Feat/symbol graph by lohitkolluri · Pull Request #25 · lohitkolluri/codasaurus

lohitkolluri · 2026-08-02T20:35:12Z

No description provided.

Tier-1 detectors get base 5; heuristic detectors base 3; LLM-authored findings default to 4. Optional BYOK LLM judge re-scores findings with a rationale; drop_ungrounded filters confidence <= 1. v18 migration adds confidence + judge_rationale to findings. New [confidence] config. Signed-off-by: Lohit Kolluri <lohitkolluri@gmail.com>

…ooltip Signed-off-by: Lohit Kolluri <lohitkolluri@gmail.com>

Add a whole-repo symbol graph (repo_symbols, repo_edges, index_status via v19 migration) with per-language tree-sitter extraction for Rust, Go, Python, JS/TS. IndexConfig gates languages and file caps under [index]. Symbols and CALLS/IMPORTS/EXTENDS/DEFINES edges feed review-time blast-radius retrieval (impact command and review walkthrough). Signed-off-by: Lohit Kolluri <lohitkolluri@gmail.com>

- replace_file_index now deletes DEFINES/IMPORTS edges (from_symbol is the file path, not a symbol name) so incremental rebuilds leave no stale rows - Rust impl_item and Python class methods qualify as Type::method; scope stack carries qualified names so CALLS edges inside methods point at the method, not a bare name - JS member_expression calls resolve to the property name, not the full member text - list_repo_files filters to indexed languages before truncating max_files so the cap is not spent on non-code blobs Signed-off-by: Lohit Kolluri <lohitkolluri@gmail.com>

Re-parse added/modified source files after each push, reusing the index store. Skips deleted branches (all-zero head SHA) and non-indexed extensions. Best-effort: token or fetch failures log and skip. Signed-off-by: Lohit Kolluri <lohitkolluri@gmail.com>

@impact and the review blast-radius section now append indexed callers of symbols defined in changed files (CALLS/EXTENDS edges from the symbol graph), showing callers across the whole repo instead of just the diff. Empty index falls back to the existing diff-only report. Signed-off-by: Lohit Kolluri <lohitkolluri@gmail.com>

codasaurus-e0a6 · 2026-08-02T20:37:47Z

Codasaurus

This PR updates 39 files across src, (root), docs. I found 3 things to fix before merge. Start with the list below.

Findings

Severity	Finding
blocking	Import not listed in the project (`extract`) in `src/index/mod.rs:7`
blocking	Import not listed in the project (`sqlx`) in `src/index/store.rs:5`
blocking	Import not listed in the project (`tree_sitter`) in `src/index/extract.rs:7`
warning	Unfinished TODO left in in `src/confidence.rs:25`

Copy this into your AI coding agent

Paste this prompt into Cursor, Copilot, or another coding agent:

You are fixing Codasaurus review findings on a GitHub pull request.

## Rules
- Change only what is required to resolve the findings below.
- Do not refactor unrelated code or add features.
- Prefer the smallest correct diff.
- `tests/fixtures/golden/` and `golden/*/input.*` files intentionally contain sample secrets/TODOs for detector tests — do not "fix" those unless the PR is explicitly changing the fixture contract.
- Workspace crate imports in `tests/` (e.g. `use codasaurus::…`) are expected — do not add them to Cargo.toml.
- If a finding is a false positive, say so instead of changing code.
- After edits, summarize what you changed and why.

## Findings (priority order)
### 1. [blocking] Import not listed in the project (`tree_sitter`)
- **Location:** `src/index/extract.rs`:7
- **Detector:** `phantom-deps`
- **Issue:** `tree_sitter` is imported but missing from the project manifest. Fresh installs and CI will break.
- **Fix:** Add `tree_sitter` to your package manager's dependency file.

- **Evidence:** tree_sitter::

### 2. [blocking] Import not listed in the project (`extract`)
- **Location:** `src/index/mod.rs`:7
- **Detector:** `phantom-deps`
- **Issue:** `extract` is imported but missing from the project manifest. Fresh installs and CI will break.
- **Fix:** Add `extract` to your package manager's dependency file.

- **Evidence:** extract::FileIndex

### 3. [blocking] Import not listed in the project (`sqlx`)
- **Location:** `src/index/store.rs`:5
- **Detector:** `phantom-deps`
- **Issue:** `sqlx` is imported but missing from the project manifest. Fresh installs and CI will break.
- **Fix:** Add `sqlx` to your package manager's dependency file.

- **Evidence:** sqlx::Row

### 4. [warning] Unfinished TODO left in
- **Location:** `src/confidence.rs`:25
- **Detector:** `todo-leaks`
- **Issue:** A `TODO` / `FIXME` marker was committed. Finish the work or remove the marker before merge.
- **Fix:** Complete the implementation or remove the placeholder.

