Skip to main content

showcase · 6 rules

Real rules difflore learned from popular OSS reviews.

Each card below is a review note distilled from a real PR thread. When an AI agent edits a matching file in your repo, difflore ships the rule into its context so the same comment never has to be written twice.

LanguageGoRustTypeScriptPython
sourceCorrectnessAsync runtimePlugin APIRoutingSecretsTesting
GoCorrectness

Bind handlers must check the returned error before responding

← learned from gin-gonic/gin

Repo
gin-gonic/gin
accepted fixes
4

Reviewers on gin keep flagging handlers that call ctx.ShouldBindJSON without inspecting the error, which silently 200s on malformed input. The rule fires whenever an agent writes a new handler that touches request bodies, so the bug is caught before the PR is opened.

Go
RustAsync runtime

Spawn long-lived tasks with tokio::spawn, not block_on inside async fns

← learned from tokio-rs/tokio

Repo
tokio-rs/tokio
accepted fixes
3

A recurring review note in tokio: calling block_on from inside an async context deadlocks the runtime under load. difflore learned the pattern from three separate PR threads and now nudges agents toward spawn or spawn_blocking with a one-line rationale linked back to the original review.

Rust
TypeScriptPlugin API

Vite plugins should declare enforce: pre when they rewrite imports

← learned from vitejs/vite

Repo
vitejs/vite
accepted fixes
5

Plugin authors routinely ship transforms that race with esbuild's default order, producing missing-import errors only on cold starts. The rule encodes the maintainer guidance from years of issue triage so an agent writing a new plugin gets the ordering right on the first commit.

TypeScript
TypeScriptRouting

Route loaders must return serialisable data, never class instances

← learned from tanstack/router

Repo
tanstack/router
accepted fixes
6

TanStack Router serialises loader output across the SSR boundary, so returning a Date, Map, or class instance breaks rehydration in subtle ways. Reviewers ask for the same fix every few weeks; the rule shortcuts that round-trip and points to the canonical issue thread.

TypeScript
TypeScriptSecrets

Server actions that touch headers() must be marked dynamic

← learned from vercel/next.js

Repo
vercel/next.js
accepted fixes
7

Caching surprises in the App Router come almost entirely from actions that read cookies or headers without opting out of static rendering. The Next.js review corpus is dense with this exact correction; difflore raises it the moment an agent edits a server action file.

TypeScript
PythonTesting

Dependency-injected sessions belong in a Depends, not a global

← learned from fastapi/fastapi

Repo
fastapi/fastapi
accepted fixes
3

The FastAPI maintainers consistently steer contributors away from module-level database sessions toward Depends-scoped factories so tests stay isolated. The rule captures that guidance and links to the docs section reviewers cite, so agents adopt it without a back-and-forth.

Python

Install difflore in 30 seconds

Point it at a repo and the first review-derived rules show up the moment your agent opens a matching file.

npm install -g @difflore/cli