Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
41 commits
Select commit Hold shift + click to select a range
4dda9ee
feat(review): transfer per-file content verdicts across rebases
wenshao Aug 15, 2026
58ffea9
fix(review): resolve merge-conflict blocks committed into SKILL.md
wenshao Aug 15, 2026
7a95f44
fix(review): round-2 findings — narrow the candidate, consult verdict…
wenshao Aug 15, 2026
485011a
fix(review): round-3 findings — certify only what was reviewed, one e…
wenshao Aug 15, 2026
6c98cb5
Merge branch 'review-incremental/2-local-anchor' into review-incremen…
wenshao Aug 15, 2026
ffed4fe
fix(review): round-4 findings — police every persisted string, test t…
wenshao Aug 15, 2026
31f36b1
Merge branch 'review-incremental/2-local-anchor' into review-incremen…
wenshao Aug 16, 2026
0f7127d
Merge branch 'review-incremental/2-local-anchor' into review-incremen…
wenshao Aug 16, 2026
8b29078
fix(review): round-5 Criticals — unusable beats wrong, and no write f…
wenshao Aug 16, 2026
272f6e8
Merge branch 'review-incremental/2-local-anchor' into review-incremen…
wenshao Aug 16, 2026
393994c
fix(review): round-7 Criticals — certify only what was read, guard th…
wenshao Aug 16, 2026
33d0565
test(review): realpath the cache-commit fixture's temp dir
wenshao Aug 16, 2026
9bc29f2
Merge branch 'review-incremental/2-local-anchor' into review-incremen…
wenshao Aug 16, 2026
75386a5
fix(review): keep both report fields the merge collided on
wenshao Aug 16, 2026
f4c32a3
Merge branch 'review-incremental/2-local-anchor' into review-incremen…
wenshao Aug 17, 2026
ed7145e
Merge branch 'tmp-9190' into tmp-9191
wenshao Aug 17, 2026
c0f8b7b
Merge branch 'review-incremental/2-local-anchor' into review-incremen…
wenshao Aug 17, 2026
8306841
Merge remote-tracking branch 'origin/review-incremental/2-local-ancho…
wenshao Aug 17, 2026
95d3e68
Merge remote-tracking branch 'origin/review-incremental/2-local-ancho…
wenshao Aug 17, 2026
797b3e0
Merge branch 'tmp2' into tmp3
wenshao Aug 17, 2026
629b8f2
fix(review): repair the build, close the attributes hole, stop overcl…
wenshao Aug 18, 2026
7f86508
Merge remote-tracking branch 'origin/review-incremental/2-local-ancho…
wenshao Aug 18, 2026
31858f5
Merge branch 'review-incremental/2-local-anchor' into review-incremen…
wenshao Aug 18, 2026
24ce961
Merge branch 'review-incremental/2-local-anchor' into review-incremen…
wenshao Aug 18, 2026
192434f
Merge branch 'tmp2' into tmp3
wenshao Aug 18, 2026
d3634a8
Merge branch 'tmp2' into tmp3
wenshao Aug 18, 2026
b8f0c7c
fix(review): keep the attribute digest through promotion, guard both …
wenshao Aug 18, 2026
aa59c7a
Merge branch 'review-incremental/2-local-anchor' into review-incremen…
wenshao Aug 19, 2026
1c7760f
Merge branch 'tmp2' into tmp3
wenshao Aug 19, 2026
91879cc
fix(review): a refused candidate write costs the anchor, not the round
wenshao Aug 19, 2026
621dc74
Merge branch 'tmp2' into tmp3
wenshao Aug 19, 2026
b037b44
Merge remote-tracking branch 'origin/review-incremental/2-local-ancho…
wenshao Aug 19, 2026
d560012
merge: take the shared safeTarget, keep this branch's parent guard
wenshao Aug 20, 2026
563971d
Merge branch 'review-incremental/2-local-anchor' of github.com:QwenLM…
wenshao Aug 20, 2026
e5765e1
merge: union the subcommand list and the path-helper tests
wenshao Aug 20, 2026
c4f652a
merge: keep this branch's guard import, and its own DESIGN paragraph
wenshao Aug 20, 2026
8295083
Merge branch 'review-incremental/2-local-anchor' of github.com:QwenLM…
wenshao Aug 20, 2026
a4467d4
Merge branch 'review-incremental/2-local-anchor' of github.com:QwenLM…
wenshao Aug 21, 2026
6e67308
Merge branch 'review-incremental/2-local-anchor' of github.com:QwenLM…
wenshao Aug 21, 2026
54785b0
merge: let the candidate's identity win cache-commit's merge
wenshao Aug 21, 2026
53817ae
merge: union the fs imports and the plan's new stop field
wenshao Aug 21, 2026
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions packages/cli/src/commands/review.test.ts
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,7 @@ describe('reviewCommand', () => {
'fetch-pr',
'capture-local',
'plan-diff',
'cache-commit',
'repo-context',
'pr-context',
'comment-status',
Expand Down
4 changes: 3 additions & 1 deletion packages/cli/src/commands/review.ts
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@ import { recoverFindingsCommand } from './review/recover-findings.js';
import { fetchPrCommand } from './review/fetch-pr.js';
import { captureLocalCommand } from './review/capture-local.js';
import { planDiffCommand } from './review/plan-diff.js';
import { cacheCommitCommand } from './review/cache-commit.js';
import { repoContextCommand } from './review/repo-context.js';
import { prContextCommand } from './review/pr-context.js';
import { commentStatusCommand } from './review/comment-status.js';
Expand Down Expand Up @@ -62,6 +63,7 @@ export const reviewCommand: CommandModule = {
.command(fetchPrCommand)
.command(captureLocalCommand)
.command(planDiffCommand)
.command(cacheCommitCommand)
.command(repoContextCommand)
.command(prContextCommand)
.command(commentStatusCommand)
Expand Down Expand Up @@ -90,7 +92,7 @@ export const reviewCommand: CommandModule = {
.command(cleanupCommand)
.demandCommand(
1,
'Specify a subcommand: run, parse-args, match-remote, meta, issue-context, fetch-diff, comment-body, fetch-pr, capture-local, plan-diff, repo-context, pr-context, comment-status, load-rules, agent-prompt, build-test, base-tree, scratch-tree, test-delta, drive, mock-provider, extract-step, script-lint, resolve-anchors, check-coverage, cost-ledger, presubmit, test-efficacy, test-plan, findings, recover-findings, publish-assets, compose-review, save-artifact, submit, or cleanup.',
'Specify a subcommand: run, parse-args, match-remote, meta, issue-context, fetch-diff, comment-body, fetch-pr, capture-local, plan-diff, cache-commit, repo-context, pr-context, comment-status, load-rules, agent-prompt, build-test, base-tree, scratch-tree, test-delta, drive, mock-provider, extract-step, script-lint, resolve-anchors, check-coverage, cost-ledger, presubmit, test-efficacy, test-plan, findings, recover-findings, publish-assets, compose-review, save-artifact, submit, or cleanup.',
)
.version(false),
handler: () => {
Expand Down
5 changes: 3 additions & 2 deletions packages/cli/src/commands/review/agent-prompt.ts
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,7 @@
// remember.

