# cargo-deny config — pinned to ≥ 0.16 schema
# Validated via openpencil-docs/superpowers/notes/2026-05-02-cargo-deny-validation.md

[graph]
all-features = false
# Scoped to the actual release targets (macOS/Linux/Windows native + wasm32).
# Without this, cargo-deny defaults to every target (including Android/iOS),
# pulling in edition-2024 deps like jni / android-activity, which makes
# `cargo metadata` fail on rustc 1.82.
targets = [
  { triple = "x86_64-unknown-linux-gnu" },
  { triple = "aarch64-unknown-linux-gnu" },
  { triple = "x86_64-apple-darwin" },
  { triple = "aarch64-apple-darwin" },
  { triple = "x86_64-pc-windows-msvc" },
  { triple = "wasm32-unknown-unknown" },
]

[licenses]
allow = [
  "MIT",
  "Apache-2.0",
  "Apache-2.0 WITH LLVM-exception",
  "BSD-2-Clause",
  "BSD-3-Clause",
  "ISC",
  "Unicode-DFS-2016",
  "Unicode-3.0",
  "CDLA-Permissive-2.0",
  "MPL-2.0",
  "Zlib",
]
confidence-threshold = 0.93

[advisories]
yanked = "deny"
ignore = []

[bans]
multiple-versions = "warn"
# Workspace-internal path deps omit the version (standard practice — avoids
# editing two places on every bump). No crate ships to crates.io, so
# wildcard path deps are expected; hence allowed.
wildcards = "allow"
allow-wildcard-paths = true
deny = [
  # WASM bundle blacklist (kickoff spec §1.2 invariant).
  # `agent` is not listed: it is a native-only dependency of op-host-desktop
  # (the desktop binary, never compiled to wasm); wasm isolation is
  # structural (op-host-web does not depend on it) and verified by
  # tools/check-wasm-bundle.sh.
  "pen-agent-cli",
  "pen-server",
  "native-tls",
]

# tokio's process / rt-multi-thread features are no longer banned:
# op-host-desktop's native (async) agent runtime legitimately needs them.
# The wasm side is structurally safe — both features depend on OS
# threads/processes and cannot compile to wasm32 — and is verified by
# tools/check-wasm-bundle.sh.

[sources]
unknown-registry = "deny"
unknown-git = "deny"
# agent-rs is now pulled in as a path dependency via the vendor/agent
# submodule, no longer a git dependency.
allow-git = []