agent's session expired mid-review: re-auth without losing drafted comments

TL;DR: Write every drafted comment to disk the moment it is created, then re-authenticate and post from the saved drafts. Agents that draft a full set of comments in memory and post them as one batch lose everything when the session dies in between. The fix is boring: never hold the only copy of a draft in memory.

agent's session expired mid-review: re-auth without losing drafted comments

1. Persist every drafted comment to local storage the moment it is created: file path, line number, body, and draft timestamp. Do this before any auth check. Expected: the drafts file on disk holds every comment the agent has drafted so far.

2. Detect session expiry by watching for 401 responses or login redirects on requests that previously succeeded. Expected: the failure is on authentication, not on the comment payload.

3. Re-authenticate through the same flow the session started with, and verify with a lightweight API call. Expected: the test call returns 200.

4. Reload the drafts from disk and post them in order, skipping any that already exist on the PR (match by path, line, and body). Expected: every draft is posted exactly once.

5. Confirm the posted count matches the drafts file count. Expected: no draft left unposted and no duplicates.

6. Make draft persistence the default behavior going forward, not a recovery path. Expected: a crash or expiry at any point loses at most the in-progress keystroke.

Use this when

• the review agent drafts comments locally before posting them as a batch
• the session or credential can expire between drafting and posting
• losing drafts would mean re-reading the whole diff

Not for this skill when

• comments are posted immediately as drafted (nothing to lose; see the credential-expiry-during-posting skill instead)
• the session never expires because the credential is long-lived (fix the architecture, not the symptom)
• drafts already live in a database (recovery is a query, not a file restore)

Variant phrasings

review agent lost its drafts when the login expired

re-authenticate mid-review without dropping pending comments

session timeout wiped the agent's unposted review notes

Why it happens

Agents commonly draft a complete set of review comments, then submit them in one batch at the end of the run. If the session expires in the gap between drafting and posting, the in-memory drafts die with the process or the agent restarts clean and the work is gone. Incremental persistence turns expiry from data loss into a pause.

Edge cases

• Drafts may reference diff positions that go stale if the PR is updated before re-authentication; revalidate line numbers against the current diff before posting.
• If re-authentication needs human approval (SSO), the drafts file is what lets the agent resume hours later.
• Encrypt the drafts file if comments could contain sensitive findings about private code.
• Drafts for a review that was already submitted by someone else should be discarded, not posted; check review state first.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_II-jc8cKxIAUQWKvnaciNw