open-code-review-toolkit 0.12.0__tar.gz → 0.13.0__tar.gz

{open_code_review_toolkit-0.12.0 → open_code_review_toolkit-0.13.0}/.gitignore

@@ -16,3 +16,4 @@ dist/
 .idea/
 *.log
 .codex
+.playwright-cli/

{open_code_review_toolkit-0.12.0 → open_code_review_toolkit-0.13.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: open-code-review-toolkit
-Version: 0.12.0
+Version: 0.13.0
 Summary: Unofficial GitLab CI integration layer for Open Code Review
 Project-URL: Homepage, https://github.com/xeonvs/open-code-review-toolkit
 Project-URL: Repository, https://github.com/xeonvs/open-code-review-toolkit
@@ -228,6 +228,7 @@ Requires-Dist: certifi<2027,>=2026.10.19
 Requires-Dist: httpx2<3,>=2.13.0
 Requires-Dist: jsonschema<5,>=4.26.0
 Requires-Dist: mcp<3,>=2.2.0
+Requires-Dist: opentelemetry-api<2,>=1.45.1
 Requires-Dist: pyjwt<3,>=2.15.0
 Description-Content-Type: text/markdown
 
@@ -242,6 +243,8 @@ Description-Content-Type: text/markdown
 
 Open Code Review Toolkit is an unofficial review control and integration layer for [Alibaba Open Code Review](https://github.com/alibaba/open-code-review), with GitLab CI and standalone local providers. It provides bounded repository evidence, a compact review bootstrap, a built-in read-only MCP server, environment-driven OCR configuration, preflight validation, local Markdown reports, and safe GitLab merge-request posting. It does **not** bundle or download the `ocr` binary.
 
+[Explore the toolkit site](https://open-code-review-toolkit.pages.dev/) for a quick overview, demo video, and latest release notes.
+
 > [!NOTE]
 > The project is under active development; the public API, CLI, environment contract, and generated schemas may evolve before 1.0.
 
@@ -295,7 +298,9 @@ commit without forge credentials:
 
 ```console
 ocr-ci preflight --local
-ocr-ci review --local --result review.json --stderr review.stderr --report review.md -- --commit HEAD
+review_dir=$(mktemp -d)
+review_dir=$(cd "$review_dir" && pwd -P)
+ocr-ci review --local --result "$review_dir/review.json" --stderr "$review_dir/review.stderr" --report "$review_dir/review.md" -- --commit HEAD
 ```
 
 Local execution uses the same OCR, mandatory evidence MCP, validation and DLP
@@ -319,13 +324,17 @@ On a successful rerun, the toolkit replaces untouched OCR-only notes instead of
 
 Suppression uses both the GitLab diff position and a stable finding fingerprint, so ordinary line shifts do not normally bring the same bug back. A materially changed finding can still receive a new discussion. See [GitLab review operations](docs/operations.md) for the complete lifecycle, posting modes, permissions, failure behavior, and Mermaid state diagram.
 
-After every current review note publishes, the GitLab adapter can add a conservative approval bound to receipt v9's exact reviewed source SHA, target SHA/protection state, merge-request author, DLP mode, and reconciled federation use. This write is enabled by default; set `OCR_AUTO_APPROVE=false` when the bot must remain comment-only. DLP-clean metadata, generic discussions, protected same-revision CI outcomes, unused governed services, and successful `review_read` tool use do not independently block approval. An unprotected target, disabled DLP, degraded metadata, a DLP rejection, required context degradation, admitted remediation history, legacy receipts, publication filtering, used advisory tools, uncertain federation accounting, author movement, or bot self-authorship prevents an approval write. A CI status is review context, never approval authority. GitLab approval rules, Code Owners, and protected-branch policy remain authoritative merge policy. They are not prerequisites for OCR execution. The toolkit only adds an eligible approval; it never removes an existing approval when a later review is ineligible or disabled.
+After every current review note publishes, the GitLab adapter can add a conservative approval bound to receipt v11's exact reviewed diff, actual target, policy authority, merge-request author, DLP mode, and reconciled federation use. This write is enabled by default; set `OCR_AUTO_APPROVE=false` when the bot must remain comment-only. DLP-clean metadata, generic discussions, protected same-revision CI outcomes, unused governed services, and successful `review_read` tool use do not independently block approval. An unprotected target, disabled DLP, degraded metadata, a DLP rejection, required context degradation, admitted remediation history, older receipts, publication filtering, used advisory tools, uncertain federation accounting, author movement, or bot self-authorship prevents an approval write. A CI status is review context, never approval authority. GitLab approval rules, Code Owners, and protected-branch policy remain authoritative merge policy. They are not prerequisites for OCR execution. The toolkit only adds an eligible approval; it never removes an existing approval when a later review is ineligible or disabled.
+
+An intentionally absent toolkit receipt retains compatible direct posting outside
+GitLab CI without automatic approval. A present v9/v10 receipt can be read for historical
+diagnostics, but cannot publish a new current MR review.
 
-Accepted tradeoffs can be recorded in `.opencodereview/accepted-decisions.md`; the evidence collector supplies only applicable target-ref decisions and never lets a source change self-authorize its review. Root and nested target `AGENTS.md`/`CLAUDE.md` guidance is similarly exposed through the existing evidence MCP with deterministic scope and precedence, while any guidance touched by the merge request is excluded. See [Accepted project decisions](docs/configuration.md#accepted-project-decisions) and [Target project guidance](docs/configuration.md#target-project-guidance) for formats and trust boundaries.
+Accepted tradeoffs can be recorded in `.opencodereview/accepted-decisions.md`; the evidence collector supplies only applicable decisions from the selected policy commit and never lets a source change self-authorize its review. Root and nested policy `AGENTS.md`/`CLAUDE.md` guidance is similarly exposed through the existing evidence MCP with deterministic scope and precedence, while any guidance touched by the merge request is excluded. See [Accepted project decisions](docs/configuration.md#accepted-project-decisions) and [Target project guidance](docs/configuration.md#target-project-guidance) for formats and trust boundaries.
 
 ## Project architecture
 
-The shipped Repository Evidence Engine reads immutable base/head Git objects, stores bounded typed facts and deltas, creates the compact bootstrap used by OCR, and exposes detailed facts, literal search, scoped absence checks, and base/head changes through the mandatory built-in read-only MCP server. That internal server is always present and cannot be removed or replaced by operator configuration. Protected-policy enriched reviews can also acquire stable GitLab discussions, verified remediation history, and protected same-revision CI outcomes before OCR. Optional external tools use the governed registry-v2 federation gateway: the toolkit freezes explicit allowlists, validates schemas, origins, DLP and budgets, and reconciles content-free usage receipts while OCR remains the only model loop. Local review permits explicit HTTPS or stdio upstreams; GitLab permits HTTPS only.
+The shipped Repository Evidence Engine reads immutable base/head Git objects, stores bounded typed facts and deltas, creates the compact bootstrap used by OCR, and exposes detailed facts, literal search, scoped absence checks, and base/head changes through the mandatory built-in read-only MCP server. GitLab reviews can also expose a bounded, separately labelled actual-target snapshot for relevant code context; it does not become policy or another reviewed delta. The internal server is always present and cannot be removed or replaced by operator configuration. Protected-policy enriched reviews can also acquire stable GitLab discussions, verified remediation history, and protected same-revision CI outcomes before OCR. Optional external tools use the governed registry-v2 federation gateway: the toolkit freezes explicit allowlists, validates schemas, origins, DLP and budgets, and reconciles content-free usage receipts while OCR remains the only model loop. Local review permits explicit HTTPS or stdio upstreams; GitLab permits HTTPS only.
 
 - [Toolkit strategy](docs/engineering/toolkit_strategy.md) - durable product boundaries, architecture, invariants, and non-goals.
 - [Bounded review context](docs/review-context.md) - protected policy, GitLab discussions and same-revision CI outcomes, legacy reference migration, opaque handles, DLP, receipt, and cleanup contracts.
@@ -336,21 +345,23 @@ The shipped Repository Evidence Engine reads immutable base/head Git objects, st
 
 1. Configure protected/masked `GITLAB_API_TOKEN` and LLM variables in GitLab.
 2. Pin and checksum the OCR binary.
-3. Keep `OCR_GITLAB_TARGET_PROTECTION_MODE=required` unless the project deliberately permits an unprotected target in limited, comment-only mode.
-4. Merge repository review configuration, including the Rules path, into the target branch.
+3. With toolkit 0.13.0, leave `OCR_GITLAB_TARGET_PROTECTION_MODE` unset to use its `auto` default for a single MR targeting an unprotected branch under the same project's protected default-branch policy. Select explicit `required` to reject unprotected targets, or `unprotected` for the earlier limited profile.
+4. Merge repository review configuration, including the Rules path, into the protected policy branch before relying on it.
 5. Enable the CI review job in a later merge request and install this package.
 6. Run the four public helper stages around `ocr review`:
 
 ```console
 ocr-ci preflight
 ocr-ci configure
-ocr-ci review --result /tmp/ocr-result.json --stderr /tmp/ocr-stderr.log -- ... --format json
-ocr-ci post --result /tmp/ocr-result.json --stderr /tmp/ocr-stderr.log
+review_result="/tmp/ocr-result-${CI_JOB_ID}.json"
+review_stderr="/tmp/ocr-stderr-${CI_JOB_ID}.log"
+ocr-ci review --result "$review_result" --stderr "$review_stderr" -- ... --format json || export OCR_EXIT_CODE=$?
+ocr-ci post --result "$review_result" --stderr "$review_stderr"
 ```
 
 See the [GitLab mode matrix](examples/gitlab/README.md), the complete [`ocr-review.gitlab-ci.yml`](examples/gitlab/ocr-review.gitlab-ci.yml) pipeline, the [GitLab setup guide](docs/gitlab.md), and [GitLab review operations](docs/operations.md).
 
-The two-merge-request setup is recommended because repository Rules are loaded only from the captured target commit. On the default protected-target path, a supported one-merge-request alternative may add the Rules and CI job together when that integration merge request does not need review: its first run stops before OCR with a setup-pending note, retrying the same merge request cannot change the captured target Rules, and later merge requests work after it merges. An actually unprotected target with missing target Rules fails closed without promoting the source copy or promising setup-pending status. If the status identity is missing or mismatched, the toolkit likewise uses the generic fail-closed failure note. A green advisory job or pipeline does not prove that OCR or its model executed.
+The two-merge-request setup is recommended because repository Rules must already exist on the captured policy commit. For a protected target that is its own authority; for an unprotected target in `auto`, it is the protected default branch. The integration MR can add Rules and CI together when it need not be reviewed: its first run may stop with setup-pending, and later MRs work after the policy change merges. Retrying the same MR cannot promote its source Rules. An unprotected target in explicit `unprotected` mode with missing target Rules fails closed. A green advisory job or pipeline does not prove that OCR or its model executed. See the [GitLab setup guide](docs/gitlab.md#first-integration-sequence) for the exact boundary.
 
 ## Configuration and safety
 

{open_code_review_toolkit-0.12.0 → open_code_review_toolkit-0.13.0}/README.md

@@ -9,6 +9,8 @@
 
 Open Code Review Toolkit is an unofficial review control and integration layer for [Alibaba Open Code Review](https://github.com/alibaba/open-code-review), with GitLab CI and standalone local providers. It provides bounded repository evidence, a compact review bootstrap, a built-in read-only MCP server, environment-driven OCR configuration, preflight validation, local Markdown reports, and safe GitLab merge-request posting. It does **not** bundle or download the `ocr` binary.
 
+[Explore the toolkit site](https://open-code-review-toolkit.pages.dev/) for a quick overview, demo video, and latest release notes.
+
 > [!NOTE]
 > The project is under active development; the public API, CLI, environment contract, and generated schemas may evolve before 1.0.
 
@@ -62,7 +64,9 @@ commit without forge credentials:
 
 ```console
 ocr-ci preflight --local
-ocr-ci review --local --result review.json --stderr review.stderr --report review.md -- --commit HEAD
+review_dir=$(mktemp -d)
+review_dir=$(cd "$review_dir" && pwd -P)
+ocr-ci review --local --result "$review_dir/review.json" --stderr "$review_dir/review.stderr" --report "$review_dir/review.md" -- --commit HEAD
 ```
 
 Local execution uses the same OCR, mandatory evidence MCP, validation and DLP
@@ -86,13 +90,17 @@ On a successful rerun, the toolkit replaces untouched OCR-only notes instead of
 
 Suppression uses both the GitLab diff position and a stable finding fingerprint, so ordinary line shifts do not normally bring the same bug back. A materially changed finding can still receive a new discussion. See [GitLab review operations](docs/operations.md) for the complete lifecycle, posting modes, permissions, failure behavior, and Mermaid state diagram.
 
-After every current review note publishes, the GitLab adapter can add a conservative approval bound to receipt v9's exact reviewed source SHA, target SHA/protection state, merge-request author, DLP mode, and reconciled federation use. This write is enabled by default; set `OCR_AUTO_APPROVE=false` when the bot must remain comment-only. DLP-clean metadata, generic discussions, protected same-revision CI outcomes, unused governed services, and successful `review_read` tool use do not independently block approval. An unprotected target, disabled DLP, degraded metadata, a DLP rejection, required context degradation, admitted remediation history, legacy receipts, publication filtering, used advisory tools, uncertain federation accounting, author movement, or bot self-authorship prevents an approval write. A CI status is review context, never approval authority. GitLab approval rules, Code Owners, and protected-branch policy remain authoritative merge policy. They are not prerequisites for OCR execution. The toolkit only adds an eligible approval; it never removes an existing approval when a later review is ineligible or disabled.
+After every current review note publishes, the GitLab adapter can add a conservative approval bound to receipt v11's exact reviewed diff, actual target, policy authority, merge-request author, DLP mode, and reconciled federation use. This write is enabled by default; set `OCR_AUTO_APPROVE=false` when the bot must remain comment-only. DLP-clean metadata, generic discussions, protected same-revision CI outcomes, unused governed services, and successful `review_read` tool use do not independently block approval. An unprotected target, disabled DLP, degraded metadata, a DLP rejection, required context degradation, admitted remediation history, older receipts, publication filtering, used advisory tools, uncertain federation accounting, author movement, or bot self-authorship prevents an approval write. A CI status is review context, never approval authority. GitLab approval rules, Code Owners, and protected-branch policy remain authoritative merge policy. They are not prerequisites for OCR execution. The toolkit only adds an eligible approval; it never removes an existing approval when a later review is ineligible or disabled.
+
+An intentionally absent toolkit receipt retains compatible direct posting outside
+GitLab CI without automatic approval. A present v9/v10 receipt can be read for historical
+diagnostics, but cannot publish a new current MR review.
 
-Accepted tradeoffs can be recorded in `.opencodereview/accepted-decisions.md`; the evidence collector supplies only applicable target-ref decisions and never lets a source change self-authorize its review. Root and nested target `AGENTS.md`/`CLAUDE.md` guidance is similarly exposed through the existing evidence MCP with deterministic scope and precedence, while any guidance touched by the merge request is excluded. See [Accepted project decisions](docs/configuration.md#accepted-project-decisions) and [Target project guidance](docs/configuration.md#target-project-guidance) for formats and trust boundaries.
+Accepted tradeoffs can be recorded in `.opencodereview/accepted-decisions.md`; the evidence collector supplies only applicable decisions from the selected policy commit and never lets a source change self-authorize its review. Root and nested policy `AGENTS.md`/`CLAUDE.md` guidance is similarly exposed through the existing evidence MCP with deterministic scope and precedence, while any guidance touched by the merge request is excluded. See [Accepted project decisions](docs/configuration.md#accepted-project-decisions) and [Target project guidance](docs/configuration.md#target-project-guidance) for formats and trust boundaries.
 
 ## Project architecture
 
-The shipped Repository Evidence Engine reads immutable base/head Git objects, stores bounded typed facts and deltas, creates the compact bootstrap used by OCR, and exposes detailed facts, literal search, scoped absence checks, and base/head changes through the mandatory built-in read-only MCP server. That internal server is always present and cannot be removed or replaced by operator configuration. Protected-policy enriched reviews can also acquire stable GitLab discussions, verified remediation history, and protected same-revision CI outcomes before OCR. Optional external tools use the governed registry-v2 federation gateway: the toolkit freezes explicit allowlists, validates schemas, origins, DLP and budgets, and reconciles content-free usage receipts while OCR remains the only model loop. Local review permits explicit HTTPS or stdio upstreams; GitLab permits HTTPS only.
+The shipped Repository Evidence Engine reads immutable base/head Git objects, stores bounded typed facts and deltas, creates the compact bootstrap used by OCR, and exposes detailed facts, literal search, scoped absence checks, and base/head changes through the mandatory built-in read-only MCP server. GitLab reviews can also expose a bounded, separately labelled actual-target snapshot for relevant code context; it does not become policy or another reviewed delta. The internal server is always present and cannot be removed or replaced by operator configuration. Protected-policy enriched reviews can also acquire stable GitLab discussions, verified remediation history, and protected same-revision CI outcomes before OCR. Optional external tools use the governed registry-v2 federation gateway: the toolkit freezes explicit allowlists, validates schemas, origins, DLP and budgets, and reconciles content-free usage receipts while OCR remains the only model loop. Local review permits explicit HTTPS or stdio upstreams; GitLab permits HTTPS only.
 
 - [Toolkit strategy](docs/engineering/toolkit_strategy.md) - durable product boundaries, architecture, invariants, and non-goals.
 - [Bounded review context](docs/review-context.md) - protected policy, GitLab discussions and same-revision CI outcomes, legacy reference migration, opaque handles, DLP, receipt, and cleanup contracts.
@@ -103,21 +111,23 @@ The shipped Repository Evidence Engine reads immutable base/head Git objects, st
 
 1. Configure protected/masked `GITLAB_API_TOKEN` and LLM variables in GitLab.
 2. Pin and checksum the OCR binary.
-3. Keep `OCR_GITLAB_TARGET_PROTECTION_MODE=required` unless the project deliberately permits an unprotected target in limited, comment-only mode.
-4. Merge repository review configuration, including the Rules path, into the target branch.
+3. With toolkit 0.13.0, leave `OCR_GITLAB_TARGET_PROTECTION_MODE` unset to use its `auto` default for a single MR targeting an unprotected branch under the same project's protected default-branch policy. Select explicit `required` to reject unprotected targets, or `unprotected` for the earlier limited profile.
+4. Merge repository review configuration, including the Rules path, into the protected policy branch before relying on it.
 5. Enable the CI review job in a later merge request and install this package.
 6. Run the four public helper stages around `ocr review`:
 
 ```console
 ocr-ci preflight
 ocr-ci configure
-ocr-ci review --result /tmp/ocr-result.json --stderr /tmp/ocr-stderr.log -- ... --format json
-ocr-ci post --result /tmp/ocr-result.json --stderr /tmp/ocr-stderr.log
+review_result="/tmp/ocr-result-${CI_JOB_ID}.json"
+review_stderr="/tmp/ocr-stderr-${CI_JOB_ID}.log"
+ocr-ci review --result "$review_result" --stderr "$review_stderr" -- ... --format json || export OCR_EXIT_CODE=$?
+ocr-ci post --result "$review_result" --stderr "$review_stderr"
 ```
 
 See the [GitLab mode matrix](examples/gitlab/README.md), the complete [`ocr-review.gitlab-ci.yml`](examples/gitlab/ocr-review.gitlab-ci.yml) pipeline, the [GitLab setup guide](docs/gitlab.md), and [GitLab review operations](docs/operations.md).
 
-The two-merge-request setup is recommended because repository Rules are loaded only from the captured target commit. On the default protected-target path, a supported one-merge-request alternative may add the Rules and CI job together when that integration merge request does not need review: its first run stops before OCR with a setup-pending note, retrying the same merge request cannot change the captured target Rules, and later merge requests work after it merges. An actually unprotected target with missing target Rules fails closed without promoting the source copy or promising setup-pending status. If the status identity is missing or mismatched, the toolkit likewise uses the generic fail-closed failure note. A green advisory job or pipeline does not prove that OCR or its model executed.
+The two-merge-request setup is recommended because repository Rules must already exist on the captured policy commit. For a protected target that is its own authority; for an unprotected target in `auto`, it is the protected default branch. The integration MR can add Rules and CI together when it need not be reviewed: its first run may stop with setup-pending, and later MRs work after the policy change merges. Retrying the same MR cannot promote its source Rules. An unprotected target in explicit `unprotected` mode with missing target Rules fails closed. A green advisory job or pipeline does not prove that OCR or its model executed. See the [GitLab setup guide](docs/gitlab.md#first-integration-sequence) for the exact boundary.
 
 ## Configuration and safety
 

{open_code_review_toolkit-0.12.0 → open_code_review_toolkit-0.13.0}/pyproject.toml

@@ -27,6 +27,8 @@ dependencies = [
   "mcp>=2.2.0,<3",
   # MCP crypto accepts older PyJWT; enforce its security floor for resolver installs.
   "PyJWT>=2.15.0,<3",
+  # MCP accepts an OpenTelemetry API version with vulnerable tracestate parsing.
+  "opentelemetry-api>=1.45.1,<2",
   "jsonschema>=4.26.0,<5",
   "httpx2>=2.13.0,<3",
   "anyio>=4.10.0,<5",

{open_code_review_toolkit-0.12.0 → open_code_review_toolkit-0.13.0}/src/ocr_toolkit/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.12.0'
-__version_tuple__ = version_tuple = (0, 12, 0)
+__version__ = version = '0.13.0'
+__version_tuple__ = version_tuple = (0, 13, 0)
 
 __commit_id__ = commit_id = None

{open_code_review_toolkit-0.12.0 → open_code_review_toolkit-0.13.0}/src/ocr_toolkit/cli.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import argparse
+import os
 import sys
 from collections.abc import Sequence
 from pathlib import Path
@@ -93,6 +94,9 @@ def main(argv: Sequence[str] | None = None) -> int:
                 **({"report_path": Path(args.report)} if args.report is not None else {}),
                 **({"debug_dir": Path(args.debug_dir)} if args.debug_dir is not None else {}),
             )
+        except review_runner.ReviewRunnerNoHandoff as exc:
+            print(f"Cannot run Open Code Review: {exc}", file=sys.stderr)
+            return os.EX_TEMPFAIL
         except review_runner.ReviewRunnerError as exc:
             if not isinstance(exc, review_runner.ReviewRejected):
                 print(f"Cannot run Open Code Review: {exc}", file=sys.stderr)

{open_code_review_toolkit-0.12.0 → open_code_review_toolkit-0.13.0}/src/ocr_toolkit/common/redaction.py

@@ -147,9 +147,9 @@ def redact_env_secret_values(text: str) -> str:
 def redact_sensitive(text: str) -> str:
     """Replace known secret values from the process environment with `***`.
 
-    Used before publishing OCR-controlled text to the merge request, including
-    stderr excerpts from `OCR_POST_ERROR_DETAILS=1` and structured OCR JSON
-    fields. Performs two passes:
+    Used before publishing OCR-controlled text to the merge request and when
+    rendering bounded local diagnostics from structured OCR JSON fields.
+    Performs two passes:
 
     1. Replace each known env value (length >= 4). This is exact-match
        replacement over a small allowlist of secret-bearing environment

{open_code_review_toolkit-0.12.0 → open_code_review_toolkit-0.13.0}/src/ocr_toolkit/context/dlp.py

@@ -3,14 +3,20 @@
 from __future__ import annotations
 
 import html
+import ipaddress
 import re
 import unicodedata
 from collections.abc import Iterator, Mapping
 from contextlib import contextmanager
 from contextvars import ContextVar
 from dataclasses import dataclass
+from datetime import date
 
-from ocr_toolkit.common.redaction import redact_env_secret_values, redact_sensitive
+from ocr_toolkit.common.redaction import (
+    SENSITIVE_NAMED_KEY_PATTERN,
+    redact_env_secret_values,
+    redact_sensitive,
+)
 from ocr_toolkit.context.contracts import TextBudgets
 
 EMAIL_RE = re.compile(
@@ -18,6 +24,20 @@ EMAIL_RE = re.compile(
     r"@(?:[a-z0-9-]{1,63}\.)+[a-z]{2,63}(?![a-z0-9_-])"
 )
 PHONE_RE = re.compile(r"(?<!\w)(?:\+?[1-9][\d .()/-]{7,24}\d)(?!\w)")
+PURE_CREDENTIAL_ASSIGNMENT_RE = re.compile(
+    rf"(?im)^[ \t]*{SENSITIVE_NAMED_KEY_PATTERN}[ \t]*:[ \t]*"
+    r"(?:(?P<quote>['\"])\{\{[ \t]*[A-Za-z_][A-Za-z0-9_]*[ \t]*\}\}(?P=quote)|"
+    r"(?P<empty>\"\"|''))[ \t]*$"
+)
+ISO_DATE_RE = re.compile(r"(?P<year>\d{4})-(?P<month>\d{2})-(?P<day>\d{2})")
+VERSION_CONTEXT_RE = re.compile(r"(?i)\b(?:version|release|build|pin)[ \t]+(?:v)?$")
+DATE_CONTEXT_RE = re.compile(
+    r"(?i)\b(?:date|dated|on|since|until|before|after|expires)(?:[ \t]+on)?[ \t]+$"
+)
+IP_CONTEXT_RE = re.compile(
+    r"(?i)(?:\b|_)(?:ipv4|ip|cidr|subnet|address|host|loginhost|listen|allow|network)\b"
+)
+PHONE_CONTEXT_RE = re.compile(r"(?i)\b(?:call|phone|tel|contact)[ \t]*$")
 MARKDOWN_DEST_RE = re.compile(
     r"(?:\]\(\s*<?(?:https?://|mailto:)|^\s*\[[^\]\n]+\]:\s*<?(?:https?://|mailto:)|"
     r"<(?:https?://|mailto:))",
@@ -95,11 +115,59 @@ def _contains_phone(value: str) -> bool:
     """Recognize formatted phone-like values without classifying bare identifiers."""
 
     return any(
-        match.group(0).startswith("+") or any(separator in match.group(0) for separator in " .()/-")
+        (
+            match.group(0).startswith("+")
+            or any(separator in match.group(0) for separator in " .()/-")
+        )
+        and not _technical_number(value, match)
         for match in PHONE_RE.finditer(value)
     )
 
 
+def _technical_number(value: str, match: re.Match[str]) -> bool:
+    """Exclude only bounded, parsed technical syntax from phone candidates."""
+
+    candidate = match.group(0)
+    if candidate.startswith("+") or candidate != candidate.strip():
+        return False
+    before, after = value[: match.start()], value[match.end() :]
+    if before.endswith((".", "/", "-")) or re.match(r"(?:[./-]\d)", after):
+        return False
+    if PHONE_CONTEXT_RE.search(before[-24:]):
+        return False
+    try:
+        if "/" in candidate:
+            ipaddress.IPv4Network(candidate, strict=False)
+            return True
+        elif isinstance(ipaddress.ip_address(candidate), ipaddress.IPv4Address):
+            if after.startswith(":"):
+                port = re.match(r":(\d{1,5})\b", after)
+                return bool(port and 1 <= int(port[1]) <= 65535)
+            return bool(IP_CONTEXT_RE.search(before[-96:]))
+    except ValueError:
+        pass
+    if ISO_DATE_RE.fullmatch(candidate) and DATE_CONTEXT_RE.search(before[-32:]):
+        try:
+            date(int(candidate[:4]), int(candidate[5:7]), int(candidate[8:10]))
+        except ValueError:
+            return False
+        return True
+    if re.fullmatch(r"\d{4}\.\d{1,2}\.\d{1,3}", candidate):
+        return bool(VERSION_CONTEXT_RE.search(before[-32:]))
+    if re.fullmatch(r"\d+\.\d+", candidate):
+        return bool(
+            re.search(r"(?i)\bdecimal\([ \t]*['\"]$", before[-32:])
+            and re.match(r"['\"][ \t]*\)", after)
+        )
+    return False
+
+
+def _semantic_secret_text(value: str) -> str:
+    """Remove proven no-value assignments only from generic secret classification."""
+
+    return PURE_CREDENTIAL_ASSIGNMENT_RE.sub("safe_reference_assignment", value)
+
+
 def _display_normalize(value: str) -> str:
     """Approximate closed text rendered by common Markdown/HTML constructs."""
 
@@ -235,6 +303,7 @@ def check_text(
     forbidden: tuple[str | ForbiddenValue, ...] = (),
     forbidden_matcher: ForbiddenMatcher | None = None,
     allow_horizontal_tabs: bool = False,
+    allow_opaque_code: bool = False,
     enabled: bool | None = None,
 ) -> DLPResult:
     """Apply independent units, redaction, PII, and optional publication checks."""
@@ -258,15 +327,26 @@ def check_text(
         return DLPResult(False, None, "limit", detector)
     if not (_DLP_ENABLED.get() if enabled is None else enabled):
         return DLPResult(True, normalized, "disabled")
-    redacted = redact_env_secret_values(redact_sensitive(normalized))
-    if redacted != normalized:
+    # Exact environment values retain priority even when they resemble a reference.
+    if redact_env_secret_values(normalized) != normalized:
+        return DLPResult(False, None, "secret", "normalized")
+    semantic = _semantic_secret_text(normalized)
+    if redact_sensitive(semantic) != semantic:
         return DLPResult(False, None, "secret", "normalized")
     decoded = _html_decode(normalized) if publication else normalized
     displayed = _display_normalize(normalized) if publication else normalized
     source = _source_normalize(normalized) if publication else normalized
-    if publication and redact_env_secret_values(redact_sensitive(displayed)) != displayed:
+    semantic_displayed = _display_normalize(semantic) if publication else semantic
+    semantic_source = _source_normalize(semantic) if publication else semantic
+    if publication and (
+        redact_env_secret_values(displayed) != displayed
+        or redact_sensitive(semantic_displayed) != semantic_displayed
+    ):
         return DLPResult(False, None, "secret", "displayed")
-    if publication and redact_env_secret_values(redact_sensitive(source)) != source:
+    if publication and (
+        redact_env_secret_values(source) != source
+        or redact_sensitive(semantic_source) != semantic_source
+    ):
         return DLPResult(False, None, "secret", "source")
     pii_candidates = (("normalized", normalized),)
     if publication:
@@ -289,7 +369,7 @@ def check_text(
             else "html_comment"
             if HTML_COMMENT_RE.search(decoded)
             else "html_tag"
-            if HTML_TAG_RE.search(decoded)
+            if HTML_TAG_RE.search(decoded) and not (allow_opaque_code and decoded == normalized)
             else "display_control"
             if any(_is_display_control(character) for character in decoded)
             else None

{open_code_review_toolkit-0.12.0 → open_code_review_toolkit-0.13.0}/src/ocr_toolkit/evidence/artifacts.py

@@ -4,7 +4,10 @@ from __future__ import annotations
 
 import os
 import stat
+from collections.abc import Iterator
+from contextlib import contextmanager
 from dataclasses import dataclass
+from fcntl import LOCK_EX, LOCK_NB, flock
 from pathlib import Path
 
 
@@ -18,6 +21,7 @@ class EvidenceArtifacts:
     policy_rules: Path
     context_store: Path
     pre_execution_status: Path
+    review_run_lock: Path
     action_receipt: Path
     action_receipt_lock: Path
     dlp_decisions: Path
@@ -35,6 +39,7 @@ def repository_artifacts(root: Path | None = None) -> EvidenceArtifacts:
         policy_rules=directory / "policy-rules.json",
         context_store=directory / "context.json",
         pre_execution_status=directory / "pre-execution-status.json",
+        review_run_lock=directory / ".review-run.lock",
         action_receipt=directory / "evidence-actions.json",
         action_receipt_lock=directory / ".evidence-actions.json.lock",
         dlp_decisions=directory / "private-dlp-decisions.json",
@@ -48,10 +53,92 @@ def prepare_artifact_directory(artifacts: EvidenceArtifacts) -> None:
     if directory.is_symlink():
         raise OSError(f"refusing private artifact directory symlink: {directory}")
     directory.mkdir(mode=0o700, parents=False, exist_ok=True)
-    metadata = directory.stat(follow_symlinks=False)
-    if not stat.S_ISDIR(metadata.st_mode):
-        raise OSError(f"private artifact path is not a directory: {directory}")
-    directory.chmod(0o700)
+    descriptor = os.open(
+        directory,
+        os.O_RDONLY | getattr(os, "O_DIRECTORY", 0) | getattr(os, "O_NOFOLLOW", 0),
+    )
+    try:
+        metadata = os.fstat(descriptor)
+        named = directory.stat(follow_symlinks=False)
+        if (
+            not stat.S_ISDIR(metadata.st_mode)
+            or metadata.st_uid != os.getuid()
+            or (metadata.st_dev, metadata.st_ino) != (named.st_dev, named.st_ino)
+        ):
+            raise OSError(f"private artifact path is not a safe directory: {directory}")
+        os.fchmod(descriptor, 0o700)
+        named = directory.stat(follow_symlinks=False)
+        if (metadata.st_dev, metadata.st_ino) != (named.st_dev, named.st_ino):
+            raise OSError(f"private artifact directory changed during setup: {directory}")
+    finally:
+        os.close(descriptor)
+
+
+class ReviewRunBusy(OSError):
+    """Another review owns the fixed private artifacts for this repository."""
+
+
+@contextmanager
+def locked_review_run(artifacts: EvidenceArtifacts) -> Iterator[None]:
+    """Hold one stable private lock across a review's entire artifact lifetime."""
+
+    prepare_artifact_directory(artifacts)
+    directory = -1
+    descriptor = -1
+    try:
+        directory = os.open(
+            artifacts.directory,
+            os.O_RDONLY | getattr(os, "O_DIRECTORY", 0) | getattr(os, "O_NOFOLLOW", 0),
+        )
+        directory_stat = os.fstat(directory)
+        named_directory = artifacts.directory.stat(follow_symlinks=False)
+        if (
+            not stat.S_ISDIR(directory_stat.st_mode)
+            or directory_stat.st_uid != os.getuid()
+            or (directory_stat.st_dev, directory_stat.st_ino)
+            != (named_directory.st_dev, named_directory.st_ino)
+            or stat.S_IMODE(directory_stat.st_mode) & 0o077
+        ):
+            raise OSError("private review lock directory is unsafe")
+        descriptor = os.open(
+            artifacts.review_run_lock.name,
+            os.O_CREAT | os.O_RDWR | getattr(os, "O_NOFOLLOW", 0) | getattr(os, "O_NONBLOCK", 0),
+            0o600,
+            dir_fd=directory,
+        )
+        opened = os.fstat(descriptor)
+        named = os.stat(
+            artifacts.review_run_lock.name,
+            dir_fd=directory,
+            follow_symlinks=False,
+        )
+        if (
+            not stat.S_ISREG(opened.st_mode)
+            or opened.st_uid != os.getuid()
+            or opened.st_nlink != 1
+            or stat.S_IMODE(opened.st_mode) & 0o077
+            or (opened.st_dev, opened.st_ino) != (named.st_dev, named.st_ino)
+        ):
+            raise OSError("private review lock file is unsafe")
+        try:
+            flock(descriptor, LOCK_EX | LOCK_NB)
+        except BlockingIOError as exc:
+            raise ReviewRunBusy("another review is already running in this repository") from exc
+        named = os.stat(
+            artifacts.review_run_lock.name,
+            dir_fd=directory,
+            follow_symlinks=False,
+        )
+        if (opened.st_dev, opened.st_ino) != (named.st_dev, named.st_ino):
+            raise OSError("private review lock file changed during acquisition")
+        # Keep the named inode across runs; unlinking it would let a second
+        # review lock a replacement while this review still holds the old one.
+        yield
+    finally:
+        if descriptor >= 0:
+            os.close(descriptor)
+        if directory >= 0:
+            os.close(directory)
 
 
 def write_private_bytes(path: Path, content: bytes) -> None: