v0.3.6 — Defects in moved code and unknown intent

Azure DevOps PR Review for OpenCode — 0.3.6

This release changes two reviewer rules that kept real defects out of the
findings: one for code a pull request moves unchanged, and one for behavior
that might be intended. Settings, commands, comment previews, adjustments and
publication work as in 0.3.5, and the tested host stays OpenCode 2.2.4.

What changed

• Defects in moved code are filed. A correctness or security defect on
  lines the PR adds or moves is filed even when the base commit had the same
  code elsewhere, such as a function moved to a new file. The finding says
  that the PR carries the defect over and shows where the base commit had it.
  Unrelated pre-existing issues still stay out.
• A possible intention no longer keeps a defect out. When behavior would be
  a defect unless the author meant it, and nothing in the code, tests,
  documentation or PR text says whether they did, reviewers file a low finding
  whose summary asks whether the author meant it and whose suggested fix asks
  them to confirm or document the intent. Low findings get no inline comment,
  so the question appears in the summary index.
• The verifier no longer rejects for either reason. Neither a possible
  intention nor identical base code refutes a finding. When only the author's
  intent would settle a verified behavior, the verifier confirms the finding
  with a summary and a suggestion that ask the author.

/pr-review, /pr-deep and /pr-quick share the reviewer rules; /pr-quick
has no verifier. Publication is unchanged: inline comments go to high and
medium findings, so the low questions about intent stay in the summary index.

Measured effect

Both rules came from a run of Martian's Code Review Bench: among the expected
issues that no run had posted were defects in moved code and a finding
rejected as possibly intended. The wording was written after reading three of
them. In a local scoring run on the benchmark's 50 pull requests, with
/pr-deep and Claude Opus 5.5 at medium effort, recall rose from 65.2% to
67.7% and F2 from 51.6 to 53.2, with precision about the same.

Because the wording was written from that benchmark, 0.3.5 and 0.3.6 also
reviewed the 25 pull requests of the public
ReviewBench test set, which was
not used to write it, through a local fixture of the Azure DevOps API. Both were
scored with ReviewBench's judging pipeline and Claude Sonnet 5, the model that
judges its leaderboard. We ran the pipeline ourselves, so this is not a
leaderboard result:

/pr-deep, Claude Opus 5.5	Issues found (recall)	Findings judged valid	High and medium found	Inline decisions (F1)
0.3.5	35.5%	95.6%	55.3%	70.0
0.3.6	39.5%	96.5%	55.3%	65.5

None of the four measures fell by more than the run-to-run variation allowed
for in advance. Inline decisions, the agreement with the judge on which
findings deserve an inline comment, fell because more findings the judge rated
medium or high were labeled low, 8 of them questions about intent, which the
new rule rates low. A local judge scored the same runs and a pair with
GPT-6.1 Sol: with Sol all four measures rose slightly, and with Claude Opus 5.5
it rated 2.4 points fewer of 0.3.6's findings valid, more than allowed. The
validation record
describes the method, both judges' results and the limits.

Installation

opencode plugin add opencode-azure-devops-pr-review@0.3.6

Alternatively, install the same release from Git:

opencode plugin add 'github:WTLAIB/opencode-azure-devops-pr-review-v2#v0.3.6'

Add only one of them. Follow the
quickstart
for a private PAT file, /pr-setup, a service restart and the first review.

Upgrading AZPR

For an entry that opencode plugin add created, add 0.3.6 and remove the
previous version only when the download succeeded. Replace PREVIOUS_VERSION
with the version in your plugins entry, such as 0.3.5:

opencode plugin add opencode-azure-devops-pr-review@0.3.6 &&
  opencode plugin remove opencode-azure-devops-pr-review@PREVIOUS_VERSION

Run them when no AZPR command is running: OpenCode 2.2.4 switches the running
service to 0.3.6 within seconds, without a restart, and
opencode plugin list should then show a single azpr row with 0.3.6. Running
only the first command leaves the previous version running. For an entry with
options, change only its package value; the OpenCode service then downloads
0.3.6 with its own network settings. See
upgrading
for the details. External settings, the PAT file and review records remain in
place, and this release adds no settings or required migration. Reviews saved
by 0.3.5 keep their findings; only new reviews use the new rules.

For a source installation, extract the new archive and run its installer with
--replace to retain settings:

sh install.sh --config-dir /absolute/path/to/v2-opencode-config --replace

Compatibility and validation

The tested target is OpenCode CLI 2.2.4 (V2 plugin API), Node.js
22.23.3, Ubuntu 22.04.5 under WSL2, and Azure DevOps Services REST API
7.1. OpenCode 1.x and Azure DevOps Server are not supported; other operating
systems remain unvalidated.

Only the reviewer instructions changed: src/prompts/common.md and
src/prompts/final.md. The runtime logic is that of 0.3.5. The
validation record
lists the offline and real-host checks with fake services and the measurements
above. A live review of the candidate with openai/gpt-6-luna on the 1-file
test PR, in a service on OpenCode 2.2.4, completed and confirmed the PR's three
known defects; its comment preview was not published.

The npm package, Git package and source archive contain the same runtime, with
no npm dependencies or install scripts; the source archive also contains the
documentation, installers and settings example. The release source artifact is
opencode-azure-devops-pr-review-v2-0.3.6.tar.gz, with checksums in SHA256SUMS.