feat(mcp-server): review 体系告别 plan 模式 — yolo+写工具物理禁用 + zcode_security_review (mimosa 预扫) - #9
Merged
Merged
Conversation
…ity_review - zcode_review: --mode plan → --mode yolo + --disallowed-tools 全量写/执行 黑名单 (含 js/mcp__node_repl__js* 一族, 防 execSync 打穿) + --json 结构化 输出; prompt 内置只审不修约束; 超时 env ZCODE_BRIDGE_REVIEW_TIMEOUT (默认 300s) - 新增 zcode_security_review: mimosa 规则引擎快扫 (零 LLM) → 回读 findings.json 投影 → --attach 喂 zcode 逐条只读复核 - mimosa 独立调用: 自带极简 stdio MCP client 直 spawn server.js, 不依赖 zcode 插件体系; ZCODE_BRIDGE_MIMOSA_ROOT/TIMEOUT 可配 - agent-help 勘误 (0.16.1 实测): --allowed-tools/--max-turns 未注册 parseArgs; auto 模式保留未实现; headless build/edit 写操作直接失败非等授权; --disallowed-tools 确认为工具集级物理移除
只读护栏命令构造/prompt 约束/--json response 提取/mimosa root 探测/ MimosaMcpClient 假 server 握手/scanDir 回读 findings/投影/管线端到端 mock
- P1-1: scanDir 视为不可信输入, 校验落在扫描历史根 (ZCODE_BRIDGE_MIMOSA_SCAN_ROOT, 默认 ~/.mimosa/security-scans) 之下才回读 findings.json, 越界降级仅用摘要 - P1-2: _recv 的 JSONDecodeError 转带上下文的 RuntimeError (前80字符), 不吞根因 - P2-1: mimosa 多版本选择改版本号数值排序 (防 1.10.0 < 1.9.0) - P2-3: 黑名单断言补全 (MultiEdit/js_reset/js_add_node_module_dir/repl 一族) - P2-8: scan_path 存在性校验前置, 错误信息明确 - P2-4/5/6: README 补并发与阻塞边界说明 + 修正'完全只读'措辞 - 存疑-1 (GC-8G 安全 review): _write_temp 权限评估注释 (POSIX 0600 已足够) - P2-2 (posix-only) / P2-7 (exec 加载测试) 为预先存在的模式, 不在本 PR 处理
- P1-A: findings.json resolve 后也须落在扫描历史根下 (防合法目录+symlink 绕过) - P1-B: 补 symlink 绕过测试用例 (test_ms2c) - P2-4: test_sr1 复用 fixture 目录; P2-1: 版本排序局限注释 - P2-2 (TOCTOU)/P2-3 (日志上下文) 复审自评可接受现状, 不改
This was referenced Aug 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
动机
review 体系原用
--mode plan求只读，但 plan 只禁「改文件」：读探索/子代理照样放行（限流与 120s 超时的主因），且 plan→build 的规划惯性容易让 review 变成「边审边修」，与「只出报告」的本意不符。改动
zcode_review重构（告别 plan）--mode yolo（全程免授权）+--disallowed-tools全量写/执行黑名单（Write Edit MultiEdit ApplyPatch Bash+ Node REPL 一族js/mcp__node_repl__js*——必须同禁，否则 execSync 可打穿 Bash 黑名单，0.16.1 实测复现）--disallowed-tools是工具集级物理移除、先于权限层，yolo 也绕不过；读工具（Read/Grep/Glob）全开，不影响审查能力--json提取response；单次超时 envZCODE_BRIDGE_REVIEW_TIMEOUT（默认 300s）可配新增
zcode_security_review（安全专项两阶段管线）--attach喂 zcode 逐条核实（确认/误报/存疑 + 攻击路径 + 修复建议），可发现清单外问题ZCODE_BRIDGE_MIMOSA_ROOT/_TIMEOUT/_SCAN_ROOT可配agent-help 勘误（0.16.1 逆向 + headless 实测）
--allowed-tools/--max-turns帮助文案有但未注册 parseArgs（Unknown option），勿用auto模式保留未实现（setMode 切 auto 全拒工具调用）No permission client configured失败，不是等授权狗食验证（本 PR 由新 review 模式自审）
zcode_review审 PR diff：0 P0 / 2 P1 / 8 P2 → 全部修复或记录（commitd1047ae）zcode_security_review全仓安全专项：mimosa 0 findings + zcode 逐文件复核确认 0 漏洞，2 存疑项已评估/加固8b56992）zcode_review冒烟 51.2stest_security_review.py24 用例；全量 9 个测试文件全绿；ruff 通过不处理项（记录）
fcntl/select）与 P2-7（测试 exec 加载模式）为预先存在的模式，不在本 PR