feat(review): anchor-safety validation for inline suggestions (#2140)

[bohdansolovie]

Summary

• Extract pure inline-suggestion-anchor.ts to parse ADDED (+) RIGHT-side lines from unified-diff patches — the only lines GitHub accepts a ```suggestion block on
• Strip suggestion blocks when the finding anchor is a context line (plain inline comment is kept); files with no usable patch still drop un-anchorable findings
• Wire anchoredSuggestionBlock into formatInlineBody / selectInlineComments alongside existing fence-safety (One-click suggested-change blocks on inline review comments #1956)

Fixes #2140

Test plan

• inline-suggestion-anchor.test.ts — added vs context lines, empty patch, anchor checks, unsafe fences
• inline-comments.test.ts — context-line suggestion stripped; no-patch file drops finding
• npx tsc -p tsconfig.json --noEmit passes locally
• CI green including codecov/patch ≥99%

Made with Cursor

[loopover-orb]

Tip

🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩

✅ Gittensory review result - approve/merge recommended

_{Review updated: 2026-07-07 09:02:04 UTC}

4 files · 1 AI reviewer · no blockers · readiness 96/100 · CI green · clean

✅ Suggested Action - Approve/Merge

• safe to merge

Review summary
This PR extracts a pure `inline-suggestion-anchor.ts` module that parses ADDED (`+`) RIGHT-side lines from a unified-diff patch and gates whether a `finding` may carry a GitHub `suggestion` block, dropping the suggestion (but keeping the plain inline comment) when the anchor is a context line or the file has no usable patch. I traced `addedLinesFromPatch` by hand against the `mixedPatch` fixture and it correctly yields only line 2 (the `+added2` line), and the wiring into `formatInlineBody`/`selectInlineComments` correctly threads the new `addedLines` map alongside the existing fence-safety check from #1956. The change is small, well-tested (added-line parsing, context-line stripping, no-patch drop, unsafe-fence drop), and fail-safe by construction — I found no reachable defect.

Nits — 5 non-blocking

• `addedLinesFromPatch` (src/review/inline-suggestion-anchor.ts) duplicates the same `@​@​ -x +y @​@​` hunk-header parsing already implemented in `rightSideLinesFromPatch` (src/review/inline-comments-select.ts) — the two differ only in whether context lines are included; consider a single shared parser that returns both the right-side set and the added-only subset to avoid two near-identical hand-rolled diff parsers.
• src/review/inline-comments.ts:109 — `addedLinesByPath(files)` is computed unconditionally in `selectInlineComments` even when `suggestionsEnabled` is false (the default), re-parsing every file's patch on every review for no benefit; gate it with `suggestionsEnabled ? addedLinesByPath(files) : new Map()`.
• The doc comment above `anchoredSuggestionBlock` (inline-suggestion-anchor.ts) could note explicitly that it assumes GitHub rejects suggestion blocks on non-added lines — worth a one-line citation/link if that assumption came from a support thread or GitHub docs, since it's the load-bearing premise for the whole module.
• Factor the shared hunk-header regex + right-cursor loop (inline-suggestion-anchor.ts and inline-comments-select.ts) into one internal helper that both `addedLinesFromPatch` and `rightSideLinesFromPatch` call, returning `{added, rightSide}` in a single pass over the patch.
• Skip `addedLinesByPath` entirely when `suggestionsEnabled` is false at the `selectInlineComments` call site to avoid the wasted per-review patch parse.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ Linked	#2140
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (draft PR; 1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 376 registered-repo PR(s), 219 merged, 7 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	bohdansolovie; Gittensor profile; 376 PR(s), 7 issue(s).
Gate result	✅ Passing	No configured blocker found.

Review context

• Author: bohdansolovie
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: Python, C++, JavaScript
• Official Gittensor activity: 376 PR(s), 7 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Mark ready when done.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.70%. Comparing base (92a154b) to head (fb87abc).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #3974   +/-   ##
=======================================
  Coverage   93.70%   93.70%           
=======================================
  Files         373      374    +1     
  Lines       35076    35098   +22     
  Branches    12863    12870    +7     
=======================================
+ Hits        32868    32890   +22     
  Misses       1584     1584           
  Partials      624      624           

Files with missing lines	Coverage Δ
src/review/inline-comments.ts	100.00% <100.00%> (ø)
src/review/inline-suggestion-anchor.ts	100.00% <100.00%> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[loopover-orb]

Gittensory approves — the gate is satisfied and CI is green.