feat: add panic lints, roll toolchain forward

Cargo.toml

@@ -9,7 +9,7 @@ exclude = ["test_app"]
 
 [package]
 name = "cargo_pup"
-version = "0.1.4"
+version = "0.1.5"
 edition = "2024"
 description = "A Rust architectural linting tool that integrates with rustc to enforce architectural patterns and boundaries"
 license = "Apache-2.0"
@@ -34,9 +34,9 @@ anyhow = { workspace = true }
 tempfile = { workspace = true }
 ron = { workspace = true }
 cargo_metadata = { workspace = true }
-cargo_pup_common = { path = "cargo_pup_common", version = "=0.1.4" }
-cargo_pup_lint_impl = { path = "cargo_pup_lint_impl", version = "=0.1.4" }
-cargo_pup_lint_config = { path = "cargo_pup_lint_config", version = "=0.1.4" }
+cargo_pup_common = { path = "cargo_pup_common", version = "=0.1.5" }
+cargo_pup_lint_impl = { path = "cargo_pup_lint_impl", version = "=0.1.5" }
+cargo_pup_lint_config = { path = "cargo_pup_lint_config", version = "=0.1.5" }
 
 #
 # These bits are just to keep rust rover happy.

README.md

@@ -21,8 +21,8 @@ First, make sure to install [rustup](https://rustup.rs/) to manage your local ru
 
 Then install pup; **you must use this nightly toolchain, as pup depends on compiler internals that are otherwise unavailable!**
 ```bash
-rustup component add --toolchain nightly-2025-07-25 rust-src rustc-dev llvm-tools-preview
-cargo +nightly-2025-07-25 install cargo_pup
+rustup component add --toolchain nightly-2026-01-22 rust-src rustc-dev llvm-tools-preview
+cargo +nightly-2026-01-22 install cargo_pup
 ```
 
 ## Getting Started
@@ -121,7 +121,7 @@ First, add the following to your `Cargo.toml`:
 
 ```toml
 [dev-dependencies]
-cargo_pup_lint_config = "0.1.4"
+cargo_pup_lint_config = "0.1.5"
 ```
 
 ## Examples

cargo_pup_common/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "cargo_pup_common"
-version = "0.1.4"
+version = "0.1.5"
 edition = "2024"
 description = "Common utilities and shared components for cargo-pup architectural linting tool"
 license = "Apache-2.0"

cargo_pup_lint_config/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "cargo_pup_lint_config"
-version = "0.1.4"
+version = "0.1.5"
 edition = "2024"
 description = "Configuration and rule builder utilities for cargo-pup architectural linting"
 license = "Apache-2.0"
@@ -13,4 +13,4 @@ serde.workspace = true
 ron.workspace = true
 tempfile.workspace = true
 anyhow.workspace = true
-cargo_pup_common = { path = "../cargo_pup_common", version = "=0.1.4" }
+cargo_pup_common = { path = "../cargo_pup_common", version = "=0.1.5" }

cargo_pup_lint_config/README.md

@@ -24,7 +24,7 @@ Add this to your `Cargo.toml`:
 
 ```toml
 [dev-dependencies]
-cargo_pup_lint_config = "0.1.4"
+cargo_pup_lint_config = "0.1.5"
 ```
 
 ## Example

cargo_pup_lint_config/src/function_lint/builder.rs

@@ -138,6 +138,37 @@ impl<'a> FunctionConstraintBuilder<'a> {
         self
     }
 
+    /// Forbid unwrap/expect calls on Option and Result
+    /// This detects: Option::unwrap, Option::expect, Result::unwrap, Result::expect,
+    /// Result::unwrap_err, Result::expect_err
+    pub fn no_unwrap(mut self) -> Self {
+        self.add_rule_internal(FunctionRule::NoUnwrap(self.current_severity));
+        self
+    }
+
+    /// Forbid all panic-family macros: panic!(), unreachable!(), unimplemented!(), todo!(), assert!()
+    /// Note: MIR-level analysis cannot distinguish between these macros as they all
+    /// compile to similar underlying panic functions.
+    pub fn no_panic(mut self) -> Self {
+        self.add_rule_internal(FunctionRule::NoPanic(self.current_severity));
+        self
+    }
+
+    /// Forbid index bounds panics
+    pub fn no_index_panic(mut self) -> Self {
+        self.add_rule_internal(FunctionRule::NoIndexPanic(self.current_severity));
+        self
+    }
+
+    /// Convenience method: forbid ALL panic sources
+    /// This adds all panic-related rules: NoUnwrap, NoPanic, and NoIndexPanic
+    pub fn no_panics(mut self) -> Self {
+        self.add_rule_internal(FunctionRule::NoUnwrap(self.current_severity));
+        self.add_rule_internal(FunctionRule::NoPanic(self.current_severity));
+        self.add_rule_internal(FunctionRule::NoIndexPanic(self.current_severity));
+        self
+    }
+
     /// Create a new MaxLength rule with the current severity
     pub fn create_max_length_rule(&self, length: usize) -> FunctionRule {
         FunctionRule::MaxLength(length, self.current_severity)

cargo_pup_lint_config/src/function_lint/matcher.rs

@@ -80,6 +80,11 @@ impl FunctionMatcher {
     pub fn is_async(&self) -> FunctionMatchNode {
         FunctionMatchNode::Leaf(FunctionMatch::IsAsync)
     }
+
+    /// Matches unsafe functions
+    pub fn is_unsafe(&self) -> FunctionMatchNode {
+        FunctionMatchNode::Leaf(FunctionMatch::IsUnsafe)
+    }
 }
 
 /// Node in the matcher expression tree

cargo_pup_lint_config/src/function_lint/types.rs

@@ -37,6 +37,8 @@ pub enum FunctionMatch {
     ReturnsType(ReturnTypePattern),
     /// Match async functions
     IsAsync,
+    /// Match unsafe functions
+    IsUnsafe,
     /// Logical AND - both patterns must match
     AndMatches(Box<FunctionMatch>, Box<FunctionMatch>),
     /// Logical OR - either pattern must match
@@ -64,6 +66,15 @@ pub enum FunctionRule {
     MustNotExist(Severity),
     /// Enforces that a function must not perform heap allocations
     NoAllocation(Severity),
+    /// Enforces that a function must not call unwrap/expect on Option or Result
+    NoUnwrap(Severity),
+    /// Enforces that a function must not use any panic-family macros.
+    /// This includes: panic!(), unreachable!(), unimplemented!(), todo!(), and assert!().
+    /// Note: MIR-level analysis cannot distinguish between these macros as they all
+    /// compile to similar underlying panic functions.
+    NoPanic(Severity),
+    /// Enforces that a function must not trigger index bounds panics
+    NoIndexPanic(Severity),
 }
 
 // Helper methods for FunctionRule

cargo_pup_lint_config/src/lint_builder_ext.rs

@@ -189,23 +189,24 @@ fn find_workspace_root() -> Result<std::path::PathBuf> {
     let mut check_dir = current_exe.parent();
 
     while let Some(dir) = check_dir {
+        // Check if this directory has the specific cargo-pup source structure
+        // This is the most reliable indicator that we're in the cargo-pup workspace
+        if dir.join("src").join("pup_driver.rs").exists() {
+            return Ok(dir.to_path_buf());
+        }
+
         let cargo_toml = dir.join("Cargo.toml");
         if cargo_toml.exists()
             && let Ok(contents) = std::fs::read_to_string(&cargo_toml)
         {
-            // Look specifically for cargo-pup project or workspace with cargo-pup
-            if contents.contains("name = \"cargo-pup\"")
-                || (contents.contains("[workspace]") && contents.contains("cargo_pup"))
-            {
+            // Look specifically for the cargo-pup package itself (not a dependency)
+            // We check for the exact package name pattern to avoid matching projects
+            // that merely depend on cargo_pup_lint_config
+            if contents.contains("name = \"cargo_pup\"") {
                 return Ok(dir.to_path_buf());
             }
         }
 
-        // Also check if this directory has the specific cargo-pup source structure
-        if dir.join("src").join("pup_driver.rs").exists() {
-            return Ok(dir.to_path_buf());
-        }
-
         check_dir = dir.parent();
     }
 

cargo_pup_lint_config/src/struct_lint/builder.rs

@@ -148,4 +148,10 @@ impl<'a> StructConstraintBuilder<'a> {
         self.add_rule_internal(StructRule::MustBePublic(self.current_severity));
         self
     }
+
+    /// Add a rule requiring the struct to have pub(crate) visibility
+    pub fn must_be_pub_crate(mut self) -> Self {
+        self.add_rule_internal(StructRule::MustBePubCrate(self.current_severity));
+        self
+    }
 }

cargo_pup_lint_config/src/struct_lint/types.rs

@@ -35,10 +35,12 @@ pub enum StructRule {
     MustBeNamed(String, Severity),
     /// Enforces that the struct name does not match the specified pattern
     MustNotBeNamed(String, Severity),
-    /// Enforces that the struct has private visibility
+    /// Enforces that the struct has private visibility (not pub, not pub(crate), not pub(super))
     MustBePrivate(Severity),
-    /// Enforces that the struct has public visibility
+    /// Enforces that the struct has public visibility (pub)
     MustBePublic(Severity),
+    /// Enforces that the struct has pub(crate) visibility
+    MustBePubCrate(Severity),
     /// Enforces that the struct implements a specific trait
     ImplementsTrait(String, Severity),
     /// Logical AND - both rules must pass

cargo_pup_lint_impl/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "cargo_pup_lint_impl"
-version = "0.1.4"
+version = "0.1.5"
 edition = "2024"
 description = "Core lint implementations and rustc integration for cargo-pup architectural linting"
 license = "Apache-2.0"
@@ -9,8 +9,8 @@ homepage = "https://github.com/datadog/cargo-pup"
 readme = "README.md"
 
 [dependencies]
-cargo_pup_lint_config = { path = "../cargo_pup_lint_config", version = "=0.1.4" }
-cargo_pup_common = { path = "../cargo_pup_common", version = "=0.1.4" }
+cargo_pup_lint_config = { path = "../cargo_pup_lint_config", version = "=0.1.5" }
+cargo_pup_common = { path = "../cargo_pup_common", version = "=0.1.5" }
 anyhow.workspace = true
 regex.workspace = true
 serde_json.workspace = true

cargo_pup_lint_impl/src/helpers/architecture_lint_runner.rs

@@ -192,7 +192,7 @@ impl ArchitectureLintRunner {
             {
                 // This is a trait implementation
                 // Get the canonical trait name using the centralized helper
-                let trait_def_id = trait_ref.path.res.def_id();
+                let trait_def_id = trait_ref.trait_ref.path.res.def_id();
                 let canonical_full_name =
                     crate::helpers::queries::get_full_canonical_trait_name_from_def_id(
                         &tcx,
@@ -261,7 +261,6 @@ impl Callbacks for ArchitectureLintRunner {
         config.register_lints = Some(Box::new(move |_sess, lint_store| {
             // If we're actually linting, recreate the lints and add them all
             if let Mode::Check = mode {
-                //let lints = setup_lints_yaml().expect("can load lints");
                 for lint in lint_collection.lints() {
                     lint.register_late_pass(lint_store);
                 }
@@ -326,8 +325,6 @@ impl Callbacks for ArchitectureLintRunner {
         _compiler: &rustc_interface::interface::Compiler,
         _tcx: TyCtxt<'_>,
     ) -> rustc_driver::Compilation {
-        _compiler.sess.coverage_discard_all_spans_in_codegen();
-
         rustc_driver::Compilation::Continue
     }
 }

cargo_pup_lint_impl/src/lib.rs

@@ -1,6 +1,5 @@
 #![feature(rustc_private)]
 // This product includes software developed at Datadog (https://www.datadoghq.com/) Copyright 2024 Datadog, Inc.
-#![feature(array_windows)]
 #![feature(try_blocks)]
 
 pub mod helpers;