多AgentCodeReview流水线：交叉审查机制实战

Agent A 写的代码 ──→ Agent B 审查（功能视角）
Agent B 写的代码 ──→ Agent C 审查（安全视角）
Agent C 写的代码 ──→ Agent A 审查（架构视角）

                    ┌─────────────────────────────────────┐
                    │         Code Review Orchestrator     │
                    │         (Hermes Scheduler)           │
                    └──────────────┬──────────────────────┘
                                   │
                  ┌────────────────┼────────────────┐
                  ▼                ▼                ▼
        ┌─────────────────┐ ┌─────────────┐ ┌─────────────────┐
        │   Agent A       │ │  Agent B    │ │   Agent C       │
        │   Hermes        │ │  Claude     │ │   Codex         │
        │   架构审查      │ │  Code       │ │   安全审查      │
        │                 │ │  功能审查    │ │                 │
        │  • 设计模式     │ │  • 逻辑正确  │ │  • SQL 注入     │
        │  • 代码规范     │ │  • 边界条件  │ │  • XSS          │
        │  • 可维护性     │ │  • 错误处理  │ │  • 认证授权     │
        │  • 性能考量     │ │  • 单元测试  │ │  • 数据泄露     │
        │  • 依赖管理     │ │  • API 契约  │ │  • 配置安全     │
        └────────┬────────┘ └──────┬──────┘ └────────┬────────┘
                 │                 │                  │
                 ▼                 ▼                  ▼
        ┌─────────────────────────────────────────────────────┐
        │              Review Aggregator                       │
        │              (审查结果聚合与冲突解决)                  │
        └─────────────────────────┬───────────────────────────┘
                                  │
                                  ▼
                    ┌─────────────────────────────┐
                    │     Final Review Report     │
                    │     (PR 评论 + 人工确认)     │
                    └─────────────────────────────┘

# cross-review-trigger.yaml
review_pipeline:
  trigger:
    - event: pull_request_opened
    - event: pull_request_updated
    - event: manual_review_requested

  routing:
    # 根据代码路径路由到不同 Agent
    rules:
      - path: "backend/src/routes/**"
        reviewers: ["agent-b", "agent-c"]  # 功能 + 安全

      - path: "backend/src/middleware/**"
        reviewers: ["agent-a", "agent-c"]  # 架构 + 安全

      - path: "frontend/src/components/**"
        reviewers: ["agent-a", "agent-b"]  # 架构 + 功能

      - path: "**/auth/**"
        reviewers: ["agent-c"]  # 仅安全审查（最高优先级）

      - path: "**/config/**"
        reviewers: ["agent-c"]  # 配置安全审查

  parallel_execution: true  # 多个 Agent 并行审查
  timeout_per_reviewer: 300s  # 每个 Agent 最多 5 分钟

{
  "agent_id": "agent-a",
  "name": "Hermes Architecture Reviewer",
  "model": "hermes-3",
  "role": "architecture_reviewer",
  "system_prompt": "你是一位拥有 15 年经验的首席架构师，专注于代码架构和设计模式审查。\n\n你的审查职责：\n1. **设计模式**：检查代码是否使用了合适的设计模式，避免反模式\n2. **代码规范**：确保代码符合团队编码规范（命名、注释、结构）\n3. **可维护性**：评估代码的可读性、可测试性和可扩展性\n4. **性能考量**：识别潜在的性能瓶颈和优化机会\n5. **依赖管理**：检查依赖引入是否合理，避免过度依赖\n\n审查标准：\n- CRITICAL: 架构缺陷会导致系统不稳定或难以维护\n- WARNING: 代码规范违反或潜在的性能问题\n- SUGGESTION: 可改进但非必须的设计优化\n\n输出格式：\n1. 总体评价（1-5分）\n2. 关键发现（按严重程度排序）\n3. 具体修改建议（包含代码示例）\n4. 是否建议合并（YES/NO/NEEDS_DISCUSSION）",
  "review_config": {
    "max_files_per_review": 15,
    "focus_areas": ["architecture", "design_patterns", "code_style", "performance"],
    "output_format": "structured_json",
    "include_code_suggestions": true
  }
}

{
  "reviewer": "agent-a (Hermes)",
  "target": "agent-b 编写的 user-service.ts",
  "score": 3,
  "verdict": "NEEDS_DISCUSSION",
  "findings": [
    {
      "severity": "CRITICAL",
      "category": "architecture",
      "file": "backend/src/services/user-service.ts",
      "line": 42,
      "issue": "Service 层直接操作数据库连接池，违反了分层架构原则",
      "suggestion": "应该引入 Repository 层来封装数据库操作：\n\n```typescript\n// ❌ 当前实现\nconst result = await db.query('SELECT * FROM users WHERE id = ?', [id]);\n\n// ✅ 推荐实现\nconst userRepository = new UserRepository(db);\nconst user = await userRepository.findById(id);\n```"
    },
    {
      "severity": "WARNING",
      "category": "performance",
      "file": "backend/src/services/user-service.ts",
      "line": 78,
      "issue": "在循环中执行数据库查询（N+1 问题）",
      "suggestion": "使用批量查询替代循环查询：\n\n```typescript\n// ❌ N+1 查询\nfor (const userId of userIds) {\n  const user = await userRepository.findById(userId);\n}\n\n// ✅ 批量查询\nconst users = await userRepository.findByIds(userIds);\n```"
    },
    {
      "severity": "SUGGESTION",
      "category": "design_patterns",
      "file": "backend/src/services/user-service.ts",
      "line": 15,
      "issue": "UserService 承担了过多职责（用户管理 + 权限检查 + 日志记录）",
      "suggestion": "考虑使用装饰器模式分离关注点：\n\n```typescript\n@Logging\n@Authorization\nclass UserService {\n  // 核心业务逻辑\n}\n```"
    }
  ],
  "summary": "代码整体结构合理，但存在架构层面的问题需要讨论。Service 层职责过重且直接与数据库交互，建议引入 Repository 层并采用装饰器模式分离横切关注点。"
}

{
  "agent_id": "agent-b",
  "name": "Claude Code Functional Reviewer",
  "model": "claude-sonnet-4-20250514",
  "role": "functional_reviewer",
  "system_prompt": "你是一位资深的高级开发工程师，专注于代码功能正确性和边界条件审查。\n\n你的审查职责：\n1. **逻辑正确性**：验证业务逻辑是否正确实现需求\n2. **边界条件**：检查边界值、空值、异常输入的处理\n3. **错误处理**：确保所有可能的错误路径都有适当的处理\n4. **单元测试**：评估测试覆盖率和测试用例的完整性\n5. **API 契约**：验证 API 的输入输出是否符合契约\n\n审查标准：\n- CRITICAL: 逻辑错误会导致功能异常或数据不一致\n- WARNING: 边界条件未处理或错误处理不完善\n- SUGGESTION: 测试覆盖不足或代码可读性可改进\n\n特别注意：\n- 检查所有 async/await 是否有错误捕获\n- 验证分页、排序、过滤参数的边界处理\n- 确保数据转换和类型校验的完整性",
  "review_config": {
    "max_files_per_review": 20,
    "focus_areas": ["logic_correctness", "edge_cases", "error_handling", "test_coverage"],
    "output_format": "structured_json",
    "generate_test_cases": true
  }
}

{
  "reviewer": "agent-b (Claude Code)",
  "target": "agent-c 编写的 auth-middleware.ts",
  "score": 4,
  "verdict": "YES",
  "findings": [
    {
      "severity": "CRITICAL",
      "category": "error_handling",
      "file": "backend/src/middleware/auth-middleware.ts",
      "line": 33,
      "issue": "JWT 验证失败时未清除用户上下文，可能导致脏数据",
      "suggestion": "在验证失败时清除上下文：\n\n```typescript\ntry {\n  const decoded = verifyToken(token);\n  req.user = decoded;\n  next();\n} catch (err) {\n  // ✅ 清除可能存在的脏数据\n  delete req.user;\n  res.status(401).json({ error: 'Invalid token' });\n}\n```"
    },
    {
      "severity": "WARNING",
      "category": "edge_cases",
      "file": "backend/src/middleware/auth-middleware.ts",
      "line": 18,
      "issue": "未处理 token 过期但 refresh token 有效的情况",
      "suggestion": "添加 token 刷新逻辑：\n\n```typescript\nif (isTokenExpired(decoded)) {\n  const refreshToken = req.headers['x-refresh-token'];\n  if (refreshToken && isValidRefreshToken(refreshToken)) {\n    const newToken = generateToken(decoded.userId);\n    res.setHeader('X-New-Token', newToken);\n    req.user = decoded;\n    return next();\n  }\n  return res.status(401).json({ error: 'Token expired' });\n}\n```"
    },
    {
      "severity": "SUGGESTION",
      "category": "test_coverage",
      "file": "tests/middleware/auth.test.ts",
      "issue": "缺少对并发请求下 token 刷新的测试",
      "suggestion": "添加并发场景测试：\n\n```typescript\nit('should handle concurrent requests with token refresh', async () => {\n  const requests = Array(10).fill(null).map(() =>\n    request(app)\n      .get('/api/protected')\n      .set('Authorization', `Bearer ${expiredToken}`)\n      .set('X-Refresh-Token', validRefreshToken)\n  );\n\n  const responses = await Promise.all(requests);\n  expect(responses.every(r => r.status === 200)).toBe(true);\n});\n```"
    }
  ],
  "suggested_tests": [
    {
      "name": "test_expired_token_with_valid_refresh",
      "description": "验证过期 token 配合有效 refresh token 的处理",
      "code": "it('should refresh expired token...', async () => {...})"
    },
    {
      "name": "test_concurrent_requests_token_refresh",
      "description": "验证并发请求下的 token 刷新行为",
      "code": "it('should handle concurrent...', async () => {...})"
    }
  ],
  "summary": "认证中间件实现整体良好，JWT 验证和权限检查逻辑正确。主要问题是错误处理中缺少上下文清理和 token 刷新支持。建议补充并发场景测试。"
}

{
  "agent_id": "agent-c",
  "name": "Codex Security Reviewer",
  "model": "o4-mini",
  "role": "security_reviewer",
  "system_prompt": "你是一位专业的安全工程师，专注于代码安全漏洞审查。\n\n你的审查职责：\n1. **注入攻击**：SQL 注入、NoSQL 注入、命令注入、LDAP 注入\n2. **跨站脚本（XSS）**：反射型 XSS、存储型 XSS、DOM XSS\n3. **认证授权**：JWT 安全性、会话管理、权限绕过\n4. **数据泄露**：敏感信息日志、错误消息泄露、API 过度暴露\n5. **配置安全**：CORS 配置、安全头设置、加密算法选择\n\n审查标准：\n- BLOCKER: 存在可利用的安全漏洞，必须修复后才能合并\n- CRITICAL: 高风险安全问题，强烈建议修复\n- WARNING: 中等风险安全问题，建议修复\n- INFO: 安全建议，可后续处理\n\n安全规则引用：\n- OWASP Top 10 (2026)\n- CWE Top 25\n- SANS Top 25",
  "review_config": {
    "max_files_per_review": 25,
    "focus_areas": ["injection", "xss", "authentication", "data_exposure", "configuration"],
    "output_format": "structured_json",
    "include_cwe_references": true,
    "include_owasp_references": true
  }
}

{
  "reviewer": "agent-c (Codex)",
  "target": "agent-a 编写的 admin-dashboard.ts",
  "score": 2,
  "verdict": "NO",
  "findings": [
    {
      "severity": "BLOCKER",
      "category": "injection",
      "file": "backend/src/routes/admin-dashboard.ts",
      "line": 56,
      "cwe": "CWE-89: SQL Injection",
      "owasp": "A03:2021 – Injection",
      "issue": "动态 SQL 查询直接使用用户输入，存在 SQL 注入漏洞",
      "evidence": "const query = `SELECT * FROM users WHERE ${filterColumn} = '${filterValue}'`;",
      "impact": "攻击者可通过构造恶意 filterValue 执行任意 SQL 命令，包括数据窃取、数据篡改或删除",
      "fix": "```typescript\n// ✅ 使用参数化查询 + 白名单列名\nconst allowedColumns = ['name', 'email', 'role', 'status'];\nif (!allowedColumns.includes(filterColumn)) {\n  throw new Error('Invalid filter column');\n}\nconst query = `SELECT * FROM users WHERE ${filterColumn} = $1`;\nconst result = await pool.query(query, [filterValue]);\n```"
    },
    {
      "severity": "BLOCKER",
      "category": "authentication",
      "file": "backend/src/routes/admin-dashboard.ts",
      "line": 23,
      "cwe": "CWE-862: Missing Authorization",
      "owasp": "A01:2021 – Broken Access Control",
      "issue": "管理接口仅验证了认证，未验证管理员权限",
      "evidence": "router.use(authenticate); // 仅验证登录状态",
      "impact": "任何登录用户均可访问管理接口，包括普通用户",
      "fix": "```typescript\n// ✅ 添加管理员权限检查\nrouter.use(authenticate);\nrouter.use(authorize(['admin']));\n\n// 或者使用角色中间件\nrouter.use(requireRole('admin'));\n```"
    },
    {
      "severity": "CRITICAL",
      "category": "data_exposure",
      "file": "backend/src/routes/admin-dashboard.ts",
      "line": 89,
      "cwe": "CWE-200: Information Exposure",
      "owasp": "A05:2021 – Security Misconfiguration",
      "issue": "错误响应中返回了完整的堆栈信息和数据库连接字符串",
      "evidence": "catch (err) { res.status(500).json({ error: err.stack, db: process.env.DATABASE_URL }); }",
      "impact": "暴露服务器内部实现细节和数据库凭证，为攻击者提供关键信息",
      "fix": "```typescript\ncatch (err) {\n  logger.error('Dashboard error', { error: err });\n  res.status(500).json({\n    error: 'Internal server error',\n    requestId: req.id\n  });\n}\n```"
    },
    {
      "severity": "WARNING",
      "category": "configuration",
      "file": "backend/src/middleware/cors.ts",
      "line": 5,
      "cwe": "CWE-942: Permissive CORS Policy",
      "owasp": "A05:2021 – Security Misconfiguration",
      "issue": "CORS 配置允许所有来源（Access-Control-Allow-Origin: *）",
      "fix": "```typescript\nconst allowedOrigins = [\n  'https://app.example.com',\n  'https://admin.example.com'\n];\n\napp.use(cors({\n  origin: allowedOrigins,\n  credentials: true\n}));\n```"
    }
  ],
  "summary": "发现 2 个 BLOCKER 级别的安全漏洞和 1 个 CRITICAL 级别的信息泄露问题。SQL 注入和权限绕过漏洞可直接被利用，必须修复后才能合并。建议同步审查所有管理接口的权限配置。"
}

// review-aggregator.ts
import { ReviewFinding, ReviewResult } from './types';

interface AggregatedReview {
  overallScore: number;
  verdict: 'APPROVE' | 'REQUEST_CHANGES' | 'COMMENT';
  findings: ReviewFinding[];
  conflicts: Conflict[];
  summary: string;
}

interface Conflict {
  findingId: string;
  reviewers: string[];
  disagreement: string;
  resolution: 'consensus' | 'majority' | 'escalate';
}

export class ReviewAggregator {
  private weights = {
    'agent-a': 1.0,  // 架构审查权重
    'agent-b': 1.0,  // 功能审查权重
    'agent-c': 1.5,  // 安全审查权重更高（安全问题一票否决）
  };

  aggregate(reviews: ReviewResult[]): AggregatedReview {
    const allFindings: ReviewFinding[] = [];
    const conflicts: Conflict[] = [];

    // 收集所有发现
    for (const review of reviews) {
      allFindings.push(...review.findings.map(f => ({
        ...f,
        reviewerId: review.reviewerId,
      })));
    }

    // 按文件和行号分组，检测冲突
    const grouped = this.groupByLocation(allFindings);

    for (const [location, findings] of Object.entries(grouped)) {
      if (findings.length > 1) {
        const conflict = this.detectConflict(findings);
        if (conflict) {
          conflicts.push(conflict);
        }
      }
    }

    // 计算综合评分（加权平均）
    const weightedScore = reviews.reduce((sum, r) =>
      sum + r.score * this.weights[r.reviewerId as keyof typeof this.weights], 0
    ) / reviews.reduce((sum, r) =>
      sum + this.weights[r.reviewerId as keyof typeof this.weights], 0
    );

    // 安全审查一票否决
    const hasBlocker = reviews
      .filter(r => r.reviewerId === 'agent-c')
      .some(r => r.findings.some(f => f.severity === 'BLOCKER'));

    // 决定最终 verdict
    let verdict: AggregatedReview['verdict'];
    if (hasBlocker) {
      verdict = 'REQUEST_CHANGES';
    } else if (weightedScore >= 4.0) {
      verdict = 'APPROVE';
    } else if (weightedScore >= 3.0) {
      verdict = 'COMMENT';
    } else {
      verdict = 'REQUEST_CHANGES';
    }

    // 生成总结
    const summary = this.generateSummary(reviews, allFindings, conflicts);

    return {
      overallScore: Math.round(weightedScore * 10) / 10,
      verdict,
      findings: this.deduplicateFindings(allFindings),
      conflicts,
      summary,
    };
  }

  private groupByLocation(findings: ReviewFinding[]): Record<string, ReviewFinding[]> {
    const grouped: Record<string, ReviewFinding[]> = {};
    for (const finding of findings) {
      const key = `${finding.file}:${finding.line}`;
      grouped[key] = grouped[key] || [];
      grouped[key].push(finding);
    }
    return grouped;
  }

  private detectConflict(findings: ReviewFinding[]): Conflict | null {
    // 检查同一位置的不同审查意见
    const severities = new Set(findings.map(f => f.severity));
    if (severities.size > 1) {
      // 存在分歧：一个 Agent 认为是 BLOCKER，另一个认为是 SUGGESTION
      return {
        findingId: findings[0].id,
        reviewers: findings.map(f => f.reviewerId),
        disagreement: `Severity disagreement: ${findings.map(f => `${f.reviewerId}=${f.severity}`).join(', ')}`,
        resolution: findings.some(f => f.severity === 'BLOCKER') ? 'escalate' : 'majority',
      };
    }
    return null;
  }

  private deduplicateFindings(findings: ReviewFinding[]): ReviewFinding[] {
    // 合并相同问题的多个报告，取最高严重程度
    const map = new Map<string, ReviewFinding>();
    for (const finding of findings) {
      const key = `${finding.file}:${finding.line}:${finding.issue}`;
      if (!map.has(key) || this.severityRank(finding.severity) > this.severityRank(map.get(key)!.severity)) {
        map.set(key, finding);
      }
    }
    return Array.from(map.values());
  }

