From 58613a61f3d6ef5ac1d0773c508b68fb6375fbfa Mon Sep 17 00:00:00 2001
From: Adam Poulemanos <adam@knitli.com>
Date: Sat, 25 Jul 2026 21:55:49 -0400
Subject: [PATCH 1/3] chore: fix typos, clippy idioms, and formatting after
 P2/P3 test work

Follow-up polish on the P2/P3 test-improvement work (#62) that landed in
ffe76d8 and 1c22370:

- Spelling: "behaviour" -> "behavior" in CLI help, doc comments, and the
  README, matching the en-us locale declared in _typos.toml.
- Clippy idioms: map(..).unwrap_or(false) -> is_ok_and, map(to_string) ->
  map(clone) on an owned String.
- rustfmt over the test files touched by the P3 work.
- _typos.toml: recognize the HTML comment form of the spellchecker:off/on
  fence, and exclude the generated CHANGELOG.md.
- hk.pkl: drop the redundant --config flag from the typos step; typos
  already discovers _typos.toml from the workspace indicator.

Refs #62

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XocU6NjgZricrRWMLyLXDn
---
 README.md                     |  2 +-
 _typos.toml                   |  5 ++-
 hk.pkl                        |  4 +-
 src/commands.rs               |  6 +--
 src/config.rs                 |  4 +-
 src/git_manager.rs            | 22 ++++++-----
 src/git_ops/git2_ops.rs       | 14 +++++--
 src/git_ops/gix_ops.rs        |  4 +-
 src/git_ops/simple_gix.rs     |  2 +-
 src/options.rs                |  2 +-
 src/utilities.rs              | 29 +++++++++-----
 tests/config_tests.rs         | 74 ++++++++++++++++++++++++-----------
 tests/error_handling_tests.rs | 12 ++++--
 tests/performance_tests.rs    | 65 +++++++++++++++++++-----------
 tests/security_tests.rs       | 38 ++++++++++--------
 15 files changed, 182 insertions(+), 101 deletions(-)

diff --git a/README.md b/README.md
index 52863c7..245ac91 100644
--- a/README.md
+++ b/README.md
@@ -319,7 +319,7 @@ submod completeme bash > ~/.bash_completion.d/submod
 
 ```zsh "zsh"
 # zsh has an fpath array with possible function directories. You can
-# put your competions in any of these; we use the first one here:
+# put your completions in any of these; we use the first one here:
 ZSH_DEFAULT="${XDG_DATA_HOME:-~/.local/share}/zsh/site-functions"
 ZFUNCDIR=""${fpath[1]:-$ZSH_DEFAULT}"
 mkdir -p "$ZFUNCDIR"
diff --git a/_typos.toml b/_typos.toml
index 1ec392d..5064868 100755
--- a/_typos.toml
+++ b/_typos.toml
@@ -7,7 +7,7 @@ locale = "en-us"
 check-file = true
 check-filename = true
 extend-ignore-re = [
-  "(?s)(#|//)\\s*spellchecker:off.*?\\n\\s*(#|//)\\s*spellchecker:on"
+  "(?s)(#|//|<!--)\\s*spellchecker:off.*?\\n\\s*(#|//|<!--)\\s*spellchecker:on"
 ]
 extend-ignore-identifiers-re = [
   "iif",
@@ -30,5 +30,6 @@ extend-exclude = [
   ".venv/",
   ".git/",
   "target/",
-  "docs/"
+  "docs/",
+  "CHANGELOG.md",
 ]
diff --git a/hk.pkl b/hk.pkl
index 1b2b76d..3a3a945 100644
--- a/hk.pkl
+++ b/hk.pkl
@@ -30,8 +30,8 @@ local linters = new Mapping<String, Step> {
     ["typos"] = new Step {
         workspace_indicator = "_typos.toml"
         glob = List( "*README", "*.{.login,astro,bash,bash_logout,bashrc,browserlistrc,conf,config,csh,css,cts,fish,gitattributes,gitmodules,html,htmx,ini,j2,jinja,jinja2,json,json5,jsonc,jsonl,ksh,md,mdown,mdtext,mdtxt,mdwn,mdx,mk,mkd,mts,nix,nu,pkl,profile,quokka,sass,scss,sh,sh,shellcheckrc,sql,sqlite,stylelintrc,svelte,tcsh,toml,ts,tsx,txt,yaml,yml,zlogin,zlogout,zprofile,zsh,zshenv,zshrc}", "*Dockerfile*", "*Makefile*", "*makefile*", "CHANGELOG*", "CODE_OF_CONDUCT*", "CONTRIBUTING*", "HACKING*", "LICENSE", "README*", "SECURITY*", "UNLICENSE")
-        check = "typos -j 8 --config {{ workspace_indicator }} {{ files }}"
-        fix = "typos --write-changes --config {{ workspace_indicator }} {{ files }}"
+        check = "typos -j 8 {{ files }}"
+        fix = "typos --write-changes {{ files }}"
     }
 
 
diff --git a/src/commands.rs b/src/commands.rs
index b589787..6660afb 100644
--- a/src/commands.rs
+++ b/src/commands.rs
@@ -125,7 +125,7 @@ pub enum Commands {
             num_args = 0..=1,
             value_parser = clap::value_parser!(bool),
             default_missing_value = "true",
-            help = "Opt out of submod's deny-all-by-default sparse-checkout model and use git's built-in behaviour instead. When set, the `!/*` prefix is NOT prepended automatically."
+            help = "Opt out of submod's deny-all-by-default sparse-checkout model and use git's built-in behavior instead. When set, the `!/*` prefix is NOT prepended automatically."
         )]
         use_git_default_sparse_checkout: Option<bool>,
 
@@ -180,7 +180,7 @@ pub enum Commands {
             num_args = 0..=1,
             value_parser = clap::value_parser!(bool),
             default_missing_value = "true",
-            help = "Opt out of submod's deny-all-by-default sparse-checkout model and use git's built-in behaviour instead."
+            help = "Opt out of submod's deny-all-by-default sparse-checkout model and use git's built-in behavior instead."
         )]
         use_git_default_sparse_checkout: Option<bool>,
 
@@ -248,7 +248,7 @@ pub enum Commands {
             num_args = 0..=1,
             value_parser = clap::value_parser!(bool),
             default_missing_value = "true",
-            help = "Set the global default for sparse-checkout mode. When true, all submodules use git's built-in behaviour instead of submod's deny-all-by-default model (unless overridden per-submodule)."
+            help = "Set the global default for sparse-checkout mode. When true, all submodules use git's built-in behavior instead of submod's deny-all-by-default model (unless overridden per-submodule)."
         )]
         use_git_default_sparse_checkout: Option<bool>,
     },
diff --git a/src/config.rs b/src/config.rs
index c25c593..3ef26d6 100644
--- a/src/config.rs
+++ b/src/config.rs
@@ -174,7 +174,7 @@ pub struct SubmoduleDefaults {
     pub fetch_recurse: Option<SerializableFetchRecurse>,
     /// [`Update`][SerializableUpdate] setting for submodules
     pub update: Option<SerializableUpdate>,
-    /// When `true`, use git's built-in sparse-checkout behaviour (no `!/*` prefix is
+    /// When `true`, use git's built-in sparse-checkout behavior (no `!/*` prefix is
     /// prepended). Defaults to `false`, which uses submod's deny-all-by-default model.
     /// Individual submodules can override this per-entry.
     #[serde(default, skip_serializing_if = "Option::is_none")]
@@ -471,7 +471,7 @@ pub struct SubmoduleEntry {
     /// Sparse checkout paths for this submodule (optional)
     #[serde(skip_serializing_if = "Option::is_none")]
     pub sparse_paths: Option<Vec<String>>,
-    /// When `true`, use git's built-in sparse-checkout behaviour instead of submod's
+    /// When `true`, use git's built-in sparse-checkout behavior instead of submod's
     /// deny-all-by-default model.  Overrides the global `[defaults]` setting.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub use_git_default_sparse_checkout: Option<bool>,
diff --git a/src/git_manager.rs b/src/git_manager.rs
index 3e25b10..ae28fb3 100644
--- a/src/git_manager.rs
+++ b/src/git_manager.rs
@@ -320,8 +320,7 @@ impl GitManager {
         // Check if submodule has its own submodules
         let has_submodules = submodule_repo
             .submodules()
-            .map(|subs| subs.is_some_and(|mut iter| iter.next().is_some()))
-            .unwrap_or(false);
+            .is_ok_and(|subs| subs.is_some_and(|mut iter| iter.next().is_some()));
 
         Ok(SubmoduleStatus {
             path: submodule_path.to_string(),
@@ -406,8 +405,13 @@ impl GitManager {
         no_init: bool,
         use_git_default_sparse_checkout: Option<bool>,
     ) -> Result<(), SubmoduleError> {
-        let repo_root = self.git_ops.workdir().ok_or(SubmoduleError::RepositoryError)?;
-        if let Err(e) = crate::utilities::validate_submodule_path(repo_root, std::path::Path::new(&path)) {
+        let repo_root = self
+            .git_ops
+            .workdir()
+            .ok_or(SubmoduleError::RepositoryError)?;
+        if let Err(e) =
+            crate::utilities::validate_submodule_path(repo_root, std::path::Path::new(&path))
+        {
             return Err(SubmoduleError::InvalidPath(e.to_string()));
         }
 
@@ -531,7 +535,7 @@ impl GitManager {
     ///
     /// By default (`use_git_default = false`) the deny-all-by-default model is applied:
     /// `!/*` is prepended so only the explicitly listed `patterns` are checked out, and a
-    /// one-time informational message is printed to help users understand the behaviour and
+    /// one-time informational message is printed to help users understand the behavior and
     /// opt out if needed.
     ///
     /// When `use_git_default = true` the patterns are written as-is, matching git's own
@@ -552,7 +556,7 @@ impl GitManager {
                 eprintln!(
                     "ℹ️  submod uses a deny-all-by-default sparse-checkout model: `!/*` is \
                      automatically prepended so only the paths you list are checked out.\n\
-                     To use git's default behaviour instead, set \
+                     To use git's default behavior instead, set \
                      `use_git_default_sparse_checkout = true` in your submod.toml (globally \
                      under `[defaults]` or per submodule) or pass \
                      `--use-git-default-sparse-checkout`."
@@ -589,7 +593,7 @@ impl GitManager {
     ///
     /// This implements the "modified cone pattern" approach: all paths are denied by
     /// default and only the explicitly listed patterns are checked out. This makes the
-    /// intent clear and avoids surprises from git's default include-everything behaviour.
+    /// intent clear and avoids surprises from git's default include-everything behavior.
     ///
     /// Blank entries (empty or whitespace-only strings) are stripped before processing.
     /// If no non-blank include patterns remain after normalization, an empty list is
@@ -1477,7 +1481,7 @@ impl GitManager {
                 entries
                     .submodule_iter()
                     .find(|(_, e)| e.path.as_deref() == Some(path.as_str()))
-                    .map(|(n, _)| n.to_string())
+                    .map(|(n, _)| n.clone())
             };
 
             if let Some(gm_name) = gitmodules_name {
@@ -1876,7 +1880,7 @@ mod tests {
     use tempfile::tempdir;
 
     // Helper to create a `GitManager` for tests that need to call methods such as
-    // `check_sparse_checkout_status`. It initialises a real git repository in `repo_dir`
+    // `check_sparse_checkout_status`. It initializes a real git repository in `repo_dir`
     // via `git2` so that `GitOpsManager` can open it without depending on the caller's
     // working directory being inside a git repo.
     fn create_test_manager(repo_dir: &Path, config_path: PathBuf) -> GitManager {
diff --git a/src/git_ops/git2_ops.rs b/src/git_ops/git2_ops.rs
index 0194f7e..4a802c5 100644
--- a/src/git_ops/git2_ops.rs
+++ b/src/git_ops/git2_ops.rs
@@ -208,7 +208,9 @@ impl GitOperations for Git2Operations {
         ))
     }
     fn write_gitmodules(&mut self, config: &SubmoduleEntries) -> Result<()> {
-        let workdir = self.repo.workdir()
+        let workdir = self
+            .repo
+            .workdir()
             .ok_or_else(|| anyhow::anyhow!("Repository has no working directory"))?;
         let gitmodules_path = workdir.join(".gitmodules");
 
@@ -239,10 +241,16 @@ impl GitOperations for Git2Operations {
                 gitmodules_config.set_str(&format!("{section}.ignore"), &ignore.to_gitmodules())?;
             }
             if let Some(fetch_recurse) = &entry.fetch_recurse {
-                gitmodules_config.set_str(&format!("{section}.fetchRecurseSubmodules"), &fetch_recurse.to_gitmodules())?;
+                gitmodules_config.set_str(
+                    &format!("{section}.fetchRecurseSubmodules"),
+                    &fetch_recurse.to_gitmodules(),
+                )?;
             }
             if let Some(active) = entry.active {
-                gitmodules_config.set_str(&format!("{section}.active"), if active { "true" } else { "false" })?;
+                gitmodules_config.set_str(
+                    &format!("{section}.active"),
+                    if active { "true" } else { "false" },
+                )?;
             }
 
             // 2. Sync to local repository config (.git/config) if the submodule exists in the repository
diff --git a/src/git_ops/gix_ops.rs b/src/git_ops/gix_ops.rs
index 3ae6e6c..8fc7c8b 100644
--- a/src/git_ops/gix_ops.rs
+++ b/src/git_ops/gix_ops.rs
@@ -500,7 +500,7 @@ impl GitOperations for GixOperations {
         let submodule_name = entries
             .submodule_iter()
             .find(|(_, entry)| entry.path.as_ref() == Some(&path.to_string()))
-            .map(|(name, _)| name.to_string())
+            .map(|(name, _)| name.clone())
             .ok_or_else(|| anyhow::anyhow!("Submodule '{path}' not found in .gitmodules"))?;
 
         // 3. Remove from .gitmodules
@@ -583,7 +583,7 @@ impl GitOperations for GixOperations {
         let submodule_name = entries
             .submodule_iter()
             .find(|(_, entry)| entry.path.as_ref() == Some(&path.to_string()))
-            .map(|(name, _)| name.to_string())
+            .map(|(name, _)| name.clone())
             .ok_or_else(|| anyhow::anyhow!("Submodule '{path}' not found in .gitmodules"))?;
         self.clone().try_gix_operation_mut(|repo| {
             // 1. Get the submodule directory
diff --git a/src/git_ops/simple_gix.rs b/src/git_ops/simple_gix.rs
index d0fb74c..6a5189a 100644
--- a/src/git_ops/simple_gix.rs
+++ b/src/git_ops/simple_gix.rs
@@ -26,7 +26,7 @@ pub fn setup_line_renderer_range(
         prodash::render::line::Options {
             level_filter: Some(levels),
             frames_per_second: 6.0,
-            initial_delay: Some(std::time::Duration::from_millis(1000)),
+            initial_delay: Some(std::time::Duration::from_secs(1)),
             timestamp: true,
             throughput: true,
             hide_cursor: true,
diff --git a/src/options.rs b/src/options.rs
index 9b1bd47..cc39ce3 100644
--- a/src/options.rs
+++ b/src/options.rs
@@ -462,7 +462,7 @@ impl GitmodulesConvert for SerializableBranch {
     fn to_gitmodules(&self) -> String {
         match self {
             Self::CurrentInSuperproject => ".".to_string(),
-            Self::Name(name) => name.to_string(),
+            Self::Name(name) => name.clone(),
         }
     }
 
diff --git a/src/utilities.rs b/src/utilities.rs
index 8839fce..8ebfd83 100644
--- a/src/utilities.rs
+++ b/src/utilities.rs
@@ -227,12 +227,17 @@ pub fn get_name(
 
 /// Validate a submodule path to ensure it is not absolute and does not escape
 /// the repository root via directory traversal (`..`) or symbolic links.
-pub fn validate_submodule_path(repo_root: &std::path::Path, path: &std::path::Path) -> Result<(), anyhow::Error> {
+pub fn validate_submodule_path(
+    repo_root: &std::path::Path,
+    path: &std::path::Path,
+) -> Result<(), anyhow::Error> {
     if path.is_absolute() {
         return Err(anyhow::anyhow!("Submodule path cannot be absolute"));
     }
 
-    let repo_root = repo_root.canonicalize().unwrap_or_else(|_| repo_root.to_path_buf());
+    let repo_root = repo_root
+        .canonicalize()
+        .unwrap_or_else(|_| repo_root.to_path_buf());
 
     let mut current = repo_root.clone();
     for component in path.components() {
@@ -247,9 +252,9 @@ pub fn validate_submodule_path(repo_root: &std::path::Path, path: &std::path::Pa
                     } else {
                         current.parent().unwrap().join(target)
                     };
-                    let canonical_resolved = resolved.canonicalize().unwrap_or_else(|_| {
-                        normalize_path_only(&resolved)
-                    });
+                    let canonical_resolved = resolved
+                        .canonicalize()
+                        .unwrap_or_else(|_| normalize_path_only(&resolved));
                     if !canonical_resolved.starts_with(&repo_root) {
                         return Err(anyhow::anyhow!(
                             "Submodule path escapes repository root via symlink: {}",
@@ -267,17 +272,21 @@ pub fn validate_submodule_path(repo_root: &std::path::Path, path: &std::path::Pa
             }
             std::path::Component::CurDir => {}
             std::path::Component::Prefix(_) | std::path::Component::RootDir => {
-                return Err(anyhow::anyhow!("Submodule path cannot contain root or prefix components"));
+                return Err(anyhow::anyhow!(
+                    "Submodule path cannot contain root or prefix components"
+                ));
             }
         }
     }
 
     // Also check the final resolved path
-    let final_canonical = current.canonicalize().unwrap_or_else(|_| {
-        normalize_path_only(&current)
-    });
+    let final_canonical = current
+        .canonicalize()
+        .unwrap_or_else(|_| normalize_path_only(&current));
     if !final_canonical.starts_with(&repo_root) {
-        return Err(anyhow::anyhow!("Submodule path resolves outside repository root"));
+        return Err(anyhow::anyhow!(
+            "Submodule path resolves outside repository root"
+        ));
     }
 
     Ok(())
diff --git a/tests/config_tests.rs b/tests/config_tests.rs
index 8499b52..5d53939 100644
--- a/tests/config_tests.rs
+++ b/tests/config_tests.rs
@@ -341,17 +341,18 @@ sparse_paths = ["src/**", "docs/*", "*.{md,txt,rst}"]
 
     #[test]
     fn test_public_surface_coverage() {
-        use submod::config::{SubmoduleUpdateOptions, SubmoduleEntry, OtherSubmoduleSettings, SubmoduleGitOptions, SubmoduleEntries};
-        use submod::options::{SerializableUpdate, SerializableFetchRecurse, SerializableIgnore, SerializableBranch};
-        use submod::git_ops::Git2Operations;
         use std::collections::HashMap;
+        use submod::config::{
+            OtherSubmoduleSettings, SubmoduleEntries, SubmoduleEntry, SubmoduleGitOptions,
+            SubmoduleUpdateOptions,
+        };
+        use submod::git_ops::Git2Operations;
+        use submod::options::{
+            SerializableBranch, SerializableFetchRecurse, SerializableIgnore, SerializableUpdate,
+        };
 
         // 1. Test SubmoduleUpdateOptions methods
-        let update_opts = SubmoduleUpdateOptions::new(
-            SerializableUpdate::Rebase,
-            true,
-            false,
-        );
+        let update_opts = SubmoduleUpdateOptions::new(SerializableUpdate::Rebase, true, false);
         assert_eq!(update_opts.strategy, SerializableUpdate::Rebase);
         assert!(update_opts.recursive);
         assert!(!update_opts.force);
@@ -395,18 +396,22 @@ sparse_paths = ["src/**", "docs/*", "*.{md,txt,rst}"]
             no_init: true,
         };
 
-        let entry_from_opts = SubmoduleEntry::from_options_and_settings(
-            git_opts.clone(),
-            other_settings.clone(),
+        let entry_from_opts =
+            SubmoduleEntry::from_options_and_settings(git_opts.clone(), other_settings.clone());
+        assert_eq!(
+            entry_from_opts.url.as_deref(),
+            Some("https://example.com/repo-new.git")
         );
-        assert_eq!(entry_from_opts.url.as_deref(), Some("https://example.com/repo-new.git"));
         assert_eq!(entry_from_opts.path.as_deref(), Some("lib/test-new"));
         assert_eq!(entry_from_opts.active, Some(false));
         assert_eq!(entry_from_opts.shallow, Some(true));
         assert_eq!(entry_from_opts.no_init, Some(true));
 
         let updated_entry = entry.update_with_settings(other_settings);
-        assert_eq!(updated_entry.url.as_deref(), Some("https://example.com/repo-new.git"));
+        assert_eq!(
+            updated_entry.url.as_deref(),
+            Some("https://example.com/repo-new.git")
+        );
         assert_eq!(updated_entry.path.as_deref(), Some("lib/test-new"));
         assert_eq!(updated_entry.active, Some(false));
         assert_eq!(updated_entry.shallow, Some(true));
@@ -417,18 +422,37 @@ sparse_paths = ["src/**", "docs/*", "*.{md,txt,rst}"]
         let entry_to_insert = SubmoduleEntry::new(
             Some("https://example.com/repo.git".to_string()),
             Some("lib/test".to_string()),
-            None, None, None, None, Some(true), Some(false), Some(false)
+            None,
+            None,
+            None,
+            None,
+            Some(true),
+            Some(false),
+            Some(false),
         );
         entries.update_entry("test-sub".to_string(), entry_to_insert);
-        
+
         // Test set_sparse_paths_for when paths is not empty
         entries.set_sparse_paths_for("test-sub", vec!["src/".to_string(), "docs/".to_string()]);
-        let stored_entry = entries.iter().find(|(name, _)| *name == "test-sub").unwrap().1.0;
-        assert_eq!(stored_entry.sparse_paths, Some(vec!["src/".to_string(), "docs/".to_string()]));
+        let stored_entry = entries
+            .iter()
+            .find(|(name, _)| *name == "test-sub")
+            .unwrap()
+            .1
+            .0;
+        assert_eq!(
+            stored_entry.sparse_paths,
+            Some(vec!["src/".to_string(), "docs/".to_string()])
+        );
 
         // Test set_sparse_paths_for when paths is empty
         entries.set_sparse_paths_for("test-sub", vec![]);
-        let stored_entry_empty = entries.iter().find(|(name, _)| *name == "test-sub").unwrap().1.0;
+        let stored_entry_empty = entries
+            .iter()
+            .find(|(name, _)| *name == "test-sub")
+            .unwrap()
+            .1
+            .0;
         assert_eq!(stored_entry_empty.sparse_paths, None);
 
         // 4. Test Config loading and sync methods using a real test harness
@@ -455,11 +479,14 @@ active = true
         assert_eq!(config.defaults.ignore, Some(SerializableIgnore::Dirty));
 
         // Test sync_with_git_config and load_with_git_sync
-        let mut git_ops = Git2Operations::new(Some(&harness.work_dir)).expect("Failed to open git_ops");
-        
+        let mut git_ops =
+            Git2Operations::new(Some(&harness.work_dir)).expect("Failed to open git_ops");
+
         // Initially, config has a submodule but gitmodules has nothing.
         // We sync config with git config, which should write the submodule to .gitmodules
-        config.sync_with_git_config(&mut git_ops).expect("Failed to sync_with_git_config");
+        config
+            .sync_with_git_config(&mut git_ops)
+            .expect("Failed to sync_with_git_config");
 
         // Verify .gitmodules was written
         let gitmodules_content = harness.gitmodules_entries();
@@ -469,6 +496,9 @@ active = true
         let loaded_sync_config = submod::Config::default()
             .load_with_git_sync(&config_path, &mut git_ops, submod::Config::default())
             .expect("Failed to load_with_git_sync");
-        assert_eq!(loaded_sync_config.defaults.ignore, Some(SerializableIgnore::Dirty));
+        assert_eq!(
+            loaded_sync_config.defaults.ignore,
+            Some(SerializableIgnore::Dirty)
+        );
     }
 }
diff --git a/tests/error_handling_tests.rs b/tests/error_handling_tests.rs
index 8aeb1e0..2de5b28 100644
--- a/tests/error_handling_tests.rs
+++ b/tests/error_handling_tests.rs
@@ -139,7 +139,9 @@ mod tests {
             assert_eq!(output.status.code(), Some(1));
             let stderr = String::from_utf8_lossy(&output.stderr);
             assert!(
-                stderr.contains("Failed to add submodule") || stderr.contains("Not a directory") || stderr.contains("not a directory"),
+                stderr.contains("Failed to add submodule")
+                    || stderr.contains("Not a directory")
+                    || stderr.contains("not a directory"),
                 "Expected directory collision/IO failure message, got: {stderr}"
             );
         } else {
@@ -396,7 +398,9 @@ active = true
             assert_eq!(output.status.code(), Some(1));
             let stderr = String::from_utf8_lossy(&output.stderr);
             assert!(
-                stderr.contains("Failed to add submodule") || stderr.contains("space") || stderr.contains("disk"),
+                stderr.contains("Failed to add submodule")
+                    || stderr.contains("space")
+                    || stderr.contains("disk"),
                 "Expected failure message containing space/disk details, got: {stderr}"
             );
         }
@@ -540,7 +544,9 @@ active = true
             assert_eq!(output.status.code(), Some(1));
             let stderr = String::from_utf8_lossy(&output.stderr);
             assert!(
-                stderr.contains("Is a directory") || stderr.contains("Failed to save config") || stderr.contains("is a directory"),
+                stderr.contains("Is a directory")
+                    || stderr.contains("Failed to save config")
+                    || stderr.contains("is a directory"),
                 "Expected directory write/config save failure message, got: {stderr}"
             );
 
diff --git a/tests/performance_tests.rs b/tests/performance_tests.rs
index fcac9c0..494a15f 100644
--- a/tests/performance_tests.rs
+++ b/tests/performance_tests.rs
@@ -23,7 +23,6 @@ static ALLOCATED: AtomicUsize = AtomicUsize::new(0);
 static PEAK_ALLOCATED: AtomicUsize = AtomicUsize::new(0);
 
 unsafe impl GlobalAlloc for TrackingAllocator {
-
     unsafe fn alloc(&self, layout: Layout) -> *mut u8 {
         let ptr = unsafe { System.alloc(layout) };
         if !ptr.is_null() {
@@ -32,7 +31,11 @@ unsafe impl GlobalAlloc for TrackingAllocator {
             let current = prev + size;
             loop {
                 let peak = PEAK_ALLOCATED.load(Ordering::Relaxed);
-                if current <= peak || PEAK_ALLOCATED.compare_exchange_weak(peak, current, Ordering::Relaxed, Ordering::Relaxed).is_ok() {
+                if current <= peak
+                    || PEAK_ALLOCATED
+                        .compare_exchange_weak(peak, current, Ordering::Relaxed, Ordering::Relaxed)
+                        .is_ok()
+                {
                     break;
                 }
             }
@@ -461,7 +464,10 @@ ignore = "all"
         std::env::set_current_dir(orig_dir).ok();
 
         println!("Large operations in-process time: {duration:?}");
-        println!("Peak memory usage during large operations: {} KB", net_peak / 1024);
+        println!(
+            "Peak memory usage during large operations: {} KB",
+            net_peak / 1024
+        );
 
         // Assert memory usage is within reasonable bounds (e.g. less than 20 MB)
         assert!(
@@ -598,16 +604,21 @@ active = true
             .expect("Failed to create remote 2");
         let remote_url2 = format!("file://{}", remote_repo2.display());
 
-        let output = harness.run_submod(&[
-            "add",
-            &remote_url2,
-            "--name",
-            "lock-sub2",
-            "--path",
-            "lib/lock-sub2",
-        ]).expect("Failed to run submod");
+        let output = harness
+            .run_submod(&[
+                "add",
+                &remote_url2,
+                "--name",
+                "lock-sub2",
+                "--path",
+                "lib/lock-sub2",
+            ])
+            .expect("Failed to run submod");
 
-        assert!(!output.status.success(), "Command should fail when index is locked");
+        assert!(
+            !output.status.success(),
+            "Command should fail when index is locked"
+        );
         let stderr = String::from_utf8_lossy(&output.stderr);
         assert!(
             stderr.contains("index.lock") || stderr.contains("lock") || stderr.contains("failed"),
@@ -618,17 +629,20 @@ active = true
         fs::remove_file(&super_lock_path).expect("Failed to remove lock file");
 
         // Now it should succeed
-        harness.run_submod_success(&[
-            "add",
-            &remote_url2,
-            "--name",
-            "lock-sub2",
-            "--path",
-            "lib/lock-sub2",
-        ]).expect("Failed to add submodule after lock release");
+        harness
+            .run_submod_success(&[
+                "add",
+                &remote_url2,
+                "--name",
+                "lock-sub2",
+                "--path",
+                "lib/lock-sub2",
+            ])
+            .expect("Failed to add submodule after lock release");
 
         // Lock the submodule's index
-        let sub_git_dir = harness.get_sparse_checkout_file_path("lib/lock-sub")
+        let sub_git_dir = harness
+            .get_sparse_checkout_file_path("lib/lock-sub")
             .parent() // info
             .unwrap()
             .parent() // gitdir root
@@ -638,8 +652,13 @@ active = true
         fs::write(&sub_lock_path, "locked").expect("Failed to create submodule lock file");
 
         // Run reset which modifies the submodule index, and verify failure
-        let output2 = harness.run_submod(&["reset", "lock-sub"]).expect("Failed to run reset");
-        assert!(!output2.status.success(), "Reset should fail when submodule index is locked");
+        let output2 = harness
+            .run_submod(&["reset", "lock-sub"])
+            .expect("Failed to run reset");
+        assert!(
+            !output2.status.success(),
+            "Reset should fail when submodule index is locked"
+        );
 
         // Clean up lock
         fs::remove_file(&sub_lock_path).expect("Failed to remove submodule lock");
diff --git a/tests/security_tests.rs b/tests/security_tests.rs
index e2f57b0..ad375b8 100644
--- a/tests/security_tests.rs
+++ b/tests/security_tests.rs
@@ -216,14 +216,16 @@ mod tests {
         let remote_url = format!("file://{}", remote_repo.display());
 
         // 1. Check direct path traversal escape
-        let result_traversal = harness.run_submod(&[
-            "add",
-            &remote_url,
-            "--name",
-            "escaped-sub",
-            "--path",
-            "../escaped-path",
-        ]).expect("Failed to run submod");
+        let result_traversal = harness
+            .run_submod(&[
+                "add",
+                &remote_url,
+                "--name",
+                "escaped-sub",
+                "--path",
+                "../escaped-path",
+            ])
+            .expect("Failed to run submod");
 
         assert!(!result_traversal.status.success());
         let stderr = String::from_utf8_lossy(&result_traversal.stderr);
@@ -239,7 +241,7 @@ mod tests {
 
         // Create a symlink in the repository pointing to the outside directory
         let symlink_path = harness.work_dir.join("lib_escaped");
-        
+
         #[cfg(unix)]
         {
             std::os::unix::fs::symlink(&outside_dir, &symlink_path)
@@ -252,14 +254,16 @@ mod tests {
         }
 
         // Try to add submodule that goes through this symlink
-        let result_symlink = harness.run_submod(&[
-            "add",
-            &remote_url,
-            "--name",
-            "symlink-sub",
-            "--path",
-            "lib_escaped/submodule",
-        ]).expect("Failed to run submod");
+        let result_symlink = harness
+            .run_submod(&[
+                "add",
+                &remote_url,
+                "--name",
+                "symlink-sub",
+                "--path",
+                "lib_escaped/submodule",
+            ])
+            .expect("Failed to run submod");
 
         assert!(!result_symlink.status.success());
         let stderr = String::from_utf8_lossy(&result_symlink.stderr);

From dd9225fc0cf60ada11a4ce0c6bc80704757818bc Mon Sep 17 00:00:00 2001
From: Adam Poulemanos <adam@knitli.com>
Date: Sat, 25 Jul 2026 22:10:00 -0400
Subject: [PATCH 2/3] fix(ci): repair the lint job, make the test job actually
 run tests
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CI has been red on main, and the green jobs were not testing anything.

**lint** died before running a single step: hk.pkl targets the hk v1.2.0
pkl schema while the workflow installs hk 1.48, which fails to evaluate it
("field not found: staticcheck"). Retarget hk.pkl at the 1.48 schema and
pin mise.toml to hk 1.48 so local and CI agree — the drift is what let this
break unnoticed. The 1.48 schema also rejects the `.toMap().filter()
.toMapping()` expression in the `test` hook, so select the step directly.

The workflow's fallback, `hk check || cd ../ && hk check`, parses as
`(hk check || cd ../) && hk check`: the second invocation always ran, in the
parent directory when the first failed. Replaced with a single
`hk check --all --skip-step cargo_test` — `--all` because hk defaults to
changed files, which on a fresh CI checkout leaves most steps with nothing
to do, and `--skip-step` because the test job now owns running the suite.

**Test Suite** checked out the repo, installed Rust, warmed three caches,
and stopped — there was no test step, so it reported success across all
three toolchains while running zero tests. Added cargo-nextest, a git
identity for the integration harness, and the actual run. beta/nightly are
marked continue-on-error so an upstream toolchain regression reports
without gating merges.

**Security Audit** was failing on live advisories, and once lint could run,
cargo-deny surfaced the same ones. Two fixes by upgrade: anyhow 1.0.102 ->
1.0.104 (RUSTSEC-2026-0190) and crossbeam-epoch 0.9.18 -> 0.9.20
(RUSTSEC-2026-0204). The two aws-lc-sys advisories are unreachable by
upgrade — aws-lc-rs pins aws-lc-sys exactly and it arrives transitively
through gix's curl-rustls transport — so they are ignored in deny.toml with
the reasoning and the upstream blocker recorded, and mirrored into the
audit-check ignore list.

Also repaired the cargo_deny step itself, which could not have passed: it
still passed --exclude-dev to the `check` subcommand (now a top-level flag)
and piped `-f json` output through `jq -e '.[].vulnerabilities | length ==
0'`, but cargo-deny streams one object per diagnostic rather than an array,
so jq exited 5 every run. It now gates on cargo-deny's own exit code,
allowing the informational classes to preserve the original intent of
failing on vulnerabilities only.

Verified locally: `hk check --all --skip-step cargo_test` passes end to end
under hk 1.48, `cargo audit` reports no vulnerabilities, and the full suite
is 569/569.

Refs #62

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XocU6NjgZricrRWMLyLXDn
---
 .github/workflows/ci.yml | 30 ++++++++++++++++++++++++++----
 Cargo.lock               | 10 +++++-----
 deny.toml                |  8 ++++++++
 hk.pkl                   | 26 ++++++++++++++++----------
 mise.toml                |  2 +-
 5 files changed, 56 insertions(+), 20 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index bc6c60a..6e44d76 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -17,7 +17,11 @@ jobs:
   test:
     name: Test Suite
     runs-on: ubuntu-latest
+    # beta/nightly are informational: a toolchain regression upstream should not
+    # gate merges, but we still want to see it.
+    continue-on-error: ${{ matrix.rust != 'stable' }}
     strategy:
+      fail-fast: false
       matrix:
         rust:
           - stable
@@ -52,6 +56,20 @@ jobs:
           path: target
           key: ${{ runner.os }}-cargo-build-target-${{ hashFiles('**/Cargo.lock') }}-${{ matrix.rust }}
 
+      - name: Install cargo-nextest
+        uses: taiki-e/install-action@v2
+        with:
+          tool: cargo-nextest
+
+      # The integration harness shells out to git; give it a committer identity.
+      - name: Setup git
+        run: |
+          git config --global user.email "ci@example.com"
+          git config --global user.name "CI"
+
+      - name: Run tests
+        run: cargo nextest run --all-features --no-fail-fast
+
   lint:
     name: lint
     runs-on: ubuntu-latest
@@ -80,12 +98,14 @@ jobs:
             pkl = "latest"
             typos = { version = "latest", depends = ["rust"] }
     
-      - name: Run hk ci workflow
+      # --all: hk defaults to staged/changed files, which on a fresh CI checkout
+      # leaves most steps with nothing to do. --skip-step cargo_test: the test
+      # job above owns running the suite.
+      - name: Run hk check
         env:
           HK_MISE: 1
           MISE_YES: 1
-        run: |
-          hk check || cd ../ && hk check
+        run: hk check --all --skip-step cargo_test
 
   security_audit:
     name: Security Audit
@@ -98,7 +118,9 @@ jobs:
       - uses: rustsec/audit-check@v2
         with:
           token: ${{ secrets.GITHUB_TOKEN || github.token }}
-          ignore: RUSTSEC-2024-0364,RUSTSEC-2024-0436
+          # Keep in sync with the `ignore` list in deny.toml, which documents why
+          # each of these is accepted.
+          ignore: RUSTSEC-2024-0364,RUSTSEC-2024-0436,RUSTSEC-2026-0044,RUSTSEC-2026-0048
 
   coverage:
     name: Code Coverage
diff --git a/Cargo.lock b/Cargo.lock
index 5cddd12..3038f31 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -84,9 +84,9 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.102"
+version = "1.0.104"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
+checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
 
 [[package]]
 name = "arc-swap"
@@ -451,9 +451,9 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-epoch"
-version = "0.9.18"
+version = "0.9.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
+checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f"
 dependencies = [
  "crossbeam-utils",
 ]
@@ -1225,7 +1225,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b305d85504de270ad3525d726a6b69cc59ee7b2269b014387651107ab9f0755b"
 dependencies = [
  "bstr",
- "hashbrown 0.16.1",
+ "hashbrown 0.17.1",
 ]
 
 [[package]]
diff --git a/deny.toml b/deny.toml
index cfeee2e..9deb94d 100644
--- a/deny.toml
+++ b/deny.toml
@@ -83,6 +83,14 @@ feature-depth = 1
 ignore = [
   "RUSTSEC-2024-0364", # gitoxide-core does not neutralize special characters for terminals. No patched version available.
   "RUSTSEC-2024-0436", # paste is unmaintained; it is a transitive dependency via rustls-ffi -> macro_rules_attribute and has no patched version or security impact.
+  # aws-lc-sys 0.38.0 X.509 issues, both patched in >=0.39.0, but we cannot reach it:
+  # aws-lc-rs pins aws-lc-sys exactly, and it arrives transitively via
+  # gix[blocking-http-transport-curl-rustls] -> curl-sys -> rustls-ffi -> rustls -> aws-lc-rs.
+  # submod does not enable CRL checking and does not do its own certificate validation;
+  # it fetches from standard WebPKI hosts, whose certs carry dNSName SANs (the case both
+  # advisories call out as unaffected). Revisit when aws-lc-rs ships a bump.
+  "RUSTSEC-2026-0044", # AWS-LC X.509 name constraints bypass via wildcard/Unicode CN.
+  "RUSTSEC-2026-0048", # AWS-LC CRL distribution point scope check logic error.
   # "RUSTSEC-0000-0000",
   # { id = "RUSTSEC-0000-0000", reason = "you can specify a reason the advisory is ignored" },
   # "a-crate-that-is-yanked@0.1.1", # you can also ignore yanked crate versions if you wish
diff --git a/hk.pkl b/hk.pkl
index 3a3a945..aeed609 100644
--- a/hk.pkl
+++ b/hk.pkl
@@ -4,15 +4,20 @@
  * SPDX-License-Identifier: LicenseRef-PlainMIT OR MIT
 */
 
-amends "package://github.com/jdx/hk/releases/download/v1.2.0/hk@1.2.0#/Config.pkl"
-import "package://github.com/jdx/hk/releases/download/v1.2.0/hk@1.2.0#/Builtins.pkl"
+amends "package://github.com/jdx/hk/releases/download/v1.48.0/hk@1.48.0#/Config.pkl"
+import "package://github.com/jdx/hk/releases/download/v1.48.0/hk@1.48.0#/Builtins.pkl"
 
 local linters = new Mapping<String, Step> {
 
     ["cargo_deny"] = new Step {
         workspace_indicator = "Cargo.toml"
         glob = "Cargo.lock"
-        check = "cargo deny --all-features --manifest-path {{ workspace_indicator }} -f json -L warn check --audit-compatible-output --exclude-dev --hide-inclusion-graph | jq -e '.[].vulnerabilities | length == 0' || exit 1"
+        // Gate on vulnerabilities only, letting cargo-deny's own exit code decide.
+        // (The previous `-f json ... | jq -e '.[].vulnerabilities | length == 0'`
+        // pipeline no longer parses: with `-f json` cargo-deny streams one object
+        // per diagnostic, not an array, so jq failed with exit 5 on every run.)
+        // --exclude-dev is a top-level flag; it moved off the `check` subcommand.
+        check = "cargo deny --all-features --manifest-path {{ workspace_indicator }} --exclude-dev -L warn check advisories --hide-inclusion-graph -A unsound -A unmaintained -A yanked -A notice"
     }
     ["cargo_fmt"] = Builtins.cargo_fmt
     ["cargo_clippy"] = Builtins.cargo_clippy
@@ -29,7 +34,11 @@ local linters = new Mapping<String, Step> {
     // Spellchecker
     ["typos"] = new Step {
         workspace_indicator = "_typos.toml"
-        glob = List( "*README", "*.{.login,astro,bash,bash_logout,bashrc,browserlistrc,conf,config,csh,css,cts,fish,gitattributes,gitmodules,html,htmx,ini,j2,jinja,jinja2,json,json5,jsonc,jsonl,ksh,md,mdown,mdtext,mdtxt,mdwn,mdx,mk,mkd,mts,nix,nu,pkl,profile,quokka,sass,scss,sh,sh,shellcheckrc,sql,sqlite,stylelintrc,svelte,tcsh,toml,ts,tsx,txt,yaml,yml,zlogin,zlogout,zprofile,zsh,zshenv,zshrc}", "*Dockerfile*", "*Makefile*", "*makefile*", "CHANGELOG*", "CODE_OF_CONDUCT*", "CONTRIBUTING*", "HACKING*", "LICENSE", "README*", "SECURITY*", "UNLICENSE")
+        glob = List( "*README", "*.{.login,astro,bash,bash_logout,bashrc,browserlistrc,conf,config,csh,css,cts,fish,gitattributes,gitmodules,html,htmx,ini,j2,jinja,jinja2,json,json5,jsonc,jsonl,ksh,md,mdown,mdtext,mdtxt,mdwn,mdx,mk,mkd,mts,nix,nu,pkl,profile,quokka,sass,scss,sh,sh,shellcheckrc,sql,sqlite,stylelintrc,svelte,tcsh,toml,ts,tsx,txt,yaml,yml,zlogin,zlogout,zprofile,zsh,zshenv,zshrc}", "*Dockerfile*", "*Makefile*", "*makefile*", "CODE_OF_CONDUCT*", "CONTRIBUTING*", "HACKING*", "LICENSE", "README*", "SECURITY*", "UNLICENSE")
+        // CHANGELOG.md is generated by git-cliff from commit subjects; abbreviated
+        // commit hashes trip the spellchecker. _typos.toml also excludes it, but that
+        // only applies when typos walks a directory — hk passes explicit file paths.
+        exclude = "CHANGELOG.md"
         check = "typos -j 8 {{ files }}"
         fix = "typos --write-changes {{ files }}"
     }
@@ -68,12 +77,9 @@ hooks {
         steps = linters
     }
     ["test"] {
-        steps =  linters
-                    .toMap()
-                    .filter(
-                        (name, _) -> name == "cargo_test")
-                    .toMapping()
-
+        steps = new Mapping<String, Step> {
+            ["cargo_test"] = linters["cargo_test"]
+        }
     }
 
     ["ci"] {
diff --git a/mise.toml b/mise.toml
index d6fd602..c7343cd 100644
--- a/mise.toml
+++ b/mise.toml
@@ -16,7 +16,7 @@ cargo-binstall = "latest"
 "cargo:cargo-nextest" = "latest" # For running tests in parallel.
 "cargo:cargo-smart-release" = "latest" # For automating releases.
 "cargo:cargo-watch" = "latest" # For watching files and rerunning commands.
-hk = "latest"  # Handles git hooks, like pre-commit.
+hk = "1.48"  # Handles git hooks, like pre-commit. Pinned to match CI; hk.pkl targets the 1.48 schema.
 jq = "latest"
 pkl = "latest"  # pkl for `hk`, which handles git hooks
 rust = "1.96"

From ef7863ea1d79cc23978f334aff56d104cae3858f Mon Sep 17 00:00:00 2001
From: Adam Poulemanos <adam@knitli.com>
Date: Sat, 25 Jul 2026 22:17:39 -0400
Subject: [PATCH 3/3] fix(ci): install rustfmt/clippy for the mise toolchain,
 report all lint failures

With the config finally loading, the lint job got far enough to reveal that
mise installs the Rust toolchain without optional components, so cargo_fmt
and cargo_clippy had no binary to call. Add them explicitly.

Also pass --no-fail-fast so a run reports every lint problem at once. The
previous run aborted the remaining six steps the instant cargo_fmt failed,
which made an aborted cargo_deny look like a second, independent failure.

Refs #62

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XocU6NjgZricrRWMLyLXDn
---
 .github/workflows/ci.yml | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6e44d76..a621466 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -98,14 +98,20 @@ jobs:
             pkl = "latest"
             typos = { version = "latest", depends = ["rust"] }
     
+      # mise installs the toolchain without optional components, so cargo_fmt and
+      # cargo_clippy have no binary to call.
+      - name: Add rustfmt and clippy components
+        run: rustup component add rustfmt clippy
+
       # --all: hk defaults to staged/changed files, which on a fresh CI checkout
       # leaves most steps with nothing to do. --skip-step cargo_test: the test
-      # job above owns running the suite.
+      # job above owns running the suite. --no-fail-fast: report every lint
+      # problem in one run instead of aborting the rest on the first failure.
       - name: Run hk check
         env:
           HK_MISE: 1
           MISE_YES: 1
-        run: hk check --all --skip-step cargo_test
+        run: hk check --all --skip-step cargo_test --no-fail-fast
 
   security_audit:
     name: Security Audit