Repository navigation
持久化 TypeScript WASM 疑似位置并绑定原生确认任务 - #15
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7f8bc05c4f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if blocker.checker_id == "node.eslint.preparation" | ||
| && blocker.diagnostic_reason.as_deref() == Some("eslint_syntax_confirmation_needed") | ||
| { | ||
| return format!( | ||
| "# {} TypeScript 语法原生确认任务\n\n- 问题证据：源码范围 `{}` 的候选 WASM 初检尚未验收；脱敏疑似位置、源码及 grammar 摘要在 `.codeguard/reports/{}.json` 的 `syntax_evidence`，报告 SHA-256 `{}`。这些不是已确认源码违规。\n- 规则依据：Tree-sitter 恢复节点只提示疑似语法位置；原生 TypeScript/ESLint 能力和项目原配置仍须确认。\n- 允许范围：核对本源码、对应构建根、原生工具及配置；不得仅凭 WASM 恢复节点修改源码、增加忽略或白名单。\n- 修复步骤：先查看同 run 的脱敏位置，再恢复适用的原生语法检查；若原生反证，保留证据并进入 grammar 误报调查。\n- 复检命令：codeguard lint typescript <原源码> --workspace <原工作区> --node-tool <核验绝对路径> --eslint-entry <核验绝对路径> --eslint-version <核验版本> --config <原配置绝对路径> --cwd <原工作目录绝对路径>。\n- 历史尝试：首次 run `{}`；后续观察、尝试和复检保留在同一任务，首张 Markdown 不是完整历史。\n- 关闭条件：同输入、范围、方言及语法能力的原生复检和正式策略/覆盖核验均满足；安装、WASM 零恢复或任务勾选不能关闭。\n", |
There was a problem hiding this comment.
When this source-scoped blocker already exists—for example after an earlier eslint_syntax_precheck_unavailable scan or an upgrade from the previous report format—persist_blocker never calls render_blocker_task because it writes task Markdown only when first is true. A subsequent successful 0.2.0 scan reuses the same fingerprint, so this new branch is skipped and the task permanently retains the generic text without the promised report path or digest, even though current syntax evidence is now available. Update or migrate an existing task when it first receives syntax-confirmation evidence.
Useful? React with 👍 / 👎.
| let lines: Vec<&str> = text.split('\n').collect(); | ||
| rows.iter().all(|row| valid_position(row, &lines)) |
There was a problem hiding this comment.
For an imported 0.2.0 report, the source and grammar hashes are checked, but each observation is accepted solely because its coordinates are in bounds. A report can therefore retain the genuine hashes, change an observation to any other in-bounds line and column, and pass work sync; next then presents that fabricated location as suspected Tree-sitter evidence. Recompute the recovery nodes with the identified grammar, or otherwise verify a worker-derived binding for the observation set, rather than treating coordinate bounds as provenance.
Useful? React with 👍 / 👎.
| && blocker.diagnostic_reason.as_deref() == Some("eslint_syntax_confirmation_needed") | ||
| { | ||
| return format!( | ||
| "# {} TypeScript 语法原生确认任务\n\n- 问题证据：源码范围 `{}` 的候选 WASM 初检尚未验收；脱敏疑似位置、源码及 grammar 摘要在 `.codeguard/reports/{}.json` 的 `syntax_evidence`，报告 SHA-256 `{}`。这些不是已确认源码违规。\n- 规则依据：Tree-sitter 恢复节点只提示疑似语法位置；原生 TypeScript/ESLint 能力和项目原配置仍须确认。\n- 允许范围：核对本源码、对应构建根、原生工具及配置；不得仅凭 WASM 恢复节点修改源码、增加忽略或白名单。\n- 修复步骤：先查看同 run 的脱敏位置，再恢复适用的原生语法检查；若原生反证，保留证据并进入 grammar 误报调查。\n- 复检命令：codeguard lint typescript <原源码> --workspace <原工作区> --node-tool <核验绝对路径> --eslint-entry <核验绝对路径> --eslint-version <核验版本> --config <原配置绝对路径> --cwd <原工作目录绝对路径>。\n- 历史尝试：首次 run `{}`；后续观察、尝试和复检保留在同一任务，首张 Markdown 不是完整历史。\n- 关闭条件：同输入、范围、方言及语法能力的原生复检和正式策略/覆盖核验均满足；安装、WASM 零恢复或任务勾选不能关闭。\n", |
There was a problem hiding this comment.
When a TypeScript filename contains Markdown or HTML metacharacters such as a backtick, safe_path accepts it and the raw workspace-relative scope is interpolated directly into this generated task. Such a filename can terminate the code span and inject attacker-controlled links or instruction-like text into the task that a user or agent is expected to inspect. Encode or escape the scope before placing it in Markdown, as the other task renderers do for source paths.
Useful? React with 👍 / 👎.
1 participant
TypeScript/TSX 单文件 WASM 初检先前虽会创建稳定的原生确认任务，但疑似位置只留在当轮反馈中。现在已初始化工作区会把有界、脱敏的位置与源码/grammar SHA-256 写入 0.2.0 本地准备报告，任务引用该报告及摘要，
next返回当前位置；重复扫描沿用同一任务，源码变化不会被旧证据关闭。导入时核验固定 grammar、当前源码和坐标边界，拒绝伪造报告。疑似结果仍是未核实证据，原生 ESLint/TypeScript 确认及交付门禁未因此完成。OpenSpec 14.7/14.10 保持未勾选。
验证：22 项定向测试通过、4 项真实 ESLint 10 测试因当前环境条件跳过；Clippy
-D warnings、OpenSpec 严校验、分层检查、JSON 和 diff 检查通过。