Skip to content

fix: 蒸馏不再采集私有推理块（CWE-200，CodeRabbit #76 评审）+ v0.7.14 - #78

Merged
modusensus merged 1 commit into
mainfrom
release/v0.7.14
Sep 7, 2026
Merged

fix: 蒸馏不再采集私有推理块（CWE-200，CodeRabbit #76 评审）+ v0.7.14#78
modusensus merged 1 commit into
mainfrom
release/v0.7.14

Conversation

@modusensus

@modusensus modusensus commented Sep 7, 2026 •
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Member

fix: 蒸馏不再采集私有推理块（CWE-200）

承接 CodeRabbit 在 #76 的评审意见（🟠 Major / Sensitive Data Exposure）：codingRetrospect 蒸馏的完整转录会把 assistant/message 里的 reasoning（私有推理）block 送进蒸馏模型，生成的记忆可能沉淀模型私有思考链；而记忆库经外部 API/CLI 可被读取、无租户隔离。

修复

  • collectMessages 只采集公开 text 块，私有 reasoning 块一律不进蒸馏上下文（含 CODING_SUMMARY_PROMPT 与注释措辞同步）
  • 新增回归测试：私有 reasoning 不进入蒸馏上下文、公开助手文本照常蒸馏
  • 617 测试全绿（+1）

工程

  • bump v0.7.14；CHANGELOG / README 高亮表同步

说明

Summary by CodeRabbit

  • Bug Fixes
    • Private assistant reasoning is no longer included in generated summaries or distillation context.
    • Public assistant text, tool calls, tool results, and dispatch output continue to be summarized.
  • Documentation
    • Updated release documentation to describe the privacy fix in version 0.7.14.
  • Tests
    • Added regression coverage confirming private reasoning is excluded while public text remains available.
  • Chores
    • Updated the package version to 0.7.14.

@modusensus @Anans-Amarre
fix: 蒸馏不再采集私有推理块（CWE-200，CodeRabbit #76 评审）+ bump v0.7.14
4323ceb 
- collectMessages 原把 assistant/message 的 reasoning block 作「助手思考」送进蒸馏上下文，生成的记忆可能沉淀模型私有思考链
- 现只采集公开 text 块；私有 reasoning 不进记忆库（同步 CODING_SUMMARY_PROMPT/注释措辞）
- 新增回归测试：reasoning 不进蒸馏上下文、公开文本照常蒸馏
- 617 测试全绿；CHANGELOG/README 补 v0.7.14

Co-Authored-By: Anans-Ivresse <[email protected]>
@coderabbitai

coderabbitai Bot commented Sep 7, 2026 •
edited
Loading

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: ac0d013d-d319-4d40-82b8-137d99ed9f67

📥 Commits

Reviewing files that changed from the base of the PR and between 3d48786 and 4323ceb.

⛔ Files ignored due to path filters (1)
  • dsh-mneme/package-lock.json is excluded by !**/package-lock.json
📒 Files selected for processing (6)
  • dsh-mneme/CHANGELOG.md
  • dsh-mneme/README.md
  • dsh-mneme/lib/summarize.js
  • dsh-mneme/package.json
  • dsh-mneme/src/summarize.js
  • dsh-mneme/test/summarize.test.js

Included review availability: Your plan provides up to 10 included reviews per hour; 8 remain after this review.

📝 Walkthrough

Walkthrough

The summarization flow now excludes assistant reasoning blocks from distillation transcripts while retaining public text and tool activity. Version 0.7.14 documentation and regression coverage record the change.

Changes

Distillation privacy

Layer / File(s) Summary
Transcript filtering and regression coverage
dsh-mneme/src/summarize.js, dsh-mneme/lib/summarize.js, dsh-mneme/test/summarize.test.js		 Prompts and transcript collection now use assistant public text without private reasoning. The regression test verifies that public text remains included and reasoning is excluded.
Release metadata
dsh-mneme/package.json, dsh-mneme/CHANGELOG.md, dsh-mneme/README.md		 The package version changes to 0.7.14. Release documentation describes the reasoning exclusion and test coverage.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 4323c

This change prevents private assistant reasoning from entering distilled memories while preserving public replies and tool context. The intended privacy behavior is covered without an identified current-head merge risk.

Suggested reviewers: anans-ivresse

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed 标题准确概括了主要变更：修复蒸馏流程采集私有推理块的问题，并标明 CWE-200 和 v0.7.14 版本更新。
Docstring Coverage ✅ Passed Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 3 files. (3 skipped: 3 …
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • ✅ Generated successfully - (🔄 Check to regenerate)
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch release/v0.7.14

Comment @coderabbitai help to get the list of available commands.

@coderabbitai

coderabbitai Bot commented Sep 7, 2026 •
edited
Loading

Copy link
Copy Markdown

Note

Docstrings generation - SUCCESS
Generated docstrings for this pull request at #79

coderabbitai Bot added a commit that referenced this pull request Sep 7, 2026
@coderabbitai
📝 Add docstrings to release/v0.7.14
d3c6963 
Docstrings generation was requested by @modusensus.

* #78 (comment)

The following files were modified:

* `dsh-mneme/lib/summarize.js`
* `dsh-mneme/src/summarize.js`
@coderabbitai coderabbitai Bot mentioned this pull request Sep 7, 2026
Closed
@modusensus
modusensus merged commit ca67a9c into main Sep 7, 2026
2 checks passed
@modusensus modusensus mentioned this pull request Sep 8, 2026
Merged
@modusensus
modusensus deleted the release/v0.7.14 branch September 11, 2026 21:37
@lxl1782586616-alt lxl1782586616-alt mentioned this pull request Sep 16, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@modusensus