Skip to content

Fix DeepSource bug-risk alerts#84

Merged
jayvdb merged 1 commit into
mainfrom
deepsource-bug-risk
Jul 14, 2026
Merged

Fix DeepSource bug-risk alerts#84
jayvdb merged 1 commit into
mainfrom
deepsource-bug-risk

Conversation

@jayvdb

@jayvdb jayvdb commented Jul 14, 2026

Copy link
Copy Markdown
Member

Summary by CodeRabbit

  • Bug Fixes

    • Improved error reporting when telemetry logger initialization fails.
    • Improved reliability of WebSocket messaging, shutdown handling, and test server synchronization.
    • WebAssembly connection tests now properly wait for timeout completion.
  • Refactor

    • Simplified default initialization for device sensor components.
    • Clarified best-effort handling during process, thread, and channel shutdown.
    • Standardized environment variable access and ignored-result handling.

@coderabbitai

coderabbitai Bot commented Jul 14, 2026

Copy link
Copy Markdown

Review Change Stack

📝 Walkthrough

Walkthrough

Changes

Result handling and runtime cleanup

Layer / File(s) Summary
Initialization and teardown result handling
libs/et-otlp/src/lib.rs, libs/test-helpers/src/lib.rs, services/ws-pyo3-runner/tests/modules.rs
Logger initialization errors now propagate, while shutdown, process, thread, and stderr results are captured without changing best-effort teardown behavior.
WebSocket runtime result handling
services/ws-pyo3-runner/..., services/ws-test-server/tests/helpers.rs, services/ws-wasi-runner/src/host/ws.rs, services/ws-wasm-agent/tests/web.rs, services/ws/src/lib.rs
WebSocket channel, task, worker, socket, and promise results are explicitly captured; the scripted server task remains detached.
Constants and derived defaults
libs/edge-toolkit/src/config.rs, libs/path/src/lib.rs, services/ws-modules/har1/src/lib.rs, services/ws-modules/sensor1/src/lib.rs
Environment-variable literals are named with local constants, and both DeviceSensors types use derived Default implementations.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately reflects that the PR addresses DeepSource bug-risk alerts across the changed code.
Docstring Coverage ✅ Passed Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch deepsource-bug-risk

Comment @coderabbitai help to get the list of available commands.

@deepsource-io

deepsource-io Bot commented Jul 14, 2026

Copy link
Copy Markdown

DeepSource Code Review

We reviewed changes in 5632e3e...af888ec on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade   Security  

Reliability  

Complexity  

Hygiene  

Coverage  

Code Review Summary

Analyzer Status Updated (UTC) Details
C# Jul 14, 2026 2:53a.m. Review ↗
C & C++ Jul 14, 2026 2:53a.m. Review ↗
Docker Jul 14, 2026 2:53a.m. Review ↗
Java Jul 14, 2026 2:53a.m. Review ↗
JavaScript Jul 14, 2026 2:53a.m. Review ↗
Python Jul 14, 2026 2:53a.m. Review ↗
Rust Jul 14, 2026 2:53a.m. Review ↗
Secrets Jul 14, 2026 2:53a.m. Review ↗
Code coverage Jul 14, 2026 3:12a.m. Review ↗

Code Coverage Summary

Language Line Coverage (New Code) Line Coverage (Overall)
Aggregate
51.4%
51.4%
Python -
54.2%
Rust
51.4%
51.3%

➟ Additional coverage metrics may have been reported. See full coverage report ↗


Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

@codacy-production

Copy link
Copy Markdown

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics -4 complexity · 0 duplication

Metric Results
Complexity -4
Duplication 0

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

Run reviewer

TIP This summary will be updated as you push new changes.

@codecov

codecov Bot commented Jul 14, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 51.42857% with 17 lines in your changes missing coverage. Please review.
✅ All tests successful. No failed tests found.

Files with missing lines Patch % Lines
services/ws-pyo3-runner/src/agent.rs 0.00% 14 Missing ⚠️
services/ws/src/lib.rs 75.00% 2 Missing ⚠️
libs/path/src/lib.rs 0.00% 1 Missing ⚠️

📢 Thoughts on this report? Let us know!

