-
Notifications
You must be signed in to change notification settings - Fork 0
chore: pin rustsec/audit-check to SHA #40
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -13,5 +13,5 @@ thiserror = { workspace = true } | |
| reqwest = { version = "0.12", features = ["json", "rustls-tls"] } | ||
| async-trait = "0.1" | ||
| tracing = "0.1" | ||
| dashmap = "7.0" | ||
| "tokio::sync" = { version = "1.44", features = ["RwLock"] } | ||
| dashmap = "7.0.0-rc2" | ||
| "tokio/sync" = { version = "1.44", features = ["RwLock"] } | ||
|
Comment on lines
+16
to
+17
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🔴 Architect Review — CRITICAL The Suggestion: Remove the Fix in Cursor | Fix in VSCode Claude (Use Cmd/Ctrl + Click for best experience) Prompt for AI Agent 🤖This is an **Architect / Logical Review** comment left during a code review. These reviews are first-class, important findings — not optional suggestions. Do NOT dismiss this as a 'big architectural change' just because the title says architect review; most of these can be resolved with a small, localized fix once the intent is understood.
**Path:** crates/llm-router/Cargo.toml
**Line:** 16:17
**Comment:**
*CRITICAL: The `llm-router` manifest declares a dependency keyed as `"tokio/sync"` in `[dependencies]`, which is not a valid crate/dependency name and incorrectly models `tokio::sync` as a separate crate, causing `cargo` to fail dependency resolution for this manifest.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
If a suggested approach is provided above, use it as the authoritative instruction. If no explicit code suggestion is given, you MUST still draft and apply your own minimal, localized fix — do not punt back with 'no suggestion provided, review manually'. Keep the change as small as possible: add a guard clause, gate on a loading state, reorder an await, wrap in a conditional, etc. Do not refactor surrounding code or expand scope beyond the finding.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fixThere was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Invalid Cargo dependency name
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,174 @@ | ||
| // Integration tests for llm-router crate | ||
| // Traces to: FR-001 | ||
|
Comment on lines
+1
to
+2
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Suggestion: This integration test file is placed under the workspace root Severity Level: Major
|
||
|
|
||
| use llm_router::{ | ||
| CompletionRequest, CompletionResponse, LlmError, LlmRouter, LlmProvider, Message, TokenUsage, | ||
| }; | ||
|
Comment on lines
+1
to
+6
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🟠 Architect Review — HIGH New integration tests are added under the workspace-root Suggestion: Move these tests into the appropriate crate-specific Fix in Cursor | Fix in VSCode Claude (Use Cmd/Ctrl + Click for best experience) Prompt for AI Agent 🤖This is an **Architect / Logical Review** comment left during a code review. These reviews are first-class, important findings — not optional suggestions. Do NOT dismiss this as a 'big architectural change' just because the title says architect review; most of these can be resolved with a small, localized fix once the intent is understood.
**Path:** tests/llm_router_test.rs
**Line:** 1:6
**Comment:**
*HIGH: New integration tests are added under the workspace-root `tests/` in a virtual workspace (root `Cargo.toml` has only [workspace], no [package]), so `cargo test --workspace` (the documented/Just/Taskfile test command) never discovers or runs them, leaving the added coverage effectively dead.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
If a suggested approach is provided above, use it as the authoritative instruction. If no explicit code suggestion is given, you MUST still draft and apply your own minimal, localized fix — do not punt back with 'no suggestion provided, review manually'. Keep the change as small as possible: add a guard clause, gate on a loading state, reorder an await, wrap in a conditional, etc. Do not refactor surrounding code or expand scope beyond the finding.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix
Comment on lines
+1
to
+6
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🟠 Architect Review — HIGH The new integration tests are placed under the workspace root Suggestion: Move each test file into the corresponding crate's Fix in Cursor | Fix in VSCode Claude (Use Cmd/Ctrl + Click for best experience) Prompt for AI Agent 🤖This is an **Architect / Logical Review** comment left during a code review. These reviews are first-class, important findings — not optional suggestions. Do NOT dismiss this as a 'big architectural change' just because the title says architect review; most of these can be resolved with a small, localized fix once the intent is understood.
**Path:** tests/llm_router_test.rs
**Line:** 1:6
**Comment:**
*HIGH: The new integration tests are placed under the workspace root `tests/` directory, but the root `Cargo.toml` is a virtual workspace (has only `[workspace]` and no `[package]`), so these tests are not attached to any Cargo package and will not run under normal `cargo test --workspace` flows, providing no real execution coverage.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
If a suggested approach is provided above, use it as the authoritative instruction. If no explicit code suggestion is given, you MUST still draft and apply your own minimal, localized fix — do not punt back with 'no suggestion provided, review manually'. Keep the change as small as possible: add a guard clause, gate on a loading state, reorder an await, wrap in a conditional, etc. Do not refactor surrounding code or expand scope beyond the finding.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix
Comment on lines
+1
to
+6
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🟠 Architect Review — HIGH The new "integration tests" have been added under the workspace-root Suggestion: Move these tests into per-crate integration test directories (e.g., Fix in Cursor | Fix in VSCode Claude (Use Cmd/Ctrl + Click for best experience) Prompt for AI Agent 🤖This is an **Architect / Logical Review** comment left during a code review. These reviews are first-class, important findings — not optional suggestions. Do NOT dismiss this as a 'big architectural change' just because the title says architect review; most of these can be resolved with a small, localized fix once the intent is understood.
**Path:** tests/llm_router_test.rs
**Line:** 1:6
**Comment:**
*HIGH: The new "integration tests" have been added under the workspace-root `tests/` directory, but the root `Cargo.toml` is a virtual workspace (it has `[workspace]` and no `[package]`), so these tests are not owned by any crate and will not run under the documented `cargo test --workspace` flow.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
If a suggested approach is provided above, use it as the authoritative instruction. If no explicit code suggestion is given, you MUST still draft and apply your own minimal, localized fix — do not punt back with 'no suggestion provided, review manually'. Keep the change as small as possible: add a guard clause, gate on a loading state, reorder an await, wrap in a conditional, etc. Do not refactor surrounding code or expand scope beyond the finding.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix |
||
|
|
||
| /// Mock provider for testing | ||
| struct MockProvider { | ||
| name: String, | ||
| should_fail: bool, | ||
| } | ||
|
|
||
| impl MockProvider { | ||
| fn new(name: &str) -> Self { | ||
| Self { | ||
| name: name.to_string(), | ||
| should_fail: false, | ||
| } | ||
| } | ||
|
|
||
| fn failing(name: &str) -> Self { | ||
| Self { | ||
| name: name.to_string(), | ||
| should_fail: true, | ||
| } | ||
| } | ||
|
Comment on lines
+22
to
+27
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Suggestion: Remove the unused Severity Level: Minor Why it matters? 🤔The Fix in Cursor | Fix in VSCode Claude (Use Cmd/Ctrl + Click for best experience) Prompt for AI Agent 🤖This is a comment left during a code review.
