From e0bd984975b0739e10a5136f619a5797eb1b7723 Mon Sep 17 00:00:00 2001
From: "pullfrog[bot]" <226033991+pullfrog[bot]@users.noreply.github.com>
Date: Fri, 27 Feb 2026 11:23:56 +0000
Subject: [PATCH] Restrict `create_pull_request_review` comments to PR diff
 (#339)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* restrict review comments to PR diff in tool description

* fix constraint text: only files (not lines) are restricted to the diff

* Revert "fix constraint text: only files (not lines) are restricted to the diff"

This reverts commit 3f2e3d05e41c308f6640a468230fb0d69c0cc3e1.

---------

Co-authored-by: pullfrog[bot] <226033991+pullfrog[bot]@users.noreply.github.com>
Co-authored-by: Mateusz Burzyński <mateuszburzynski@gmail.com>
---
 entry         | 6 ++++--
 mcp/review.ts | 9 +++++++--
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/entry b/entry
index 88e14ee..f73cb49 100755
--- a/entry
+++ b/entry
@@ -143259,7 +143259,9 @@ var CreatePullRequestReview = type({
   ).optional(),
   commit_id: type.string.describe("Optional SHA of the commit being reviewed. Defaults to latest.").optional(),
   comments: type({
-    path: type.string.describe("The file path to comment on (relative to repo root)"),
+    path: type.string.describe(
+      "The file path to comment on (relative to repo root). Must be a file that appears in the PR diff."
+    ),
     line: type.number.describe(
       "End line of the comment range. For single-line comments, set equal to 'start_line'. Use NEW column from diff format."
     ),
@@ -143280,7 +143282,7 @@ var CreatePullRequestReview = type({
 function CreatePullRequestReviewTool(ctx) {
   return tool({
     name: "create_pull_request_review",
-    description: `Submit a review for an existing pull request. IMPORTANT: 95%+ of feedback should be in 'comments' array with file paths and line numbers. Only use 'body' for a 1-2 sentence summary with urgency and critical callouts. Use 'suggestion' to propose replacement code - MUST preserve exact indentation of original code. Example replacing lines 42-44 (3 lines) with 5 lines: { path: 'src/api.ts', start_line: 42, line: 44, suggestion: '    const result = await fetch(url);\\n    if (!result.ok) {\\n      log.error(result.status);\\n      throw new Error("request failed");\\n    }' }`,
+    description: `Submit a review for an existing pull request. IMPORTANT: 95%+ of feedback should be in 'comments' array with file paths and line numbers. Only use 'body' for a 1-2 sentence summary with urgency and critical callouts. Use 'suggestion' to propose replacement code - MUST preserve exact indentation of original code. Example replacing lines 42-44 (3 lines) with 5 lines: { path: 'src/api.ts', start_line: 42, line: 44, suggestion: '    const result = await fetch(url);\\n    if (!result.ok) {\\n      log.error(result.status);\\n      throw new Error("request failed");\\n    }' } CONSTRAINT: Inline comments can ONLY target files and lines that appear in the PR diff. Commenting on files or lines outside the diff will cause GitHub API errors. Put feedback about code outside the diff in 'body' instead.`,
     parameters: CreatePullRequestReview,
     execute: execute(async ({ pull_number, body, commit_id, comments = [] }) => {
       ctx.toolState.issueNumber = pull_number;
diff --git a/mcp/review.ts b/mcp/review.ts
index 979b7ab..6e5c599 100644
--- a/mcp/review.ts
+++ b/mcp/review.ts
@@ -19,7 +19,9 @@ export const CreatePullRequestReview = type({
     .describe("Optional SHA of the commit being reviewed. Defaults to latest.")
     .optional(),
   comments: type({
-    path: type.string.describe("The file path to comment on (relative to repo root)"),
+    path: type.string.describe(
+      "The file path to comment on (relative to repo root). Must be a file that appears in the PR diff."
+    ),
     line: type.number.describe(
       "End line of the comment range. For single-line comments, set equal to 'start_line'. Use NEW column from diff format."
     ),
@@ -57,7 +59,10 @@ export function CreatePullRequestReviewTool(ctx: ToolContext) {
       "Only use 'body' for a 1-2 sentence summary with urgency and critical callouts. " +
       "Use 'suggestion' to propose replacement code - MUST preserve exact indentation of original code. " +
       "Example replacing lines 42-44 (3 lines) with 5 lines: " +
-      `{ path: 'src/api.ts', start_line: 42, line: 44, suggestion: '    const result = await fetch(url);\\n    if (!result.ok) {\\n      log.error(result.status);\\n      throw new Error("request failed");\\n    }' }`,
+      `{ path: 'src/api.ts', start_line: 42, line: 44, suggestion: '    const result = await fetch(url);\\n    if (!result.ok) {\\n      log.error(result.status);\\n      throw new Error("request failed");\\n    }' }` +
+      " CONSTRAINT: Inline comments can ONLY target files and lines that appear in the PR diff." +
+      " Commenting on files or lines outside the diff will cause GitHub API errors." +
+      " Put feedback about code outside the diff in 'body' instead.",
     parameters: CreatePullRequestReview,
     execute: execute(async ({ pull_number, body, commit_id, comments = [] }) => {
       // set issue context (PRs are issues)