merge queue: checking main (2b49294), #387, #390 and #388 together

.claude/settings.json

@@ -1,22 +1,9 @@
 {
-    "hooks": {
-        "PreToolUse": [
-            {
-                "matcher": "Bash",
-                "hooks": [
-                    {
-                        "type": "command",
-                        "command": "bash .claude/hooks/enforce-dco-signoff.sh"
-                    }
-                ]
-            }
-        ]
-    },
     "enabledPlugins": {
         "rust-analyzer-lsp@claude-plugins-official": true,
         "security-guidance@claude-plugins-official": true,
         "rust-cli-developer@geoffjay-claude-plugins": true,
         "systems-programming@claude-code-workflows": true,
-        "everything-claude-code@everything-claude-code": true
+        "ecc@ecc": true
     }
-}
+}

.claude/skills/.gitignore

@@ -0,0 +1,8 @@
+**/*
+!.gitignore
+!api-design/
+!tdd-workflow/
+!security-review/
+!strategic-compact/
+!verification-loop/
+!SKILL.md

.config/nextest.toml

@@ -0,0 +1,18 @@
+# cargo-nextest configuration.
+#
+# Serialize the integration test binaries that spawn child processes (the CLI
+# under test, the system `file` binary) or manipulate the process working
+# directory. Running these concurrently causes subprocess-spawn contention and
+# cwd races -- most visibly the planted-magic CLI security regression tests,
+# which resolve behavior from a temp cwd. Under heavy full-suite parallelism
+# these produced rare, load-dependent flakes once additional process-spawning
+# binaries (the `system_magic_dir` differential-parity suite that shells out to
+# GNU `file`) were added. Pinning them to a single-threaded group makes the
+# suite deterministic while leaving the ~1500 in-process unit tests fully
+# parallel.
+[test-groups]
+serial-integration = { max-threads = 1 }
+
+[[profile.default.overrides]]
+filter = 'binary(compatibility_tests) or binary(cli_integration) or binary(json_integration_test) or binary(security_regression) or binary(system_magic_dir)'
+test-group = 'serial-integration'

.github/workflows/benchmarks.yml

@@ -16,6 +16,13 @@ on:
     # Allow manual triggering
     workflow_dispatch:
 
+# Cancel superseded runs on the same ref so rapid pushes don't pile up
+# concurrent cold-cache `mise-action` installs racing on the shared cache
+# (matches ci.yml / security.yml).
+concurrency:
+    group: ${{ github.workflow }}-${{ github.ref }}
+    cancel-in-progress: true
+
 env:
     CARGO_TERM_COLOR: always
 
@@ -28,9 +35,12 @@ jobs:
         steps:
             - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
-            - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
+            - uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1
               with:
                   install: true
+                  # Only rust is needed (cargo bench); avoid the full mise tool
+                  # set whose no-prebuilt cargo tools fail to install on runners.
+                  install_args: rust
                   cache: true
                   github_token: ${{ secrets.GITHUB_TOKEN }}
 
@@ -47,7 +57,7 @@ jobs:
                       ${{ runner.os }}-cargo-
 
             - name: Run benchmarks
-              run: cargo bench --bench parser_bench --bench evaluation_bench --bench io_bench
+              run: mise x -- cargo bench --bench parser_bench --bench evaluation_bench --bench io_bench
 
             - name: Upload benchmark results
               uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
@@ -68,9 +78,12 @@ jobs:
               with:
                   fetch-depth: 0
 
-            - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
+            - uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1
               with:
                   install: true
+                  # Only rust is needed (cargo bench); avoid the full mise tool
+                  # set whose no-prebuilt cargo tools fail to install on runners.
+                  install_args: rust
                   cache: true
                   github_token: ${{ secrets.GITHUB_TOKEN }}
 
@@ -93,7 +106,7 @@ jobs:
 
             - name: Run benchmarks on PR branch
               run: |
-                  cargo bench --bench parser_bench --bench evaluation_bench --bench io_bench -- --save-baseline pr
+                  mise x -- cargo bench --bench parser_bench --bench evaluation_bench --bench io_bench -- --save-baseline pr
 
             - name: Checkout main branch
               run: git checkout origin/main
@@ -102,7 +115,7 @@ jobs:
               continue-on-error: true
               id: main-bench
               run: |
-                  cargo bench --bench parser_bench --bench evaluation_bench --bench io_bench -- --save-baseline main
+                  mise x -- cargo bench --bench parser_bench --bench evaluation_bench --bench io_bench -- --save-baseline main
 
             - name: Compare benchmarks
               if: steps.main-bench.outcome == 'success'

.github/workflows/ci.yml

@@ -29,34 +29,50 @@ jobs:
         timeout-minutes: 10
         steps:
             - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-            - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
+            - uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1
               with:
                   install: true
+                  # Install only the tools this job uses. Installing the full
+                  # mise tool set pulls in no-prebuilt cargo tools (cargo-audit,
+                  # mdbook-*) whose cargo-install fallback fails on hosted
+                  # runners; the audit/docs workflows install those where needed.
+                  install_args: rust just
                   cache: true
                   github_token: ${{ secrets.GITHUB_TOKEN }}
 
-            - name: Ensure rustfmt and clippy are installed
-              run: rustup component add rustfmt clippy
-
+            # rustfmt + clippy are installed by mise's rust component set
+            # (`components = "...,rustfmt,clippy"`). A second `rustup component
+            # add` here re-added them and collided with mise's install on the
+            # hosted runner (`detected conflict` / `Directory not empty`), so it
+            # is intentionally removed.
             - name: Check formatting
               run: just lint-rust
 
     test:
         runs-on: ubuntu-latest
+        # Gate on `quality` so it populates the shared mise/toolchain cache
+        # FIRST. Without this, `quality` and `test` start together and both run
+        # a cold-cache `mise-action` install concurrently, racing on the same
+        # cache key (`detected conflict` / `Directory not empty`). Serializing
+        # them means `quality` writes the cache and every downstream job
+        # (`test`, and transitively `coverage` / `test-cross-platform`) restores
+        # the warm cache instead of racing to populate it.
+        needs: quality
         timeout-minutes: 20
         steps:
             - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-            - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
+            - uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1
               with:
                   install: true
+                  install_args: rust cargo:cargo-nextest
                   cache: true
                   github_token: ${{ secrets.GITHUB_TOKEN }}
 
             - name: Run tests (all features)
-              run: cargo nextest run --all-features
+              run: mise x -- cargo nextest run --all-features
 
             - name: Build release
-              run: cargo build --release --all-features
+              run: mise x -- cargo build --release --all-features
 
     test-cross-platform:
         strategy:
@@ -74,39 +90,53 @@ jobs:
         runs-on: ${{ matrix.os }}
         needs: test
         timeout-minutes: 20
+        # `mise.toml` sets `exec_auto_install = true`, so `mise x` would
+        # otherwise auto-install the ENTIRE tool set before running. Several
+        # `cargo:` dev tools (cargo-audit, mdbook-*, git-cliff, ...) have no
+        # prebuilt binary on macOS/Windows and mise's cargo-install fallback
+        # is disabled, so that auto-install fatally fails on those runners
+        # (it only ever "passed" on ubuntu because every tool has a prebuilt,
+        # and this job never ran before -- it is gated on `test`, which was
+        # red until now). Disable exec-time auto-install so `mise x` uses only
+        # the scoped `install_args` tools (rust + cargo-nextest), which is all
+        # these steps need.
+        env:
+            MISE_EXEC_AUTO_INSTALL: "false"
         steps:
             - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-            - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
+            - uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1
               with:
                   install: true
+                  install_args: rust cargo:cargo-nextest
                   cache: true
                   github_token: ${{ secrets.GITHUB_TOKEN }}
 
-            - run: cargo nextest run --all-features
-            - run: cargo build --release --all-features
+            - run: mise x -- cargo nextest run --all-features
+            - run: mise x -- cargo build --release --all-features
 
     coverage:
         runs-on: ubuntu-latest
         needs: test
         timeout-minutes: 20
         steps:
             - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-            - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
+            - uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1
               with:
                   install: true
+                  install_args: rust cargo:cargo-nextest cargo:cargo-llvm-cov
                   cache: true
                   github_token: ${{ secrets.GITHUB_TOKEN }}
 
             - name: Generate coverage
               # Use --test-threads=1 to prevent race conditions in stdin-mocking tests
               # that manipulate file descriptors (dup/dup2) which aren't thread-safe
-              run: cargo llvm-cov --all-features --no-report -- --test-threads=1
+              run: mise x -- cargo llvm-cov --all-features --no-report -- --test-threads=1
 
             - name: Combine coverage reports
-              run: cargo llvm-cov report --lcov --output-path lcov.info
+              run: mise x -- cargo llvm-cov report --lcov --output-path lcov.info
 
             - name: Enforce 85% coverage threshold
-              run: cargo llvm-cov report --fail-under-lines 85
+              run: mise x -- cargo llvm-cov report --fail-under-lines 85
 
             - name: Upload to Codecov
               uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0

.github/workflows/compatibility.yml

@@ -10,14 +10,26 @@ on:
         - cron: "0 2 * * *"
     workflow_dispatch:
 
+# Cancel superseded runs on the same ref so rapid pushes don't pile up
+# concurrent cold-cache `mise-action` installs racing on the shared cache
+# (matches ci.yml / security.yml).
+concurrency:
+    group: ${{ github.workflow }}-${{ github.ref }}
+    cancel-in-progress: true
+
 env:
     CARGO_TERM_COLOR: always
 
 jobs:
     compatibility-tests:
         name: Compatibility Tests (${{ matrix.os }})
         runs-on: ${{ matrix.os }}
-        timeout-minutes: 20
+        # 30m (matching benchmarks.yml) because the `cargo build --release`
+        # step on the windows-latest runner alone routinely approaches 20m on a
+        # cold dependency cache; the compatibility test itself runs in <1s. The
+        # fast Linux/macOS legs finish in ~10m, so the higher ceiling only ever
+        # affects the slow Windows leg. See PR #376.
+        timeout-minutes: 30
 
         strategy:
             fail-fast: false
@@ -27,20 +39,23 @@ jobs:
         steps:
             - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
-            - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
+            - uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1
               with:
                   install: true
+                  # Only rust + just are needed here; avoid the full mise tool
+                  # set whose no-prebuilt cargo tools fail to install on runners.
+                  install_args: rust just
                   cache: true
                   github_token: ${{ secrets.GITHUB_TOKEN }}
 
             - name: Verify compatibility test files are available
               run: just verify-compatibility-tests
 
             - name: Build rmagic
-              run: cargo build --release
+              run: mise x -- cargo build --release
 
             - name: Run compatibility tests
-              run: cargo test test_compatibility_with_original_libmagic -- --ignored --nocapture
+              run: mise x -- cargo test test_compatibility_with_original_libmagic -- --ignored --nocapture
 
             - name: Upload test results on failure
               if: failure()

.github/workflows/copilot-setup-steps.yml

@@ -9,6 +9,13 @@ on:
         paths:
             - .github/workflows/copilot-setup-steps.yml
 
+# Cancel superseded runs on the same ref so rapid pushes don't pile up
+# concurrent cold-cache `mise-action` installs racing on the shared cache
+# (matches ci.yml / security.yml).
+concurrency:
+    group: ${{ github.workflow }}-${{ github.ref }}
+    cancel-in-progress: true
+
 jobs:
     copilot-setup-steps:
         runs-on: ubuntu-latest
@@ -19,7 +26,7 @@ jobs:
 
         steps:
             - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-            - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
+            - uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1
               with:
                   install: true
                   cache: true

.github/workflows/docs.yml

@@ -26,7 +26,7 @@ jobs:
         timeout-minutes: 10
         steps:
             - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-            - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
+            - uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1
               with:
                   install: true
                   cache: true
@@ -41,16 +41,16 @@ jobs:
                   use-toc: true
                   use-admonish: true
             - name: Install mdbook plugins
-              run: cargo binstall mdbook-tabs mdbook-i18n-helpers mdbook-alerts mdbook-yml-header mdbook-image-size --no-confirm
+              run: mise x -- cargo binstall mdbook-tabs mdbook-i18n-helpers mdbook-alerts mdbook-yml-header mdbook-image-size --no-confirm
 
             - name: Build mdBook
               run: |
                   cd docs
-                  mdbook build
+                  mise x -- mdbook build
 
             - name: Build rustdoc and copy into book
               run: |
-                  cargo doc --no-deps --document-private-items --target-dir target
+                  mise x -- cargo doc --no-deps --document-private-items --target-dir target
                   mkdir -p docs/book/api
                   cp -r target/doc/* docs/book/api/
 

.github/workflows/release-plz.yml

@@ -19,11 +19,11 @@ jobs:
                   fetch-depth: 0
                   # persist-credentials required for pushing signed tags via git CLI
                   persist-credentials: true
-            - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
+            - uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1
               with:
                   install: true
             - name: Run release-plz
-              uses: release-plz/action@e8792575c7f2366cf6ff3ccc33ead9ace5b691c7 # v0.5.130
+              uses: release-plz/action@2eb1d8bcb770b4c48ccfaad919734b38b51958c9 # v0.5.131
               with:
                   command: release
               env:
@@ -45,11 +45,11 @@ jobs:
               with:
                   fetch-depth: 0
                   persist-credentials: false
-            - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
+            - uses: jdx/mise-action@dad1bfd3df957f44999b559dd69dc1671cb4e9ea # v4.2.1
               with:
                   install: true
             - name: Run release-plz
-              uses: release-plz/action@e8792575c7f2366cf6ff3ccc33ead9ace5b691c7 # v0.5.130
+              uses: release-plz/action@2eb1d8bcb770b4c48ccfaad919734b38b51958c9 # v0.5.131
               with:
                   command: release-pr
               env: