code-review plugin completes review but produces empty result — no PR comment posted

[nao-de]

Describe the bug

The code-review@claude-code-plugins plugin successfully performs a full code review (spawns parallel review agents, validates findings, outputs a formatted summary), but the session ends with "result": "", so no comment is ever posted to the PR.

The root cause appears to be that the plugin's final turn is a TodoWrite tool call (marking its last checklist item as "completed") rather than a text message. The actual review summary was generated as a text content block in an earlier turn, but the result capture doesn't pick it up.

Post-processing logs confirm nothing was posted:
No buffered inline comments

To Reproduce

1. Configure the code-review@claude-code-plugins plugin as shown in the workflow below.
2. Open a PR with non-trivial code changes (mine had ~1000 lines across migrations, API hooks, and components).
3. Add a label to trigger the workflow.
4. The action runs for ~7 minutes, completes successfully (exit code 0, 24 turns).
5. No comment appears on the PR.

Expected behavior

The review summary should be posted as a PR comment. The plugin generates a thorough review (in my case it correctly identified 2 real bugs with file/line references), but the output is lost because the session result is empty.

Workflow yml file

name: Claude Code Review

on:
  pull_request:
    types: [opened, synchronize, ready_for_review, reopened, labeled]

jobs:
  claude-review:
    if: contains(github.event.pull_request.labels.*.name, 'claude-review')
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
      issues: write
      id-token: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - name: Run Claude Code Review
        id: claude-review
        uses: anthropics/claude-code-action@v1
        with:
          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
          plugin_marketplaces: '[https://github.com/anthropics/claude-code.git](https://github.com/anthropics/claude-code.git)'
          plugins: 'code-review@claude-code-plugins'
          prompt: '/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }}'
          claude_args: "--allowedTools Bash(gh:*)"
          show_full_output: true

Additional context

Key details from the session log with show_full_output:
true:

• Claude Code v2.1.79, models: claude-opus-4-6 (outer),
  claude-sonnet-4-6 + claude-opus-4-6 (review agents)
• Session completed normally: "stop_reason": "end_turn",
  24 turns, ~7 min
• The review text was output in message
  msg_01A2MbGXySsa12kEoF6QZHZ4 as a text content block, but
  that same message also contained a TodoWrite tool call.
  The plugin's final message was the TodoWrite response,
  leaving "result": "".
• The --allowedTools Bash(gh:*) flag was added to grant gh
  CLI access, which resolved an earlier permission denial
  issue — but the plugin never reaches the point of calling
  gh to post comments because it ends on the TodoWrite
  instead.

[lewispierson]

We're also experiencing this exact issue. Setup via /install-github-app on a Max plan using claude_code_oauth_token.

Observations from three separate runs:

Run	Turns	Cost (equiv.)	Permission denials	Comments posted
1	14	$0.95	2	0
2	24	$1.71	7	0
3	31	$2.05	8	0

All runs completed successfully (is_error: false), all logged No buffered inline comments in post-processing.

Worth noting: the /install-github-app command silently creates claude-code-review.yml alongside claude.yml, but the generated PR description only describes the @claude mention workflow — no mention of auto code review. So users may not realise they're running (and paying for) a broken review workflow on every PR push.

The @claude mention workflow (claude.yml) works fine and posts comments as expected.