fix: address review pipeline false skips and UTF-8 safety

Prevent compression analysis from skipping files in per-file review mode, make verification diff truncation UTF-8 safe, and tighten comment-only triage to avoid dereference false positives while improving compression packing order.

Made-with: Cursor

Author: haasonsaas

src/review/compression.rs

@@ -205,14 +205,14 @@ pub fn compress_diffs(
     }
 
     // Stage 2: Compressed — remove deletion-only hunks, drop tail files
-    // Sort by token count (largest first) for greedy packing
-    file_tokens.sort_by(|a, b| b.1.cmp(&a.1));
+    // Sort by token count (smallest first) to maximize files reviewed.
+    file_tokens.sort_by(|a, b| a.1.cmp(&b.1));
 
     let mut included = Vec::new();
     let mut skipped = Vec::new();
     let mut budget_used = 0;
 
-    for &(idx, tokens) in &file_tokens {
+    for &(idx, _tokens) in &file_tokens {
         // Re-estimate with compression
         let compressed_tokens = if let Some(compressed) = compress_diff(&diffs[idx]) {
             estimate_diff_tokens(&compressed)

src/review/pipeline.rs

@@ -188,10 +188,11 @@ async fn review_diff_content_raw_inner(
         compression_result.batches.len(),
         compression_result.skipped_indices.len(),
     );
-    let compression_skipped: std::collections::HashSet<usize> =
-        compression_result.skipped_indices.iter().copied().collect();
     if !compression_result.skipped_summary.is_empty() {
-        info!("Compression skipped files:\n{}", compression_result.skipped_summary);
+        info!(
+            "Compression analysis skipped files (advisory in per-file mode):\n{}",
+            compression_result.skipped_summary
+        );
     }
 
     // Gather git history for enhanced context
@@ -304,16 +305,6 @@ async fn review_diff_content_raw_inner(
             continue;
         }
 
-        // Compression: skip files that exceed the token budget
-        if compression_skipped.contains(&diff_index) {
-            info!(
-                "Skipping {} (compression: exceeds token budget)",
-                diff.file_path.display()
-            );
-            files_skipped += 1;
-            continue;
-        }
-
         // Emit progress: preparing this file
         if let Some(ref cb) = on_progress {
             cb(ProgressUpdate {

src/review/triage.rs

@@ -42,7 +42,7 @@ const LOCK_FILES: &[&str] = &[
 
 /// Comment line prefixes (after trimming leading whitespace).
 const COMMENT_PREFIXES: &[&str] = &[
-    "//", "#", "/*", "*/", "*", "--", "<!--", "\"\"\"", "'''",
+    "//", "#", "/*", "*/", "* ", "--", "<!--", "\"\"\"", "'''",
 ];
 
 /// Classify a diff using fast heuristics (no LLM call).
@@ -631,6 +631,18 @@ mod tests {
         assert_eq!(triage_diff(&diff), TriageResult::NeedsReview);
     }
 
+    #[test]
+    fn test_comment_only_does_not_match_pointer_dereference_code() {
+        let diff = make_diff(
+            "src/lib.rs",
+            vec![
+                make_line(1, ChangeType::Added, "*ptr = compute();"),
+                make_line(2, ChangeType::Added, "*buffer = data;"),
+            ],
+        );
+        assert_eq!(triage_diff(&diff), TriageResult::NeedsReview);
+    }
+
     // ── Edge cases ───────────────────────────────────────────────────────
 
     #[test]

src/review/verification.rs

@@ -116,11 +116,7 @@ pub fn is_auto_zero(content: &str) -> bool {
 fn build_verification_prompt(comments: &[Comment], diff_content: &str) -> String {
     let mut prompt = String::from("## Code Diff\n```\n");
     // Include a truncated version of the diff
-    let truncated_diff = if diff_content.len() > 8000 {
-        &diff_content[..8000]
-    } else {
-        diff_content
-    };
+    let truncated_diff = safe_utf8_prefix(diff_content, 8000);
     prompt.push_str(truncated_diff);
     prompt.push_str("\n```\n\n## Findings to Verify\n\n");
 
@@ -142,6 +138,18 @@ fn build_verification_prompt(comments: &[Comment], diff_content: &str) -> String
     prompt
 }
 
+fn safe_utf8_prefix(content: &str, max_bytes: usize) -> &str {
+    if content.len() <= max_bytes {
+        return content;
+    }
+
+    let mut end = max_bytes;
+    while end > 0 && !content.is_char_boundary(end) {
+        end -= 1;
+    }
+    &content[..end]
+}
+
 fn parse_verification_response(content: &str, comments: &[Comment]) -> Vec<VerificationResult> {
     static FINDING_PATTERN: Lazy<Regex> = Lazy::new(|| {
         Regex::new(r"(?i)FINDING\s+(\d+)\s*:\s*score\s*=\s*(\d+)\s+accurate\s*=\s*(true|false)\s+reason\s*=\s*(.+)")
@@ -261,6 +269,15 @@ mod tests {
         assert!(prompt.len() < long_diff.len() + 1000); // truncated
     }
 
+    #[test]
+    fn test_build_verification_prompt_utf8_safe_truncation() {
+        // 3000 emojis => 12k bytes, and byte 8000 is not a char boundary.
+        let long_diff = "😀".repeat(3000);
+        let comments = vec![make_comment("c1", "issue", 10)];
+        let prompt = build_verification_prompt(&comments, &long_diff);
+        assert!(prompt.contains("## Code Diff"));
+    }
+
     #[test]
     fn test_build_verification_prompt_includes_suggestion() {
         let mut comment = make_comment("c1", "Use parameterized queries", 10);