bubbleptr/dureview is a self-hosted AI pull request review bot. Leave /dureview on a PR and you get inline comments graded P0–P3 as well as check run results. The latest commit c25334f (2026-10-29) is a fix that corrected the problem where the state value was passed incorrectly during the GitHub App registration step, causing GitHub to reject the manifest.
GitHub rejects the manifest with the "redirect_url must be a valid URL" error when the manifest's redirect_url carries a state query parameter. This change detaches state from redirect_url and attaches it instead when POSTing to GitHub's app creation address (settings/apps/new), and the returning request is identified by the presence of the code and state parameters rather than by the setup=github indicator. The changed files are src/github/manifest.ts, src/http/console.ts, src/service.ts and the corresponding test test/console-config.test.ts — four places in total — and the entire change is 28 lines (19 added, 9 deleted).
However, what this commit touches is only the state delivery in the registration flow, and the permissions and webhook settings declared in the manifest remain unchanged. The state is stored on the server with a 10-minute expiry, and the same way of attaching it is used for GitHub Enterprise organization addresses as well. There is no version notation or performance measurement in the commit message, and no license information was given either. Since it is a bug fix in a single settings screen, the functional change is not large, but its real effect is that, in environments where app installation was blocked, the procedure can now proceed.