fix(cr-agent): PR#201二轮审查(_conclusion覆盖warnings桶+_bounded_int参数收紧)

Critical(static_review stdin)=误判, 未改动:
  当前 static_review.py main() 已是 diff_content=sys.stdin.read() 正确读 diff,
  全目录 grep file_list_input/file_paths 零匹配, reviewer 引用代码不存在(版本差异).
  test_static_review_script_executable(input=diff) 通过, returncode=0 且输出含 findings.

2 Warning:
- _conclusion 只检查 findings 桶, 遗漏 warnings 桶(HIGH confidence=0.75 进 warnings
  只得 needs_human_review) → 覆盖 findings+warnings 两桶
- _bounded_int env未设置返回 default(timeout参数) 未收紧, 调用方可绕过上限
  → 返回 min(default, max_val)

加测试: test_11_conclusion_warnings_bucket_high + test_bounded_int_default_capped_to_max
验证: flake8 全绿 + 192 测试全过

Author: wzxsdf

examples/skills_code_review_agent/agent/pipeline.py

@@ -50,9 +50,12 @@ def _conclusion(findings, warnings, needs_review, decisions, sandbox_runs) -> st
     4. 都无 → approve
     """
     # 1. 有 critical/high finding → changes_requested (最高优先级)
-    for finding in findings:
-        if finding.severity in [Severity.CRITICAL, Severity.HIGH]:
-            return "changes_requested"
+    # Warning 修复: 覆盖 findings + warnings 两桶，避免高危安全问题(如 SEC008 SSRF
+    #   confidence=0.75 进 warnings 桶)只得出 needs_human_review 而非 changes_requested
+    for bucket in (findings, warnings):
+        for finding in bucket:
+            if finding.severity in [Severity.CRITICAL, Severity.HIGH]:
+                return "changes_requested"
 
     # 2. 有 warnings 或 filter block → needs_human_review
     if warnings:

examples/skills_code_review_agent/sandbox/container.py

@@ -43,7 +43,8 @@ def _bounded_int(env_name: str, default: int, max_val: int) -> int:
     """
     value = os.getenv(env_name)
     if value is None:
-        return default
+        # env 未设置：返回 default，但单向收紧到 max_val（防止调用方参数绕过上限）
+        return min(default, max_val)
 
     try:
         int_value = int(value)

examples/skills_code_review_agent/tests/test_pipeline.py

@@ -317,6 +317,31 @@ def test_10_conclusion_derivation_rules(self):
         report4 = run_review(diff_clean, "test", "fake", True, False)
         self.assertEqual(report4.conclusion, "approve", "无问题应该 → approve")
 
+    def test_11_conclusion_warnings_bucket_high_severity(self):
+        """测试11: warnings 桶中 HIGH 严重级别 finding → changes_requested（修复 _conclusion 遗漏 warnings 桶）"""
+        from agent.pipeline import _conclusion
+        from agent.models import Finding
+
+        # 构造 HIGH severity、低置信度(0.75)的 finding（会被路由到 warnings 桶，如 SEC008 SSRF）
+        high_in_warnings = Finding(
+            severity=Severity.HIGH,
+            category="security",
+            file="test.py",
+            line=10,
+            title="SSRF",
+            evidence="requests.get(user_url)",
+            recommendation="校验/白名单 URL",
+            confidence=0.75,
+            source="rule",
+            rule_id="SEC008",
+            bucket=Bucket.WARNINGS,
+        )
+
+        # warnings 桶有 HIGH → 应 changes_requested（修复前会走到 needs_human_review）
+        conclusion = _conclusion([], [high_in_warnings], [], [], [])
+        self.assertEqual(conclusion, "changes_requested",
+                         "warnings 桶的 HIGH severity 应 → changes_requested，而非 needs_human_review")
+
 
 if __name__ == "__main__":
     unittest.main()

examples/skills_code_review_agent/tests/test_sandbox.py

@@ -192,6 +192,15 @@ def test_bounded_int_exceeds_max_raises(self):
             with pytest.raises(ValueError, match="TEST_VAR 不能超过 60"):
                 _bounded_int("TEST_VAR", 30, 60)
 
+    def test_bounded_int_default_capped_to_max(self):
+        """测试 env 未设置时 default 超过 max_val 被收紧（防止调用方参数绕过上限）。"""
+        from sandbox.container import _bounded_int
+
+        with patch.dict(os.environ, {}, clear=True):
+            # env 未设置，default=100 > max=60 → 单向收紧到 60（修复参数绕过）
+            result = _bounded_int("TEST_VAR", 100, 60)
+            assert result == 60
+
 
 class TestContainerSandbox:
     """测试 ContainerSandbox 的 Docker 容器执行。"""