You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Implements PRO-547: the CLI now works with a PR's GitHub review live instead of keeping a local mirror, surfacing three clearly-labeled comment states — Local (CLI-only, offline), Pending (your unsubmitted GitHub review draft, only you see it), and Submitted (published) — faithful to GitHub's own review model.
Changes
Added a live GitHub review layer over gh api graphql (github/review.ts): one paginated query loads pending + submitted threads, plus mutations to create/reply/edit/delete pending comments, submit a review (Comment / Approve / Request changes), discard it, and resolve/reopen threads.
Added a merged read model + routes (runs/review.ts, routes/review.ts, GET /api/runs/:id/review) that combine local DB threads with the PR's live GitHub threads, degrading to local-only when gh is offline or the run isn't a PR.
Rebuilt the comment UI (vendored from hosted Stage): per-state badges, a review tray (submit popover with a pending-comments list, own-PR guard, Cmd⏎), and "Comment on the PR" / "Start a review" composer toggles; GitHub comments link to their permalink and render GitHub's server HTML.
Local comments stay CLI-only and work offline; no GitHub state is mirrored, so there is no DB schema change.
Testing
pnpm typecheck, pnpm lint, pnpm test (385 tests, including new route-integration tests for the review API against a faked gh), and pnpm build all pass. Not yet exercised against a live PR.
Summary by cubic
Bidirectional comment sync between the CLI and GitHub PR reviews for PRO‑547. The CLI now merges local and live review state, keeps them in sync after writes, and adds strong guardrails, PR‑scoped cross‑process locks, and origin‑bound recovery so comments don’t get lost or mis‑anchored.
New Features
Live GitHub review via gh api graphql (paginated read; add/reply/edit/delete pending; submit/discard; resolve/reopen). Uses separate deadlines for reads (ghReadOrThrow) and writes (ghWriteOrThrow), refreshes PR/review after writes, shows comments on closed PRs but blocks writes, gates on the run’s diff matching the PR head, and rejects cross‑origin reads of private draft content.
Merged endpoint GET /api/runs/:runId/review: overlays local threads on GitHub; falls back to local‑only when gh is unavailable, the PR is unresolvable, the run isn’t a PR, or the run’s diff isn’t at the PR head. Preserves “GitHub unavailable” states and enforces same‑origin for private draft content and local bodies.
Guardrails, locks, and recovery: require a clean working tree, committed scope, and matching PR head; reject empty “Comment” reviews and require a summary for “Request changes”; count anchorless pending drafts so valid reviews aren’t rejected as empty; preserve pending drafts across edits/failures; resume interrupted promotions using stored GitHub IDs and reply counts bound to the same origin repo/PR; sequence updates and serialize actions across clones/worktrees with PR‑scoped locks via proper-lockfile; tolerant read‑path git errors; scoped PR‑query invalidation; hardened state transitions.
Rebuilt UI: badges for Local/Pending/Submitted; review panel with a pending list and submit flow (own‑PR guard); “Comment on the PR” / “Start a review” toggles with remembered choice and clear destinations; GitHub threads render authors and server HTML with permalinks; preserves unposted replies; suggestion tool when on a PR.
Types: @stagereview/types adds review models that encode review source invariants.
Migration
DB: add repoRoot to comment_thread with index (repoRoot, scopeKey); backfill where unique; add promotionThreadNodeId, promotionRootCommentNodeId, promotionReplyCount to safely resume promotions; replaces comment_thread_scope_key_idx.
Routes: local resolve/reopen moved to PATCH /api/comment-threads/:threadId; new review routes under /api/runs/:runId/review.
Web: replace comment threads context/hooks with ReviewProvider and useReview; remove legacy components.
Written for commit d8cd3a4. Summary will update on new commits.
Pull existing PR review comments into the local/merged review view (load pending + submitted GitHub threads and merge with local threads).
New GitHub read layer, merged read model, and a review route are added; the UI switches to the new ReviewProvider. These changes show the PR fetches and surfaces pending/submitted GitHub threads alongside local threads.
✅
Push locally-authored comments back to the PR (create/reply/edit/delete pending comments, submit or discard a review).
The diff adds write mutations and server handlers for creating/replying/editing/deleting pending comments and submitting/discarding reviews, plus UI for drafting/submitting reviews — indicating the PR implements push paths to GitHub.
✅
Guardrails before pushing: ensure the working tree is clean and the local state matches the PR head (prevent mis-anchored/stale pushes, only push committed-scope comments).
