Resolve CodeAnt PR Comments

Use the source-control provider as the source of truth for PR metadata, review comments, and thread state. Never install, update, invoke, or fall back to

codeant-cli

. Never send CodeAnt telemetry.

Workflow

Run the preflight checks.
Select exactly one provider adapter and fetch every result page.
Keep only unresolved inline CodeAnt threads.
Validate and classify every finding.
Present the plan and obtain approval before editing.
Apply approved fixes and run relevant verification.
Resolve only threads whose fixes were applied and verified.
Report results and offer to commit and push.

1. Preflight

Inspect the repository without modifying it:

bash

git status --short
git branch --show-current
git remote -v

Preserve all pre-existing changes. Detect the provider from the remote host:

```
github.com
```
or GitHub Enterprise: GitHub.
```
gitlab.com
```
or self-managed GitLab: GitLab.
```
bitbucket.org
```
: Bitbucket Cloud.
Another Bitbucket Server/Data Center host: Bitbucket Data Center.

dev.azure.com

ssh.dev.azure.com

, or

*.visualstudio.com

: Azure DevOps.

If detection is ambiguous, ask which provider hosts the PR. If the user supplied a PR/MR URL or number, use it. Otherwise find an open PR whose source branch exactly equals the current branch. If on the default branch, require a PR number or URL. If zero or multiple exact matches exist, stop and ask the user to identify the PR.

Use already-configured provider authentication. Do not install CLIs, expose tokens, print credential-bearing headers, or put secrets in generated files. If authentication is missing, name the required provider login/token and stop.

Filter CodeAnt suggestions

After fetching the PR's review comments, retain only unresolved inline suggestions generated by CodeAnt. Treat an inline comment as CodeAnt-generated when either condition is true:

Its author login, username, nickname, or display name case-insensitively equals
```
codeant-ai
```
,
```
codeant-ai[bot]
```
,
```
codeant-bot
```
, or
```
CodeAnt AI
```
.

Its body contains a CodeAnt action URL beginning with

https://app.codeant.ai/fix-in-ide

https://app.codeant.ai/feedback

Use the body signature because GitLab and Azure DevOps can attribute CodeAnt comments to the connected human account. Do not require a bot author when the body signature matches, and do not run a separate identity-discovery or confirmation step. Do not classify a comment from the word

CodeAnt

alone; require an exact service-account name or CodeAnt action URL.

Skip general PR comments, summaries, quality-gate reports, system messages, deleted comments, drafts, and replies that do not begin an inline finding. If no matching suggestions remain, report that the PR has no unresolved CodeAnt inline suggestions and stop. Otherwise continue directly to validation.

2. Provider adapters

Choose only the matching adapter. Normalize each actionable item to:

text

thread_id, comment_id, author_id, body, path, line, url,
resolved, outdated_or_stale, provider

Retain provider-native IDs exactly because they are required for resolution.

GitHub

Require authenticated

gh

. Determine the PR and repository:

bash

gh auth status
gh pr view <number-or-url> --json number,title,url,state,headRefName,baseRefName
gh repo view --json nameWithOwner --jq .nameWithOwner

Without a PR number, try

gh pr view

on the current branch. If necessary, list exact branch matches:

bash

gh pr list --head "<branch>" --state open \
  --json number,title,url,state,headRefName,baseRefName

Fetch and paginate review threads with GitHub GraphQL. Use

--paginate --slurp

; the pagination variable must be named

$endCursor

bash

gh api graphql --paginate --slurp \
  -f owner='<owner>' \
  -f name='<repository>' \
  -F number=<pr-number> \
  -f query='query($owner: String!, $name: String!, $number: Int!, $endCursor: String) {
    repository(owner: $owner, name: $name) {
      pullRequest(number: $number) {
        number title url
        reviewThreads(first: 100, after: $endCursor) {
          nodes {
            id isResolved isOutdated
            comments(first: 100) {
              nodes {
                databaseId
                author { login }
                body path line originalLine createdAt url
              }
            }
          }
          pageInfo { hasNextPage endCursor }
        }
      }
    }
  }'

Retry this read-only fetch up to three times for transient HTTP 429, 502, 503, or 504 responses, honoring

Retry-After

when present. Do not retry authentication, authorization, schema, or validation errors.

Across every returned page, keep a thread only when:

```
isResolved
```
is
```
false
```
.
The root comment matches the CodeAnt author-or-body filtering rule.
The root comment has a non-null
```
path
```
; use
```
line
```
, falling back to
```
originalLine
```
only to locate historical context.