**Path:** tests/llm_router_test.rs
**Line:** 22:27
**Comment:**
*Custom Rule: Remove the unused `MockProvider::failing` constructor or add a dedicated failure-path test that uses it, so the test target does not trigger `dead_code` under clippy with warnings denied.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix |
||
| } | ||
|
|
||
| #[::async_trait::async_trait] | ||
| impl LlmProvider for MockProvider { | ||
| async fn complete( | ||
| &self, | ||
| request: &CompletionRequest, | ||
| ) -> Result<CompletionResponse, LlmError> { | ||
| if self.should_fail { | ||
| return Err(LlmError::Provider("Mock failure".to_string())); | ||
| } | ||
|
|
||
| Ok(CompletionResponse { | ||
| content: format!("Mock response for model: {}", request.model), | ||
| model: request.model.clone(), | ||
| provider: self.name.clone(), | ||
| usage: TokenUsage { | ||
| prompt_tokens: 10, | ||
| completion_tokens: 20, | ||
| total_tokens: 30, | ||
| }, | ||
| latency_ms: 100, | ||
| }) | ||
| } | ||
|
|
||
| fn provider_name(&self) -> &str { | ||
| &self.name | ||
| } | ||
| } | ||
|
|
||
| #[test] | ||
| fn test_completion_request_serialization() { | ||
| let request = CompletionRequest { | ||
| model: "gpt-4".to_string(), | ||
| messages: vec![ | ||
| Message { | ||
| role: "user".to_string(), | ||
| content: "Hello".to_string(), | ||
| }, | ||
| ], | ||
| temperature: Some(0.7), | ||
| max_tokens: Some(100), | ||
| timeout_ms: Some(30000), | ||
| }; | ||
|
|
||
| let json = serde_json::to_string(&request).expect("Should serialize"); | ||
| assert!(json.contains("gpt-4")); | ||
| assert!(json.contains("Hello")); | ||
|
|
||
| let deserialized: CompletionRequest = | ||
| serde_json::from_str(&json).expect("Should deserialize"); | ||
| assert_eq!(deserialized.model, "gpt-4"); | ||
| } | ||
|
|
||
| #[test] | ||
| fn test_completion_response_serialization() { | ||
| let response = CompletionResponse { | ||
| content: "Test response".to_string(), | ||
| model: "gpt-4".to_string(), | ||
| provider: "openai".to_string(), | ||
| usage: TokenUsage { | ||
| prompt_tokens: 10, | ||
| completion_tokens: 20, | ||
| total_tokens: 30, | ||
| }, | ||
| latency_ms: 150, | ||
| }; | ||
|
|
||
| let json = serde_json::to_string(&response).expect("Should serialize"); | ||
| assert!(json.contains("Test response")); | ||
|
|
||
| let deserialized: CompletionResponse = | ||
| serde_json::from_str(&json).expect("Should deserialize"); | ||
| assert_eq!(deserialized.content, "Test response"); | ||
| assert_eq!(deserialized.usage.total_tokens, 30); | ||
| } | ||
|
|
||
| #[test] | ||
| fn test_llm_router_creation() { | ||
| let router = LlmRouter::new(); | ||
| assert!(router.providers.is_empty()); | ||
| assert!(router.fallback.is_none()); | ||
|
Comment on lines
+108
to
+109
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Suggestion: This integration test accesses private internals of Severity Level: Critical 🚨- ❌ `cargo test` fails compiling integration tests.
- ❌ CI pipeline with tests blocked on compilation error.Steps of Reproduction ✅1. From the workspace root `/workspace/phenoAI`, run `cargo test` to build and execute all
tests, including integration tests in `tests/`.
2. The integration test `tests/llm_router_test.rs` is compiled as an external test crate
which depends on the `llm-router` crate and imports `LlmRouter` at line 4.
3. The Rust compiler resolves `LlmRouter` to the definition in
`crates/llm-router/src/lib.rs:13-17`, where `providers` and `fallback` are private fields
(no `pub` keyword on lines 15-16).
4. During compilation of `test_llm_router_creation` at `tests/llm_router_test.rs:105-110`,
the expressions `router.providers` and `router.fallback` on lines 108-109 attempt to
access these private fields, causing compile-time errors like "no field `providers` on
type `LlmRouter`" and "field `fallback` of struct `LlmRouter` is private", and preventing
the test suite from compiling.Fix in Cursor | Fix in VSCode Claude (Use Cmd/Ctrl + Click for best experience) Prompt for AI Agent 🤖This is a comment left during a code review.
**Path:** tests/llm_router_test.rs
**Line:** 108:109
**Comment:**
*Api Mismatch: This integration test accesses private internals of `LlmRouter` (`providers` and `fallback`), which are not part of the public API and are inaccessible from `tests/`. The test will fail to compile; assert behavior through public methods (e.g., `complete`) instead of direct field reads.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix |
||
| } | ||
|
|
||
| #[test] | ||
| fn test_llm_router_register_provider() { | ||
| use std::sync::Arc; | ||
|
|
||
| let router = LlmRouter::new(); | ||
| let provider = Arc::new(MockProvider::new("test-provider")); | ||
|
|
||
| router.register_provider("test", provider); | ||
|
|
||
| assert_eq!(router.providers.len(), 1); | ||
| assert!(router.providers.contains_key("test")); | ||
| } | ||
|
Comment on lines
+106
to
+123
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🟠 Architect Review — HIGH The new "integration" tests are placed under the workspace root Suggestion: Move these tests into each crate's own Fix in Cursor | Fix in VSCode Claude (Use Cmd/Ctrl + Click for best experience) Prompt for AI Agent 🤖This is an **Architect / Logical Review** comment left during a code review. These reviews are first-class, important findings — not optional suggestions. Do NOT dismiss this as a 'big architectural change' just because the title says architect review; most of these can be resolved with a small, localized fix once the intent is understood.
**Path:** tests/llm_router_test.rs
**Line:** 106:123
**Comment:**
*HIGH: The new "integration" tests are placed under the workspace root `tests/` of a virtual manifest (no `[package]`), so they are not built or run by `cargo test --workspace` or standard Cargo flows, and they also access private `LlmRouter` fields (`providers`, `fallback`) in a way that would not compile as true integration tests. As written, these tests provide no effective coverage.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
If a suggested approach is provided above, use it as the authoritative instruction. If no explicit code suggestion is given, you MUST still draft and apply your own minimal, localized fix — do not punt back with 'no suggestion provided, review manually'. Keep the change as small as possible: add a guard clause, gate on a loading state, reorder an await, wrap in a conditional, etc. Do not refactor surrounding code or expand scope beyond the finding.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix |
||
|
|
||
| #[test] | ||
| fn test_llm_router_set_fallback() { | ||
| use std::sync::Arc; | ||
|
|
||
| let router = LlmRouter::new(); | ||
| let fallback = Arc::new(MockProvider::new("fallback")); | ||
|
|
||
| router.set_fallback(fallback); | ||
|
|
||
| assert!(router.fallback.is_some()); | ||
|
Comment on lines
+109
to
+134
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Suggestion: This assertion depends on direct access to Severity Level: Major
|
||
| } | ||
|
|
||
| #[test] | ||
| fn test_llm_error_display() { | ||
| let err = LlmError::Provider("test error".to_string()); | ||
| assert_eq!(format!("{}", err), "provider error: test error"); | ||
|
|
||
| let err = LlmError::RateLimited; | ||
| assert_eq!(format!("{}", err), "rate limited"); | ||
|
|
||
| let err = LlmError::Timeout; | ||
| assert_eq!(format!("{}", err), "timeout"); | ||
|
|
||
| let err = LlmError::InvalidModel("gpt-5".to_string()); | ||
| assert_eq!(format!("{}", err), "invalid model: gpt-5"); | ||
| } | ||
|
|
||
| #[test] | ||
| fn test_message_creation() { | ||
| let msg = Message { | ||
| role: "assistant".to_string(), | ||
| content: "I am here to help".to_string(), | ||
| }; | ||
|
|
||
| assert_eq!(msg.role, "assistant"); | ||
| assert_eq!(msg.content, "I am here to help"); | ||
| } | ||
|
|
||
| #[test] | ||
| fn test_token_usage() { | ||
| let usage = TokenUsage { | ||
| prompt_tokens: 100, | ||
| completion_tokens: 200, | ||
| total_tokens: 300, | ||
| }; | ||
|
|
||
| assert_eq!(usage.prompt_tokens, 100); | ||
| assert_eq!(usage.completion_tokens, 200); | ||
| assert_eq!(usage.total_tokens, 300); | ||
| } | ||


There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Dependency pinned to unstable release candidate version
Medium Severity
dashmapis pinned to"7.0.0-rc2", a release candidate. The latest stable version is6.1.0. If the crate truly needs dashmap 7.x features, this is a conscious tradeoff, but RC versions carry stability and API-change risks that are worth acknowledging — especially in a PR described as a routine CI pin.Reviewed by Cursor Bugbot for commit a856bb4. Configure here.