chore: clippy disallows std::env access outside the config module

clippy.toml

@@ -0,0 +1,8 @@
+disallowed-methods = [
+    { path = "std::env::var", reason = "environment access lives in path-cli's config module; take the value as a parameter" },
+    { path = "std::env::var_os", reason = "environment access lives in path-cli's config module; take the value as a parameter" },
+    { path = "std::env::vars", reason = "environment access lives in path-cli's config module; take the value as a parameter" },
+    { path = "std::env::vars_os", reason = "environment access lives in path-cli's config module; take the value as a parameter" },
+    { path = "std::env::set_var", reason = "tests construct values instead of mutating the environment" },
+    { path = "std::env::remove_var", reason = "tests construct values instead of mutating the environment" },
+]

crates/path-cli/src/config.rs

@@ -176,6 +176,10 @@ impl Config {
 ///
 /// The environment is read here so consumers take the search path as a
 /// parameter.
+#[expect(
+    clippy::disallowed_methods,
+    reason = "this module is the one place that reads the environment"
+)]
 pub(crate) fn search_path() -> Vec<PathBuf> {
     std::env::var_os("PATH")
         .map(|p| std::env::split_paths(&p).collect())

crates/path-cli/src/fuzzy.rs

@@ -100,6 +100,10 @@ pub const fn embedded_picker_available() -> bool {
     false
 }
 
+#[expect(
+    clippy::disallowed_methods,
+    reason = "the fzf probe keeps its own read until the search path's owner is decided in review"
+)]
 fn which(cmd: &str) -> Option<std::path::PathBuf> {
     let path = std::env::var_os("PATH")?;
     for dir in std::env::split_paths(&path) {

crates/pathbase-client/build.rs

@@ -46,6 +46,10 @@ fn main() {
     let ast = syn::parse2::<syn::File>(tokens).expect("parse generated tokens");
     let formatted = prettyplease::unparse(&ast);
 
+    #[expect(
+        clippy::disallowed_methods,
+        reason = "cargo passes OUT_DIR to a build script only through the environment"
+    )]
     let out_dir = PathBuf::from(env::var("OUT_DIR").expect("OUT_DIR set by cargo"));
     let out_file = out_dir.join("pathbase_client.rs");
     fs::write(&out_file, formatted).unwrap_or_else(|e| panic!("write {}: {e}", out_file.display()));

crates/toolpath-cursor/examples/dump_fixture.rs

@@ -147,6 +147,10 @@ fn referenced_blob_hashes(session: &CursorSession) -> std::collections::HashSet<
 
 /// The home directory this example reads Cursor state under. The
 /// library takes it as an argument, so the caller supplies it.
+#[expect(
+    clippy::disallowed_methods,
+    reason = "this example reads the developer's real Cursor store, so it must locate the real home directory"
+)]
 fn home_dir() -> Option<PathBuf> {
     std::env::var_os("HOME")
         .or_else(|| std::env::var_os("USERPROFILE"))

crates/toolpath-cursor/tests/real_session_sanity.rs

@@ -71,6 +71,10 @@ fn real_cursor_db_round_trips_when_present() {
 
 /// The home directory this test reads Cursor state under. The library
 /// takes it as an argument, so the caller supplies it.
+#[expect(
+    clippy::disallowed_methods,
+    reason = "this test reads the developer's real Cursor store, so it must locate the real home directory"
+)]
 fn home_dir() -> Option<std::path::PathBuf> {
     std::env::var_os("HOME")
         .or_else(|| std::env::var_os("USERPROFILE"))

scripts/quality_gates.sh

@@ -70,7 +70,7 @@ gate_shellcheck() {
 
 # shellcheck disable=SC2329
 gate_clippy() {
-    cargo clippy --workspace -- -D warnings 2>&1
+    cargo clippy --workspace --all-targets -- -D warnings 2>&1
 }
 
 # shellcheck disable=SC2329