Version Packages

[khan-actions-bot]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

autofix@0.4.0

Minor Changes

• 499a8bd: Autofix now parses the review body's collapsed observations as a second work-list source, and the reviewer's documentation-label budget exemption goes away. The coupling this fixes: autofix selected its work exclusively off posted threads (the label parse on each opener), so any finding the reviewer's posting surface collapsed (the non-blocking budget, blocking-only/blocking-medium re-reviews) silently vanished from autofix's scope; the documentation autofix was the acute case, since its entire selection is one label. The plan reads the collapsed entries of the latest bot review body (workflows/autofix/lib/collapsed.ts, parsing the exact line grammar submission.ts renders), filtered by the same scope labels, deduplicated against open threads (thread-covered), and subject to the same stale-path currency check. Body-sourced items carry a synthetic review-body:path:line:label-token id; there is no thread to reply on, so the prompt reports their outcomes in the run summary instead of Step 6 replies. With that in place, the review side drops the documentation exemption from the non-blocking inline budget: doc findings are budgeted like any other, and collapsing one no longer shrinks the autofix's reach.

  Two disclosures. The collapsed section now always renders into the review body, never riding the top-ranked inline comment: the body is the only surface both stagers persist, so the ride made the new work-list source blind exactly where the budget sheds. Expected output-shape effect: the top inline comment shrinks by the collapsed section it used to carry, the review body grows by the same block, inline comment count is unchanged by this PR itself, and dropping the documentation exemption means a doc finding past the budget collapses instead of posting inline (at the measured 2.91 findings/run the budget binds rarely). And the body source widens autofix: nits to collapsed nitpick-class findings, which by design never become threads and were previously unreachable; that is the reach the posting-surface changeset promised this change would restore, and it means autofix can push commits for findings that never appeared as inline comments.

review@1.20.0

Minor Changes

• 499a8bd: Autofix now parses the review body's collapsed observations as a second work-list source, and the reviewer's documentation-label budget exemption goes away. The coupling this fixes: autofix selected its work exclusively off posted threads (the label parse on each opener), so any finding the reviewer's posting surface collapsed (the non-blocking budget, blocking-only/blocking-medium re-reviews) silently vanished from autofix's scope; the documentation autofix was the acute case, since its entire selection is one label. The plan reads the collapsed entries of the latest bot review body (workflows/autofix/lib/collapsed.ts, parsing the exact line grammar submission.ts renders), filtered by the same scope labels, deduplicated against open threads (thread-covered), and subject to the same stale-path currency check. Body-sourced items carry a synthetic review-body:path:line:label-token id; there is no thread to reply on, so the prompt reports their outcomes in the run summary instead of Step 6 replies. With that in place, the review side drops the documentation exemption from the non-blocking inline budget: doc findings are budgeted like any other, and collapsing one no longer shrinks the autofix's reach.

  Two disclosures. The collapsed section now always renders into the review body, never riding the top-ranked inline comment: the body is the only surface both stagers persist, so the ride made the new work-list source blind exactly where the budget sheds. Expected output-shape effect: the top inline comment shrinks by the collapsed section it used to carry, the review body grows by the same block, inline comment count is unchanged by this PR itself, and dropping the documentation exemption means a doc finding past the budget collapses instead of posting inline (at the measured 2.91 findings/run the budget binds rarely). And the body source widens autofix: nits to collapsed nitpick-class findings, which by design never become threads and were previously unreachable; that is the reach the posting-surface changeset promised this change would restore, and it means autofix can push commits for findings that never appeared as inline comments.

