open-code-review-toolkit 0.9.0__tar.gz → 0.9.1__tar.gz

{open_code_review_toolkit-0.9.0 → open_code_review_toolkit-0.9.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: open-code-review-toolkit
-Version: 0.9.0
+Version: 0.9.1
 Summary: Unofficial GitLab CI integration layer for Open Code Review
 Project-URL: Homepage, https://github.com/xeonvs/open-code-review-toolkit
 Project-URL: Repository, https://github.com/xeonvs/open-code-review-toolkit
@@ -257,13 +257,12 @@ python -m venv .venv
 python -m pip install open-code-review-toolkit
 ```
 
-The toolkit does not bundle OCR. Download the platform asset for exact
-[Open Code Review 1.11.3](https://github.com/alibaba/open-code-review/releases/tag/v1.11.3),
-verify it before installation against the [compatibility manifest](compatibility/ocr-support.json),
-and place the verified binary on `PATH`. The current Linux amd64 digest is
-`9726204ac81baee153fd65b1ff357c380f73e9d8091c4a73c3c9fb541b5164cb`; Darwin arm64 is
-`515cd92ce300b62dea2bcaf53e910cdf57b681e1d58bbd0a9e8e49617bca52fa`. The manifest owns
-the other platform hashes.
+The toolkit does not bundle OCR. Use `recommended_version` in the
+[compatibility manifest](compatibility/ocr-support.json) for this toolkit revision
+to select the exact [upstream release](https://github.com/alibaba/open-code-review/releases).
+Download its platform asset, verify it against that release entry's asset SHA-256,
+and place the verified binary on `PATH`. Do not substitute the latest upstream
+release or use another toolkit revision's manifest.
 
 Verify the installation without contacting an LLM provider:
 
@@ -272,14 +271,14 @@ ocr --version
 ocr-ci --help
 ```
 
-`ocr --version` must report `open-code-review v1.11.3`; `ocr-ci --help` must exit
+`ocr --version` must report the manifest's exact `recommended_version`; `ocr-ci --help` must exit
 successfully. `ocr-ci preflight` is an operational configuration check, not the installation
 smoke test.
 
 The exact recommended OCR release and its verified asset checksums live in the [versioned compatibility manifest](compatibility/ocr-support.json). CI should pin that release and checksum before execution.
 The [versioned compatibility policy](docs/compatibility.md) records tested assets and evidence and describes the conservative Dependabot-like qualification workflow for later upstream releases.
 Review output defaults to English. `OCR_REVIEW_LANGUAGE` accepts another explicit language name when a project needs localized review output; for example, `OCR_REVIEW_LANGUAGE=Russian`.
-The current OCR 1.11.3 integration defaults `OCR_REVIEW_EFFORT` to `medium` for two review rounds. `low` and `high` are explicit one- and three-round alternatives; see the [configuration reference](docs/configuration.md#review-effort) for cost, budget, and precedence boundaries.
+The toolkit defaults `OCR_REVIEW_EFFORT` to `medium` for two review rounds. `low` and `high` are explicit one- and three-round alternatives; see the [configuration reference](docs/configuration.md#review-effort) for cost, budget, and precedence boundaries.
 
 Stable distributions are published to [PyPI](https://pypi.org/project/open-code-review-toolkit/) and mirrored as checksum-listed, provenance-attested assets in the corresponding [GitHub Release](https://github.com/xeonvs/open-code-review-toolkit/releases). Development snapshots are published only to TestPyPI.
 

{open_code_review_toolkit-0.9.0 → open_code_review_toolkit-0.9.1}/README.md

@@ -30,13 +30,12 @@ python -m venv .venv
 python -m pip install open-code-review-toolkit
 ```
 
-The toolkit does not bundle OCR. Download the platform asset for exact
-[Open Code Review 1.11.3](https://github.com/alibaba/open-code-review/releases/tag/v1.11.3),
-verify it before installation against the [compatibility manifest](compatibility/ocr-support.json),
-and place the verified binary on `PATH`. The current Linux amd64 digest is
-`9726204ac81baee153fd65b1ff357c380f73e9d8091c4a73c3c9fb541b5164cb`; Darwin arm64 is
-`515cd92ce300b62dea2bcaf53e910cdf57b681e1d58bbd0a9e8e49617bca52fa`. The manifest owns
-the other platform hashes.
+The toolkit does not bundle OCR. Use `recommended_version` in the
+[compatibility manifest](compatibility/ocr-support.json) for this toolkit revision
+to select the exact [upstream release](https://github.com/alibaba/open-code-review/releases).
+Download its platform asset, verify it against that release entry's asset SHA-256,
+and place the verified binary on `PATH`. Do not substitute the latest upstream
+release or use another toolkit revision's manifest.
 
 Verify the installation without contacting an LLM provider:
 
@@ -45,14 +44,14 @@ ocr --version
 ocr-ci --help
 ```
 
-`ocr --version` must report `open-code-review v1.11.3`; `ocr-ci --help` must exit
+`ocr --version` must report the manifest's exact `recommended_version`; `ocr-ci --help` must exit
 successfully. `ocr-ci preflight` is an operational configuration check, not the installation
 smoke test.
 
 The exact recommended OCR release and its verified asset checksums live in the [versioned compatibility manifest](compatibility/ocr-support.json). CI should pin that release and checksum before execution.
 The [versioned compatibility policy](docs/compatibility.md) records tested assets and evidence and describes the conservative Dependabot-like qualification workflow for later upstream releases.
 Review output defaults to English. `OCR_REVIEW_LANGUAGE` accepts another explicit language name when a project needs localized review output; for example, `OCR_REVIEW_LANGUAGE=Russian`.
-The current OCR 1.11.3 integration defaults `OCR_REVIEW_EFFORT` to `medium` for two review rounds. `low` and `high` are explicit one- and three-round alternatives; see the [configuration reference](docs/configuration.md#review-effort) for cost, budget, and precedence boundaries.
+The toolkit defaults `OCR_REVIEW_EFFORT` to `medium` for two review rounds. `low` and `high` are explicit one- and three-round alternatives; see the [configuration reference](docs/configuration.md#review-effort) for cost, budget, and precedence boundaries.
 
 Stable distributions are published to [PyPI](https://pypi.org/project/open-code-review-toolkit/) and mirrored as checksum-listed, provenance-attested assets in the corresponding [GitHub Release](https://github.com/xeonvs/open-code-review-toolkit/releases). Development snapshots are published only to TestPyPI.
 

{open_code_review_toolkit-0.9.0 → open_code_review_toolkit-0.9.1}/src/ocr_toolkit/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.9.0'
-__version_tuple__ = version_tuple = (0, 9, 0)
+__version__ = version = '0.9.1'
+__version_tuple__ = version_tuple = (0, 9, 1)
 
 __commit_id__ = commit_id = None

{open_code_review_toolkit-0.9.0 → open_code_review_toolkit-0.9.1}/src/ocr_toolkit/preflight.py

@@ -28,7 +28,7 @@ DEFAULT_REQUEST_HEADERS = {
     "Accept": "application/json",
     "User-Agent": "open-code-review-ci-preflight/1.0",
 }
-EXPECTED_OCR_VERSION = "1.11.3"
+EXPECTED_OCR_VERSION = "1.11.5"
 
 
 class PreflightError(Exception):

{open_code_review_toolkit-0.9.0 → open_code_review_toolkit-0.9.1}/src/ocr_toolkit/review_runner.py

@@ -184,6 +184,8 @@ MAX_TOOL_FAILURE_DETAILS_LOGGED = 20
 MAX_TOOL_FAILURE_NAME_CHARS = 256
 MAX_TOOL_FAILURE_PATH_CHARS = 4_096
 MAX_TOOL_FAILURE_ERROR_CHARS = 32_768
+MAX_TOOL_FAILURE_ARGUMENT_CHARS = 32_768
+MAX_TOOL_FAILURE_ARGUMENT_BYTES = 131_072
 MAX_TOOL_FAILURE_LOG_FIELD_CHARS = 500
 
 
@@ -900,6 +902,17 @@ def _safe_publication_warnings(
     return retained, len(value) - len(retained)
 
 
+def _bounded_tool_failure_arguments(value: object) -> bool:
+    """Validate opaque private arguments without retaining or interpreting their content."""
+
+    if not isinstance(value, str) or len(value) > MAX_TOOL_FAILURE_ARGUMENT_CHARS:
+        return False
+    try:
+        return len(value.encode("utf-8")) <= MAX_TOOL_FAILURE_ARGUMENT_BYTES
+    except UnicodeEncodeError:
+        return False
+
+
 def _tool_failure_telemetry(value: object) -> ToolFailureTelemetry:
     """Parse additive OCR diagnostics without granting them result authority."""
 
@@ -954,8 +967,12 @@ def _tool_failure_telemetry(value: object) -> ToolFailureTelemetry:
         if not isinstance(detail, dict) or set(detail) not in (
             {"tool_call_number", "tool_name", "error"},
             {"tool_call_number", "tool_name", "file_path", "error"},
+            {"tool_call_number", "tool_name", "arguments", "error"},
+            {"tool_call_number", "tool_name", "file_path", "arguments", "error"},
         ):
             return ToolFailureTelemetry(True, False, None, {}, ())
+        if "arguments" in detail and not _bounded_tool_failure_arguments(detail["arguments"]):
+            return ToolFailureTelemetry(True, False, None, {}, ())
         number = detail.get("tool_call_number")
         name = detail.get("tool_name")
         error = detail.get("error")