  private severityRank(severity: string): number {
    const ranks: Record<string, number> = {
      'BLOCKER': 5,
      'CRITICAL': 4,
      'WARNING': 3,
      'SUGGESTION': 2,
      'INFO': 1,
    };
    return ranks[severity] || 0;
  }

  private generateSummary(
    reviews: ReviewResult[],
    findings: ReviewFinding[],
    conflicts: Conflict[]
  ): string {
    const blockers = findings.filter(f => f.severity === 'BLOCKER').length;
    const criticals = findings.filter(f => f.severity === 'CRITICAL').length;
    const warnings = findings.filter(f => f.severity === 'WARNING').length;

    let summary = `## 多Agent交叉审查报告\n\n`;
    summary += `| 指标 | 值 |\n|------|-----|\n`;
    summary += `| 综合评分 | ${reviews.reduce((s, r) => s + r.score, 0) / reviews.length}/5 |\n`;
    summary += `| BLOCKER | ${blockers} |\n`;
    summary += `| CRITICAL | ${criticals} |\n`;
    summary += `| WARNING | ${warnings} |\n`;
    summary += `| 审查冲突 | ${conflicts.length} |\n\n`;

    if (conflicts.length > 0) {
      summary += `### ⚠️ 审查冲突\n`;
      for (const c of conflicts) {
        summary += `- ${c.disagreement} → 解决策略: ${c.resolution}\n`;
      }
      summary += `\n`;
    }

    return summary;
  }
}

# .github/workflows/cross-review.yml
name: Cross-Agent Code Review

on:
  pull_request:
    branches: [main, develop]
    types: [opened, synchronize, reopened]

jobs:
  cross-review:
    name: 🔍 Cross-Agent Review
    runs-on: ubuntu-latest
    timeout-minutes: 15

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Get PR diff
        id: diff
        run: |
          git diff origin/${{ github.base_ref }}...HEAD > pr-diff.patch
          echo "changed-files=$(git diff --name-only origin/${{ github.base_ref }}...HEAD | tr '\n' ',')" >> $GITHUB_OUTPUT

      # 并行启动三个 Agent 审查
      - name: Agent A - Architecture Review (Hermes)
        uses: nousresearch/hermes-agent-action@v1
        id: agent-a
        with:
          api-key: ${{ secrets.HERMES_API_KEY }}
          model: hermes-3
          system-prompt-file: ./.review/agent-a-prompt.md
          input-file: pr-diff.patch
          output-file: review-a.json

      - name: Agent B - Functional Review (Claude Code)
        uses: anthropic/claude-code-action@v1
        id: agent-b
        with:
          api-key: ${{ secrets.ANTHROPIC_API_KEY }}
          model: claude-sonnet-4-20250514
          system-prompt-file: ./.review/agent-b-prompt.md
          input-file: pr-diff.patch
          output-file: review-b.json

      - name: Agent C - Security Review (Codex)
        uses: openai/codex-review-action@v2
        id: agent-c
        with:
          api-key: ${{ secrets.OPENAI_API_KEY }}
          model: o4-mini
          system-prompt-file: ./.review/agent-c-prompt.md
          diff-file: pr-diff.patch
          output-file: review-c.json

      # 聚合审查结果
      - name: Aggregate Reviews
        run: |
          npx ts-node scripts/review-aggregator.ts \
            --review-a review-a.json \
            --review-b review-b.json \
            --review-c review-c.json \
            --output aggregated-review.json

      # 发布到 PR
      - name: Post Review to PR
        uses: actions/github-script@v7
        with:
          script: |
            const review = require('./aggregated-review.json');
            const emoji = {
              'APPROVE': '✅',
              'REQUEST_CHANGES': '❌',
              'COMMENT': '💬'
            };

            const body = `## 🤖 Multi-Agent Cross Review ${emoji[review.verdict]}

            ${review.summary}

            ### Agent A (Hermes) - 架构审查
            - 评分: ${review.agentAScore}/5
            - 发现: ${review.agentAFindings.length} 个问题

            ### Agent B (Claude Code) - 功能审查
            - 评分: ${review.agentBScore}/5
            - 发现: ${review.agentBFindings.length} 个问题

            ### Agent C (Codex) - 安全审查
            - 评分: ${review.agentCScore}/5
            - 发现: ${review.agentCFindings.length} 个问题

            ${review.findings.length > 0 ? '### 详细发现\n' + review.findings.map(f =>
              `- **${f.severity}** [${f.file}:${f.line}] ${f.issue}\n  💡 ${f.suggestion}`
            ).join('\n') : ''}

            ${review.conflicts.length > 0 ? '### ⚠️ 审查冲突\n' + review.conflicts.map(c =>
              `- ${c.disagreement} → ${c.resolution}`
            ).join('\n') : ''}
            `;

            github.rest.issues.createComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
              body: body
            });

      # 设置审查状态
      - name: Set Review Status
        run: |
          REVIEW_STATUS=$(jq -r '.verdict' aggregated-review.json)
          echo "review_status=$REVIEW_STATUS" >> $GITHUB_OUTPUT

    outputs:
      review-status: ${{ steps.aggregate.outputs.review_status }}

  auto-approve:
    name: ✅ Auto-Approve
    needs: cross-review
    if: needs.cross-review.outputs.review-status == 'APPROVE'
    runs-on: ubuntu-latest

    steps:
      - name: Auto-approve PR
        uses: hmarr/auto-approve-action@v4
        with:
          github-token: ${{ secrets.REVIEW_BOT_TOKEN }}
          pull-request-number: ${{ github.event.pull_request.number }}

问题发现分布:
  Agent A (架构): ████████████████░░░░░░░░ 32%
  Agent B (功能): ██████████████████░░░░░░ 36%
  Agent C (安全): ████████████░░░░░░░░░░░░ 24%
  多个Agent共同: ████░░░░░░░░░░░░░░░░░░░░  8%

Agent C 的贡献虽然占比不是最高，但其发现的 BLOCKER 级别问题
占总 BLOCKER 的 87%，充分证明了安全审查独立设置的价值。

案例：用户管理 API 的交叉审查

Agent A (架构) 发现：
  - Service 层缺少 Repository 抽象
  - 缺少依赖注入容器
  - 事件处理应使用事件总线模式

Agent B (功能) 发现：
  - 分页参数未校验负数
  - 批量删除缺少事务保护
  - 用户状态机转换缺少合法性检查

Agent C (安全) 发现：
  - 用户密码使用 MD5 哈希（BLOCKER）
  - API 返回了密码哈希字段（BLOCKER）
  - 缺少请求频率限制（CRITICAL）

最终结果：
  - 3 个 BLOCKER 问题全部修复
  - 架构改进建议纳入技术债务 backlog
  - 功能边界条件补充了 12 个测试用例
  - 安全配置全面升级

# 随机化审查路由，打破固定模式
review_routing:
  strategy: "randomized"
  constraints:
    - "同一 PR 至少需要 2 个不同 Agent 审查"
    - "安全审查 (Agent C) 必须参与所有涉及认证/授权的 PR"
    - "Agent 不能审查自己编写的代码"
    - "每周轮换审查组合，避免固定搭配"

// 智能审查成本控制
const reviewCostControl = {
  // 小变更跳过完整审查
  skipFullReviewIf: {
    linesChanged: '< 20',
    filesChanged: '< 2',
    categories: ['docs', 'chore', 'style'],
  },
  // 大变更增加审查力度
  enhanceReviewIf: {
    linesChanged: '> 500',
    filesChanged: '> 10',
    paths: ['**/auth/**', '**/payment/**', '**/admin/**'],
  },
  // 缓存相同代码的审查结果
  cacheStrategy: {
    enabled: true,
    ttl: '24h',
    key: 'file-content-hash + review-rules-version',
  },
};