Audit panic paths, split config domains, and align release metadata by EvalOpsBot · Pull Request #37 · evalops/diffscope

EvalOpsBot · 2026-03-13T21:15:04Z

Summary

harden the highest-risk production parser panic paths by removing capture-group unwrap/expect usage in LLM response, diff, secret scanning, and verification parsing
reorganize Config into flattened Vault, GitHub, Agent, and Verification domain structs while migrating a slice of the command tree to idiomatic mod.rs modules
align release metadata with 0.5.26, add a release workflow guard for tag/version drift, and pin the Rust toolchain so the current dependency graph is reproducible
merge the latest main changes, resolve conflicts in the eval/config/verification pipeline, and preserve the diff parser fix for zero-count hunks

Testing

cargo test

Slack Thread

Co-authored-by: EvalOpsBot <EvalOpsBot@users.noreply.github.com>

haasonsaas · 2026-03-13T21:23:21Z

@cursor review and resolve merge conflicts

cursor · 2026-03-13T21:23:26Z

Skipping Bugbot: Bugbot is disabled for this repository. Visit the Bugbot dashboard to update your settings.

haasonsaas · 2026-03-13T21:52:41Z

@cursor review and resolve merge conflicts

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Bugbot Autofix prepared a fix for the issue found in the latest run.

✅ Fixed: Filter in parse_optional_capture rejects valid zero line counts
- Removed the zero-value filter so hunk headers preserve valid 0 line counts, and added regression assertions for new and deleted file hunks.

src/core/diff_parser.rs

sentry · 2026-03-13T21:55:51Z

src/core/diff_parser.rs

+fn parse_optional_capture(captures: &regex::Captures<'_>, group: usize) -> Option<usize> {
+    captures
+        .get(group)
+        .and_then(|value| value.as_str().parse::<usize>().ok())


Bug: The parse_optional_capture function incorrectly converts 0 to 1 for line counts in diff hunk headers, breaking parsing for new files, deleted files, and pure insertion/deletion hunks.
_{Severity: CRITICAL}

Suggested Fix

Remove the .filter(|value| *value > 0) call within the parse_optional_capture function. This will allow the parser to correctly handle 0 as a valid line count in diff hunk headers, which is necessary for new files, deleted files, and pure insertion/deletion hunks.

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not valid. Location: src/core/diff_parser.rs#L478 Potential issue: In `diff_parser.rs`, the `parse_optional_capture` function uses `.filter(|value| *value > 0)` followed by `.unwrap_or(1)`. This incorrectly converts a line count of `0` in a diff hunk header to `1`. This affects hunks for new files, deleted files, and pure insertions/deletions. The hunk termination logic `consumed_old >= old_lines && consumed_new >= new_lines` then fails because one of the conditions (e.g., `consumed_old >= 1` for a new file) can never be met. This causes the parser to read past the end of the hunk, corrupting the parsed diff output.

_{Did we get this right? 👍 / 👎 to inform future reviews.}

haasonsaas · 2026-03-13T22:24:45Z

@cursor resolve the merge conflictss and address all feedback

cursor · 2026-03-13T22:24:51Z

Bugbot Autofix prepared a fix for the issue found in the latest run.

✅ Fixed: Filter in parse_optional_capture rejects valid zero line counts
- Removed the zero-value filter so hunk headers preserve valid 0 line counts, and added regression assertions for new and deleted file hunks.

- release: use python3 -c one-liners for version check (avoid heredoc that actionlint parses as YAML) - Apply clippy uninlined_format_args fixes across codebase for lint job Made-with: Cursor

…hub) Made-with: Cursor

sentry · 2026-03-14T17:39:51Z

src/config.rs

    #[serde(default = "default_false")]
    pub multi_pass_specialized: bool,

-    /// Enable agent loop for iterative tool-calling review (default false).
-    #[serde(default)]
-    pub agent_review: bool,
-
-    /// Maximum number of LLM round-trips in agent mode (default 10).
-    #[serde(default = "default_agent_max_iterations")]
-    pub agent_max_iterations: usize,
-
-    /// Optional total token budget for agent loop.
-    #[serde(default)]
-    pub agent_max_total_tokens: Option<usize>,
-
-    /// Which agent tools are enabled. None = all tools enabled.
-    #[serde(default)]
-    pub agent_tools_enabled: Option<Vec<String>>,
+    #[serde(default, flatten)]
+    pub agent: AgentConfig,

-    /// Whether to run the verification pass on review comments (default true).
-    #[serde(default = "default_true")]
-    pub verification_pass: bool,
-
-    /// Which model role to use for the verification pass (default Weak).
-    #[serde(default = "default_verification_model_role")]
-    pub verification_model_role: ModelRole,
-
-    /// Additional model roles used as verification judges.
-    #[serde(default = "default_verification_additional_model_roles")]
-    pub verification_additional_model_roles: Vec<ModelRole>,
-
-    /// How multiple verification judges should be combined.
-    #[serde(default = "default_verification_consensus_mode")]
-    pub verification_consensus_mode: VerificationConsensusMode,
-
-    /// Minimum verification score to keep a comment (0-10, default 5).
-    #[serde(default = "default_verification_min_score")]
-    pub verification_min_score: u8,
-
-    /// Maximum number of comments to send through verification (default 20).
-    #[serde(default = "default_verification_max_comments")]
-    pub verification_max_comments: usize,
-
-    /// When true, keep original comments if the verification pass fails or
-    /// returns an unparseable response (default false).
-    #[serde(default = "default_false")]
-    pub verification_fail_open: bool,
+    #[serde(default, flatten)]
+    pub verification: VerificationConfig,

    /// Enable enhanced feedback loop with per-category/file-pattern tracking
    /// and feedback-adjusted confidence scores (default false).


