feat(mcp-server): zcode_security_review 接 mimosa deep 深扫 (异步任务管线) - #10
Merged
Conversation
- 新增 depth 参数: normal (默认, 同步快扫) / deep (业务逻辑投研, security_scan_start → status 轮询 → completed 回读 findings) - 新增 focus_files 参数 (仅 deep, 优先级提示非过滤器 — 实测静态引擎全量扫) - 异步响应解析: content[0].text 是嵌套 JSON 字符串, 完成判定看 job.status (running 态含 completedAt:null, 字符串匹配会误判) - 超时会 best-effort cancel 后台 job; ZCODE_BRIDGE_MIMOSA_DEEP_TIMEOUT (默认 900s) / ZCODE_BRIDGE_MIMOSA_POLL_INTERVAL (默认 2s) 可配 - deep 与 normal 共用同一条 scanDir 校验 + findings.json 回读管线 - 新增 12 个测试用例 (36 全绿); README/SKILL/agent-help 同步
- P0-2/3: cancel 收敛进 finally — start 后任何未完成退出路径 (status 单次 超时/解析异常/总预算超时) 统一 best-effort cancel, 不留孤儿 job; cancel 失败 log 留痕 (P1-5); status 单次超时视同 running 继续轮询 - P0-1: 总预算计时起点移到 start 之前 (预算含 start 开销); test_ds2 改单调递增 fake clock - P1-1: _EnvGuard 补 ZCODE_BRIDGE_MIMOSA_DEEP_TIMEOUT/POLL_INTERVAL - P1-2: test_ds3 补 time.sleep patch - P1-3: cwd 计算移到 zcode 复核阶段 (mimosa 阶段不用, 消除误导) - P1-4: focus_files 类型校验 (非 list 明确报错) + 200 上限截断 - P2-1: content 提取收敛为 _mimosa_result_body; P2-2: completion 空值渲染; P2-4: test lambda 技巧改具名函数
- P1-1: status 超时的 try 收窄到只包 call_tool (防未来解析层 TimeoutError 被误吞) - P1-2: failed/cancelled 终态不再触发冗余 cancel (terminal 标志) - P1-3: status 连续单次超时要 5 次上限, 防显著推迟总预算触发 - P2-1: focus_files 元素级过滤 (非字符串丢弃+log, 不 stringify)
- R1 P2-5: deep stub 改工厂模式 (_make_deep_stub), 弃类变量全局状态; DS1 顺带补'failed 终态不再 cancel'断言 - R2 P2-2: fake clock 改 itertools.count 无界递增 - R2 P2-4: 测试 stub lambda 统一改具名函数 (sr0/_patch_common/_patch) - R2 P2-5: _env_int 加 maximum 上界, 5 个调用点全部钳位 (review_timeout≤3600/max_retries≤10/mimosa≤3600/deep≤7200/poll≤60) - R1 P2-3: README 明确 focus_files 由调用方算 diff 传入, bridge 不做 git 集成
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
动机
PR #9 的
zcode_security_review只接了 mimosa 的normal快扫（纯规则匹配）。本 PR 接入deep深扫档：含业务逻辑投研（threatModel/validation/pathAnalysis），用于发版前全面审计等需要更彻底覆盖的场景。改动
zcode_security_review新增depth参数（normal默认不变 /deep）与focus_files参数（仅 deep：业务逻辑复核的优先级提示，不是过滤器——实测静态引擎永远全量扫）security_scan_start→security_scan_status轮询 → completed 后回读 findings，与 normal 共用同一条 scanDir 校验 + findings.json 回读管线content[0].text是嵌套 JSON 字符串（mimosa-mcp-security-scan-job/v1）非 Markdown；完成判定必须 parse JSON 看job.status（running 态含"completedAt":null，字符串匹配会误判）ZCODE_BRIDGE_MIMOSA_DEEP_TIMEOUT（默认 900s，计时起点含 start 开销）、ZCODE_BRIDGE_MIMOSA_POLL_INTERVAL（默认 2s）finally统一 best-effort cancel；status 单次响应超时视同 running 继续（连续 5 次上限）；终态不重复 cancelmimosa deep 实测结论（GC-8G，mimosa 1.0.3）
evidenceBoundary: static_only_no_runtime_execution，扫描期间ss无任何连接）focusFiles实测不是过滤器狗食验证（新 review 模式自审本 PR）
zcode_review审 feat diff：3 P0 / 5 P1 / 5 P2 → P0/P1 全修（commitda3abac）：孤儿 job 风险（cancel 收敛 finally）、总预算计时起点、env 隔离、focus_files 校验等21d1ab9）：try 范围收窄、终态冗余 cancel、status 超时连续上限；P2 记录可选