Skip to content

Harden core workflows and accelerate indexing - #30

Merged
indrazm merged 12 commits into
mainfrom
codex/codebase-hardening-and-performance
Jul 12, 2026
Merged

Harden core workflows and accelerate indexing#30
indrazm merged 12 commits into
mainfrom
codex/codebase-hardening-and-performance

Conversation

@indrazm

@indrazm indrazm commented Jul 12, 2026

Copy link
Copy Markdown
Contributor

Summary

  • harden indexing freshness, edit safety, graph persistence, MCP framing/output bounds, installers, and release validation
  • split agent output, MCP, CLI commands, and engine responsibilities into focused modules while preserving existing public behavior
  • add parallel preparation for projects with 64+ files and snapshot v3 with full BLAKE3 validation, hydrated indexes, and v0.9-v2 compatibility
  • reduce exact-search materialization and add a reproducible performance gate against v0.9.0
  • pin every external GitHub Action to an immutable full-length upstream commit SHA

Compatibility and assumptions

  • existing lexa::engine::*, CLI, and MCP behavior is preserved unless explicitly hardened
  • graph snapshots written by v0.9, v1, and v2 remain readable; new writes use v3
  • bincode remains read-only for legacy snapshot compatibility

Verification

  • cargo fmt --all -- --check
  • cargo clippy --workspace --all-targets --all-features -- -D warnings
  • cargo test --locked — 228 tests passed
  • cargo build --locked
  • cargo run -p xtask -- gen-skill --check
  • cargo run -p xtask -- perf-gate
    • 500-file indexing: 61.1% faster than v0.9.0
    • warm exact search: 82.8% faster than v0.9.0
    • snapshot loading benchmark: approximately 70% faster
  • Lexa structural audit: 0 high findings and no dependency cycles
  • sh -n install.sh
  • workflow YAML parsing and full-SHA action-pin validation

Local limitations

  • shellcheck and PowerShell (pwsh) were not installed locally; the configured CI jobs cover those checks.
  • No UI changes; screenshots are not applicable.

Summary by CodeRabbit

  • New Features

    • Added a comprehensive CLI for indexing, searching, auditing, editing, graph management, pipelines, watching, and MCP integration.
    • Added persisted project graphs with status, refresh, reindex, and clear-index commands.
    • Added richer context and search results, including symbol, dependency, caller, and file discovery tools.
    • Added MCP support for structured tool calls, diagnostics, file mutations, and multiple message formats.
    • Installers now verify release archives using SHA-256 checksums before extraction.
  • Bug Fixes

    • Improved preservation of line endings and file permissions during edits.
    • Improved change detection, dependency-cycle reporting, pagination limits, and snapshot validation.

indrazm added 7 commits July 12, 2026 10:59
Detect content changes that preserve metadata, retain file formatting and permissions during edits, and centralize shared project operations. Add checksummed v2 snapshots with v0.9 compatibility, bounded MCP input/output, improved audit cycle reporting, and verified release assets.
Keep the public output facade stable while separating tool renderers, path compaction, next-step guidance, value normalization, UTC formatting, and regression tests into focused modules.
Keep the public MCP API and wire contracts stable while separating server lifecycle, bounded transport, dispatch, response encoding, argument parsing, and focused tool groups. Remove legacy text rendering whose output was discarded before structured TOON encoding.
Reduce main to logging, argument parsing, and dispatcher invocation. Separate Clap types, graph/session utilities, retrieval, mutation, maintenance, watch, pipeline, and CLI regression tests while preserving command behavior and output.
Prepare parsing, word data, and trigrams with Rayon for projects of 64 or more files. Write v3 snapshots with full BLAKE3 payload hashes and hydrated search/dependency indexes while retaining v0.9-v2 readers.

Add a CI performance gate requiring indexing and warm exact search to remain at least 20% faster than v0.9.0.
Replace all mutable action tags and the Rust stable branch reference with full-length commits from the official upstream repositories. Keep release labels in comments so automated and manual updates remain reviewable.
@coderabbitai

coderabbitai Bot commented Jul 12, 2026

Copy link
Copy Markdown

Review Change Stack

Warning

Review limit reached

@indrazm, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 26 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 28467779-405b-4f78-a81f-037573cff07c

📥 Commits

Reviewing files that changed from the base of the PR and between 2e5f4e6 and 9fbc708.

