qwen-code/packages/cli
Shaojin Wen 471141fcde
fix(review): correct the borrowed lenses and vacuous-test severity (follow-up to #7735/#7736) (#7746)
* fix(review): correct and tighten the borrowed lenses per review

Four findings on the lenses this PR adds:

- **Agent 2 (subprocess injection), Critical.** The guidance said "terminate the
  argv with `--`", but `--` ends *option* parsing without neutralizing a
  *pathspec* — for an overloaded command it creates one (`git checkout -- release`
  restores a path instead of switching branch; `git checkout -- .` still discards
  changes). Reword: validate against the subcommand grammar; a `--` helps only
  where it keeps the operand's role, and the value allowlist is what closes it.
- **Agent 1b (changed literal).** A default ripgrep skips hidden `.github/**`, so
  a marker consumed only by a workflow reads as "no consumer". Require a
  hidden-path search (`rg --hidden --glob '!.git/**' --fixed-strings`).
- **Agent 4 (unreproducible benchmark).** "Flag as unverified" conflicts with the
  actionable-findings-only contract. Make it actionable when load-bearing (request
  the script/env/raw numbers) or no finding when incidental (record under
  not-verified), never a non-defect finding.
- **Agent 5 (equivalent mutant).** Add a focused `buildRoleBrief(PLAN, '5')` test
  pinning the equivalent-mutant rule and its discriminating-input requirement, so
  a prompt-assembly regression cannot silently drop it.

* fix(review): a vacuous test is a Suggestion, not a Critical for being the sole guard

Agent 5's mutation lens graded a sole-guard vacuous test as Critical, but the
shared severity ladder — and Agent 7's deterministic efficacy probe — grade an
ineffective test as Suggestion. Step 4 keeps the higher severity, so the same
inert guard arrived as Critical from Agent 5 and Suggestion from Agent 7, and
the Critical won: a PR could be blocked solely for lacking an *effective* test,
the exact inflation those shared rules exist to prevent.

Align it with the dimension's own "name the bug, not the gap" rule: a vacuous
test is a Suggestion, escalated to Critical only when it asserts the opposite of
the intended behaviour, was weakened in-diff, or lets a specific incorrect
behaviour ship (in which case that behaviour is the Critical, with the test as
evidence). Mirrored in the test-matrix brief and the SKILL.md dimension table,
and pinned by a buildRoleBrief(PLAN, '5') assertion so the semantic reversal
cannot pass the generic word-presence check again.

* fix(review): pin the Agent 2 and test-matrix brief corrections, sync the SKILL table

---------

Co-authored-by: verify <verify@local>
2026-07-26 13:22:35 +00:00
..
src fix(review): correct the borrowed lenses and vacuous-test severity (follow-up to #7735/#7736) (#7746) 2026-07-26 13:22:35 +00:00
.gitignore feat(core): add opt-in built-in web_search backed by the DashScope Responses API (#7215) 2026-07-21 10:59:36 +00:00
index.ts fix(cli): add bootstrap fast paths (#6188) 2026-07-02 22:28:11 +00:00
package.json feat(channels): GitHub polling adapter with notification-as-wakeup architecture (#7632) 2026-07-25 09:31:50 +00:00
test-setup.ts feat(serve): persist dynamic workspace registrations (#6716) 2026-07-11 16:49:40 +00:00
tsconfig.json feat(webshell): replay ChatRecord history in readonly WebShell (#6999) 2026-07-19 00:09:44 +00:00
vitest.config.ts test: raise timeout ceiling for I/O-bound tests flaky under CI contention (#7230) 2026-07-19 12:03:48 +00:00