Enforce rust-llm-tidy standards repo-wide and gate PRs on them

.github/workflows/tidy.yml

@@ -0,0 +1,36 @@
+name: Tidy
+
+# Applies rust-llm-tidy fixes to PR-changed .rs/.md files in place and, on a
+# pull request, commits + pushes them back to the PR branch (mode: apply).
+
+on:
+  pull_request:
+    branches: [main]
+    paths:
+      - "src/**"
+      - "**/*.md"
+      - "**/*.MD"
+  workflow_dispatch:
+
+jobs:
+  tidy:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write # apply: commit + push fixes to the PR branch
+      pull-requests: write # post a report comment on success/failure
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          # Check out the PR branch head, not the auto-generated merge ref:
+          # apply-mode commits on top of HEAD and pushes back to this branch,
+          # which would be a non-fast-forward from the merge commit.
+          ref: ${{ github.head_ref }}
+          # Full history so the PR base diff is resolvable for changed-files.
+          fetch-depth: 0
+
+      - name: Apply tidy fixes to changed files
+        uses: Sewer56/rust-llm-tidy-action@v1
+        with:
+          rust-project-path: "."
+          changed-files: "true"
+          mode: "apply"

README.MD

@@ -17,7 +17,7 @@
 ReloadedCode started as "an OpenCode for servers." Headless,
 sandboxed, and cheap to host for non-commercial use.
 
-[OpenCode](https://opencode.ai) is a great interactive coding agent, but it's a
+[OpenCode] is a great interactive coding agent, but it's a
 <abbr title="opencode v1.14.21&#10;serve: 305 MiB RSS&#10;TUI: 525 MiB RSS&#10;&#10;v1.4.2&#10;serve: 392 MiB RSS&#10;TUI: 679 MiB RSS">~305 MiB</abbr> TypeScript application that runs as a separate process.
 What if you need those same tools for a **server**? A **Discord bot**?
 A **CI pipeline**? A **custom product**?
@@ -36,7 +36,7 @@ Shell sandboxing. Default-deny permissions. ~10 MiB footprint.
 ## Features
 
 - **10 Built-in tools** - read, write, edit, glob, grep, bash, webfetch, todoread, todowrite, task
-- **Agents similar to [OpenCode](https://opencode.ai)** - load agent markdown files with YAML frontmatter
+- **Agents similar to [OpenCode]** - load agent markdown files with YAML frontmatter
 - **Multi-agent delegation** - orchestrator pattern with depth-limited task chains
 - **Linux sandboxing** - bubblewrap profiles for shell isolation (Public Bot + Trusted Maintenance)
 - **Path security** - restrict file access with allowed directories and glob-based rules
@@ -55,7 +55,7 @@ Shell sandboxing. Default-deny permissions. ~10 MiB footprint.
 reloaded-code-serdesai = "0.2"
 ```
 
-**1.** Create an agent file (markdown + YAML frontmatter similar to [OpenCode](https://opencode.ai)):
+**1.** Create an agent file (markdown + YAML frontmatter similar to [OpenCode]):
 
 ```markdown
 ---
@@ -114,14 +114,14 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
 
