feat(examples): add skills code review agent

[k0mondor]

Summary

This PR adds a code review agent prototype under examples/skills_code_review_agent/ and a formal code-review skill under skills/code-review/.

The example accepts unified diffs, repo workspace changes, or fixtures as input, parses changed files/hunks/context, runs deterministic review rules, applies filter decisions before sandboxed script execution, and persists the full review result into SQLite. It also generates both review_report.json and review_report.md.

What Is Included

• new example directory: examples/skills_code_review_agent/
• formal skill package: skills/code-review/
• CLI entrypoint for --diff-file, --repo-path, and --fixture
• deterministic rule engine covering:
  • security risks
  • async errors
  • resource leaks
  • missing tests
  • secret leakage
  • database lifecycle issues
• finding dedupe and confidence-based routing
• filter governance before script execution
• controlled sandbox/script execution with timeout and output truncation
• secret redaction before reporting and persistence
• SQLite schema + repository for review tasks, inputs, filter decisions, sandbox runs, findings, and final reports
• dual report outputs: review_report.json and review_report.md
• dry-run / fake-model compatible execution path
• public fixture coverage and example tests

Deliverables

• examples/skills_code_review_agent/
• skills/code-review/SKILL.md
• skill rules / usage / script contracts / scripts
• database schema and storage implementation
• sample outputs:
  • examples/skills_code_review_agent/sample_outputs/review_report.json
  • examples/skills_code_review_agent/sample_outputs/review_report.md
• design note:
  • examples/skills_code_review_agent/DESIGN_NOTE.md

Testing

Ran:

pytest examples/skills_code_review_agent/tests -q

Covered scenarios include:

• clean diff
• security issue
• async/resource leak
• database lifecycle issue
• missing tests
• duplicate finding
• sandbox failure
• secret redaction

Notes

• The canonical reusable skill now lives at skills/code-review/.
• The example keeps explicit Python-side orchestration for review flow, storage, telemetry, and governance, while exposing a formal skill package and skill_run payload contract.
• dry-run / fake-model mode is supported so the pipeline can be validated without real model credentials.

[CongkeChen]

AI Code Review

已在上下文中完成核实。正在撰写审查报告。

发现的问题

⚠️ Warning

• trpc_agent_sdk/sessions/_summarizer_manager.py:212 与 trpc_agent_sdk/sessions/_summarizer_manager.py:166：previous_summary 被重复获取，存在缓存与持久化状态不一致的版本号风险

  • create_session_summary 在压缩前先调用 self._get_cached_summary(session)（212 行）拿到 previous_summary 并传入 _build_summary_metadata；而 _build_summary_metadata 内部在 previous_summary is None 时又会再次调用 _get_cached_summary（166 行）。_get_cached_summary 在缓存未命中时会调用 _restore_summary_from_session 并把恢复结果写回缓存（_cache_summary），这意味着第一次调用就会把“从当前 session.events 反序列化出的旧 summary”固化为缓存。如果同一 session 对象在本次 summarize 之前被外部修改过 events（例如 replay harness 中的 DELETE_SUMMARY/SET_SUMMARY_VALUE fault 已直接清掉或篡改了 summary event 的 custom_metadata），version 会从被篡改/残缺的元数据中推导，导致 summary_id/version/replaces 链路错乱。建议让 create_session_summary 只取一次 previous_summary 并显式传入，_build_summary_metadata 不要在 previous_summary is None 时回退到再次读缓存（或至少在回退前校验 summary event 的元数据完整性），避免恢复出的脏缓存污染版本号。

• tests/sessions/replay_harness.py:1308-1314：_patched_time_time 全局替换 time.time，未做并发隔离

  • 该上下文管理器直接把模块级 time.time 替换为固定值再恢复，依赖测试串行执行。_run_replay_cases 虽然按顺序 await，但被 patch 的 create_session_summary 内部会 await self._summarizer.create_session_summary(...)，期间若 event loop 调度到任何同样读取 time.time 的协程（例如 SQL cleanup loop、TTL 判定），都会拿到错误的固定时间戳，可能影响 is_expired/update_expired_at 等基于真实时间的判断。建议改为对 summarizer 对象的 time 取值做显式注入（如传入 now 参数），而不是 monkeypatch 全局 time.time。

💡 Suggestion

• trpc_agent_sdk/sessions/_sql_session_service.py:843：_start_cleanup_task 仍使用 asyncio.get_event_loop()
  • 本次改动给 _cleanup_loop 加了对 __cleanup_stop_event is None 的保护（修复了 NameError 风险），但任务创建仍用 asyncio.get_event_loop().create_task(...)，在没有运行中 event loop 的情况下会触发 DeprecationWarning 或报错。由于本 PR 未改这一行，仅作为后续维护提示：可考虑用 asyncio.get_running_loop() 或延迟到首次异步调用时启动 cleanup task。

总结

SDK 侧的生产代码改动（Redis hset 改用 mapping、_decode_redis_hash 字节解码、SQL summary 事件重排、cleanup loop 空值保护、in-memory model_copy 防别名）整体正确且与既有行为对齐，未发现阻塞级缺陷。主要风险集中在 summarizer 版本号链路在异常/篡改输入下的健壮性，以及 replay harness 对全局 time.time 的 monkeypatch 在事件循环调度下的副作用，建议合并前评估上述两条 Warning。

测试建议

• 建议补一个用例：在 create_session_summary 之前人为破坏 session 中 summary event 的 custom_metadata（删 key 或置为非 dict），断言 _build_summary_metadata 不会从残缺数据推出错误的 version/replaces，并能安全回退到 v1。
• 建议在 replay harness 中验证 _patched_time_time 生效期间并发触发的 TTL 过期判断不会被固定时间戳污染（或在 CI 中跑一次 TRPC_AGENT_REPLAY_CLOCK_MODE=fixed_safe 的多 case 顺序运行以固化该假设）。

[codecov]

Codecov Report

❌ Patch coverage is 91.20879% with 8 lines in your changes missing coverage. Please review.
⚠️ Please upload report for BASE (main@e113610). Learn more about missing BASE report.

Files with missing lines	Patch %	Lines
trpc_agent_sdk/sessions/_sql_session_service.py	73.33333%	4 Missing ⚠️
trpc_agent_sdk/sessions/_summarizer_manager.py	93.54839%	4 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main        #208   +/-   ##
==========================================
  Coverage        ?   87.92150%           
==========================================
  Files           ?         479           
  Lines           ?       45047           
  Branches        ?           0           
==========================================
  Hits            ?       39606           
  Misses          ?        5441           
  Partials        ?           0           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[k0mondor]

Closing this PR because the branch was based on a previous work branch and mixed unrelated session/replay changes into the diff.
I reopened the same code-review-agent work from a clean branch based on upstream/main.