⛔ Files ignored due to path filters (1)
  • Cargo.lock is excluded by !**/*.lock
📒 Files selected for processing (8)
  • .github/workflows/release.yml
  • install.sh
  • src/commands/maintenance.rs
  • src/commands/retrieval.rs
  • src/edit.rs
  • src/mcp/mutation.rs
  • src/mcp/tests.rs
  • tests/cli_graph.rs
📝 Walkthrough

Walkthrough

This PR modularizes the engine, CLI, MCP, application, snapshot, output, and audit systems; adds graph persistence and refresh behavior; preserves edit metadata; introduces installer checksums and performance gates; expands release CI; and updates tool schemas and release documentation.

Changes

Engine, CLI, MCP, and Application Refactor

Layer / File(s) Summary
Engine model, indexing, persistence, and search
src/engine/*, src/types.rs
Adds engine data models, indexing, persistence, file/dependency queries, search, and index snapshot support.
Context ranking and brief generation
src/engine/context*
Adds keyword extraction, context ranking, confidence metadata, filtering, and rendered context output.
Index snapshot validation and dependency restoration
src/index/*, src/engine/dep_graph.rs
Adds validated index snapshots, prepared indexing, bounded searches, and dependency graph restoration.
Engine behavior regression coverage
src/engine/tests.rs
Adds tests for snapshots, dependency resolution, context ranking, filtering, assets, parallel indexing, and language outlines.
Snapshot v3 serialization
src/snapshot.rs
Adds postcard/BLAKE3 snapshot writing with compatibility readers for older formats.
Freshness and durable file edits
src/freshness.rs, src/edit.rs, src/walker.rs
Improves refresh decisions and preserves line endings, permissions, and file metadata during edits.
ProjectSession application API
src/application.rs
Adds shared project-scoped read, patch, create, audit, reindex, and index-clearing operations.
Audit configuration and cycle detection
src/audit*
Moves audit include configuration and replaces cycle enumeration with SCC-based detection.
CLI definitions and command execution
src/cli.rs, src/commands/*, src/cli_upgrade.rs
Adds Clap command definitions, command handlers, shared validation, graph management, retrieval, mutation, and release-aware upgrades.
MCP transport, dispatch, and tools
src/mcp/*
Adds framed transport, JSON-RPC dispatch, diagnostics, graph watching, retrieval/mutation/maintenance tools, and protocol tests.
Output rendering and guidance
src/output/*
Adds structured output construction, path compression, tool renderers, timestamp formatting, audit guidance, and output tests.
Crate and executable wiring
src/lib.rs, src/main.rs
Exports the application module and delegates executable command handling to the command dispatcher.

Release CI, Installer Checksums, and Performance Gate

Layer / File(s) Summary
Release workflow hardening
.github/workflows/release.yml
Pins actions, adds audit/build/syntax gates, tests macOS and Windows, and generates release checksums.
Installer archive verification
install.sh, install.ps1, docs/install.md
Verifies downloaded archives against release SHA256SUMS files before extraction.
Performance gate benchmark tooling
xtask/src/main.rs, benches/engine.rs, justfile, Cargo.toml, .cargo/audit.toml
Adds benchmark comparison against a baseline release and exposes it through the justfile and CI.
Release notes and tool schema documentation
CHANGELOG.md, docs/tools.md, src/mcp/tool_spec.rs
Documents unreleased changes and adds numeric result limits to tool schemas.

Estimated code review effort: 5 (Critical) | ~120 minutes

Possibly related PRs

  • anvia-hq/lexa#20: Related graph snapshot path resolution and --no-graph behavior.
  • anvia-hq/lexa#24: Related freshness refresh and dependency-graph rebuild behavior.
  • anvia-hq/lexa#25: Related MCP tool schema and generated documentation updates.
🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 18.41% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately captures the main themes of the changes: workflow hardening and indexing performance improvements.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch codex/codebase-hardening-and-performance

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

Only skip content verification when the filesystem change timestamp is strictly older than the snapshot. Equal timestamps can occur on coarse-resolution filesystems and must fall back to content comparison.
@indrazm

indrazm commented Jul 12, 2026

Copy link
Copy Markdown
Contributor Author

Addressed the Linux CI freshness race in 9a127ff: equal filesystem change/snapshot timestamps are now treated as ambiguous and fall back to content comparison. Added boundary coverage for older, equal, newer, and unavailable timestamps. Reran formatting, clippy with warnings denied, all 229 tests, build, and generated-doc verification successfully.

Convert filesystem-relative paths to forward-slash project paths before indexing or watcher updates. This keeps dependency lookup and public engine paths consistent on Windows.
@indrazm

indrazm commented Jul 12, 2026

Copy link
Copy Markdown
Contributor Author

Addressed the Windows dependency failures in 2e5f4e6 by normalizing walker and watcher filesystem paths to canonical forward-slash project paths. Added a cross-platform walker regression test and reran all previously failing dependency tests plus the full suite: formatting, clippy, 230 tests, build, and generated docs all pass.

@indrazm

indrazm commented Jul 12, 2026

Copy link
Copy Markdown
Contributor Author

CI dependency audit surfaced RUSTSEC-2026-0190 and RUSTSEC-2026-0204. Updated the lockfile to patched versions (anyhow 1.0.103 and crossbeam-epoch 0.9.20) in 6e57e7a. Full local fmt, clippy, all-target tests/bench targets, build, and generated-doc sync checks pass.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 5

🧹 Nitpick comments (10)
xtask/src/main.rs (1)

141-151: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Add --locked to cargo bench for reproducible benchmark results.

The CI pipeline uses --locked for cargo test and cargo build, but run_bench omits it. Without --locked, cargo may silently update an out-of-sync Cargo.lock in the baseline worktree, potentially pulling different dependency versions and skewing benchmark comparisons.

♻️ Proposed fix
 fn run_bench(repo_root: &Path, target_dir: &Path, filter: &str) -> Result<()> {
     run_command(
         Command::new("cargo")
-            .args(["bench", "--bench", "engine", "--"])
+            .args(["bench", "--locked", "--bench", "engine", "--"])
             .arg(filter)
             .arg("--noplot")
             .env("CARGO_TARGET_DIR", target_dir)
             .current_dir(repo_root),
         &format!("run performance benchmarks in {}", repo_root.display()),
     )
 }
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@xtask/src/main.rs` around lines 141 - 151, Update the cargo argument list in
run_bench to include --locked alongside bench and the engine benchmark
selection, ensuring benchmark runs use the existing Cargo.lock without modifying
or resolving dependency versions.
.github/workflows/release.yml (1)

114-129: 🚀 Performance & Scalability | 🔵 Trivial | ⚡ Quick win

Add cargo caching to test-platforms for faster CI.

The check and build jobs cache ~/.cargo/registry and target, but test-platforms recompiles all dependencies from scratch on macOS and Windows. Adding the same cache step would significantly reduce CI time.

♻️ Suggested cache step for test-platforms
       - name: Install Rust
         uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
 
+      - name: Cache cargo
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: |
+            ~/.cargo/registry/index
+            ~/.cargo/registry/cache
+            ~/.cargo/git/db
+            target
+          key: ${{ runner.os }}-test-cargo-${{ hashFiles('**/Cargo.lock') }}
+
       - name: Test
         run: cargo test --locked
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/release.yml around lines 114 - 129, Add a Cargo cache step
to the test-platforms job, alongside its Checkout and Install Rust steps,
reusing the same cache configuration and key strategy as the existing check and
build jobs for ~/.cargo/registry and target. Keep the cargo test --locked
command unchanged.
install.ps1 (1)

50-52: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick win

Add retry logic to Invoke-WebRequest for transient network failures.

The bash installer uses curl --retry 3 --retry-delay 2 for the SHA256SUMS download, but the PowerShell installer has no retry logic. Adding -MaximumRetryCount 3 -RetryIntervalSec 2 (available in PowerShell 7+) would improve reliability for users on unstable connections.