Carry

isOutdated

into stale validation. Resolve a successfully fixed thread with its GraphQL thread node ID, not the numeric comment ID:

bash

gh api graphql \
  -f threadId='<thread-node-id>' \
  -f query='mutation($threadId: ID!) {
    resolveReviewThread(input: {threadId: $threadId}) {
      thread { id isResolved }
    }
  }'

Require the response to confirm

isResolved: true

GitLab

Require authenticated

glab

. A GitLab merge request IID is project-local; do not confuse it with a global database ID.

bash

glab auth status
glab mr view <iid-or-url> --output json
glab repo view --output json

Without an IID, find the sole open MR whose

source_branch

exactly matches the current branch:

bash

glab mr list --source-branch "<branch>" --state opened --output json

Use the numeric project ID returned by

glab repo view

to avoid path-encoding errors. Fetch all discussion pages:

bash

glab api --paginate \
  "projects/<project-id>/merge_requests/<mr-iid>/discussions?per_page=100"

Keep a discussion only when:

```
individual_note
```
is
```
false
```
.
Its root note matches the CodeAnt author-or-body filtering rule. GitLab may show the connected human user as the author, so accept a matching CodeAnt action URL in
```
body
```
.
The CodeAnt root note is
```
resolvable: true
```
and
```
resolved: false
```
.
The note has a diff
```
position
```
with
```
new_path
```
or
```
old_path
```
; prefer
```
new_line
```
, otherwise use
```
old_line
```
for context.

Carry the discussion

id

thread_id

and the root note

id

comment_id

. Resolve a successfully fixed discussion:

bash

glab api --method PUT \
  "projects/<project-id>/merge_requests/<mr-iid>/discussions/<discussion-id>" \
  -f resolved=true

Require the returned discussion to show the relevant resolvable note as resolved.

Bitbucket Cloud

Use the Bitbucket Cloud REST API 2.0 with existing OAuth, access-token, or API-token authentication. Parse

<workspace>/<repo-slug>

from the remote or PR URL. Never echo the credential.

If no PR number was supplied, list open PRs and select the sole exact

source.branch.name

match. Use URL encoding for query values:

text

GET https://api.bitbucket.org/2.0/repositories/<workspace>/<repo-slug>/pullrequests
    ?state=OPEN&pagelen=100

Fetch all comment pages and follow the response's

next

URL until it is absent:

text

GET https://api.bitbucket.org/2.0/repositories/<workspace>/<repo-slug>/pullrequests/<pr-id>/comments
    ?pagelen=100

Keep a comment only when:

```
deleted
```
is not
```
true
```
and
```
pending
```
is not
```
true
```
.
It is a root comment, not a reply.
```
inline.path
```
is present; use
```
inline.to
```
for the new-file line or
```
inline.from
```
for the old-file line.
```
resolution
```
is null or absent.
The comment matches the CodeAnt author-or-body filtering rule using
```
user.nickname
```
,
```
user.display_name
```
, or
```
content.raw
```
.

Retain the root comment

id

. Resolve a successfully fixed thread:

text

POST https://api.bitbucket.org/2.0/repositories/<workspace>/<repo-slug>/pullrequests/<pr-id>/comments/<comment-id>/resolve
Accept: application/json

Require HTTP 200 and a returned resolution object. Never delete the comment as a substitute for resolving it.

Bitbucket Data Center

Use the host's

/rest/api/latest

API with existing bearer, personal-access-token, or session authentication. Parse

<base-url>

<project-key>

, and

<repo-slug>

from the remote or PR URL.

If no PR ID was supplied, paginate open PRs and select the sole item whose

fromRef.displayId

exactly matches the current branch:

text

GET <base-url>/rest/api/latest/projects/<project-key>/repos/<repo-slug>/pull-requests
    ?state=OPEN&limit=100&start=<offset>

nextPageStart

until

isLastPage

is true. Fetch all comment pages the same way:

text

GET <base-url>/rest/api/latest/projects/<project-key>/repos/<repo-slug>/pull-requests/<pr-id>/comments
    ?limit=100&start=<offset>

Keep root comments that match the CodeAnt author-or-body filtering rule using

author.name

author.slug

author.displayName

, or

text

, and whose

anchor.path

is present,

pending

is not true,

state

OPEN

, and

threadResolved

is false. Use

anchor.line

and the full anchored path.

To resolve a successfully fixed thread, first refetch the comment to obtain its current

version

, then update it with optimistic concurrency:

text

PUT <base-url>/rest/api/latest/projects/<project-key>/repos/<repo-slug>/pull-requests/<pr-id>/comments/<comment-id>
Content-Type: application/json

{
  "id": <comment-id>,
  "version": <current-version>,
  "text": <unchanged-current-text>,
  "state": "OPEN",
  "severity": <unchanged-current-severity>,
  "threadResolved": true
}

Preserve the current text, state, severity, and required properties. On HTTP 409, refetch and retry only if the thread is still the same unresolved comment. Require the response to show

threadResolved: true

Azure DevOps (ADO)

Use Azure DevOps REST API 7.1 with existing OAuth or PAT authentication. Parse the organization, project, and repository from the remote or PR URL. Prefer immutable repository and identity IDs. Do not log the

Authorization

header.

If no PR ID was supplied, URL-encode the full source ref and select the sole active exact match:

text

GET https://dev.azure.com/<organization>/<project>/_apis/git/repositories/<repository-id>/pullrequests
    ?searchCriteria.status=active
    &searchCriteria.sourceRefName=refs/heads/<branch>
    &$top=100
    &api-version=7.1

Fetch PR threads:

text

GET https://dev.azure.com/<organization>/<project>/_apis/git/repositories/<repository-id>/pullRequests/<pr-id>/threads
    ?api-version=7.1

Keep a thread only when:

```
status
```
is
```
active
```
or
```
pending
```
.

threadContext.filePath

is present; use

rightFileStart.line

, otherwise

leftFileStart.line

Its root non-system, non-deleted comment has
```
commentType: text
```
.
The root comment matches the CodeAnt author-or-body filtering rule using
```
author.uniqueName
```
,
```
author.displayName
```
, or
```
content
```
. Azure DevOps may show the connected human user as the author.

Carry the numeric thread

id

and root comment

id

. Resolve a successfully fixed thread by marking it fixed:

text

PATCH https://dev.azure.com/<organization>/<project>/_apis/git/repositories/<repository-id>/pullRequests/<pr-id>/threads/<thread-id>
Content-Type: application/json

{"status":"fixed"}

Use

api-version=7.1

and require the returned thread to show

status: fixed

. Do not use

closed

wontFix

, or

byDesign

for an applied fix.

3. Validate every finding

Group findings by file. For each finding:

Read the complete comment and at least 30 lines above and below the referenced line.
Inspect definitions, callers, tests, and repository guidance needed to understand the claimed behavior.
Identify the defect, expected behavior, reproduction path, and any fenced suggestion.
If the provider marks the position outdated, the file is gone, or current code no longer matches the claim, assign
```
STALE
```
unless the same defect clearly remains at the referenced code.
Treat Architect Review and Logical Review comments as actionable. Read the complete
```
Prompt for AI Agent
```
section and draft a localized fix when no suggestion is supplied.
Validate syntax, scope, imports, types, error handling, public interfaces, edge cases, concurrency, and compatibility with callers.
Prefer the smallest correct fix. Do not refactor adjacent code for style.

Assign exactly one verdict:

```
ACCEPT
```
: The defect is real and the localized fix is safe without changing a public contract or weakening handling.
```
LIKELY ACCEPT
```
: The fix is sound, but a behavior change may affect callers or requires targeted validation.
```
DO NOT ACCEPT
```
: The proposal is unsafe, unjustified, depends on unavailable APIs, or requires broader design work than a focused patch can safely provide.
```
STALE
```
: The referenced code or defect is no longer present.

Do not reject an Architect or Logical Review solely because it lacks a ready-made patch.

4. Present the plan before editing

Report the provider, PR number, title, link, and unresolved CodeAnt inline-thread count. Group every finding by verdict. For each, include:

File and line.
One-line issue summary.
Validation rationale.
Intended before/after change when applicable.
For
```
LIKELY ACCEPT
```
, the exact callers, tests, or behavior needing verification.

State that

ACCEPT

fixes are ready and ask whether to include named

LIKELY ACCEPT

fixes. Do not edit before approval. Never apply

DO NOT ACCEPT

STALE

findings.

5. Apply and verify

After approval:

Recheck
```
git status --short
```
and preserve pre-existing edits.
Apply only confirmed fixes to files referenced by comments, except narrowly required tests or imports.
Review the diff for accidental changes and interactions between fixes.
Run the narrowest relevant formatter, static checks, and tests; expand when shared behavior changed.
Repair only failures caused by these edits. If a fix cannot be verified, revert only that fix if safely separable, leave its thread unresolved, and report it.

6. Resolve and report

Resolving a thread is an external mutation. Resolve threads sequentially only after the user approved the corresponding fix and local verification passed. Continue after individual resolution failures.

Never resolve

DO NOT ACCEPT

STALE

, skipped, partially fixed, or unverified findings. Refetch thread state after resolution when the provider response is ambiguous.

Final report:

Applied and verified fixes with file, line, verdict, and test result.
Unapplied findings with verdict and reason.
Provider thread IDs resolved and any resolution failures.
Final
```
git status --short
```
and files changed by this workflow.

Offer to commit and push selected files. Do not commit or push without explicit approval.

Guardrails

Fetch every pagination page before claiming the list is complete.
Treat provider-native thread state as authoritative.
Validate suggestions individually; never batch-apply blindly.
Preserve unrelated user changes and avoid unrelated files.
Flag conflicting comments rather than choosing silently.
Never disclose access tokens, PATs, cookies, or verbose auth output.
Never install, invoke, or rely on
```
codeant-cli
```
for any step.

codeant-resolve-pr-comments

NPX Install

Tags

SKILL.md Content

Resolve CodeAnt PR Comments

Workflow

1. Preflight

Filter CodeAnt suggestions

2. Provider adapters

GitHub

GitLab

Bitbucket Cloud

Bitbucket Data Center

Azure DevOps (ADO)

3. Validate every finding

4. Present the plan before editing

5. Apply and verify

6. Resolve and report

Guardrails