@jayvdb
jayvdb marked this pull request as ready for review July 14, 2026 06:41
@jayvdb
jayvdb requested a review from pierre-tenedero July 14, 2026 06:41

@codacy-production codacy-production Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR successfully addresses multiple DeepSource bug-risk alerts by modernizing trait implementations and improving Result handling. Codacy analysis indicates the changes are up to standards with no new issues introduced. However, a significant functional change was identified in the OTLP initialization logic (libs/et-otlp/src/lib.rs) where the code now propagates errors instead of silently ignoring them. While this improves robustness, it may cause startup failures if the application environment relies on existing, partially initialized global loggers. Furthermore, a logic issue in the test teardown (services/ws-pyo3-runner/tests/modules.rs) introduces a race condition that could lead to flaky CI runs. The PR description is currently empty, which prevents proper tracking of the specific alerts being resolved.

About this PR

  • The shift from silent failure to error propagation in global logger initialization is a systemic change. Ensure that all entry points calling this initialization are prepared to handle a Result error, particularly in environments where a logger might already be configured.
  • The PR description is empty. Please provide the specific DeepSource alert IDs or a summary of the bug-risk categories being addressed to ensure all intended fixes are covered.

Test suggestions

  • Verify that LogTracer::init handles double-initialization or configuration errors by propagating the error as requested in the change.
  • Ensure DeviceSensors::default() correctly initializes all fields to the expected state (false/None) via the derived implementation.
  • Verify that mise_env_includes correctly reads the 'MISE_ENV' environment variable using the new constant.
Prompt proposal for missing tests
Consider implementing these tests if applicable:
1. Verify that LogTracer::init handles double-initialization or configuration errors by propagating the error as requested in the change.
2. Ensure DeviceSensors::default() correctly initializes all fields to the expected state (false/None) via the derived implementation.
3. Verify that mise_env_includes correctly reads the 'MISE_ENV' environment variable using the new constant.

TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback


drop(runner.kill());
drop(runner.wait());
runner.kill().unwrap();

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 MEDIUM RISK

This unwrap() introduces a race condition that can cause flaky tests if the runner exits just before kill() is called. Since wait() follows immediately, you can safely ignore the result of kill() to avoid unnecessary panics if the process is already dead.

Suggested change
runner.kill().unwrap();
let _ = runner.kill();

drop(inbound_tx);
drop(worker.join());
drop(socket.send(tungstenite::Message::Close(None)).await);
let _joined = worker.join();

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 MEDIUM RISK

Suggestion: Swallowing the join result hides panics in the dispatcher thread. Propagating the panic ensures that the agent fails visibly if the Python worker crashes.

Suggested change
let _joined = worker.join();
worker.join().expect("python worker thread panicked");

Comment thread libs/et-otlp/src/lib.rs
// through the tracing subscriber.
drop(tracing_log::LogTracer::init());
// through the tracing subscriber. A second init (global logger already set) is a real error here.
tracing_log::LogTracer::init()?;

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 MEDIUM RISK

Suggestion: Changed from silent ignore (drop) to error propagation (?). While this is a robustness improvement that prevents running with broken telemetry, it will cause initialization to fail if a global logger was already set elsewhere. Verify that callers are prepared to handle this change in return type.

}

#[wasm_bindgen]
#[derive(Default)]

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚪ LOW RISK

Suggestion: Manual Default implementation replaced by derive macro. This is a clean refactor that maintains the expected initialization state.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@services/ws-pyo3-runner/src/agent.rs`:
- Around line 159-169: Update the dispatch flow around the Connect and Shutdown
sends in run() to propagate inbound_tx.send failures instead of ignoring them,
while preserving shutdown ordering. Also propagate worker.join() failures so
worker termination or panic causes run() to return an error rather than
appearing successful.

In `@services/ws/src/lib.rs`:
- Around line 331-337: Update the direct-message delivery path around
recipient.send in the AgentMessage handling flow so its Result is checked rather
than discarded. Only report or count delivery as successful when send succeeds,
and handle failed sends consistently with the existing delivery-status behavior,
including broadcast delivery where applicable.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: c0873c4a-e108-4dec-8079-d61eaba2edfc

📥 Commits

Reviewing files that changed from the base of the PR and between 5632e3e and af888ec.

📒 Files selected for processing (12)
  • libs/edge-toolkit/src/config.rs
  • libs/et-otlp/src/lib.rs
  • libs/path/src/lib.rs
  • libs/test-helpers/src/lib.rs
  • services/ws-modules/har1/src/lib.rs
  • services/ws-modules/sensor1/src/lib.rs
  • services/ws-pyo3-runner/src/agent.rs
  • services/ws-pyo3-runner/tests/modules.rs
  • services/ws-test-server/tests/helpers.rs
  • services/ws-wasi-runner/src/host/ws.rs
  • services/ws-wasm-agent/tests/web.rs
  • services/ws/src/lib.rs

Comment on lines +159 to +169
let _connect_sent = inbound_tx.send(InboundEvent::Connect(agent_id));

let result = drive(&mut socket, &inbound_tx, &mut outbound_rx).await;

// Queue `on_shutdown` (the worker drains any frames ahead of it first),
// then drop our sender so the worker's recv loop ends. Join before aborting
// the storage task so an `on_shutdown` that persists state can still reach
// it; only then close the socket and stop storage.
drop(inbound_tx.send(InboundEvent::Shutdown));
let _shutdown_sent = inbound_tx.send(InboundEvent::Shutdown);
drop(inbound_tx);
drop(worker.join());
drop(socket.send(tungstenite::Message::Close(None)).await);
let _joined = worker.join();

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

sed -n '1,360p' services/ws-pyo3-runner/src/agent.rs

Repository: edge-toolkit/core

Length of output: 13589


🏁 Script executed:

rg -n "enum RunnerError|impl From<.*Join|SendError|worker.join|unbounded_channel|InboundEvent" services/ws-pyo3-runner/src -S

Repository: edge-toolkit/core

Length of output: 1770


🏁 Script executed:

sed -n '1,220p' services/ws-pyo3-runner/src/error.rs

Repository: edge-toolkit/core

Length of output: 1160


Propagate dispatch-worker failure instead of silently dropping events. If inbound_tx.send(...) fails, the Python worker is already gone, but run() keeps the socket alive and inbound frames are lost. Surface that error, and do the same for worker.join() so a worker panic does not look like a successful run.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@services/ws-pyo3-runner/src/agent.rs` around lines 159 - 169, Update the
dispatch flow around the Connect and Shutdown sends in run() to propagate
inbound_tx.send failures instead of ignoring them, while preserving shutdown
ordering. Also propagate worker.join() failures so worker termination or panic
causes run() to return an error rather than appearing successful.

Comment thread services/ws/src/lib.rs
Comment on lines +331 to +337
let _sent = recipient.send(SessionMessage::Json(ServerMessage::AgentMessage {
message_id: message_id.clone(),
from_agent_id,
scope: MessageScope::Direct,
server_received_at: pending.server_received_at,
message: pending.message,
})));
}));

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🏁 Script executed:

set -euo pipefail

# Show the relevant file and line ranges.
sed -n '300,360p' services/ws/src/lib.rs
printf '\n====\n'
sed -n '500,540p' services/ws/src/lib.rs
printf '\n====\n'
# Find delivery/status related enums or message variants in the same file.
rg -n "Delivered|Broadcast|Direct|send\\(" services/ws/src/lib.rs

Repository: edge-toolkit/core

Length of output: 6305


🏁 Script executed:

set -euo pipefail
printf 'Need tool output\n'

Repository: edge-toolkit/core

Length of output: 172


Don't mark direct or broadcast delivery as successful when send can fail. recipient.send(...) is ignored here, so a disconnect after the registry snapshot can still produce a false Delivered/broadcast status. Handle the error or count only successful sends.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@services/ws/src/lib.rs` around lines 331 - 337, Update the direct-message
delivery path around recipient.send in the AgentMessage handling flow so its
Result is checked rather than discarded. Only report or count delivery as
successful when send succeeds, and handle failed sends consistently with the
existing delivery-status behavior, including broadcast delivery where
applicable.

@jayvdb
jayvdb merged commit f469545 into main Jul 14, 2026
32 of 34 checks passed
@jayvdb
jayvdb deleted the deepsource-bug-risk branch July 14, 2026 07:42
@coderabbitai coderabbitai Bot mentioned this pull request Jul 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants