parseBpeData parses the base64-encoded BPE data format. Each line: <base64-token> <rank>

readRuleFileSafe reads and validates a rule file: extension whitelist, 512 KB cap, and symlink resolution. When confineRoot is non-empty, the resolved

runConfig provides test compatibility: dispatches config subcommands through a fresh cobra command tree that mirrors the production config command, so

运行任意参数，流式回调日志，结束返回 stdout 全文。退出码非 0 时 reject，并带上 CLI 报错文本。

seedParentManifest gives a hand-built ResumeState the parent manifest a real resume always has, matching the identity a already resolved. Without one

tryApplyPendingCompression checks whether a background compression has completed and swaps the rebuilt messages into place. Returns true if applied.

unwritableConfigPath returns a config path that is itself a directory, so any saveConfig / loadOrCreateConfig against it fails. This is the lever used

AsDiff returns a Diff suitable for handing to code that expects the diff-based shape (line-number resolver, file_read_diff tool). The Diff field stays

BudgetExceeded reports whether the aggregate token budget gate stopped the run before all files were reviewed. It is a diagnostic signal only — it fee

CollectToolDefs gathers tool definitions from MCP clients, filtering out tools that conflict with built-in tools or were not successfully registered.

ContextWithTraceParentFromEnv extracts W3C traceparent from the TRACEPARENT environment variable and returns a context carrying the upstream span cont

Frozen reports whether Finalize has already run.

Init initializes global TracerProvider and MeterProvider based on environment variables and optional config file. Returns true when enabled. Safe to c

ListSessions enumerates all persisted sessions for the given repository directory, sorted by StartTime descending (most recent first). Missing directo

Load parses the tools config file. When path is empty, falls back to the embedded default tools configuration.

LoadAppConfig loads config from path. Returns nil, nil if file does not exist.

LoadComments replays one session's JSONL and returns every review comment recorded in it, in file-completion order. It mirrors resume replay semantics

NewSessionKey returns a fresh UUIDv4 session key. Clients use it as a per-client fallback for requests whose context carries no session key (e.g. `ocr

ParseComments extracts LlmComment entries from tool call arguments without writing to the Collector. Returns parsed comments and an error message (emp

Reason is the safe, human-facing sentence for a stop, and the single source of truth for it: the diff-review manifest reason and the scan subtask warn

RecordWarning adds a non-fatal warning.

RelocateAcrossFiles handles the comment whose ExistingCode belongs to a different file than the one it was filed against. The reviewing Agent reads r

ReplaceSince replaces comments[start:] with the given replacements. Useful for batch-level dedup: take a Snapshot, run a batch, dedup the new comments

Run executes a git command and returns the combined stdout+stderr output.

SessionKeyFromContext returns the session key carried by ctx, or "" when none was set.

SetExecution sets the non-secret execution provenance.

SetRepository sets the redacted repository identity.

Submit runs f in a background goroutine bounded by the semaphore. When f completes its return value is collected internally.

TotalInputTokens returns the accumulated input/prompt tokens from all LLM calls.

TraceIDFromContext returns the hex-encoded trace ID of the span carried by ctx, or "" if ctx carries no valid span (e.g. telemetry is disabled).

ValidateResume reports whether req may reuse this parent's checkpoints. A mismatch on any input field rejects the whole resume rather than degrading

buildAllowedHosts returns the default-deny allowlist used by the host guard. The set always includes the standard loopback names. If bindHost is a con

buildConcatenatedDiffs formats all diffs in the group as per-file XML elements.

cancelPendingCompression aborts the conversation's in-flight background compression, if any.

describe renders m for internal construction errors raised by RetryCollector.Freeze. Those errors reach the user through runErr, and with --concurren

ensureModelInList appends model to the end when missing; never reorders existing entries.

Positional-argument validators that replace Cobra's raw count message ("accepts 2 arg(s), received 1") with an actionable one built from metadata the

executeGroupSubtask performs the Plan Phase + Main Loop for a file group. It returns (completed, stop, err): a hard Go error (err) for provider/config

executeSubtask runs the scan pipeline for one file: 1. Optional PLAN_TASK: produce a JSON checklist of focus areas. 2. MAIN_TASK: review the file with

extractFilenameFromURL returns the filename part (last path segment) of a URL pattern.

filterDiffs drops diffs that should not be reviewed based on user-configured include/exclude patterns and default extension/path filters.

finalizeRequest is the shared body of the client-boundary defer: correct the last attempt if the error only became visible after the SDK returned, the

gitOut runs a git command in dir and returns its trimmed stdout, failing the test on error. Used to capture the SHAs a ResolveInput result must match.

hashFields folds a sequence of string fields into one SHA-256 digest, writing an unambiguous 8-byte big-endian length prefix before each field so no t

isMachineReadable reports whether the output format writes a structured document to stdout that must not be interleaved with progress text. Both json

loadDiffs populates the diff-related fields.

logicalRequestID computes the canonical logical_request_id for m under runID. Fields are NUL-terminated in a fixed order rather than concatenated, be

manifestItemID derives the content-independent item_id for a diff, keyed on operation, input mode and the normalized old/new paths. RegisterSelected a

maybeRunDedup, when the template has a DedupTask and the batch produced at least DedupMinComments comments, invokes the DEDUP_TASK LLM to merge near-d

maybeRunProjectSummary runs the post-batch PROJECT_SUMMARY_TASK over the union of all collected comments. Best-effort: any error / empty input no-temp

openBrowserCandidates tries each candidate in turn. Every failure is reported, not just the first: with $BROWSER set to something uninstalled and no p

parentState builds a resumable parent: a v1 review manifest whose identity is parentIdentity, run on anthropic/claude, with one selected item. mutate

planEnabled / dedupEnabled / summaryEnabled report whether each optional phase will actually run: template must define it AND the corresponding --no-*

Drive post() over a sequence of per-call fake_urlopen outcomes. Each outcome is either the raw response body (bytes, returned) or an

resolveWorkingDirForSession accepts an explicit --repo flag value and falls back to the current working directory. Unlike resolveRepoDir it does not r