Skip to content

Commit 0155e1c

Browse files
ghost613bbghost613bb
committed
agent: add code review example deliverables
This change adds allowlisted sandbox script examples and committed sample review reports for the code review Agent example. The scripts provide deterministic diff summary and static-rule smoke checks that can be executed by a sandbox runtime, while the sample reports show the redacted JSON and Markdown output generated from the hard-coded secret fixture. It also updates the example README to document the sample reports and script layout. Updates #92 RELEASE NOTES: NONE
1 parent af0d65d commit 0155e1c

5 files changed

Lines changed: 286 additions & 0 deletions

File tree

‎examples/code_review_agent/README.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,8 @@ user / CI request
3434
```text
3535
examples/code_review_agent/
3636
README.md
37+
review_report.json
38+
review_report.md
3739
run_review.py
3840
agent/
3941
diff_parser.py
@@ -61,6 +63,9 @@ examples/code_review_agent/
6163
renamed_file.diff
6264
skills/code-review/
6365
SKILL.md
66+
scripts/
67+
diff_summary.py
68+
static_rules.py
6469
references/
6570
finding_schema.md
6671
rules.md

‎examples/code_review_agent/review_report.json‎

Lines changed: 136 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,136 @@
1+
{
2+
"mode": "dry_run",
3+
"summary": "Found 1 finding(s) across 1 changed file(s).",
4+
"findings": [
5+
{
6+
"severity": "high",
7+
"category": "secrets",
8+
"file": "src/config.py",
9+
"line": 2,
10+
"title": "Hard-coded secret in changed code",
11+
"evidence": "Added line contains a secret-like assignment: API_KEY = \"<REDACTED_SECRET>\"",
12+
"recommendation": "Move the secret to an environment variable or secret manager, remove it from source control, and rotate the exposed value.",
13+
"confidence": "high",
14+
"source": "fake_model",
15+
"fingerprint": "9b95e3b4d91e69ea",
16+
"line_start": 2,
17+
"line_end": 2,
18+
"needs_human_review": false,
19+
"raw_source": null
20+
}
21+
],
22+
"warnings": [],
23+
"filter_decisions": [
24+
{
25+
"filter_name": "changed_line_anchor",
26+
"decision": "allow",
27+
"reason": "Finding is anchored to an added changed line.",
28+
"file": "src/config.py",
29+
"line": 2,
30+
"fingerprint": "9b95e3b4d91e69ea",
31+
"stage": "post",
32+
"script_name": null,
33+
"path": null,
34+
"rule_id": null
35+
},
36+
{
37+
"filter_name": "redaction",
38+
"decision": "redact",
39+
"reason": "Redacted secret-like content from finding fields.",
40+
"file": "src/config.py",
41+
"line": 2,
42+
"fingerprint": "9b95e3b4d91e69ea",
43+
"stage": "post",
44+
"script_name": null,
45+
"path": null,
46+
"rule_id": null
47+
},
48+
{
49+
"filter_name": "sandbox_governance",
50+
"decision": "allow",
51+
"reason": "Sandbox request passed pre-execution governance.",
52+
"file": null,
53+
"line": null,
54+
"fingerprint": null,
55+
"stage": "pre_sandbox",
56+
"script_name": "diff_summary",
57+
"path": null,
58+
"rule_id": null
59+
},
60+
{
61+
"filter_name": "sandbox_governance",
62+
"decision": "allow",
63+
"reason": "Sandbox request passed pre-execution governance.",
64+
"file": null,
65+
"line": null,
66+
"fingerprint": null,
67+
"stage": "pre_sandbox",
68+
"script_name": "static_rules",
69+
"path": null,
70+
"rule_id": null
71+
}
72+
],
73+
"metrics": {
74+
"file_count": 1,
75+
"hunk_count": 1,
76+
"changed_line_count": 3,
77+
"finding_count": 1,
78+
"warning_count": 0,
79+
"severity_counts": {
80+
"high": 1
81+
},
82+
"category_counts": {
83+
"secrets": 1
84+
},
85+
"duration_ms": 0,
86+
"sandbox_duration_ms": 0,
87+
"tool_call_count": 2,
88+
"sandbox_run_count": 2,
89+
"filter_intercept_count": 0,
90+
"redaction_count": 1,
91+
"exception_counts": {}
92+
},
93+
"task_id": "review-7bb30cf34bf8",
94+
"status": "completed",
95+
"input": {
96+
"input_type": "diff_file",
97+
"repo_path": null,
98+
"diff_file": "examples/code_review_agent/fixtures/hardcoded_secret.diff",
99+
"base_ref": null,
100+
"changed_files": [
101+
"src/config.py"
102+
],
103+
"diff_sha256": "142c997e939d03b9ff401ec8fe60f6597e2b3745db8c8561acfc7ae01b73e74b",
104+
"diff_summary": "1 file(s), 1 hunk(s), 3 parsed changed/context line(s)."
105+
},
106+
"sandbox_runs": [
107+
{
108+
"id": "sandbox-diff_summary",
109+
"script_name": "diff_summary",
110+
"runtime": "fake",
111+
"decision": "allow",
112+
"exit_code": 0,
113+
"timed_out": false,
114+
"duration_ms": 0,
115+
"stdout_excerpt": "files=1 hunks=1 changed_lines=3",
116+
"stderr_excerpt": "",
117+
"output_truncated": false,
118+
"error_type": null
119+
},
120+
{
121+
"id": "sandbox-static_rules",
122+
"script_name": "static_rules",
123+
"runtime": "fake",
124+
"decision": "allow",
125+
"exit_code": 0,
126+
"timed_out": false,
127+
"duration_ms": 0,
128+
"stdout_excerpt": "static_rules completed",
129+
"stderr_excerpt": "",
130+
"output_truncated": false,
131+
"error_type": null
132+
}
133+
],
134+
"audit_events": [],
135+
