From 50669bf3022764fea3368f26c3e8747a6ca05e07 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E9=9B=B7=E7=94=B5=E8=8A=BD=E8=A1=A3?= Date: Thu, 27 Aug 2026 11:55:19 -0400 Subject: [PATCH] chore(gates): zero clippy warnings and a buildable sandbox example on Windows The full-workspace gates had never run on this platform: collapsible ifs in the Windows shell probe, a same-type cast in the crash handler, an unused AsRawHandle import, and the sandbox smoke-test example building its unix-only body (libc, kernel enforcement) unconditionally. The example now stubs main off-unix; formatting reflow from cargo fmt. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01KSy9S31pZNWXtRZNVJ1sDf --- crates/codegen/kigi-config/src/shell.rs | 24 +++--- .../codegen/kigi-crash-handler/src/handler.rs | 2 +- .../codegen/kigi-sampling-types/src/error.rs | 4 +- .../examples/sandbox_smoke_test.rs | 12 +++ crates/codegen/kigi-shell/src/agent/models.rs | 75 ++++++++++--------- crates/codegen/kigi-shell/src/auth/storage.rs | 5 +- .../src/test_support/lsp_runtime.rs | 3 +- .../src/util/config/resolve/compaction.rs | 5 +- crates/codegen/kigi-tools/src/util/spawn.rs | 3 +- crates/codegen/kigi-tty-utils/src/lib.rs | 2 +- 10 files changed, 75 insertions(+), 60 deletions(-) diff --git a/crates/codegen/kigi-config/src/shell.rs b/crates/codegen/kigi-config/src/shell.rs index 47d6fdb..db97555 100644 --- a/crates/codegen/kigi-config/src/shell.rs +++ b/crates/codegen/kigi-config/src/shell.rs @@ -78,11 +78,10 @@ pub fn detect_windows_shell() -> &'static WindowsShell { kigi_tty_utils::detach_std_command(&mut cmd); cmd.arg("pwsh.exe").stdin(std::process::Stdio::null()); cmd.output() - } { - if output.status.success() { - tracing::info!("Windows shell: pwsh"); - return WindowsShell::Pwsh; - } + } && output.status.success() + { + tracing::info!("Windows shell: pwsh"); + return WindowsShell::Pwsh; } // powershell.exe (Windows PowerShell 5.1). @@ -131,14 +130,13 @@ fn find_git_bash() -> Option { kigi_tty_utils::detach_std_command(&mut cmd); cmd.arg("bash.exe").stdin(std::process::Stdio::null()); cmd.output() - } { - if output.status.success() { - let stdout = String::from_utf8_lossy(&output.stdout); - for line in stdout.lines() { - let line = line.trim(); - if line.to_ascii_lowercase().contains("git") { - return Some(line.to_string()); - } + } && output.status.success() + { + let stdout = String::from_utf8_lossy(&output.stdout); + for line in stdout.lines() { + let line = line.trim(); + if line.to_ascii_lowercase().contains("git") { + return Some(line.to_string()); } } } diff --git a/crates/codegen/kigi-crash-handler/src/handler.rs b/crates/codegen/kigi-crash-handler/src/handler.rs index 1629707..c16d1a8 100644 --- a/crates/codegen/kigi-crash-handler/src/handler.rs +++ b/crates/codegen/kigi-crash-handler/src/handler.rs @@ -616,7 +616,7 @@ mod win { } let signal = exception_to_signal(exception_code); - let si_code = exception_code as i32; + let si_code = exception_code; // ExceptionInformation[1] holds the faulting address for ACCESS_VIOLATION. let si_addr = if exception_code == EXCEPTION_ACCESS_VIOLATION diff --git a/crates/codegen/kigi-sampling-types/src/error.rs b/crates/codegen/kigi-sampling-types/src/error.rs index 2952774..5021177 100644 --- a/crates/codegen/kigi-sampling-types/src/error.rs +++ b/crates/codegen/kigi-sampling-types/src/error.rs @@ -388,7 +388,9 @@ mod tests { #[test] fn retryable_api_status_covers_edge_5xx_and_excludes_broken_tls() { - for status in [429u16, 500, 502, 503, 504, 520, 521, 522, 523, 524, 529, 530, 599] { + for status in [ + 429u16, 500, 502, 503, 504, 520, 521, 522, 523, 524, 529, 530, 599, + ] { assert!