Bug: The Config struct uses #[serde(flatten)] on VerificationConfig, which contains enums. serde_yaml may fail to deserialize these fields, preventing config loading.
_{Severity: HIGH}

Suggested Fix

Add a test case that deserializes a YAML string containing the flattened enum fields (verification_model_role, verification_consensus_mode) to confirm the failure. If it fails, consider removing #[serde(flatten)] and nesting VerificationConfig under a verification: key in the YAML. This would make the structure explicit and avoid the serde_yaml bug.

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not valid. Location: src/config.rs#L396-L414 Potential issue: The `Config` struct uses `#[serde(flatten)]` on the `VerificationConfig` struct, which contains enum-typed fields like `model_role` and `consensus_mode`. Due to known issues in `serde_yaml` with deserializing enums within flattened structs, loading a YAML configuration file containing fields like `verification_model_role` will likely fail. This issue was introduced by refactoring the configuration structure without adding corresponding deserialization tests for these specific fields. A failure would prevent the application from starting or reloading its configuration if a user has these settings in their `.diffscope.yml` file.

Use symbol-graph related files to prioritize semantic RAG candidates before global similarity ranking, surface the graph-ranked hint in semantic context, add coverage for the ranking behavior, and mark TODO.md item #37 complete.

cursoragent and others added 6 commits March 13, 2026 21:02

fix: harden parser panic paths

e0d686b

Co-authored-by: EvalOpsBot <EvalOpsBot@users.noreply.github.com>

refactor: group config domains and trim path modules

15262ee

Co-authored-by: EvalOpsBot <EvalOpsBot@users.noreply.github.com>

fix: align release metadata with tagged version

82d6417

Co-authored-by: EvalOpsBot <EvalOpsBot@users.noreply.github.com>

build: pin jsonwebtoken for Rust 1.83

fcc9ecf

Co-authored-by: EvalOpsBot <EvalOpsBot@users.noreply.github.com>

build: pin Rust toolchain for current deps

1474077

Co-authored-by: EvalOpsBot <EvalOpsBot@users.noreply.github.com>

build: raise pinned Rust toolchain to 1.88

6e3b794

Co-authored-by: EvalOpsBot <EvalOpsBot@users.noreply.github.com>

haasonsaas marked this pull request as ready for review March 13, 2026 21:52

cursor bot reviewed Mar 13, 2026

View reviewed changes

src/core/diff_parser.rs Show resolved Hide resolved

sentry bot reviewed Mar 13, 2026

View reviewed changes

Preserve zero hunk line counts

904fa04

cursoragent and others added 3 commits March 13, 2026 22:29

Merge main and resolve review feedback

1b028c9

fix(ci): release.yml YAML parse + clippy uninlined_format_args

d20cd0d

- release: use python3 -c one-liners for version check (avoid heredoc that actionlint parses as YAML) - Apply clippy uninlined_format_args fixes across codebase for lint job Made-with: Cursor

Merge main; resolve config and API to branch shape (verification, git…

a412f14

…hub) Made-with: Cursor

sentry bot reviewed Mar 14, 2026

View reviewed changes

haasonsaas merged commit e39c31a into main Mar 14, 2026
12 checks passed

haasonsaas deleted the cursor/codebase-health-audit-5da4 branch March 14, 2026 17:40

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Audit panic paths, split config domains, and align release metadata#37

Audit panic paths, split config domains, and align release metadata#37
haasonsaas merged 10 commits intomainfrom
cursor/codebase-health-audit-5da4

EvalOpsBot commented Mar 13, 2026 •

edited by cursor bot

Loading

Uh oh!

haasonsaas commented Mar 13, 2026

Uh oh!

cursor bot commented Mar 13, 2026

Uh oh!

haasonsaas commented Mar 13, 2026

Uh oh!

cursor bot left a comment •

edited

Loading

Uh oh!

Uh oh!

sentry bot Mar 13, 2026

Uh oh!

haasonsaas commented Mar 13, 2026

Uh oh!

cursor bot commented Mar 13, 2026 •

edited

Loading

Uh oh!

sentry bot Mar 14, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

EvalOpsBot commented Mar 13, 2026 • edited by cursor bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Testing

Uh oh!

haasonsaas commented Mar 13, 2026

Uh oh!

cursor bot commented Mar 13, 2026

Uh oh!

haasonsaas commented Mar 13, 2026

Uh oh!

cursor bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

sentry bot Mar 13, 2026

Choose a reason for hiding this comment

Uh oh!

haasonsaas commented Mar 13, 2026

Uh oh!

cursor bot commented Mar 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sentry bot Mar 14, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

EvalOpsBot commented Mar 13, 2026 •

edited by cursor bot

Loading

cursor bot left a comment •

edited

Loading

cursor bot commented Mar 13, 2026 •

edited

Loading