Repository navigation
v3.12.4
What's new
Bug Fixes
ce:review's Stage 5 verdict could read as clean even when a review had actually degraded, for three separate reasons closed by this release (#818).
First, environment-value redaction was too aggressive: it matched any runtime environment value, exact or embedded, and discarded an entire persona payload on a hit. Short values are common — in a typical shell, 19 of 101 environment values are eight characters or fewer, including strings like 0, 1, 3, 30, and -c — so a finding that merely quoted a diff line containing a digit could cause a reviewer's whole payload to be thrown away. Value matching is now limited to values of at least 16 characters that are not purely digits, dots, dashes, or path separators, plus any value whose variable name looks secret-bearing regardless of length. Structural detectors are unchanged, and a match inside a single finding now drops only that finding rather than the entire payload.
Second, a rejected reviewer could still contribute to a "clean" verdict. When the persona assigned to a risk-critical surface came back malformed or never returned, the coverage note recorded the gap but the verdict itself did not reflect it. The verdict is now blocking unless another persona covered the same surface with validated evidence, and the same rule applies when a risk-critical persona loses findings to finding-level rejection. A follow-up fix refined this rule further: keying the block on any nonzero rejected-finding count was both too strict (blocking the verdict over a single dropped P3) and too loose. The rule now keys on severity — a rejected P0, P1, or unknown-severity finding blocks the verdict, while P2/P3 losses are only recorded in Coverage, and unknown severity fails closed.
Third, rejected payloads no longer get per-finding ledger entries, so deduplication — which runs only over validated returns — can no longer undercount cross-reviewer agreement by excluding an enumerated rejected finding from the fingerprint group of an identical surviving one. A rejected payload now rolls up into a single weighted summary entry, keeping disposition counts consistent with the findings actually observed.
The secret-bearing variable-name list used for redaction also gained coverage for common short-secret variables — DB_PASS, MYSQL_PWD, GPG_PASSPHRASE, SIGNING_PASSPHRASE, AUTH_SALT, and HMAC_SALT — via new _PASS, _PWD, PASSPHRASE, and _SALT patterns, underscore-qualified specifically to avoid catching benign names like BYPASS_CACHE, PWD, BASALT_DIR, or SALT_ROUNDS.
Also in this release
- deps: Updated
fro-bot/agentto v0.101.0 (#817).