♻️ Suggested retry parameters
     Invoke-WebRequest -Uri $url -OutFile $zipPath
     $checksumsPath = Join-Path $tmpDir "SHA256SUMS"
     $checksumsUrl = "https://github.com/$Repo/releases/download/$tag/SHA256SUMS"
-    Invoke-WebRequest -Uri $checksumsUrl -OutFile $checksumsPath
+    Invoke-WebRequest -Uri $checksumsUrl -OutFile $checksumsPath -MaximumRetryCount 3 -RetryIntervalSec 2

If PowerShell 5.1 compatibility is required, a try-catch retry loop would be needed instead since these parameters are only available in PowerShell 7+.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@install.ps1` around lines 50 - 52, Update the Invoke-WebRequest call used to
download SHA256SUMS in the checksum setup flow to retry transient failures three
times with a two-second interval, using the appropriate implementation for the
script’s supported PowerShell versions; preserve the existing URI and output
path behavior.
src/freshness.rs (1)

85-88: 🚀 Performance & Scalability | 🔵 Trivial | ⚡ Quick win

Directory events trigger a full project rescan each time.

seen only dedups identical paths, so every distinct changed directory runs refresh_project_no_rebuild(engine, root), which walks the entire project from root. When the watcher reports several directory events in one batch (see refresh_from_watcher extending event.paths), the whole tree is re-walked N times. Metadata checks prevent double counting, but the repeated walks are wasted work.

Gate the full rescan behind a one-shot flag:

    let mut work = RefreshWork::default();
    let mut seen = HashSet::new();
    let mut refreshed_project = false;
⚡ Proposed guard
         if path.is_dir() {
-            work.add(refresh_project_no_rebuild(engine, root)?);
-            continue;
+            if !refreshed_project {
+                work.add(refresh_project_no_rebuild(engine, root)?);
+                refreshed_project = true;
+            }
+            continue;
         }
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/freshness.rs` around lines 85 - 88, In the directory-event handling loop,
add a mutable one-shot flag alongside `work` and `seen`, and only call
`refresh_project_no_rebuild(engine, root)` once per refresh operation. Mark the
flag after the first successful project refresh; continue deduplicating paths
and processing subsequent events without repeating the full-tree scan.
src/engine/context_helpers.rs (1)

18-48: 🚀 Performance & Scalability | 🔵 Trivial | ⚡ Quick win

Replace the redundant seen set with a key→index map
scored.iter_mut().find(...) already handles dedup/update, so the extra HashSet only adds bookkeeping while every candidate still pays a linear scan. A HashMap<(String, String, SymbolKind, u32), usize> in src/engine/context_helpers.rs (and the caller in src/engine/context.rs:133) would make this path O(1) per candidate.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/engine/context_helpers.rs` around lines 18 - 48, Replace the seen HashSet
parameter in push_context_symbol_candidate with a HashMap<(String, String,
SymbolKind, u32), usize> and use the key to update the existing scored entry by
index or append a new ScoredContextSymbol and record its index. Update the
caller in the context flow to initialize and pass the map, preserving score
filtering and highest-score replacement behavior while removing the linear
scored.iter_mut().find scan.
src/commands/retrieval.rs (1)

520-528: 🚀 Performance & Scalability | 🔵 Trivial | 💤 Low value

cmd_context builds context twice; second call is dead code.

build_context_details_with_options is called for JSON output, then build_context_with_options for human-readable. Since cli.json is always true (set in main.rs), the second build is never reached. If both paths are kept for future use, consider short-circuiting to avoid the wasted computation.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/commands/retrieval.rs` around lines 520 - 528, Update cmd_context to
avoid building context twice: branch on cli.json before invoking either builder,
using build_context_details_with_options only for JSON output and
build_context_with_options only for human-readable output. Preserve the existing
print_agent_result and println! behaviors.
src/commands/maintenance.rs (1)

233-267: 🚀 Performance & Scalability | 🔵 Trivial | ⚡ Quick win

Debounce snapshot writes in cmd_watch.

Every file system event triggers a write_snapshot call. For rapid changes (e.g., git checkout touching many files), this causes excessive synchronous I/O. Consider batching changes over a short window and writing once.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/commands/maintenance.rs` around lines 233 - 267, Debounce snapshot
persistence in cmd_watch instead of calling snapshot::write_snapshot immediately
for every received event. Batch rapid file changes over a short window, then
perform one synchronous write_snapshot call after the window expires, while
preserving the existing cli.no_graph guard and warning behavior.
src/cli.rs (1)

367-368: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

structured_content field in Mcp is dead code.

reject_removed_output_flags (called in main.rs before Cli::parse()) exits with code 2 when --structured-content or --json-output is found anywhere in args. The field is ignored in the dispatch match (structured_content: _ in src/commands/mod.rs), so it can never influence behavior. Consider removing it to reduce confusion.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/cli.rs` around lines 367 - 368, Remove the unused structured_content
field and its structured-content/json-output argument definition from the Mcp
CLI arguments in the relevant command declaration. Update the dispatch pattern
in the command handling code to stop matching or ignoring structured_content,
while preserving reject_removed_output_flags as the sole handling for those
removed flags.
src/output/mod.rs (1)

55-93: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Consider deduplicating search_result_path_facets and word_result_path_facets.

