feat(examples): add code-review skill scaffold and diff parser

Author: DNKYr

examples/skills_code_review_agent/fixtures/clean.diff

@@ -0,0 +1,14 @@
+--- a/app/util.py
++++ b/app/util.py
+@@ -1,4 +1,6 @@
+ def add(a, b):
++    # add two numbers and return the result
++    # used by the billing module
+     return a + b
+--- a/tests/test_util.py
++++ b/tests/test_util.py
+@@ -1,3 +1,4 @@
+ from app.util import add
++
+ def test_add():
+     assert add(1, 2) == 3

examples/skills_code_review_agent/skills/code-review/SKILL.md

@@ -0,0 +1,29 @@
+---
+name: code-review
+description: Automated code review rules and scripts. Parses unified diffs and detects security risks, async/resource leaks, DB lifecycle problems, missing tests, and secret leaks.
+---
+Overview
+
+This skill reviews a unified diff. Stage the diff at work/inputs/changes.diff, then run
+the scripts below from the workspace root. Every script prints a JSON object to stdout.
+
+Scripts
+
+- scripts/parse_diff.py <diff>       : prints {"summary": ..., "files": [...]}
+- scripts/check_security.py <diff>   : security findings (eval/exec, shell=True, pickle, yaml.load, SQL injection)
+- scripts/check_async_leak.py <diff> : async/resource leak findings (unreferenced tasks, unmanaged sessions/files)
+- scripts/check_db_lifecycle.py <diff> : DB connection/cursor/transaction lifecycle findings
+- scripts/check_tests_missing.py <diff> : source changed without test changes
+- scripts/check_secrets.py <diff>    : hardcoded secrets (evidence pre-redacted)
+
+Rules documentation lives under references/rules/.
+
+Examples
+
+1) python3 skills/code-review/scripts/parse_diff.py work/inputs/changes.diff
+2) python3 skills/code-review/scripts/check_security.py work/inputs/changes.diff
+
+Output contract
+
+Checker scripts print: {"findings": [{"severity", "category", "file", "line",
+"title", "evidence", "recommendation", "confidence", "source"}]}

examples/skills_code_review_agent/skills/code-review/scripts/diffparse.py

@@ -0,0 +1,82 @@
+# Tencent is pleased to support the open source community by making tRPC-Agent-Python available.
+#
+# Copyright (C) 2026 Tencent. All rights reserved.
+#
+# tRPC-Agent-Python is licensed under Apache-2.0.
+"""Unified diff parser shared by all code-review checker scripts (stdlib only)."""
+import re
+
+_HUNK_RE = re.compile(r"^@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@")
+
+
+def _strip_prefix(path):
+    """Strip git's a/ b/ prefixes."""
+    if path.startswith(("a/", "b/")):
+        return path[2:]
+    return path
+
+
+def parse_unified_diff(text):
+    """Parse a unified diff into a list of per-file dicts with new-file line numbers."""
+    files = []
+    current = None
+    old_no = new_no = 0
+    for line in text.splitlines():
+        if line.startswith("diff --git") or line.startswith("Index: "):
+            current = None
+            continue
+        if line.startswith("--- "):
+            raw_old = line[4:].split("\t")[0].strip()
+            current = {
+                "path": "",
+                "old_path": "" if raw_old == "/dev/null" else _strip_prefix(raw_old),
+                "is_new": raw_old == "/dev/null",
+                "is_deleted": False,
+                "hunks": [],
+                "added_lines": [],
+                "removed_lines": [],
+            }
+            files.append(current)
+            continue
+        if line.startswith("+++ "):
+            if current is None:
+                continue
+            raw_new = line[4:].split("\t")[0].strip()
+            if raw_new == "/dev/null":
+                current["is_deleted"] = True
+                current["path"] = current["old_path"]
+            else:
+                current["path"] = _strip_prefix(raw_new)
+            continue
+        m = _HUNK_RE.match(line)
+        if m and current is not None:
+            old_no, new_no = int(m.group(1)), int(m.group(3))
+            current["hunks"].append({"old_start": old_no, "new_start": new_no, "lines": []})
+            continue
+        if current is None or not current["hunks"]:
+            continue
+        hunk = current["hunks"][-1]
+        if line.startswith("+"):
+            hunk["lines"].append({"tag": "+", "new_lineno": new_no, "old_lineno": None, "text": line[1:]})
+            current["added_lines"].append({"line": new_no, "text": line[1:]})
+            new_no += 1
+        elif line.startswith("-"):
+            hunk["lines"].append({"tag": "-", "new_lineno": None, "old_lineno": old_no, "text": line[1:]})
+            current["removed_lines"].append({"line": old_no, "text": line[1:]})
+            old_no += 1
+        elif line.startswith(" ") or line == "":
+            hunk["lines"].append({"tag": " ", "new_lineno": new_no, "old_lineno": old_no, "text": line[1:]})
+            old_no += 1
+            new_no += 1
+        # "\ No newline at end of file" markers are intentionally ignored.
+    return files
+
+
+def summarize(files):
+    """Return a compact summary dict for a parsed diff."""
+    return {
+        "files_changed": len(files),
+        "additions": sum(len(f["added_lines"]) for f in files),
+        "deletions": sum(len(f["removed_lines"]) for f in files),
+        "files": [f["path"] or f["old_path"] for f in files],
+    }

examples/skills_code_review_agent/skills/code-review/scripts/parse_diff.py

@@ -0,0 +1,24 @@
+# Tencent is pleased to support the open source community by making tRPC-Agent-Python available.
+#
+# Copyright (C) 2026 Tencent. All rights reserved.
+#
+# tRPC-Agent-Python is licensed under Apache-2.0.
+"""CLI: parse a unified diff file and print a JSON summary to stdout."""
+import json
+import sys
+
+from diffparse import parse_unified_diff, summarize
+
+
+def main():
+    if len(sys.argv) < 2:
+        print(json.dumps({"error": "usage: parse_diff.py <diff-file>"}))
+        return 2
+    with open(sys.argv[1], encoding="utf-8", errors="replace") as fh:
+        files = parse_unified_diff(fh.read())
+    print(json.dumps({"summary": summarize(files), "files": files}))
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

examples/skills_code_review_agent/tests/conftest.py

@@ -0,0 +1,15 @@
+# Tencent is pleased to support the open source community by making tRPC-Agent-Python available.
+#
+# Copyright (C) 2026 Tencent. All rights reserved.
+#
+# tRPC-Agent-Python is licensed under Apache-2.0.
+"""Test path setup for the skills_code_review_agent example."""
+import sys
+from pathlib import Path
+
+EXAMPLE_ROOT = Path(__file__).resolve().parents[1]
+SCRIPTS_DIR = EXAMPLE_ROOT / "skills" / "code-review" / "scripts"
+
+for p in (str(EXAMPLE_ROOT), str(SCRIPTS_DIR)):
+    if p not in sys.path:
+        sys.path.insert(0, p)

examples/skills_code_review_agent/tests/test_diffparse.py

@@ -0,0 +1,50 @@
+# Tencent is pleased to support the open source community by making tRPC-Agent-Python available.
+#
+# Copyright (C) 2026 Tencent. All rights reserved.
+#
+# tRPC-Agent-Python is licensed under Apache-2.0.
+"""Tests for the unified diff parser."""
+import json
+import subprocess
+import sys
+from pathlib import Path
+
+EXAMPLE_ROOT = Path(__file__).resolve().parents[1]
+FIXTURES = EXAMPLE_ROOT / "fixtures"
+SCRIPTS = EXAMPLE_ROOT / "skills" / "code-review" / "scripts"
+
+
+def _clean_text():
+    return (FIXTURES / "clean.diff").read_text(encoding="utf-8")
+
+
+def test_parse_files_and_paths():
+    from diffparse import parse_unified_diff
+    files = parse_unified_diff(_clean_text())
+    assert [f["path"] for f in files] == ["app/util.py", "tests/test_util.py"]
+
+
+def test_added_line_numbers():
+    from diffparse import parse_unified_diff
+    files = parse_unified_diff(_clean_text())
+    added = files[0]["added_lines"]
+    assert added[0]["line"] == 2
+    assert "add two numbers" in added[0]["text"]
+    assert added[1]["line"] == 3
+
+
+def test_summarize():
+    from diffparse import parse_unified_diff, summarize
+    s = summarize(parse_unified_diff(_clean_text()))
+    assert s["files_changed"] == 2
+    assert s["additions"] == 3
+    assert s["deletions"] == 0
+
+
+def test_parse_diff_cli():
+    out = subprocess.run(
+        [sys.executable, str(SCRIPTS / "parse_diff.py"), str(FIXTURES / "clean.diff")],
+        capture_output=True, text=True, check=True)
+    payload = json.loads(out.stdout)
+    assert payload["summary"]["files_changed"] == 2
+    assert payload["files"][0]["path"] == "app/util.py"