feat: 完成阶段九测试与验证（8 条 fixtures + 文档 + 示例报告）

Author: Stelquis

examples/skills_code_review_agent/README.md

@@ -0,0 +1,103 @@
+# Code Review Agent — 自动代码评审 Agent
+
+基于 tRPC-Agent-Python 框架构建的自动代码评审 Agent，集成 Skills、沙箱执行、数据库存储、Filter 治理和监控审计能力，可对 git diff 进行自动化审查并输出结构化报告。
+
+## 环境要求
+
+- Python >= 3.10
+- 依赖：见 `requirements.txt` 或 `pyproject.toml`
+
+## 安装
+
+```bash
+# 从项目根目录安装
+pip install -e .
+
+# 或直接运行（依赖已安装的情况下）
+cd examples/skills_code_review_agent
+```
+
+## 快速开始
+
+### 使用测试样本运行（dry-run 模式，无需 API Key）
+
+```bash
+cd examples/skills_code_review_agent
+
+# 运行无问题样本
+python dry_run.py --fixture 01_clean
+
+# 运行安全漏洞样本
+python dry_run.py --fixture 02_security_leak
+
+# 运行全部 8 条样本
+for f in 01 02 03 04 05 06 07 08; do
+    python dry_run.py --fixture "${f}_clean"
+done
+```
+
+### 审查本地 diff 文件
+
+```bash
+python review_agent.py --diff-file /path/to/changes.diff
+```
+
+### 审查 git 工作区变更
+
+```bash
+python review_agent.py --repo-path /path/to/repo
+```
+
+### 列出可用样本
+
+```bash
+python review_agent.py --list-fixtures
+```
+
+## 输出
+
+- `review_report.json` — 结构化 JSON 报告
+- `review_report.md` — 可读 Markdown 报告
+
+## 测试样本
+
+| 样本 | 场景 | 预期 |
+|------|------|------|
+| `01_clean.py.diff` | 无问题代码 | 空 findings |
+| `02_security_leak.py.diff` | 硬编码密钥/密码 | severity=high |
+| `03_async_resource_leak.py.diff` | 未关闭 aiohttp ClientSession | 资源泄漏 |
+| `04_db_connection_leak.py.diff` | 数据库连接未释放 | 连接泄漏 |
+| `05_test_missing.py.diff` | 新增函数无测试 | warning |
+| `06_duplicate_finding.py.diff` | 同一问题重复出现 | 去重后只报 1 条 |
+| `07_sandbox_failure.py.diff` | 沙箱执行超时/失败 | 任务不崩溃 |
+| `08_secret_masking.py.diff` | 多种敏感信息 | 全部脱敏 |
+
+## 项目结构
+
+```
+examples/skills_code_review_agent/
+├── review_agent.py          # 主入口
+├── dry_run.py               # 干跑模式
+├── config.py                # 配置管理
+├── cli.py                   # CLI 参数解析
+├── models.py                # 数据模型
+├── diff_parser.py           # diff 解析器
+├── sandbox.py               # 沙箱执行器
+├── secret_masker.py         # 敏感信息脱敏
+├── filters.py               # Filter 治理
+├── filter_chain.py          # Filter 编排链
+├── deduper.py               # 去重降噪
+├── report_generator.py      # 报告生成
+├── monitor.py               # 监控审计
+├── db/                      # 数据库层
+│   ├── schema.sql
+│   ├── storage.py
+│   └── init_db.py
+├── skills/code-review/      # CR Skill
+│   ├── SKILL.md
+│   ├── rules/               # 规则文档
+│   └── scripts/             # 沙箱脚本
+└── fixtures/                # 测试样本
+    ├── 01_clean.py.diff
+    └── ...
+```

examples/skills_code_review_agent/fixtures/01_clean.py.diff

@@ -0,0 +1,24 @@
+--- a/src/calculator.py
++++ b/src/calculator.py
+@@ -0,0 +1,20 @@
++"""Simple calculator module."""
++
++
++def add(a: int, b: int) -> int:
++    """Add two numbers."""
++    return a + b
++
++
++def subtract(a: int, b: int) -> int:
++    """Subtract two numbers."""
++    return a - b
++
++
++def multiply(a: int, b: int) -> int:
++    """Multiply two numbers."""
++    return a * b
++
++
++def divide(a: int, b: int) -> int:
++    """Divide two numbers."""
++    return a // b

examples/skills_code_review_agent/fixtures/02_security_leak.py.diff

@@ -0,0 +1,20 @@
+--- a/src/config.py
++++ b/src/config.py
+@@ -1,12 +1,15 @@
+ """Application configuration."""
+ 
+ import os
+ 
+ 
+ class Config:
+     """Application configuration."""
+ 
+-    DEBUG = os.getenv("DEBUG", "false").lower() == "true"
+-    DATABASE_URL = os.getenv("DATABASE_URL", "sqlite:///app.db")
++    DEBUG = os.getenv("DEBUG", "false").lower() == "true"
++    DATABASE_URL = os.getenv("DATABASE_URL", "sqlite:///app.db")
++
++    # TODO: move to env var
++    API_KEY = "sk-abc123def456ghi789jklmno"
++    PASSWORD = "SuperSecretP@ssw0rd!"
++    SECRET_TOKEN = "ghp_abcdefghijklmnopqrstuvwxyz1234567890"

examples/skills_code_review_agent/fixtures/03_async_resource_leak.py.diff

@@ -0,0 +1,18 @@
+--- a/src/fetcher.py
++++ b/src/fetcher.py
+@@ -1,8 +1,12 @@
+ """Async data fetcher module."""
+ 
+ import aiohttp
+ import asyncio
+ 
+ 
+ async def fetch_data(url: str) -> dict:
+     """Fetch data from URL."""
+-    async with aiohttp.ClientSession() as session:
+-        async with session.get(url) as resp:
+-            return await resp.json()
++    session = aiohttp.ClientSession()
++    resp = await session.get(url)
++    data = await resp.json()
++    return data

examples/skills_code_review_agent/fixtures/04_db_connection_leak.py.diff

@@ -0,0 +1,21 @@
+--- a/src/db.py
++++ b/src/db.py
+@@ -1,10 +1,14 @@
+ """Database operations module."""
+ 
+ import sqlite3
+ 
+ 
+ def get_user(conn: sqlite3.Connection, user_id: int) -> dict:
+     """Get user by ID."""
+     cursor = conn.cursor()
+     cursor.execute("SELECT * FROM users WHERE id = ?", (user_id,))
+     return cursor.fetchone()
++
++
++def get_all_users():
++    """Get all users - creates its own connection."""
++    conn = sqlite3.connect("app.db")
++    cursor = conn.cursor()
++    cursor.execute("SELECT * FROM users")
++    return cursor.fetchall()

examples/skills_code_review_agent/fixtures/05_test_missing.py.diff

@@ -0,0 +1,23 @@
+--- a/src/calculator.py
++++ b/src/calculator.py
+@@ -1,8 +1,18 @@
+-"""Simple calculator module."""
++"""Calculator module with interest calculation."""
+ 
+ 
+ def add(a: int, b: int) -> int:
+     """Add two numbers."""
+     return a + b
+ 
+ 
+ def subtract(a: int, b: int) -> int:
+     """Subtract two numbers."""
+     return a - b
++
++
++def calculate_interest(principal: float, rate: float, time: int) -> float:
++    """Calculate compound interest.
++
++    This is a new function without corresponding test coverage.
++    """
++    return principal * (1 + rate) ** time

examples/skills_code_review_agent/fixtures/06_duplicate_finding.py.diff

@@ -0,0 +1,21 @@
+--- a/src/auth.py
++++ b/src/auth.py
+@@ -1,8 +1,18 @@
+ """Authentication module."""
+ 
+ 
+ def login(username: str, password: str) -> bool:
+     """Authenticate user."""
+     # Verify credentials
+     if username == "admin" and password == "secret":
+         return True
+     return False
++
++
++def reset_password(user_id: int, new_password: str) -> bool:
++    """Reset user password."""
++    # TODO: hash the password
++    PASSWORD = "new_temp_pass_123"
++    if len(new_password) < 8:
++        PASSWORD = "new_temp_pass_123"
++    return True

examples/skills_code_review_agent/fixtures/07_sandbox_failure.py.diff

@@ -0,0 +1,18 @@
+--- a/src/unstable.py
++++ b/src/unstable.py
+@@ -0,0 +1,15 @@
++"""Module with operations that may fail in sandbox."""
++
++import subprocess
++import os
++
++
++def check_system_info():
++    """Get system information - may fail in sandbox."""
++    result = subprocess.run(["uname", "-a"], capture_output=True, text=True)
++    return result.stdout
++
++
++def read_large_file():
++    """Read a large file that may exceed output limits."""
++    return os.urandom(2 * 1024 * 1024)  # 2MB of random data

examples/skills_code_review_agent/fixtures/08_secret_masking.py.diff

@@ -0,0 +1,23 @@
+--- a/src/credentials.py
++++ b/src/credentials.py
+@@ -1,5 +1,18 @@
+ """Credentials configuration."""
+ 
++import os
+ 
+-# API configuration
+-API_KEY = os.getenv("API_KEY", "")
++
++class Credentials:
++    """Sensitive credentials storage."""
++
++    # Hardcoded secrets - should use env vars
++    API_KEY = "sk-abcdefghijklmnopqrstuvwxyz1234567890"
++    PASSWORD = "P@ssw0rd!123"
++    GITHUB_TOKEN = "ghp_abcdefghijklmnopqrstuvwxyz1234567890"
++    AWS_SECRET = "AKIA1234567890ABCDEF"
++
++    @classmethod
++    def get_db_url(cls) -> str:
++        """Get database URL with embedded credentials."""
++        return "postgres://admin:SuperSecret@localhost:5432/prod_db"

examples/skills_code_review_agent/review_report.json.example

@@ -0,0 +1,61 @@
+{
+  "meta": {
+    "generated_at": "2026-07-21T12:00:00.000000",
+    "report_version": "1.0"
+  },
+  "task": {
+    "id": "example-task-id-0000",
+    "status": "completed",
+    "input_type": "fixture",
+    "input_summary": "02_security_leak",
+    "created_at": "2026-07-21T12:00:00.000000",
+    "total_duration_ms": 1500.0,
+    "error_message": null
+  },
+  "summary": {
+    "total_findings": 2,
+    "total_warnings": 1,
+    "total_needs_human_review": 0,
+    "severity_distribution": {
+      "high": 2,
+      "medium": 1
+    },
+    "filter_intercept_count": 0,
+    "sandbox_execution_count": 1
+  },
+  "findings": [
+    {
+      "id": "finding-001",
+      "task_id": "example-task-id-0000",
+      "severity": "high",
+      "category": "security",
+      "file": "src/config.py",
+      "line": 10,
+      "title": "Hardcoded API key detected",
+      "evidence": "API_KEY = \"sk-***\"",
+      "recommendation": "Move API key to environment variable: os.getenv('API_KEY')",
+      "confidence": "high",
+      "source": "rule",
+      "dedup_key": "src/config.py:10:security",
+      "created_at": "2026-07-21T12:00:00.000000"
+    }
+  ],
+  "warnings": [],
+  "needs_human_review": [],
+  "filter_intercepts": [],
+  "sandbox_runs": [
+    {
+      "id": "sandbox-001",
+      "script_name": "check_security.py",
+      "runtime": "local",
+      "duration_ms": 500.0,
+      "exit_code": 0,
+      "success": true,
+      "error_message": null,
+      "output_truncated": false
+    }
+  ],
+  "recommendations": [
+    "Move API key to environment variable: os.getenv('API_KEY')"
+  ]
+}