These two functions are identical except for the input type. A shared helper accepting an iterator of path strings would eliminate the duplication.

♻️ Proposed refactor
 pub fn search_result_path_facets(results: &[SearchResult]) -> Value {
-    let mut counts = BTreeMap::<String, usize>::new();
-    for result in results {
-        let prefix = result
-            .path
-            .split('/')
-            .next()
-            .filter(|prefix| !prefix.is_empty())
-            .unwrap_or(".");
-        *counts.entry(prefix.to_string()).or_default() += 1;
-    }
-
-    Value::Array(
-        counts
-            .into_iter()
-            .map(|(path_prefix, count)| json!({ "path_prefix": path_prefix, "count": count }))
-            .collect(),
-    )
+    path_prefix_facets(results.iter().map(|r| r.path.as_str()))
 }

 pub fn word_result_path_facets(results: &[WordSearchResult]) -> Value {
-    let mut counts = BTreeMap::<String, usize>::new();
-    for result in results {
-        let prefix = result
-            .path
-            .split('/')
-            .next()
-            .filter(|prefix| !prefix.is_empty())
-            .unwrap_or(".");
-        *counts.entry(prefix.to_string()).or_default() += 1;
-    }
-
-    Value::Array(
-        counts
-            .into_iter()
-            .map(|(path_prefix, count)| json!({ "path_prefix": path_prefix, "count": count }))
-            .collect(),
-    )
+    path_prefix_facets(results.iter().map(|r| r.path.as_str()))
+}
+
+fn path_prefix_facets<'a>(paths: impl IntoIterator<Item = &'a str>) -> Value {
+    let mut counts = BTreeMap::<String, usize>::new();
+    for path in paths {
+        let prefix = path
+            .split('/')
+            .next()
+            .filter(|prefix| !prefix.is_empty())
+            .unwrap_or(".");
+        *counts.entry(prefix.to_string()).or_default() += 1;
+    }
+    Value::Array(
+        counts
+            .into_iter()
+            .map(|(path_prefix, count)| json!({ "path_prefix": path_prefix, "count": count }))
+            .collect(),
+    )
 }
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/output/mod.rs` around lines 55 - 93, Deduplicate the identical counting
logic in search_result_path_facets and word_result_path_facets by introducing a
shared helper that accepts an iterator of path strings and returns the facet
Value. Update both public functions to pass their results’ path values to this
helper while preserving the existing prefix handling, counting, ordering, and
JSON structure.
src/mcp/dispatch.rs (1)

8-8: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Extract MAX_RETRIEVAL_RESULTS to a shared location.

This constant is also defined as 200 in src/mcp/retrieval.rs:13, and tool_glob in retrieval.rs:85 hardcodes 200usize as a third source. If the limit changes in one place, the others won't follow, causing inconsistent clamping across tools.

Consider defining it once (e.g., in mod.rs or a shared constants module) and importing it in both dispatch.rs and retrieval.rs.

♻️ Suggested consolidation
// In src/mcp/mod.rs, add:
+ pub(super) const MAX_RETRIEVAL_RESULTS: usize = 200;

// In src/mcp/dispatch.rs:
- const MAX_RETRIEVAL_RESULTS: usize = 200;
+ use super::MAX_RETRIEVAL_RESULTS;

// In src/mcp/retrieval.rs:
- const MAX_RETRIEVAL_RESULTS: usize = 200;
+ use super::MAX_RETRIEVAL_RESULTS;

// In src/mcp/retrieval.rs tool_glob:
-        let max = 200usize;
+        let max = MAX_RETRIEVAL_RESULTS;
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/mcp/dispatch.rs` at line 8, Define MAX_RETRIEVAL_RESULTS once in a shared
MCP location, then import and use it from dispatch.rs and retrieval.rs. Replace
retrieval.rs’s duplicate constant and tool_glob’s hardcoded 200usize with the
shared symbol, preserving the existing limit of 200 for all clamping paths.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/release.yml:
- Around line 122-123: Update the Checkout steps in both the test-platforms and
github-release jobs to set persist-credentials to false. Leave the existing
checkout action references and subsequent job behavior unchanged.

In `@src/commands/maintenance.rs`:
- Around line 175-186: Update cmd_audit before the strict failure path to
explicitly flush stdout after rendering the audit report and before
std::process::exit(1). Preserve the existing report output and exit behavior,
propagating any flush error consistently with the function’s Result return.

In `@src/commands/retrieval.rs`:
- Around line 15-21: Update cmd_search’s search_rich error branch to emit the
same structured JSON error response on stdout used by cmd_read and cmd_outline,
rather than printing to stderr and returning an empty success. Preserve the
existing successful results path and ensure failures remain represented
consistently for JSON consumers.

In `@src/edit.rs`:
- Around line 465-476: Update the temporary-file write closure around
file.write_all so permissions are applied immediately after the temp file is
created and before any content is written. Move the existing set_permissions
call ahead of write_all while preserving existing_permissions handling and its
contextual error message; leave the final sync behavior unchanged.

In `@src/mcp/mutation.rs`:
- Around line 34-44: Add the compact field to the unchanged response constructed
in the result.unchanged branch of the mutation handler, using the existing
compact value so its response shape matches the normal response while preserving
all other fields and behavior.

---

Nitpick comments:
In @.github/workflows/release.yml:
- Around line 114-129: Add a Cargo cache step to the test-platforms job,
alongside its Checkout and Install Rust steps, reusing the same cache
configuration and key strategy as the existing check and build jobs for
~/.cargo/registry and target. Keep the cargo test --locked command unchanged.

In `@install.ps1`:
- Around line 50-52: Update the Invoke-WebRequest call used to download
SHA256SUMS in the checksum setup flow to retry transient failures three times
with a two-second interval, using the appropriate implementation for the
script’s supported PowerShell versions; preserve the existing URI and output
path behavior.

In `@src/cli.rs`:
- Around line 367-368: Remove the unused structured_content field and its
structured-content/json-output argument definition from the Mcp CLI arguments in
the relevant command declaration. Update the dispatch pattern in the command
handling code to stop matching or ignoring structured_content, while preserving
reject_removed_output_flags as the sole handling for those removed flags.

In `@src/commands/maintenance.rs`:
- Around line 233-267: Debounce snapshot persistence in cmd_watch instead of
calling snapshot::write_snapshot immediately for every received event. Batch
rapid file changes over a short window, then perform one synchronous
write_snapshot call after the window expires, while preserving the existing
cli.no_graph guard and warning behavior.

In `@src/commands/retrieval.rs`:
- Around line 520-528: Update cmd_context to avoid building context twice:
branch on cli.json before invoking either builder, using
build_context_details_with_options only for JSON output and
build_context_with_options only for human-readable output. Preserve the existing
print_agent_result and println! behaviors.

In `@src/engine/context_helpers.rs`:
- Around line 18-48: Replace the seen HashSet parameter in
push_context_symbol_candidate with a HashMap<(String, String, SymbolKind, u32),
usize> and use the key to update the existing scored entry by index or append a
new ScoredContextSymbol and record its index. Update the caller in the context
flow to initialize and pass the map, preserving score filtering and
highest-score replacement behavior while removing the linear
scored.iter_mut().find scan.

In `@src/freshness.rs`:
- Around line 85-88: In the directory-event handling loop, add a mutable
one-shot flag alongside `work` and `seen`, and only call
`refresh_project_no_rebuild(engine, root)` once per refresh operation. Mark the
flag after the first successful project refresh; continue deduplicating paths
and processing subsequent events without repeating the full-tree scan.

In `@src/mcp/dispatch.rs`:
- Line 8: Define MAX_RETRIEVAL_RESULTS once in a shared MCP location, then
import and use it from dispatch.rs and retrieval.rs. Replace retrieval.rs’s
duplicate constant and tool_glob’s hardcoded 200usize with the shared symbol,
preserving the existing limit of 200 for all clamping paths.

In `@src/output/mod.rs`:
- Around line 55-93: Deduplicate the identical counting logic in
search_result_path_facets and word_result_path_facets by introducing a shared
helper that accepts an iterator of path strings and returns the facet Value.
Update both public functions to pass their results’ path values to this helper
while preserving the existing prefix handling, counting, ordering, and JSON
structure.

In `@xtask/src/main.rs`:
- Around line 141-151: Update the cargo argument list in run_bench to include
--locked alongside bench and the engine benchmark selection, ensuring benchmark
runs use the existing Cargo.lock without modifying or resolving dependency
versions.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 4adbdc31-c2e4-47e3-9456-0ea5bc178a24

📥 Commits

Reviewing files that changed from the base of the PR and between a22373c and 2e5f4e6.

⛔ Files ignored due to path filters (1)
  • Cargo.lock is excluded by !**/*.lock
📒 Files selected for processing (69)
  • .cargo/audit.toml
  • .github/workflows/release.yml
  • CHANGELOG.md
  • Cargo.toml
  • benches/engine.rs
  • docs/install.md
  • docs/tools.md
  • install.ps1
  • install.sh
  • justfile
  • src/application.rs
  • src/audit.rs
  • src/audit/config.rs
  • src/audit/rules.rs
  • src/audit/rules/architecture.rs
  • src/audit/rules/dead_code.rs
  • src/cache.rs
  • src/cli.rs
  • src/cli_tests.rs
  • src/cli_upgrade.rs
  • src/commands/graph.rs
  • src/commands/maintenance.rs
  • src/commands/mod.rs
  • src/commands/mutation.rs
  • src/commands/retrieval.rs
  • src/commands/shared.rs
  • src/edit.rs
  • src/engine/context.rs
  • src/engine/context_helpers.rs
  • src/engine/core.rs
  • src/engine/dep_graph.rs
  • src/engine/files.rs
  • src/engine/indexing.rs
  • src/engine/mod.rs
  • src/engine/persistence.rs
  • src/engine/search.rs
  • src/engine/shared.rs
  • src/engine/tests.rs
  • src/freshness.rs
  • src/index/symbol.rs
  • src/index/trigram.rs
  • src/index/word.rs
  • src/lib.rs
  • src/main.rs
  • src/mcp.rs
  • src/mcp/args.rs
  • src/mcp/diagnostics.rs
  • src/mcp/dispatch.rs
  • src/mcp/maintenance.rs
  • src/mcp/mod.rs
  • src/mcp/mutation.rs
  • src/mcp/response.rs
  • src/mcp/retrieval.rs
  • src/mcp/server.rs
  • src/mcp/tests.rs
  • src/mcp/tool_spec.rs
  • src/mcp/transport.rs
  • src/output.rs
  • src/output/compact.rs
  • src/output/guidance.rs
  • src/output/mod.rs
  • src/output/renderers.rs
  • src/output/tests.rs
  • src/output/time.rs
  • src/output/value.rs
  • src/snapshot.rs
  • src/types.rs
  • src/walker.rs
  • xtask/src/main.rs
💤 Files with no reviewable changes (3)
  • src/cache.rs
  • src/output.rs
  • src/mcp.rs

Comment thread .github/workflows/release.yml
Comment thread src/commands/maintenance.rs
Comment thread src/commands/retrieval.rs
Comment thread src/edit.rs
Comment thread src/mcp/mutation.rs
@indrazm

indrazm commented Jul 12, 2026

Copy link
Copy Markdown
Contributor Author

The refreshed audit passed. CI then surfaced ShellCheck SC2016 on an intentionally literal $PATH in the installer guidance. Added a one-line scoped suppression with an explanatory comment in 7da08a0; sh -n install.sh and diff checks pass locally.

@indrazm

indrazm commented Jul 12, 2026

Copy link
Copy Markdown
Contributor Author

Addressed all five actionable review threads in 9fbc708 and resolved them after verification. Local gate: fmt, clippy with warnings denied, 231 tests/bench targets, build, generated-doc sync, installer syntax, workflow YAML, and diff checks all pass.

@indrazm
indrazm merged commit b37fd8b into main Jul 12, 2026
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant