Skip to content

MendCode Nightly — 2026-10-31 · Build 11

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 31 Oct 21:57
· 29 commits to main since this release
v0.0.2-nightly.20261031.11
2065a35

v0.0.2-nightly.20261031.11 · Nightly · since v0.0.2-nightly.20261030.8 · built from 2065a35d4eb2

MendCode signs in to ChatGPT for itself with OpenAI's Sign in with ChatGPT, keeps its own list of the models your account can use,
and Claude models on a new install run in the Claude Code you already have signed in; the setup no longer leaves you at a prompt with
no model, and the pull request reviewer keeps working when the daemon starts with a short PATH.

New

  • PR review: .mendcode/review.yaml can start from a preset (preset: balanced | quiet | strict | on-request | autofix); the file's own keys go over it, and no preset turns posting on, adds checks, widens who may post or pushes.
  • PR review: budget.tokens_per_pr: null means no internal cap, and budget.context_tokens bounds what one call carries (200,000 when unset), apart from the PR's total.
  • PR review: /reviews (or /pr dashboard) opens a page of review jobs, reviewers and watches. From it you can pause, resume, cancel or retry a job (a retry needs a reason), take a job over and release it, and show a job's config.
  • PR review platform: - A review stopped by its token budget, a quota or a rate limit keeps what it found and is resumed without a second review pass: on retry, or after the quota reset with on_quota: wait. - mode and filters decide which PRs are reviewed; /pr list shows the reason for each PR not taken. - .mendcode/reviewers.yaml routes PRs to the global reviewer and to personal reviewers. A personal reviewer whose MendCode runs elsewhere waits with its reason, and its own daemon reviews the PR when it starts. Device claims on the PR are best-effort, not compare-and-swap. - Personal profiles can only narrow the repository's config. The config actions and the review_config tool always need a scope. - Review memory follows the reviewer's scope. - fix.mode fix-once and fix-loop push only with fix.push and /pr publish on; otherwise the fix is kept on a local ref. - Stages are planned for each run, and a stacked PR is reviewed on its own commits. - Token accounting is kept per PR head. - An audit of the whole checkout stays in the session; it is a pr.review action, with no slash command. - GitLab (through glab) and Gitea / Forgejo (GITEA_TOKEN) are supported: the daemon watches, posts reviews, answers @mendcode and pushes fixes through their adapters. This ran live against local GitLab CE 19.5.3 and Gitea 28.2.0. They have no check follow-ups and no hosted runner, and Gitea has no thread resolution (providers). - template.language (default English, set by the repository only) is the language of every review, verify, fix and @mendcode explain reply, on every engine. Your own harness language setting no longer reaches a public review. With auto, a PR is reviewed in its author's language, judged once from the PR's title and description and kept for the PR. A short, empty, mixed or unclear text is English. - Open PRs when a watch starts: when a watch starts, after a daemon restart and after a pause or outage, open PRs whose head has no review yet are reviewed, newest first. That is at most backlog.max_prs (10), updated within backlog.window_days (30), and /pr watch-repo lists what it queued and what it skipped. max_prs: 0 keeps the old baseline. - Set up PR review with your session: review_config setup reports what exists, the signals of your role, what is missing and the questions to ask. It is read-only. - The pr_review tool reviews a PR now from a session (review asks your approval outside full access, and status lists the jobs). It posts only as /pr publish allows, and a session never posts @mendcode from your account to start a review. - .mendcode/reviewers.yaml capabilities review, fix and publish are enforced, and a reviewer without the list has all three. A requested watch also takes PRs that area or label routing gives its login's personal reviewer. - Logins in reviewers.yaml and in review.yaml's reviewers and publishers follow the checkout's forge, so GitLab and Gitea usernames with _ or . can be listed. - A diff too large for one call is reviewed in parts of whole files (at most 12), and their candidates go to one verify pass. - A team setup guide covers the hosted workflow, an always-on server with personal reviewers on laptops, what happens while a laptop is off or asleep, and troubleshooting (team setup).
  • grep takes context (0 to 5): the lines around each match come back as path-line-text, with -- between groups, with ripgrep and with the built-in search alike, so one search can replace the read that would follow it. The 500-match cap and the count still read matching lines only.
  • edit takes edits: [{oldString, newString}] (up to 50): several replacements in one file, in order, in one write. The first one that does not match stops the call before anything is written and says which (edit 2 of 3: …); replaceAll covers every replacement of the call. A pasted secret's marker works inside edits as it does in oldString/newString.
  • Mermaid flowcharts with subgraph are laid out like the rest: boxes in layers with straight arrows, each subgraph a frame with its title in the border, nested subgraphs nested frames. Before, every box of such a diagram was stacked in one column with a side channel per connection. A left-to-right one too wide for the chat is drawn top-down instead.

Changed

  • PR review: reviews are durable jobs in pr-review/jobs.json instead of an in-memory queue. A daemon restart finds the queued and running reviews and runs each once; a push during a review marks it stale and it is not posted; a failed review is retried with backoff, at most 5 times. Before, a restart lost every queued review.
  • PR review: the default budget.tokens_per_pr is 1,000,000 (was 200,000), and the review context is bounded by budget.context_tokens instead of half of tokens_per_pr. A review stopped at the cap says it is incomplete.
  • PR review: every posted review carries a reviewer marker, and a post that timed out or got a 5xx is looked up on the PR before anything is sent again, so a slow GitHub answer no longer risks a second review.
  • PR review: native and Claude Code review children load no memory or instruction files of their own; the review prompt carries only the memory the reviewer's scope allows, so your user memories never reach a repository's reviewer. Claude Code review and fix sessions run with --setting-sources user, so a PR's own .claude/ settings and hooks never load. Codex review children get none of the worktree's AGENTS.md, no Codex memories and no skill instructions. Codex review and fix sessions treat the checkout as untrusted, so its .codex/config.toml, hooks and rules never load; a fix session's checkout skills are disabled. Only your own ~/.codex/AGENTS.md still reaches a review child.
  • PR review: the reviewer's notices to the watching session are recorded without starting a model turn (experimental.pr_review_prompts brings the old behaviour back).
  • PR review: a review, verify or fix turn has no fixed time limit. It is stopped as stalled after 10 minutes with no event from the model (a fix session waiting for your approval does not count), with a 2-hour cap. The job keeps its work and retries with backoff. Failure and stop notices name the repository, the PR, the head's first 12 characters, the reason, the next retry time and the attempts left.
  • PR review: a maintainer's @mendcode review on a head that was already reviewed is kept. The reply says the next push will be reviewed, and that head is reviewed even with triggers.synchronize off, also after a restart. Commands are checked in one order: permission, filters, reviewed head. A comment from the daemon's own login runs like /pr review, and what it is refused is said in the session only.
  • PR watch: one watched PR ends only when it is gone or inaccessible for 15 awake minutes. A network outage or sleep never ends it.
  • The daemon drops the Claude Code session variables it inherits when an agent starts it from a Claude Code shell (CLAUDECODE, CLAUDE_CODE_SESSION_ID, …), so a claude it starts no longer takes itself for that session's child. ANTHROPIC_* and your other Claude Code settings are kept (Claude Code).
  • apply_patch also places a hunk whose lines differ from the file only in spaces inside a line, and a context line matched loosely (indentation, trailing or inner spaces) keeps the file's own text: only - and + lines change the file. A hunk of several lines that does not match shows the file around its closest line, numbered, with > on the first line that differs.
  • The tool definitions every request carries are as small as before these additions: the descriptions that only repeated their tool's (read's paths, glob's patterns, apply_patch's patch) were cut (minimalist's first request 5,378 characters, was 5,381).

Fixed

  • PR review: @mendcode review on a head with nothing new no longer answers just "published". The reply names the head, says no new review was posted, and lists the earlier findings it resolved and the ones still open. An explicit review re-checks the open findings, so asking again after a fix closes the threads of the fixed ones, also on a head reviewed before. Where GitHub does not let the account resolve a thread (read access), one reply in it says Fixed in <head> instead of nothing.
  • A notice a Claude Code or other external session did not see (a PR review's result, recorded without a model turn) reaches its next turn whole, up to 3,000 characters, instead of cut after 400.
  • PR review: the pr_review tool no longer asks for approval in a full-access session, and its prompt reads "Review a pull request" instead of "Edit files".
  • PR review: a sleeping laptop or a network outage no longer ends a repo watch. Failing time is counted awake, only a permanent error (a repository gone, access revoked) ends one, and a job that fails on the network spends none of its attempts. Before, 15 minutes asleep ended every watch.
  • PR review: a detached daemon with a repo watch no longer stops itself after 10 idle minutes.
  • PR review: a fix pushed by fix.mode is reviewed by its job once the forge reports the new head. A fix round counts a finding resolved only when that re-check closed it, including a fix that inserts a line next to the flagged one. Before, the fix's head could go unreviewed and its thread stay open.
  • PR review: releasing a taken-over fix job pushes the kept fix and does not count the interrupted round. Before, the job ended failed.
  • PR review: a released claim wakes the other device's waiting job at its next poll, instead of after the claim's two hours.
  • PR review: fix commits name their source (the automatic fix mode, or the commenter and the comment of @mendcode fix), and their subject is cut at a word.
  • Claude Code sessions know MendCode: they get the same line a native session has, that MendCode's slash commands and features are read with mendcode docs --search. Asked to keep reviewing a repository's pull requests, a Claude Code session offered a session cron job, a cloud routine or a GitHub Action and posted reviews with gh itself; with pr_watch it is now told that pr_watch only wakes it on one PR, and that MendCode's own reviewer (/pr review, /pr watch-repo) reviews every new PR and push from the daemon.
  • Claude Code sessions: a ToolSearch that loaded tools showed "empty"; it says which tools it loaded.
  • edit cut its diff at 2,000 lines even where the daemon allows more: the output limits were passed to the diff, not to the cut.
  • The context report counts every file a read with paths named, each with its share of the result; such a read was left out.
  • The built-in search (no ripgrep installed) no longer reports the empty "line" after a file's final newline.

Known limitations

  • Mermaid subgraphs are told apart by title: two subgraphs with the same title are drawn as one frame. In a left-to-right flowchart, a connection back to an earlier box shares the last stretch of the arrow going into it.

Install

curl -fsSL https://github.com/MendCode/MendCode/releases/latest/download/install.sh | sh -s -- --channel nightly

Already installed: mendcode upgrade --channel nightly. This exact build: MENDCODE_VERSION=v0.0.2-nightly.20261031.11 with the same installer.

Verify

SHA256SUMS lists every file of this release. It, every binary and both installers carry a keyless cosign bundle (*.sigstore.json) signed by this repository's release workflow at v0.0.2-nightly.20261031.11, and the binaries have GitHub build provenance.

gh release download v0.0.2-nightly.20261031.11 --repo MendCode/MendCode --pattern 'SHA256SUMS*' --pattern mendcode-0.0.2-nightly.20261031.11-darwin-arm64
grep ' mendcode-0.0.2-nightly.20261031.11-darwin-arm64$' SHA256SUMS | shasum -a 256 -c
cosign verify-blob --bundle SHA256SUMS.sigstore.json --certificate-identity https://github.com/MendCode/MendCode/.github/workflows/release.yml@refs/tags/v0.0.2-nightly.20261031.11 --certificate-oidc-issuer https://token.actions.githubusercontent.com SHA256SUMS
gh attestation verify mendcode-0.0.2-nightly.20261031.11-darwin-arm64 --repo MendCode/MendCode
Full changelog

1 commit since v0.0.2-nightly.20261030.8:

  • 2065a35d PR review platform and tools: reviews in English unless the template says otherwise, stalled turns stopped after 10 idle minutes, big diffs reviewed in parts, fixed findings' threads closed; grep takes context, edit takes edits in one write, apply_patch keeps the file's context lines and shows the file around a near miss; Mermaid flowcharts with subgraphs are laid out as clusters with frames

199 files changed: packages/daemon (135), apps/cli (22), packages/tools (9), docs (8), packages/protocol (6), packages/engine-codex (5), packages/engine-native (4), packages/client (3), packages/engine-claude (3), scripts (2), CHANGELOG.md (1), packages/kernel (1).

Full Changelog: v0.0.2-nightly.20261030.8...v0.0.2-nightly.20261031.11

Assets 22
Loading