- **Evidence:** | "guidelines" | "todo-leaks" | "policy" => 3,

## PR context
Title: Feat/symbol graph

Changes

Path	What changed
`Cargo.toml`	updated
`docs/codasaurus-toml.md`	updated
`src/bot/commands.rs`	updated
`src/bot/concern.rs`	updated
`src/bot/markdown.rs`	updated
`src/bot/mod.rs`	updated
`src/bot/policy.rs`	updated
`src/bot/provenance.rs`	updated
…31 more

All files (39)

Cargo.toml (modified)
docs/codasaurus-toml.md (modified)
src/bot/commands.rs (modified)
src/bot/concern.rs (modified)
src/bot/markdown.rs (modified)
src/bot/mod.rs (modified)
src/bot/policy.rs (modified)
src/bot/provenance.rs (modified)
src/bot/quality.rs (modified)
src/bot/review/findings.rs (modified)
src/bot/review/mod.rs (modified)
src/bot/review/persist.rs (modified)
src/bot/review/pipeline.rs (modified)
src/bot/worker.rs (modified)
src/confidence.rs (added)
src/config.rs (modified)
src/db/migrations.rs (modified)
src/db/models.rs (modified)
src/detectors/graph.rs (modified)
src/detectors/guidelines.rs (modified)
src/detectors/hallucinated_imports.rs (modified)
src/detectors/iac.rs (modified)
src/detectors/license_drift.rs (modified)
src/detectors/lockfile_drift.rs (modified)
src/detectors/mod.rs (modified)
src/detectors/phantom_deps.rs (modified)
src/detectors/risky_patterns.rs (modified)
src/detectors/security.rs (modified)
src/detectors/slop.rs (modified)
src/detectors/stale_api.rs (modified)
src/detectors/style.rs (modified)
src/detectors/vulnerabilities.rs (modified)
src/gates.rs (modified)
src/index/extract.rs (added)
src/index/mod.rs (added)
src/index/store.rs (added)
src/lib.rs (modified)
src/llm/mod.rs (modified)
svelte-dashboard/src/pages/app/ReviewDetail.svelte (modified)

codasaurus-e0a6 · 2026-08-02T20:37:48Z

Context

Blast radius

Sensitive path: src/bot/mod.rs (+4)

Blast details

High-sensitivity paths:

src/bot/mod.rs
src/bot/review/mod.rs
src/detectors/mod.rs
src/index/mod.rs
src/llm/mod.rs

Top imports in this PR:

super:: (4 importers)

_{Bounded estimate from PR imports only.}

Dependencies

Dependency delta

Cargo.toml

removed aho-corasick
removed anyhow
removed argon2
removed axum
removed base64
removed chrono
removed clap
removed dirs
removed hex
removed hmac
removed http-body-util
removed jsonwebtoken
removed petgraph
removed regex
removed reqwest
removed serde
removed serde_json
removed sha2
removed sqlx
removed subtle
removed tokio
removed toml
removed tower
removed tower-http
removed tracing
removed tracing-subscriber
removed url
removed uuid
removed walkdir

_{From manifest diffs only.}

Related pull requests

feat: confidence score (0-5) + optional LLM judge #24: feat: confidence score (0-5) + optional LLM judge (4 shared files)
Review maturity: advisory gate, grounding, concerns, eval, learning guard #19: Review maturity: advisory gate, grounding, concerns, eval, learning guar (3 shared files)
Copyable AI fix prompt + review comment polish #17: Copyable AI fix prompt + review comment polish

codasaurus-e0a6 · 2026-08-02T20:37:49Z

Checks

Before merge

No blocking findings
- Work through the Findings list (items marked blocking), then push again.
Warning budget within limit
- At most 0 warnings allowed. Clear the notes on the Files tab, or ask a teammate.
PR has a title

Reviewer time ~50 min (5/5 · Critical · 39 files)

Commands

Type as plain text (GitHub Apps are not @-mentionable):

review · describe · summarize · improve · security · ask … · ignore <fp> · help

_{Full list: @codasaurus help}

codasaurus-e0a6

Codasaurus

Commit adf5fdd: please fix the items in the Findings list, then check the 4 inline comments.

codasaurus-e0a6 · 2026-08-02T20:37:50Z

+//! CALLS / IMPORTS / EXTENDS / DEFINES edges. Unresolvable names are kept as
+//! plain text — the graph is best-effort and query time does the matching.
+
+use tree_sitter::{Language, Node, Parser};


Needs fix · Import not listed in the project (tree_sitter)

Do this: Add tree_sitter to your package manager's dependency file.

Why it matters

tree_sitter is imported but missing from the project manifest. Fresh installs and CI will break.

detector: phantom-deps
source: tier1
evidence: https://crates.io/search?q=tree_sitter
snippet: tree_sitter::

Suggested change

use tree_sitter::{Language, Node, Parser};

cargo add tree_sitter

Dismiss / fix commands

fingerprint: 01baf6b990e3

@codasaurus ignore 01baf6b990e3 · 👎 to dismiss · @codasaurus fix 01baf6b990e3 (needs Contents Write + allow_auto_fix)

codasaurus-e0a6 · 2026-08-02T20:37:50Z

+pub mod store;
+
+use crate::config::IndexConfig;
+use extract::FileIndex;


Needs fix · Import not listed in the project (extract)

Do this: Add extract to your package manager's dependency file.

