diff --git a/.gitea/ai-review/exclusions.json b/.gitea/ai-review/exclusions.json index 8e9acd5..f0c3ae7 100644 --- a/.gitea/ai-review/exclusions.json +++ b/.gitea/ai-review/exclusions.json @@ -142,5 +142,11 @@ "role": "Mage", "original_finding": "這裡直接使用 `spawn` 執行 `codex` 命令,且參數 `prompt` 是直接從 `process.env.PROMPT` 讀取並傳入的。如果 CI 環境的 `PROMPT` 被惡意竄改,雖使用陣列傳遞參數避免了 shell injection,但 `codex exec` 的邏輯若沒有妥善限制(例如限制可執行指令類型),可能導致攻擊者在 CI Runner 環境執行任意指令。", "reason": "此 action 的目的就是讓呼叫 workflow 以 `PROMPT` 指定 Codex 任務並在隔離 CI 容器內非互動執行;prompt 語意必須由 workflow 與 secret 的信任邊界控管。程式已用 `spawn` 參數陣列避免 shell injection,不適合在 action 內以白名單改寫或限制使用者 prompt。" + }, + { + "location": "app/main.js:134", + "role": "Maya", + "original_finding": "對於 codex 執行失敗的各種細節(權限不足、找不到 binary 等)都統一處理為 status: 1,測試未驗證具體錯誤來源。", + "reason": "此 GitHub Action 對外輸出以 `status=completed|failed` 與 `output` 訊息表達成功或失敗;process exit code 只需反映 Codex 子程序結果或通用啟動失敗。細分 ENOENT、EACCES 等 Action exit code 會改變既有介面且對 workflow 判斷價值有限,本次已用簡潔 output 訊息與測試覆蓋具體錯誤來源。" } ] diff --git a/.gitea/ai-review/findings.json b/.gitea/ai-review/findings.json index c86e092..fe51488 100644 --- a/.gitea/ai-review/findings.json +++ b/.gitea/ai-review/findings.json @@ -1,86 +1 @@ -[ - { - "level": "critical", - "role": "Maya", - "location": "app/main.js:189", - "problem": "Codex 超時處理路徑未經測試,無法確保 SIGTERM 能成功發送與訊息正確產出。", - "suggestion": "增加測試案例模擬長期睡眠(如 sleep 10),驗證超時機制與輸出訊息。" - }, - { - "level": "warning", - "role": "Maya", - "location": "app/main.js:147", - "problem": "spawn ENOENT 錯誤處理可能洩漏系統路徑資訊。", - "suggestion": "針對 error.code === 'ENOENT' 做明確判斷,回傳簡潔錯誤訊息而非完整 stack trace。" - }, - { - "level": "warning", - "role": "Maya", - "location": "app/main.js:164", - "problem": "close 事件缺少對 signal 終止(如 SIGKILL)的具體紀錄。", - "suggestion": "檢查 signal 參數,並在 output 中加入被哪個 signal 終止的資訊。" - }, - { - "level": "warning", - "role": "Rogue", - "location": "app/main.js:127", - "problem": "處理輸出區塊時使用 chunks.reduce 重複計算陣列大小,造成 O(n²) 運算瓶頸。", - "suggestion": "在 closure 中維護 currentSize 變數追蹤總大小,避免遍歷。" - }, - { - "level": "warning", - "role": "Rogue", - "location": "app/main.js:142", - "problem": "validateAuth 中重複執行 decoded.toString('base64') 並進行 normalizedBase64 處理,極度浪費資源。", - "suggestion": "移除這些無謂的重新編碼比較,直接嘗試解碼。" - }, - { - "level": "warning", - "role": "Bard", - "location": "app/main.js:166", - "problem": "runCodex 函式過於臃腫,包含了過多職責。", - "suggestion": "建議將輸出處理與超時設定分離為獨立函式。" - }, - { - "level": "warning", - "role": "Bard", - "location": "app/main.js:183", - "problem": "spawn 函式參數陣列過長且散亂,閱讀性較差。", - "suggestion": "將參數拆分為數組變數並展開傳遞。" - }, - { - "level": "warning", - "role": "Maya", - "location": "app/main.js:77", - "problem": "OutputCollector 的截斷機制未被測試。", - "suggestion": "增加測試案例模擬輸出超過 DEFAULT_OUTPUT_LIMIT_BYTES,驗證截斷提示。" - }, - { - "level": "warning", - "role": "Maya", - "location": "app/main.js:168", - "problem": "parsePositiveInteger 的輸入回退機制未經測試。", - "suggestion": "針對設定變數傳入無效數字或非法格式場景,驗證預設值套用。" - }, - { - "level": "info", - "role": "Maya", - "location": "app/main.js:134", - "problem": "對於 codex 執行失敗的各種細節(權限不足、找不到 binary 等)都統一處理為 status: 1,測試未驗證具體錯誤來源。", - "suggestion": "根據錯誤類型回傳細緻 status code,並在測試中驗證這些 code。" - }, - { - "level": "info", - "role": "Bard", - "location": "app/main.js:93", - "problem": "makeTempDir 內部使用了硬編碼的 '.codex-action-' 前綴。", - "suggestion": "將前綴提取為常數或設定檔參數。" - }, - { - "level": "info", - "role": "Bard", - "location": "app/main.js:283", - "problem": "setupAuth 函式職責過於繁雜。", - "suggestion": "將鎖定機制與驗證機制拆分為獨立輔助函式。" - } -] +[]