Restore retained command dispatch and review correctness improvements

[dceoy]

Summary

Recovers the independently useful functionality from reverted PRs #27 and #28 without reintroducing their #24-specific review-only architecture.

• expands leading Markdown slash commands before opencode github run;
• makes the agent input effective through default_agent, while command frontmatter remains authoritative;
• preserves project and user-global command precedence, with bundled commands as a fallback;
• pins the PR head before diff analysis and refuses to publish stale conclusions;
• submits structured inline reviews through a target-bound, schema-validating helper that injects event: COMMENT;
• restores /review-pr simplify as proposal-only review suggestions that never edit files.

Deliberately out of scope

This PR does not attempt to resolve #24 and does not include:

• a dedicated review-only primary orchestrator;
• project config/plugin isolation;
• an OpenCode version floor;
• broad reviewer permission rewrites;
• HOME/XDG isolation or no-commit/no-push enforcement.

Validation

• focused Bats coverage for command expansion, precedence, literal argument handling, agent selection, JSONC merging, review target/payload validation, and stale-head rejection;
• existing repository CI and QA workflows.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[dceoy]

The direction is substantially better than the reverted architecture, but the current implementation still leaves the original mutation boundary unenforced and has correctness gaps in agent selection and stale-head handling. Please address the inline findings before merge.

[opencode-agent]

OpenCode PR Review: Submission Failed

The token gate refused to submit: 1 candidate App token found in git credential configuration, but none verified as opencode-agent[bot]. The only candidate resolves to github-actions[bot] (likely a checkout-persisted workflow token). Per the /review-pr policy, no review is posted under the wrong identity. The 7 findings below were produced against head SHA d34e6687b622891af18a82b6f892df2e90615bd1 but were not posted to PR #30.

github run

Inline findings (6)

• important · test-coverage-reviewer — scripts/expand-command.sh:22: opencode_command_agent does not strip surrounding quotes from the frontmatter value, so a command written as agent: "build" (a common YAML style) yields OPENCODE_RESOLVED_AGENT='"build"', which the OPENCODE_CONFIG overlay then writes as the literal string "build" (with quotes) — a silent failure mode. Extend the awk with quote stripping, e.g. sub(/^["'\'']+/, ""); sub(/["'\'']+$/, "").
• important · test-coverage-reviewer — scripts/expand-command.sh:64: ${template//\$ARGUMENTS/${args}} treats & in ${args} as the matched text and \ as an escape, so an $ARGUMENTS containing & or \ silently produces … $ARGUMENTS … in the expanded template. Pre-escape & and \ in ${args} before substitution, or switch the substitution to awk.
• important · test-coverage-reviewer — scripts/expand-command.sh:64: the only $ARGUMENTS substitution test uses one word (/review-pr security), but the README documents /review-pr security performance as a primary use case and the bundled template at .opencode/commands/review-pr.md:12 is the only place multi-word $ARGUMENTS is intended to flow. Add a bats test that calls opencode_resolve_prompt_and_agent "/review-pr security performance tests" "plan" "${bundled_commands}" and asserts all three words land in the Requested review aspects line.
• important · code-quality-reviewer — action.yml:141: the trap 'rm -f "${output_file}"' EXIT does not include agent_config, which is created at line 131 and leaked to ${RUNNER_TEMP:-/tmp} on every run with a non-empty resolved agent. Initialize agent_config="" before the if [[ -n ... ]] block and widen the trap to trap 'rm -f "${output_file}"${agent_config:+ "${agent_config}"}' EXIT.
• important · silent-failure-hunter — .opencode/scripts/resolve-app-token.sh:272: opencode_assert_pr_head_unchanged conflates "head SHA could not be determined" with "head moved": when gh api --jq '.head.sha' exits 0 with an empty result, the check emits "head moved from pinned to unknown", which is misleading. Split the check: emit a distinct "could not determine the current head SHA" error for the empty case, and keep the "moved" wording strictly for the genuine mismatch.
• important · silent-failure-hunter — .opencode/commands/review-pr.md:275: the gh api … PUT that updates the submitted review's body is not wrapped in if ! or otherwise checked for failure, so a 422 (e.g., body too long after appending the run link) or 5xx leaves the initial review posted but the summary update lost, with only gh's opaque error in the log. Wrap it: if ! gh api …; then echo "::error::Failed to update review summary for review ${review_id}: …" >&2; exit 1; fi.

Summary-only finding (1)

• .opencode/scripts/resolve-app-token.sh:25 — fallback: cannot anchor (the function is in unchanged code outside the diff hunks). important · test-coverage-reviewer: opencode_decode_extraheader_token is the security-critical parser that turns a git config value into a token, but has no direct bats tests; every coverage path is exercised only transitively through opencode_resolve_app_token_candidates. Add direct tests for empty header, non-Basic scheme (e.g. Bearer …), base64 decode failure, and a decoded body that is not x-access-token:<token>.

github run

[dceoy]

The stale-head fixes are sound and CI is green, but the review-only boundary is still bypassable through project command/agent configuration and unrestricted subagent dispatch. I also found two input/config handling regressions. These should be fixed before merge.

[dceoy]

PR Review Summary

No new actionable issues meeting the review’s reporting threshold were identified beyond findings already present in unresolved review threads.

Checked

• Current head SHA and eligibility metadata
• Full PR diff and changed-file scope
• Slash-command expansion and agent-selection behavior
• Review-only trust boundary and project configuration precedence
• Stale-head guards and structured review submission path
• Existing review threads and duplicate-finding suppression
• Current-head CI/CD status

Notes

Existing unresolved findings remain applicable and were not duplicated, including project command/agent shadowing of the review boundary, unrestricted subagent dispatch, JSONC handling in OPENCODE_CONFIG_CONTENT, and literal-unsafe $ARGUMENTS substitution. Current-head CI/CD completed successfully.

Recommended Action

Address the existing unresolved critical and important review threads before merge.

[dceoy]

The latest fixes address the previously reported command-precedence, config-order, and stale-head gaps, and CI is green. Four blockers remain: the orchestrator's bash policy is still write-capable, project agent prompts remain shadowable, quoted YAML agent values are misparsed, and the 422 retry path can submit after the head moves.

[dceoy]

PR Review Summary

No additional actionable issues meeting the review’s reporting threshold were identified beyond the existing unresolved review threads.

Checked

• Current eligibility metadata, base/head refs, and exact head SHA.
• Complete changed-file patch for slash-command expansion, agent/config overlays, stale-head guards, and review-only permission enforcement.
• Existing review threads, including the latest unresolved trust-boundary, YAML parsing, and retry freshness findings.
• Current-head CI/CD status.

Notes

• Four existing unresolved current-head findings remain applicable and were not duplicated: generic write-capable bash/gh api access in the orchestrator, incomplete pinning of bundled agent definitions, quoted YAML agent scalar parsing, and the missing freshness guard before the 422 retry/fallback POST.
• Current-head CI/CD completed successfully.

Recommended Action

Address the four unresolved review threads before merge.

[dceoy]

PR Review Summary

Important Issues

• [HIGH][Confidence: HIGH][security and trust boundaries] The trusted review helpers are loaded from a non-authoritative global-config path — .opencode/scripts/review-pr-context.sh:25

  • Impact: Copy bundled OpenCode config uses cp -rn, so an existing ${HOME}/.config/opencode/scripts/review-pr-context.sh, review-pr-submit.sh, or resolve-app-token.sh is preserved. The new orchestrator then invokes and sources those preserved files as trusted code. A pre-populated runner or earlier workflow step can therefore replace the context/state derivation or GitHub submission helper, bypassing the exact-command allowlist, pinned-head checks, target binding, and review-only boundary.
  • Recommendation: execute/source the helpers directly from the immutable action checkout (${{ github.action_path }}), or copy them into a dedicated per-run directory with overwrite plus ownership/permission validation. Do not treat ~/.config/opencode/scripts as trusted when cp -n permits pre-existing files to win.

Checked

• Current-head changes for command expansion, full bundled-agent overlay pinning, project-config disabling, the exact orchestrator permission allowlist, trusted context/submission helpers, stale-head gates, and related Bats validation.
• Existing review threads and their fixes on the current head.
• Current-head CI/CD result; the workflow completed successfully.

Strengths

• The current revision removes generic shell access from the orchestrator and binds structured review submissions to pinned per-run state.
• Previously reported command-shadowing, agent-shadowing, quoted-scalar, and retry-freshness defects are addressed.

Recommended Action

Fix the helper provenance issue before merge; the new security boundary otherwise depends on mutable pre-existing files outside the action checkout.

[dceoy]

The latest head resolves the previous review threads and CI passes, but three remaining issues still weaken the review-only boundary or introduce destructive runner behavior. Please address the inline findings before merge.

[dceoy]

The prior findings are addressed and CI is green, but the current head still has two security-boundary breaks and two correctness gaps. In particular, the supposedly trusted review state remains writable/pre-seedable under realistic workflow conditions, and the read-only agents can read checkout-persisted credentials. Please address the inline findings before merge.

[dceoy]

PR Review Summary

No new actionable issues meeting the review’s reporting threshold were identified beyond findings already present in unresolved review threads.

Checked

• Current eligibility metadata, base/head refs, and exact current head SHA.
• Full changed-file scope and current patches for slash-command expansion, bundled-agent pinning, project-config disabling, trusted context/submission helpers, state/payload directory handling, target binding, and stale-head gates.
• Existing review submissions and unresolved inline threads for duplicate suppression.
• Current-head GitHub Actions status; CI/CD completed successfully.

Notes

Four existing unresolved current-head findings remain applicable and were not duplicated: caller-controlled/pre-seedable review state, review-agent access to checkout-persisted .git/config credentials, context reads not explicitly bound to GITHUB_REPOSITORY, and the missing pinned-head gate before review-body updates.

Recommended Action

Address the four unresolved security and correctness threads before merge.

[dceoy]

Found two integration gaps in the retained functionality: comment-triggered slash commands are not expanded, and the structured review helper does not actually enforce a strict per-comment schema.

[dceoy]

PR Review Summary

No new actionable issues meeting the review’s reporting threshold were identified beyond findings already present in unresolved review threads.

Checked

• Repository ownership and archived status, PR author/state/draft status, base/head refs, and exact current head SHA.
• Full changed-file patch for command expansion, agent/config overlay handling, review context gathering, payload validation, stale-head protection, and review submission.
• Existing review submissions and unresolved inline threads for duplicate suppression.
• Current-head CI/CD status; the workflow completed successfully.

Notes

Two unresolved current-head findings remain applicable and were not duplicated: comment-triggered slash commands are not expanded before opencode github run, and the structured review helper does not enforce exact mutually consistent schemas for file-level versus line-level comments.

Recommended Action

Address the two unresolved important review threads before merge.

[dceoy]

The reduced one-commit shape is substantially better and CI is green, but three correctness gaps remain in the retained generic command/review functionality. In particular, the comment-triggered path is not portable to Bash 3.2, valid OpenCode commands can silently execute with different agent/model semantics, and the accepted file-level review payload is incompatible with the batch review endpoint. I would fix these before merge without broadening the architecture.

[dceoy]

The previous findings are fixed, but three user-visible regressions remain in the command-dispatch/install boundary. Please address the inline findings before merge; each can be fixed without broadening the PR architecture.

[opencode-agent]

I edited scripts/expand-command.sh to fix the prompt truncation logic: when OPENCODE_RESOLVED_COMMAND_FILE is non-empty, use the derived suffix "and keep compatibility"; otherwise keep the original empty action prompt so opencode github run consumes the complete event body.

github run

[dceoy]

PR Review Summary

No new actionable issues meeting the review’s reporting threshold were identified for this head after deduplicating against existing review threads.

Checked

• Current diff across command expansion, action wiring, structured review submission, bundled review command/agent configuration, tests, and README contract.
• Comment-triggered prompt extraction and fallback behavior.
• Unsupported Markdown command semantics and literal argument expansion.
• Structured inline-comment payload validation, target binding, and stale-head checks.
• Current-head CI/CD status for 459d20ea0eb26af2c0ebf28988e40b1d8d7b2168.

Notes

Three existing unresolved findings remain applicable and were not duplicated: ordinary comment text can be truncated when event-derived text replaces the native prompt; unsupported positional placeholders or shell template blocks are not rejected; and toolkit installation force-overwrites user-global helper scripts despite the preservation contract.

Recommended Action

Address the existing unresolved findings before merge. No additional automated blocking concern was identified beyond those threads; merge remains a maintainer decision after required checks pass.

[dceoy]

PR Review Summary

No actionable issues meeting the review’s reporting threshold were identified.

Checked

• Repository ownership, archived status, PR author/state/draft status, base/head refs, and exact current head SHA.
• Full changed-file scope and current patches for Markdown slash-command resolution, event-comment extraction, frontmatter validation, literal argument expansion, JSONC config merging, and action wiring.
• Structured review payload schema validation, target derivation, token identity gate, and stale-head protection.
• Existing review submissions and resolved/unresolved inline threads for duplicate suppression.
• Current-head CI/CD status; the workflow completed successfully.

Notes

The current revision intentionally removes the earlier review-only orchestrator architecture and retains the narrower generic command-dispatch and structured-review helper functionality. The combined-status endpoint returned no status contexts; the current-head GitHub Actions CI/CD run completed successfully.

Recommended Action

No automated blocking concerns were identified. Merge remains a maintainer decision after required checks pass.