feat: v0.4 — Deterministic Engine Pipeline (Rules + Bundling + Context Chain) by ajianaz · Pull Request #148 · codecoradev/cora-cli

ajianaz · 2026-06-03T05:02:09Z

Summary

Implements the v0.4 engine pipeline (#147) — three-phase deterministic analysis layer that runs before LLM review.

Changes

Phase 1: Deterministic Rule Engine (#116)

diff_parser.rs — Parse unified diff into FileChunk/DiffHunk/DiffLine with language detection (70+ extensions)
rules/ — Rule engine with 6 built-in rules (security, SQL injection, TODO) + custom YAML rules via .cora.yaml
Rules always report (zero false negative), no LLM dismissal
Glob-based file matching for exclude/include patterns

Phase 2: File Bundling (#115)

bundling/ — Smart grouping by directory + language family with configurable limits
.cora.yaml config: strategy, max_chars_per_group, max_files_per_group
Module created (34 tests) — parallel review deferred to v0.5 (needs llm.rs changes)

Phase 3: Context Chain (#114)

context/ — Cross-file dependency extraction for 5 languages (Rust, Python, JS, Go, Java)
Regex-based symbol extraction (imports, function calls, type references)
Token-budgeted context injection into LLM prompt
.cora.yaml config: review.context_chain.enabled, max_context_tokens, follow_depth

Schema Extension

BundlingConfig, ContextConfig, RulesConfig added to Config and .cora.yaml parsing

Test Results

351 tests passing, 0 failures
4 clippy warnings (expected dead code — bundling parallel review not yet wired)
cargo check clean, cargo fmt applied

What's Deferred to v0.5

Parallel bundle review — needs llm.rs refactor to accept per-bundle diffs
Tree-sitter / syn AST parsing — currently regex-only for cross-file resolution
Test coverage mapping — context chain has test file discovery but not wired

Closes #116, #115, #114. Epic: #147

- Add diff_parser.rs: parse unified diff into FileChunk/DiffHunk/DiffLine with language detection, line tracking, binary/new/deleted file support - Add rules/ module (4 files): RuleEngine with 12 built-in rules + custom YAML rules, regex matching with language/exclude filters, post-match filter for localhost URL exclusion - Extend schema.rs: RulesConfig for .cora.yaml integration - Update review.rs: rule engine integration (pre-LLM + merge findings) - Add detect_language() with 40+ extensions incl. image/document/lock - All 266 tests pass, cargo clippy clean Refs: #116, #147 (v0.4 Engine Pipeline)

- Add bundling/ (3 files): Smart grouping by directory/language, flat batching, merge small groups, BundlingConfig with 34 tests - Add context/ (4 files): Symbol extraction (imports, fn calls, types) per language (Rust/Python/JS/Go/Java), cross-file resolver with token budget, ContextConfig - Extend schema.rs: BundlingConfig, ContextConfig in ReviewSection - 351 tests pass Refs: #115, #114, #147 (v0.4 Engine Pipeline)

- Wire context chain extraction into review_diff_inner() - Context chain text injected after rules/static analysis context - 351 tests pass, compiles clean Refs: #114, #147 (v0.4 Engine Pipeline)

- Remove duplicate #[allow(dead_code)] in bundling mod.rs - Fix duplicate ContextConfig import in context mod.rs - Fix private GroupingStrategy re-export path - Use struct field init instead of Default + reassign - Use rsplit_once instead of manual suffix stripping - 351 tests pass, 4 clippy warnings (expected dead code) Refs: #147 (v0.4 Engine Pipeline)

Refs: #147 (v0.4 Engine Pipeline)

github-actions · 2026-06-03T05:03:33Z

🔍 Cora AI Code Review

❌ Blocked — critical issues found.

🔴 Error (3)

src/engine/rules/matching.rs:30 — The match_rule_against_line function compiles a new Regex for every rule × line combination. For a diff with N added lines and R rules, this compiles N×R regexes. Regex compilation is expensive — this should use pre-compiled LazyLock<Regex> or a compiled cache.
src/engine/rules/builtin.rs:20 — The pattern r##"format!(\"SELECT|f\"SELECT|..."## uses ##-delimited raw strings but then tries to escape quotes with \" inside a raw string — backslash escapes don't work in Rust raw strings. The \" will be literal backslash-quote, not a quote. This means the regex won't match the intended format!("SELECT... or f"SELECT... patterns. The query \+\= part also has unnecessary escaping.
src/engine/review.rs:145 — The context chain resolver uses std::env::current_dir() as the project root. This is fragile — if the CLI is invoked from a subdirectory, or in CI where the working directory may differ, symbol resolution will fail to find files. The actual project root should be determined from the git repository or passed through from the caller.

Review powered by cora-cli · BYOK · MIT

Previously, if the LLM call returned an error (auth, timeout, network), all deterministic rule findings were silently discarded because the ? operator propagated the error before merge. Now: on LLM failure, if rule findings exist, return a fallback ReviewResponse with only deterministic findings. This ensures pre-commit hooks always surface security/best-practice violations regardless of LLM availability.

- Add #[allow(dead_code)] to v0.5-forward items (ExtractedSymbol, ContextChain.stats, extract_added_lines, parse_and_run_rules) - Run cargo fmt on all files (context/extraction.rs, types.rs, review.rs, matching.rs import order)

+            return true;
+        }
+    }
+


- Reverse upload-sarif default to true (opt-out, not opt-in) - Rename SARIF tool driver to CodeCora (branding) - Add fullName field: codecoradev/cora-cli - Update watermark: Reviewed by CodeCora vX.Y.Z - Add test for fullName field verification

+                "{ctx}\n\n## Cross-file Context\n{context_chain_text}",
+                context_chain_text = context_chain.text
+            )),
+            None => Some(format!("## Cross-file Context\n{}", context_chain.text)),


+        },
+        CustomRule {
+            id: "sec-sql-concat".to_string(),
+            pattern: r##"format!\("SELECT|f"SELECT|f"INSERT|f"UPDATE|f"DELETE|query\s*\+="##


CTO Hermes added 5 commits June 3, 2026 11:42

feat: integrate context chain into review pipeline

32ecbe9

- Wire context chain extraction into review_diff_inner() - Context chain text injected after rules/static analysis context - 351 tests pass, compiles clean Refs: #114, #147 (v0.4 Engine Pipeline)

docs: CHANGELOG — v0.4 features (rules, bundling, context chain)

b648f81

Refs: #147 (v0.4 Engine Pipeline)

CTO Hermes added 2 commits June 3, 2026 13:10

fix: CI compliance — clippy -D warnings + cargo fmt

e103f13

- Add #[allow(dead_code)] to v0.5-forward items (ExtractedSymbol, ContextChain.stats, extract_added_lines, parse_and_run_rules) - Run cargo fmt on all files (context/extraction.rs, types.rs, review.rs, matching.rs import order)

github-advanced-security AI found potential problems Jun 3, 2026

View reviewed changes

Comment thread src/engine/rules/builtin.rs Fixed

Comment thread src/engine/rules/matching.rs

return true;

}

}

ajianaz force-pushed the feat/v0.4-engine branch from d704dba to c9832fc Compare June 3, 2026 07:53

github-advanced-security AI found potential problems Jun 3, 2026

View reviewed changes

ajianaz merged commit f1558b5 into develop Jun 3, 2026
7 of 9 checks passed

ajianaz deleted the feat/v0.4-engine branch June 3, 2026 08:01

ajianaz mentioned this pull request Jun 3, 2026

Epic: v0.4 — Deterministic Engine Pipeline (Rules + Bundling + Context Chain) #147

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: v0.4 — Deterministic Engine Pipeline (Rules + Bundling + Context Chain)#148

feat: v0.4 — Deterministic Engine Pipeline (Rules + Bundling + Context Chain)#148
ajianaz merged 8 commits into
developfrom
feat/v0.4-engine

ajianaz commented Jun 3, 2026

Uh oh!

github-actions Bot commented Jun 3, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

ajianaz commented Jun 3, 2026

Summary

Changes

Phase 1: Deterministic Rule Engine (#116)

Phase 2: File Bundling (#115)

Phase 3: Context Chain (#114)

Schema Extension

Test Results

What's Deferred to v0.5

Uh oh!

github-actions Bot commented Jun 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 Cora AI Code Review

🔴 Error (3)

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions Bot commented Jun 3, 2026 •

edited

Loading