|
|
0e41c8c6f6
|
W15: workflow improvements — EXPRESS fast-path, audit→fix closed loop, metadata self-check (W15.1-W15.3)
CI / Determine matrix (push) Has been cancelled
CI / ${{ matrix.os }} / ${{ matrix.build_type }} (push) Has been cancelled
- W15.1 (杨帆): Add EXPRESS fast-path to §11 state machine (T17/T18, E1-E6 conditions, escalation safety valve)
- W15.2 (王测): Add §14 audit→fix closed loop — findings-registry.md, severity-driven auto-triage, CRITICAL blocking rule
- W15.3 (胡桐): Create scripts/check_agents_metadata.py (5-check: YAML parse, rating range, group/member refs, duplicate IDs)
- Fix YAML orphan bugs in 3 profiles: devops-hu, engineer-sun, security-cao (perf_log entries outside array)
- Pre-fill findings-registry.md with 10 historical findings from W11.1/W11.7 audits
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
|
2026-05-27 18:19:37 +08:00 |
|
|
|
47082376ef
|
Wave 10: deep audits of 5 unaudited plugins, smoke regression set (W13.1-W13.6)
CI / Determine matrix (push) Has been cancelled
CI / ${{ matrix.os }} / ${{ matrix.build_type }} (push) Has been cancelled
- W13.1 anthropic_plugin (architect-yang, 497 lines): rated C. 6 C ABI
functions lack try/catch (§8 violation); my_chat leaks response_body on
error path; tool_use response silently dropped.
- W13.2 deepseek_plugin (engineer-sun, 486 lines): rated C+. 7 ABI entries
unprotected including json::parse paths (malformed JSON terminates);
SSE [DONE] sentinel match brittle; ~55% code overlap with anthropic
suggests an ai_plugin_base extraction.
- W13.3 network_plugin (qa-wang, 322 lines): rated C. CRITICAL: TLS
certificate verification fully disabled (set_verify_mode never called,
default verify_none accepts any cert) — all AI traffic incl. api_key
is MITM-vulnerable. DNS resolve has no timeout; catch lacks (...).
- W13.4 lsp_plugin (architect-huang, 749 lines): rated C. CRITICAL:
guaranteed deadlock at L519-526 → L547 (g_lsp_impl_start holds mutex
then calls g_lsp_impl_stop which re-locks the same non-recursive
mutex); 7 vtable funcs unprotected; server→client requests dropped.
- W13.5 session+tools (security-cao, 264+251 lines): rated D+/D. Path
traversal in builtin_file_read/write (zero validation); global
static state in both plugins lacks mutex (UAF risk); 9 vtable funcs
lack try/catch.
- W13.6 smoke regression (qa-xu, +193 lines): 4 new cases — context
max_tokens trim, config dual-store consistency (exposes that W12.2
merge is incomplete: dstalk_config_set→config_service.get returns
null), HTTP error path no-crash, repeated init/shutdown cycle.
Verified: cmake build 0 error 0 warning, ctest 4/4 pass.
Top W14 priorities surfaced: TLS verification (W13.3), LSP deadlock
(W13.4), file-tool path traversal (W13.5), config dual-store still
broken (W13.6 R2), shared try/catch wrapper across all AI plugins.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
|
2026-05-27 09:32:13 +08:00 |
|
|
|
bb2e8c0220
|
Wave 8: tech-debt audits, core unit tests, CLI pipe input (W11.1-W11.7)
CI / Determine matrix (push) Has been cancelled
CI / ${{ matrix.os }} / ${{ matrix.build_type }} (push) Has been cancelled
- W11.1 context_plugin audit (architect-huang): 3 findings on ABI exception
safety, strdup null checks, dead g_max_tokens variable. Rating: B.
- W11.2 config audit (engineer-chen): identified 74-line TOML parser
duplication between config_plugin and config_store, dual-store data
isolation, dangling c_str() risk. Rating: C.
- W11.3 event_bus + service_registry unit tests (qa-liu): 12 cases total,
ctest coverage 2 -> 4 targets, 100% pass.
- W11.4 CLI stdin pipe mode (engineer-zhao): isatty detection, single-shot
inference path with exit codes 0/1/2/3.
- W11.6 scripts/refresh_status.py (engineer-li): 431-line generator that
scans 16 profile.md + 5 group.md to regenerate STATUS.md.
- W11.7 destructive testing (qa-xu): 10 input scenarios PASS, found bin
copy mismatch (BUG-1) plus 3 minor UX bugs for follow-up.
Verified: cmake build 0 error, ctest 4/4 pass.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
|
2026-05-27 09:06:25 +08:00 |
|
