feat(review): anchor-safety validation drops un-commentable suggested changes

[jimcody1995]

Summary

• Add addedLinesFromPatch — the ADDED ("+") subset of rightSideLinesFromPatch.
• In selectInlineComments, keep plain inline comments on context lines but strip GitHub ```suggestion blocks unless the finding anchor is an added line (avoids 422s).
• Files with no usable patch still produce no inline comments.

Fixes #2140

Scope

• Conventional Commit title format.
• Focused — src/review/inline-comments.ts + unit tests only.
• Open issue feat(review): anchor-safety validation drops un-commentable suggested changes #2140 (unassigned, not maintainer-only).

Validation

• git diff --check
• npx vitest run test/unit/inline-comments.test.ts — 36 passed

Conflict avoidance

Touches only inline-comments.ts and its test file. No overlap with open PRs (#3823–#3836) which touch processors, commands, focus-manifest, unified-comment-bridge, or local-write-tools.

Made with Cursor

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

❌ Patch coverage is 95.00000% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 93.41%. Comparing base (ca6a6d7) to head (80cc531).

Files with missing lines	Patch %	Lines
src/review/inline-comments.ts	95.00%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #3837   +/-   ##
=======================================
  Coverage   93.41%   93.41%           
=======================================
  Files         326      326           
  Lines       32855    32873   +18     
  Branches    12035    12040    +5     
=======================================
+ Hits        30691    30708   +17     
  Misses       1530     1530           
- Partials      634      635    +1     

Files with missing lines	Coverage Δ
src/review/inline-comments.ts	98.63% <95.00%> (-1.37%)	⬇️

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Caution

🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥

🛑 Gittensory review result - fixes required

_{Review updated: 2026-07-06 14:03:57 UTC}

2 files · 1 AI reviewer · no blockers · readiness 100/100 · CI failing · unstable

🛑 Suggested Action - Fix Blockers

Review summary
This PR adds addedLinesFromPatch (a strict subset of rightSideLinesFromPatch limited to "+" lines) and uses it in selectInlineComments to gate whether a finding's GitHub suggestion block is rendered, while still allowing the plain inline comment on context lines. The logic is correct: suggestionAnchorable now requires the finding's line to be in the added-lines set for that path, and formatInlineBody is called with that flag instead of the raw suggestionsEnabled flag, so a context-line finding keeps its comment but loses the ```suggestion``` fence (avoiding the 422). Tests directly exercise all three new branches (context-line strip, added-line pass-through, no-patch file drop) and the traced logic matches the new function's line-by-line hunk parsing.

Nits — 4 non-blocking

• addedLinesFromPatch (src/review/inline-comments.ts:69-84) duplicates almost all of rightSideLinesFromPatch's hunk-parsing loop; consider extracting a shared line-classifier to avoid two copies of the header regex/marker logic drifting apart.
• codecov/patch is at 95% vs the 99% target — likely the marker===undefined (trailing-split) branch in the new addedLinesFromPatch isn't exercised by a dedicated test the way rightSideLinesFromPatch's trailing-newline regression test covers it.
• Add a trailing-newline test for addedLinesFromPatch mirroring the existing rightSideLinesFromPatch regression test to close the coverage gap and guard the same edge case in the new function.
• Factor the shared hunk-walk (header parse + marker switch) into a single internal helper parameterized by which markers to include, called by both rightSideLinesFromPatch and addedLinesFromPatch.

CI checks failing

• codecov/patch — 95.00% of diff hit (target 99.00%)

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ Linked	#2140
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 132 registered-repo PR(s), 90 merged, 0 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	jimcody1995; Gittensor profile; 132 PR(s), 0 issue(s).
Gate result	✅ Passing	No configured blocker found.

Review context

• Author: jimcody1995
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: TypeScript, JavaScript
• Official Gittensor activity: 132 PR(s), 0 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Keep the PR focused and include validation evidence before maintainer review.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review

[loopover-orb]

Gittensory is closing this pull request on the maintainer's behalf (CI is failing (codecov/patch)). This is an automated maintenance action — to pursue this change, please open a new pull request with the issues resolved. Closed PRs may be analyzed later to improve review accuracy, but they are not automatically reopened or re-reviewed.