feat(examples): add skills-based code review agent with sandbox and database

Implements #92 — automated code review agent with:
- 6 rule scanners (security, async, resource leak, DB lifecycle, missing tests, secret info)
- Filter chain for pre-execution safety interception
- Local sandbox with timeout/output limits/env isolation
- Deduplication and sensitive info redaction
- JSON + Markdown report generation
- SQLite persistence (4 tables: tasks, findings, sandbox_runs, filter_logs)
- 8 test fixture diffs covering all acceptance criteria
- 116 tests across 8 test modules (unit + integration + acceptance)

Signed-off-by: coder-mtj <coder-mtj@users.noreply.github.com>

Author: coder-mtj

examples/skills_code_review_agent/README.md

@@ -0,0 +1,98 @@
+# Code Review Agent
+
+基于 tRPC-Agent Skills + 沙箱 + 数据库的自动化代码评审 Agent。
+
+## 功能概述
+
+读取 git diff → 安全检查（Filter）→ 规则扫描（6 类）→ 沙箱执行 → 去重脱敏 → 结构化报告 → 数据库存储。
+
+## 快速开始
+
+```bash
+# 安装依赖
+pip install -e ".[gepa]"
+
+# 运行单个 diff 评审
+python run_review.py --diff-file fixtures/diffs/security.diff
+
+# Dry-run 模式（无需 API Key）
+python run_review.py --diff-file fixtures/diffs/security.diff --dry-run
+
+# 运行测试
+python -m pytest tests/ -v
+```
+
+## 扫描规则（6 类）
+
+| 类别 | 说明 | 示例 |
+|------|------|------|
+| Security | 命令注入、不安全反序列化、动态导入 | `os.system()`, `eval()`, `pickle.loads()` |
+| Async Error | 事件循环阻塞、缺少 await | `time.sleep()` in async, 未 await 协程 |
+| Resource Leak | 文件句柄未关闭、连接泄漏 | `open()` 无 with, HTTP 无 session |
+| DB Lifecycle | 游标/连接未关闭、事务未提交 | `cursor.execute()` 无 commit |
+| Missing Tests | 新函数无对应测试 | `def new_func()` 无 `test_new_func` |
+| Secret Info | 硬编码密钥/密码/Token | API keys, GitHub tokens, JWT |
+
+## 目录结构
+
+```
+examples/skills_code_review_agent/
+├── run_review.py          # 入口
+├── pipeline/              # 评审 pipeline
+│   ├── diff_parser.py     # Unified diff 解析
+│   ├── scanners.py        # 6 类规则扫描器
+│   ├── filter_chain.py    # Filter 安全拦截
+│   ├── sandbox.py         # 沙箱执行
+│   ├── dedup.py           # 去重降噪
+│   ├── redaction.py       # 敏感信息脱敏
+│   ├── report.py          # JSON/MD 报告生成
+│   └── telemetry.py       # 监控审计
+├── storage/               # SQLite 持久化
+│   ├── schema.sql         # 数据库 Schema
+│   ├── models.py          # 数据模型
+│   └── dao.py             # 数据访问层
+├── fixtures/diffs/        # 8 个测试 diff
+├── tests/                 # 测试（116 个）
+└── skills/code-review/    # Code-review Skill 定义
+```
+
+## 输出格式
+
+### JSON (`review_report.json`)
+```json
+{
+  "task_id": "review-20260707-...",
+  "summary": { "total_findings": 6, "by_severity": {...} },
+  "findings": [
+    {
+      "severity": "critical",
+      "category": "security",
+      "file": "handler.py",
+      "line": 8,
+      "title": "os.system() with unsanitized input",
+      "evidence": "os.system(user_input)",
+      "recommendation": "Use subprocess.run() with shell=False",
+      "confidence": 0.9,
+      "source": "security_scanner"
+    }
+  ],
+  "filter_summary": {...},
+  "sandbox_summary": {...},
+  "telemetry": {...}
+}
+```
+
+### Markdown (`review_report.md`)
+- Findings 摘要和严重级别统计
+- 人工复核项
+- Filter 拦截摘要
+- 沙箱执行摘要
+- 可执行修复建议
+
+## 数据库
+
+SQLite 存储，4 张表：
+- `review_tasks` — 评审任务
+- `findings` — 发现的问题
+- `sandbox_runs` — 沙箱执行记录
+- `filter_logs` — Filter 拦截日志

examples/skills_code_review_agent/agent/__init__.py

@@ -0,0 +1 @@
+# Code Review Agent — trpc-agent integration

examples/skills_code_review_agent/agent/agent.py

@@ -0,0 +1,34 @@
+"""Code review agent definition — integrates with tRPC-Agent framework."""
+
+from trpc_agent_sdk.agents import LlmAgent
+
+
+def create_code_review_agent(model_config: dict | None = None) -> LlmAgent:
+    """Create a LlmAgent configured for code review tasks.
+
+    The agent uses the code-review Skill for rule loading and
+    structured output generation.
+
+    Args:
+        model_config: Optional model configuration dict.
+
+    Returns:
+        Configured LlmAgent instance.
+    """
+    config = model_config or {
+        "model": "fake",  # Default to fake mode
+    }
+
+    agent = LlmAgent(
+        name="code_review_agent",
+        description="Automated code review agent that analyzes diffs "
+                     "for security, quality, and best practice issues.",
+        model=config["model"],
+        instruction="""You are a code review agent. Your job is to:
+1. Load the code-review skill to understand review rules.
+2. Analyze the provided diff for issues.
+3. Output structured findings in the review format.
+""",
+    )
+
+    return agent

examples/skills_code_review_agent/agent/config.py

@@ -0,0 +1,7 @@
+"""Model configuration for the code review agent."""
+
+DEFAULT_MODEL_CONFIG = {
+    "model": "fake",
+    "temperature": 0.0,
+    "max_tokens": 4096,
+}

examples/skills_code_review_agent/agent/prompts.py

@@ -0,0 +1,20 @@
+"""System prompts for the code review agent."""
+
+SYSTEM_PROMPT = """You are an automated code review agent.
+Your task is to analyze code diffs for potential issues including:
+- Security vulnerabilities
+- Resource leaks
+- Async/await errors
+- Database lifecycle problems
+- Missing tests
+- Hardcoded secrets
+
+For each issue found, provide:
+1. Severity (critical/high/medium/low/info)
+2. Category
+3. File and line number
+4. Evidence from the code
+5. A clear recommendation for fixing the issue
+
+Be thorough but avoid false positives. When unsure, flag as low confidence.
+"""

examples/skills_code_review_agent/fixtures/diffs/async_resource_leak.diff

@@ -0,0 +1,21 @@
+diff --git a/worker.py b/worker.py
+index 0000000..1111111 100644
+--- a/worker.py
++++ b/worker.py
+@@ -1,0 +1,16 @@
++import asyncio
++import time
++
++
++async def process_items(items: list) -> list:
++    results = []
++    for item in items:
++        time.sleep(0.1)  # Blocks event loop
++        results.append(item * 2)
++    return results
++
++
++def read_file():
++    f = open("data.txt")
++    data = f.read()
++    return data  # f never closed

examples/skills_code_review_agent/fixtures/diffs/clean.diff

@@ -0,0 +1,15 @@
+diff --git a/example.py b/example.py
+index 0000000..1111111 100644
+--- a/example.py
++++ b/example.py
+@@ -5,3 +5,4 @@
+ def greet(name: str) -> str:
+     """Return a friendly greeting."""
+-    return f"Hello {name}!"
++    """Greet someone by name."""
++    return f"Hello, {name}!"
+@@ -10,2 +11,2 @@
+ def add(a: int, b: int) -> int:
+-    return a + b
++    """Add two integers and return the sum."""
++    return int(a) + int(b)

examples/skills_code_review_agent/fixtures/diffs/db_lifecycle.diff

@@ -0,0 +1,23 @@
+diff --git a/db_repo.py b/db_repo.py
+index 0000000..1111111 100644
+--- a/db_repo.py
++++ b/db_repo.py
+@@ -1,0 +1,18 @@
++import sqlite3
++
++
++def get_users() -> list:
++    conn = sqlite3.connect("app.db")
++    cursor = conn.cursor()
++    cursor.execute("SELECT * FROM users")
++    rows = cursor.fetchall()
++    return rows  # conn and cursor never closed
++
++
++def insert_user(name: str) -> None:
++    conn = sqlite3.connect("app.db")
++    cursor = conn.cursor()
++    cursor.execute("INSERT INTO users (name) VALUES (?)", (name,))
++    # Missing conn.commit()
++    cursor.close()
++    conn.close()

examples/skills_code_review_agent/fixtures/diffs/duplicate_finding.diff

@@ -0,0 +1,20 @@
+diff --git a/service.py b/service.py
+index 0000000..1111111 100644
+--- a/service.py
++++ b/service.py
+@@ -1,0 +1,15 @@
++import os
++
++
++def run_command_1(cmd: str) -> str:
++    return os.system(cmd)  # security issue
++
++
++def run_command_2(cmd: str) -> str:
++    return os.system(cmd)  # same security issue, different function
++
++
++def run_command_3(cmd: str) -> str:
++    # This also calls os.system on untrusted input
++    result = os.system(cmd)  # same pattern again
++    return str(result)

examples/skills_code_review_agent/fixtures/diffs/missing_tests.diff

@@ -0,0 +1,17 @@
+diff --git a/math_utils.py b/math_utils.py
+index 0000000..1111111 100644
+--- a/math_utils.py
++++ b/math_utils.py
+@@ -1,0 +1,12 @@
++def calculate_average(values: list[float]) -> float:
++    if not values:
++        return 0.0
++    return sum(values) / len(values)
++
++
++def find_median(values: list[float]) -> float:
++    sorted_vals = sorted(values)
++    n = len(sorted_vals)
++    if n % 2 == 1:
++        return sorted_vals[n // 2]
++    return (sorted_vals[n // 2 - 1] + sorted_vals[n // 2]) / 2