feat: PR 审查 mimosa findings 双级过滤 — diff 文件过滤 (#26) + 基线指纹去重 (#27) - #30
Merged
Merged
Conversation
- _filter_findings_by_files: findings 按 PR diff 触及文件过滤 (normpath 双侧匹配), 附件只含新增信号; scope 开关 ZCODE_BRIDGE_PR_FINDINGS_SCOPE=diff|all 可回滚 - 基线指纹库: sha256(path+anchor) (anchor 为 mimosa 内容哈希, 跨扫描稳定, 代码改动自动失效), 存仓外 ~/.local/state/zcode-mcp-server/baselines/ (gate 每轮 git clean -fdx 清仓内文件); 损坏降级空库; 原子写 - 写入时机守卫: 仅 zcode 复核成功 (非 isError) 才落库 — 失败重试不产生假「无新增」 - 报告头 known 汇总行 (纯中文, 不含 P0/P1/P2 token, gate 双解析路径钉子测试); verdict 计数只含新增 finding - zcode_security_review 保持全量扫语义; gate 脚本零改动; mcp-server 1.4.0→1.5.0 - tests: +16 用例 (pr13-pr23 + bf0-bf3 + gate 头行钉子) — 434 passed, 28 subtests
…l 行口径 (P2) + P3×6 - _pr_diff 加 -c core.quotePath=false: 非 ASCII 路径不再被 C 转义 → 过滤匹配恢复; 回归测试 gt1 (flag 钉住) + pr24 (中文路径端到端存活) - _load_baseline/_save_baseline 显式 encoding=utf-8, except 扩 UnicodeError — 非 UTF-8 locale 不再破坏「绝不抛」「落盘失败不反杀」契约 - 同扫重复指纹 count 语义与注释对齐 (出现次数+1); 附件标题改「本轮新增 X, 全仓 Y」 - test_pr17 预置基线字节级断言; gate 测试元组误作 msg 参数改钉值; scope=all 措辞分支 - 437 passed, 28 subtests
- _write_temp/_git/agent-help/zcode headless/mimosa Popen 五处显式 encoding=utf-8: quotePath 修复后 git/mimosa 通道开始承载原始 UTF-8 (中文路径/标题), locale 依赖 成为正确性承重点; strict 失败显性 (审查报错) 优于 replace 静默乱码→过滤失配→丢 finding (本 PR 刚修的 P1 症状方向) - _git except 扩 UnicodeError (保「不抛异常, 调用方判」契约, 解码失败经 _pr_diff→RuntimeError→isError 收口仍显性); _save_baseline 调用点扩 UnicodeError - pr24 升级行为级回归: fake git 在缺 -c core.quotePath=false 时回 C 转义形态 (flag 误删→转义失配→测试挂, 不再单靠 GT1 argv 钉); +pr26 同扫重复指纹计数 - 438 passed, 28 subtests
…ADME 尾句截短 + env 表补 BASELINE_DIR 行
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #26, Closes #27
方案（analyst 预检 + plan-reviewer OKAY 过审）
实测确认 mimosa 静态引擎调用面无法限缩输入（focusFiles 仅优先级提示），故走「全量扫 + findings 后过滤」——zcode 复核 token 与报告噪音立即清零，扫描时间照旧（~13s 量级、零 LLM）。
#26 diff 文件过滤
_filter_findings_by_files：normpath 双侧精确匹配location.path∈git diff --name-only清单（diff 本就在 mcp-server 内算好）ZCODE_BRIDGE_PR_FINDINGS_SCOPE=diff|all可一键回滚旧行为#27 基线指纹库
sha256(normpath(path) + "\\0" + identity.anchor)——anchor 是 mimosa 自产内容哈希（实测跨扫描稳定、不含路径语义、代码一行改动即失效重报）~/.local/state/zcode-mcp-server/baselines/（gate 每轮git clean -fdx会清仓内文件）；损坏 → 空库降级；tmp+os.replace 原子写ZCODE_BRIDGE_PR_BASELINE=on|off第二回滚开关刻意不做（文档已注明）
zcode_security_review深扫（保持全量语义不动）测试
+16 用例（过滤命中/开关回归/路径归一/指纹稳定性 4 条/基线过滤/入库时机三路径/损坏 fail-safe/分仓隔离/off 不读不写/kept=0 如实文案/verdict 尾契约/gate 头行钉子）→ 434 passed, 28 subtests（基线 418+28）；ruff 干净；gate 脚本 diff 为零