New git helper functions to read HEAD SHA and check working-tree cleanliness are added, and the runs/review layer and summary mention scope-key/commit-scope checks and push guardrails, indicating these safety checks are implemented server-side before writes to GitHub.
⚠️
Surface a clear result of what was pushed / skipped / failed to the user.
The code adds a ReviewResponse model and routing plus UI feedback (toasts, submit popover), suggesting structured results are produced and surfaced. The diff provides some evidence but the exact shape and completeness of a per-comment pushed/skipped/failed report is not fully verifiable from the shown diffs (and the PR hasn’t been exercised against a live PR).
✅
Mirror and sync thread resolution state (resolve/reopen threads mirrored between CLI and GitHub).
Resolve/reopen flows are routed and wired into the GitHub review layer and the merged run review API, indicating thread resolution is synced.
Tip: cubic can generate docs of your entire codebase and keep them up to date. Try it here.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: high. Left a non-blocking comment (not approved): Cursor Bugbot found 2 unresolved medium-severity issues, review comments remain open, and this GitHub review sync change exceeds the medium approval threshold. Assigned reviewers charleslpan and onequbitaway for human review.
Sent by Cursor Approval Agent: Pull Request Router and Approver
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: high. Left a non-blocking comment (not approved): Cursor Bugbot found 2 unresolved medium-severity issues, review comments remain open, and this GitHub review sync change exceeds the medium approval threshold. Assigned reviewer charleslpan for human review.
Sent by Cursor Approval Agent: Pull Request Router and Approver
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: high. Left a non-blocking comment — not approving because Cursor Bugbot completed as skipped, two Bugbot findings remain unresolved, and this bidirectional GitHub sync + migration work is above the medium approval threshold. Human review is needed; assigning reviewers.
Sent by Cursor Approval Agent: Pull Request Router and Approver
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: high. Left a non-blocking comment (not approved): Cursor Bugbot completed as skipped with unresolved findings, open review comments remain, and this GitHub comment-sync change exceeds the medium approval threshold. Assigned an additional reviewer; charleslpan remains requested.
Sent by Cursor Approval Agent: Pull Request Router and Approver
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: high. Left a non-blocking comment (not approved): Cursor Bugbot completed as skipped with unresolved findings, open review comments remain, and this GitHub comment-sync change exceeds the medium approval threshold. Human review is needed; charleslpan remains requested.
Sent by Cursor Approval Agent: Pull Request Router and Approver
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: high. Left a non-blocking comment (not approved): Cursor Bugbot completed as skipped with an unresolved high-severity finding, Security Agent passed, and this GitHub comment-sync + migration work exceeds the medium approval threshold. Assigned an additional reviewer; charleslpan remains requested.
Sent by Cursor Approval Agent: Pull Request Router and Approver
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: high. Left a non-blocking comment (not approved): Cursor Bugbot completed as skipped with an unresolved high-severity finding, Security Agent passed, and this GitHub comment-sync + migration work exceeds the medium approval threshold. Human review is needed; charleslpan remains requested.
Sent by Cursor Approval Agent: Pull Request Router and Approver
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: high. Left a non-blocking comment (not approved): Cursor Bugbot completed as skipped with two unresolved findings, Security Agent passed, and open review comments remain on this high-risk GitHub comment-sync change. Assigned an additional reviewer; charleslpan was already requested.
Sent by Cursor Approval Agent: Pull Request Router and Approver
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: high. Left a non-blocking comment (not approved): Cursor Bugbot completed as skipped with two unresolved findings, Security Agent passed, and open review comments remain on this high-risk GitHub comment-sync change. Human review is needed; charleslpan was already requested.
Sent by Cursor Approval Agent: Pull Request Router and Approver
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Risk: high. Left a non-blocking comment (not approved): Cursor Bugbot completed as skipped with an unresolved finding, Security Agent passed, and this GitHub comment-sync + migration work exceeds the medium approval threshold. Assigned an additional reviewer; charleslpan remains requested.
Sent by Cursor Approval Agent: Pull Request Router and Approver
The reason will be displayed to describe this comment to others. Learn more.
Risk: high. Left a non-blocking comment (not approved): Cursor Bugbot completed as skipped, Security Agent passed, and this GitHub comment-sync + migration work exceeds the medium approval threshold. Assigned an additional reviewer; charleslpan remains requested.
Sent by Cursor Approval Agent: Pull Request Router and Approver
The reason will be displayed to describe this comment to others. Learn more.
Risk: high. Left a non-blocking comment (not approved): Cursor Bugbot completed as skipped, Security Agent passed, and this GitHub comment-sync + migration work exceeds the medium approval threshold. Human review is needed; charleslpan remains requested.
