vendor: make warning hygiene deterministic and auditable

Author: nikivdev

docs/dependency-vendoring.md

@@ -114,7 +114,9 @@ What this does:
 Run after each vendoring step:
 
 ```bash
+f vendor-trims
 /Users/nikiv/code/rise/scripts/vendor-control.sh verify --project /Users/nikiv/code/flow
+python3 ./scripts/vendor/rough_edges_audit.py --project . --strict-warnings
 cargo check -q
 scripts/vendor/sync-all.sh --important --dry-run
 ```
@@ -128,6 +130,10 @@ scripts/vendor/sync-all.sh --important --dry-run
 - patch path matches lock materialized path,
 - manifest version matches lock version.
 
+`vendor-rough-audit --strict-warnings` additionally enforces warning-hygiene
+regressions for known vendored crate hot spots (`crossterm`, `portable-pty`,
+`x25519-dalek`, `ratatui`) so release builds stay quiet.
+
 ## Provenance and Hardening
 
 `inhouse` now records provenance fields in crate manifests:

docs/vendor-optimization-loop.md

@@ -12,6 +12,7 @@ while keeping Cargo correctness and upstream sync reliability.
 ## Commands
 
 ```bash
+f vendor-trims
 f vendor-rough-audit
 f vendor-offenders
 f vendor-bench-iter -- --mode incremental --samples 3
@@ -39,6 +40,8 @@ f vendor-optimize-loop -- --strict
 - provenance fields in manifests (`history_head`, `upstream_repository`),
 - stale code index detection (`.vendor/typesense/sources.json` freshness),
 - extra drift artifacts (`lib/vendor/*` or patch entries not in lock).
+- warning-hygiene regressions in vendored crates that would reintroduce noisy
+  release-build warnings.
 
 `vendor-offenders` (`scripts/vendor/offenders.sh`) shows:
 

flow.toml

@@ -268,6 +268,11 @@ name = "vendor-code-search-sources"
 command = "python3 ./scripts/vendor/typesense_code_index.py --project . search --collection sources $@"
 description = "Search source inventory metadata (crate/version/path/upstream)"
 
+[[tasks]]
+name = "vendor-trims"
+command = "bash ./scripts/vendor/apply-trims.sh $@"
+description = "Apply deterministic trim + warning-hygiene patches to vendored crates"
+
 [[tasks]]
 name = "vendor-rough-audit"
 command = "python3 ./scripts/vendor/rough_edges_audit.py --project . $@"

scripts/vendor/rough_edges_audit.py

@@ -86,6 +86,89 @@ def latest_mtime(paths: list[Path]) -> float:
     return latest
 
 
+def check_warning_hygiene(project: Path) -> list[Finding]:
+    findings: list[Finding] = []
+
+    checks: list[tuple[str, str]] = [
+        (
+            "lib/vendor/crossterm/src/lib.rs",
+            'cfg(all(winapi, not(feature = "winapi")))',
+        ),
+        (
+            "lib/vendor/crossterm/src/lib.rs",
+            'cfg(all(crossterm_winapi, not(feature = "crossterm_winapi")))',
+        ),
+        (
+            "lib/vendor/crossterm/src/terminal/sys/unix.rs",
+            "map(|file| (FileDesc::Owned(file.into())))",
+        ),
+        (
+            "lib/vendor/portable-pty/src/unix.rs",
+            'feature = "cargo-clippy"',
+        ),
+        (
+            "lib/vendor/x25519-dalek/src/lib.rs",
+            'cfg_attr(feature = "bench", feature(test))',
+        ),
+        (
+            "lib/vendor/ratatui/src/terminal/terminal.rs",
+            "pub fn get_frame(&mut self) -> Frame {",
+        ),
+        (
+            "lib/vendor/ratatui/src/terminal/terminal.rs",
+            "pub fn draw<F>(&mut self, render_callback: F) -> io::Result<CompletedFrame>",
+        ),
+        (
+            "lib/vendor/ratatui/src/terminal/terminal.rs",
+            "pub fn try_draw<F, E>(&mut self, render_callback: F) -> io::Result<CompletedFrame>",
+        ),
+        (
+            "lib/vendor/ratatui/src/text/line.rs",
+            "pub fn iter(&self) -> std::slice::Iter<Span<'a>> {",
+        ),
+        (
+            "lib/vendor/ratatui/src/text/line.rs",
+            "pub fn iter_mut(&mut self) -> std::slice::IterMut<Span<'a>> {",
+        ),
+        (
+            "lib/vendor/ratatui/src/text/text.rs",
+            "pub fn iter(&self) -> std::slice::Iter<Line<'a>> {",
+        ),
+        (
+            "lib/vendor/ratatui/src/text/text.rs",
+            "pub fn iter_mut(&mut self) -> std::slice::IterMut<Line<'a>> {",
+        ),
+        (
+            "lib/vendor/ratatui/src/text/text.rs",
+            "fn to_text(&self) -> Text {",
+        ),
+        (
+            "lib/vendor/ratatui/src/widgets/block.rs",
+            ") -> impl DoubleEndedIterator<Item = &Line> {",
+        ),
+    ]
+
+    for rel_path, needle in checks:
+        path = project / rel_path
+        if not path.is_file():
+            continue
+        try:
+            content = path.read_text(encoding="utf-8")
+        except Exception:
+            continue
+        if needle in content:
+            findings.append(
+                Finding(
+                    "warn",
+                    "warning_hygiene_regression",
+                    f"{rel_path}: found stale warning pattern `{needle}`",
+                    "run scripts/vendor/apply-trims.sh (or hydrate) to re-apply warning hygiene patches",
+                )
+            )
+
+    return findings
+
+
 def build_report(project: Path) -> tuple[dict[str, Any], list[Finding]]:
     findings: list[Finding] = []
     metrics: dict[str, Any] = {
@@ -96,6 +179,7 @@ def build_report(project: Path) -> tuple[dict[str, Any], list[Finding]]:
         "direct_dependencies": 0,
         "direct_non_vendored_dependencies": 0,
         "direct_non_vendored_list": [],
+        "warning_hygiene_regressions": 0,
     }
 
     vendor_lock_path = project / "vendor.lock.toml"
@@ -401,6 +485,10 @@ def build_report(project: Path) -> tuple[dict[str, Any], list[Finding]]:
             )
         )
 
+    warning_hygiene_findings = check_warning_hygiene(project)
+    metrics["warning_hygiene_regressions"] = len(warning_hygiene_findings)
+    findings.extend(warning_hygiene_findings)
+
     return metrics, findings
 
 
@@ -411,6 +499,7 @@ def print_text(metrics: dict[str, Any], findings: list[Finding]) -> None:
     print(f"vendor patch entries: {metrics['vendor_patch_entries']}")
     print(f"direct deps: {metrics['direct_dependencies']}")
     print(f"direct deps not yet vendored: {metrics['direct_non_vendored_dependencies']}")
+    print(f"warning hygiene regressions: {metrics['warning_hygiene_regressions']}")
     if metrics["direct_non_vendored_list"]:
         preview = ", ".join(metrics["direct_non_vendored_list"][:12])
         suffix = " ..." if len(metrics["direct_non_vendored_list"]) > 12 else ""

scripts/vendor/trim-hooks.sh

@@ -51,6 +51,76 @@ apply_ratatui_trims() {
     "$root/RELEASE.md" \
     "$root/SECURITY.md" \
     "$root/BREAKING-CHANGES.md"
+
+  # Rust 1.90+ warns on elided lifetime name mismatches in these signatures.
+  local terminal_file="$root/src/terminal/terminal.rs"
+  local text_line_file="$root/src/text/line.rs"
+  local text_text_file="$root/src/text/text.rs"
+  local widgets_block_file="$root/src/widgets/block.rs"
+
+  [[ -f "$terminal_file" ]] && perl -0777 -i -pe '
+    s/pub fn get_frame\(&mut self\) -> Frame \{/pub fn get_frame(&mut self) -> Frame<'\''_> {/g;
+    s/pub fn draw<F>\(&mut self, render_callback: F\) -> io::Result<CompletedFrame>/pub fn draw<F>(&mut self, render_callback: F) -> io::Result<CompletedFrame<'\''_>>/g;
+    s/pub fn try_draw<F, E>\(&mut self, render_callback: F\) -> io::Result<CompletedFrame>/pub fn try_draw<F, E>(&mut self, render_callback: F) -> io::Result<CompletedFrame<'\''_>>/g;
+  ' "$terminal_file"
+
+  [[ -f "$text_line_file" ]] && perl -0777 -i -pe '
+    s/pub fn iter\(&self\) -> std::slice::Iter<Span<'\''a>>/pub fn iter(&self) -> std::slice::Iter<'\''_, Span<'\''a>>/g;
+    s/pub fn iter_mut\(&mut self\) -> std::slice::IterMut<Span<'\''a>>/pub fn iter_mut(&mut self) -> std::slice::IterMut<'\''_, Span<'\''a>>/g;
+  ' "$text_line_file"
+
+  [[ -f "$text_text_file" ]] && perl -0777 -i -pe '
+    s/pub fn iter\(&self\) -> std::slice::Iter<Line<'\''a>>/pub fn iter(&self) -> std::slice::Iter<'\''_, Line<'\''a>>/g;
+    s/pub fn iter_mut\(&mut self\) -> std::slice::IterMut<Line<'\''a>>/pub fn iter_mut(&mut self) -> std::slice::IterMut<'\''_, Line<'\''a>>/g;
+    s/fn to_text\(&self\) -> Text \{/fn to_text(&self) -> Text<'\''_> {/g;
+  ' "$text_text_file"
+
+  [[ -f "$widgets_block_file" ]] && perl -0777 -i -pe '
+    s/\) -> impl DoubleEndedIterator<Item = &Line> \{/) -> impl DoubleEndedIterator<Item = &Line<'\''_>> {/g;
+  ' "$widgets_block_file"
+}
+
+apply_crossterm_trims() {
+  local root="lib/vendor/crossterm"
+  [[ -d "$root" ]] || return 0
+
+  local lib_file="$root/src/lib.rs"
+  local unix_file="$root/src/terminal/sys/unix.rs"
+  local filter_file="$root/src/event/filter.rs"
+
+  [[ -f "$lib_file" ]] && perl -0777 -i -pe '
+    s/\n#\[cfg\(all\(winapi, not\(feature = "winapi"\)\)\)\]\ncompile_error!\("Compiling on Windows with \\"winapi\\" feature disabled\. Feature \\"winapi\\" should only be disabled when project will never be compiled on Windows\."\);\n//g;
+    s/\n#\[cfg\(all\(crossterm_winapi, not\(feature = "crossterm_winapi"\)\)\)\]\ncompile_error!\("Compiling on Windows with \\"crossterm_winapi\\" feature disabled\. Feature \\"crossterm_winapi\\" should only be disabled when project will never be compiled on Windows\."\);\n//g;
+  ' "$lib_file"
+
+  [[ -f "$unix_file" ]] && perl -0777 -i -pe '
+    s/File::open\("\/dev\/tty"\)\.map\(\|file\| \(FileDesc::Owned\(file\.into\(\)\)\)\)/File::open("\/dev\/tty").map(|file| FileDesc::Owned(file.into()))/g;
+  ' "$unix_file"
+
+  [[ -f "$filter_file" ]] && perl -0777 -i -pe '
+    if (!/\#\[allow\(dead_code\)\]\s*pub\(crate\) struct InternalEventFilter;/s) {
+      s/\#\[derive\(Debug, Clone\)\]\s*pub\(crate\) struct InternalEventFilter;/#[derive(Debug, Clone)]\n#[allow(dead_code)]\npub(crate) struct InternalEventFilter;/s;
+    }
+  ' "$filter_file"
+}
+
+apply_portable_pty_trims() {
+  local file="lib/vendor/portable-pty/src/unix.rs"
+  [[ -f "$file" ]] || return 0
+
+  perl -0777 -i -pe '
+    s/\n[ \t]*#\[cfg_attr\(feature = "cargo-clippy", allow\(clippy::unnecessary_mut_passed\)\)\]//g;
+    s/\n[ \t]*#\[cfg_attr\(feature = "cargo-clippy", allow\(clippy::cast_lossless\)\)\]//g;
+  ' "$file"
+}
+
+apply_x25519_dalek_trims() {
+  local file="lib/vendor/x25519-dalek/src/lib.rs"
+  [[ -f "$file" ]] || return 0
+
+  perl -0777 -i -pe '
+    s/\n#!\[cfg_attr\(feature = "bench", feature\(test\)\)\]//g;
+  ' "$file"
 }
 
 apply_vendor_trims() {
@@ -60,12 +130,18 @@ apply_vendor_trims() {
       reqwest) apply_reqwest_trims ;;
       axum) apply_axum_trims ;;
       ratatui) apply_ratatui_trims ;;
-      *) echo "warning: no trim rules defined for crate '$crate'" ;;
+      crossterm) apply_crossterm_trims ;;
+      portable-pty) apply_portable_pty_trims ;;
+      x25519-dalek) apply_x25519_dalek_trims ;;
+      *) ;;
     esac
     return
   fi
 
   apply_reqwest_trims
   apply_axum_trims
   apply_ratatui_trims
+  apply_crossterm_trims
+  apply_portable_pty_trims
+  apply_x25519_dalek_trims
 }

scripts/vendor/vendor-repo.sh

@@ -300,6 +300,9 @@ cmd_import_local() {
   ensure_repo_layout "$checkout"
   ensure_git_identity "$checkout"
 
+  # Keep imported source deterministic with the same trim/hygiene rules used by hydrate.
+  scripts/vendor/apply-trims.sh
+
   while IFS=$'\t' read -r name repo_path manifest_path materialized_path; do
     [[ -n "$name" ]] || continue