Fix Rust CI formatter and clippy warnings

.github/workflows/rust.yml

@@ -40,7 +40,10 @@ jobs:
         with:
           persist-credentials: false
       - uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable
-      - run: cargo fmt --check --all
+        with:
+          toolchain: nightly
+          components: rustfmt
+      - run: cargo +nightly fmt --check --all
 
   clippy:
     name: Clippy

lib/crates/fabro-cli/src/commands/install.rs

@@ -13,7 +13,7 @@ use dialoguer::theme::ColorfulTheme;
 use dialoguer::{MultiSelect, Select};
 use fabro_api::types::{CreateSecretRequest, SecretType as ApiSecretType};
 use fabro_config::user::SETTINGS_CONFIG_FILENAME;
-use fabro_config::{Storage, legacy_env};
+use fabro_config::{Storage, envfile, legacy_env};
 use fabro_model::Provider;
 use fabro_util::printer::Printer;
 use fabro_util::terminal::Styles;
@@ -729,7 +729,7 @@ fn persist_server_env_secrets(storage_dir: &Path, secrets: &[(String, String)])
         return Ok(());
     }
 
-    fabro_config::envfile::merge_env_file(
+    envfile::merge_env_file(
         &Storage::new(storage_dir).server_state().env_path(),
         secrets.iter().cloned(),
     )?;

lib/crates/fabro-server/src/diagnostics.rs

@@ -306,10 +306,7 @@ async fn probe_llm_provider(client: &LlmClient, provider: Provider) -> Result<()
 async fn check_github_app(state: &AppState) -> CheckResult {
     let settings = state.server_settings();
     if settings.integrations.github.strategy == GithubIntegrationStrategy::GhCli {
-        let token = match state
-            .github_credentials(&settings.integrations.github)
-            .await
-        {
+        let token = match state.github_credentials(&settings.integrations.github) {
             Ok(Some(fabro_github::GitHubCredentials::Token(token))) => token,
             Ok(Some(_)) => unreachable!("gh_cli strategy should not return app credentials"),
             Ok(None) => {

lib/crates/fabro-server/src/run_manifest.rs

@@ -368,7 +368,6 @@ async fn build_preflight_report(
     let github_app = if needs_github_credentials {
         state
             .github_credentials(&resolved_server.integrations.github)
-            .await
             .unwrap_or_default()
     } else {
         None

lib/crates/fabro-server/src/serve.rs

@@ -337,7 +337,7 @@ where
         max_concurrent_runs,
         store,
         artifact_store,
-        vault_path,
+        &vault_path,
         active_config_path,
         matches!(&auth_mode, AuthMode::Disabled),
     )?;
@@ -377,7 +377,6 @@ where
                     let secret = server_secrets.get("GITHUB_APP_WEBHOOK_SECRET");
                     let github_app = state
                         .github_credentials(&resolved_server_settings.integrations.github)
-                        .await
                         .unwrap_or_else(|err| {
                             warn!(
                                 error = %err,

lib/crates/fabro-server/src/server.rs

@@ -613,12 +613,12 @@ impl AppState {
         self.server_secrets.get(name)
     }
 
-    pub(crate) async fn session_key(&self) -> Option<Key> {
+    pub(crate) fn session_key(&self) -> Option<Key> {
         self.server_secret("SESSION_SECRET")
             .map(|value| Key::derive_from(value.as_bytes()))
     }
 
-    pub(crate) async fn github_credentials(
+    pub(crate) fn github_credentials(
         &self,
         settings: &GithubIntegrationSettings,
     ) -> Result<Option<fabro_github::GitHubCredentials>, String> {
@@ -1723,7 +1723,7 @@ async fn get_github_repo(
                 return ApiError::new(StatusCode::SERVICE_UNAVAILABLE, err.to_string())
                     .into_response();
             }
-            let creds = match state.github_credentials(github_settings).await {
+            let creds = match state.github_credentials(github_settings) {
                 Ok(Some(fabro_github::GitHubCredentials::App(creds))) => creds,
                 Ok(Some(_)) => unreachable!("app strategy should not return token credentials"),
                 Ok(None) => {
@@ -1805,7 +1805,7 @@ async fn get_github_repo(
                 Err(err) => return ApiError::new(StatusCode::BAD_GATEWAY, err).into_response(),
             }
         }
-        GithubIntegrationStrategy::GhCli => match state.github_credentials(github_settings).await {
+        GithubIntegrationStrategy::GhCli => match state.github_credentials(github_settings) {
             Ok(Some(fabro_github::GitHubCredentials::Token(token))) => token,
             Ok(Some(_)) => unreachable!("gh_cli strategy should not return app credentials"),
             Ok(None) => {
@@ -1938,7 +1938,7 @@ async fn cookie_and_demo_middleware(
         req.headers_mut()
             .insert("x-fabro-demo", HeaderValue::from_static("1"));
     }
-    if let Some(key) = state.session_key().await {
+    if let Some(key) = state.session_key() {
         if let Some(session) = web_auth::read_private_session(req.headers(), &key) {
             req.extensions_mut().insert(session);
         }
@@ -2127,7 +2127,7 @@ pub fn create_app_state_with_settings_and_registry_factory(
         5,
         store,
         artifact_store,
-        test_secret_store_path(),
+        &test_secret_store_path(),
         test_config_path(),
         false,
     )
@@ -2171,7 +2171,7 @@ pub fn create_app_state_with_store(
         max_concurrent_runs,
         store,
         artifact_store,
-        test_secret_store_path(),
+        &test_secret_store_path(),
         test_config_path(),
         false,
     )
@@ -2184,11 +2184,11 @@ pub(crate) fn build_app_state_with_path(
     max_concurrent_runs: usize,
     store: Arc<Database>,
     artifact_store: ArtifactStore,
-    vault_path: PathBuf,
+    vault_path: &std::path::Path,
     config_path: PathBuf,
     local_daemon_mode: bool,
 ) -> anyhow::Result<Arc<AppState>> {
-    let vault = Arc::new(AsyncRwLock::new(Vault::load(vault_path.clone())?));
+    let vault = Arc::new(AsyncRwLock::new(Vault::load(vault_path.to_path_buf())?));
     let server_env_path = vault_path.parent().map_or_else(
         || PathBuf::from("server.env"),
         |parent| parent.join("server.env"),
@@ -3811,10 +3811,10 @@ async fn execute_run_in_process(state: Arc<AppState>, run_id: RunId) {
                 && settings.sandbox.provider == "daytona")
                 || !github_settings.permissions.is_empty();
             if required_github_credentials {
-                state.github_credentials(&github_settings).await
+                state.github_credentials(&github_settings)
             } else if settings.execution.mode != RunMode::DryRun && settings.pull_request.is_some()
             {
-                match state.github_credentials(&github_settings).await {
+                match state.github_credentials(&github_settings) {
                     Ok(github_app) => Ok(github_app),
                     Err(err) => {
                         tracing::warn!(

lib/crates/fabro-server/src/server_secrets.rs

@@ -77,7 +77,7 @@ impl std::fmt::Debug for ServerSecrets {
                 "file_entries",
                 &self.file_entries.keys().collect::<Vec<_>>(),
             )
-            .finish()
+            .finish_non_exhaustive()
     }
 }
 

lib/crates/fabro-server/src/web_auth.rs

@@ -240,7 +240,7 @@ async fn callback_github(
     Query(params): Query<OAuthCallbackParams>,
     headers: HeaderMap,
 ) -> Response {
-    let Some(session_key) = state.session_key().await else {
+    let Some(session_key) = state.session_key() else {
         error!("OAuth callback failed: SESSION_SECRET not configured");
         return json_response(
             StatusCode::CONFLICT,
@@ -449,7 +449,7 @@ async fn callback_github(
 async fn logout(State(state): State<Arc<AppState>>) -> Response {
     info!("User logged out");
     let mut jar = CookieJar::new();
-    if let Some(key) = state.session_key().await {
+    if let Some(key) = state.session_key() {
         jar.private_mut(&key).remove(
             Cookie::build((SESSION_COOKIE_NAME, ""))
                 .path("/")
@@ -464,7 +464,7 @@ async fn logout(State(state): State<Arc<AppState>>) -> Response {
 
 async fn auth_me(State(state): State<Arc<AppState>>, headers: HeaderMap) -> Response {
     let has_cookie = headers.get(header::COOKIE).is_some();
-    let Some(session_key) = state.session_key().await else {
+    let Some(session_key) = state.session_key() else {
         warn!(
             has_cookie,
             "Auth check failed: SESSION_SECRET not available"