 ## Crate Map
 
-| Crate                                                                     | Version | Description                                                                                      |
-| ------------------------------------------------------------------------- | ------- | ------------------------------------------------------------------------------------------------ |
-| [**reloaded-code-core**](./src/reloaded-code-core/)                       | 0.2     | Framework-agnostic tool implementations, path resolvers, permissions, custom tool registry       |
-| [**reloaded-code-agents**](./src/reloaded-code-agents/)                   | 0.1     | agent markdown loader similar to [OpenCode](https://opencode.ai), typed catalog, runtime builder |
-| [**reloaded-code-serdesai**](./src/reloaded-code-serdesai/)               | 0.2     | SerdesAI framework integration, tool adapters, 15 provider bridges, task delegation              |
-| [**reloaded-code-bubblewrap**](./src/reloaded-code-bubblewrap/)           | 0.1     | Linux bubblewrap sandbox profiles (Public Bot + Trusted Maintenance)                             |
-| [**reloaded-code-models-dev**](./src/reloaded-code-models-dev/)           | 0.1     | models.dev catalog sync with ETag caching and offline fallback                                   |
-| [**reloaded-code-provider-config**](./src/reloaded-code-provider-config/) | 0.1     | Provider configuration loading and provider catalog overrides                                    |
+| Crate                                                                     | Version | Description                                                                                |
+| ------------------------------------------------------------------------- | ------- | ------------------------------------------------------------------------------------------ |
+| [**reloaded-code-core**](./src/reloaded-code-core/)                       | 0.2     | Framework-agnostic tool implementations, path resolvers, permissions, custom tool registry |
+| [**reloaded-code-agents**](./src/reloaded-code-agents/)                   | 0.1     | agent markdown loader similar to [OpenCode], typed catalog, runtime builder                |
+| [**reloaded-code-serdesai**](./src/reloaded-code-serdesai/)               | 0.2     | SerdesAI framework integration, tool adapters, 15 provider bridges, task delegation        |
+| [**reloaded-code-bubblewrap**](./src/reloaded-code-bubblewrap/)           | 0.1     | Linux bubblewrap sandbox profiles (Public Bot + Trusted Maintenance)                       |
+| [**reloaded-code-models-dev**](./src/reloaded-code-models-dev/)           | 0.1     | models.dev catalog sync with ETag caching and offline fallback                             |
+| [**reloaded-code-provider-config**](./src/reloaded-code-provider-config/) | 0.1     | Provider configuration loading and provider catalog overrides                              |
 
 ## Examples
 
@@ -161,3 +161,4 @@ our guidelines.
 ## License
 
 Licensed under [Apache 2.0](./LICENSE).
+[OpenCode]: https://opencode.ai

src/docs/src/comparison.md

@@ -41,7 +41,7 @@ reloaded-code is for embedding agent tools into your own applications.
   (`name`, `mode`, `description`, `model`, `permission`, `tool_settings`).
   Agent files written for [OpenCode] are drop-in compatible (add
   explicit permissions). See [Agents](agents.md) for the full format
-  reference and [Migrating from OpenCode](migration.md) for the differences.
+  reference and [Migrating from OpenCode] for the differences.
 
 - **Core tools** - both provide `read`, `write`, `edit`, `glob`, `grep`,
   `bash`, and `webfetch`. See [Tools](tools.md) for the complete tool
@@ -65,7 +65,7 @@ reloaded-code uses **default-deny**: every tool is blocked unless you
 explicitly allow it in the agent frontmatter. There is no interactive approval
 flow because there is no user to prompt - the agent runs unattended.
 
-See [Migrating from OpenCode](migration.md) for a side-by-side YAML example,
+See [Migrating from OpenCode] for a side-by-side YAML example,
 a [portable default-deny configuration](migration.md#portable-default-deny),
 and a migration checklist.
 
@@ -123,11 +123,12 @@ configuration. See [Sandboxing](sandboxing.md) for the full guide.
 ---
 
 Ready to get started? See [Getting Started](getting-started.md) or
-[Migrating from OpenCode](migration.md).
+[Migrating from OpenCode].
 
 [OpenCode]: https://opencode.ai/
 [SerdesAI]: https://crates.io/crates/serdes-ai
 [models.dev]: https://models.dev
 [bubblewrap]: https://github.com/containers/bubblewrap
 [Bun]: https://bun.sh
 [tokio]: https://tokio.rs
+[Migrating from OpenCode]: migration.md

src/docs/src/getting-started.md

@@ -153,7 +153,7 @@ a Rust project and an LLM API key (e.g. `OPENAI_API_KEY`).
     [serdesai-basic](https://github.com/Reloaded-Project/ReloadedCode/blob/main/src/reloaded-code-serdesai/examples/serdesai-basic.rs)
     (without agent files) and
     [serdesai-agents](https://github.com/Reloaded-Project/ReloadedCode/blob/main/src/reloaded-code-serdesai/examples/serdesai-agents.rs)
-    (with agent files). See [Examples](examples.md) for the full list.
+    (with agent files). See [Examples] for the full list.
 
 ## Custom tools
 
@@ -224,7 +224,7 @@ cargo run --example serdesai-agents -p reloaded-code-serdesai
 cargo run --example serdesai-task -p reloaded-code-serdesai
 ```
 
-See [Examples](examples.md) for the full list with descriptions and
+See [Examples] for the full list with descriptions and
 source links.
 
 ## Sandboxing for production
@@ -242,10 +242,10 @@ to isolate shell execution. See [Sandboxing](sandboxing.md) for the full guide.
 ### Common deployment profiles
 
 - **Discord bot / chat bot** - Use the Public Bot sandbox profile
-  (restrictive; see [Sandboxing](sandboxing.md#the-two-profiles)) and
+  (restrictive; see [Sandboxing]) and
   `AllowedPathResolver` to limit what the LLM can do with user-provided prompts.
 - **CI/CD pipeline** - Use the Trusted Maintenance profile
-  (permissive; see [Sandboxing](sandboxing.md#the-two-profiles)) for build jobs
+  (permissive; see [Sandboxing]) for build jobs
   where you control the inputs. Explicitly mount the cache directories so that
   build artifacts persist between runs.
 
@@ -274,3 +274,5 @@ reloaded-code-core = { version = "0.2", default-features = false, features = ["b
 [`ToolContext`]: https://docs.rs/reloaded-code-core/latest/reloaded_code_core/trait.ToolContext.html
 [`CustomTool`]: https://docs.rs/reloaded-code-core/latest/reloaded_code_core/trait.CustomTool.html
 [`ToolFactory`]: https://docs.rs/reloaded-code-core/latest/reloaded_code_core/trait.ToolFactory.html
+[Examples]: examples.md
+[Sandboxing]: sandboxing.md#the-two-profiles

src/docs/src/guides/custom-providers.md

@@ -50,12 +50,12 @@ Each provider must include at least one model under `models`.
 
 ### Provider fields
 
-| Field        | Type        | Default             | Notes                                 |
-| ------------ | ----------- | ------------------- | ------------------------------------- |
-| `api_url`    | string      | required            | Base URL for the API endpoint         |
-| `api_type`   | string      | `openai-compatible` | Maps to provider behaviour profile    |
-| `env`        | string list | `[]`                | Env var names checked for credentials |
-| `models`     | map         | required            | Models offered by this provider       |
+| Field      | Type        | Default             | Notes                                 |
+| ---------- | ----------- | ------------------- | ------------------------------------- |
+| `api_url`  | string      | required            | Base URL for the API endpoint         |
+| `api_type` | string      | `openai-compatible` | Maps to provider behaviour profile    |
+| `env`      | string list | `[]`                | Env var names checked for credentials |
+| `models`   | map         | required            | Models offered by this provider       |
 
 ### api_type values
 

src/docs/src/models-catalog.md

@@ -82,8 +82,8 @@ let result = ModelsDevCatalog::load_at(&cache_path).await?;
 
 **Location** (platform default):
 
-| Platform | Path                                                            |
-| -------- | --------------------------------------------------------------- |
+| Platform | Path                                                         |
+| -------- | ------------------------------------------------------------ |
 | Linux    | `~/.cache/reloaded-code/models.dev.catalog.v1.cache`         |
 | macOS    | `~/Library/Caches/reloaded-code/models.dev.catalog.v1.cache` |
 | Windows  | `%LOCALAPPDATA%\reloaded-code\models.dev.catalog.v1.cache`   |

src/docs/src/sandboxing.md

@@ -31,7 +31,7 @@ protection:
 Built on [bubblewrap](https://github.com/containers/bubblewrap), a lightweight
 sandboxing tool that uses Linux kernel namespaces.
 
-- **Feature flag**: `linux-bubblewrap` (see [Feature Flags](feature-flags.md))
+- **Feature flag**: `linux-bubblewrap` (see [Feature Flags])
 - **Requirement**: Linux host with `bwrap` installed
 
 The sandbox never silently falls back to host execution. If `bwrap` is missing
@@ -48,7 +48,7 @@ reloaded-code-serdesai = { version = "0.2", features = ["linux-bubblewrap"] }
 ```
 
 *(Also shown in [Getting Started](getting-started.md) and
-[Feature Flags](feature-flags.md).)*
+[Feature Flags].)*
 
 When you enable sandboxing, start with the **Public Bot** profile.
 
@@ -262,16 +262,16 @@ full mount table, environment variables, and design rationale.
 
 ### Quick comparison
 
-| Aspect             | Public Bot                        | Trusted Maintenance                       |
-| ------------------ | --------------------------------- | ----------------------------------------- |
-| Use case           | Untrusted / hostile input         | Trusted automation                        |
-| Network            | Disabled                          | Enabled                                   |
-| Host filesystem    | Minimal (bins, libs, workspace)   | Full `/` read-only                        |
-| Writable paths     | Workspace, synthetic home, `/tmp` | Workspace, synthetic home, cache, `/tmp`  |
-| `/etc` visible     | No                                | Yes (except `/etc/shadow`)                |
+| Aspect             | Public Bot                        | Trusted Maintenance                                           |
+| ------------------ | --------------------------------- | ------------------------------------------------------------- |
+| Use case           | Untrusted / hostile input         | Trusted automation                                            |
+| Network            | Disabled                          | Enabled                                                       |
+| Host filesystem    | Minimal (bins, libs, workspace)   | Full `/` read-only                                            |
+| Writable paths     | Workspace, synthetic home, `/tmp` | Workspace, synthetic home, cache, `/tmp`                      |
+| `/etc` visible     | No                                | Yes (except `/etc/shadow`)                                    |
 | Environment        | Cleared, minimal sanitized `PATH` | Cleared, sanitized host `PATH` + XDG Base Directory variables |
-| Credential mounts  | Not supported                     | Supported (validated)                     |
-| Safe for untrusted | **Yes**                           | **No**                                    |
+| Credential mounts  | Not supported                     | Supported (validated)                                         |
+| Safe for untrusted | **Yes**                           | **No**                                                        |
 
 ### Under the hood
 
@@ -328,3 +328,4 @@ and design rationale, see [Profile Reference](extra-sandboxing-notes.md).
 [with_linux_bwrap]: https://docs.rs/reloaded-code-serdesai/latest/reloaded_code_serdesai/struct.BashTool.html#method.with_linux_bwrap
 [new_with_temp_sandbox]: https://docs.rs/reloaded-code-serdesai/latest/reloaded_code_serdesai/struct.AgentBuildContext.html#method.new_with_temp_sandbox
 [Preset]: https://docs.rs/reloaded-code-bubblewrap/latest/reloaded_code_bubblewrap/profile/enum.Preset.html
+[Feature Flags]: feature-flags.md

src/docs/src/tools.md

@@ -218,7 +218,7 @@ Reads a file, optionally with line numbers and a windowed range.
 **Output:** Line-numbered file content. Lines beyond `max_line_length` are
 truncated with `...`.
 
-**Configurable via [tool settings](#tool-settings):** `line_numbers`, `limit`,
+**Configurable via [tool settings]:** `line_numbers`, `limit`,
 `max_line_length`
 
 ### write
@@ -269,7 +269,7 @@ crate for fast traversal.
 
 **Output:** List of matching file paths.
 
-**Configurable via [tool settings](#tool-settings):** `limit`
+**Configurable via [tool settings]:** `limit`
 
 ### grep
 
@@ -285,7 +285,7 @@ Searches file contents by regex pattern. Returns matching lines with metadata.
 
 **Output:** Matching lines with line numbers and file paths.
 
-**Configurable via [tool settings](#tool-settings):** `line_numbers`, `limit`,
+**Configurable via [tool settings]:** `line_numbers`, `limit`,
 `max_line_length`
 
 ### bash
@@ -303,10 +303,10 @@ Executes a shell command with timeout and captured output.
 **Output:** Combined stdout and stderr. Non-zero exit codes are included in
 the output.
 
-**Configurable via [tool settings](#tool-settings):** `timeout_ms`, `max_timeout_ms`
+**Configurable via [tool settings]:** `timeout_ms`, `max_timeout_ms`
 
 **Sandboxing:** On Linux, you can enable the `linux-bubblewrap` feature to run
-commands inside a [bubblewrap] sandbox. See [Sandboxing](sandboxing.md) for details.
+commands inside a [bubblewrap] sandbox. See [Sandboxing] for details.
 
 ### webfetch
 
@@ -322,7 +322,7 @@ to markdown.
 
 **Output:** Page content as text or markdown.
 
-**Configurable via [tool settings](#tool-settings):** `timeout_ms`,
+**Configurable via [tool settings]:** `timeout_ms`,
 `max_timeout_ms`, `max_response_size`
 
 ### todoread / todowrite
@@ -501,9 +501,11 @@ This controls which paths the tools can access:
 Agents use `AllowedGlobResolver` by default. If you don't need glob-based rules,
 `AllowedPathResolver` or `AbsolutePathResolver` are slightly faster.
 
-For a deeper dive into path security, see [Sandboxing](sandboxing.md).
+For a deeper dive into path security, see [Sandboxing].
 
 [bubblewrap]: https://github.com/containers/bubblewrap
 [create_todo_tools]: https://docs.rs/reloaded-code-serdesai/latest/reloaded_code_serdesai/tools/todo/fn.create_todo_tools.html
 [reloaded-code-core]: https://docs.rs/reloaded-code-core
 [reloaded-code-serdesai]: https://docs.rs/reloaded-code-serdesai
+[tool settings]: #tool-settings
+[Sandboxing]: sandboxing.md

src/reloaded-code-agents/benches/fixtures/orchestrator-quality-gate-gpt5.md

@@ -119,9 +119,9 @@ Description of issue
 Detailed explanation of the problem and why it matters
 **Impact:** What could go wrong
 **Fix:**
-```lang
+~~~lang
 // replacement code if applicable
-```
+~~~
 
 ## Test Issues
 [basic|no] - [PASS|FAIL|FORBIDDEN_TESTS_FOUND]

src/reloaded-code-agents/benches/parser.rs

@@ -1,18 +1,13 @@
 //! Benchmarks for agent parsing.
 
+criterion_group!(benches, benchmark_parse_frontmatter);
+
+criterion_main!(benches);
+
 use core::hint::black_box;
 use criterion::{criterion_group, criterion_main, BenchmarkId, Criterion, Throughput};
 use reloaded_code_agents::{AgentCatalog, AgentLoader};
 
-/// Loads a real agent fixture file at runtime.
-fn load_fixture() -> String {
-    std::fs::read_to_string(concat!(
-        env!("CARGO_MANIFEST_DIR"),
-        "/benches/fixtures/orchestrator-quality-gate-gpt5.md"
-    ))
-    .expect("failed to load fixture file")
-}
-
 fn benchmark_parse_frontmatter(c: &mut Criterion) {
     let real_lf = load_fixture();
     let real_crlf = real_lf.replace('\n', "\r\n");
@@ -38,5 +33,11 @@ fn benchmark_parse_frontmatter(c: &mut Criterion) {
     group.finish();
 }
 
-criterion_group!(benches, benchmark_parse_frontmatter);
-criterion_main!(benches);
+/// Loads a real agent fixture file at runtime.
+fn load_fixture() -> String {
+    std::fs::read_to_string(concat!(
+        env!("CARGO_MANIFEST_DIR"),
+        "/benches/fixtures/orchestrator-quality-gate-gpt5.md"
+    ))
+    .expect("failed to load fixture file")
+}