# agent-reviews
Manage GitHub PR review comments from the terminal and from AI coding agents.
PR review bots (Copilot, Cursor Bugbot, CodeRabbit, etc.) leave inline comments on your pull requests. agent-reviews gives you a CLI to list, filter, reply to, and watch those comments, plus agent skills that automate the entire triage-fix-reply loop.
## Why
**`gh` CLI is fragile for review comments.** Agents frequently get the syntax wrong, fail to paginate, and can't reliably detect whether a comment has been replied to. agent-reviews provides a single, purpose-built interface that handles all of this correctly.
**Bot reviews create a doom loop.** You fix one round of findings, push, and new comments appear. Fix those, push again, more comments. This cycle can eat hours. The included skills solve this with an integrated watcher that keeps fixing and replying until the bots go quiet.
**Works in cloud environments.** Most solutions rely on local tooling that isn't available in cloud or remote agent environments. agent-reviews works everywhere, so you can kick off a session, let the agent resolve all findings autonomously, and come back to a clean PR.
## Install
### CLI (npm)
```bash
npm install -g agent-reviews
```
### Agent Skills
Three skills are available, each as a slash command (no npm install required):
| Skill | What it resolves |
|-------|-----------------|
| `resolve-reviews` | All comments (human + bot) |
| `resolve-agent-reviews` | Bot comments only (Copilot, Cursor, etc.) |
| `resolve-human-reviews` | Human comments only |
Works with any agent that supports [Agent Skills](https://agentskills.io) (Claude Code, Cursor, Codex, etc.):
```bash
npx skills add pbakaus/agent-reviews@resolve-agent-reviews
```
Replace `resolve-agent-reviews` with whichever skill you want. Skills use `npx agent-reviews` at runtime, so the CLI is fetched automatically.
> You can also use both: install the CLI globally for direct terminal use, and a skill for the agent workflow.
## Authentication
The simplest method is the **GitHub CLI**. If you're logged in with `gh auth login`, agent-reviews picks up the token automatically. No configuration needed.
For cloud/remote environments or HTTPS proxy setups, set `GITHUB_TOKEN` or `GH_TOKEN` directly. agent-reviews includes [undici](https://github.com/nodejs/undici) `ProxyAgent` support and will route requests through `HTTPS_PROXY` automatically when set.
**Resolution order** (first match wins):
1. `GITHUB_TOKEN` environment variable
2. `GH_TOKEN` environment variable
3. `.env.local` in the repo root
4. `gh auth token` (GitHub CLI)
### Fork pull requests
Branch discovery keeps the head repository separate from the PR's base repository. It uses the branch push remote, `remote.pushDefault`, tracking remote, or `origin` (in that order), and looks for the current branch in configured GitHub repositories and the fork's parent/source repositories. The selected remote's push URL determines the head repository, including when its fetch URL points upstream. An upstream remote is not required. A single GitHub remote with another name also works.
`GH_REPO=organisation/project` restricts the target repository without changing the head owner. Use `GH_REPO=organisation/project agent-reviews --pr 123` to select a PR explicitly, including from detached HEAD. Malformed `GH_REPO` values fail explicitly. If multiple open PRs match, or a matching PR has a deleted/inaccessible head repository that cannot be verified, the CLI asks for an explicit target instead of choosing one. Discovery uses the GitHub API and works with token authentication without requiring `gh`.
### Custom API host
Set `GITHUB_API_URL` to point agent-reviews at a GitHub Enterprise host or any API-compatible server (useful for testing, recording, or routing through a local mediator). Defaults to `https://api.github.com`.
```bash
# GitHub Enterprise Server
GITHUB_API_URL=https://github.example.com/api/v3 agent-reviews
# Local API-compatible server
GITHUB_API_URL=http://127.0.0.1:8080 agent-reviews
```
GraphQL endpoint resolution: agent-reviews uses `${GITHUB_API_URL}/graphql` by default. For GitHub Enterprise Server, where REST lives under `/api/v3` and GraphQL under `/api/graphql` on the same origin, the trailing `/api/v3` is rewritten to `/api/graphql` automatically. Set `GITHUB_GRAPHQL_URL` directly if you need full control over the GraphQL endpoint.
## CLI Usage
```bash
# List all review comments on the current branch's PR
agent-reviews
# Only unresolved comments
agent-reviews --unresolved
# Only unanswered bot comments
agent-reviews --unanswered --bots-only
# Full detail for a specific comment (diff hunk + replies)
agent-reviews --detail 12345678
# Reply to a comment
agent-reviews --reply 12345678 "Fixed in abc1234"
agent-reviews --reply 12345678 --body-file body.md
# JSON output for scripting / AI agents
agent-reviews --json
# Watch for new comments (polls every 30s, exits after 10 min idle)
agent-reviews --watch --bots-only
# After a push: wait for the head commit's checks, then print failures and unanswered bot comments
agent-reviews --wait-checks --bots-only --expect "Greptile Review"
# Target a specific PR (otherwise auto-detects from branch)
agent-reviews --pr 42
```
Unknown options, unexpected arguments, and invalid numeric values fail before authentication or network requests. To pass an inline reply starting with a dash, put options first and use `agent-reviews --reply 12345 -- "- Fixed the issue"`. Everything after `--` is literal text.
### Options
| Flag | Short | Description |
|------|-------|-------------|
| `--unresolved` | `-u` | Only unresolved/pending comments |
| `--unanswered` | `-a` | Only comments without any replies |
| `--reply <id> "msg"` | `-r` | Reply to a comment |
| `--body-file <path>` | | Read reply text from a UTF-8 file instead of a positional message |
| `--resolve` | | Resolve the review thread after replying (use with `--reply`) |
| `--detail <id>` | `-d` | Full detail for a comment |
| `--pr <number>` | `-p` | Target a specific PR |
| `--json` | `-j` | JSON output |
| `--bots-only` | `-b` | Only bot comments |
| `--humans-only` | `-H` | Only human comments |
| `--ignore-author <login>` | | Exclude an author from listing and watching; repeat for multiple authors |
| `--expanded` | `-e` | Show full detail for each listed comment |
| `--watch` | `-w` | Poll for new comments |
| `--wait-checks` | | Wait for the head commit's checks, then report failures and unanswered comments |
| `--expect <name>` | | With `--wait-checks`: a check that must report before the wait ends; repeatable |
| `--interval <sec>` | `-i` | Poll interval in seconds (default: 30, or 15 with `--wait-checks`) |
| `--timeout <sec>` | | Inactivity timeout in seconds (default: 600); with `--wait-checks`, the total wait (default: 1800) |
To hide workflow status comments, use `agent-reviews --ignore-author 'github-actions[bot]'`. Repeat the flag for multiple authors, including with `--watch`. Matching is case-insensitive and uses the full GitHub login, including `[bot]` when present. Excluded authors' top-level findings are hidden, but their replies remain visible as context in other authors' threads. Explicit `--detail` lookups and replies are unaffected. No authors are excluded by default.
## Agent Skills
The skills automate the full PR review resolution workflow:
1. Fetch unanswered comments (all, bot-only, or human-only depending on skill)
2. Evaluate each finding (true positive, false positive, actionable, etc.)
3. Fix real issues and run lint/type-check
4. Dismiss false positives with an explanation
5. Reply to every comment with the outcome
6. Wait for the head commit's checks (`--wait-checks`) and repeat until a pass is clean
7. Report a summary of all actions taken
### Skill behavior
- **True positives / actionable feedback** get fixed and replied with `Fixed in {commit}`
- **False positives** get replied with `Won't fix: {reason}`
- **Uncertain findings** prompt the user for guidance
- All fixes are batched into a single commit before polling begins
- The bot and combined skills loop until every check on the head commit has passed and no comment waits; the human-review skill watches until reviewers go quiet
## How It Works
### Comment types
agent-reviews fetches three types of GitHub PR comments:
| Type | Label | Description |
|------|-------|-------------|
| Review comment | `CODE` | Inline comment attached to a specific line |
| Issue comment | `COMMENT` | General PR-level comment |
| Review | `REVIEW` | Review summary (approved, changes requested) |
### Meta-comment filtering
Bot review bodies (`REVIEW` type) are always filtered out since actionable findings come through as inline comments. Additionally, these bot issue comments are filtered:
| Bot | What's filtered |
|-----|----------------|
| Vercel | Deployment status (`[vc]:...`) |
| Supabase | Branch status (`[supa]:...`) |
| Cursor Bugbot | Review summary ("Cursor Bugbot has reviewed your changes...") |
| Copilot | PR review summary ("Pull request overview") |
| CodeRabbit | Walkthrough, summary, and "review skipped" comments |
| Sourcery | Reviewer's guide and PR summary |
| Codacy | Analysis summary and coverage summary |
| SonarCloud | Quality Gate pass/fail summary |
| Gemini Code Assist | "Summary of Changes" issue comment |
### Reply status
Each comment displays its reply status:
| Status | Meaning |
|--------|---------|
| `no reply` | No one has replied |
| `replied` | A human has replied |
| `bot replied` | Only bots have replied |
### Waiting for checks
`--wait-checks` polls the PR's head commit until every check run and commit status has finished, then prints one line with the outcome, the failed checks with links, any expected check that never reported, and the unanswered comments (with the usual filters). It follows new pushes to the PR, stops at once when the PR conflicts with its base branch (no CI runs then), and waits 30 seconds after the last check finishes for reviewers that register late. Name a reviewer with `--expect` when it registers much later, for example only after a preview deploys; expected checks are not waited for on drafts.
| Exit code | Meaning |
|---|---|
| 0 | Every check passed and no comment waits |
| 1 | A check failed, an expected check never reported, or an inline review comment waits |
| 2 | The PR conflicts with its base branch |
| 3 | Timed out with checks still running |
| 4 | No check registered on the commit |
Summary comments from review bots (Greptile, Copilot, CodeRabbit and others) are not counted as findings. PR-level comments (issue comments, review bodies) are listed but never change the exit code, since they have no thread to reply in and would otherwise hold every run at 1.
### Watch mode
Polls the GitHub API at a configurable interval and reports new comments as they appear. Outputs both formatted text and JSON for AI agent consumption. Exits automatically after a configurable inactivity timeout (default: 10 minutes).
Reply files preserve Markdown and newlines exactly. For multiline or complex replies, write the text to a file and pass `--body-file body.md` to avoid shell quoting and command substitution. Both absolute and relative paths are supported; relative paths are resolved from the current directory. Prefer uniquely named temporary files outside the repository so later commits cannot accidentally include reply text. Use either a positional message or `--body-file`, not both; empty or whitespace-only replies are rejected. The flag works with `--resolve` and `--json`.
## Changelog
### 1.3.0 (October 16, 2026)
- The bot and combined skills stop after a second round of fixes when new findings keep landing on lines the earlier fixes changed, and hand the rest to the user instead of patching on.
- `--wait-checks` rides out network drops of up to five minutes instead of five failed requests, and retries the PR lookup and the comment fetch through short drops.
### 1.2.0 (October 15, 2026)
- Wait for a PR's checks with `--wait-checks`: follows new pushes, stops on a conflict with the base branch, waits for late reviewers named with `--expect`, and prints only failed checks and unanswered comments, with an exit code for each outcome.
- The bot and combined skills wait with `--wait-checks` instead of a quiet window.
- Treat Greptile's PR summary as a summary, not a finding.
### 1.1.0 (September 10, 2026)
- Read exact UTF-8 reply text with `--body-file`, without shell command substitution.
- Reject unknown flags and invalid arguments before posting; use `--` for replies beginning with a dash.
- Discover fork PRs across upstream repositories, separate push URLs, and GitHub Enterprise hosts.
- Exclude selected authors from listing and watching with repeatable `--ignore-author`.
- Reduce duplicate replies with fresh reply checks and watcher-startup reconciliation in all three skills.
- Update development dependencies to Vitest 5 and refresh website dependencies and audit fixes.
Development tests now require Node.js 22.12+, 24, or 26+ as supported by Vitest 5. CLI runtime support remains Node.js 18+.
### 1.0.2
- GitHub Enterprise Server support via `GITHUB_API_URL` env var (also works for local API-compatible servers used in testing). REST and GraphQL endpoints both honor it, with GHES `/api/v3` automatically rewritten to `/api/graphql`. Optional `GITHUB_GRAPHQL_URL` for unusual setups.
- Gemini Code Assist meta-comment filtering: the bot's `## Summary of Changes` issue comment is now dropped, while inline severity-badged findings are preserved.
### 1.0.0
**Three skills instead of one.** The single `agent-reviews` skill has been split into three, each tailored for different workflows:
- `resolve-reviews` resolves all comments (human + bot)
- `resolve-agent-reviews` resolves bot comments only
- `resolve-human-reviews` resolves human comments only
**Thread resolution.** The new `--resolve` flag marks GitHub review threads as resolved after replying. Uses the GraphQL `resolveReviewThread` mutation. Works with `--reply` in any argument order.
**Expanded bot support.** Added detection and meta-comment filtering for CodeRabbit, Sourcery, Codacy, SonarCloud/SonarQube Cloud, and Copilot PR reviewer, in addition to the existing Cursor Bugbot, Vercel, and Supabase filters.
**Agent-harness universal.** Skills now work with any agent that supports [Agent Skills](https://agentskills.io) (Claude Code, Cursor, Codex, etc.), not just Claude Code.
**Watch mode improvements.** The watcher now exits immediately when new comments are found (with a 5s grace period for batch posts), designed for loop-based workflows where the agent processes comments and restarts the watcher.
**New CLI options:**
- `--resolve` resolves the review thread after replying (use with `--reply`)
- `--expanded` / `-e` shows full detail (body, diff hunk, replies) for each comment in list mode
**Bug fixes:**
- `--json --resolve` no longer emits plain-text status messages to stdout
**Cloud and proxy support:**
- `GH_TOKEN` environment variable support (in addition to `GITHUB_TOKEN`)
- `GH_REPO` environment variable for targeting repos in detached environments
- Curl-based HTTP fallback for environments without native fetch/undici
- Curl requests include timeouts (10s connect, 60s max)
**Smarter filtering.** Bot review bodies (summaries listing inline findings) are now automatically excluded, since actionable findings always come through as inline comments. Reply comments posted by agent-reviews itself (`> Re: comment ...`) are also filtered to avoid noise.
**Simplified architecture.** Skills now invoke `npx agent-reviews` at runtime instead of bundling their own scripts, reducing the package from ~4000 lines of duplicated code to a single CLI entry point. Skills no longer run redundant startup commands (version check, branch detection, PR lookup), relying on the CLI's own error handling instead.
## License
MIT