cli: Enable workspace linting and fix clippy violations

Add [workspace.lints] configuration to enforce clippy::all,
  clippy::pedantic, and deny all warnings.

Fix resulting violations across the codebase

Author: davidabram

cli/Cargo.toml

@@ -39,3 +39,13 @@ regex = "1"
 
 [target.'cfg(unix)'.dev-dependencies]
 libc = "0.2"
+
+[lints]
+workspace = true
+
+[workspace.lints.clippy]
+all = { level = "deny" }
+pedantic = { level = "deny" }
+
+[workspace.lints.rust]
+warnings = "deny"

cli/build.rs

@@ -1,6 +1,8 @@
 use std::{
-    env, fs,
-    io::{self, Write},
+    env,
+    fmt::Write,
+    fs,
+    io::{self, Write as IoWrite},
     path::{Path, PathBuf},
 };
 
@@ -35,12 +37,12 @@ fn main() {
 }
 
 fn generate_embedded_asset_manifest() -> io::Result<()> {
-    let manifest_dir = PathBuf::from(env::var("CARGO_MANIFEST_DIR").map_err(invalid_data)?);
+    let manifest_dir = PathBuf::from(env::var("CARGO_MANIFEST_DIR").map_err(|e| invalid_data(&e))?);
     let repository_root = manifest_dir
         .parent()
-        .ok_or_else(|| invalid_data("CARGO_MANIFEST_DIR does not have a parent"))?
+        .ok_or_else(|| invalid_data(&"CARGO_MANIFEST_DIR does not have a parent"))?
         .to_path_buf();
-    let out_dir = PathBuf::from(env::var("OUT_DIR").map_err(invalid_data)?);
+    let out_dir = PathBuf::from(env::var("OUT_DIR").map_err(|e| invalid_data(&e))?);
     let destination_path = out_dir.join("setup_embedded_assets.rs");
 
     let mut output = String::new();
@@ -53,19 +55,21 @@ fn generate_embedded_asset_manifest() -> io::Result<()> {
         collect_files(&source_root, &source_root, &mut files)?;
         files.sort_unstable_by(|a, b| a.relative_path.cmp(&b.relative_path));
 
-        output.push_str(&format!(
-            "pub static {}: &[EmbeddedAsset] = &[\n",
+        let _ = writeln!(
+            output,
+            "pub static {}: &[EmbeddedAsset] = &[",
             target.const_name
-        ));
+        );
 
         for file in &files {
             println!("cargo:rerun-if-changed={}", file.absolute_path.display());
-            output.push_str(&format!(
-                "    EmbeddedAsset {{ relative_path: \"{}\", bytes: include_bytes!(concat!(env!(\"CARGO_MANIFEST_DIR\"), \"{}{}\")) }},\n",
+            let _ = writeln!(
+                output,
+                "    EmbeddedAsset {{ relative_path: \"{}\", bytes: include_bytes!(concat!(env!(\"CARGO_MANIFEST_DIR\"), \"{}{}\")) }},",
                 escape_for_rust_string(&file.relative_path),
                 target.include_prefix,
                 escape_for_rust_string(&file.relative_path),
-            ));
+            );
         }
 
         output.push_str("];\n\n");
@@ -97,7 +101,7 @@ fn collect_files(
 
         let relative_path = path
             .strip_prefix(base_root)
-            .map_err(|_| invalid_data("failed to strip source root from file path"))?;
+            .map_err(|_| invalid_data(&"failed to strip source root from file path"))?;
 
         let relative_path = normalize_relative_path(relative_path)?;
 
@@ -113,15 +117,15 @@ fn collect_files(
 fn normalize_relative_path(path: &Path) -> io::Result<String> {
     let normalized = path
         .to_str()
-        .ok_or_else(|| invalid_data("non-UTF-8 config paths are not supported"))?
+        .ok_or_else(|| invalid_data(&"non-UTF-8 config paths are not supported"))?
         .replace('\\', "/");
 
     if normalized.is_empty() {
-        return Err(invalid_data("relative path cannot be empty"));
+        return Err(invalid_data(&"relative path cannot be empty"));
     }
 
     if normalized.starts_with('/') {
-        return Err(invalid_data("relative path must not start with '/'"));
+        return Err(invalid_data(&"relative path must not start with '/'"));
     }
 
     Ok(normalized)
@@ -131,6 +135,6 @@ fn escape_for_rust_string(value: &str) -> String {
     value.replace('\\', "\\\\").replace('"', "\\\"")
 }
 
-fn invalid_data<E: ToString>(error: E) -> io::Error {
+fn invalid_data<E: ToString>(error: &E) -> io::Error {
     io::Error::new(io::ErrorKind::InvalidData, error.to_string())
 }

cli/src/app.rs

@@ -310,7 +310,7 @@ where
                     format: services::version::VersionFormat::Text,
                 }));
             }
-            return Err(classify_clap_error(error));
+            return Err(classify_clap_error(&error));
         }
     };
 
@@ -323,42 +323,28 @@ where
     convert_clap_command(command)
 }
 
-/// Classify a clap error into our ClassifiedError taxonomy.
-fn classify_clap_error(error: clap::Error) -> ClassifiedError {
+/// Classify a clap error into our `ClassifiedError` taxonomy.
+fn classify_clap_error(error: &clap::Error) -> ClassifiedError {
     use clap::error::ErrorKind;
 
     let message = error.to_string();
 
     // Determine error class based on clap error kind
+    // Note: Many clap error kinds map to Parse failures
     let class = match error.kind() {
-        // Parse errors: unknown commands, unknown arguments, missing arguments
-        ErrorKind::InvalidSubcommand
-        | ErrorKind::UnknownArgument
-        | ErrorKind::InvalidValue
-        | ErrorKind::ValueValidation
-        | ErrorKind::TooFewValues
-        | ErrorKind::TooManyValues
-        | ErrorKind::WrongNumberOfValues => FailureClass::Parse,
-
         // Validation errors: missing required arguments, argument conflicts
         ErrorKind::MissingRequiredArgument | ErrorKind::ArgumentConflict | ErrorKind::NoEquals => {
             FailureClass::Validation
         }
 
-        // Display errors (help, version) - treat as parse since user asked for something invalid
-        ErrorKind::DisplayHelp
-        | ErrorKind::DisplayHelpOnMissingArgumentOrSubcommand
-        | ErrorKind::DisplayVersion => FailureClass::Parse,
-
-        // Default to parse for any other error types
+        // All other errors (parse errors, display errors, etc.) map to Parse
         _ => FailureClass::Parse,
     };
 
     // Clean up clap's error message to match our style
     let cleaned_message = clean_clap_error_message(&message, error.kind());
 
     match class {
-        FailureClass::Parse => ClassifiedError::parse(cleaned_message),
         FailureClass::Validation => ClassifiedError::validation(cleaned_message),
         _ => ClassifiedError::parse(cleaned_message),
     }
@@ -377,55 +363,49 @@ fn clean_clap_error_message(message: &str, kind: clap::error::ErrorKind) -> Stri
             if let Some(subcommand) = extract_quoted_value(message) {
                 if command_surface::is_known_command(&subcommand) {
                     format!(
-                        "Command '{}' is currently unavailable in this build. Try: run 'sce --help' to see available commands in this build.",
-                        subcommand
+                        "Command '{subcommand}' is currently unavailable in this build. Try: run 'sce --help' to see available commands in this build."
                     )
                 } else {
                     format!(
-                        "Unknown command '{}'. Try: run 'sce --help' to list valid commands, then rerun with a valid command such as 'sce version' or 'sce setup --help'.",
-                        subcommand
+                        "Unknown command '{subcommand}'. Try: run 'sce --help' to list valid commands, then rerun with a valid command such as 'sce version' or 'sce setup --help'."
                     )
                 }
             } else {
-                format!("{}. Try: run 'sce --help' to see valid usage.", message)
+                format!("{message}. Try: run 'sce --help' to see valid usage.")
             }
         }
         ErrorKind::UnknownArgument => {
             // Extract the unknown argument and provide helpful guidance
             if let Some(arg) = extract_quoted_value(message) {
                 format!(
-                    "Unknown option '{}'. Try: run 'sce --help' to see top-level usage, or use 'sce <command> --help' for command-specific options.",
-                    arg
+                    "Unknown option '{arg}'. Try: run 'sce --help' to see top-level usage, or use 'sce <command> --help' for command-specific options."
                 )
             } else {
-                format!("{}. Try: run 'sce --help' to see valid usage.", message)
+                format!("{message}. Try: run 'sce --help' to see valid usage.")
             }
         }
         ErrorKind::MissingRequiredArgument => {
             // Clean up clap's message for missing required arguments
             if message.contains("required") {
-                format!(
-                    "{}. Try: run 'sce --help' to see required arguments.",
-                    message
-                )
+                format!("{message}. Try: run 'sce --help' to see required arguments.")
             } else {
-                format!("{}. Try: run 'sce --help' to see valid usage.", message)
+                format!("{message}. Try: run 'sce --help' to see valid usage.")
             }
         }
         ErrorKind::ArgumentConflict => {
             // Handle mutually exclusive arguments
             if message.contains("cannot be used with") || message.contains("conflicts with") {
-                format!("{}. Try: use only one of the conflicting options.", message)
+                format!("{message}. Try: use only one of the conflicting options.")
             } else {
-                format!("{}. Try: run 'sce --help' to see valid usage.", message)
+                format!("{message}. Try: run 'sce --help' to see valid usage.")
             }
         }
         _ => {
             // Default cleanup: ensure message ends with guidance
             if message.contains("Try:") {
                 message.to_string()
             } else {
-                format!("{}. Try: run 'sce --help' to see valid usage.", message)
+                format!("{message}. Try: run 'sce --help' to see valid usage.")
             }
         }
     }
@@ -477,6 +457,7 @@ fn convert_clap_command(command: cli_schema::Commands) -> Result<Command, Classi
     }
 }
 
+#[allow(clippy::unnecessary_wraps, clippy::needless_pass_by_value)]
 fn convert_auth_subcommand(
     subcommand: cli_schema::AuthSubcommand,
 ) -> Result<Command, ClassifiedError> {
@@ -525,6 +506,7 @@ fn convert_completion_shell(
 }
 
 /// Convert clap config subcommand to service config subcommand.
+#[allow(clippy::unnecessary_wraps)]
 fn convert_config_subcommand(
     subcommand: cli_schema::ConfigSubcommand,
 ) -> Result<Command, ClassifiedError> {
@@ -568,7 +550,8 @@ fn convert_log_level(level: cli_schema::LogLevel) -> services::config::LogLevel
     }
 }
 
-/// Convert setup command flags to SetupRequest.
+/// Convert setup command flags to `SetupRequest`.
+#[allow(clippy::fn_params_excessive_bools)]
 fn convert_setup_command(
     opencode: bool,
     claude: bool,
@@ -595,6 +578,7 @@ fn convert_setup_command(
 }
 
 /// Convert clap hooks subcommand to service hooks subcommand.
+#[allow(clippy::unnecessary_wraps)]
 fn convert_hooks_subcommand(
     subcommand: cli_schema::HooksSubcommand,
 ) -> Result<Command, ClassifiedError> {

cli/src/cli_schema.rs

@@ -16,6 +16,7 @@ pub struct Cli {
 
 impl Cli {
     /// Parse arguments from an iterator of strings
+    #[allow(dead_code)]
     pub fn parse_from<I, T>(args: I) -> Self
     where
         I: IntoIterator<Item = T>,
@@ -36,7 +37,7 @@ impl Cli {
 
 #[derive(Subcommand, Debug, Clone, PartialEq, Eq)]
 pub enum Commands {
-    /// Authenticate with WorkOS device authorization flow
+    /// Authenticate with `WorkOS` device authorization flow
     Auth {
         #[command(subcommand)]
         subcommand: AuthSubcommand,
@@ -51,15 +52,15 @@ pub enum Commands {
     /// Prepare local repository/workspace prerequisites
     #[command(about = "Prepare local repository/workspace prerequisites")]
     Setup {
-        /// Install OpenCode configuration
+        /// Install `OpenCode` configuration
         #[arg(long, conflicts_with_all = ["claude", "both"])]
         opencode: bool,
 
         /// Install Claude configuration
         #[arg(long, conflicts_with_all = ["opencode", "both"])]
         claude: bool,
 
-        /// Install both OpenCode and Claude configuration
+        /// Install both `OpenCode` and Claude configuration
         #[arg(long, conflicts_with_all = ["opencode", "claude"])]
         both: bool,
 
@@ -373,7 +374,7 @@ mod tests {
                 ConfigSubcommand::Show { format, .. } => {
                     assert_eq!(format, OutputFormat::Text);
                 }
-                _ => panic!("Expected Show subcommand"),
+                ConfigSubcommand::Validate { .. } => panic!("Expected Show subcommand"),
             },
             _ => panic!("Expected Config command"),
         }
@@ -388,7 +389,7 @@ mod tests {
                 ConfigSubcommand::Validate { format, .. } => {
                     assert_eq!(format, OutputFormat::Json);
                 }
-                _ => panic!("Expected Validate subcommand"),
+                ConfigSubcommand::Show { .. } => panic!("Expected Validate subcommand"),
             },
             _ => panic!("Expected Config command"),
         }
@@ -420,7 +421,7 @@ mod tests {
                     assert_eq!(log_level, Some(LogLevel::Debug));
                     assert_eq!(timeout_ms, Some(60000));
                 }
-                _ => panic!("Expected Show subcommand"),
+                ConfigSubcommand::Validate { .. } => panic!("Expected Show subcommand"),
             },
             _ => panic!("Expected Config command"),
         }

cli/src/command_surface.rs

@@ -93,11 +93,10 @@ Auth usage:\n  sce auth <login|logout|status> [--format <text|json>]\n\n\
 Completion usage:\n  sce completion --shell <bash|zsh|fish>\n\n\
 Output format contract:\n  Supported commands accept --format <text|json>\n\n\
 Examples:\n  sce setup\n  sce setup --opencode --non-interactive --hooks\n  sce setup --hooks --repo ../demo-repo\n  sce auth status\n  sce auth login --format json\n  sce doctor --format json\n  sce version --format json\n\n\
-Commands:\n{}\n\n\
+Commands:\n{command_rows}\n\n\
 Setup defaults to interactive target selection when no setup target flag is passed, and installs hooks in the same run.\n\
 Use '--hooks' to install required git hooks for the current repository or '--repo <path>' for a specific repository.\n\
-`setup`, `doctor`, `auth`, `hooks`, `version`, and `completion` are implemented; `mcp` and `sync` remain placeholder-oriented.\n",
-        command_rows
+`setup`, `doctor`, `auth`, `hooks`, `version`, and `completion` are implemented; `mcp` and `sync` remain placeholder-oriented.\n"
     )
 }