Why it matters

extract is imported but missing from the project manifest. Fresh installs and CI will break.

detector: phantom-deps
source: tier1
evidence: https://crates.io/search?q=extract
snippet: extract::FileIndex

Suggested change

use extract::FileIndex;

cargo add extract

Dismiss / fix commands

fingerprint: b690af097e0c

@codasaurus ignore b690af097e0c · 👎 to dismiss · @codasaurus fix b690af097e0c (needs Contents Write + allow_auto_fix)

codasaurus-e0a6 · 2026-08-02T20:37:50Z

+
+use crate::db::DbPool;
+use crate::index::extract::FileIndex;
+use sqlx::Row;


Needs fix · Import not listed in the project (sqlx)

Do this: Add sqlx to your package manager's dependency file.

Why it matters

sqlx is imported but missing from the project manifest. Fresh installs and CI will break.

detector: phantom-deps
source: tier1
evidence: https://crates.io/search?q=sqlx
snippet: sqlx::Row

Suggested change

use sqlx::Row;

cargo add sqlx

Dismiss / fix commands

fingerprint: 294050218c7d

@codasaurus ignore 294050218c7d · 👎 to dismiss · @codasaurus fix 294050218c7d (needs Contents Write + allow_auto_fix)

codasaurus-e0a6 · 2026-08-02T20:37:50Z

+        | "risky-patterns" => 5,
+        "vulnerabilities" => 3,
+        "boilerplate" | "over-engineering" | "slop-detection" | "stale-api" | "graph"
+        | "guidelines" | "todo-leaks" | "policy" => 3,


Note · Unfinished TODO left in

Do this: Complete the implementation or remove the placeholder.

Why it matters

A TODO / FIXME marker was committed. Finish the work or remove the marker before merge.

detector: todo-leaks
source: tier1
snippet: | "guidelines" | "todo-leaks" | "policy" => 3,

Dismiss / fix commands

fingerprint: a44b36868e15

@codasaurus ignore a44b36868e15 · 👎 to dismiss

lohitkolluri added 6 commits August 3, 2026 01:33

feat(dashboard): show finding confidence badge with judge rationale t…

e2b3702

…ooltip Signed-off-by: Lohit Kolluri <lohitkolluri@gmail.com>

lohitkolluri merged commit 03002f3 into main Aug 2, 2026
6 checks passed

codasaurus-e0a6 Bot suggested changes Aug 2, 2026

View reviewed changes

codasaurus-e0a6 Bot added dependencies documentation Improvements or additions to documentation labels Aug 2, 2026

This was referenced Aug 2, 2026

Feat/merge readiness #27

Merged

feat(bot): natural-language pre-merge checks (Phase 5) #28

Merged

feat(bot): learned-rules wiki with approval gate (Phase 6) #29

Merged

feat: merge-readiness, pre-merge checks, learned-rules wiki (Phases 4-6) #30

Merged

Navigation Menu

Feat/symbol graph - #25

Feat/symbol graph#25
lohitkolluri merged 6 commits into
mainfrom
feat/symbol-graph

lohitkolluri commented Aug 2, 2026

Uh oh!

Uh oh!

codasaurus-e0a6 Bot commented Aug 2, 2026

Uh oh!

codasaurus-e0a6 Bot commented Aug 2, 2026

Uh oh!

codasaurus-e0a6 Bot commented Aug 2, 2026

Uh oh!

codasaurus-e0a6 Bot left a comment

Uh oh!

codasaurus-e0a6 Bot Aug 2, 2026

Uh oh!

codasaurus-e0a6 Bot Aug 2, 2026

Uh oh!

codasaurus-e0a6 Bot Aug 2, 2026

Uh oh!

codasaurus-e0a6 Bot Aug 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

	use tree_sitter::{Language, Node, Parser};
	cargo add tree_sitter

Conversation

lohitkolluri commented Aug 2, 2026

Uh oh!

Uh oh!

codasaurus-e0a6 Bot commented Aug 2, 2026

Codasaurus

Findings

Changes

Uh oh!

codasaurus-e0a6 Bot commented Aug 2, 2026

Context

Blast radius

Dependencies

Related pull requests

Uh oh!

codasaurus-e0a6 Bot commented Aug 2, 2026

Checks

Before merge

Uh oh!

codasaurus-e0a6 Bot left a comment

Choose a reason for hiding this comment

Codasaurus

Uh oh!

codasaurus-e0a6 Bot Aug 2, 2026

Choose a reason for hiding this comment

Uh oh!

codasaurus-e0a6 Bot Aug 2, 2026

Choose a reason for hiding this comment

Uh oh!

codasaurus-e0a6 Bot Aug 2, 2026

Choose a reason for hiding this comment

Uh oh!

codasaurus-e0a6 Bot Aug 2, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant