feat!: surface unresolved PR comments and tasks to agents

[vriesdemichael]

Closes #306.

Eight commits, stacked. The first three are the feature; the rest are things it uncovered that had to be fixed for it to work correctly against a real server.

---

1. Unresolved comments and tasks (issue #306)

An agent working a PR with reviewers had no way to see anything was waiting on it, and had to be told that comments and tasks were two separate commands.

bb pr get now carries a review_summary with a single action_required flag:

#42	OPEN	feature/my-work -> main	Add payment retries
Reviewers: 2
Open items: 3 unresolved comments, 1 open task
Needs work: carol

bb pr comment list returns comment threads and tasks together, unresolved first — Bitbucket models a task as a blocker comment, so one call now answers what took two. New --unresolved, --state, --tasks-only, --with-replies. bb pr list shows per-PR counts.

Counts are absent rather than zero when they could not be measured, with counts_source naming the source. Reporting an unmeasured count as zero would make a PR with open feedback look clean — the exact failure this exists to prevent.

Also: MCP tools carry the summary, published output schemas for both commands (validated against real command output across 8 invocation variants), and a rewritten SKILL.md.

⚠️ Breaking: bb pr comment list --json emits the summarised thread view instead of raw comment objects, which embedded an entire pull request per comment. --full restores the old payload; bb pr comment get is unchanged.

2. Two Bitbucket bugs found by verifying against a real server

OPENAPI-007 — the activity timeline serialises an inline comment's anchor.path as a string while the spec models an object, so one inline comment made the whole page fail to decode. bb pr comment list has been returning nothing for any PR with inline review comments.

OPENAPI-008 — a retired endpoint and a missing resource are both 404s but differ in body shape. Separating them lets the summary degrade only for features a server lacks and report everything else.

3. The CI gap

bb pr task * calls an endpoint Atlassian removed in 8.0. It 404s against this repo's own stack and CI was green, because the live tests hid it:

if strings.Contains(strings.ToLower(err.Error()), "not_found") {
    t.Skipf("pull request task endpoint unavailable in live environment: %v", err)
}

A skipped test looks identical to a passing one. tools/cli-live-coverage reports a command whose only live coverage can skip itself on error as masked, not covered. Current: 53% asserted, 4 masked (exactly the broken pr task * set), 101 never invoked. Baseline + ratchet, static analysis, no live infra needed.

4. The generated client was not reproducible

Collision suffixes were assigned while ranging over a Go map, so the same spec produced a different operationId→endpoint mapping every run — whether Get3WithResponse hit /basicauth/latest/config or a pull-request endpoint was decided by chance. Invisible because models:verify and client:verify were never run by CI. Both now are.

5. Vendoring the Bitbucket 10.2 spec

The reference was 9.4 while the stack and live suite run 10.2 — that drift is why the retired endpoint survived. Almost entirely additive, but 10.2 raises required-field counts from 27 to 117, so codegen emits values where 9.4 emitted pointers; ~30 call sites adjusted. One behavioural change the compiler caught: fork-sync moved GetStatus2 → GetStatus.

Per ADR 042 this states no supported version — the spec is provenance for the generated client, not a claim about which servers work. defaultBitbucketVersionTarget stays empty and ADR 018 stays superseded.

⚠️ Breaking: generated models expose required fields as values, and RestReviewerGroup drops displayName. Consumers of the generated packages must adjust. The bb surface and JSON output are unchanged.

6. Tests must not reconfigure the repo they run in

Backend.Clone persists http.extraHeader, and a test that once pointed it at the working copy wrote this into this repo's .git/config:

http.extraheader = Authorization: Basic <base64 of dummy-user:dummy-password>
user.name        = Test User
user.email       = test@example.local

An unscoped http.extraHeader beats any credential helper, so every git push sent dummy-user:dummy-password and was rejected with "Password authentication is not supported for Git operations" — which reads like a bad token and sends you hunting in the wrong place. The identity override authored real commits as Test User <test@example.local>, including some already on main.

internal/git/gittest snapshots repository-scoped config before each package's tests and fails on any change, naming the keys. Before/after comparison, so a developer's own settings are invisible to it. Its git calls use execgit.ScopeFreeEnv so it inspects the right repository under a hook.

---

Verification

• Full unit suite and full live suite green against the container stack
• models:verify / client:verify clean — generated code reproduces byte-identically
• Patch coverage 95%, combined scoped 91%
• Docs build strictly; decisions validate; all generated artifacts regenerated

Note

Two feat!: commits, so merging cuts v2.0.0. Retitle them if you'd rather not.

docker/README.md still says 9.4.16 while the stack runs 10.2 — under ADR 042 the fix is to delete that line, not update it, so I left it alone.

🤖 Generated with Claude Code