clippy.toml

# Clippy config for crates/codegen/**.
#
# NOTE: clippy uses the NEAREST clippy.toml (no merging), so this file must
# duplicate any settings from the repo-root //clippy.toml.

# TODO: remove after https://github.com/hyperium/tonic/issues/2253 fixed.
large-error-threshold = 256

# Ban raw canonicalize: on Windows it returns verbatim `\\?\C:\...` paths that
# break external tools, leak into prompts, and poison path-equality keys.
# `dunce::canonicalize` keeps the verbatim form for paths it cannot simplify
# (over 260 chars, device names), so containment checks there fail closed.
#
# Ban raw child-process spawning: an unenrolled child outlives the session that
# started it, while an enrolled one dies with its scope. Allow with a reason
# where a child is waited on or deliberately detached.
#
# Enforced by `cargo clippy` and `just lint-rs`. The Bazel lint aspect pins the
# repo-root config instead, so crates this file does not reach carry a
# crate-level allow.
disallowed-methods = [
    { path = "reqwest::Client::new", reason = "bypasses the grok TLS policy (backend pin, OS roots, GROK_EXTRA_CA_BUNDLE); build through xai_grok_extra_ca; localhost-only clients allow with a reason" },
    { path = "reqwest::blocking::Client::new", reason = "bypasses the grok TLS policy (backend pin, OS roots, GROK_EXTRA_CA_BUNDLE); build through xai_grok_extra_ca; localhost-only clients allow with a reason" },
    { path = "reqwest::ClientBuilder::build", reason = "use xai_grok_extra_ca::build_reqwest_client: it applies the grok TLS policy and survives a broken OS store; localhost/test clients allow with a reason" },
    { path = "reqwest::blocking::ClientBuilder::build", reason = "use xai_grok_extra_ca::build_blocking_reqwest_client: it applies the grok TLS policy and survives a broken OS store; localhost/test clients allow with a reason" },
    { path = "std::fs::canonicalize", reason = "returns \\\\?\\ verbatim paths on Windows; use dunce::canonicalize" },
    { path = "std::path::Path::canonicalize", reason = "returns \\\\?\\ verbatim paths on Windows; use dunce::canonicalize" },
    { path = "tokio::fs::canonicalize", reason = "returns \\\\?\\ verbatim paths on Windows; use xai_grok_tools::util::fs helpers or spawn_blocking + dunce::canonicalize" },
    { path = "std::process::Command::spawn", reason = "an unenrolled child outlives its session; use xai_tty_utils::ProcessScope::enroll" },
    { path = "tokio::process::Command::spawn", reason = "an unenrolled child outlives its session; use xai_tty_utils::ProcessScope::enroll" },
    { path = "portable_pty::SlavePty::spawn_command", reason = "an unenrolled pty child outlives its session; enroll the shell with xai_tty_utils::ProcessScope::enroll_terminal_pid" },
]