Recompute filtered review summaries

[Iron-Ham]

Summary

• Recompute review stats, groups, and group IDs after CLI-level entity filters
• Preserve dependency edges internally so filtered groups are rebuilt from real retained edges
• Normalize inspect file targets to repo-relative paths, including absolute paths under -C repos

Closes #13

Test plan

• cargo test -p inspect-core -p inspect-cli
• cargo build -p inspect-cli
• cargo check --workspace
• target/debug/inspect diff HEAD --format json --min-risk critical in the issue reproduction repo
• target/debug/inspect file app.ts -C REPO --format json in the issue reproduction repo
• target/debug/inspect file REPO/app.ts -C REPO --format json in the issue reproduction repo
• target/debug/inspect pr 19 --remote Ataraxy-Labs/inspect --format json --min-risk critical

[vercel]

@Iron-Ham is attempting to deploy a commit to the rs545837's projects Team on Vercel.

A member of the Team first needs to authorize it.

[inspect-review]

inspect review

Triage: 20 entities analyzed | 0 critical, 0 high, 9 medium, 11 low
Verdict: standard_review

Findings (4)

1. [low] In crates/inspect-cli/src/commands/file.rs, the normalize_path function incorrectly handles ParentDir components when the parts vector is empty. The condition parts.last().is_some_and(|part| part != "..") will be false when parts is empty, causing ".." to be pushed. This means a path like "../file.txt" will normalize to "../file.txt" instead of being properly handled, which could lead to incorrect path matching.
2. [low] In crates/inspect-core/src/analyze.rs, the refresh_result_summaries function filters dependency_edges to only include edges where both endpoints are in remaining_ids, but then reassigns this filtered list back to result.dependency_edges. However, the original result.dependency_edges is borrowed immutably during iteration, and this creates a potential logic error where the dependency_edges field is being replaced with a filtered version. If retain_entity_reviews is called multiple times, the second call will work with already-filtered edges rather than the original full set, leading to incorrect edge filtering.
3. [low] In crates/inspect-cli/src/commands/file.rs, the normalize_path function has a logic error when handling ParentDir components. The condition parts.last().is_some_and(|part| part != "..") will incorrectly pop a part when the last part is ".." and should instead push another "..". This breaks path normalization for paths like "a/../b/../c" where multiple parent directory references exist.
4. [low] In crates/inspect-cli/src/commands/file.rs, the normalize_path function doesn't handle the case where parts is empty when encountering a ParentDir. When parts.is_empty() is true, parts.last().is_some_and(...) returns false, causing ".." to be pushed. However, the condition should explicitly check if parts is empty OR if the last part is "..", not use the negation of the first condition as a fallback for the second.

---

Reviewed by inspect | Entity-level triage found 0 high-risk changes

[inspect-review]

inspect review

Triage: 23 entities analyzed | 0 critical, 0 high, 9 medium, 14 low
Verdict: standard_review

Findings (1)

1. [low] In crates/inspect-cli/src/commands/file.rs, the normalize_path function has a logic error when handling ParentDir components. The condition parts.last().is_some_and(|part| part != "..") will pop a part even when the last part is ".." if is_some_and returns false, because the else branch pushes ".." regardless. This means consecutive ".." components won't be preserved correctly.

---

Reviewed by inspect | Entity-level triage found 0 high-risk changes

[inspect-review]

inspect review

Triage: 23 entities analyzed | 0 critical, 0 high, 9 medium, 14 low
Verdict: standard_review

Findings (3)

1. [low] In file.rs::normalize_path, the logic for handling ParentDir components is incorrect. When checking if the last part is not "..", it pops from the stack, but this doesn't correctly handle cases where we're already at the root or have consumed all normal components. The condition parts.last().is_some_and(|part| part != "..") will pop a normal component when encountering .., but if parts is empty, it should add .. to the result. However, the else branch adds .. when the last part IS .. or when parts is empty, which is correct. But the pop happens when last part is NOT .., meaning we have a normal component to cancel out. This logic appears correct on closer inspection.
2. [low] In file.rs::canonicalize_existing_path, there's a potential infinite loop or incorrect path construction. The function walks up the directory tree by setting cursor = parent, but if parent is None (at root), the while loop condition while let (Some(parent), Some(name)) will exit. However, the logic builds suffix by prepending components, which could result in an incorrect final path if the loop exits early without finding a canonicalizable parent.
3. [low] In file.rs::repo_relative_path, when the path cannot be stripped from the repo prefix, it falls back to normalize_path(path) which returns a String. However, this normalized path might be relative to the current directory, not the repo root, leading to incorrect file matching. For example, if input is "/other/path/file.rs" and repo is "/tmp/repo", it will return "other/path/file.rs" which won't match entity reviews that have paths relative to the repo.

---

Reviewed by inspect | Entity-level triage found 0 high-risk changes