fix: consolidated numeric overflow/underflow prevention with saturating operations

[echobt]

Summary

This PR consolidates 3 numeric safety fixes into a single, cohesive change.

Included PRs:

• fix(engine): use saturating casts in git_info to prevent overflow #39: Use saturating casts in git_info to prevent overflow
• fix(engine): use saturating casts for token counts in streaming #40: Use saturating casts for token counts in streaming
• fix(compact): use saturating subtraction to prevent underflow #41: Use saturating subtraction to prevent underflow in compaction

Changes:

• Replaced direct casts with saturating_sub and try_into
• Prevents panic on numeric overflow/underflow conditions
• Uses safe arithmetic throughout

Files Modified:

• src/cortex-compact/src/compactor.rs
• src/cortex-engine/src/git_info.rs
• src/cortex-engine/src/streaming.rs

Closes #39, #40, #41

[greptile-apps]

Greptile Overview

Greptile Summary

This PR consolidates three numeric safety fixes to prevent overflow and underflow conditions across different components:

Changes Made:

• compactor.rs: Replaced direct arithmetic with saturating_sub and saturating_add when calculating token counts after compaction, preventing underflow when tokens_in_compacted exceeds current_tokens
• git_info.rs: Added saturation logic using .min(u32::MAX as usize) before casting usize counts to u32 for both file changes and stash indices, preventing truncation overflow for large repositories
• streaming.rs: Implemented saturating_i64_to_u32 helper function to safely convert i64 token counts to u32, handling negative values (clamp to 0) and values exceeding u32::MAX (clamp to max)

Impact:
All changes are defensive improvements that prevent panic conditions. The saturating behavior provides graceful degradation - in edge cases where values would overflow/underflow, the system will use boundary values (0 or MAX) instead of crashing.

Confidence Score: 5/5

• This PR is safe to merge with minimal risk
• All changes are defensive improvements that replace potentially unsafe operations with saturating alternatives. The changes are well-targeted, properly implemented, and add robustness without altering intended behavior in normal cases.
• No files require special attention

Important Files Changed

Filename	Overview
src/cortex-compact/src/compactor.rs	Replaced arithmetic with saturating operations to prevent underflow when calculating tokens_after
src/cortex-engine/src/git_info.rs	Added saturation when casting usize line counts to u32 to prevent truncation overflow
src/cortex-engine/src/streaming.rs	Implemented saturating_i64_to_u32 helper to safely convert token counts with bounds checking

Sequence Diagram

sequenceDiagram
    participant App as Application Code
    participant Comp as Compactor
    participant Git as GitInfo
    participant Stream as Streaming
    
    Note over App,Stream: Numeric Overflow/Underflow Prevention

    App->>Comp: compact(items, summary_text, current_tokens)
    Note over Comp: tokens_in_compacted may exceed current_tokens
    Comp->>Comp: saturating_sub(current_tokens, tokens_in_compacted)
    Note over Comp: Prevents underflow: min value = 0
    Comp->>Comp: saturating_add(result, summary_tokens)
    Note over Comp: Prevents overflow: max value = usize::MAX
    Comp-->>App: CompactionResult with safe tokens_after

    App->>Git: GitInfo::from_path(path)
    Git->>Git: count status lines (returns usize)
    Note over Git: Line count may exceed u32::MAX
    Git->>Git: min(count, u32::MAX as usize) as u32
    Note over Git: Saturates to u32::MAX if too large
    Git-->>App: GitInfo with safe u32 counts

    App->>Stream: Convert TokenUsage (i64) to StreamTokenUsage (u32)
    Note over Stream: Token values may be negative or > u32::MAX
    Stream->>Stream: saturating_i64_to_u32(input_tokens)
    alt value <= 0
        Stream->>Stream: Return 0
    else value > u32::MAX
        Stream->>Stream: Return u32::MAX
    else valid range
        Stream->>Stream: Return value as u32
    end
    Stream-->>App: StreamTokenUsage with safe u32 tokens

Loading

[greptile-apps]

_{3 files reviewed, no comments}

_{Edit Code Review Agent Settings | Greptile}

[echobt]

Closing this PR to consolidate into a single mega-PR combining all bug fixes. The changes will be included in a new consolidated PR.