pub struct SiteConfig {
pub refuse_markers: Vec<String>,
pub max_concurrent_ceiling: Option<usize>,
}Expand description
What the site allows, for every repository on this machine.
deny_unknown_fields is the whole of the “no providers, no credentials”
rule: an [[llm]], an endpoint or an api_key in this file is an unknown
key and is rejected, so there is no separate rejection list to drift from the
field list. It is also what makes a misspelled policy key loud rather than a
silent no-op.
This is the one config type that may derive Debug. LlmConfig, AuthStore
and LlmClient hand-write theirs because they can hold a credential; this
file is defined to carry none, and the attribute above is what enforces that
definition rather than a promise in a comment.
Fields§
§refuse_markers: Vec<String>Filenames whose presence in a repository refuses semantic review.
Consumed by the marker refusal in check, which is what reads this list
and stops the semantic layer before a byte of source is rendered. Parsed
and validated here, and read nowhere else in this module.
max_concurrent_ceiling: Option<usize>The most concurrent LLM requests any one provider may make.
An Option rather than a usize sentinel so doctor can tell “no
ceiling” from “a ceiling that happens to equal the default”.
Implementations§
Source§impl SiteConfig
impl SiteConfig
Sourcepub fn clamp_concurrency(&self, requested: usize) -> usize
pub fn clamp_concurrency(&self, requested: usize) -> usize
requested, lowered to the ceiling when there is one.
The single definition of the rule, so the loaded-config path and
doctor’s raw-tree path cannot come to disagree about the same entry -
the shape auth::source_of already exists in for the same reason.
Sourcepub fn apply(&self, config: &mut Config)
pub fn apply(&self, config: &mut Config)
Lower every enabled provider’s max_concurrent to the ceiling.
Disabled entries are skipped, matching every other pass over the provider
list: ${VAR} expansion, field validation and auth::resolve all leave a
parked entry alone, and clamping one would make doctor report a change
to a provider drep never contacts.
Applied to the effective value, whether the repository wrote
max_concurrent or inherited the default. Skipping the defaulted ones
would let a repository raise its own concurrency by deleting a line, which
is the loosening this layer exists to prevent.
Returns nothing: no caller wants a list of what it changed, and an unread return value is surface a later reader has to account for.
Sourcepub async fn refusal_among(
&self,
directories: &BTreeSet<PathBuf>,
policy: &Path,
) -> Result<Option<Refusal>, SiteConfigError>
pub async fn refusal_among( &self, directories: &BTreeSet<PathBuf>, policy: &Path, ) -> Result<Option<Refusal>, SiteConfigError>
The first configured marker present at the repository root above any of
directories.
Ok(None) on a machine that configured none, decided before git is
spawned. That short circuit is the whole reason an unaffected machine
gains neither the latency nor the new failure mode: drep check outside a
repository keeps working exactly as it does today, and only a machine that
asked for the policy pays for evaluating it.
The repository root, not the directory itself: a check run from a
subdirectory of a marked repository is still a check on that repository’s
source, and consulting the given directory would let cd src && drep check walk straight past the policy.
Plural because one run can review files from more than one repository, and then one repository’s policy was consulted while another’s source was sent. Each directory is resolved on its own rather than being assumed to share a root with the others: a nested checkout has its own root, and deciding otherwise from the paths alone would reimplement git’s discovery rules here. The marker probe is then done once per distinct root.
Presence is decided by std::fs::symlink_metadata, and nothing opens
the file. Not metadata, which follows a symlink and so answers “no” for
a marker whose target is gone; not is_file(), which answers “no” for a
directory. Both are names someone deliberately placed at the root, and
either reading would let a marker silently disable the policy it was put
there to invoke. Contents are never read for the same reason: a marker
whose text said allow would be a second grammar nobody documented.
Sourcepub fn has_refuse_markers(&self) -> bool
pub fn has_refuse_markers(&self) -> bool
Whether this policy names any marker at all.
So a caller can decline to build the directory set for a policy that would
return immediately. The guard inside Self::refusal_among stays: this one
saves the argument, not the answer.