From 1322d73c7b70c46af85f1c23c73e77853c50c6a5 Mon Sep 17 00:00:00 2001 From: Alex Clarke Date: Tue, 11 Aug 2026 21:50:46 -0600 Subject: [PATCH] style: further cleanup --- src/rag/mod.rs | 20 +------------------- src/rag/providers/qdrant.rs | 5 +---- src/sandbox/mod.rs | 4 ---- 3 files changed, 2 insertions(+), 27 deletions(-) diff --git a/src/rag/mod.rs b/src/rag/mod.rs index 8522e05..f1e1255 100644 --- a/src/rag/mod.rs +++ b/src/rag/mod.rs @@ -603,7 +603,7 @@ impl Rag { } // Explicitly NOT a catch-all falling through to yaml. A typo'd driver // used to build a yaml store, pay to embed the whole corpus, persist - // the bad driver, and only fail on the NEXT run — leaving the RAG + // the bad driver, and only fail on the NEXT run, leaving the RAG // unusable without hand-editing the YAML. other => bail!( "Unknown RAG driver '{other}' for RAG '{name}'. \ @@ -1179,11 +1179,6 @@ impl Rag { top_k: usize, rerank_model: Option<&str>, ) -> Result> { - // The two legs run CONCURRENTLY. Both can be network round trips on a - // remote provider (embedding the query, then the vector search; a native - // keyword search), so awaiting them in sequence roughly doubles the - // latency of every hybrid query. The local BM25 branch is synchronous and - // simply runs inline inside the future. let keyword_leg = async { if self.provider.has_native_keyword_search() { self.provider @@ -1587,11 +1582,6 @@ impl RagData { } } - // An api_key must be a `{{NAME}}` reference, never the credential itself. - // Two reasons, both load-bearing: a literal key here gets committed to the - // RAG YAML in plaintext, and sandbox provisioning parses this value back - // out to learn which vault secret to bind, so a literal one silently - // provisions nothing (and used to be echoed to stderr on failure). if let Some(api_key) = self.driver_config.get("api_key") && placeholder_secret_name(api_key).is_none() { @@ -3290,9 +3280,6 @@ vectors: {} assert!(data.validate().is_ok()); } - /// A literal credential in `driver_config.api_key` is refused outright: it - /// would be persisted to the RAG YAML in plaintext, and sandbox - /// provisioning parses this field expecting a placeholder. #[test] fn ragdata_validate_rejects_a_literal_api_key() { let mut data = RagData::new( @@ -3337,15 +3324,10 @@ vectors: {} assert!(data.validate().is_ok()); } - /// The parser is the single thing standing between a hand-edited literal key - /// and a "could not load secret ''" line in the user's terminal. #[test] fn placeholder_secret_name_accepts_only_well_formed_placeholders() { assert_eq!(placeholder_secret_name("{{NAME}}"), Some("NAME")); assert_eq!(placeholder_secret_name(" {{ NAME }} "), Some("NAME")); - - // Every one of these used to survive the old trim_matches unchanged and - // then be used as a secret name. assert_eq!(placeholder_secret_name("sk-literal-key"), None); assert_eq!(placeholder_secret_name(""), None); assert_eq!(placeholder_secret_name("{{}}"), None); diff --git a/src/rag/providers/qdrant.rs b/src/rag/providers/qdrant.rs index bcc980c..b77d2cb 100644 --- a/src/rag/providers/qdrant.rs +++ b/src/rag/providers/qdrant.rs @@ -104,9 +104,6 @@ fn parse_search_hits( let score = pt["score"].as_f64()? as f32; Some((interner.document_id(&pt["id"])?, score)) }) - // Only a positive floor is a floor. Euclid collections score by negative - // distance, so a 0.0 floor would drop every hit — the exact failure the - // caller avoids `score_threshold` to prevent. .filter(|(_, score)| min_score <= 0.0 || *score > min_score) .collect()) } @@ -356,7 +353,7 @@ impl RagProvider for QdrantProvider { // `score_threshold` is deliberately NOT sent. It is metric-aware: on Cosine // collections 0.0 means "no floor" as expected, but Euclid collections score // by negative distance, where 0.0 filters everything out. The attach wizard - // does not pin the distance metric, so filter locally instead — where a + // does not pin the distance metric, so filter locally instead; i.e. where a // 0.0 floor is correctly treated as "no floor" (see `parse_search_hits`). let body = serde_json::json!({ "vector": embedding, diff --git a/src/sandbox/mod.rs b/src/sandbox/mod.rs index e97fcb1..39f362b 100644 --- a/src/sandbox/mod.rs +++ b/src/sandbox/mod.rs @@ -344,10 +344,6 @@ fn inject_rag_secrets(vault: &Vault, registered: &HashSet) -> Result<()> if service_id.is_empty() || registered.contains(&service_id) { continue; } - // A literal key must NOT be mistaken for a secret NAME. The trims that - // used to stand here leave a non-placeholder value completely untouched, - // so the vault lookup below would run with the credential as the "name" - // and the warning would then print that credential to stderr. let Some(secret_name) = placeholder_secret_name(placeholder) else { eprintln!( "Warning: RAG '{stem}' has a driver_config.api_key that is not a \