ci: verify codex-rs Cargo manifests inherit workspace settings

codex-rs/ansi-escape/Cargo.toml

@@ -8,6 +8,9 @@ license.workspace = true
 name = "codex_ansi_escape"
 path = "src/lib.rs"
 
+[lints]
+workspace = true
+
 [dependencies]
 ansi-to-tui = { workspace = true }
 ratatui = { workspace = true, features = [

codex-rs/app-server/tests/common/Cargo.toml

@@ -7,6 +7,9 @@ license.workspace = true
 [lib]
 path = "lib.rs"
 
+[lints]
+workspace = true
+
 [dependencies]
 anyhow = { workspace = true }
 base64 = { workspace = true }

codex-rs/app-server/tests/common/models_cache.rs

@@ -27,7 +27,7 @@ fn preset_to_info(preset: &ModelPreset, priority: i32) -> ModelInfo {
         },
         supported_in_api: preset.supported_in_api,
         priority,
-        upgrade: preset.upgrade.as_ref().map(|u| u.into()),
+        upgrade: preset.upgrade.as_ref().map(Into::into),
         base_instructions: "base instructions".to_string(),
         model_messages: None,
         supports_reasoning_summaries: false,

codex-rs/backend-client/Cargo.toml

@@ -8,6 +8,9 @@ publish = false
 [lib]
 path = "src/lib.rs"
 
+[lints]
+workspace = true
+
 [dependencies]
 anyhow = "1"
 serde = { version = "1", features = ["derive"] }

codex-rs/codex-backend-openapi-models/Cargo.toml

@@ -8,6 +8,9 @@ license.workspace = true
 name = "codex_backend_openapi_models"
 path = "src/lib.rs"
 
+[lints]
+workspace = true
+
 # Important: generated code often violates our workspace lints.
 # Allow unwrap/expect in this crate so the workspace builds cleanly
 # after models are regenerated.

codex-rs/core/tests/common/Cargo.toml

@@ -7,6 +7,9 @@ license.workspace = true
 [lib]
 path = "lib.rs"
 
+[lints]
+workspace = true
+
 [dependencies]
 anyhow = { workspace = true }
 assert_cmd = { workspace = true }

codex-rs/debug-client/Cargo.toml

@@ -4,6 +4,9 @@ version.workspace = true
 edition.workspace = true
 license.workspace = true
 
+[lints]
+workspace = true
+
 [dependencies]
 anyhow.workspace = true
 clap = { workspace = true, features = ["derive"] }

codex-rs/debug-client/src/client.rs

@@ -1,3 +1,4 @@
+#![allow(clippy::expect_used)]
 use std::io::BufRead;
 use std::io::BufReader;
 use std::io::Write;

codex-rs/debug-client/src/output.rs

@@ -1,3 +1,4 @@
+#![allow(clippy::expect_used)]
 use std::io;
 use std::io::IsTerminal;
 use std::io::Write;

codex-rs/debug-client/src/reader.rs

@@ -1,3 +1,4 @@
+#![allow(clippy::expect_used)]
 use std::io::BufRead;
 use std::io::BufReader;
 use std::process::ChildStdout;
@@ -113,7 +114,7 @@ fn handle_server_request(
     stdin: &Arc<Mutex<Option<std::process::ChildStdin>>>,
     output: &Output,
 ) -> anyhow::Result<()> {
-    let server_request = match ServerRequest::try_from(request.clone()) {
+    let server_request = match ServerRequest::try_from(request) {
         Ok(server_request) => server_request,
         Err(_) => return Ok(()),
     };

codex-rs/feedback/Cargo.toml

@@ -4,6 +4,9 @@ version.workspace = true
 edition.workspace = true
 license.workspace = true
 
+[lints]
+workspace = true
+
 [dependencies]
 anyhow = { workspace = true }
 codex-protocol = { workspace = true }

codex-rs/feedback/src/lib.rs

@@ -7,6 +7,7 @@ use std::io::{self};
 use std::path::PathBuf;
 use std::sync::Arc;
 use std::sync::Mutex;
+use std::sync::PoisonError;
 use std::time::Duration;
 
 use anyhow::Result;
@@ -95,11 +96,19 @@ impl CodexFeedback {
 
     pub fn snapshot(&self, session_id: Option<ThreadId>) -> FeedbackSnapshot {
         let bytes = {
-            let guard = self.inner.ring.lock().expect("mutex poisoned");
+            let guard = self
+                .inner
+                .ring
+                .lock()
+                .unwrap_or_else(PoisonError::into_inner);
             guard.snapshot_bytes()
         };
         let tags = {
-            let guard = self.inner.tags.lock().expect("mutex poisoned");
+            let guard = self
+                .inner
+                .tags
+                .lock()
+                .unwrap_or_else(PoisonError::into_inner);
             guard.clone()
         };
         FeedbackSnapshot {
@@ -324,7 +333,7 @@ impl FeedbackSnapshot {
             use sentry::protocol::Values;
 
             event.exception = Values::from(vec![Exception {
-                ty: title.clone(),
+                ty: title,
                 value: Some(r.to_string()),
                 ..Default::default()
             }]);
@@ -430,7 +439,11 @@ where
             return;
         }
 
-        let mut guard = self.inner.tags.lock().expect("mutex poisoned");
+        let mut guard = self
+            .inner
+            .tags
+            .lock()
+            .unwrap_or_else(PoisonError::into_inner);
         for (key, value) in visitor.tags {
             if guard.len() >= MAX_FEEDBACK_TAGS && !guard.contains_key(&key) {
                 continue;

codex-rs/file-search/Cargo.toml

@@ -12,6 +12,9 @@ path = "src/main.rs"
 name = "codex_file_search"
 path = "src/lib.rs"
 
+[lints]
+workspace = true
+
 [dependencies]
 anyhow = { workspace = true }
 clap = { workspace = true, features = ["derive"] }

codex-rs/file-search/src/lib.rs

@@ -20,6 +20,7 @@ use std::path::PathBuf;
 use std::sync::Arc;
 use std::sync::Condvar;
 use std::sync::Mutex;
+use std::sync::PoisonError;
 use std::sync::RwLock;
 use std::sync::atomic::AtomicBool;
 use std::sync::atomic::Ordering;
@@ -195,10 +196,10 @@ pub fn create_session(
         threads: threads.get(),
         compute_indices,
         respect_gitignore,
-        cancelled: cancelled.clone(),
+        cancelled,
         shutdown: Arc::new(AtomicBool::new(false)),
         reporter,
-        work_tx: work_tx.clone(),
+        work_tx,
     });
 
     let matcher_inner = inner.clone();
@@ -611,14 +612,16 @@ struct RunReporter {
 
 impl SessionReporter for RunReporter {
     fn on_update(&self, snapshot: &FileSearchSnapshot) {
-        #[expect(clippy::unwrap_used)]
-        let mut guard = self.snapshot.write().unwrap();
+        let mut guard = self
+            .snapshot
+            .write()
+            .unwrap_or_else(PoisonError::into_inner);
         *guard = snapshot.clone();
     }
 
     fn on_complete(&self) {
         let (cv, mutex) = &self.completed;
-        let mut completed = mutex.lock().unwrap();
+        let mut completed = mutex.lock().unwrap_or_else(PoisonError::into_inner);
         *completed = true;
         cv.notify_all();
     }
@@ -627,11 +630,14 @@ impl SessionReporter for RunReporter {
 impl RunReporter {
     fn wait_for_complete(&self) -> FileSearchSnapshot {
         let (cv, mutex) = &self.completed;
-        let mut completed = mutex.lock().unwrap();
+        let mut completed = mutex.lock().unwrap_or_else(PoisonError::into_inner);
         while !*completed {
-            completed = cv.wait(completed).unwrap();
+            completed = cv.wait(completed).unwrap_or_else(PoisonError::into_inner);
         }
-        self.snapshot.read().unwrap().clone()
+        self.snapshot
+            .read()
+            .unwrap_or_else(PoisonError::into_inner)
+            .clone()
     }
 }
 

codex-rs/file-search/src/main.rs

@@ -27,12 +27,15 @@ struct StdioReporter {
 impl Reporter for StdioReporter {
     fn report_match(&self, file_match: &FileMatch) {
         if self.write_output_as_json {
-            println!("{}", serde_json::to_string(&file_match).unwrap());
+            match serde_json::to_string(file_match) {
+                Ok(json) => println!("{json}"),
+                Err(err) => eprintln!("Failed to serialize file match as JSON: {err}"),
+            }
         } else if self.show_indices {
-            let indices = file_match
-                .indices
-                .as_ref()
-                .expect("--compute-indices was specified");
+            let Some(indices) = file_match.indices.as_ref() else {
+                println!("{}", file_match.path.to_string_lossy());
+                return;
+            };
             // `indices` is guaranteed to be sorted in ascending order. Instead
             // of calling `contains` for every character (which would be O(N^2)
             // in the worst-case), walk through the `indices` vector once while
@@ -61,7 +64,10 @@ impl Reporter for StdioReporter {
     fn warn_matches_truncated(&self, total_match_count: usize, shown_match_count: usize) {
         if self.write_output_as_json {
             let value = json!({"matches_truncated": true});
-            println!("{}", serde_json::to_string(&value).unwrap());
+            match serde_json::to_string(&value) {
+                Ok(json) => println!("{json}"),
+                Err(err) => eprintln!("Failed to serialize truncation warning as JSON: {err}"),
+            }
         } else {
             eprintln!(
                 "Warning: showing {shown_match_count} out of {total_match_count} results. Provide a more specific pattern or increase the --limit.",

codex-rs/mcp-server/tests/common/Cargo.toml

@@ -7,6 +7,9 @@ license.workspace = true
 [lib]
 path = "lib.rs"
 
+[lints]
+workspace = true
+
 [dependencies]
 anyhow = { workspace = true }
 codex-core = { workspace = true }

codex-rs/network-proxy/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "codex-network-proxy"
-edition = "2024"
+edition.workspace = true
 version = { workspace = true }
 license.workspace = true
 

codex-rs/shell-escalation/Cargo.toml

@@ -8,6 +8,9 @@ version.workspace = true
 name = "codex-execve-wrapper"
 path = "src/bin/main_execve_wrapper.rs"
 
+[lints]
+workspace = true
+
 [dependencies]
 anyhow = { workspace = true }
 async-trait = { workspace = true }

codex-rs/shell-escalation/src/unix/escalate_server.rs

@@ -601,7 +601,7 @@ mod tests {
         let execve_wrapper_str = execve_wrapper.to_string_lossy().to_string();
         let server = EscalateServer::new(
             PathBuf::from("/bin/zsh"),
-            execve_wrapper.clone(),
+            execve_wrapper,
             DeterministicEscalationPolicy {
                 decision: EscalationDecision::run(),
             },

codex-rs/shell-escalation/src/unix/socket.rs

@@ -59,15 +59,18 @@ fn extract_fds(control: &[u8]) -> Vec<OwnedFd> {
         let ty = unsafe { (*cmsg).cmsg_type };
         if level == libc::SOL_SOCKET && ty == libc::SCM_RIGHTS {
             let data_ptr = unsafe { libc::CMSG_DATA(cmsg).cast::<RawFd>() };
-            let fd_count: usize = {
+            let Some(cmsg_data_len) = ({
                 // `cmsghdr::cmsg_len` is not typed consistently across targets, so normalize it
                 // before doing the size arithmetic.
                 #[allow(clippy::useless_conversion)]
-                let cmsg_data_len = usize::try_from(unsafe { (*cmsg).cmsg_len })
-                    .expect("cmsghdr length fits")
-                    - unsafe { libc::CMSG_LEN(0) as usize };
-                cmsg_data_len / size_of::<RawFd>()
+                usize::try_from(unsafe { (*cmsg).cmsg_len })
+                    .ok()
+                    .and_then(|len| len.checked_sub(unsafe { libc::CMSG_LEN(0) as usize }))
+            }) else {
+                cmsg = unsafe { libc::CMSG_NXTHDR(&hdr, cmsg) };
+                continue;
             };
+            let fd_count = cmsg_data_len / size_of::<RawFd>();
             for i in 0..fd_count {
                 let fd = unsafe { data_ptr.add(i).read() };
                 fds.push(unsafe { OwnedFd::from_raw_fd(fd) });

codex-rs/utils/pty/Cargo.toml

@@ -1,5 +1,5 @@
 [package]
-edition = "2024"
+edition.workspace = true
 license.workspace = true
 name = "codex-utils-pty"
 version.workspace = true

codex-rs/windows-sandbox-rs/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 build = "build.rs"
-edition = "2024"
+edition.workspace = true
 license.workspace = true
 name = "codex-windows-sandbox"
 version.workspace = true
@@ -17,6 +17,9 @@ path = "src/bin/setup_main.rs"
 name = "codex-command-runner"
 path = "src/bin/command_runner.rs"
 
+[lints]
+workspace = true
+
 [dependencies]
 anyhow = "1.0"
 base64 = { workspace = true }