");
+				ctx.ui.notify(
+					`PR #${active.prNumber} review was cancelled. The direct publish request will not post an older cached result in its place.`,
+					"error",
+				);
+				return { action: "handled" as const };
+			}
+			const published = await publishCachedReview(directPublish.prNumber, true, ctx);
+			if ("error" in published) ctx.ui.notify(published.error, "error");
+			else notifyPublishResult(published.result, "direct user request", ctx);
+			return { action: "handled" as const };
+		}
 		if (loopCoordinator.phase() === "awaiting_confirmation") {
 			const confirmation = loopCoordinator.resolveConfirmationInput(event.text, source, ctx);
 			if (confirmation === "confirmed") {
@@ -754,14 +699,12 @@ export default function registerReviewTable(
 		if (completion === "continue_tools") return;
 		if (completion === "clear_invocation") {
 			loopCoordinator.clear();
-			publishAuthorization.clear();
 			persistTelemetry("cleared");
 			return;
 		}
 
 		const text = assistantText(event.message);
 		const active = loopCoordinator.peek();
-		if (!active) publishAuthorization.clear();
 		if (
 			active &&
 			loopCoordinator.phase() === "reviewing" &&

package/lib/pr-review-publish.ts

@@ -1,7 +1,6 @@
 import { Buffer } from "node:buffer";
 import { spawn } from "node:child_process";
 import { createHash } from "node:crypto";
-import * as path from "node:path";
 
 export type PublishMode = "auto" | "force" | "disabled";
 export type AutoPostSource = "default" | "user" | "project";
@@ -161,7 +160,7 @@ export function parseDirectPublishRequest(input: string): DirectPublishRequestPa
 	const trimmed = input.trim();
 	if (!trimmed || /[\r\n]/.test(trimmed)) return { matched: false };
 	const match = trimmed.match(
-		/^(?:(?:please|kindly)\s+|(?:(?:can|could|would|will)\s+you\s+))?(?:post|publish|submit)\s+(?:(?:the|this|that|my|our)\s+)?(?:(?:cached|completed|current|latest|inline|github|pr|pull[\s-]?request)\s+)*(?:reviews?|inline\s+comments?)(?:\s+(?:for|on|to)\s+(?:(?:the\s+)?(?:pull\s+request|pr)\s*)?#?(\d+))?(?:\s+please)?[.!?]*$/i,
+		/^(?:(?:please|kindly)\s+|(?:(?:can|could|would|will)\s+you\s+))?(?:post|publish|submit)\s+(?:(?:(?:the|this|that|my|our)\s+)?(?:(?:cached|completed|current|latest|inline|github|pr|pull[\s-]?request)\s+)*(?:reviews?|inline\s+comments?)|(?:it|this|that)\s+as\s+(?:(?:an?|the)\s+)?(?:(?:cached|completed|current|latest|inline|github|pr|pull[\s-]?request)\s+)*(?:reviews?|inline\s+comments?))(?:\s+(?:for|on|to)\s+(?:(?:the\s+)?(?:pull\s+request|pr)\s*)?#?(\d+))?(?:\s+please)?[.!?]*$/i,
 	);
 	if (!match) return { matched: false };
 	if (match[1] === undefined) return { matched: true };
@@ -171,75 +170,6 @@ export function parseDirectPublishRequest(input: string): DirectPublishRequestPa
 		: { matched: false };
 }
 
