fix(ci): self-heal failed checkouts on the reused review runners by wenshao · Pull Request #9220 · QwenLM/qwen-code

wenshao · 2026-08-15T09:34:33Z

What this PR does

The automatic review job checks out the base branch on the reused self-hosted runner pool, and a failed checkout was terminal: the job died and nothing ever repaired the workspace it failed on. This PR makes that checkout self-healing: when the first attempt fails, the runner wipes the entire persisted workspace and retries the identical checkout once (same pinned action, same ref, same full-history fetch) before giving up. When the first attempt succeeds, nothing changes — the heal steps are gated on the first checkout's outcome and stay skipped.

Why it's needed

Between 2026-08-13 and 2026-08-15, seven review jobs landing on one runner (ecs-qwen-runner-64c-23) failed at checkout with remote did not send all necessary objects, every time citing the SAME missing commit SHAs. The persisted workspace repository was corrupt — local refs claimed objects missing from the object store — so every fetch died in negotiation, and the machine was a guaranteed failure for every review dispatched to it for two days. Two further checkout failures in the same window were transient network drops mid-fetch (curl 92 HTTP/2 stream CANCEL / early EOF). Nothing recreates the workspace today, so one corruption permanently poisons a runner for this workflow; the workspace is fully disposable (later steps reinstall dependencies and tools), so wiping it and re-cloning is always a safe recovery.

Reviewer Test Plan

How to verify

The happy path is unchanged: the heal steps only run when the first checkout fails. On failure, the wipe step deletes the whole workspace (guarded by ${GITHUB_WORKSPACE:?} so an unset variable fails loudly instead of removing something unintended, with a passwordless-sudo fallback for root-owned leftovers, matching the existing ownership-restore step), recreates the directory, and the retry runs the byte-identical checkout. Thirteen new tests pin the chain: the first checkout is survivable and addressable, the heal gates fire exactly on outcome == 'failure' in the right order, the retry is identical to the first checkout (pin, ref, fetch-depth), the REAL wipe script empties and recreates a scratch workspace when executed, the guard refuses every suspicious and allowlist-escaping workspace path without ever invoking rm, and the script refuses to run when GITHUB_WORKSPACE or RUNNER_WORKSPACE is empty. Run npx vitest run --config ./scripts/tests/vitest.config.ts scripts/tests/qwen-pr-review-workflow.test.js — 131 tests pass. The suite is also exercised against a simulated BSD userland (a realpath on PATH that rejects -m, the way Darwin's does) and against a symlinked TMPDIR, because the canonicalization the guard relies on is a GNU-only flag: the assertions that depend on it are gated on a host probe, so the suite is green on a non-GNU host instead of failing there for a defect the Linux-only review pool cannot have. Durable confirmation will come from the next real checkout failure on the pool; note that until this merges, ecs-qwen-runner-64c-23 still needs a manual workspace wipe (or the runner drained), since the heal only ships with the workflow change.

Evidence (Before & After)

N/A — CI infrastructure change, no user-visible output. Before: seven consecutive failed checkouts on one runner with identical missing-SHA annotations (Could not read 0dcf7140…, Failed to traverse parents of commit …, remote did not send all necessary objects), visible in the workflow run annotations for 2026-08-13..15. After: the first such failure wipes the workspace once and the retry clones fresh; a second consecutive failure on a healed workspace is what would indicate a deeper problem.

Tested on

OS	Status
🍏 macOS	⚠️
🪟 Windows	N/A
🐧 Linux	✅

Environment (optional)

Unit tests only: vitest against the workflow YAML, including executing the wipe script itself, on Linux — macOS is covered by simulating its userland (a non-GNU realpath) and its symlinked temp directory, not by running on a Mac. The retry path will exercise for real on the self-hosted pool's next checkout failure.

Risk & Scope

Main risk or tradeoff: a failed checkout now spends one extra full-history clone before succeeding or failing for good; the wipe deletes everything in the persisted workspace, which is intentional — everything there is recreated by later steps.
Not validated / out of scope: the root cause of the corruption (most likely a killed git operation or a root-owned job writing into the shared workspace — the same runner's temp dir shows root-owned leftovers from another job's tmux run) is not fixed, only contained; sibling workflows on the same pool do not get their own heal, though the first healed review run cleans the shared workspace for them.
Breaking changes / migration notes: none.

Linked Issues

None — observed directly in CI run annotations; no open issue tracks this.

中文说明

这个 PR 做了什么

自动 review job 在复用的 self-hosted runner 池上 checkout base 分支，此前 checkout 一旦失败就是终局：job 直接挂掉，而它失败所依赖的那个 workspace 永远不会被修复。本 PR 让这个 checkout 具备自愈能力：第一次失败时，runner 会清掉整个持久化 workspace，然后用完全相同的参数（同一个 pin 的 action、同一个 ref、同样完整历史 fetch）重试一次 checkout，再失败才算失败。第一次就成功时什么都不会变——自愈步骤以第一次 checkout 的 outcome 为条件，正常情况下全部跳过。

为什么需要

2026-08-13 到 08-15 之间，落在同一台 runner（ecs-qwen-runner-64c-23）上的 7 个 review job 全部在 checkout 阶段以 remote did not send all necessary objects 失败，而且每次引用的都是完全相同的缺失 commit SHA。持久化 workspace 里的 git 仓库已损坏——本地 ref 指向对象库中不存在的对象——于是每次 fetch 都在协商阶段死掉，这台机器连续两天对所有调度过来的 review 都是必挂。同一窗口内另有两次 checkout 失败是 fetch 中途的网络瞬断（curl 92 HTTP/2 stream CANCEL / early EOF）。目前没有任何机制会重建 workspace，所以一次损坏就会让某台 runner 对这个 workflow 永久中毒；而 workspace 本身是完全可再生的（后续步骤会重新安装依赖和工具），因此清掉重clone永远是安全的恢复手段。

Reviewer 测试计划

如何验证

正常路径不变：自愈步骤只在第一次 checkout 失败时运行。失败时，wipe 步骤删除整个 workspace（用 ${GITHUB_WORKSPACE:?} 保护，变量未设置时会响亮报错而不是误删，并带免密 sudo 兜底处理 root 属主残留，与现有的属主恢复步骤同一模式），重建目录，然后用字节级一致的参数重试 checkout。新增 13 个测试钉住整条链：第一次 checkout 可存活且可被引用、自愈条件恰好在 outcome == 'failure' 时按正确顺序触发、重试与第一次 checkout 完全一致（pin、ref、fetch-depth）、真实执行 wipe 脚本验证它能清空并重建临时 workspace、guard 对所有可疑路径以及能逃出 allowlist 的路径都拒绝执行且从不调用 rm、以及 GITHUB_WORKSPACE 或 RUNNER_WORKSPACE 为空时脚本拒绝运行。运行 npx vitest run --config ./scripts/tests/vitest.config.ts scripts/tests/qwen-pr-review-workflow.test.js，131 个测试全部通过。此外还在模拟的 BSD userland（PATH 上放一个像 Darwin 那样拒绝 -m 的 realpath）和软链 TMPDIR 下跑过：guard 依赖的规范化用的是 GNU 独有参数，因此依赖它的断言以主机探测为前提跳过——在非 GNU 主机上套件保持绿色，而不是为一个 Linux-only runner 池不可能出现的缺陷变红。持久的确认要等 runner 池上下一次真实的 checkout 失败；注意在本 PR 合入之前，ecs-qwen-runner-64c-23 仍需要手动清一次 workspace（或先下线该 runner），因为自愈是随 workflow 变更才生效的。

Before / After 证据

N/A——CI 基础设施改动，无用户可见输出。Before：同一台 runner 上连续 7 次 checkout 失败，annotation 中的缺失 SHA 完全相同（Could not read 0dcf7140…、Failed to traverse parents of commit …、remote did not send all necessary objects），见 2026-08-13..15 的 workflow run annotations。After：第一次此类失败会清一次 workspace，重试重新 clone；只有在自愈后的 workspace 上再次连续失败，才说明有更深层的问题。

测试平台

OS	状态
🍏 macOS	⚠️
🪟 Windows	N/A
🐧 Linux	✅

环境（可选）

仅单元测试：vitest 解析 workflow YAML 并实际执行 wipe 脚本，运行在 Linux 上；macOS 是通过模拟其 userland（非 GNU 的 realpath）和软链临时目录覆盖的，并非在 Mac 上真机运行。重试路径会在 runner 池下一次真实 checkout 失败时得到验证。

风险与范围

主要风险或取舍：checkout 失败后在最终成功或失败之前会多花一次完整历史 clone 的时间；wipe 会删掉持久化 workspace 里的所有内容，这是有意为之——里面的一切都会被后续步骤重建。
未验证 / 不在范围内：损坏的根因（最可能是某次被 kill 的 git 操作，或某个 root 权限 job 写入了共享 workspace——同一台 runner 的临时目录里就有另一个 job 的 tmux 运行留下的 root 属主残留）没有被修复，只是被兜住；同池的其他 workflow 没有获得各自的自愈，不过第一次自愈成功的 review 会顺带清理它们共享的 workspace。
破坏性变更 / 迁移说明：无。

关联事项

无——直接从 CI run annotations 观察到，没有对应的 open issue。

A checkout failure on the self-hosted review pool was terminal: either a transient network drop mid-fetch (curl 92 / early EOF), or a corrupt persisted workspace whose refs claim objects missing from its object store, after which every fetch dies in negotiation with 'remote did not send all necessary objects'. ecs-qwen-runner-64c-23 stayed in that state for two days (2026-08-13..15), failing seven review jobs on the same missing SHAs. Make the first checkout continue-on-error; on failure wipe the whole workspace (not just .git) and retry the identical checkout once. The workspace is disposable — later steps reinstall deps and tools.

qwen-code-ci-bot · 2026-08-15T09:35:34Z

✅ Qwen Triage finished — CI landed green on 952792a and the deferred approval was posted. finalize run

✅ Qwen Triage 已完成 —— 952792a 的 CI 全绿，延迟审批已提交。查看 finalize 运行

qwen-code-ci-bot · 2026-08-15T09:45:02Z

Gate re-check on 952792a5 — the takeover bot's merge of origin/main. The substance since the last pass is 90fa6bb4, wenshao's fix for the two Criticals doudouOUC raised on the test suite. Verdicts unchanged from earlier passes; the new head was re-verified regardless.

Template ✓ — all required sections, bilingual.

Problem: observed, not theoretical. Independently confirmed on an earlier pass from the CI run annotations: 2026-08-13..15, seven review-pr jobs died at checkout on one runner (ecs-qwen-runner-64c-23) citing the SAME missing SHAs — a corrupted persisted clone that poisoned the machine for every review it took for two days. Two further deaths in the window were transient mid-fetch network drops. Both failure shapes are named in the heal step's own comment.

Direction: in scope — this heals the repo's own review automation on its reused self-hosted pool; no product surface is touched.

Size: not core infrastructure. Production change is +72/−0 in the workflow YAML; tests are +453/−1. Test lines dominate, and that is proportionate rather than bloat: the wipe step's payload is an rm -rf in CI, so heavily pinned guards are exactly what it needs.

Approach: minimal — first checkout made survivable, outcome-gated wipe, byte-identical retry once. Scope is still exactly right: only the review-pr job's checkout is healed; the file's second "Checkout base branch" belongs to resolve-pr, which runs on ephemeral ubuntu-latest, so only the healed checkout sits on the persisted-workspace pool. New this pass: the merge reconciled main's Verify runner directory health step (#8894 incident class) in the SAME file — the two defenses are complementary, not overlapping (health probes the runner directories at job start; the heal fires on the workspace at checkout time), and the step order in the merged file checks out.

Risk: changed files match no high-risk path pattern; no elevated risk signals.

Moving on to code review. 🔍

中文说明

在 952792a5 上重新过门 —— 这是 takeover bot 合入 origin/main 后的 head。上一轮 pass 之后的实质改动是 90fa6bb4，即 wenshao 针对 doudouOUC 在测试套件上提出的两个 Critical 的修复。各项结论与之前一致，新 head 已重新核验。

模板 ✓ —— 各必需小节齐全，中英双语。

问题： 已观测到的，不是理论问题。早前的 pass 已从 CI run annotation 中独立确认：2026-08-13 至 15 日，七个 review-pr job 在同一台 runner（ecs-qwen-runner-64c-23）的 checkout 阶段挂掉，引用的都是完全相同的缺失 SHA —— 损坏的持久化 clone 令该机器连续两天对所有调度过来的 review 必挂。同窗口内另有两次失败是 fetch 中途的网络瞬断。两种失败形态都写进了自愈步骤自己的注释里。

方向： 在范围内 —— 修复的是仓库自己的 review 自动化在复用 self-hosted 池上的可靠性，不触及任何产品面。

规模： 非核心基础设施。生产改动为 workflow YAML +72/−0；测试 +453/−1。测试行数占大头，但这是相称的而非臃肿：wipe 步骤的载荷是 CI 里的 rm -rf，守卫正需要这样的重度 pin。

方案： 最小化 —— 第一次 checkout 可存活、按 outcome 触发 wipe、一次性字节级相同的重试。范围仍然恰好：只自愈 review-pr job 的 checkout；文件中第二个 "Checkout base branch" 属于跑在临时 ubuntu-latest 上的 resolve-pr，所以只有被修的 checkout 位于持久化 workspace 池上。本轮新增：merge 在同一文件里调和了 main 的 Verify runner directory health 步骤（#8894 同类）—— 两道防线互补而非重叠（health 在 job 启动时探测 runner 目录；自愈在 checkout 时作用于 workspace），合并后文件中的步骤顺序核验无误。

风险： 改动文件未命中任何高风险路径模式；无升级风险信号。

进入代码审查 🔍

— Qwen Code · qwen3.8-max

_{Reviewed at 952792a5297d025c083c5d8b98d6223b90af743d · re-run with @qwen-code /triage}

qwen-code-ci-bot · 2026-08-15T09:49:12Z

Code review

Second full pass, on 952792a5 (the takeover bot's merge of origin/main). The substance since the last pass is 90fa6bb4 — the fix for the two Criticals doudouOUC raised on the test suite — so that is where this pass focuses. My independent baseline is unchanged: survivable first checkout, guarded wipe, one byte-identical retry. The PR still matches it.

Both Criticals are fixed the way the reviewer prescribed — not sanded down.

GNU-only assertion red on every macOS host — the ..-escape canonicalization test now runs under a host probe: hasGnuRealpath executes realpath -m -- / once, and the test is it.skipIf(!hasGnuRealpath). On a BSD userland the assertion that cannot hold there is skipped instead of red; the stubbed-realpath tests keep covering the absent-realpath axis, and a Mac with GNU coreutils fronting PATH keeps the full coverage. The production script is untouched — correct, since the pool is Linux-only.
Symlinked-TMPDIR fixture mismatch — lockFixture() now canonicalizes the fixture parent (realpathSync(mkdtempSync(...))) AND returns rws: realpathSync(tmpdir()), with both lock tests passing fixture.rws as RUNNER_WORKSPACE. Both halves of the allowlist comparison now speak one spelling on every host, which also removes the suite's incidental dependency on ci.yml's TMPDIR=$RUNNER_TEMP export on the test_macos lane — the exact dependency the Critical named.

The bot's earlier Critical on the same family (sudo argv pin vs canonicalized $WS on a symlinked tmpdir) is fixed by the same fixture canonicalization — and the argv pin stayed an exact-entry comparison, so a drifted wipe target still fails on every host.

The guard chain end to end — canonicalize → strip trailing slashes → denylist → RUNNER_WORKSPACE allowlist → find -mindepth 1 wipe that keeps the directory itself → sudo fallback → survivors annotation — re-verified in the merged head file: step order intact, the retry byte-identical to the first checkout (pin, ref, fetch-depth), and the two load-bearing invariants (a failed wipe warns and exits 0 so the retry still runs; the guard's exit-1 refusal stays red because the wipe step has no continue-on-error) remain pinned by tests that execute the REAL script under bash -e -o pipefail.

The merge itself is clean: main brought the FALLBACK_MARKER env and the Verify runner directory health step (#8894 incident class) into the same workflow, and they coexist with the heal chain without interaction. Several stale bot threads from earlier rounds still read unresolved on GitHub but are verifiably addressed at this head — the RWS strip loop, realpath canonicalization, RUNNER_WORKSPACE unset/empty refusal test, wipe-step continue-on-error pin, root-runner skipIf, and the canonicalization-discriminating escape test are all present in the current code. Open records, not blockers: R5-1 (this is the fourth copy of the pool-wipe idiom across sibling workflows) stays escalated, and the PR contains rather than fixes the poisoning root cause — stated explicitly in the description.

Testing

Unattended CI run — no PR code executed here; the evidence below is the PR's own CI on the reviewed commit, quoted via the API. At posting time the ubuntu unit lane — which runs test:ci, including the changed suite that executes the real wipe script on Linux — is still in progress on this head; the finalize flow updates the table below once CI settles. The macOS/Windows lanes are merge-queue-only for fork PRs, so the BSD-userland surfaces fixed this round next run in the merge queue — the host-probe gating is precisely what makes that ordering safe. The batch of cancelled conclusions on this SHA belongs to the run superseded when the merge landed, not to failures.

Final CI results for 952792a (auto-updated by the triage finalize job after CI completed):

Check	Conclusion
`Classify PR`	✅ success
`Dependency CVE audit`	✅ success
`Desktop Shell (ubuntu-22.04)`	✅ success
`Desktop Shell (windows-2022)`	✅ success
`Secret scan (TruffleHog)`	✅ success
`Test (ubuntu-latest, Node 22.x)`	✅ success
`web-shell E2E Smoke (ubuntu-latest, Node 22.x)`	✅ success

_{One row per check name (latest run); skipped checks omitted; failures sort first. / 每个检查名一行（取最新一次运行），省略 skipped，失败项排在最前。}

Sandboxed verification would settle the remaining behavioral claim: @qwen-code /verify — that the heal chain works end to end on a real checkout failure (wipe empties the workspace, guards refuse, the retry clones fresh) is not observable from the diff or the unit suite, which can execute the wipe script but not the checkout-fail → heal → retry sequence itself. A verify run for this head was already triggered by the triage flow; the previous head's verify passed with 338 assertions.

中文说明

代码审查

第二次完整 pass，在 952792a5（takeover bot 合入 origin/main 之后）。上一轮之后的实质改动是 90fa6bb4 —— 针对 doudouOUC 在测试套件上提出的两个 Critical 的修复 —— 因此本轮聚焦于此。我的独立基线不变：第一次 checkout 可存活、有守卫的 wipe、一次字节级相同的重试。PR 仍然与之吻合。

两个 Critical 都按评审者给出的方式修复 —— 没有打磨变钝。

在每个 macOS 主机上变红的 GNU 独有断言 —— .. 逃逸规范化测试现在以主机探测为前提运行：hasGnuRealpath 执行一次 realpath -m -- /，测试改为 it.skipIf(!hasGnuRealpath)。在 BSD userland 上，这个在那里不可能成立的断言被跳过而不是变红；stub realpath 的测试继续覆盖无 realpath 轴，而 PATH 前置 GNU coreutils 的 Mac 仍保留完整覆盖。生产脚本未被触碰 —— 正确，因为 runner 池是 Linux-only。
软链 TMPDIR 的 fixture 不一致 —— lockFixture() 现在对 fixture 父目录做规范化（realpathSync(mkdtempSync(...))），并返回 rws: realpathSync(tmpdir())，两个锁测试都以 fixture.rws 作为 RUNNER_WORKSPACE。allowlist 比较的两半现在在每个主机上拼写一致，同时也移除了套件对 ci.yml 中 test_macos lane 顺带导出 TMPDIR=$RUNNER_TEMP 的依赖 —— 正是该 Critical 点名的那个依赖。

机器人早先在同一问题族上的 Critical（软链 tmpdir 下 sudo argv pin 与规范化后的 $WS 不一致）由同一个 fixture 规范化修复 —— 且 argv pin 保持精确数组项比较，漂移的 wipe 目标在任何机器上仍然失败。

整条守卫链 —— 规范化 → 去尾斜杠 → 拒绝名单 → RUNNER_WORKSPACE 允许名单 → 保留目录本身的 find -mindepth 1 wipe → sudo 回退 → 幸存者注解 —— 在合并后的 head 文件中重新核验：步骤顺序完好，重试与第一次 checkout 字节级相同（pin、ref、fetch-depth），两个关键不变量（wipe 失败时警告并以 0 退出以便重试继续；守卫的 exit 1 拒绝因 wipe 步骤没有 continue-on-error 而保持红色）仍由执行真实脚本（bash -e -o pipefail 下）的测试 pin。

merge 本身干净：main 把 FALLBACK_MARKER 环境变量和 Verify runner directory health 步骤（#8894 同类）带进了同一个 workflow，与自愈链共存且互不干扰。早前轮次的若干机器人线程在 GitHub 上仍显示未解决，但在此 head 上可核验已修复 —— RWS 去尾斜杠循环、realpath 规范化、RUNNER_WORKSPACE 未设置/为空的拒绝测试、wipe 步骤 continue-on-error 的 pin、root runner 的 skipIf、以及规范化的判别性逃逸测试都已存在于当前代码。未结记录项（非阻断）：R5-1（这是兄弟 workflow 间池 wipe 习语的第四份拷贝）保持已升级状态；PR 是遏制而非修复投毒根因 —— 描述中已明确说明。

测试

无人值守 CI 运行 —— 此处未执行任何 PR 代码；以下证据是 PR 自身 CI 在被审 commit 上的结果，经 API 引用。发布时 ubuntu 单元 lane —— 运行 test:ci，包含在 Linux 上执行真实 wipe 脚本的被改套件 —— 在此 head 上仍在进行中；finalize 流程会在 CI 结束后更新下方表格。macOS/Windows lane 对 fork PR 仅在 merge queue 运行，所以本轮修复的 BSD userland 面将在合并队列中首次跑到 —— 主机探测的门槛化正是让这个顺序安全的原因。此 SHA 上一批 cancelled 结论属于 merge 落地时被取代的那次运行，不是失败。沙箱验证可以敲定剩余的行为主张：@qwen-code /verify —— 自愈链在真实 checkout 失败下端到端可用（wipe 清空 workspace、守卫拒绝、重试重新 clone）无法从 diff 或单元套件观察，后者能执行 wipe 脚本但无法执行 checkout 失败 → 自愈 → 重试这一序列本身。针对此 head 的 verify 运行已由 triage 流程触发；上一个 head 的 verify 以 338 条断言通过。

— Qwen Code · qwen3.8-max

_{Reviewed at 952792a5297d025c083c5d8b98d6223b90af743d · re-run with @qwen-code /triage}

qwen-code-ci-bot · 2026-08-15T09:50:25Z

Confidence: 4/5 — both of doudouOUC's Criticals are fixed exactly the way they were prescribed, without loosening a single assertion; the guard chain re-verifies end to end at the merged head; and this pass surfaced no new concern. What keeps it from a 5 is the standing open records — the R5-1 wipe-idiom duplication, and a root cause contained rather than fixed — plus the ubuntu lane still running at posting time.

Stepping back: the shape of this PR has not changed since the first pass, and it remains the right shape — a permanent failure mode (one corrupted persisted workspace poisons a runner for days) turned into a self-healing one at bounded cost (one extra full clone after a first failure), with nothing changing when the first checkout succeeds. What this pass added is the reassurance that the review process itself worked: a human reviewer caught two ways the test suite would have been red on macOS, the fixes landed as probe-and-gate and spelling-consistency rather than deleted assertions, and the suite comes out of it strictly more honest — it now documents which of its claims depend on GNU userland instead of silently leaning on a ci.yml TMPDIR export. In six months this still reads like someone who has been burned by a CI runner before and does not want to be again.

The bot's changes-request from the 8688ce15 round pinned code five pushes ago; its single Critical is fixed by the same fixture canonicalization this pass verified, and the approval below supersedes it. The ubuntu unit lane was still in flight at posting time, so approval is deferred until CI lands green on the reviewed commit; the finalize flow posts it pinned to that commit. If anything lands red, it will flag the status comment instead.

中文说明

置信度：4/5 —— doudouOUC 的两个 Critical 都严格按照其给出的方式修复，未放宽任何断言；守卫链在合并后的 head 上端到端复核通过；本轮未发现新问题。没到 5 分是因为尚存的记录项 —— R5-1 的 wipe 习语重复、以及被遏制而非修复的根因 —— 加上发布时 ubuntu lane 仍在运行。

退一步看：这个 PR 的形态从第一次 pass 起没有变，而且仍然是正确的形态 —— 把一种永久性失败模式（一次持久化 workspace 损坏就能让某台 runner 中毒数天）变成有界代价的自愈（第一次失败后多一次完整 clone），且第一次 checkout 成功时什么都不变。本轮新增的是对评审流程本身的确认：人类评审抓出了测试套件在 macOS 上会变红的两处，修复以"探测并跳过"和"拼写一致"的方式落下，而不是删除断言，套件因此变得更诚实 —— 它现在明确声明哪些断言依赖 GNU userland，而不是悄悄依赖 ci.yml 的 TMPDIR 导出。六个月后再看，这代码依然像一个被 CI runner 坑过、不想再被坑一次的人写的。

机器人 8688ce15 轮的 changes-request 钉在五个 push 之前的代码上；其唯一 Critical 已由本轮核验的同一 fixture 规范化修复，下方的批准决定取代它。发布时 ubuntu 单元 lane 仍在运行，因此批准推迟到 CI 在被审 commit 上全绿后执行；finalize 流程会把批准锚定到该 commit。若有检查变红，则改为在状态评论中标记。

— Qwen Code · qwen3.8-max

_{Reviewed at 952792a5297d025c083c5d8b98d6223b90af743d · re-run with @qwen-code /triage}

qwen-code-ci-bot

LGTM, looks ready to ship — CI landed green after the review. ✅

qwen-code-ci-bot

⚠️ This run could not certify that any of this diff was reviewed. Suggestions are inline.

Not reviewed: reverse audit rounds 3–5 — the loop stopped after round 2: the Step 4 verifier's mutation probe executed rm -rf /* on the runner host and destroyed the review environment, and resuming agent rounds on the damaged host was declined.

Not reviewed: diff-coverage proof — the harness transcripts that record the Step 3 fan-out were destroyed in the same incident, so coverage can no longer be certified mechanically even though all 13 agents returned substantive receipts before it.

Not reviewed: coverage — could not read the agents' transcripts (no subagent transcripts at /home/github-runner/actions-runner-hk-j6c03lyei7s809zq1s6t-17/_work/_temp/qwen-home/projects/-home-github-runner-actions-runner-hk-j6c03lyei7s809zq1s6t-17--work-qwen-code-qwen-code/subagents/b330460a-a575-4bd2-a3a4-f5fb6f4f5fb9 (ENOENT: no such file or directory, scandir '/home/github-runner/actions-runner-hk-j6c03lyei7s809zq1s6t-17/_work/_temp/qwen-home/projects/-home-github-runner-actions-runner-hk-j6c03lyei7s809zq1s6t-17--work-qwen-code-qwen-code/subagents/b330460a-a575-4bd2-a3a4-f5fb6f4f5fb9'). The harness writes one per agent; if there are none, either no agents ran or the harness could not write them.), so this run cannot show that any of the diff was read.

Not reviewed: verification — could not check that Step 4 and Step 5 ran (no subagent transcripts at /home/github-runner/actions-runner-hk-j6c03lyei7s809zq1s6t-17/_work/_temp/qwen-home/projects/-home-github-runner-actions-runner-hk-j6c03lyei7s809zq1s6t-17--work-qwen-code-qwen-code/subagents/b330460a-a575-4bd2-a3a4-f5fb6f4f5fb9 (ENOENT: no such file or directory, scandir '/home/github-runner/actions-runner-hk-j6c03lyei7s809zq1s6t-17/_work/_temp/qwen-home/projects/-home-github-runner-actions-runner-hk-j6c03lyei7s809zq1s6t-17--work-qwen-code-qwen-code/subagents/b330460a-a575-4bd2-a3a4-f5fb6f4f5fb9'). The harness writes one per agent; if there are none, either no agents ran or the harness could not write them.).

中文说明

⚠️ 本次运行无法证明这个 diff 的任何部分经过了审查。建议见行内评论。

未审查：reverse audit rounds 3–5 — the loop stopped after round 2: the Step 4 verifier's mutation probe executed rm -rf /* on the runner host and destroyed the review environment, and resuming agent rounds on the damaged host was declined。

未审查：diff-coverage proof — the harness transcripts that record the Step 3 fan-out were destroyed in the same incident, so coverage can no longer be certified mechanically even though all 13 agents returned substantive receipts before it。

未审查：覆盖情况——无法读取 agent 的运行记录（no subagent transcripts at /home/github-runner/actions-runner-hk-j6c03lyei7s809zq1s6t-17/_work/_temp/qwen-home/projects/-home-github-runner-actions-runner-hk-j6c03lyei7s809zq1s6t-17--work-qwen-code-qwen-code/subagents/b330460a-a575-4bd2-a3a4-f5fb6f4f5fb9 (ENOENT: no such file or directory, scandir '/home/github-runner/actions-runner-hk-j6c03lyei7s809zq1s6t-17/_work/_temp/qwen-home/projects/-home-github-runner-actions-runner-hk-j6c03lyei7s809zq1s6t-17--work-qwen-code-qwen-code/subagents/b330460a-a575-4bd2-a3a4-f5fb6f4f5fb9'). The harness writes one per agent; if there are none, either no agents ran or the harness could not write them.），本次运行无法证明 diff 的任何部分被读过。

未审查：验证——无法检查步骤 4 与步骤 5 是否运行（no subagent transcripts at /home/github-runner/actions-runner-hk-j6c03lyei7s809zq1s6t-17/_work/_temp/qwen-home/projects/-home-github-runner-actions-runner-hk-j6c03lyei7s809zq1s6t-17--work-qwen-code-qwen-code/subagents/b330460a-a575-4bd2-a3a4-f5fb6f4f5fb9 (ENOENT: no such file or directory, scandir '/home/github-runner/actions-runner-hk-j6c03lyei7s809zq1s6t-17/_work/_temp/qwen-home/projects/-home-github-runner-actions-runner-hk-j6c03lyei7s809zq1s6t-17--work-qwen-code-qwen-code/subagents/b330460a-a575-4bd2-a3a4-f5fb6f4f5fb9'). The harness writes one per agent; if there are none, either no agents ran or the harness could not write them.）。

— qwen3.8-max via Qwen Code /review (v0.21.12)

qwen-code-ci-bot

Reviewed — no blockers. Suggestions are inline.

Not linted (tool limitation, not a blocker): the executable-script lint — .github/workflows/qwen-code-pr-review.yml: actionlint embedded-shell source mapping is not yet supported — not linted.

中文说明

已审查——无阻断问题。建议见行内评论。

未检查（工具限制，非阻断）：the executable-script lint — .github/workflows/qwen-code-pr-review.yml: actionlint embedded-shell source mapping is not yet supported — not linted。

— qwen3.8-max via Qwen Code /review (v0.21.12)

wenshao · 2026-08-15T14:41:49Z

@qwen-code /takeover

qwen-code-dev-bot · 2026-08-15T14:42:09Z

🤝 Takeover engaged: the autofix loop now manages this PR — it will address new review feedback and resolve base conflicts until the label is removed or the round cap is reached. This is a fork PR, so the first round comes from the next scheduled scan (usually within minutes). Remove the autofix/takeover label (or comment @qwen-code /takeover stop) to release.

中文说明

🤝 已接管：autofix 循环现在管理此 PR —— 将持续处理新的评审反馈与 base 冲突，直到移除标签或达到轮次上限。本 PR 来自 fork，首轮处理将由下一次定时扫描执行（通常几分钟内）。移除 autofix/takeover 标签（或评论 @qwen-code /takeover stop）即可释放。

qwen-code-dev-bot · 2026-08-15T14:56:49Z

✅ AutoFix round 7 finished — view run. See this round's report below.

中文说明

✅ AutoFix 第 7 轮已完成 —— 查看运行。本轮报告见下方。

QwenLM#9220)

qwen-code-dev-bot · 2026-08-15T15:32:00Z

🤖 Addressed the latest review feedback (round 1/100). What changed, and what I pushed back on: · 已处理最新评审反馈（第 1/100 轮）。改动内容与我反驳保留之处如下：

Autofix review round — PR #9220

All seven inline findings from the automated reviewer (six [Suggestion] items across rounds 1–2) were implemented in one commit: a6a617bfa6 fix(ci): heal with the pool wipe idiom and pin the checkout guardrails (#9220). Changes stay inside the PR's existing footprint: the review workflow's checkout self-heal step and its test block. No conflict resolution was needed (--conflict false; origin/main was not merged).

Feedback points and decisions

Unconditional "wiped the workspace" annotation (R1-1) — Resolved (reproduced, then fixed). Probe against the pre-round script confirmed the claim: with a wipe blocked and sudo failing, the step printed the failure warning immediately followed by "wiped the workspace for a clean retry" and exited 0. The wipe step now emits the success annotation only when a wipe leg actually succeeded, and the "could not wipe" warning otherwise.
Fourth divergent workspace-wipe mechanism (R1-2) — Resolved. The heal step now uses the pool's established idiom find "${GITHUB_WORKSPACE:?}" -mindepth 1 -maxdepth 1 -exec rm -rf {} + (serve-ab.yml:83, qwen-triage.yml:2586/:3511), keeping this step's sudo -n fallback and the :? guard. Because the find idiom keeps the directory itself, the cd / escape and the mkdir -p recreation were both deleted — the change is net subtractive. Note: the qwen-triage siblings' additional suspicious-path refusals were not duplicated; GITHUB_WORKSPACE is set by the runner itself and the :? guard covers the unset/empty case, matching the suggestion's own code block.
Wipe fixture lacks hidden entries (R1-3) — Resolved. The fixture now includes a .git/HEAD entry, so a glob-shaped wipe mutation (which skips dotfiles and would leave exactly the corrupt .git this heal exists for) is caught. Mutation-verified: a dotfile-skipping mutant fails the suite.
No absolute pins on the checkout steps (R2-1) — Resolved. The first checkout is now pinned to its required absolute values — actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10, ref: ${{ github.event.repository.default_branch }}, fetch-depth: 0 — with the retry still pinned by equality, so a coordinated drift of both steps can no longer survive. Mutation-verified: drifting both refs to the PR head SHA fails the suite.
Wipe-failure branch never exercised (R2-2) — Resolved. New test still exits 0 when the wipe cannot remove the workspace: a chmod-500 workspace blocks the first find leg, and on this pool sudo does not exist (sudo: command not found), so the failure branch is genuinely exercised. Per the finding's guidance, the test asserts the exit-code contract only (no throw), not the directory state, which varies by runner's sudo availability.
continue-on-error absence on the retry not pinned (R2-4) — Resolved. Added expect(retry['continue-on-error']).toBeUndefined() next to the existing first-checkout pin, so a double checkout failure must stay red and the job can never proceed into review without code. Mutation-verified: adding the flag to the retry step fails the suite.
Wipe script tested under bare bash -c (R2-6) — Resolved. All wipe invocations now run through a shared runWipe helper under bash -e -o pipefail, the runner's implicit flags (same precedent as the suite's gh PATH-shim harness). Mutation-verified: rewriting the step as a bare chain without the failure tail exits nonzero under errexit and is caught by the wipe-failure test.

Verification

Repro probe (pre-round script, blocked wipe + failing sudo on PATH): printed both contradictory annotations, exit 0 — finding R1-1 confirmed before fixing.
Post-fix probes: success path (emptied incl. .git, dir kept, success annotation, exit 0), blocked path (failure annotation only, exit 0, contents left), empty/unset GITHUB_WORKSPACE (exit 1 guard), and a no-failure-tail mutant (exit 1 under -eo pipefail) — all as required.
Mutation runs against the new tests (4 mutants: dotfile-skipping find, bare chain without else, continue-on-error on retry, both refs drifted to PR head SHA) — each killed (suite failed as expected), then reverted.
npx prettier --write scripts/tests/qwen-pr-review-workflow.test.js — unchanged (already formatted).
YAML parse check of the workflow — passed.
npx vitest run --config ./scripts/tests/vitest.config.ts qwen-pr-review-workflow — 122/122 passed (was 121; +1 new wipe-failure test).
npm run build — passed (exit 0).
npm run typecheck — passed (exit 0).
npm run lint — passed (exit 0).
npm run test:scripts (full scripts suite, run twice) — 1168 passed / 1 failed, then 1167 passed / 2 failed; the only failures are in scripts/tests/verify-capture.test.js pixel-color assertions (renders 256-colour..., keeps black-foreground text readable...). Evidence this is pre-existing and unrelated to this diff: with the round's changes reverted, the same test failed on the pre-round tree, and flakiness occurs in both states (with changes: pass/fail/fail across three runs; pre-round: fail/pass/pass). Characterization: the DejaVu Sans Mono named in the helper's SVG font stack is not installed on this runner (fc-list: 0 matches), so librsvg falls back to the fontconfig-resolved monospace and the exact-pixel color assertions become flaky. scripts/verify-capture.mjs is verification machinery this PR never touched and lies outside the PR's footprint, so it was not modified here. The file this round changed (qwen-pr-review-workflow.test.js) was 122/122 green in both full-suite runs.

Commit: a6a617bfa6 on fix/review-checkout-self-heal (2 files changed, +57/−17).

中文说明

Autofix 审查轮次 — PR #9220

自动审查者的全部 7 条行内发现（第 1–2 轮共 7 条 [Suggestion]）已在一次提交中全部实现：a6a617bfa6 fix(ci): heal with the pool wipe idiom and pin the checkout guardrails (#9220)。改动保持在本 PR 已有的足迹范围内：review 工作流的 checkout 自愈步骤及其测试块。无需冲突处理（--conflict false，未合并 origin/main）。

反馈点与处理决定

无条件的 "wiped the workspace" annotation（R1-1）— 已解决（先复现、后修复）。 对修改前脚本的探针确认了该发现：在清空被阻止且 sudo 失败时，该步骤先打印失败警告、紧接着又打印 "wiped the workspace for a clean retry"，并以退出码 0 结束。现在 wipe 步骤只在某条清空分支真正成功时才发出成功 annotation，否则发出 "could not wipe" 警告。
第四种、与现有实现分叉的 workspace 清空机制（R1-2）— 已解决。 自愈步骤现在使用池上已有的惯用写法 find "${GITHUB_WORKSPACE:?}" -mindepth 1 -maxdepth 1 -exec rm -rf {} +（serve-ab.yml:83、qwen-triage.yml:2586/:3511），并保留本步骤的 sudo -n 兜底与 :? 保护。由于 find 写法保留目录本身，cd / 逃逸与 mkdir -p 重建均被删除——本次改动整体是净减少的。说明：未复制 qwen-triage 同额可疑路径拒绝逻辑；GITHUB_WORKSPACE 由 runner 自身设置，:? 保护已覆盖未设置/为空的情形，与建议给出的代码块一致。
wipe fixture 缺少隐藏条目（R1-3）— 已解决。 fixture 现在包含 .git/HEAD 条目，glob 形式的 wipe 变异（跳过隐藏文件、恰好留下本自愈机制要清除的损坏 .git）将被捕获。已做变异验证：跳过隐藏文件的 find 变异会使套件失败。
checkout 步骤缺少绝对钉住（R2-1）— 已解决。 第一次 checkout 现在被钉在其必需的绝对值上——actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10、ref: ${{ github.event.repository.default_branch }}、fetch-depth: 0——重试侧继续由相等性钉住，因此对两个步骤的协同漂移不再能存活。已做变异验证：把两个 ref 同时漂移为 PR head SHA 会使套件失败。
wipe 失败分支从未被演练（R2-2）— 已解决。 新增测试 still exits 0 when the wipe cannot remove the workspace：chmod-500 的 workspace 阻断第一条 find 分支，且本池上没有 sudo（sudo: command not found），因此失败分支是被真实演练的。按该发现的指引，测试只断言退出码契约（不抛异常）、不断言目录状态——后者因 runner 的 sudo 可用性而异。
重试步骤上 continue-on-error 的缺失未被钉住（R2-4）— 已解决。 在现有第一次 checkout 钉住旁新增 expect(retry['continue-on-error']).toBeUndefined()，确保双重 checkout 失败必须保持红色、job 永远不会在没有代码的情况下继续进入 review。已做变异验证：给重试步骤加上该字段会使套件失败。
wipe 脚本在纯 bash -c 下测试（R2-6）— 已解决。 所有 wipe 调用现在统一经由共享的 runWipe 辅助函数、在 bash -e -o pipefail（runner 的隐式标志，与本套件 gh PATH-shim harness 的先例一致）下执行。已做变异验证：把步骤改写为不带失败兜底的裸链条时，在 errexit 下非零退出，会被 wipe 失败测试捕获。

验证

复现探针（修改前脚本，清空被阻断 + PATH 上放置失败的 sudo）：连续输出两条互相矛盾的 annotation、退出码 0 —— R1-1 在修复前确认。
修复后探针：成功路径（清空含 .git 的全部内容、目录保留、成功 annotation、退出码 0），受阻路径（仅失败 annotation、退出码 0、内容保留），GITHUB_WORKSPACE 为空/未设置（退出码 1 守卫），以及去掉失败兜底的变异（在 -eo pipefail 下退出码 1）——全部符合预期。
针对新测试的变异运行（4 个变异：跳过隐藏文件的 find、无 else 的裸链条、重试步骤加 continue-on-error、两个 ref 同时漂移为 PR head SHA）——每个均被杀死（套件按预期失败），随后还原。
npx prettier --write scripts/tests/qwen-pr-review-workflow.test.js —— 无变更（格式已符合）。
工作流 YAML 解析检查 —— 通过。
npx vitest run --config ./scripts/tests/vitest.config.ts qwen-pr-review-workflow —— 122/122 通过（原为 121；新增 1 个 wipe 失败测试）。
npm run build —— 通过（退出码 0）。
npm run typecheck —— 通过（退出码 0）。
npm run lint —— 通过（退出码 0）。
npm run test:scripts（完整 scripts 套件，运行两次）—— 1168 通过 / 1 失败，随后 1167 通过 / 2 失败；唯一的失败位于 scripts/tests/verify-capture.test.js 的像素颜色断言（renders 256-colour...、keeps black-foreground text readable...）。证明其为既有问题且与本 diff 无关的证据： 还原本轮改动后，同一测试在修改前的树上同样失败，且两种状态下均随机成败（有改动时三次运行：通过/失败/失败；修改前：失败/通过/通过）。定性：helper 的 SVG 字体栈中指定的 DejaVu Sans Mono 未安装在本 runner 上（fc-list：0 条匹配），librsvg 回退到 fontconfig 解析的 monospace，导致精确像素颜色断言不稳定。scripts/verify-capture.mjs 是本 PR 从未触及的验证机制、位于本 PR 足迹之外，因此本轮不做修改。本轮改动的文件（qwen-pr-review-workflow.test.js）在两次完整套件运行中均为 122/122 全绿。

提交：a6a617bfa6，位于 fix/review-checkout-self-heal 分支（2 个文件变更，+57/−17）。

Base-conflict check · 基分支冲突检查: no conflict with main. · 与 main 无冲突。

Re-review when you have a moment. After round 100 this bot stops and leaves the PR for a human. · 有空请复审；第 100 轮后本 bot 停止并将 PR 交给人工。

🧠 Handled by Qwen Code · model/模型 qwen3.8-max

qwen-code-dev-bot · 2026-08-15T16:18:52Z

🤖 Reviewed the latest feedback — no changes needed. Why, point by point: · 已审阅最新反馈——无需改动。逐点说明原因如下：

Autofix review round — PR #9220

No action taken this round: the workflow-prepared feedback contains no actionable items, so no code was changed and no commit was created. The branch stays at a6a617bf (already pushed and verified by round 1).

Feedback triage

Reviews / inline comments / issue-level comments: none newer than the last evaluation (2026-08-15T14:06:40Z). All seven automated-reviewer findings (round-1 items R1-1…R1-3 at 10:44 UTC and round-2 items R2-1, R2-2, R2-4, R2-6 at 14:06 UTC) were implemented, mutation-verified, and pushed by round 1 in commit a6a617bf.
Human comments since the evaluation: one incoherent comment from a non-maintainer account (danialzivehdadr, 14:38 UTC — "Nama address all Jion home Naem me pick") contains no actionable request and was treated as untrusted input; the /takeover command (wenshao, 14:41 UTC) was already acknowledged by the takeover flow at 14:42 UTC. Neither requires a code change.
Failed checks: every listed check is CANCELLED, not failed. These are the runs for the previous head that were superseded when round 1 pushed a6a617bf (~15:32 UTC). The check data shows the superseding runs on the current head completed green — ubuntu unit tests, dependency CVE audit, secret scan, desktop shell (ubuntu-22.04 + windows-2022), and web-shell E2E smoke all SUCCESS; macOS/windows unit tests and CLI integration tests were SKIPPED per the workflow's own gating; the automated review-pr job was still in progress at the data snapshot. There is no failure to diagnose or fix in code.
Diff growth this window: +3 source / +37 test lines vs the window baseline (budgets 400/400, 0 prior rounds over budget) — no brake engaged.
Conflicts: none (--conflict false); origin/main was not merged. The branch's merge-base is main's current tip.

Result

No code changes, no commit.
No inline findings to resolve or reply to this round.
Remaining open item outside this bot's control: the automated review-pr check on a6a617bf was still running when this round's data was captured; the workflow's own verification gate remains the final arbiter.

中文说明

Autofix 评审轮次 —— PR #9220

本轮未采取任何操作：工作流准备的反馈中没有可处理的事项，因此未修改任何代码，也未创建任何提交。分支保持在 a6a617bf（已由第 1 轮推送并验证）。

反馈分诊

评审 / 行内评论 / Issue 级评论： 上次评估（2026-08-15T14:06:40Z）之后没有任何新条目。自动评审器的全部七条发现（第 1 轮的 R1-1…R1-3，10:44 UTC；第 2 轮的 R2-1、R2-2、R2-4、R2-6，14:06 UTC）均已由第 1 轮实现、经变异验证并在提交 a6a617bf 中推送。
评估之后的人工评论： 一条来自非维护者账号（danialzivehdadr，14:38 UTC —— "Nama address all Jion home Naem me pick"）的语意不明的评论，不包含任何可执行的请求，已按不可信输入处理；/takeover 指令（wenshao，14:41 UTC）已由接管流程于 14:42 UTC 确认。两者均不需要代码改动。
失败的检查： 列出的每一项检查都是 CANCELLED（已取消），而非失败。这些是上一个 head 的运行，在第 1 轮推送 a6a617bf（约 15:32 UTC）时被取代。检查数据显示，当前 head 上的取代运行已全绿完成 —— ubuntu 单元测试、依赖 CVE 审计、密钥扫描、desktop shell（ubuntu-22.04 + windows-2022）、web-shell E2E 冒烟均为 SUCCESS；macOS/windows 单元测试与 CLI 集成测试按工作流自身的门控被 SKIPPED；自动 review-pr 作业在数据快照时仍在进行中。没有需要在代码中诊断或修复的失败。
本窗口 Diff 增长： 相对窗口基线 +3 行源码 / +37 行测试（预算 400/400，此前 0 轮超预算）—— 未触发任何制动。
冲突： 无（--conflict false）；未合并 origin/main。分支的 merge-base 即 main 的最新提交。

结果

无代码改动，无提交。
本轮没有需要解决或回复的行内发现。
本机器人控制范围之外的遗留事项：数据采集时，针对 a6a617bf 的自动 review-pr 检查仍在运行；最终以工作流自身的验证门为准。

Base-conflict check · 基分支冲突检查: no conflict with main. · 与 main 无冲突。

🧠 Handled by Qwen Code · model/模型 qwen3.8-max

wenshao · 2026-08-15T16:37:40Z

@qwen-code /triage

qwen-code-ci-bot · 2026-08-15T16:38:22Z

Sandboxed verification: ✅ passed — merge-ready (agent verdict) - workflow run

Ran the PR in an isolated, token-free container: A/B against the base build, mock-free harness assertions, targeted gates. Advisory evidence for human reviewers — not a review, an approval, or a CI check.

Scripted assertions: 176 passed · 0 failed · 176 total

中文 — 判定：✅ 通过 · 可合入（agent 判定）

沙箱验证在隔离、无凭证的容器中执行了该 PR 的代码（与 base 构建 A/B 对照、无 mock harness 断言、定向门禁）。仅作为评审证据，不构成评审、批准或 CI 检查。

脚本断言：176 通过 · 0 失败 · 176 总计

Verification report

PR #9220 Deep Verification — fix(ci): self-heal failed checkouts on the reused review runners

Verdict: merge-ready — 176 scripted assertions executed, 176 pass, 0 fail.
Verified head: a6a617bfa6298cd8b5b137fee08a7835a1724f15 (git rev-parse HEAD^2; matches the snapshot's headRefOid). Base of the merge checkout: 5b125f0b89 (note: the metadata snapshot's baseRefOid dc7e2348… has drifted behind; the verified tree is the merge into the current base tip). One non-blocking suggestion below.

中文摘要

结论：merge-ready（176 项脚本化断言全部通过）。

A/B 结论：在「持久化 workspace 损坏导致 checkout 必挂」的模拟场景下，base 构建第一次 checkout 失败即终局（job 红、毒仓库原样残留、无任何补救）；head 构建按 outcome == 'failure' 触发 wipe + 字节级一致的重试，清空 workspace（目录本身保留）、重试成功并走到下一个步骤；正常路径两步自愈全部跳过、已有文件不被误删；两次 checkout 都失败时 job 保持红（不会无代码继续 review）。见 01-ab-replay-corrupt-workspace-base-vs-head.png。
wipe 脚本真实执行：隐藏文件/嵌套目录/带空格文件名/指向外部的符号链接全部正确清除且不伤及外部 canary；GITHUB_WORKSPACE 未设置或为空时响亮拒绝退出；权限受阻时仍 exit 0（重试链不断）；sudo 兜底腿以完全相同的参数被调用（容器无 sudo，用 argv 保真 shim 验证控制流）。见 02-wipe-matrix-live-execution.png。
测试钉住程度：122/122 通过（PR 描述称 121，实际新增 6 个测试而非 5 个，见更正）。5 个单点突变体全部被预期的那个测试杀死；基线测试文件对 head YAML 回归为 116/116 绿。见 04-mutation-matrix-all-mutants-killed.png。
Findings：仅一条非阻塞建议——wipe 步骤缺少池内惯用法中 qwen-triage.yml 版本的「可疑路径 case 守卫」(/|/home|/root|…)；该值由 runner 设定而非 PR 输入，且 serve-ab.yml 的同池先例本就无守卫，故为纵深防御一致性建议。
未覆盖：重放未经真实 run annotation 校准（首轮、无 token）；sudo 兜底腿的真实 root 执行无法在本容器复现（uid 1000、无 sudo）；yamllint 不可用（pip3 权限）；第一个提交在浅克隆中不可达，按聚合 diff 验证；「下一次真实失败时自愈」只能在池上观察。

Central claim and A/B proof

Central claim: on the reused self-hosted review pool, a failed base-branch checkout is no longer terminal — the job wipes the whole workspace once and retries the byte-identical checkout; on success nothing changes.

Secondary claims: (1) the wipe script is safe (${GITHUB_WORKSPACE:?} guard, keeps the directory, sudo fallback, never fails the chain); (2) the 6 new tests genuinely pin the chain.

The checkout step itself cannot run in this sandbox, so the A/B is a step-chain replay: both YAMLs are parsed, run: blocks execute for real under the runner shell contract (bash --noprofile --norc -e <script>, cwd = workspace), and actions/checkout is stubbed with the bug's failure model — a poison marker in the workspace's .git makes every checkout fail with the issue's exact error shape (remote did not send all necessary objects) until a wipe removes it. This reproduces the shape of the failure, not its git-internal cause. Witness: 01-ab-replay-corrupt-workspace-base-vs-head.png.

Cell	Environment	Oracle	Result
BASE/corrupt	base YAML (`HEAD^1`), poisoned workspace	job status, attempt count, poison survival	failed after 1 attempt, poison survives (expected red — the bug)
HEAD/corrupt	head YAML, poisoned workspace	2 attempts, poison gone, dir preserved, reaches `Resolve PR context`	success, wipe fired, retry clean, chain reached the next step
HEAD/clean	head YAML, healthy workspace + canary file	heal steps skipped, canary survives	2 SKIPs, canary intact — happy path unchanged
BASE/clean	base YAML, parity A/A control	canary survives	identical end state to HEAD/clean
HEAD/double-fail	head YAML, checkout forced to always fail	job stays red after exactly 2 attempts	red, no loop — never proceeds into review without code

14/14 scripted assertions. Recovery from a corrupt workspace: head 1/1, base 0/1; happy path preserved on both arms; double failure stays red.

Byte-identical retry, proven two ways. The retry step is textually the base's original checkout body (the diff inserts the new head above it), so pin/ref/fetch-depth cannot drift by construction; the suite's equality assertion plus mutant m4 (retry fetch-depth: 0 → 1, killed) pin it behaviorally. The unchanged pin is actions/checkout@df4cb1c0… — the same SHA the base already used (no new third-party dereference to verify). The first checkout gains id: 'checkout' + continue-on-error: true; actionlint (which type-checks steps.<id> references in if: expressions — proven live by a probe that flags an undefined step id) passes the workflow cleanly, confirming the gates address a real step.

Wipe script — real execution matrix

The exact run: block extracted from the YAML via parser, executed under the runner shell contract (02-wipe-matrix-live-execution.png), 19/19 assertions:

Cell	Scenario	Observed
W1	nested dirs, `.git`, dotfiles, `dir with space`, symlink escaping to an outside canary	emptied incl. dotfiles, directory preserved, exit 0, success warning; outside canary untouched (symlink removed as link)
W2	`GITHUB_WORKSPACE` unset	exit 1, `parameter null or not set` names the variable, nothing deleted
W3	`GITHUB_WORKSPACE` empty	exit 1, same refusal
W4	wipe permission-blocked (0500 dir), sudo unavailable	exit 0, else-branch warning, retry chain stays alive
W5	first leg blocked, sudo present (argv-recording shim)	sudo invoked exactly once with `-n find <ws> -mindepth 1 -maxdepth 1 -exec rm -rf {} +` — identical command, exit 0
W6	static guard contrast	PR wipe has no suspicious-path `case` guard; the triage idiom's guard refuses `WS=/` (control, exit 1) — see Finding 1

bash -n clean on all 11 run: blocks of the job; shellcheck clean on the extracted wipe block; the repo's shellcheck gate exits 0 (its only warnings are pre-existing, in scripts/test-rewind-e2e.sh, not in this diff).

Corrections (to the PR description / test comments, not code-change requests)

"Five new tests … 121 tests pass" — the diff adds 6 it() blocks under checkout self-heal; the suite at head is 122/122 (116 pre-existing + 6). Confirmed by execution (03-vitest-head-122-pass.png).
Test plan says the wipe "recreates the directory" — the implementation preserves it (find -mindepth 1 -maxdepth 1, per the inline comment "keeps the directory itself for the retry checkout, so no cd-escape and no recreation are needed"). Preservation is the better behavior and is what W1 verifies; the plan's wording is loose, not the code.
The test comment states GitHub Actions executes run: blocks with -eo pipefail; the documented Linux default shell is bash -e {0} (no pipefail). The tests are stricter than the runner, which is conservative and harmless — the script sets set -uo pipefail itself.

Findings

1. Suggestion (non-blocking): wipe lacks the pool idiom's suspicious-path guard

The wipe step's comment cites the "Pool wipe idiom (serve-ab.yml, qwen-triage.yml)", but adopts only the unguarded half of it. The qwen-triage.yml copies of this idiom (both the pre- and post-external-code wipes) carry a case "$WS" in /|/home|/root|/usr*|/etc*|/var|"") refuse; exit 1 guard that this step does not (measured contrast in cell W6: the triage guard refuses WS=/ with exit 1). Blast radius if GITHUB_WORKSPACE were ever /: find / -mindepth 1 -maxdepth 1 -exec rm -rf {} + deletes the entire filesystem. Probability is low — the value is set by actions/runner from its registered work directory, not from PR input — and the same-pool precedent serve-ab.yml wipes unguarded too, so this is a consistency/defense-in-depth suggestion, not a merge condition. If aligned with the triage form, the two-line guard slots in before the find; the existing ${GITHUB_WORKSPACE:?} already covers the unset/empty shapes (W2/W3).

2. Note: one new test passes for the wrong reason under the coarse revert — the fine mutant still kills it

Under mutant m1 (whole-file revert to base YAML) only 5 of the 6 heal tests go red: refuses to wipe when GITHUB_WORKSPACE is unset or empty stays green because wipe is undefined there, so bash -c undefined throws and toThrow() passes for the wrong reason. This is an artifact of the coarse mutation (the scenario stops existing), not a vacuous test — the finer mutant m3 (guard dropped, step present) kills exactly that test with the intended assertion. No action needed; recorded so the 5/6 number is not misread as a survivor.

Not covered

Replay calibration. First round, no token, no retrievable real annotations — the replay is uncalibrated: the checkout stub reproduces the shape of the corrupt-workspace failure (its exact error lines), not the git negotiation that produces it. A real failed-run annotation from the pool would have calibrated it; the durable proof ("next real checkout failure heals") is only observable on the pool, as the PR itself states.
Real sudo fallback execution. Container is uid 1000 with no sudo binary; the fallback leg is verified by argv-fidelity shim (W5) and real permission-denied paths (W4), not by an actual root find.
Per-commit attribution. Depth-2 shallow checkout: git rev-list HEAD^1..HEAD^2 sees only a6a617bf of the snapshot's 2 commits (abd11648… unreachable), so the rework between the author's commit and the bot's follow-up cannot be separated; the aggregate HEAD^1..HEAD diff is what was verified.
yamllint — not installable here (pip3: Permission denied at uid 1000); actionlint covers the YAML structure and passed.
Concurrent jobs sharing one runner's workspace: pre-existing pool semantics; the heal fires only on that job's own failed checkout and adds no new surface.
resolve-pr's checkout (the only other in this workflow) runs on ephemeral ubuntu-latest — no pool exposure; repo-wide test gates not run (targeted gate only, per scope).

Methodology

Environment: the CI verify container (node:22-bookworm lane runtime), uid 1000, node v22.23.2, no sudo/shellcheck/zstd preinstalled; actionlint 1.7.12 + shellcheck 0.11.0 installed via the repo's pinned scripts/lint.js --setup. Harnesses live in harness/ (replay-ab.mjs, wipe-matrix.mjs, mutation-matrix.sh): they parse the workflow with the yaml package, execute every run: block verbatim under bash --noprofile --norc -e with cwd = scratch workspace, and evaluate the if: gates from recorded step outcomes. Mutants ran in scratch git worktrees at HEAD with a single YAML edit each; the base arm used a worktree at HEAD^1 (removed after capture, git worktree list clean). Raw per-cell logs: logs/01…06. Evidence images were produced by scripts/verify-capture.mjs rerunning each harness as it printed.

Evidence images

Harness scripts and raw logs are in the workflow run artifacts (7-day retention).

— Qwen Code · sandboxed verification

qwen-code-ci-bot

Reviewed. Suggestions are inline.

Not linted (tool limitation, not a blocker): the executable-script lint — .github/workflows/qwen-code-pr-review.yml: actionlint embedded-shell source mapping is not yet supported — not linted.

中文说明

已审查。建议见行内评论。

未检查（工具限制，非阻断）：the executable-script lint — .github/workflows/qwen-code-pr-review.yml: actionlint embedded-shell source mapping is not yet supported — not linted。

— qwen3.8-max via Qwen Code /review (v0.21.12)

qwen-code-ci-bot

LGTM, looks ready to ship. ✅

Addresses the 16:40 review round on the checkout self-heal: - The wipe-failure test leaned on the real sudo, so it covered a different branch per lane; replace it with a PATH-stubbed sudo that forces both legs to fail hermetically, and pin the survivors left in place plus their oncall-visible warning. - The '|| sudo -n find' escalation leg survived deletion mutants: add a stub-sudo test proving the leg actually runs when user-mode find fails (leg-deletion and '||'->'&&' mutants both verified red). - Reuse the triage idiom's suspicious-path guard before wiping. - Count post-wipe survivors and warn with the count — triage exits 1 here, but the heal chain must stay alive for the retry. - Disclose in the step comment that the sudo leg only helps pool members with passwordless sudo.

qwen-code-dev-bot · 2026-08-15T19:19:52Z

🔀 Base updated: red check(s) [review-pr] pass on current main — merged current main via update-branch; CI will re-run.

中文说明

🔀 已更新 base：红色检查 [review-pr] 在当前 main 上通过 —— 已通过 update-branch 合入当前 main，CI 将重新运行。

qwen-code-ci-bot

Reviewed — no blockers. Suggestions are inline.

Not linted (tool limitation, not a blocker): the executable-script lint — .github/workflows/qwen-code-pr-review.yml: actionlint embedded-shell source mapping is not yet supported — not linted.

中文说明

已审查——无阻断问题。建议见行内评论。

未检查（工具限制，非阻断）：the executable-script lint — .github/workflows/qwen-code-pr-review.yml: actionlint embedded-shell source mapping is not yet supported — not linted。

— qwen3.8-max via Qwen Code /review (v0.21.12)

…vivors (QwenLM#9220)

qwen-code-dev-bot · 2026-08-15T21:33:08Z

🤖 Addressed the latest review feedback (round 2/100). What changed, and what I pushed back on: · 已处理最新评审反馈（第 2/100 轮）。改动内容与我反驳保留之处如下：

Round summary — PR #9220 (review round 4)

All seven round-4 Suggestions are addressed in one commit
(92995a7b6c). Every behavioral claim was reproduced with a probe or a
temporary mutant before implementing, and every fix is pinned by a test
that was mutation-verified against the defect it guards.

Feedback points and dispositions

[Suggestion] case guard misses trailing-slash variants (rc:3790220263, .github/workflows/qwen-code-pr-review.yml:508) — Fixed. Probe reproduced the hole with the verbatim guard patterns: /home/, /root/, /var/, /home//, //, /// all passed the guard while /home/runner/work/x correctly passed through. The wipe step now strips all trailing slashes before the case (while [ "${WS%/}" != "$WS" ]; do WS="${WS%/}"; done), so /home/ → /home (refused), ////// → `` (refused by the empty arm), and a one-shot ${WS%/} is not what was used (`/home//` needs the loop). The new rm-recorder guard test pins all five slash variants plus all seven original values. Scope note: the finding also suggested fixing the sibling copies at `qwen-triage.yml:2579/:3509`; those files are outside this PR's footprint (never touched by it), so they are deliberately left untouched here — the same hole is pre-existing there and best fixed in a separate change to keep this PR reviewable and inside the footprint gate.
[Suggestion] survivor annotation reports a count but not the entry names (rc:3790220270, qwen-code-pr-review.yml:518) — Fixed. Probe against the real script on a permission-locked fixture confirmed the warning carried only 1 entries survived … with no names, while the test comment already claimed "naming them". The warning now includes the surviving entry paths (find … | tr '\n' ' ' | cut -c1-500, capped at 500 chars), and the blocked-wipe test asserts the fixture's entry name appears in the output. The deletion mutant (names dropped) was verified red against the new suite.
[Suggestion] no test pins the wipe step's continue-on-error absence (rc:3790220272, qwen-pr-review-workflow.test.js:2646) — Fixed. Mutant probe first: adding continue-on-error: true to the wipe step left all 126 tests green. The suite now asserts expect(wipe['continue-on-error']).toBeUndefined() alongside the existing first-checkout/retry pins, and the mutant was re-run and killed by exactly that test.
[Suggestion] sudo stub discards its arguments; the escalation test does not pin the leg's target (rc:3790220274, qwen-pr-review-workflow.test.js:2704) — Fixed, with one deliberate strengthening. Mutant probe confirmed the drift: sudo -n find "$WS" → "$WS/does-not-exist" passed all 126 tests. The stub now records its argv (printf '%s\n' "$@" >> marker). The suggested toContain(fixture.dir) assertion turned out to be insufficient — the drifted path $WS/does-not-exist still contains the workspace path as a substring, and the mutant survived it (verified); the assertion therefore checks for the workspace path as an exact argv entry (split('\n') + toContain), which kills the drift mutant.
[Suggestion] the two lockFixture tests assume a non-root runner (rc:3790220276, qwen-pr-review-workflow.test.js:2715) — Fixed. Both tests are wrapped in the repo's established idiom for this fixture shape, it.skipIf(process.platform === 'win32' || process.getuid?.() === 0) (same form as review-source-digest.test.ts:220, package-assets.test.js:500), with the rationale (root bypasses the 0o500 lock via CAP_DAC_OVERRIDE; win32 has no POSIX permission bits) recorded once at the lockFixture helper. No root environment exists on this runner (uid 1000, no sudo binary) to replay the failure live; the skip matches the attested witness and the repo idiom.
[Suggestion] guard test covers only the /home arm (rc:3790220278, qwen-pr-review-workflow.test.js:2770) — Fixed. Mutant probe confirmed the gap: dropping the /var arm from the case left all 126 tests green. The guard test is rebuilt on the sibling rm-recorder idiom (qwen-triage-workflow.test.js:1690-1714): rm is PATH-stubbed to a recorder, all seven values (/, /usr, /etc, /var, /root, /home, '') plus the five trailing-slash variants are driven through the real script, and every value asserts a non-zero exit plus an empty rm-call log. The /var mutant now dies in exactly this test.
[Suggestion] guard test runs the REAL wipe script against live /home with no rm stub (rc:3790220281, qwen-pr-review-workflow.test.js:2776) — Fixed together with the previous finding. The live-/home invocation is gone; under any guard regression the recorder shows the attempted delete and the test fails having deleted nothing. No remaining test points the real script at a live system path (the other exec tests use tmpdir fixtures or abort at ${GITHUB_WORKSPACE:?} before find).

No conflict work: --conflict false, and origin/main was not merged (it is already merged into this branch at 0c778e8ebe).

Verification

Commands actually run, in order:

Baseline (pre-round): npx vitest run --config ./scripts/tests/vitest.config.ts scripts/tests/qwen-pr-review-workflow.test.js — 126 passed.
Probes/mutants on the pre-round tree (all confirmed the findings): echo-only case-guard probe (slash variants pass); real-script blocked-wipe probe (count-only warning); mutant A wipe continue-on-error: true — 126 passed (survived); mutant B sudo target drift — 126 passed (survived); mutant C /var arm dropped — 126 passed (survived).
After the fix: npx vitest run --config ./scripts/tests/vitest.config.ts scripts/tests/qwen-pr-review-workflow.test.js — 126 passed.
Mutant re-runs against the new suite, all killed by the intended test: A (wipe continue-on-error), B (sudo target drift, via the exact-argv assertion), C (/var arm dropped), D (slash normalization removed), E (survivor names dropped).
npm run test:scripts — 1177 passed | 16 skipped | 1 failed: install-script.test.js (standalone-package smoke). Pre-existing, not caused by this round: the same single test fails identically with this round's changes stashed (verified on the pre-round tree); it exercises scripts/create-standalone-package.js, which this PR does not touch.
npm run lint — passed (exit 0).
npm run typecheck — passed (exit 0). One mid-round run reported stale-dist module errors in packages/acp-bridge consumers (TS6305, "has not been built from source"); npm run build refreshed the artifacts and the final typecheck is clean — unrelated to this diff, which touches no TypeScript.
npm run build — passed (exit 0).
npx prettier --check on both changed files — clean.
bash -n on the wipe run: block extracted from the YAML — clean. The workflow YAML itself is parsed by the test suite on every run.
Not available on this runner: actionlint/shellcheck/yamllint binaries (the repo's scripts/lint.js would download them; outside the gate command set). YAML parsing + bash -n + real-script execution in the suite cover the changed block.

中文说明

轮次总结 — PR #9220（review 第 4 轮）

第 4 轮的全部 7 条 Suggestion 已在一个提交（92995a7b6c）中处理完毕。每一条行为性主张都在实现之前用探针或临时突变体验证复现，每一个修复都由一个经过突变验证的测试钉住。

反馈点与处置

[建议] case 守卫遗漏带尾斜杠的变体（rc:3790220263，.github/workflows/qwen-code-pr-review.yml:508）— 已修复。 用守卫模式逐字复制的探针复现了该漏洞：/home/、/root/、/var/、/home//、//、/// 全部穿过守卫，而 /home/runner/work/x 正确放行。wipe 步骤现在在 case 之前剥掉所有尾斜杠（while [ "${WS%/}" != "$WS" ]; do WS="${WS%/}"; done），因此 /home/ → /home（被拒绝）、////// → ``（被空值分支拒绝），且没有采用一次性 ${WS%/}（`/home//` 需要循环处理）。新的 rm 记录器守卫测试钉住了全部 5 个尾斜杠变体加原有 7 个取值。范围说明： 该发现还建议修复 `qwen-triage.yml:2579/:3509` 的姊妹拷贝；这些文件不在本 PR 的足迹内（本 PR 从未触碰），因此刻意不动——同样的洞在那里属于既有问题，最好在单独的变更中修复，以保持本 PR 可审且位于足迹门禁之内。
[建议] 残留项 annotation 只报数量、不报条目名（rc:3790220270，qwen-code-pr-review.yml:518）— 已修复。 在权限锁定夹具上对真实脚本的探针确认警告只有 1 entries survived … 而无名称，尽管测试注释已声称 "naming them"。警告现在包含残留条目的路径（find … | tr '\n' ' ' | cut -c1-500，上限 500 字符），被阻塞 wipe 测试断言夹具条目名出现在输出中。删除名称的突变体已对新套件验证为红。
[建议] 没有测试钉住 wipe 步骤的 continue-on-error 缺失（rc:3790220272，qwen-pr-review-workflow.test.js:2646）— 已修复。 先做突变探针：给 wipe 步骤加 continue-on-error: true 后 126 个测试全绿。套件现在与既有的首次 checkout/retry 钉住并列断言 expect(wipe['continue-on-error']).toBeUndefined()，突变体重跑后恰好被该测试杀死。
[建议] sudo 桩丢弃参数；升级测试没有钉住提权腿的目标（rc:3790220274，qwen-pr-review-workflow.test.js:2704）— 已修复，有一处刻意的加强。 突变探针确认了漂移：sudo -n find "$WS" → "$WS/does-not-exist" 通过全部 126 个测试。桩现在记录 argv（printf '%s\n' "$@" >> marker）。建议的 toContain(fixture.dir) 断言被证明不够——漂移后的路径 $WS/does-not-exist 作为子串仍然包含 workspace 路径，突变体在该版本下存活（已验证）；因此断言改为检查 workspace 路径是精确的 argv 条目（split('\n') + toContain），可杀死漂移突变体。
[建议] 两个 lockFixture 测试假设非 root 运行者（rc:3790220276，qwen-pr-review-workflow.test.js:2715）— 已修复。 两个测试都包上仓库对这种夹具形状的既有惯用法 it.skipIf(process.platform === 'win32' || process.getuid?.() === 0)（与 review-source-digest.test.ts:220、package-assets.test.js:500 同形），理由（root 通过 CAP_DAC_OVERRIDE 绕过 0o500 锁；win32 没有 POSIX 权限位）集中记录在 lockFixture 助手处。本 runner 无 root 环境（uid 1000、无 sudo 二进制），无法实机复现该失败；跳过处理与已验证的证据及仓库惯用法一致。
[建议] 守卫测试只覆盖 /home 分支（rc:3790220278，qwen-pr-review-workflow.test.js:2770）— 已修复。 突变探针确认缺口：删除 case 的 /var 分支后 126 个测试全绿。守卫测试按姊妹文件的 rm 记录器惯用法（qwen-triage-workflow.test.js:1690-1714）重写：rm 被 PATH 前置桩替换为记录器，七个取值（/、/usr、/etc、/var、/root、/home、''）加五个尾斜杠变体全部驱动真实脚本执行，每个取值都断言非零退出 + rm 调用日志为空。/var 突变体现在恰好死在这个测试上。
[建议] 守卫测试在无 rm 桩的情况下对活 /home 运行真实 wipe 脚本（rc:3790220281，qwen-pr-review-workflow.test.js:2776）— 与上一条一并修复。 活 /home 调用已移除；任何守卫回归下，记录器会显示删除企图，测试在什么都没删掉的情况下失败。不再有测试把真实脚本指向活的系统路径（其余 exec 测试使用 tmpdir 夹具，或在 find 之前就被 ${GITHUB_WORKSPACE:?} 中止）。

无冲突处理：--conflict false，且未合并 origin/main（本分支已在 0c778e8ebe 合入 main）。

验证

实际执行的命令（按顺序）：

基线（本轮前）：npx vitest run --config ./scripts/tests/vitest.config.ts scripts/tests/qwen-pr-review-workflow.test.js — 126 通过。
在本轮前树上的探针/突变体（均确认了发现）：仅 echo 的 case 守卫探针（尾斜杠变体穿过）；真实脚本的被阻塞 wipe 探针（只有计数的警告）；突变体 A wipe continue-on-error: true — 126 通过（存活）；突变体 B sudo 目标漂移 — 126 通过（存活）；突变体 C 删除 /var 分支 — 126 通过（存活）。
修复后：npx vitest run --config ./scripts/tests/vitest.config.ts scripts/tests/qwen-pr-review-workflow.test.js — 126 通过。
突变体对新套件重跑，全部被预期测试杀死：A（wipe continue-on-error）、B（sudo 目标漂移，由精确 argv 断言杀死）、C（删除 /var 分支）、D（移除尾斜杠归一化）、E（移除残留项命名）。
npm run test:scripts — 1177 通过 | 16 跳过 | 1 失败：install-script.test.js（独立打包冒烟）。既有失败，与本轮无关： 本轮改动 stash 后同一测试以完全相同的方式失败（已在轮前树上验证）；它执行的是本 PR 未触碰的 scripts/create-standalone-package.js。
npm run lint — 通过（exit 0）。
npm run typecheck — 通过（exit 0）。轮中有一次运行报告了 packages/acp-bridge 消费方的 dist 过期模块错误（TS6305，"has not been built from source"）；npm run build 刷新产物后最终 typecheck 干净——与本 diff 无关（未触碰任何 TypeScript）。
npm run build — 通过（exit 0）。
对两个改动文件执行 npx prettier --check — 干净。
对从 YAML 提取的 wipe run: 块执行 bash -n — 干净。workflow YAML 本身在每次测试运行时都被套件解析。
本 runner 不可用：actionlint/shellcheck/yamllint 二进制（仓库的 scripts/lint.js 需要下载它们，超出门禁命令集）。YAML 解析 + bash -n + 套件内真实脚本执行覆盖了改动块。

Base-conflict check · 基分支冲突检查: no conflict with main. · 与 main 无冲突。

Re-review when you have a moment. After round 100 this bot stops and leaves the PR for a human. · 有空请复审；第 100 轮后本 bot 停止并将 PR 交给人工。

🧠 Handled by Qwen Code · model/模型 qwen3.8-max

qwen-code-ci-bot

Reviewed. Suggestions are inline.

Not explored to full depth (tool budget reached): "agent 3c": none — no check was cut short (~13 of ~35 tool calls used)..

Not linted (tool limitation, not a blocker): the executable-script lint — .github/workflows/qwen-code-pr-review.yml: actionlint embedded-shell source mapping is not yet supported — not linted.

中文说明

已审查。建议见行内评论。

未探索到全部深度（达到工具调用预算）："agent 3c"：none — no check was cut short (~13 of ~35 tool calls used).。

未检查（工具限制，非阻断）：the executable-script lint — .github/workflows/qwen-code-pr-review.yml: actionlint embedded-shell source mapping is not yet supported — not linted。

— qwen3.8-max via Qwen Code /review (v0.21.12)

…unner workspace (QwenLM#9220)

qwen-code-ci-bot · 2026-08-16T13:21:16Z

Sandboxed verification: ✅ passed — merge-ready (agent verdict) - workflow run

Ran the PR in an isolated, token-free container: A/B against the base build, mock-free harness assertions, targeted gates. Advisory evidence for human reviewers — not a review, an approval, or a CI check.

Scripted assertions: 138 passed · 0 failed · 138 total

中文 — 判定：✅ 通过 · 可合入（agent 判定）

沙箱验证在隔离、无凭证的容器中执行了该 PR 的代码（与 base 构建 A/B 对照、无 mock harness 断言、定向门禁）。仅作为评审证据，不构成评审、批准或 CI 检查。

脚本断言：138 通过 · 0 失败 · 138 总计

Verification report

PR #9220 Deep Verification (round 6) — fix(ci): self-heal failed checkouts on the reused review runners

Verdict: merge-ready — 138 scripted assertions executed, 138 pass, 0 fail (breakdown in Methodology).
Verified head: 952792a5297d025c083c5d8b98d6223b90af743d (git rev-parse HEAD^2). Verified base: 62014c01883d22210746717a9f943e81ae224fa5 (HEAD^1) — byte-equal to the snapshot's baseRefOid, so this round has no base drift: the A/B ran against exactly the tip the merge lands on. This is a follow-up round (round 5 was merge-ready at head 83777489); every carried measurement was rebuilt and re-run from scratch at the new head — nothing carried on the shortcut. The head advanced by one substantive commit (90fa6bb4, BSD-userland suite fix) plus a merge of origin/main into the branch (952792a5, which resolved a conflict in the test file); the base under the merge advanced to 62014c01, whose only effect on this file is +26 pre-existing tests (see Corrections).

中文 — 判定：✅ 通过 · 可合入（agent 判定）

沙箱验证在隔离、无凭证容器中执行（与 base A/B 重放对照、真实 git 损坏恢复、真实执行 harness、BSD userland 增量 A/B、突变矩阵、定向门禁）。仅作为评审证据，不构成评审、批准或 CI 检查。脚本断言：138 通过 · 0 失败 · 138 总计。

本轮背景：第 6 轮，head 前进到 90fa6bb4（BSD userland 套件修复）+ 一次 main 合入（952792a5，测试文件有冲突并已解决）；base 无漂移（62014c01 == 快照 baseRefOid）。所有旧测量全部重跑。
核心结论：自愈链继续成立——corrupt workspace 下 base 一次失败即终局、head 清空后重试且参数字节级一致、双失败保持红（表 A/B replay cells，见证 01-ab-replay-base-vs-head-corrupt-workspace.png）；真实 git 损坏经真实 wipe 脚本 + 重克隆恢复（02-real-git-corruption-heal.png）。
增量验证（本轮重点）：新提交让套件在非 GNU userland 上保持绿色——模拟 BSD realpath（拒绝 -m）下 head 为 12 通过 + 1 跳过、软链 TMPDIR 下同样绿色；而重建的 pre-delta 测试文件在同样环境下分别以 1 失败/12 通过、3 失败/10 通过复现提交信息所述两种失败形态（04-bsd-userland-delta-ab.png）。GNU 主机上 13/13 全跑，规范化突变 M1 仍被杀死。
上轮发现：.. 词法逃逸残留仍存在（W7.2 重测）；M2/M10/M11 存活突变仍存在（分类不变），另新增一个探针突变存活者 M17（完整性备注，见 Findings 3）；"unset or empty" 测试名漂移仍存在；actionlint/shellcheck 卡死连续两轮未复现。
更正：PR 正文 "131 tests pass" 已过期——head 实测 157（main 合入给该文件带来 26 个既有测试）；"Thirteen new tests" 现在正确（13 个 heal 测试）。
未覆盖：重放未经真实 run annotation 校准（无 token）；sudo 兜底腿真实 root 执行（容器无 sudo）；逐提交归因（浅克隆 10 提交仅 1 可达）；yamllint（pip3 无执行位，环境级，已证明）；仓库级门禁。

Previous-finding status (round 5 → round 6 head `952792a5`)

#	Round-5 finding	Severity	Status at round 6
1	Lexical `..`-escape reaches rm on the no-realpath fallback axis	Note	stands, re-measured — wipe matrix W7.2: with realpath stubbed, `$RWS/sub/../../w7-outside-canary` string-matches the allowlist and the rm recorder logged `-rf …/w7-rws/sub/../../w7-outside-canary/canary` (raw `..` argv, nothing actually deleted). The other 21 ladder shapes still refused without realpath (W7.1 21/21); the legitimate control still wipes on the same axis (W7.3). Blast radius unchanged: runner-set `GITHUB_WORKSPACE` + an image without coreutils `realpath` both required; this lane ships `/usr/bin/realpath` (measured).
2	Surviving mutants (M2/M10/M11 after round 5's delta killed M12)	Note	stand, re-measured — matrix re-run at the new head: M2/M10/M11 survive with unchanged classifications (Findings 2). No mutant regressed killed→survived; 15/19 killed. One NEW survivor discovered this round (probe mutant M17, Findings 3).
3	`refuses to wipe when GITHUB_WORKSPACE is unset or empty` names "unset" but the fixture exercises only empty	Note	stands, re-measured — source scan: fixture passes only `GITHUB_WORKSPACE: ''`; live run with the variable truly unset refuses (exit 1, `bash: line 8: GITHUB_WORKSPACE: parameter null or not set`). Name/fixture drift, not a hole.
4	Intermittent actionlint+shellcheck stall (environmental)	Note	not reproduced, second round running — wrapper `--actionlint` 0.07 s, `--shellcheck` 12.44 s, direct per-arm actionlint 0.012 s (head) / 0.016 s (base); round 4 measured ~100 s stalls on identical input. Both gates proven live by planted-violation probes (L5/L7).

Carried corrections: #2 (wipe preserves the directory, better than the plan's "recreates" — re-verified W1/F3) and #3 (runner default shell includes -o pipefail — re-verified F4) remain accurate. Correction #1 was partially addressed — see Corrections.

Round-6 delta: BSD-userland suite fix, proven load-bearing by A/B

The delta commit 90fa6bb4 (per its commit message; per-commit diffs are unreachable at depth 2) is test-file-only plus a YAML comment: it adds a hasGnuRealpath host probe (spawnSync('realpath', ['-m', '--', '/'])), gates the canonicalization test on it.skipIf(!hasGnuRealpath) instead of running it everywhere, and canonicalizes the lock fixture's RUNNER_WORKSPACE half (realpathSync(tmpdir())) so both halves of the allowlist comparison are spelled the same way on symlinked-tmpdir hosts. The YAML's heal script itself is unchanged in behavior; the only YAML delta is a comment recording that -m is GNU-only.

The A/B below reconstructs the pre-delta state by reverting exactly those two hunks in a scratch worktree, then drives both builds through the same environments:

Cell	Build	Environment	Result (heal describe, 13 tests)
B1	head	this GNU lane	13 pass, 0 skip (probe reads true; coverage kept)
B2	head	BSD realpath stub on PATH	12 pass, 1 skip, 0 fail — skipped test is exactly `refuses an allowlist-escaping .. path via canonicalization`
B3	head	BSD stub + symlinked TMPDIR	12 pass, 1 skip, 0 fail
B4	head	symlinked TMPDIR alone (GNU)	13 pass (lock-fixture canonicalization holds on the macOS `/var → /private/var` shape)
B5	pre-delta reconstruction	BSD stub	1 failed / 12 passed — the failing test is the canonicalization test (the commit's reported shape)
B6	pre-delta reconstruction	BSD stub + symlinked TMPDIR	3 failed / 10 passed — canonicalization test + both lock-fixture tests, which throw before any assertion because the resolved workspace sits outside the raw allowlist root (the commit's second reported shape)
B7	head (restored)	this GNU lane	13 pass (harness integrity)

Witness: 04-bsd-userland-delta-ab.png. Both failure shapes the commit message reports were reproduced byte-for-byte in cell counts, and the shipped head is green in all four environments. The delta's mutation claim ("deleting the canonicalization line still turns the test red on a GNU host") also holds at this head — mutant M1 is killed by exactly that test (mutation matrix).

The merge commit 952792a5 resolved a conflict in the test file against the newer main tip; the merged file's non-heal tests are exercised by the full-suite gates below (144 base tests green at head, in both directions).

Central claim and A/B proof

Central claim: on the reused self-hosted review pool, a failed base-branch checkout is no longer terminal — the job wipes the whole workspace once and retries the byte-identical checkout; on a successful first checkout nothing changes; a double failure stays red.

The checkout action cannot run in this sandbox, so the A/B is a step-chain replay: both YAMLs parsed with the repo's yaml package, every review-pr step up to (not including) Resolve PR context executed for real under the runner shell contract (bash --noprofile --norc -e -o pipefail, cwd = scratch workspace, pool geometry GITHUB_WORKSPACE one level inside RUNNER_WORKSPACE), actions/checkout stubbed by the bug's failure model (poison marker inside the workspace ⇒ the incident's exact remote did not send all necessary objects / Could not read … / Failed to traverse parents … lines until a wipe removes it; network marker ⇒ a network that stays down). This reproduces the shape of the failure, not its git-internal cause — see Not covered. Witness: 01-ab-replay-base-vs-head-corrupt-workspace.png.

A/B replay cells

Cell	Environment	Oracle	Result
BASE/corrupt	base YAML, poisoned workspace	job status, attempts, poison survival	red after 1 attempt, poison survives, review never reached (expected red — the bug)
HEAD/corrupt	head YAML, poisoned workspace	attempts, poison gone, dir preserved, params identical, next step reached	green, 2 attempts, wipe fired, junk (node_modules) wiped too, retry params byte-identical (ref/fetch-depth), reached `Resolve PR context`
HEAD/clean	head YAML, healthy git repo + canary	heal skipped, canary survives	green, 1 attempt, wipe AND retry both SKIP, canary intact
BASE/clean	base YAML, A/A parity	identical end state	green, 1 attempt, canary intact
HEAD/double-fail	head YAML, network stays down	job red, exactly 2 attempts, wipe between them	red, 2 attempts, wipe fired at trace index between checkout and retry, review never reached

28/28 assertions including stub fidelity (incident lines emitted while poisoned, success once healed) and control purity (base YAML has no heal steps). Recovery from a corrupt workspace: head 1/1, base 0/1.

Real-git corroboration (cause, not just shape)

02-real-git-corruption-heal.png: a file://-cloned workspace with its object store deleted but refs kept fails git fsck on missing blobs and git log dies (fatal: bad object HEAD) — the incident's corruption shape; the real extracted wipe script empties the workspace and preserves the directory; a fresh clone into it passes fsck and traverses all 3 commits. 13/13 assertions. Same honest caveat as round 5: an honest loopback server re-sends whatever the corrupt client lacks, so the terminal negotiation failure itself is modeled by the replay stub.

Wipe matrix — real execution of the extracted `run:` block

33/33 assertions. Witness: 03-wipe-matrix-guard-ladder-allowlist.png. Guard probes use a PATH-fronted rm recorder; a regressed guard is proven by its call log with nothing deleted.

Cell	Scenario	Observed
W1	legitimate wipe in pool geometry (real rm): nested dirs, `.git`, dotfiles, `dir with space`, symlink escaping to an outside canary	emptied incl. dotfiles, directory preserved, exit 0, success warning, no survivors warning, outside canary untouched
W2/W3	`GITHUB_WORKSPACE` unset / empty	refused, error names the variable, rm never invoked (container ships `GITHUB_WORKSPACE`; the unset cell deletes it from the child env explicitly)
W4	whole workspace locked (0o500) + failing sudo stub (both legs fail)	exit 0 (chain alive), wipe-failed warning, `2 entries survived` naming both survivors incl. the one with a space
W5	locked workspace + argv-recording sudo stub exiting 0	sudo leg ran with `-n find`, argv targets exactly the workspace, then-branch warning
W6	hostile ladder WITH realpath (22 shapes: roots, trailing slashes, `//`, dot-components, `/tmp`, `/opt`, symlink→/etc, `..`-spellings)	all refused, zero rm invocations
W7	same ladder with realpath stubbed + `..`-escape + legitimate control	21/21 lexical shapes refused; the `..`-escape reaches rm (Finding 1, raw argv recorded); legitimate workspace still wipes
W8	allowlist boundary: `WS==RWS` exactly, prefix-sibling `$RWS-evil`, legitimate WS with trailing slash	first two refused with zero rm; legitimate wiped
W9	`RUNNER_WORKSPACE` edges: `/`, empty, unset, trailing-slash without realpath, nonexistent WS inside RWS	refused/refused/refused/wiped/exit 0 as designed

Mutation matrix — test pinning at the round-6 head

Control (unmutated heal describe): 13/13 green. Witness: 05-mutation-matrix-probe-mutants.png. 21/21 assertions (control + 19 mutants with attribution).

Mutant	Change	Round 5	Round 6
M1	drop WS `realpath -m` canonicalization	killed	killed by `refuses an allowlist-escaping .. path via canonicalization` (the delta's mutation claim, re-verified)
M2	drop denylist `case`	survives	survives (Findings 2)
M3	drop allowlist `case`	killed	killed by both guard tests
M4	drop RWS strip loop	killed	killed by the trailing-slash-RWS test
M5	`RUNNER_WORKSPACE :?` → bare	killed	killed by `refuses to wipe when RUNNER_WORKSPACE is unset or empty`
M6	drop empty-RWS `resolved to /` refusal	killed	killed by `refuses to wipe when RUNNER_WORKSPACE resolves to /`
M7	delete `\|\| sudo -n find` leg	killed	killed by `escalates to the sudo leg when the user-mode wipe fails`
M8	wipe condition `\|\|` → `&&`	killed	killed by the same test
M9	delete survivors count+warning	killed	killed by `exits 0 and keeps survivors when BOTH wipe legs fail`
M10	survivors `wc -l` → `wc -c`	survives	survives (Findings 2)
M11	`GITHUB_WORKSPACE :?` → bare	survives	survives (Findings 2)
M12	drop WS strip loop	killed	killed by `refuses a trailing-slash GITHUB_WORKSPACE when realpath is absent`
M13	drop `continue-on-error`	killed	killed by `makes the first checkout failure survivable and addressable`
M14	drop `id: 'checkout'`	killed	killed by the same test
M15	gates `'failure'` → `'success'`	killed	killed by `wipes and retries exactly when the first checkout fails`
M16	retry `fetch-depth: 0 → 1`	killed	killed by `retries with the identical checkout`
M17	new: probe `hasGnuRealpath` forced `false`, run on GNU lane	—	survives (12 pass + 1 skip, suite green) — Findings 3
M18	new: probe forced `true`, run under BSD realpath	—	killed by the canonicalization test — the probe's BSD direction IS behaviorally pinned
M0	coarse whole-file revert to base YAML	11 red / 2 green	11 red / 2 green — the two greens are the two `toThrow()` tests, green for the wrong reason (wipe step absent ⇒ `wipe.run` throws before any assertion)

No mutant regressed from killed to survived. Regression direction: the base test file (144 tests) against the head YAML: 144/144 green; base parity at the base tip: 144/144 green (suites harness). Head full suite: 157 pass / 0 fail / 0 skip (06-head-suite-157-pass.png).

Corrections

Description count drift (not a code-change request), new shape: the body now says "Thirteen new tests pin the chain … 131 tests pass". The thirteen claim is correct (13 it() blocks under checkout self-heal, counted from source; round-5's "Five new tests" correction is addressed). The total is stale: the suite at head is 157/157 — the merge of main into the branch brought 26 pre-existing tests into this file (base parity measures 144 there vs 118 at round 5's base tip), so 144 + 13 = 157, not 131.
(Carried) The test plan says the wipe "recreates the directory"; the implementation preserves it (find -mindepth 1 -maxdepth 1) — the better behavior, re-verified in W1/F3.
(Carried) The runner's documented Linux default shell includes -o pipefail; the tests reproduce it (bash -e -o pipefail -c wipe.run, F4).

Findings

1. Note (non-blocking): the no-realpath fallback still admits a lexical `..`-escape — stands

Re-measured (W7.2): with realpath stubbed, GITHUB_WORKSPACE=$RWS/sub/../../<outside> string-matches "$RWS"/* and reaches rm — the recorder logged -rf <raw .. path>/canary while nothing was deleted; with realpath present (W6) the same shape is refused by canonicalization. Reproduce: node tmp/pr9220-verify-20260816-133108/harness/wipe-matrix.mjs (cell W7). Blast radius unchanged and bounded: GITHUB_WORKSPACE is set by the runner from its registered work directory, never from PR input, and the residual additionally requires an image without coreutils realpath — the pool's node:22-bookworm container ships it (measured here: /usr/bin/realpath, -m exits 0). Recorded for awareness only.

2. Note: three surviving mutants, classified (completeness reporting, not merge conditions) — stands for M2/M10/M11

M2 (denylist dropped) — redundant layer since the allowlist landed: a canonicalized path inside "$RWS"/* can match a denylist arm only if the runner workspace itself sits under a guarded root; no realistic pool layout does. Belt-and-braces; no test can pin a unique outcome for it.
M10 (wc -l → wc -c) — coverage gap: the survivors count value is asserted by no test (only the warning's presence and the names); control flow does not depend on the number.
M11 (WS :? dropped) — redundant layer: set -u aborts the unset case and the "" denylist arm catches empty; only the error text differs.

3. Note (new this round): the GNU-host truth of the `hasGnuRealpath` probe is unpinned — completeness only

Mutant M17 (probe forced false) runs green on this GNU lane — the canonicalization test simply skips, and nothing in the suite notices. By the design of skipIf, a probe that wrongly reads false on a GNU host would silently drop the canonicalization coverage everywhere, and a later M1-class regression could ship green with it. The other direction IS pinned: M18 (probe forced true) fails under a BSD userland exactly on the gated test. The probe runs the real realpath -m -- / binary, so breaking it requires editing the probe line itself — visible in any diff review — which is why this stays a completeness note rather than a merge condition.

4. Note: test name promises more than the fixture — stands

refuses to wipe when GITHUB_WORKSPACE is unset or empty exercises only GITHUB_WORKSPACE: ''. Behaviorally both cases refuse identically (re-proven: truly-unset run exits 1 naming the variable), so this is a name/fixture drift, not a hole.

5. Note: intermittent actionlint+shellcheck stall (environmental) — not reproduced, second round running

Round 4 measured ~100 s stalls; rounds 5 and 6 both measure sub-13 s on identical input with both liveness probes green. Non-determinism on identical input keeps the attribution environmental; all deterministic gates are green on both arms.

6. Note (observation): shellcheck style notes on the wipe block; no repo gate scans YAML run blocks

With the repo's shellcheck flags (--enable=all --severity=style), the extracted wipe block draws only style notes — SC2250 (brace the variables), SC2292 (prefer [[ ]]), SC2249 (default case arm; the denylist deliberately falls through to the allowlist layer) — and exits 0 at severity=warning (L6/L6b). Pre-existing configuration, not a PR defect: the repo's shellcheck gate scans tracked shell files only and its actionlint runs with -shellcheck=, so bash inside run: blocks is gated nowhere in CI — the vitest suite that executes the script verbatim is its only coverage, and it is green (L8).

Not covered

Replay calibration. No token, no retrievable real run annotations — the replay remains uncalibrated: the stub reproduces the shape of the corrupt-workspace failure (its exact error lines), not the git negotiation that produces it. The real-git harness proves the corruption and the wipe+re-clone recovery with real git; the durable proof ("next real checkout failure heals") is only observable on the pool, as the PR itself states.
Real sudo fallback execution. Container is uid 1000 with no sudo binary; the leg is verified by argv-fidelity shim (W5), real permission-denied paths (W4), and the BSD/symlink probes, not by an actual root find.
Per-commit attribution. Depth-2 shallow checkout: git rev-list HEAD^1..HEAD^2 sees 1 of the snapshot's 10 commits (and --is-shallow-repository is true), so the aggregate HEAD^1..HEAD diff (2 files, +525/−1) is what was verified; per-commit behavior attribution was out of reach.
macOS lane behavior — simulated via the BSD realpath stub and symlinked TMPDIR (cells B2–B6), not run on Darwin.
yamllint — re-measured as environmental: pip3 exists on PATH without an execute bit (wrapper fails with xargs: yamllint: Permission denied; --setup fails only at the yamllint install, L0/L3/L3b). actionlint covers the YAML structure and passed with liveness probes on both arms.
Repo-wide lint/test gates (targeted suite + changed files only, per scope).
Harness self-corrections this round (documented, not findings about the PR): the first replay run had a trace-index arithmetic bug of mine (wipe correctly sat between checkout and retry at indices 3/4/5); the container ships GITHUB_WORKSPACE, which leaked into the first "unset" cell until the env merge learned to delete keys; the W7.3/W8 legitimate cells first ran with the rm recorder still on PATH (no-op wipe); lint L0/L6 encodings adjusted (setup exits 1 on the yamllint image block; an extracted run: block needs a shebang for shellcheck). All fixed and re-run from the same harnesses; the PR's behavior was never in doubt by these.

Methodology

Environment: CI verify container (node:22-bookworm lane runtime), uid 1000, node v22.23.2, /usr/bin/realpath present and GNU (-m exits 0), no sudo binary, /tmp a real directory. Harnesses in harness/ (replay-ab.mjs, real-corruption.mjs, wipe-matrix.mjs, bsd-delta.mjs, mutation-matrix.mjs, suites.mjs, lint-gates.mjs, findings-remeasure.mjs, tally.mjs): they parse the workflow with the repo's yaml package and execute every relevant run: block verbatim under bash --noprofile --norc -e -o pipefail with cwd = scratch workspace; the replay emulates runner semantics (continue-on-error, steps.<id>.outcome gates) in pool geometry. BSD/mutation/suite cells ran in scratch git worktrees at HEAD (tmp/scratch-tree, removed after; git worktree list shows the main tree only) and at HEAD^1 (tmp/base-tree, removed after); node_modules resolution for those trees walks up to the root install, which is a clean control because the PR touches no package.json/lockfile (no workspace symlinks are crossed by these test paths). Assertion totals: replay 28 + real-git 13 + wipe matrix 33 + BSD delta 10 + mutation 21 + suites 7 + lint gates 14 + findings re-measure 12 = 138 pass / 0 fail (assertions.json). Raw logs and per-cell vitest JSON: logs/; evidence images produced by scripts/verify-capture.mjs rerunning each harness as it printed.

Evidence images

Harness scripts and raw logs are in the workflow run artifacts (7-day retention).

— Qwen Code · sandboxed verification

qwen-code-ci-bot · 2026-08-16T13:33:46Z

Triage re-run completed without a new review.

⚠️ The bot has neither a verdict nor a deferral on 952792a5297d025c083c5d8b98d6223b90af743d — no APPROVED, CHANGES_REQUESTED, or COMMENTED review of its own. A DISMISSED one does not count: dismiss_stale_reviews voids the bot's approval on every push, which is exactly when a fresh one is needed. If this re-run was meant to review or approve, it did not, and an approval left by another account is a separate vote that does not count as the bot's own.

⚠️ 机器人在 952792a5297d025c083c5d8b98d6223b90af743d 上既没有裁决也没有 defer —— 没有属于它自己的 APPROVED、CHANGES_REQUESTED 或 COMMENTED 评审。DISMISSED 不算：dismiss_stale_reviews 会在每次推送时作废机器人的批准，而那恰恰是需要一次新批准的时刻。如果这次重跑本应评审或批准，那么它没有做到；而其他账号留下的批准是另一张票，不能算作机器人自己的。

The stage comments above were updated with the latest result. View workflow run.

上方各阶段评论已更新为最新结果。查看工作流运行。

qwen-code-ci-bot

LGTM, looks ready to ship — CI landed green after the review. ✅

qwen-code-ci-bot

Partially reviewed — gaps disclosed. Suggestions are inline.

Not reviewed: build-and-test — the macOS merge-queue lane did not run at this head (all check runs at the reviewed SHA were cancelled; the lane is merge-queue-only by design); the suite ran green on Linux (157/157) and the macOS gating fixes were traced in code.

Not linted (tool limitation, not a blocker): the executable-script lint — .github/workflows/qwen-code-pr-review.yml: actionlint embedded-shell source mapping is not yet supported — not linted.

中文说明

仅完成部分审查，审查缺口已披露。建议见行内评论。

未审查：build-and-test — the macOS merge-queue lane did not run at this head (all check runs at the reviewed SHA were cancelled; the lane is merge-queue-only by design); the suite ran green on Linux (157/157) and the macOS gating fixes were traced in code。

未检查（工具限制，非阻断）：the executable-script lint — .github/workflows/qwen-code-pr-review.yml: actionlint embedded-shell source mapping is not yet supported — not linted。

— qwen3.8-max via Qwen Code /review (v0.21.12)

qwen-code-dev-bot · 2026-08-16T15:00:39Z

🤖 Reviewed the latest feedback — no changes needed. Why, point by point: · 已审阅最新反馈——无需改动。逐点说明原因如下：

Autofix round: no action required

This round ran in Critical-only mode (5 change-producing rounds already complete) and found nothing actionable:

Feedback: the actionable Reviews / Inline comments / Issue-level comments sections are empty. Cross-checked against the raw feedback dumps: every item newer than the last evaluation (2026-08-16T12:14:36Z) is either (a) the automated reviewer's two inline findings and its COMMENTED review — all [Suggestion] severity, correctly placed in the deferred section by the deterministic brake; (b) the previous round's own summary; (c) a @qwen-code /triage command; or (d) a triage re-run status comment. None is actionable feedback for this PR.
Deferred non-Critical feedback: per Critical-only mode, the deferred section is an audit record, not work — no code changes, no thread resolutions, no replies were made for it. The items remain open for human follow-up.
Checks: every "failed" check is CANCELLED, not FAILURE. They are the superseded runs cancelled at 13:14:50–51 UTC when the merge commit 952792a529 was pushed; replacement runs of the same workflows succeeded at this head — Test (ubuntu-latest, Node 22.x), Desktop Shell (ubuntu-22.04, windows-2022), web-shell E2E Smoke, Dependency CVE audit, Secret scan (TruffleHog), Classify PR, precheck, authorize, delay-automatic-review, review-pr. No still-red checks persist. The macOS/windows test and integration lanes were SKIPPED by design in the replacement runs, not failed.
Conflicts: none reported (--conflict false); no merge performed.

No code changes were made and no commit was created.

Verification

No verification commands were run this round because no change was made — there was nothing to build, typecheck, lint, or test, and nothing was committed. CI at head 952792a529 is green per the replacement runs listed above; the previous round's full verification of this exact tree is recorded in its round summary.

中文说明

Autofix 轮次：无需任何操作

本轮在 Critical-only 模式下运行（此前已完成 5 个产生改动的轮次），未发现任何可执行事项：

反馈：可执行的 Reviews / Inline comments / Issue-level comments 区域均为空。已与原始反馈数据交叉核对：上次评估（2026-08-16T12:14:36Z）之后的所有条目，要么是（a）自动审查者的两条行内 finding 及其 COMMENTED review —— 均为 [Suggestion] 级别，已被确定性刹车机制正确归入延后区域；要么是（b）上一轮自己的总结；（c）一条 @qwen-code /triage 命令；或（d）triage 重跑状态评论。均不是针对本 PR 的可执行反馈。
延后的非 Critical 反馈：按 Critical-only 模式，延后区域是审计记录而非工作 —— 未对其修改任何代码、未解决任何线程、未做任何回复。这些条目保持开放，留待人工跟进。
检查项：所有"失败"检查均为 CANCELLED，而非 FAILURE。它们是合并提交 952792a529 推送时（UTC 13:14:50–51）被取消的过期运行；同一批工作流的替代运行已在当前 head 上成功 —— Test (ubuntu-latest, Node 22.x)、Desktop Shell (ubuntu-22.04, windows-2022)、web-shell E2E Smoke、Dependency CVE audit、Secret scan (TruffleHog)、Classify PR、precheck、authorize、delay-automatic-review、review-pr。没有持续红色的检查项。macOS/windows 测试与集成测试通道在替代运行中按设计 SKIPPED，并非失败。
冲突：未报告冲突（--conflict false）；未执行任何合并。

本轮未做任何代码改动，也未创建任何提交。

验证

本轮未运行任何验证命令，因为没有产生任何改动 —— 没有需要 build、typecheck、lint 或测试的内容，也没有提交任何内容。head 952792a529 上的 CI 按上述替代运行结果为绿色；上一轮对同一棵代码树的完整验证记录在其轮次总结中。

Deferred non-Critical feedback

Critical-only mode is active: 5 change-producing rounds are complete. The workflow excluded the non-Critical feedback below from this round's actionable sections; the items remain open for human follow-up. Maintainer feedback is deferred only after its author has used 2 regular feedback batches in this window's Critical-only tail; authors at that budget, if any, are named below. (@qwen-code /retry starts a fresh counting window.)

Review by @qwen-code-ci-bot: fix(ci): self-heal failed checkouts on the reused review runners #9220 (review)
Inline rc:3791993415 scripts/tests/qwen-pr-review-workflow.test.js:2997: fix(ci): self-heal failed checkouts on the reused review runners #9220 (comment)
Inline rc:3791993420 .github/workflows/qwen-code-pr-review.yml:569: fix(ci): self-heal failed checkouts on the reused review runners #9220 (comment)
PR comment by @qwen-code-ci-bot: fix(ci): self-heal failed checkouts on the reused review runners #9220 (comment)
PR comment by @qwen-code-ci-bot: fix(ci): self-heal failed checkouts on the reused review runners #9220 (comment)

中文说明

已进入仅处理 Critical 的模式：已完成 5 个产生改动的轮次。本轮可执行区域已排除下方非 Critical 反馈；这些条目保持开放，留待人工跟进。维护者反馈仅在其本人于本窗口 Critical-only 阶段已使用 2 批常规反馈预算后才会延后；达到预算的作者（如有）在下方点名。（评论 @qwen-code /retry 可开启新的计数窗口。）

Base-conflict check · 基分支冲突检查: no conflict with main. · 与 main 无冲突。

🧠 Handled by Qwen Code · model/模型 qwen3.8-max

doudouOUC

Re-reviewed the current head 952792a5 after the merge from main. No blockers found.

The checkout-heal chain is coherent end to end: the first checkout failure is survivable and addressable, the wipe and retry are gated on its actual outcome, the wipe canonicalizes and constrains the target under RUNNER_WORKSPACE, the retry is byte-identical to the first checkout, and a second checkout failure still fails the job. No downstream step consumes outputs from the failed first checkout.

Verification:

checkout self-heal tests on stock macOS/BSD userland: 12 passed, with the GNU-only canonicalization case correctly skipped
the same tests with GNU realpath: 13 passed
extracted wipe script: bash -n and ShellCheck clean
current-head Ubuntu and review workflow checks are green

The full workflow test file has one macOS-only runner-health fixture failure, but the same test fails unchanged on the base commit, so it is not introduced by this PR. Approved.

qwen-code-ci-bot · 2026-08-17T02:27:46Z

Released in v0.21.13.

…ve-ab wipes (QwenLM#9277) * fix(ci): back-port the checkout-heal wipe guard to the triage and serve-ab wipes The "empty the workspace, keep the directory" idiom exists in three copies; only the review workflow's copy received the QwenLM#9220 hardening (canonicalization, trailing-slash strip, RUNNER_WORKSPACE allowlist). Measured on main for QwenLM#9265, the two triage guards let non-canonical spellings of the guarded roots through (/home/, /home/., //usr, /root/, /var/ all reached the rm), and serve-ab's wipe had no guard at all — even `/home` or an empty string arrived at `find … -exec rm -rf`. Port the reference guard to all three sites, keeping each site's exit contract: triage fails loud both before and after external code, serve-ab stays bare under the job's `-eo pipefail` so an unclearable workspace fails before either checkout builds on top of the leftovers. Pin each ported copy with its own tests: bad-path batteries under an rm recorder (the destructive primitive cannot fire under any edit), an allowlist-escaping `..` case gated on a GNU-realpath host probe (the lesson from 90fa6bb), a realpath-absent trailing-slash RUNNER_WORKSPACE case, and text pins on the ported layers. Every pin was mutation-verified red against a deletion of the layer it guards. * test(ci): pin guarded serve wipe * fix(ci): close wipe guard fallback gaps * fix(ci): fail closed without realpath * fix(ci): keep wipe guards portable * test(ci): pin wipe-guard RWS layers and unmask the pre-run battery - run the rewritten pre-run sweep battery under -e -o pipefail so a failing sweep can no longer report success (bare bash -c masked it) - pin the RWS '..' refusal and degenerate-root refusal text in all copies, and add RUNNER_WORKSPACE='/' exec cases to both copy suites - exercise both pre-run and post-run copies in the realpath-absent refusal test - replace the '..' escape vector with a symlink escape that only the realpath line can refuse, and correct the mutant-outcome comments - add the serve-ab wipe-before-checkouts ordering pin from the sister suite and a happy-path RWS canonicalization pin * test(ci): correct wipe-guard mutant-outcome comments for find -P The symlink-escape comments claimed that with the WS realpath line deleted, find reaches rm through the link target. GNU find's default -P mode does not descend symlink operands: the mutant passes every guard, wipes nothing, and exits 0, so only the non-zero-status assertion catches it — the rm-log assertion passes vacuously. Reword both twin comments (R5-1). --------- Co-authored-by: yiliang114 <yiliang114@users.noreply.github.com>

The revived macOS lane ran the shared suite for the first time since the merge queue went dark and failed on exactly three tests, identical across three consecutive runs: the bite-check block and the baseline A/B green path die with `mapfile: command not found` (a bash >= 4.4 builtin; macOS ships 3.2), and the health-probe repair case trips over BSD `mktemp -u` attempting to create where GNU's print-only `-u` just names the canary. Both suites pin scripts that only ever execute on Linux runners — ubuntu-latest or the Linux ECS pool — so the defects cannot exist in production; the suites just cannot run those scripts on a macOS host. Follow the convention #9220's fix established for the realpath case in the same file: probe the host capability, not the platform, and skipIf the three dependent tests where it is absent. A Mac with a newer bash or GNU coreutils fronting PATH keeps the coverage; the Linux lane runs all three unconditionally. The large bite-check test body is re-indented by prettier around the new skipIf wrapper; no other token changed.

…-retry (QwenLM#9327) * refactor(ci): simplify the review checkout self-heal back to wipe-and-retry QwenLM#9220 fixed a real incident (a corrupt persisted workspace made seven review jobs fail checkout on the same missing SHAs), but eight review rounds grew the heal step from ~15 lines into ~60 lines of path-guard layers (realpath canonicalization, two trailing-slash strip loops, a denylist case, a RUNNER_WORKSPACE allowlist) plus ~450 lines of tests pinning their mutation resistance. Every removed layer defended against a mangled GITHUB_WORKSPACE. That variable is set by actions/runner; anything that could mangle it — a compromised runner, a step writing GITHUB_ENV — already executes arbitrary code on the machine and needs no wipe to do damage, so the guard cannot defend against the only actor able to trigger it. The realistic contract is the :? guard: fail loud on a dropped variable. Kept and still pinned by tests: the pool wipe idiom, the sudo fallback leg (exact argv), the never-fail exit contract with named survivors, the identical retry checkout, and the continue-on-error invariants. Also dropped with the guards: the GNU-only realpath flag and its host-probe test machinery. * test(ci): pin the runner-owned GITHUB_WORKSPACE premise before the workspace wipe Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> * test(ci): seal the live override channels into the review wipe step * fix(ci): refuse a redirected workspace and pin the clean-wipe silence Addresses the two doudouOUC findings on the simplified heal: - The wipe now validates the filesystem OBJECT at $WS, not just the string: find -P does not descend a symlinked start, so a redirected workspace logged 'wiped for a clean retry' while deleting nothing, and the secret-bearing review step would then run through the redirection. Refuse loud on a symlink or non-directory — POSIX-only, no false-positive surface (a legitimate workspace is always a runner-created plain directory), and it pins the only sudo-escalated wipe in the pool to a validated target. - The clean-wipe silence branch was unpinned: the reviewer's minimal mutant (dropping the if/fi pair) shipped an empty-list survivor warning on every heal with the suite green. The clean-wipe test now asserts the success annotation and the absence of the survivor warning; both mutants verified red. * test(ci): seal the wipe step's surviving override channels * test(ci): seal the wipe's surviving override channels, pin its signals Addresses the open review findings on the simplified heal: - The seal's premise covered declarative env, $GITHUB_ENV/$GITHUB_PATH run writes, and the pre-wipe action set, but three channels passed it unchecked: a wipe-step `shell:` or workflow/job `defaults:` wrapper re-targets the environment at exec time; SHELLOPTS rides the same bash-startup family as BASH_ENV/ENV yet sat outside the dangerous name class; and ACTIONS_ALLOW_UNSECURE_COMMANDS re-enables the legacy ::set-env:: / ::add-path:: spellings the run-text scan did not match. Each channel was reproduced green against the old seal (mutant probe) and now turns it red. - The both-legs-fail test now also pins the else-branch "could not wipe" warning, and a dedicated test pins the `[ ! -d ]` refusal for a nonexistent workspace — the plain-file test alone still passes a guard mutated to `[ -f ]`. - The non-sudo wipe leg keeps its stderr: the 2>/dev/null discarded exactly the diagnostics oncall needs when the wipe fails, and the sudo leg already ran unsuppressed. * fix(ci): refuse workspace wipe through symlinked path components (QwenLM#9327) --------- Co-authored-by: qwen-code-dev-bot <qwen-code-dev-bot@users.noreply.github.com> Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> Co-authored-by: qwen-code-dev-bot <qwen-code-dev@service.alibaba.com>

* fix(ci): give the macOS and Windows lanes a trigger again Both lanes are gated on `merge_group`, and no merge queue is enabled on this repository — the `main` ruleset carries only deletion, non-fast-forward and pull_request rules, no status check is required, and merges land as squashes. The last `merge_group` run of anything was 2026-07-02. So the gate was an off switch: the lanes reported as "skipped" on every pull request, which reads as agreement, and nothing ever reached them afterwards. The only signal this repository has about a host that is not Linux with a GNU userland had been silently off for six weeks, which is how QwenLM#9220 shipped a GNU-only `realpath -m` in a workflow guard with the suite that pinned it red on every Mac. Three triggers now, in cost order. A pull request whose diff a new classifier recognises as platform-sensitive: shell scripts of every dialect, workflow and composite-action YAML and the scripts they call, the script layer and its tests, the test-runner configuration that decides which suites run where, the root manifests, and source paths whose segments name a platform-coupled subsystem. It is a net, not a proof — it cannot see a platform assumption inside an ordinary source file, and no path rule ever will — so every unknown answers "sensitive": an unreadable listing, an unparsable entry, a fork pull request, a truncated file list, or the classify job failing outright all end as "run the lanes". Only a confident `false` skips them. The merge queue, if it is ever enabled again, unchanged. And a nightly run on `main` for everything the path list cannot see. Every other job in the workflow excludes `schedule` explicitly, so a nightly is exactly two jobs, and 'Qwen Code CI' joins the workflows the main-failure watcher opens autofix issues for — a red lane nobody is told about is the same silence the queue gate produced. That watcher gains a trigger-level `branches: ['main']` filter so the CI workflow's pull-request completions do not raise an event there just to skip. The classifier runs in its own small hosted job rather than as a step in `classify_pr`: that job's outputs pick the Linux runner for the whole run, and this one needs a checkout — on a pool whose workspace other jobs have poisoned before. It checks out the pull request's BASE commit, never the head: it runs before any review and executes a script from the tree it checks out. Its listing goes through the existing classify-pr-profile.sh wrapper, extended with a mode argument, because that wrapper's whole point is that one PR is never listed twice and classified differently in two places. Twelve tests pin the wiring — the triggers, the fail-safe direction of the gate, the base-commit checkout, that a nightly stays two jobs, and the alerting — and ten more pin the classifier itself, including the substring traps (`Shellfish.tsx`, `cryptic.ts`, `plateauDetector.ts` must not drag both lanes in) and every fail-safe path. Mutation-checked: flipping the gate to `== 'true'`, dropping the schedule from a lane, dropping the nightly guard from the ubuntu job, pointing the checkout at the head, dropping the classifier's test from the helper list, and removing the schedule trigger are each caught. * fix(ci): gate the Windows lane's checkout verification per trigger The first thing the revived triggers hit was not a test failure but the lane's own plumbing. `test_windows` verifies its checkout with `verify-checkout-head`, and the input was written when this lane ran in the merge queue alone: `expected_sha: github.event.merge_group.head_sha`, with no event gate. On a pull request that expression is empty, the action refuses an empty SHA, and the lane went red in 63 seconds without running a test — the first Windows run in six weeks, failing on the trigger rather than on the code. Give it the event-aware shape the Ubuntu gate already uses, and skip it where there is nothing to verify: the scheduled and dispatch runs check out a branch by name, not a head commit. Pinned generally rather than by name: for both lanes, any step whose inputs read a `github.event.<event>` context must be gated to that event, in the step's own `if` or in the expression itself. Restoring the old spelling turns that test red. * fix(ci): close review round on the revived platform lanes (QwenLM#9370) * fix(ci): pin the Windows lane routing to the canonical trust policy (QwenLM#9370) * fix(ci): host-probe the macOS lane's bash and GNU dependencies (QwenLM#9370) The revived macOS lane ran the shared suite for the first time since the merge queue went dark and failed on exactly three tests, identical across three consecutive runs: the bite-check block and the baseline A/B green path die with `mapfile: command not found` (a bash >= 4.4 builtin; macOS ships 3.2), and the health-probe repair case trips over BSD `mktemp -u` attempting to create where GNU's print-only `-u` just names the canary. Both suites pin scripts that only ever execute on Linux runners — ubuntu-latest or the Linux ECS pool — so the defects cannot exist in production; the suites just cannot run those scripts on a macOS host. Follow the convention QwenLM#9220's fix established for the realpath case in the same file: probe the host capability, not the platform, and skipIf the three dependent tests where it is absent. A Mac with a newer bash or GNU coreutils fronting PATH keeps the coverage; the Linux lane runs all three unconditionally. The large bite-check test body is re-indented by prettier around the new skipIf wrapper; no other token changed. * fix(ci): stop the subsystem rule matching compounds that name something else The platform-sensitivity classifier split a path segment on dashes and underscores anywhere, so `packages/web-shell/**` matched the `shell` keyword — one of this repository's largest packages, a browser UI with no host coupling, summoning both expensive lanes on every change to it. That is the cost the gate exists to avoid, spent on the wrong diffs. A keyword now counts when it NAMES the thing: a whole path segment (`src/sandbox/**`, `platform/paths.ts`, `shell.ts`) or the head of a hyphen/underscore stem (`pty-host.ts`). Not a trailing part of a compound, which belongs to whatever the leading word names, and still not a substring inside a longer word. Pinned both directions, including a directory that IS named for the subsystem wherever it sits (`web-shell/components/shell/**` stays sensitive). Mutation-checked: dropping either rule, or restoring the split-anywhere spelling, turns the suite red. Also drops a wrong issue citation in the watcher test's comment: the nightly comes from this change, not from the wipe-guard back-port. * test(ci): pin the gate as a disjunction and the watcher's name binding Two mutation-survivable gaps in this PR's own tests. The clause-presence assertions left a connective mutation alive: `||` → `&&` between two event clauses keeps every asserted string in place and makes the gate unsatisfiable for every trigger — both lanes silently off again, which is the state this PR exists to end. Read the event group and require it to be a disjunction, allowing `&&` only inside the pull-request clause that binds to the classifier output. And the watcher's binding to this workflow is by display name: `workflow_run.workflows` matches the watched workflow's `name:`, so renaming ci.yml unhooks the nightly's alerting silently. Pin both sides. Both checked by mutation: flipping one `||` and renaming the workflow each turn a named test red. * fix(ci): close the classifier's CRLF gap and widen the lane step scan Three findings from this round, all in the direction of the tests and the parser being less clever than they claimed. The classifier's JSONL reader split on `\n` while its sibling splits on `/\r?\n/`. Every suffix rule here is end-anchored, so one carriage return on a CRLF listing would leave `build.sh\r` and classify a script-layer change as ordinary source. Matched to the sibling, with a fixture on both the JSON and the raw-line path. The per-trigger step scan serialized only `with:` inputs, so the same defect wearing an `env:` or `run:` key escaped it; it now reads all three. And the nightly blast-radius guard tested for the MENTION of an allowlisted event rather than the IMPOSSIBILITY of `schedule` — a job gated `pull_request || schedule` satisfied it while running every night. It now requires the absence of an explicit schedule clause too. * style(ci): format the runner-routing suite The Windows trust-policy matrix added last round left the file outside prettier's style, which the repository's lint step fails on; main's copy is clean. Formatting only — the nine assertions are unchanged and still pass. * fix(ci): gate the two mapfile-crossing gate tests on the host probe (QwenLM#9370) * fix(ci): keep pull requests off the persistent Windows pool and cover native audio (QwenLM#9370) A pull_request run executes the workflow YAML from the PR's own merge commit, so the test_windows runs-on trust clause it evaluated could be rewritten by any PR the lane admits. Every pull request now runs on hosted windows-2022 unconditionally; the pool is reached only by the post-approval merge queue, schedule and dispatch, guarded by the kill-switch. The routing tests and the exact-line pin are re-pointed at that enforceable shape. Also add audio to the platform-sensitivity classifier's subsystem keywords: packages/audio-capture is a node-gyp workspace compiled per-host on exactly the two revived lanes, but its native sources (.cc/.mm/.gyp) carried no rule and a PR touching only them skipped both lanes. The workspace directory now classifies sensitive; an ordinary .cc elsewhere stays ordinary source. Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com> --------- Co-authored-by: qwen-code-dev-bot <qwen-code-dev@service.alibaba.com> Co-authored-by: qwen-code-dev-bot <qwen-code-dev-bot@users.noreply.github.com> Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>

qwen-code-ci-bot previously approved these changes Aug 15, 2026

View reviewed changes

qwen-code-ci-bot reviewed Aug 15, 2026

View reviewed changes

Comment thread .github/workflows/qwen-code-pr-review.yml Outdated

Comment thread .github/workflows/qwen-code-pr-review.yml Outdated

Comment thread scripts/tests/qwen-pr-review-workflow.test.js

qwen-code-ci-bot reviewed Aug 15, 2026

View reviewed changes

Comment thread scripts/tests/qwen-pr-review-workflow.test.js

Comment thread scripts/tests/qwen-pr-review-workflow.test.js Outdated

Comment thread scripts/tests/qwen-pr-review-workflow.test.js

Comment thread scripts/tests/qwen-pr-review-workflow.test.js Outdated

qwen-code-dev-bot added the autofix/takeover Summon the autofix loop to manage this PR (remove to release; needs triage+) label Aug 15, 2026

fix(ci): heal with the pool wipe idiom and pin the checkout guardrails (

a6a617b

QwenLM#9220)

qwen-code-dev-bot dismissed qwen-code-ci-bot’s stale review via a6a617b August 15, 2026 15:32

qwen-code-ci-bot reviewed Aug 15, 2026

View reviewed changes

Comment thread scripts/tests/qwen-pr-review-workflow.test.js Outdated

Comment thread .github/workflows/qwen-code-pr-review.yml Outdated

Comment thread .github/workflows/qwen-code-pr-review.yml Outdated

Comment thread .github/workflows/qwen-code-pr-review.yml

qwen-code-ci-bot previously approved these changes Aug 15, 2026

View reviewed changes

qwen-code-dev-bot mentioned this pull request Aug 15, 2026

Fleet Shepherd Dashboard #7167

Open

wenshao dismissed qwen-code-ci-bot’s stale review via 2638086 August 15, 2026 18:10

Merge branch 'main' into fix/review-checkout-self-heal

0c778e8

qwen-code-ci-bot reviewed Aug 15, 2026

View reviewed changes

fix(ci): close the heal guard's trailing-slash hole and name wipe sur…

92995a7

…vivors (QwenLM#9220)

qwen-code-ci-bot reviewed Aug 15, 2026

View reviewed changes

Comment thread .github/workflows/qwen-code-pr-review.yml

Comment thread .github/workflows/qwen-code-pr-review.yml

fix(ci): canonicalize the heal guard's path match and allowlist the r…

2b3595c

…unner workspace (QwenLM#9220)

qwen-code-ci-bot approved these changes Aug 16, 2026

View reviewed changes

qwen-code-ci-bot added a commit that referenced this pull request Aug 16, 2026

verify evidence for PR #9220 (run 31949539630)

241625c

qwen-code-ci-bot reviewed Aug 16, 2026

View reviewed changes

Comment thread scripts/tests/qwen-pr-review-workflow.test.js

Comment thread .github/workflows/qwen-code-pr-review.yml

doudouOUC approved these changes Aug 16, 2026

View reviewed changes

wenshao added this pull request to the merge queue Aug 16, 2026

Merged via the queue into QwenLM:main with commit c031cc6 Aug 16, 2026
97 of 114 checks passed

qwen-code-ci-bot mentioned this pull request Aug 16, 2026

feat(core): Add privacy-safe tool-result boundary diagnostics #9039

Merged

yiliang114 mentioned this pull request Aug 16, 2026

fix(ci): back-port the checkout-heal wipe guard to the triage and serve-ab wipes #9277

Merged

wenshao added a commit that referenced this pull request Aug 16, 2026

evidence: re-verify at head 415d980 and add the #9220 interaction matrix

1e6fb5c

wenshao mentioned this pull request Aug 16, 2026

fix(ci): narrow serve-ab's self-hosted wipe to the A/B checkout dirs #9228

Merged

qwen-code-dev-bot mentioned this pull request Aug 16, 2026

Deferred review findings from PR #9228 #9285

Open

wenshao mentioned this pull request Aug 17, 2026

Qwen Autofix: review-event storms and duplicate address dispatch waste runner capacity #9296

Open

wenshao mentioned this pull request Aug 17, 2026

refactor(ci): simplify the review checkout self-heal back to wipe-and-retry #9327

Merged

qwen-code-ci-bot mentioned this pull request Aug 17, 2026

fix(ci): port the heal chain's wipe guard to the triage and A/B wipes #9369

Closed

wenshao mentioned this pull request Aug 18, 2026

fix(ci): give the macOS and Windows lanes a trigger again #9370

Merged

wenshao mentioned this pull request Aug 19, 2026

ci: the Windows lane is red — 59 tests across 10 files, unobserved since the merge queue stopped running #9481

Closed

wenshao mentioned this pull request Aug 26, 2026

ci: take the macOS and Windows lanes off pull requests #10059

Merged

Uh oh!

Conversation

wenshao commented Aug 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR does

Why it's needed

Reviewer Test Plan

How to verify

Evidence (Before & After)

Tested on

Environment (optional)

Risk & Scope

Linked Issues

这个 PR 做了什么

为什么需要

Reviewer 测试计划

如何验证

Before / After 证据

测试平台

环境（可选）

风险与范围

关联事项

Uh oh!

qwen-code-ci-bot commented Aug 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

qwen-code-ci-bot commented Aug 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

qwen-code-ci-bot commented Aug 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code review

Testing

代码审查

测试

Uh oh!

qwen-code-ci-bot commented Aug 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

qwen-code-ci-bot left a comment

Choose a reason for hiding this comment

Uh oh!

qwen-code-ci-bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

qwen-code-ci-bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wenshao commented Aug 15, 2026

Uh oh!

qwen-code-dev-bot commented Aug 15, 2026

Uh oh!

qwen-code-dev-bot commented Aug 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

qwen-code-dev-bot commented Aug 15, 2026

Autofix review round — PR #9220

Feedback points and decisions

Verification

Autofix 审查轮次 — PR #9220

反馈点与处理决定

验证

Uh oh!

qwen-code-dev-bot commented Aug 15, 2026

Autofix review round — PR #9220

Feedback triage

Result

Autofix 评审轮次 —— PR #9220

反馈分诊

结果

Uh oh!

wenshao commented Aug 15, 2026

Uh oh!

wenshao commented Aug 15, 2026 •

edited

Loading

qwen-code-ci-bot commented Aug 15, 2026 •

edited

Loading

qwen-code-ci-bot commented Aug 15, 2026 •

edited

Loading

qwen-code-ci-bot commented Aug 15, 2026 •

edited

Loading

qwen-code-ci-bot commented Aug 15, 2026 •

edited

Loading

qwen-code-dev-bot commented Aug 15, 2026 •

edited

Loading

qwen-code-ci-bot commented Aug 15, 2026 •

edited

Loading

qwen-code-ci-bot commented Aug 16, 2026 •

edited

Loading

Previous-finding status (round 5 → round 6 head `952792a5`)

Wipe matrix — real execution of the extracted `run:` block

1. Note (non-blocking): the no-realpath fallback still admits a lexical `..`-escape — stands

3. Note (new this round): the GNU-host truth of the `hasGnuRealpath` probe is unpinned — completeness only