Sent by Cursor Approval Agent: Pull Request Router and Approver
The reason will be displayed to describe this comment to others. Learn more.
Bind promotion checkpoints to their pull request
When the same diff scope is associated with two PRs, an interrupted promotion started through PR A can be retried through a run targeting PR B. Because the persisted checkpoint contains only remote node IDs, this lookup searches B, treats the missing A thread as manual deletion, clears the checkpoint, and reposts the local thread to B while the original remains on A. Persist the repository and PR identity with the checkpoint and reject or resume recovery only against that target.
The reason will be displayed to describe this comment to others. Learn more.
Honor GitHub's per-thread resolve permission
On an open, matching PR, a reviewer who neither authored the PR nor has repository write access can still get canWriteToGitHub: true, so this enables the resolve/reopen control even though GitHub denies that thread mutation. The click then reaches the server and surfaces as a 500. Load GitHub's per-thread resolve/unresolve capability and use it both to gate the UI and validate the route.
The reason will be displayed to describe this comment to others. Learn more.
Hide the GitHub destination for lines outside the diff
When a file is expanded to show unchanged regions between hunks, Pierre still exposes the comment gutter on those lines, and this initializes every draft from the run-wide canPushToReview flag. The composer therefore offers and defaults to a pending GitHub comment even though GitHub cannot anchor a line review comment outside the PR diff, so submission fails after the user has written it; local threads created there also later offer an unusable promotion action. Determine GitHub eligibility from the selected anchor's actual hunk as well as the global review state.
The reason will be displayed to describe this comment to others. Learn more.
Hide suggested changes from reply composers
Every GitHub destination enables the suggestion toolbar, including the reply forms in ReviewThreadView. A reply does not carry its own diff-line anchor, so a suggestion block inserted there cannot be applied as a GitHub suggested change and is rendered as misleading comment content instead. Pass suggestion eligibility separately from destination type and enable it only for a new line-anchored root comment.
Useful? React with 👍 / 👎.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
Summary
Implements PRO-547: the CLI now works with a PR's GitHub review live instead of keeping a local mirror, surfacing three clearly-labeled comment states — Local (CLI-only, offline), Pending (your unsubmitted GitHub review draft, only you see it), and Submitted (published) — faithful to GitHub's own review model.
Changes
gh api graphql(github/review.ts): one paginated query loads pending + submitted threads, plus mutations to create/reply/edit/delete pending comments, submit a review (Comment / Approve / Request changes), discard it, and resolve/reopen threads.runs/review.ts,routes/review.ts,GET /api/runs/:id/review) that combine local DB threads with the PR's live GitHub threads, degrading to local-only whenghis offline or the run isn't a PR.Testing
pnpm typecheck,pnpm lint,pnpm test(385 tests, including new route-integration tests for the review API against a fakedgh), andpnpm buildall pass. Not yet exercised against a live PR.Summary by cubic
Bidirectional comment sync between the CLI and GitHub PR reviews for PRO‑547. The CLI now merges local and live review state, keeps them in sync after writes, and adds strong guardrails, PR‑scoped cross‑process locks, and origin‑bound recovery so comments don’t get lost or mis‑anchored.
New Features
gh api graphql(paginated read; add/reply/edit/delete pending; submit/discard; resolve/reopen). Uses separate deadlines for reads (ghReadOrThrow) and writes (ghWriteOrThrow), refreshes PR/review after writes, shows comments on closed PRs but blocks writes, gates on the run’s diff matching the PR head, and rejects cross‑origin reads of private draft content.GET /api/runs/:runId/review: overlays local threads on GitHub; falls back to local‑only whenghis unavailable, the PR is unresolvable, the run isn’t a PR, or the run’s diff isn’t at the PR head. Preserves “GitHub unavailable” states and enforces same‑origin for private draft content and local bodies.proper-lockfile; tolerant read‑pathgiterrors; scoped PR‑query invalidation; hardened state transitions.@stagereview/typesaddsreviewmodels that encode review source invariants.Migration
repoRoottocomment_threadwith index(repoRoot, scopeKey); backfill where unique; addpromotionThreadNodeId,promotionRootCommentNodeId,promotionReplyCountto safely resume promotions; replacescomment_thread_scope_key_idx.PATCH /api/comment-threads/:threadId; new review routes under/api/runs/:runId/review.ReviewProvideranduseReview; remove legacy components.Written for commit d8cd3a4. Summary will update on new commits.