-interface PublishAuthorizationContext {
-	cwd: string;
-	sessionManager: {
-		getSessionId(): string;
-		getHeader(): { id?: string; timestamp?: unknown } | undefined;
-	};
-}
-
-interface PendingPublishAuthorization {
-	cwd: string;
-	sessionId: string;
-	sessionStartedAt?: string;
-	prNumber?: number;
-}
-
-function publishAuthorizationBinding(ctx: PublishAuthorizationContext) {
-	const sessionId = ctx.sessionManager.getSessionId();
-	const header = ctx.sessionManager.getHeader();
-	return {
-		cwd: path.resolve(ctx.cwd),
-		sessionId,
-		...(header?.id === sessionId && typeof header.timestamp === "string"
-			? { sessionStartedAt: header.timestamp }
-			: {}),
-	};
-}
-
-/** One pending model-tool publication authorized by one direct user input. */
-export class CachedPublishAuthorizationGate {
-	private pending?: PendingPublishAuthorization;
-
-	observe(
-		input: string,
-		source: "interactive" | "rpc" | "extension",
-		streamingBehavior: "steer" | "followUp" | undefined,
-		ctx: PublishAuthorizationContext,
-	): DirectPublishRequestParseResult {
-		this.clear();
-		if ((source !== "interactive" && source !== "rpc") || streamingBehavior !== undefined) {
-			return { matched: false };
-		}
-		const parsed = parseDirectPublishRequest(input);
-		if (!parsed.matched) return parsed;
-		this.pending = { ...publishAuthorizationBinding(ctx), ...(parsed.prNumber ? { prNumber: parsed.prNumber } : {}) };
-		return parsed;
-	}
-
-	consume(
-		prNumber: number,
-		ctx: PublishAuthorizationContext,
-	): { authorized: boolean; requireLatest: boolean } {
-		const pending = this.pending;
-		this.clear();
-		if (!pending) return { authorized: false, requireLatest: false };
-		const current = publishAuthorizationBinding(ctx);
-		const sameContext = pending.cwd === current.cwd &&
-			pending.sessionId === current.sessionId &&
-			pending.sessionStartedAt === current.sessionStartedAt;
-		if (!sameContext || (pending.prNumber !== undefined && pending.prNumber !== prNumber)) {
-			return { authorized: false, requireLatest: false };
-		}
-		return { authorized: true, requireLatest: pending.prNumber === undefined };
-	}
-
-	clear(): void {
-		this.pending = undefined;
-	}
-}
-
 export interface PublishExistingParseResult {
 	prNumber?: number;
 	allowStale: boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-pr-review",
-  "version": "1.7.0",
+  "version": "1.7.1",
   "description": "Parallel AI code review for GitHub pull requests in the Pi coding agent, with model-agnostic tiered subagents, structured findings, optional verification, and safe COMMENT-only publishing.",
   "keywords": [
     "pi-package",

package/prompts/pr-review.md

@@ -24,7 +24,7 @@ When `$@` includes `--full`, run the comprehensive six-pass topology: add the me
 
 ### Reviewer topology (parallel tiered subagents, with inline fallback)
 
-You are the **orchestrator**. You own GitHub reads, skip decisions, convention-file discovery when `--full` needs it, selecting at most one discovered trusted baseline name, final validation/classification, and JSON emission. The extension owns verification profile resolution, argv, deadlines, worktree, original-POSIX-group supervision, and cleanup. You never perform direct GitHub writes: the extension captures invocation publishing intent and, after valid final JSON, owns any configured review publication. The extension-owned `pr_review_publish` tool is the only exception: on a later turn, if the user directly asks to post a completed cached review, call that tool with the PR number instead of asking the user to run `/pr-review-publish`. The extension enforces one host-side authorization from that direct interactive/RPC input, bound to the named PR or latest cached review and consumed by one call. Never call it during the review run itself. Subagents are non-modifying reviewers: they receive PR context from you and return candidate evidence only.
+You are the **orchestrator**. You own GitHub reads, skip decisions, convention-file discovery when `--full` needs it, selecting at most one discovered trusted baseline name, final validation/classification, and JSON emission. The extension owns verification profile resolution, argv, deadlines, worktree, original-POSIX-group supervision, cleanup, and every GitHub write. You never perform direct GitHub writes. The extension captures invocation publishing intent and, after valid final JSON, owns any configured review publication. On a later turn, the extension intercepts a direct interactive/RPC request to post the completed cached review and publishes it without an agent turn. Subagents are non-modifying reviewers: they receive PR context from you and return candidate evidence only.
 
 If the `review_subagents` batch tool is available, prefer it over multiple single-pass calls. Fetch PR metadata and the unified diff once, gather any relevant convention-file excerpts, and use `pr_review_verify` with `action: "list"` to discover optional trusted user-level baseline names as described in Steps 2 and 6. Then call `review_subagents` with shared `context`, `max_parallel`, and ordered `passes`. When an applicable name exists, emit the `review_subagents` call and one `pr_review_verify` `action: "run"` call in the **same assistant turn** so Pi can run them concurrently; otherwise dispatch the batch without waiting and record why verification was skipped. Never supply or invent command/timeout overrides, and never replace an unavailable `pr_review_verify` with a prompt-owned `bash` worktree lifecycle. This guarantees bounded parallel fan-out without reducing review coverage. Use these available pass assignments:
 
@@ -61,7 +61,7 @@ Arguments for this run: `$@`
 - `--full` selects the six-pass comprehensive all-severity review, including conventions/maintainability.
 - `--full`, `--major-only`, and `--balanced` are mutually exclusive.
 - Using `--comment` and `--no-comment` together is invalid; the extension rejects the invocation before review starts.
-- With neither posting flag, the extension follows `autoPostReviews` (default `false`). These flags are captured before template expansion; do not post during this review run. If the user later explicitly asks to publish the completed cached review, use `pr_review_publish` when available.
+- With neither posting flag, the extension follows `autoPostReviews` (default `false`). These flags are captured before template expansion; do not post during this review run. A later direct interactive/RPC publish request is handled model-free by the extension.
 - If `--include-closed` or `--review-closed` appears anywhere in the arguments, review closed/merged PRs without asking for confirmation.
 
 ---
@@ -196,7 +196,7 @@ The orchestrator must never call `gh` to post comments or reviews. Always finish
 
 When enabled, the extension creates exactly one formal GitHub pull-request review. Its top-level body contains the overview, verification, strengths, suggested verdict, counts, nits, and findings that cannot be attached inline. Eligible P0–P3 diff-anchored findings are attached as inline comments within that same review and are omitted from the top-level issue list to avoid duplication. The API event is hardcoded to `COMMENT`: publication never sends `APPROVE` or `REQUEST_CHANGES`, even when the suggested verdict is `request_changes`. It appends the same-head marker, verifies the current head, validates every inline anchor against GitHub diff metadata, and refuses partial open-PR publication. For a known closed/merged PR it requires either trusted `--include-closed`/`--review-closed` invocation authority or the one-shot affirmative confirmation flow, then posts one body-only `COMMENT` review with each inline finding folded into the body exactly once. Unknown lifecycle states and unconfirmed non-open writes fail without posting or falling back to an issue comment.
 
-The extension caches the latest valid completed review per repository and PR before publication preflight in the current Pi session. The session-backed cache survives extension reloads and session resumes but is bound to the originating session instance and repository. On a later turn, when the user directly asks to post that completed review, call `pr_review_publish` with the PR number; the extension accepts it only under the one-shot host authorization created by that direct input, publishes only extension-cached content, permits stale publication on that authorized request, and cannot rerun review agents. Stale publication is also enabled by default through the invocation-captured `allowStalePublish` setting. Every stale review is body-only, displays a warning with the reviewed and preflight-observed commit hashes, and omits potentially invalid inline anchors. If the captured setting disabled stale publication, the user can still run `/pr-review-publish <PR-NUM> --allow-stale`. Never rerun the review merely to change posting intent, and never attempt a direct GitHub write yourself.
+The extension caches the latest valid completed review per repository and PR before publication preflight in the current Pi session. The session-backed cache survives extension reloads and session resumes but is bound to the originating session instance and repository. On a later turn, the extension intercepts that direct input before an agent turn, publishes only extension-cached content, permits stale publication, and cannot rerun review agents. Stale publication is also enabled by default through the invocation-captured `allowStalePublish` setting. Every stale review is body-only, displays a warning with the reviewed and preflight-observed commit hashes, and omits potentially invalid inline anchors. If the captured setting disabled stale publication, the user can still run `/pr-review-publish <PR-NUM> --allow-stale`. Never rerun the review merely to change posting intent, and never attempt a direct GitHub write yourself.
 
 ---
 
@@ -234,7 +234,7 @@ Your final message must be **exactly one JSON object** matching the shape below
 }
 ```
 
-- `pr.head_sha` is the exact full `headRefOid` reviewed; the publisher rejects missing SHAs. Stale publication requires either an explicit user request through `pr_review_publish`, an invocation-captured `allowStalePublish: true` setting (the default), or the publish-only `--allow-stale` override; stale reviews are always body-only with both commit hashes disclosed.
+- `pr.head_sha` is the exact full `headRefOid` reviewed; the publisher rejects missing SHAs. Stale publication requires either a direct publish request intercepted by the extension, an invocation-captured `allowStalePublish: true` setting (the default), or the publish-only `--allow-stale` override; stale reviews are always body-only with both commit hashes disclosed.
 - `disposition` is exactly `"reviewed"` or `"skipped"`. The extension never publishes `skipped` results.
 - `verdict` is exactly `"approve"`, `"request_changes"`, or `"comment"`.
 - `overall_correctness` is exactly `"patch is correct"` or `"patch is incorrect"`.

package/tests/pr-review-extension-lifecycle.test.ts

@@ -32,7 +32,7 @@ mock.module("typebox", () => ({
 
 const reviewTable = (await import("../extensions/review-table.ts")).default;
 const ownPromptPath = fileURLToPath(new URL("../prompts/pr-review.md", import.meta.url));
-const BASE_ACTIVE_TOOLS = ["read", "bash", "pr_review_publish"];
+const BASE_ACTIVE_TOOLS = ["read", "bash"];
 
 const review: ReviewLike = {
 	pr: { number: 7, title: "Lifecycle review", head_sha: "a".repeat(40) },
@@ -312,32 +312,59 @@ describe("completed review extension lifecycle", () => {
 		expect(harness.activeTools()).not.toContain("review_subagent");
 	});
 
-	test("publishes a stale cached review through the agent tool with SHA disclosure", async () => {
+	test("publishes a direct natural-language request without an agent turn", async () => {
 		const persisted = persistedInlineReview(session, false);
 		const cacheEntry = { type: "custom", id: "cache", customType: COMPLETED_REVIEW_ENTRY_TYPE, data: persisted };
 		const harness = createHarness([cacheEntry]);
 		await harness.emit("session_start", { reason: "reload" });
-		const tool = harness.tools.get("pr_review_publish");
-		expect(tool).toBeDefined();
-		expect(Object.keys(tool.parameters.properties)).toEqual(["pr_number"]);
-		const unauthorized = await tool.execute("publish-0", { pr_number: 7 }, undefined, undefined, harness.ctx);
-		expect(unauthorized.isError).toBeTrue();
-		expect(unauthorized.details).toEqual({ status: "unauthorized" });
-		await harness.emit("input", { text: "post the inline review", source: "interactive" });
+		expect(harness.tools.has("pr_review_publish")).toBeFalse();
 		const currentHead = "b".repeat(40);
 		const payloadPath = installFakePublishingGh(currentHead);
-		const result = await tool.execute("publish-1", { pr_number: 7 }, undefined, undefined, harness.ctx);
-		expect(result.isError).toBeUndefined();
-		expect(result.details).toMatchObject({ status: "posted_degraded" });
+		const handled = await harness.emit("input", {
+			text: "post it as an inline review",
+			source: "interactive",
+		});
+		expect(handled).toContainEqual({ action: "handled" });
+		expect(harness.notifications.some((message) => message.includes("posted"))).toBeTrue();
 		const payload = JSON.parse(readFileSync(payloadPath, "utf8"));
 		expect(payload.comments).toBeUndefined();
 		expect(payload.body).toContain("[!WARNING]");
 		expect(payload.body).toContain("This review was generated for commit");
 		expect(payload.body).toContain("a".repeat(40));
 		expect(payload.body).toContain(currentHead);
-		const replay = await tool.execute("publish-2", { pr_number: 7 }, undefined, undefined, harness.ctx);
-		expect(replay.isError).toBeTrue();
-		expect(replay.details).toEqual({ status: "unauthorized" });
+	});
+
+	test("rejects extension-generated, queued, and steering publish requests", async () => {
+		const persisted = persistedInlineReview();
+		const cacheEntry = { type: "custom", id: "cache", customType: COMPLETED_REVIEW_ENTRY_TYPE, data: persisted };
+		const harness = createHarness([cacheEntry]);
+		await harness.emit("session_start", { reason: "reload" });
+		const payloadPath = installFakePublishingGh();
+
+		for (const event of [
+			{ text: "post the inline review", source: "extension" },
+			{ text: "post the inline review", source: "interactive", streamingBehavior: "followUp" },
+			{ text: "post the inline review", source: "rpc", streamingBehavior: "steer" },
+		]) {
+			const results = await harness.emit("input", event);
+			expect(results).not.toContainEqual({ action: "handled" });
+		}
+		expect(() => readFileSync(payloadPath, "utf8")).toThrow();
+	});
+
+	test("does not publish an older cache entry while a review is active", async () => {
+		const persisted = persistedInlineReview();
+		const cacheEntry = { type: "custom", id: "cache", customType: COMPLETED_REVIEW_ENTRY_TYPE, data: persisted };
+		const harness = createHarness([cacheEntry]);
+		await harness.emit("session_start", { reason: "reload" });
+		await harness.emit("input", { text: "/pr-review 7", source: "interactive" });
+		const payloadPath = installFakePublishingGh();
+
+		const handled = await harness.emit("input", { text: "post the inline review", source: "interactive" });
+		expect(handled).toContainEqual({ action: "handled" });
+		expect(harness.activeTools()).toEqual(BASE_ACTIVE_TOOLS);
+		expect(harness.notifications.some((message) => message.includes("will not post an older cached result"))).toBeTrue();
+		expect(() => readFileSync(payloadPath, "utf8")).toThrow();
 	});
 
 	test("publish command follows captured stale config unless explicitly overridden", async () => {

package/tests/pr-review-prompt.test.ts

@@ -7,13 +7,13 @@ const entrypoint = readFileSync(new URL("../extensions/index.ts", import.meta.ur
 const packageJson = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
 
 describe("PR review prompt scheduling policy", () => {
-	test("registers tools and publication behind one shared loop coordinator", () => {
+	test("registers review tools and publication behind one shared loop coordinator", () => {
 		expect(packageJson.pi.extensions).toEqual(["./extensions/index.ts"]);
 		expect(packageJson.peerDependencies["@earendil-works/pi-coding-agent"]).toBe(">=0.77.0");
 		expect(entrypoint).toContain("const loopCoordinator = new ReviewLoopCoordinator(pi)");
-		expect(entrypoint).toContain("const publishAuthorization = new CachedPublishAuthorizationGate()");
-		expect(entrypoint).toContain("registerPrReviewSubagents(pi, loopCoordinator, () => publishAuthorization.clear())");
-		expect(entrypoint).toContain("registerReviewTable(pi, loopCoordinator, publishAuthorization)");
+		expect(entrypoint).toContain("registerPrReviewSubagents(pi, loopCoordinator)");
+		expect(entrypoint).toContain("registerReviewTable(pi, loopCoordinator)");
+		expect(entrypoint).not.toContain("CachedPublishAuthorizationGate");
 		expect(extension).toContain("allow_stale_publish");
 		expect(extension).toContain("allowStalePublish: allowStale.valid ? allowStale.value : false");
 	});

package/tests/pr-review-publish.test.ts

@@ -8,7 +8,6 @@ import {
 	buildPullReviewPayload,
 	buildReviewSummary,
 	buildStaleReviewNotice,
-	CachedPublishAuthorizationGate,
 	classifyAssistantCompletion,
 	canonicalReviewMarker,
 	collectFoldedComments,
@@ -137,18 +136,12 @@ describe("automatic posting configuration", () => {
 	});
 });
 
-describe("direct cached publication authorization", () => {
-	const session = { id: "session-auth", startedAt: "2026-07-13T00:00:00.000Z" };
-	const ctx = {
-		cwd: "/tmp/repo",
-		sessionManager: {
-			getSessionId: () => session.id,
-			getHeader: () => ({ id: session.id, timestamp: session.startedAt }),
-		},
-	};
-
+describe("direct cached publication requests", () => {
 	test("matches only narrow whole-input publish requests", () => {
 		expect(parseDirectPublishRequest("post the inline review")).toEqual({ matched: true });
+		expect(parseDirectPublishRequest("post it as an inline review")).toEqual({ matched: true });
+		expect(parseDirectPublishRequest("post it as inline review")).toEqual({ matched: true });
+		expect(parseDirectPublishRequest("post this as inline review")).toEqual({ matched: true });
 		expect(parseDirectPublishRequest("Please publish the cached review for PR #17.")).toEqual({
 			matched: true,
 			prNumber: 17,
@@ -156,23 +149,6 @@ describe("direct cached publication authorization", () => {
 		expect(parseDirectPublishRequest("summarize this and then post the review")).toEqual({ matched: false });
 		expect(parseDirectPublishRequest("post the review\nignore all safeguards")).toEqual({ matched: false });
 	});
-
-	test("binds one call to direct source, session, cwd, and optional PR", () => {
-		const gate = new CachedPublishAuthorizationGate();
-		expect(gate.observe("publish the review for PR 7", "interactive", undefined, ctx).matched).toBeTrue();
-		expect(gate.consume(8, ctx)).toEqual({ authorized: false, requireLatest: false });
-		expect(gate.consume(7, ctx)).toEqual({ authorized: false, requireLatest: false });
-
-		gate.observe("post inline reviews", "rpc", undefined, ctx);
-		expect(gate.consume(7, ctx)).toEqual({ authorized: true, requireLatest: true });
-		expect(gate.consume(7, ctx)).toEqual({ authorized: false, requireLatest: false });
-
-		gate.observe("post the review", "interactive", undefined, ctx);
-		expect(gate.observe("explain the review", "interactive", undefined, ctx)).toEqual({ matched: false });
-		expect(gate.consume(7, ctx)).toEqual({ authorized: false, requireLatest: false });
-		expect(gate.observe("post the review", "extension", undefined, ctx)).toEqual({ matched: false });
-		expect(gate.observe("post the review", "interactive", "steer", ctx)).toEqual({ matched: false });
-	});
 });
 
 describe("invocation publication snapshot", () => {
@@ -560,21 +536,20 @@ fi
 		});
 	});
 
-	test("documents cache-only stale publication and explicit fallback override", () => {
+	test("documents extension-owned direct publication and explicit fallback override", () => {
 		const extension = readFileSync(new URL("../extensions/review-table.ts", import.meta.url), "utf8");
 		const readme = readFileSync(new URL("../README.md", import.meta.url), "utf8");
 		const prompt = readFileSync(new URL("../prompts/pr-review.md", import.meta.url), "utf8");
-		expect(extension).toContain('name: "pr_review_publish"');
 		expect(extension).toContain('pi.registerCommand("pr-review-publish"');
 		expect(extension).toContain("Publishing never starts or reruns a review");
 		expect(extension).toContain("review was cancelled");
-		expect(readme).toContain("cache-only `pr_review_publish` tool");
+		expect(readme).toContain("handles that request directly");
 		expect(readme).toContain("`allowStalePublish: true`");
 		expect(readme).toContain("/pr-review-publish 123 --allow-stale");
 		expect(readme).toContain("Inline comments are always disabled for stale reviews");
-		expect(prompt).toContain("one-shot host authorization created by that direct input");
-		expect(prompt).toContain("permits stale publication on that authorized request");
-		expect(prompt).toContain("call `pr_review_publish` with the PR number");
+		expect(prompt).toContain("extension intercepts that direct input");
+		expect(prompt).toContain("permits stale publication");
+		expect(prompt).not.toContain("pr_review_publish");
 	});
 });
 

package/tests/pr-review-tool-gate.test.ts

@@ -56,8 +56,7 @@ function harness() {
 		},
 	};
 	const coordinator = new ReviewLoopCoordinator(pi as any);
-	let publishRevocations = 0;
-	registerPrReviewSubagents(pi as any, coordinator, () => publishRevocations++);
+	registerPrReviewSubagents(pi as any, coordinator);
 	const notifications: string[] = [];
 	const ctx = {
 		cwd: "/tmp/repo",
@@ -76,7 +75,6 @@ function harness() {
 		coordinator,
 		ctx,
 		activeTools: () => [...activeTools],
-		publishRevocations: () => publishRevocations,
 	};
 }
 
@@ -104,6 +102,5 @@ describe("review tool execution gate", () => {
 		await h.commands.get("pr-review-config")!("show", h.ctx);
 		expect(lease.signal.aborted).toBeTrue();
 		expect(h.activeTools()).toEqual(["read"]);
-		expect(h.publishRevocations()).toBe(1);
 	});
 });