The wrapper honors superseded and claim markers whoever wrote the comment #55

Open
opened 2026-10-06 05:35:53 +00:00 by jercik · 0 comments
Owner

Anyone who can comment on a pull request can start a reply with one of the wrapper's hidden markers and steer what the wrapper writes next: it posts duplicate findings, and it resolves a person's thread.

What happens

The wrapper finds its own threads by an HTML comment at the start of a comment body. It checks the position of the marker and never the author. The file says so (src/reconcile/conversation-markers.ts:11-12), and PullReviewComment has no author field to check (src/forge/types.ts:13-24). The summary comment is different: it is adopted only when the Actions user wrote it (src/reconcile/summary.ts:20-31).

#20 made a marker count only at the start of a comment, so a quoted marker is text. That fixed position and left authorship open. #24 (third bullet) rewords the code comment that admits the author is not checked, and does not change the behavior.

Two effects, both reproduced at 9f272a52 with the committed bundle on Node 24.21.0 against a stand-in forge where a second account replies in a thread:

What it should do instead

Add the comment author to PullReviewComment and count a marker only in a comment written by the Actions user, the same identity check summary.ts already makes. Treat a thread as the wrapper's only when its first comment passes that check. A person's thread then stays untouched whatever a reply says.

Why it matters

The writes stay comments and resolutions, so the wrapper does not gain a new kind of write. But a commenter (on a public repository, anyone with an account) decides when the bot posts a duplicate finding and when it resolves a person's thread. The README already admits that the summary check cannot tell the wrapper from other Actions tasks sharing the identity. An author check would share that limit and would still close the gap for ordinary commenters.

🤖 Generated with Claude Code

Anyone who can comment on a pull request can start a reply with one of the wrapper's hidden markers and steer what the wrapper writes next: it posts duplicate findings, and it resolves a person's thread. ## What happens The wrapper finds its own threads by an HTML comment at the start of a comment body. It checks the position of the marker and never the author. The file says so ([`src/reconcile/conversation-markers.ts:11-12`](https://code.j4k.dev/j4k-oss/review-wrapper/src/commit/9f272a522e8ed6f748533761de45ee3e94fd7481/src/reconcile/conversation-markers.ts#L11-L12)), and `PullReviewComment` has no author field to check ([`src/forge/types.ts:13-24`](https://code.j4k.dev/j4k-oss/review-wrapper/src/commit/9f272a522e8ed6f748533761de45ee3e94fd7481/src/forge/types.ts#L13-L24)). The summary comment is different: it is adopted only when the Actions user wrote it ([`src/reconcile/summary.ts:20-31`](https://code.j4k.dev/j4k-oss/review-wrapper/src/commit/9f272a522e8ed6f748533761de45ee3e94fd7481/src/reconcile/summary.ts#L20-L31)). #20 made a marker count only at the start of a comment, so a quoted marker is text. That fixed position and left authorship open. #24 (third bullet) rewords the code comment that admits the author is not checked, and does not change the behavior. Two effects, both reproduced at `9f272a52` with the committed bundle on Node 24.21.0 against a stand-in forge where a second account replies in a thread: - **A superseded marker removes a finding from the posted set** (`d10-supmark-outsider`). `isSuperseded` scans every comment of a thread ([`src/reconcile/conversation-markers.ts:39-41`](https://code.j4k.dev/j4k-oss/review-wrapper/src/commit/9f272a522e8ed6f748533761de45ee3e94fd7481/src/reconcile/conversation-markers.ts#L39-L41)). A thread with that marker no longer counts as posted ([`src/reconcile/inline.ts:38-41`](https://code.j4k.dev/j4k-oss/review-wrapper/src/commit/9f272a522e8ed6f748533761de45ee3e94fd7481/src/reconcile/inline.ts#L38-L41)) and gets no more disposition updates ([`src/reconcile/dispositions.ts:177-181`](https://code.j4k.dev/j4k-oss/review-wrapper/src/commit/9f272a522e8ed6f748533761de45ee3e94fd7481/src/reconcile/dispositions.ts#L177-L181)). The next run posts the finding again as a new thread, and the original thread stops following the claim. - **A claim marker makes the wrapper adopt and close a person's thread** (`d11-human-thread-claim-marker`). `claimIdsOf` accepts a claim marker from any comment in the thread ([`src/reconcile/conversation-markers.ts:24-33`](https://code.j4k.dev/j4k-oss/review-wrapper/src/commit/9f272a522e8ed6f748533761de45ee3e94fd7481/src/reconcile/conversation-markers.ts#L24-L33)). In a thread a person opened, a reply that starts with a claim marker for a claim the current review does not have makes the wrapper post "superseded by review …" and then resolve the thread ([`src/reconcile/dispositions.ts:168-176`](https://code.j4k.dev/j4k-oss/review-wrapper/src/commit/9f272a522e8ed6f748533761de45ee3e94fd7481/src/reconcile/dispositions.ts#L168-L176), [`src/reconcile/dispositions.ts:134-154`](https://code.j4k.dev/j4k-oss/review-wrapper/src/commit/9f272a522e8ed6f748533761de45ee3e94fd7481/src/reconcile/dispositions.ts#L134-L154)). ## What it should do instead Add the comment author to `PullReviewComment` and count a marker only in a comment written by the Actions user, the same identity check `summary.ts` already makes. Treat a thread as the wrapper's only when its first comment passes that check. A person's thread then stays untouched whatever a reply says. ## Why it matters The writes stay comments and resolutions, so the wrapper does not gain a new kind of write. But a commenter (on a public repository, anyone with an account) decides when the bot posts a duplicate finding and when it resolves a person's thread. The README already admits that the summary check cannot tell the wrapper from other Actions tasks sharing the identity. An author check would share that limit and would still close the gap for ordinary commenters. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
Sign in to join this conversation.
No labels
No milestone
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
j4k-oss/review-wrapper#55
No description provided.