• d65bd1a: The COMMENT middle verdict: a run that finds medium-importance findings and nothing blocking now submits a COMMENT review instead of an approval. The verdict stays mechanical (lib/verdict.ts): REQUEST_CHANGES iff a posted claim carries a blocking label (plus the existing floors), COMMENT iff nothing blocks and the post-veto medium count is nonzero (collapsed mediums count too: the verdict follows what the run found, not which surface showed it, the same invariant that keeps a 21st blocking claim blocking), APPROVE otherwise. HOLD_FOR_HUMAN outranks COMMENT: the hold's no-stamp/no-record effect is what forces the next run to review in full, and a COMMENT run writes both, so a partial assessment holds even when it found mediums (they fold into the hold comment as claim lines). One mechanical guard on GitHub's state model: a COMMENT that would leave this workflow's own prior REQUEST_CHANGES standing upgrades to APPROVE with a note, since GitHub only moves a reviewer's state on APPROVE or REQUEST_CHANGES and the author's fixes already earned the block's removal. A vetoed medium demotes nothing. The stamp and cache-record machinery accept the new verdict (a COMMENT run still records its fingerprint, so re-review depth planning is unaffected), the conformance gate's no-blocking-inline rule covers COMMENT the same as APPROVE, and the frontmatter's allowed-events gains COMMENT (consumers inherit it at bump time; the gh-aw engine passes the event through to GitHub's review API).

  Expected output-shape effect: no change to inline comment count or body sizes; the review event changes from APPROVE to COMMENT exactly when the medium count is nonzero, and the body head reads "Commented — medium-importance findings found; nothing blocks." instead of the approval line. Authors keep a clean green approval only when the run found nothing worth fixing before merge.

• c6a61f6: A cap on how many non-blocking findings post as inline comments per review, plus a collapsed-section summary that names its top-ranked finding. Four posting-surface changes, all deterministic (no model behavior changes): at most 3 non-blocking findings post inline per review (the ROUTING non-blocking-budget line tunes it; blocking findings are uncapped up to the engine's 20), nitpick (non-blocking) never posts inline, documentation-label findings are exempt from the budget (the documentation autofix selects its work by parsing that label off posted threads, so budgeting them would silently shrink a shipped feature's scope), and the collapsed section's summary line now names its top-ranked entry's location, label, and subject instead of a bare count. The motivating case for the disclosure: three 2026-08-24 approving re-reviews on this repo collapsed correctness findings behind "Non-blocking observations (N)", including review: an author acknowledgment stops reading as unaddressed #367's report that the acknowledgment feature's own reply guard never fires. Nothing is dropped and the verdict still counts every validated claim; every shed is disclosed in the plan notes, per reason (budget, nitpick ban), and a non-default budget shows in the version footer.

  Expected output-shape effect: fewer inline comments per review (at most 3 non-blocking plus blocking, down from every claim at >=0.5 confidence up to 20; at the measured 2.91 findings/run the cap binds rarely), an unchanged median comment body, a slightly longer top comment or review body where a collapsed section now rides with its named-top summary line, and zero inline nitpick comments. The nitpick ban also means nitpick findings stop becoming threads, which removes them from the thread-sourced autofix: nits work list until the companion autofix change (the body-sourced work list, same release train) restores that reach.

• 7508b24: The medium importance tier (PRA-7): a middle level for findings that aren't blocking but shouldn't be hidden. Reviewers propose it (an optional importance: "medium" field on the label-shape contracts, a medium severity on the structured lens schema; the bar is a verified defect or gap in code this PR adds, one a reasonable author would fix before merge), the claim-validator adjudicates it (corrected.importance both directions; a plausible or refuted verification loses the tier, as does the author-dispute cap), and code vetoes it deterministically (the tier is stripped from any claim not anchored on an added diff line). Medium claims rank ahead of minor ones for the non-blocking inline budget, and a new ROUTING modifier re-review <mode> blocking-medium lets them post inline on reduced-depth re-reviews where blocking-only collapses everything; blocking-only stays as the strict rollback dial. Motivating case: three 2026-08-24 approving re-reviews on this repo collapsed verified correctness findings behind a bare count, including review: an author acknowledgment stops reading as unaddressed #367's report that the acknowledgment feature's own reply guard never fires. The tier mints no new labels, so the verdict, recap parser, dedup guards, and flip gate are untouched by construction, and medium renders with the same non-blocking labels advisory findings get. Every submission plan notes its post-veto medium count (zero included), which is the day-one instrument for whether the roster uses the tier at all.

  Expected output-shape effect: on full-depth reviews, none by itself (medium only reorders which non-blocking claims take the existing budget's slots); on reduced-depth re-reviews under the new blocking-medium modifier, up to 3 medium non-blocking comments post inline where blocking-only posted zero, each of ordinary comment length, and the review body's collapsed section shrinks by the same entries. Median comment body length is unchanged; every plan gains one artifact-only notes line (the medium count).

• 7337dc1: Sweep out what the thumbs-sweep deletion (review: retire the thumbs sweep's why? follow-up; the sweep is read-only #364) left behind. The weekly counters drop their thumbs plumbing (ThumbsTally, ThumbsCounter, the report's Thumbs line): nothing writes a thumbs key into per-run artifacts since the sweep died, so the section could only ever render "none recorded"; the report section is now "Cost". Minor because the weekly report's shape changes. The root package.json drops the sweep's octokit devDependency (unimported since the deletion). Ten doc sites under lib/, one prompt parenthetical in review.md, the consumer README, and the review-feedback-audit skill stop describing the sweep as live: references are past-tense or removed, the README now tells a consumer still carrying review-feedback.yml to delete it at its next bump (webapp#41685 is the reference deletion), and the skill's sentinel-string recovery points at a pre-retirement tag instead of a CHANGELOG entry that does not quote the deleted strings. The eval thumbs-calibration surface (eval/judge.ts) deliberately stays: bare downvotes remain a live signal and a thumbs-calibration task is still planned against it.

Patch Changes

• d384230: Fixes from the final review folds of three merged PRs. The dispatcher-death prose (review: post a PR comment when the dispatcher dies without a result #370) sequenced "report the run incomplete" before "continue at Step 9", and reporting incomplete can end the turn, so the cache compensation the death path exists to trigger could be skipped with it; Step 9 now comes first, and the repost claim is scoped to the next full-depth run. The gh aw update ban test (review: stop recommending gh aw update in the consumer README #371) folds whitespace before matching so a line-wrapped mention cannot slip past, gains a positive control so a broadened exclusion fails instead of passing vacuously, and checks file existence before reading so the stale-allowlist message actually renders. foldToken's three length thresholds are documented (review: drop a subject that restates the discussion; stage body-size stats #365) and the empty-subject-tokens early return is pinned by a test.
• 524f661: Sub-agent salvage paths stop reporting usd: 0, turns: 0 for sessions that really ran. A non-success result record (error_max_turns et al.) still carries total_cost_usd/num_turns; the runner now captures them before throwing, so the captured/provisional and lastText salvages report real metering, and the Stop hook's common max-turns ending no longer systematically undercounts dispatch's perAgent entries and the totalUsd summed over them (zeros remain when the stream dies with no result record at all, and on the rethrow path, where dispatch.ts's run-failed entry has no channel for a cost carried on an error). The lastText salvage is also gated on a delivered result record: a hard failure mid-stream leaves narration, not a final, and salvaging it burned the malformed-output re-dispatch. The Stop hook's block reason now distinguishes "never called submit_result" from "your submission was bounced, correct and resubmit", branching on an attempt counter so both bounce kinds (contract and prose gate) are covered (an agent mid-bounce was being told it had not delivered). Riders from merged-PR review folds: the adjudicated cross-file hard-negative fixture asserts its calibration band (bigram and overlap floors cleared, jaccard rejecting) instead of only documenting it, the acknowledgment guard's dead isBotLogin clause is documented as belt-and-suspenders (staged threads carry GraphQL's bare logins) with the test spelling annotated, and the consumer-bump skill stops describing the now-guarded --repo footgun as silent (review: check-consumer-config fails loudly on a nonexistent --repo path #372 made the checker fail loudly).