[V10.284] 預設關閉 Code Review Hermes LLM scan | code_review_pipeline_service.py

tests/test_code_review_claude_routing.py

@@ -211,6 +211,7 @@ def test_code_review_ollama_defaults_use_fast_local_model(monkeypatch):
         "CODE_REVIEW_HERMES_NUM_PREDICT",
         "CODE_REVIEW_HERMES_MAX_FILES",
         "CODE_REVIEW_HERMES_MAX_CHARS",
+        "CODE_REVIEW_HERMES_LLM_SCAN_ENABLED",
     ):
         monkeypatch.delenv(key, raising=False)
 
@@ -234,6 +235,7 @@ def test_code_review_ollama_defaults_use_fast_local_model(monkeypatch):
     assert svc_mod.CODE_REVIEW_HERMES_NUM_PREDICT == 384
     assert svc_mod.CODE_REVIEW_HERMES_MAX_FILES == 2
     assert svc_mod.CODE_REVIEW_HERMES_MAX_CHARS == 900
+    assert svc_mod.CODE_REVIEW_HERMES_LLM_SCAN_ENABLED is False
 
 
 def test_openclaw_uses_secondary_local_model_before_gemini(monkeypatch):
@@ -304,6 +306,7 @@ def test_openclaw_uses_secondary_local_model_before_gemini(monkeypatch):
 
 def test_hermes_scan_uses_compact_prompt_and_short_timeout(monkeypatch):
     """Hermes scan 只送 compact snippet，避免大檔讓三主機各卡 120 秒。"""
+    monkeypatch.setenv("CODE_REVIEW_HERMES_LLM_SCAN_ENABLED", "true")
     monkeypatch.setenv("CODE_REVIEW_HERMES_TIMEOUT", "7")
     monkeypatch.setenv("CODE_REVIEW_HERMES_MAX_FILES", "2")
     monkeypatch.setenv("CODE_REVIEW_HERMES_MAX_CHARS", "20")
@@ -331,6 +334,29 @@ def test_hermes_scan_uses_compact_prompt_and_short_timeout(monkeypatch):
     assert "截斷" in prompt
 
 
+def test_hermes_scan_defaults_to_static_scan_without_ollama(monkeypatch):
+    """預設不打 LLM，避免部署後 Hermes scan 卡三段 Ollama timeout。"""
+    monkeypatch.delenv("CODE_REVIEW_HERMES_LLM_SCAN_ENABLED", raising=False)
+    _stub_logger(monkeypatch)
+
+    svc_mod = _reload_pipeline()
+    pipeline = _make_pipeline(svc_mod)
+    findings = pipeline._hermes_scan({
+        "services/foo.py": (
+            "import requests\n"
+            "def risky(payload):\n"
+            "    requests.get('https://example.com')\n"
+            "    return eval(payload)\n"
+        )
+    })
+
+    descriptions = {finding["description"] for finding in findings}
+    assert "HTTP request 未設定 timeout，可能拖住 worker" in descriptions
+    assert "使用 eval() 有安全風險" in descriptions
+    assert pipeline.state["severity_summary"]["high"] == 1
+    assert pipeline.state["severity_summary"]["medium"] == 1
+
+
 def test_flag_true_still_uses_ollama_before_claude(monkeypatch):
     """flag=true 也不得跳過 Ollama；Ollama 成功時 Claude/Gemini 都不呼叫"""
     monkeypatch.setenv('CODE_REVIEW_USE_CLAUDE', 'true')