"final_conclusion": "Review completed with high-confidence findings."
136+
}

‎examples/code_review_agent/review_report.md‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
# Code Review Dry-run Report
2+
3+
**Mode:** `dry_run`
4+
**Status:** `completed`
5+
**Task ID:** `review-7bb30cf34bf8`
6+
7+
## Summary
8+
9+
Found 1 finding(s) across 1 changed file(s).
10+
11+
## Final conclusion
12+
13+
Review completed with high-confidence findings.
14+
15+
## Metrics
16+
17+
- Files reviewed: 1
18+
- Hunks reviewed: 1
19+
- Changed lines reviewed: 3
20+
- Findings: 1
21+
- Warnings / needs human review: 0
22+
- Duration ms: 0
23+
- Sandbox duration ms: 0
24+
- Sandbox runs: 2
25+
- Tool calls: 2
26+
- Filter intercepts: 0
27+
- Redactions: 1
28+
29+
## Severity distribution
30+
31+
- high: 1
32+
33+
## Category distribution
34+
35+
- secrets: 1
36+
37+
## Findings
38+
39+
### 1. Hard-coded secret in changed code
40+
41+
- Severity: `high`
42+
- Category: `secrets`
43+
- Location: `src/config.py:2`
44+
- Confidence: `high`
45+
- Source: `fake_model`
46+
- Fingerprint: `9b95e3b4d91e69ea`
47+
48+
Evidence: Added line contains a secret-like assignment: API_KEY = "<REDACTED_SECRET>"
49+
50+
Recommendation: Move the secret to an environment variable or secret manager, remove it from source control, and rotate the exposed value.
51+
52+
53+
## Warnings / needs human review
54+
55+
No warnings.
56+
57+
## Filter governance summary
58+
59+
- `post` `changed_line_anchor` -> `allow` src/config.py:2: Finding is anchored to an added changed line.
60+
- `post` `redaction` -> `redact` src/config.py:2: Redacted secret-like content from finding fields.
61+
- `pre_sandbox` `sandbox_governance` -> `allow` [diff_summary]: Sandbox request passed pre-execution governance.
62+
- `pre_sandbox` `sandbox_governance` -> `allow` [static_rules]: Sandbox request passed pre-execution governance.
63+
64+
## Sandbox execution summary
65+
66+
- `diff_summary` on `fake`: exit 0, 0 ms, truncated=false
67+
- `static_rules` on `fake`: exit 0, 0 ms, truncated=false
68+
69+
## Audit / exceptions
70+
71+
No exceptions recorded.
72+
73+
## Actionable recommendations
74+
75+
- `src/config.py:2` Move the secret to an environment variable or secret manager, remove it from source control, and rotate the exposed value.

‎examples/code_review_agent/skills/code-review/scripts/diff_summary.py‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
# Tencent is pleased to support the open source community by making tRPC-Agent-Python available.
2+
#
3+
# Copyright (C) 2026 Tencent. All rights reserved.
4+
#
5+
# tRPC-Agent-Python is licensed under Apache-2.0.
6+
"""Allowlisted sandbox script that summarizes a unified diff from stdin."""
7+
8+
from __future__ import annotations
9+
10+
import json
11+
import sys
12+
13+
14+
def main() -> int:
15+
"""Read diff text from stdin and emit a small JSON summary."""
16+
diff_text = sys.stdin.read()
17+
files = sum(1 for line in diff_text.splitlines() if line.startswith("diff --git "))
18+
hunks = sum(1 for line in diff_text.splitlines() if line.startswith("@@ "))
19+
added = sum(1 for line in diff_text.splitlines() if line.startswith("+") and not line.startswith("+++"))
20+
removed = sum(1 for line in diff_text.splitlines() if line.startswith("-") and not line.startswith("---"))
21+
print(
22+
json.dumps(
23+
{
24+
"script": "diff_summary",
25+
"files": files,
26+
"hunks": hunks,
27+
"added_lines": added,
28+
"removed_lines": removed,
29+
},
30+
sort_keys=True,
31+
)
32+
)
33+
return 0
34+
35+
36+
if __name__ == "__main__":
37+
raise SystemExit(main())

‎examples/code_review_agent/skills/code-review/scripts/static_rules.py‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
# Tencent is pleased to support the open source community by making tRPC-Agent-Python available.
2+
#
3+
# Copyright (C) 2026 Tencent. All rights reserved.
4+
#
5+
# tRPC-Agent-Python is licensed under Apache-2.0.
6+
"""Allowlisted sandbox script for deterministic static-rule smoke checks."""
7+
8+
from __future__ import annotations
9+
10+
import json
11+
import re
12+
import sys
13+
14+
_SECRET_RE = re.compile(r"(?i)\b(api[_-]?key|token|secret|password)\b\s*[:=]")
15+
_EVAL_RE = re.compile(r"\b(eval|exec)\s*\(")
16+
17+
18+
def main() -> int:
19+
"""Read diff text from stdin and emit non-secret rule counters."""
20+
diff_text = sys.stdin.read()
21+
added_lines = [line[1:] for line in diff_text.splitlines() if line.startswith("+") and not line.startswith("+++")]
22+
result = {
23+
"script": "static_rules",
24+
"added_lines": len(added_lines),
25+
"secret_like_additions": sum(1 for line in added_lines if _SECRET_RE.search(line)),
26+
"dynamic_execution_additions": sum(1 for line in added_lines if _EVAL_RE.search(line)),
27+
}
28+
print(json.dumps(result, sort_keys=True))
29+
return 0
30+
31+
32+
if __name__ == "__main__":
33+
raise SystemExit(main())

0 commit comments

Comments
 (0)