Claude (review-harness setup) a75e14716b Phase E — append-only memory + diff subcommand (PROMPT.md complete)
Closes the harness's feature set per PROMPT.md modes 2 (Diff Review)
and Phase 5 (Memory). Rules subcommand still pending (it needs
operator-authored .review-rules.md content first; documented as
Phase E follow-up).

internal/memory/ — append-only writer:
- AppendKnownRisks: one JSONL line per confirmed finding per run.
  O_APPEND only; never O_TRUNC. Empty findings list is a no-op
  (doesn't even create the file — keeps clean runs from polluting
  .memory/).
- AppendRunHistory: one JSONL line per run. Run summary stats +
  receipts hash for cross-link.
- WriteProjectProfile: the ONLY non-versioned memory file; snapshot
  semantics, overwrites are explicit + documented.
- 4 unit tests including TestAppendKnownRisks_NeverTruncates which
  is the audit's "no silent overwrite" gate — write twice, assert
  both writes' content survives.

Pipeline phase 5 wires it. Confirmed findings only — suspected
findings might still be wrong, keeping .memory/ authoritative.
Disabled if review-profile.memory.enabled = false.

internal/git/git.go — ChangedFiles helper:
- Probes unstaged + staged + branch diff against main/master.
- Dedup'd, stable order. Empty result on clean tree.
- Graceful failure: returns error if git binary missing or target
  isn't a git repo.

cli/repo.go — Diff subcommand:
- `review-harness diff <path>` runs the same pipeline as scrum but
  scoped to changed files only. Pipeline.Inputs gains DiffOnlyFiles
  filter applied post-Walk.
- Empty diff (clean tree, no commits ahead of base) → exit 0 with
  message; doesn't generate empty reports.
- LLM toggleable via --enable-llm same as scrum.

scanner/walk.go: added .memory to SkipDirs (universal — harness's
own audit trail, scanning it surfaces planted-secret evidence as
new findings — same class as B5 self-skip).

.gitignore tightened: /.memory/ → **/.memory/ to keep test-fixture
.memory dirs from leaking into version control (same fix as
reports/latest pattern).

Verified end-to-end:
- 4 memory unit tests PASS
- Append-only proven: insecure-repo run 1 → 16 known-risks lines;
  run 2 → 44 lines (16 + 28 from new run); run-history grew 1 → 2.
- Diff subcommand against this repo (5 uncommitted Phase E files
  staged) → exit 0, all reports produced, scoped to those 5 files
  only (0 findings on the diff-scoped scan vs 129 on full repo —
  changed files don't contain analyzer-flaggable patterns).

Phase A through E shipped today. Rules subcommand + tests for
internal/{config,scanner,git,llm,reporters,pipeline} remain.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-30 02:19:12 -05:00

157 lines
4.1 KiB
Go

// runRepo + runScrum are Phase B entry points. Phase A leaves them
// as compilable stubs that produce the JSON shapes the gates expect
// but with zero analyzer findings — letting the pipeline structure
// be exercised end-to-end before analyzers land.
package cli
import (
"context"
"flag"
"fmt"
"os"
"path/filepath"
"local-review-harness/internal/config"
"local-review-harness/internal/git"
"local-review-harness/internal/pipeline"
)
func runRepo(ctx context.Context, repoPath string, cf commonFlags) int {
if _, err := os.Stat(repoPath); err != nil {
fmt.Fprintln(os.Stderr, "repo: target path:", err)
return 65
}
rp, err := config.LoadReviewProfile(cf.reviewProfilePath)
if err != nil {
fmt.Fprintln(os.Stderr, "config:", err)
return 65
}
mp, err := config.LoadModelProfile(cf.modelProfilePath)
if err != nil {
fmt.Fprintln(os.Stderr, "config:", err)
return 65
}
outDir := resolveOutputDir(&cf, rp, repoPath)
res, err := pipeline.RunRepo(ctx, pipeline.Inputs{
RepoPath: repoPath,
ReviewProfile: rp,
ModelProfile: mp,
OutputDir: outDir,
EmitScrum: false,
EnableLLM: cf.enableLLM,
})
if err != nil {
fmt.Fprintln(os.Stderr, "pipeline:", err)
return 65
}
for _, f := range res.OutputFiles {
fmt.Println(filepath.Join(outDir, f))
}
return res.ExitCode
}
// Diff is the `review-harness diff <path>` subcommand entry point
// (Phase E). Detects changed files via git (unstaged + staged + vs
// branch base), then runs the same pipeline as `repo` but scoped to
// just those files. PROMPT.md mode 2: "diff review."
func Diff(args []string) int {
fs := flag.NewFlagSet("diff", flag.ContinueOnError)
var cf commonFlags
bindCommonFlags(fs, &cf)
if err := fs.Parse(args); err != nil {
return 64
}
if fs.NArg() < 1 {
fmt.Fprintln(os.Stderr, "diff: missing target path")
return 64
}
repoPath := fs.Arg(0)
return runDiff(context.Background(), repoPath, cf)
}
func runDiff(ctx context.Context, repoPath string, cf commonFlags) int {
if _, err := os.Stat(repoPath); err != nil {
fmt.Fprintln(os.Stderr, "diff: target path:", err)
return 65
}
rp, err := config.LoadReviewProfile(cf.reviewProfilePath)
if err != nil {
fmt.Fprintln(os.Stderr, "config:", err)
return 65
}
mp, err := config.LoadModelProfile(cf.modelProfilePath)
if err != nil {
fmt.Fprintln(os.Stderr, "config:", err)
return 65
}
changed, err := git.ChangedFiles(ctx, repoPath)
if err != nil {
fmt.Fprintln(os.Stderr, "diff: git probe:", err)
return 65
}
if len(changed) == 0 {
fmt.Fprintln(os.Stderr, "diff: no changed files (clean tree, no commits ahead of main/master) — exit 0")
return 0
}
fmt.Fprintf(os.Stderr, "diff: scanning %d changed file(s):\n", len(changed))
for _, f := range changed {
fmt.Fprintln(os.Stderr, " -", f)
}
outDir := resolveOutputDir(&cf, rp, repoPath)
res, err := pipeline.RunRepo(ctx, pipeline.Inputs{
RepoPath: repoPath,
ReviewProfile: rp,
ModelProfile: mp,
OutputDir: outDir,
EmitScrum: true, // diff mode emits the scrum bundle so PR reviewers see it
EnableLLM: cf.enableLLM,
DiffOnlyFiles: changed,
})
if err != nil {
fmt.Fprintln(os.Stderr, "pipeline:", err)
return 65
}
for _, f := range res.OutputFiles {
fmt.Println(filepath.Join(outDir, f))
}
return res.ExitCode
}
func runScrum(ctx context.Context, repoPath string, cf commonFlags) int {
if _, err := os.Stat(repoPath); err != nil {
fmt.Fprintln(os.Stderr, "scrum: target path:", err)
return 65
}
rp, err := config.LoadReviewProfile(cf.reviewProfilePath)
if err != nil {
fmt.Fprintln(os.Stderr, "config:", err)
return 65
}
mp, err := config.LoadModelProfile(cf.modelProfilePath)
if err != nil {
fmt.Fprintln(os.Stderr, "config:", err)
return 65
}
outDir := resolveOutputDir(&cf, rp, repoPath)
res, err := pipeline.RunRepo(ctx, pipeline.Inputs{
RepoPath: repoPath,
ReviewProfile: rp,
ModelProfile: mp,
OutputDir: outDir,
EmitScrum: true,
EnableLLM: cf.enableLLM,
})
if err != nil {
fmt.Fprintln(os.Stderr, "pipeline:", err)
return 65
}
for _, f := range res.OutputFiles {
fmt.Println(filepath.Join(outDir, f))
}
return res.ExitCode
}