import type { CommandModule } from 'yargs';
import { displayAnchor } from './lib/report.js';
import { createHash } from 'node:crypto';
import { readFileSync } from 'node:fs';
import { dirname, join, resolve } from 'node:path';
Expand Down Expand Up @@ -733,7 +734,7 @@ export function buildChunkAgentPrompt(
const lines = [
'',
`**This is an INCREMENTAL round** — the diff holds only what changed since the ` +
`previous clean review round (anchor \`${inertPath(incremental.anchor.slice(0, 12))}\`), ` +
`previous clean review round (anchor \`${inertPath(displayAnchor(incremental.anchor))}\`), ` +

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[Suggestion] R4-6: The removed .slice(0, 12) incidentally bounded the interpolated anchor; displayAnchor only truncates 40–64-hex labels, inertPath substitutes characters but has no length cap, and incrementalScopeOf validates the anchor only as a non-empty string — so an arbitrary-size non-hex anchor now reaches every chunk brief (this site) and role brief (the twin at ~999). — Failure scenario: the plan file is parsed off disk with field-by-field re-validation precisely because it is untrusted input; a tampered plan with a multi-megabyte incremental.anchor injects it into every agent brief, blowing the brief size budget this file otherwise enforces with SCOPE_LIST_CAP/SCOPE_EDGE_CAP. Legitimate producers are bounded (rescope's 7–64-hex gate or the literal content-verdicts), so only a tampered plan triggers this — the old code bounded that case at 12 chars. Suggested fix: in incrementalScopeOf, reject or truncate over-length anchors (e.g. raw.anchor.length > 64 → return null, matching the degrade-to-full-scope policy), or clamp displayAnchor's output to a fixed display length.

中文说明

建议:被移除的 .slice(0, 12) 附带地限制了被内插锚点的长度;displayAnchor 只截断 40–64 位十六进制标签,inertPath 替换字符但不限长,incrementalScopeOf 只校验锚点为非空字符串——于是任意长度的非十六进制锚点现在会进入每个分块 brief(本处)与角色 brief(~999 处的孪生点)。

失败场景:plan 文件之所以逐字段重新校验,正因为它是不可信输入;篡改的 plan 用数 MB 的 incremental.anchor 把该字符串注入每个代理 brief,击穿本文件用 SCOPE_LIST_CAP/SCOPE_EDGE_CAP 维护的 brief 体积预算。合法生产者是有界的(rescope 的 7–64 hex 门或字面量 `content-verdicts``),因此只有篡改的 plan 能触发——旧代码把该情形限制在 12 字符。

建议修复:在 incrementalScopeOf 中拒绝或截断超长锚点(如 raw.anchor.length > 64 → return null,与降级到全量范围的策略一致),或给 displayAnchor 的输出加上固定显示长度上限。

— qwen3.8-max via Qwen Code /review (v0.21.12)

`plus still-clean files one import hop from a change. Your files' scopes:`,
];
if (deltaHere.length > 0) {
Expand Down Expand Up @@ -1103,7 +1104,7 @@ function diffReadingBlock(
...(incremental
? [
`**Incremental round.** This diff is scoped to what changed since the previous ` +
`clean review round (anchor \`${inertPath(incremental.anchor.slice(0, 12))}\`), plus ` +
`clean review round (anchor \`${inertPath(displayAnchor(incremental.anchor))}\`), plus ` +
`still-clean files one import hop from a change — each of those is in scope ` +
`only for its interaction with what it imports. The rest of the change was ` +
`reviewed clean last round and is deliberately absent; do not go find it. ` +
Expand Down
Loading
Loading