refactor: unwrap cleanup + 5-layer supply chain security#208
Merged
Conversation
Replace all .unwrap() calls in production code (non-test) with descriptive .expect() messages for better panic diagnostics: - user_dict: RwLock read/write (7 sites) → "user_dict lock poisoned" - reranker: .min().unwrap() → "paths guaranteed non-empty" - resegment/predictive/scoring: .last().unwrap() → invariant docs - wal: try_into/file unwraps → context messages - snippets/variables: chars.next().unwrap() → match invariant Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The surrounding trie_len/pool_len/entries_len already use try_into() with proper error handling, but reading_count used bare `as u32` which silently truncates on overflow. Align to the same pattern. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
本番コード内のパニック要因になり得る .unwrap() を .expect() に置き換えて、パニック時の診断情報を改善しつつ、trie_dict_io.rs の数値キャストを安全な変換に揃えるリファクタです。
Changes:
- WAL / ユーザー辞書 / 変換・スコアリング周辺で
.unwrap()を.expect()に置換し、不変条件をメッセージで明示 snippets/variablesの日付フォーマット処理で.expect()に置換trie_dict_io.rsのas u32をtry_into()に変更して範囲外をエラー化
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| engine/crates/lex-core/src/user_history/wal.rs | WAL フレーム解析・ファイルハンドル取得の unwrap を expect に置換 |
| engine/crates/lex-core/src/user_dict/mod.rs | RwLock read/write の unwrap を expect に置換（poison 時の診断改善） |
| engine/crates/lex-core/src/snippets/variables.rs | 日付フォーマットの未知指定子処理で unwrap を expect に置換 |
| engine/crates/lex-core/src/neural/scoring.rs | セグメント境界計算の unwrap を expect に置換 |
| engine/crates/lex-core/src/dict/trie_dict_io.rs | reading_count の as u32 を try_into() + エラーに変更 |
| engine/crates/lex-core/src/converter/resegment.rs | EOS 遷移計算で segments.last() の unwrap を expect に置換 |
| engine/crates/lex-core/src/converter/reranker.rs | min() 結果の unwrap を expect に置換（不変条件を明示） |
| engine/crates/lex-core/src/candidates/predictive.rs | path.last() の unwrap を expect に置換（空チェック後の不変条件） |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
…t messages
- trie_dict_io: 8 header field try_into().unwrap() → expect("4-byte header field")
- wal: distinguish "4-byte length field" from "4-byte CRC field" in expect messages
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Update candle-core and candle-nn to 0.10 and downgrade zip from yanked 7.4.0 to 7.2.0 to fix cargo-audit failure in CI. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Layer 1 - cargo-deny: advisories, licenses, sources, bans Layer 3 - Quarantine: reject deps published <7 days ago (crates.io API) Layer 4 - build.rs monitoring: detect new crates with build scripts Layer 5 - Cargo.lock sync: cargo check --locked in CI cargo-vet (Layer 2) will be added separately. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…ports Set up cargo-vet with shared audit imports covering 73 crates. Remaining 199 crates are exempted and will be audited incrementally. Also adds cargo-vet to CI and mise audit task. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
send
changed the title
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 18 out of 20 changed files in this pull request and generated 4 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- quarantine: fail-closed on API/parse errors instead of skipping - quarantine: use explicit registry+ pattern for Cargo.lock source match - check-build-scripts: remove stderr suppression on cargo metadata - mise.toml: include cargo-vet in audit task description Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 18 out of 20 changed files in this pull request and generated 4 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Use printf '%s\n' instead of echo for comm input (shell portability) - Validate QUARANTINE_DAYS is a positive integer before arithmetic - Add curl timeouts and retry for crates.io API resilience - Apply same printf fix to check-build-scripts.sh Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 18 out of 20 changed files in this pull request and generated 1 comment.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
コード品質
.unwrap()を全て.expect()に置き換え（パニック時のデバッグ情報改善）trie_dict_io.rsのas u32をtry_into()に修正（隣接コードとの一貫性）サプライチェーン防御（5層）
cargo check --lockedで意図しない変更を検出依存更新
Test plan
cargo fmt/clippy/test全 passcargo deny check— advisories ok, bans ok, licenses ok, sources okcargo vet check— 73 fully audited, 199 exemptedscripts/check-quarantine.sh— all deps pass 7-day policyscripts/check-build-scripts.sh— baseline matches (34 crates)🤖 Generated with Claude Code