# cargo-deny config — pinned to ≥ 0.16 schema
# Validated via openpencil-docs/superpowers/notes/2026-05-02-cargo-deny-validation.md

[graph]
all-features = false
# 限定到实际发布目标（macOS/Linux/Windows native + wasm32）。
# 不限定的话 cargo-deny 默认尝试所有 target（含 Android/iOS），
# 拉进 jni / android-activity 等 edition-2024 deps，在 rustc 1.82 上 cargo metadata 失败。
targets = [
  { triple = "x86_64-unknown-linux-gnu" },
  { triple = "aarch64-unknown-linux-gnu" },
  { triple = "x86_64-apple-darwin" },
  { triple = "aarch64-apple-darwin" },
  { triple = "x86_64-pc-windows-msvc" },
  { triple = "wasm32-unknown-unknown" },
]

[licenses]
allow = [
  "MIT",
  "Apache-2.0",
  "Apache-2.0 WITH LLVM-exception",
  "BSD-2-Clause",
  "BSD-3-Clause",
  "ISC",
  "Unicode-DFS-2016",
  "Unicode-3.0",
  "CDLA-Permissive-2.0",
  "MPL-2.0",
  "Zlib",
]
confidence-threshold = 0.93

[advisories]
yanked = "deny"
ignore = []

[bans]
multiple-versions = "warn"
wildcards = "deny"
# 允许 workspace 内部 path 依赖不写 version（标准实践，避免每次 bump 都改两处）。
allow-wildcard-paths = true
deny = [
  # WASM bundle 黑名单（kickoff spec §1.2 invariant）
  "pen-agent-cli",
  "pen-server",
  "agent",
  "native-tls",
]

[[bans.features]]
crate = "tokio"
deny = ["process", "rt-multi-thread"]

[sources]
unknown-registry = "deny"
unknown-git = "deny"
allow-git = ["https://github.com/ZSeven-W/agent-rs"]