chore(ai-review 狀態): 回寫本輪已處理 findings

.gitea/ai-review/findings/2026-07-20-18:31:07.json

@@ -134,20 +134,6 @@
       "suggestedCode": "```\nfunction addIssueDependency(ctx, issueNumber, dependencyIssueNumber) {\n  return api(ctx, 'POST', `/repos/${ctx.owner}/${ctx.repo}/issues/${issueNumber}/dependencies`, {\n    index: dependencyIssueNumber,\n    owner: ctx.owner,\n    repo: ctx.repo,\n  });\n}\n```",
       "sourceIssue": 15
     },
-    {
-      "id": "F019",
-      "reviewer": "Leo",
-      "focus": "",
-      "badge": "🧰",
-      "severity": "建議",
-      "file": "src/lib/review.js",
-      "startLine": 13,
-      "endLine": 72,
-      "problem": "`redactSecrets()` 與 `agentFailureDetail()` 是低階日誌診斷／遮罩邏輯，現在放在 `review.js` 這個負責 diff 整理與審查決策的模組頂端。這會讓 `review.js` 的職責繼續膨脹：未來若其他模組也要安全輸出 CLI 錯誤，只能複製這段或反向依賴 review 模組，邊界會越來越不清楚。",
-      "suggestion": "把這兩個函式搬到專門的工具模組，例如 `src/lib/diagnostics.js` 或 `src/lib/log-redaction.js`，並由 `review.js` 引入。這樣遮罩規則可集中測試與重用，`review.js` 也能維持在「審查流程資料處理」的邊界內。",
-      "suggestedCode": "",
-      "sourceIssue": 17
-    },
     {
       "id": "F022",
       "reviewer": "Leo",
@@ -232,20 +218,6 @@
       "suggestedCode": "```\nconst issueBuffer = [];\nlet trackingIssue = null;\n\nconst postComment = async (body) => {\n  if (ctx.createIssue) {\n    if (trackingIssue) return gitea.createCommentOnIssue(ctx, trackingIssue.number, body);\n    issueBuffer.push(body);\n    return null;\n  }\n  const created = await gitea.createIssueComment(ctx, body);\n  currentRunCommentIds.add(created.id);\n  return created;\n};\n```",
       "sourceIssue": 19
     },
-    {
-      "id": "F028",
-      "reviewer": "Leo",
-      "focus": "",
-      "badge": "🧰",
-      "severity": "建議",
-      "file": "src/lib/review.js",
-      "startLine": 14,
-      "endLine": 75,
-      "problem": "`review.js` 這次新增 `redactSecrets()` 與 `agentFailureDetail()`，但這兩個函式處理的是 AI CLI 執行失敗診斷與機密遮罩，責任更接近 `agents.js` 或共用 log/sanitize 工具。現在審查結果整理模組同時負責 diff、裁決、issue 發文與 CLI 診斷格式，模組邊界越來越鬆；之後其他地方若也要記錄 agent 失敗，很容易複製一份遮罩邏輯或反向依賴 `review.js`。",
-      "suggestion": "將這兩個函式移到 `src/lib/agents.js`（例如匯出 `formatAgentFailure()`），或新增 `src/lib/sanitize.js`/`src/lib/diagnostics.js`。`review.js` 只消費格式化後的錯誤摘要，避免讓審查編排模組承擔 CLI 診斷細節。",
-      "suggestedCode": "",
-      "sourceIssue": 19
-    },
     {
       "id": "F029",
       "reviewer": "Bard",
@@ -302,20 +274,6 @@
       "suggestedCode": "```\nfunction addIssueDependency(ctx, blockedIssueNumber, blockingIssueNumber) {\n  return api(ctx, 'POST', `/repos/${ctx.owner}/${ctx.repo}/issues/${blockedIssueNumber}/dependencies`, {\n    index: blockingIssueNumber,\n    owner: ctx.owner,\n    repo: ctx.repo,\n  });\n}\n```",
       "sourceIssue": 21
     },
-    {
-      "id": "F036",
-      "reviewer": "Rogue",
-      "focus": "",
-      "badge": "⚡",
-      "severity": "警告",
-      "file": "src/index.js",
-      "startLine": 305,
-      "endLine": 305,
-      "problem": "攻擊方沒有找出任何 finding 時，這裡還是照樣啟動防守方 `runDefenders`。空陣列沒有東西可裁決，卻會多跑一輪 AI CLI/sub agent、讀 exclusions/history、組 prompt；每個乾淨 PR 都被偷走 1 次防守方呼叫的 CPU、等待時間與 token。",
-      "suggestion": "在 `findings.length === 0` 時直接略過防守方裁決，令 `kept/excluded` 都是空陣列，直接進入保存結果與收尾。這不是微優化，是整輪 AI 呼叫直接歸零。",
-      "suggestedCode": "```\nconst { kept, excluded } = findings.length === 0\n  ? { kept: [], excluded: [] }\n  : await review.runDefenders({ tool, model: ctx.model, cwd, defenders, findings });\n```",
-      "sourceIssue": 22
-    },
     {
       "id": "F040",
       "reviewer": "Assassin",