(is_retryable_api_status(status), "should retry {status}"); } // Cloudflare 525/526: origin TLS handshake / invalid certificate — diff --git a/crates/codegen/kigi-sandbox/examples/sandbox_smoke_test.rs b/crates/codegen/kigi-sandbox/examples/sandbox_smoke_test.rs index ac6c007..8c19da1 100644 --- a/crates/codegen/kigi-sandbox/examples/sandbox_smoke_test.rs +++ b/crates/codegen/kigi-sandbox/examples/sandbox_smoke_test.rs @@ -14,9 +14,19 @@ //! cargo run -p kigi-sandbox --example sandbox_smoke_test -- read-only //! ``` +// Kernel enforcement is unix-only (Seatbelt / Landlock); Windows builds a +// stub so `--all-targets` stays green everywhere. +#[cfg(unix)] use kigi_sandbox::{ProfileName, SandboxManager}; +#[cfg(unix)] use std::path::Path; +#[cfg(not(unix))] +fn main() { + eprintln!("sandbox_smoke_test exercises kernel enforcement and only runs on Unix."); +} + +#[cfg(unix)] fn main() { let profile_name = std::env::args() .nth(1) @@ -121,6 +131,7 @@ fn main() { println!("\n✅ Smoke test complete"); } +#[cfg(unix)] fn test_read(label: &str, path: &Path) { if path.is_file() { match std::fs::read(path) { @@ -150,6 +161,7 @@ fn test_read(label: &str, path: &Path) { } } +#[cfg(unix)] fn test_write(label: &str, path: &Path) { match std::fs::write(path, b"sandbox-test") { Ok(()) => { diff --git a/crates/codegen/kigi-shell/src/agent/models.rs b/crates/codegen/kigi-shell/src/agent/models.rs index 5db3997..96fe970 100644 --- a/crates/codegen/kigi-shell/src/agent/models.rs +++ b/crates/codegen/kigi-shell/src/agent/models.rs @@ -1959,46 +1959,47 @@ fn spawn_prefetch_thread(env: PrefetchEnv) -> Option { let spawned = std::thread::Builder::new() .name("early-prefetch".into()) .spawn(move || { - let mut timer = crate::instrumentation_timer!("startup.early_prefetch"); - let proxy_endpoint = env.endpoints.proxy_url(); - timer.with_field("endpoint", proxy_endpoint.as_str()); - // Resolve each stored subscription-OAuth session's bearer (refreshed - // on expiry) so those platforms are part of the STARTUP fetch plan — - // otherwise a claude-pro-max-only user boots onto the bundled Kimi - // table until some later async refresh happens to run, and the cache - // origin (which encodes enabled platforms) never matches the - // async-path's claude-inclusive origin. - let oauth_tokens = tokio::runtime::Builder::new_current_thread() - .enable_all() - .build() - .map(|rt| { - rt.block_on(crate::agent::models_fetch::resolve_generic_oauth_tokens( - &crate::auth::oauth_registry::pool_home(), - )) - }) - .unwrap_or_default(); - let models = prefetch_models_blocking( - &env.endpoints, - env.auth.as_ref(), - &oauth_tokens, - env.model_fetch_auth, - &env.platform_keys, - ); - if (env.endpoints.deployment_key.is_some() || crate::managed_config::has_active_team_auth()) - && crate::config::is_managed_config_stale_for( - &crate::managed_config::current_serving_identity(), - ) - && crate::managed_config::is_fetch_enabled() - && let Ok(rt) = tokio::runtime::Builder::new_current_thread() + let mut timer = crate::instrumentation_timer!("startup.early_prefetch"); + let proxy_endpoint = env.endpoints.proxy_url(); + timer.with_field("endpoint", proxy_endpoint.as_str()); + // Resolve each stored subscription-OAuth session's bearer (refreshed + // on expiry) so those platforms are part of the STARTUP fetch plan — + // otherwise a claude-pro-max-only user boots onto the bundled Kimi + // table until some later async refresh happens to run, and the cache + // origin (which encodes enabled platforms) never matches the + // async-path's claude-inclusive origin. + let oauth_tokens = tokio::runtime::Builder::new_current_thread() .enable_all() .build() - { - crate::managed_config::clear_orphan(); - let _ = rt.block_on(crate::managed_config::sync()); - } + .map(|rt| { + rt.block_on(crate::agent::models_fetch::resolve_generic_oauth_tokens( + &crate::auth::oauth_registry::pool_home(), + )) + }) + .unwrap_or_default(); + let models = prefetch_models_blocking( + &env.endpoints, + env.auth.as_ref(), + &oauth_tokens, + env.model_fetch_auth, + &env.platform_keys, + ); + if (env.endpoints.deployment_key.is_some() + || crate::managed_config::has_active_team_auth()) + && crate::config::is_managed_config_stale_for( + &crate::managed_config::current_serving_identity(), + ) + && crate::managed_config::is_fetch_enabled() + && let Ok(rt) = tokio::runtime::Builder::new_current_thread() + .enable_all() + .build() + { + crate::managed_config::clear_orphan(); + let _ = rt.block_on(crate::managed_config::sync()); + } - EarlyPrefetchResult { models } - }); + EarlyPrefetchResult { models } + }); match spawned { Ok(handle) => Some(handle), Err(e) => { diff --git a/crates/codegen/kigi-shell/src/auth/storage.rs b/crates/codegen/kigi-shell/src/auth/storage.rs index 9ee6345..665d306 100644 --- a/crates/codegen/kigi-shell/src/auth/storage.rs +++ b/crates/codegen/kigi-shell/src/auth/storage.rs @@ -900,9 +900,8 @@ mod write_fallback_tests { fn atomic_write_reclaims_tmp_when_store_write_fails() { let dir = tempfile::tempdir().unwrap(); let path = dir.path().join("auth.json"); - let err = - write_auth_json_atomic_with(&path, &sample_store(), fake_partial_write_then_fail) - .unwrap_err(); + let err = write_auth_json_atomic_with(&path, &sample_store(), fake_partial_write_then_fail) + .unwrap_err(); assert_eq!(err.kind(), std::io::ErrorKind::StorageFull); let orphans: Vec<_> = std::fs::read_dir(dir.path()) diff --git a/crates/codegen/kigi-shell/src/test_support/lsp_runtime.rs b/crates/codegen/kigi-shell/src/test_support/lsp_runtime.rs index 5222106..f3cbed8 100644 --- a/crates/codegen/kigi-shell/src/test_support/lsp_runtime.rs +++ b/crates/codegen/kigi-shell/src/test_support/lsp_runtime.rs @@ -33,8 +33,7 @@ pub(crate) fn ctx_with_toggle(toggle: HashMap) -> SubagentSpawnCon let (tx, _rx) = mpsc::unbounded_channel(); SubagentSpawnContext { lsp: None, - spawn_limits: - kigi_tools::implementations::kigi::task::admission::SubagentLimits::default(), + spawn_limits: kigi_tools::implementations::kigi::task::admission::SubagentLimits::default(), spawn_permits: std::sync::Arc::new(tokio::sync::Semaphore::new( kigi_tools::implementations::kigi::task::admission::SubagentLimits::default() .effective_max_concurrent(), diff --git a/crates/codegen/kigi-shell/src/util/config/resolve/compaction.rs b/crates/codegen/kigi-shell/src/util/config/resolve/compaction.rs index a2a45da..44f2704 100644 --- a/crates/codegen/kigi-shell/src/util/config/resolve/compaction.rs +++ b/crates/codegen/kigi-shell/src/util/config/resolve/compaction.rs @@ -187,7 +187,10 @@ mod compaction_tool_choice_tests { resolve(Some("bogus"), None, Some("none")), CompactionToolChoice::None ); - assert_eq!(resolve(Some("NONE "), None, None), CompactionToolChoice::None); + assert_eq!( + resolve(Some("NONE "), None, None), + CompactionToolChoice::None + ); } } diff --git a/crates/codegen/kigi-tools/src/util/spawn.rs b/crates/codegen/kigi-tools/src/util/spawn.rs index 42bfd27..305f00f 100644 --- a/crates/codegen/kigi-tools/src/util/spawn.rs +++ b/crates/codegen/kigi-tools/src/util/spawn.rs @@ -15,7 +15,8 @@ pub use kigi_tty_utils::{ pub async fn reap_killed_search_child( child: &mut tokio::process::Child, ) -> Option { - let status = kigi_tty_utils::reap_killed_bounded(child, kigi_tty_utils::KILL_REAP_TIMEOUT).await; + let status = + kigi_tty_utils::reap_killed_bounded(child, kigi_tty_utils::KILL_REAP_TIMEOUT).await; if status.is_none() { tracing::warn!( reap_timeout_secs = kigi_tty_utils::KILL_REAP_TIMEOUT.as_secs(), diff --git a/crates/codegen/kigi-tty-utils/src/lib.rs b/crates/codegen/kigi-tty-utils/src/lib.rs index c1b0979..2357bb3 100644 --- a/crates/codegen/kigi-tty-utils/src/lib.rs +++ b/crates/codegen/kigi-tty-utils/src/lib.rs @@ -567,7 +567,7 @@ pub fn dup_tui_stderr() -> io::Result { // `DuplicateHandle` — avoiding the `from_raw_handle` footgun // where `File` would take ownership of the process stderr handle // and close it on drop. - use std::os::windows::io::{AsRawHandle, FromRawHandle}; + use std::os::windows::io::FromRawHandle; let stderr_handle = unsafe { windows::Win32::System::Console::GetStdHandle( windows::Win32::System::Console::STD_ERROR_HANDLE,