源码快照 @ 2026-09-02 (source-only, 剔除非源码素材)

warden.toml

@@ -0,0 +1,53 @@
+version = 1
+
+# Warden gates clearance on blocking findings from two skills:
+# diff-security-review (all findings block) and desktop-den-sync-review (only
+# high findings block; medium findings are advisory). The clearance itself is
+# granted by .github/workflows/warden-clearance.yml.
+
+[defaults]
+reportOn = "low"
+ignorePaths = [
+  "**/node_modules/**",
+  "**/pnpm-lock.yaml",
+  "**/dist/**",
+  "**/*.min.js",
+]
+
+[defaults.agent]
+model = "openai/gpt-5.6-luna"
+
+# Auxiliary verifies/merges findings and gates what survives to the report;
+# keep it on the same strong model so weak verification can't cause a false
+# clearance.
+[defaults.auxiliary]
+model = "openai/gpt-5.6-luna"
+
+[[skills]]
+name = "diff-security-review"
+
+[[skills.triggers]]
+type = "pull_request"
+actions = ["opened", "synchronize", "reopened"]
+draft = false
+
+# Lets developers run `warden` locally on uncommitted changes before pushing.
+[[skills.triggers]]
+type = "local"
+
+[[skills]]
+name = "desktop-den-sync-review"
+paths = [
+  "apps/app/**",
+  "apps/desktop/**",
+  "ee/apps/den-api/**",
+  "packages/types/**",
+]
+
+[[skills.triggers]]
+type = "pull_request"
+actions = ["opened", "synchronize", "reopened"]
+draft = false
+
+[[skills.triggers]]
+type = "local"