refactor: narrow workspace visibility with hawk and delete the exposed dead code

Apply cargo-hawk's closed-world visibility fixes (258 pub -> pub(crate)/private
narrowings across 43 files; the agentfs binary is the workspace's only product
and this fork has no external library consumers). Then remove the dead code the
narrowing exposed: the duplicate CLI telemetry snapshot, unused telemetry
recorders, MountSpec, NfsServerHandle::is_finished, run_supervised_pid, the
tokio set_parent_death_signal variant, and unused constructors/accessors in
core. Test-only helpers (OverlayFS::delta, import_entries, KvStore::new,
ToolCalls::new, ProfileSnapshot::counter) move behind #[cfg(test)], and the
docs/knobs manual-generation machinery becomes #[cfg(test)] modules since its
only consumers are their parity tests.

Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>

Author: factory-ain3sh

crates/agentfs-cli/src/cmd/fs.rs

@@ -382,7 +382,7 @@ mod tests {
     const S_IFREG: u32 = 0o100000;
 
     #[tokio::test]
-    pub async fn cat_file_not_found() {
+    async fn cat_file_not_found() {
         let (_agentfs, path, _file) = agentfs().await;
         let mut buf = Vec::new();
         let err = cat_filesystem(&mut buf, path, "test.md", None)
@@ -392,7 +392,7 @@ mod tests {
     }
 
     #[tokio::test]
-    pub async fn cat_file_found() {
+    async fn cat_file_found() {
         let (agentfs, path, _file) = agentfs().await;
         let content = b"hello, agentfs";
         write_file(&agentfs.fs, "test.md", content, 0, 0)
@@ -406,7 +406,7 @@ mod tests {
     }
 
     #[tokio::test]
-    pub async fn cat_big_file_found() {
+    async fn cat_big_file_found() {
         let (agentfs, path, _file) = agentfs().await;
         let content = vec![100u8; 4 * 1024 * 1024];
         write_file(&agentfs.fs, "test.md", &content, 0, 0)
@@ -420,15 +420,15 @@ mod tests {
     }
 
     #[tokio::test]
-    pub async fn ls_empty() {
+    async fn ls_empty() {
         let (_agentfs, path, _file) = agentfs().await;
         let mut buf = Vec::new();
         ls_filesystem(&mut buf, path, "/", None).await.unwrap();
         assert_eq!(buf, b"");
     }
 
     #[tokio::test]
-    pub async fn ls_files_only() {
+    async fn ls_files_only() {
         let (agentfs, path, _file) = agentfs().await;
         write_file(&agentfs.fs, "1.md", b"1", 0, 0).await.unwrap();
         write_file(&agentfs.fs, "2.md", b"11", 0, 0).await.unwrap();
@@ -446,7 +446,7 @@ f 3.md
     }
 
     #[tokio::test]
-    pub async fn ls_dirs() {
+    async fn ls_dirs() {
         let (agentfs, path, _file) = agentfs().await;
         agentfs.fs.mkdir("a", 0, 0).await.unwrap();
         agentfs.fs.mkdir("a/b", 0, 0).await.unwrap();
@@ -480,7 +480,7 @@ f d/e/3.md
     }
 
     #[tokio::test]
-    pub async fn ls_subdir_lists_only_subtree() {
+    async fn ls_subdir_lists_only_subtree() {
         let (agentfs, path, _file) = agentfs().await;
         agentfs.fs.mkdir("a", 0, 0).await.unwrap();
         agentfs.fs.mkdir("a/b", 0, 0).await.unwrap();
@@ -517,7 +517,7 @@ f c/2.md
     }
 
     #[tokio::test]
-    pub async fn ls_missing_path_errors() {
+    async fn ls_missing_path_errors() {
         let (_agentfs, path, _file) = agentfs().await;
         let mut buf = Vec::new();
         let err = ls_filesystem(&mut buf, path, "/missing", None)
@@ -530,7 +530,7 @@ f c/2.md
     }
 
     #[tokio::test]
-    pub async fn ls_file_path_errors() {
+    async fn ls_file_path_errors() {
         let (agentfs, path, _file) = agentfs().await;
         write_file(&agentfs.fs, "file.md", b"1", 0, 0)
             .await
@@ -546,7 +546,7 @@ f c/2.md
     }
 
     #[tokio::test]
-    pub async fn read_commands_leave_no_wal_sidecar() {
+    async fn read_commands_leave_no_wal_sidecar() {
         let (agentfs, path, _file) = agentfs().await;
         write_file(&agentfs.fs, "test.md", b"1", 0, 0)
             .await
@@ -585,7 +585,7 @@ f c/2.md
     // Encryption tests
 
     #[tokio::test]
-    pub async fn encrypted_write_and_cat() {
+    async fn encrypted_write_and_cat() {
         let (agentfs, path, _file) = encrypted_agentfs().await;
         let content = b"encrypted content";
         write_file(&agentfs.fs, "secret.txt", content, 0, 0)
@@ -602,7 +602,7 @@ f c/2.md
     }
 
     #[tokio::test]
-    pub async fn encrypted_ls() {
+    async fn encrypted_ls() {
         let (agentfs, path, _file) = encrypted_agentfs().await;
         write_file(&agentfs.fs, "file1.txt", b"1", 0, 0)
             .await
@@ -621,7 +621,7 @@ f c/2.md
     }
 
     #[tokio::test]
-    pub async fn write_filesystem_owns_entries_as_invoking_user() {
+    async fn write_filesystem_owns_entries_as_invoking_user() {
         let (_agentfs, path, _file) = agentfs().await;
         write_filesystem(path.clone(), "/subdir/owned.txt", "content", None)
             .await
@@ -649,7 +649,7 @@ f c/2.md
     }
 
     #[tokio::test]
-    pub async fn encrypted_write_filesystem() {
+    async fn encrypted_write_filesystem() {
         let (_agentfs, path, _file) = encrypted_agentfs().await;
 
         let encryption = Some((TEST_KEY.to_string(), TEST_CIPHER.to_string()));

crates/agentfs-cli/src/cmd/init.rs

@@ -16,7 +16,7 @@ pub struct EncryptionOptions {
     pub cipher: String,
 }
 
-pub async fn open_agentfs(options: AgentFSOptions) -> Result<AgentFS, agentfs_core::error::Error> {
+pub(crate) async fn open_agentfs(options: AgentFSOptions) -> Result<AgentFS, agentfs_core::error::Error> {
     let mut options = options;
     if options.core_config.is_none() {
         options = options.with_core_config(crate::config::core_config_from_env());
@@ -34,13 +34,13 @@ pub async fn open_agentfs(options: AgentFSOptions) -> Result<AgentFS, agentfs_co
 /// the owning session performed (invariant I1). Best-effort — a finalize
 /// failure (e.g. a concurrent holder of the database) must not fail a
 /// command whose real work already succeeded.
-pub async fn finalize_readonly(agentfs: &AgentFS) {
+pub(crate) async fn finalize_readonly(agentfs: &AgentFS) {
     if let Err(error) = agentfs.fs.finalize().await {
         eprintln!("Warning: Failed to restore the single-file database family: {error:#}");
     }
 }
 
-pub fn build_sync_options(sync_cmd_options: &SyncCommandOptions) -> SyncOptions {
+fn build_sync_options(sync_cmd_options: &SyncCommandOptions) -> SyncOptions {
     let mut sync = SyncOptions {
         remote_url: sync_cmd_options.sync_remote_url.clone(),
         auth_token: crate::config::turso_db_auth_token(),

crates/agentfs-cli/src/cmd/migrate.rs

@@ -30,7 +30,7 @@ const S_IFREG: i64 = 0o100000;
 /// Names a command that actually finishes the job: supported old versions get
 /// `agentfs migrate <id-or-path>` (which lands at CURRENT in one invocation);
 /// anything else is from a newer agentfs and no local command can help.
-pub fn schema_upgrade_guidance(found: &str, expected: &str, id_or_path: &str) -> String {
+fn schema_upgrade_guidance(found: &str, expected: &str, id_or_path: &str) -> String {
     match SchemaVersion::parse(found) {
         Some(version) if version < schema::CURRENT => format!(
             "Filesystem `{id_or_path}` requires migration\n\n\
@@ -47,7 +47,7 @@ pub fn schema_upgrade_guidance(found: &str, expected: &str, id_or_path: &str) ->
 
 /// Convert an SDK open error into an anyhow error, attaching migrate guidance
 /// when the failure is a schema-version mismatch.
-pub fn open_error_with_guidance(err: SdkError, id_or_path: &str) -> anyhow::Error {
+pub(crate) fn open_error_with_guidance(err: SdkError, id_or_path: &str) -> anyhow::Error {
     match &err {
         SdkError::SchemaVersionMismatch { found, expected } => {
             anyhow::anyhow!("{}", schema_upgrade_guidance(found, expected, id_or_path))

crates/agentfs-cli/src/cmd/profiling.rs

@@ -3,8 +3,6 @@
 //! Adapter-specific counters register from their owning crates when those
 //! adapters are constructed; the CLI owns only the process report lifecycle.
 
-pub use agentfs_core::telemetry::ProfileSnapshot;
-
 const PROFILE_SUMMARY_EVENT: &str = "agentfs_profile_summary";
 
 /// Drop guard installed by the CLI binary for a single process summary.
@@ -18,7 +16,7 @@ impl ProfileReportGuard {
         Self { source }
     }
 
-    pub fn emit_now(&self) {
+    fn emit_now(&self) {
         emit_profile_summary(self.source);
     }
 }
@@ -37,7 +35,7 @@ pub fn emit_cli_report() {
     emit_profile_summary("cli");
 }
 
-pub fn report_checkpoint() {
+pub(crate) fn report_checkpoint() {
     if let Some(payload) = agentfs_core::telemetry::checkpoint_payload(PROFILE_SUMMARY_EVENT) {
         eprintln!("{payload}");
     }
@@ -50,7 +48,3 @@ fn emit_profile_summary(source: &str) {
         eprintln!("{payload}");
     }
 }
-
-pub fn snapshot() -> ProfileSnapshot {
-    agentfs_core::telemetry::snapshot()
-}

crates/agentfs-cli/src/cmd/ps.rs

@@ -11,19 +11,19 @@ use serde::{Deserialize, Serialize};
 #[derive(Debug, Serialize, Deserialize)]
 pub struct ProcInfo {
     /// Process ID.
-    pub pid: u32,
+    pid: u32,
     /// Whether this process is the session owner (created the FUSE mount).
-    pub owner: bool,
+    owner: bool,
     /// Command being run.
-    pub command: String,
+    command: String,
     /// When the process started.
-    pub started_at: DateTime<Utc>,
+    started_at: DateTime<Utc>,
     /// Working directory when the session was started.
-    pub cwd: PathBuf,
+    cwd: PathBuf,
 }
 
 /// Get the path to the procs directory for a session.
-pub fn procs_dir(session_id: &str) -> PathBuf {
+pub(crate) fn procs_dir(session_id: &str) -> PathBuf {
     let home = dirs::home_dir().expect("home directory");
     home.join(".agentfs")
         .join("run")
@@ -32,12 +32,12 @@ pub fn procs_dir(session_id: &str) -> PathBuf {
 }
 
 /// Get the path to a proc file.
-pub fn proc_file(session_id: &str, pid: u32) -> PathBuf {
+fn proc_file(session_id: &str, pid: u32) -> PathBuf {
     procs_dir(session_id).join(format!("{}.json", pid))
 }
 
 /// Write a proc file for the current process.
-pub fn write_proc_file(session_id: &str, owner: bool, command: &str, cwd: &Path) -> Result<()> {
+pub(crate) fn write_proc_file(session_id: &str, owner: bool, command: &str, cwd: &Path) -> Result<()> {
     let pid = std::process::id();
     let procs_dir = procs_dir(session_id);
     std::fs::create_dir_all(&procs_dir)?;
@@ -58,7 +58,7 @@ pub fn write_proc_file(session_id: &str, owner: bool, command: &str, cwd: &Path)
 }
 
 /// Remove the proc file for the current process.
-pub fn remove_proc_file(session_id: &str) {
+pub(crate) fn remove_proc_file(session_id: &str) {
     let pid = std::process::id();
     let path = proc_file(session_id, pid);
     let _ = std::fs::remove_file(path);
@@ -88,7 +88,7 @@ struct SessionInfo {
 }
 
 /// Get the set of active session IDs.
-pub fn active_session_ids() -> std::collections::HashSet<String> {
+pub(crate) fn active_session_ids() -> std::collections::HashSet<String> {
     list_sessions().into_iter().map(|s| s.session_id).collect()
 }
 

crates/agentfs-cli/src/config.rs

@@ -113,7 +113,7 @@ pub(crate) fn adopt_private_spill_dir() {
 }
 
 /// The temp dir the user actually configured, independent of the override.
-pub(crate) fn original_temp_dir() -> PathBuf {
+fn original_temp_dir() -> PathBuf {
     match ORIGINAL_TMPDIR.get() {
         Some(Some(dir)) if !dir.is_empty() => PathBuf::from(dir),
         Some(None) => PathBuf::from("/tmp"),

crates/agentfs-cli/src/docs.rs

@@ -18,7 +18,7 @@ const GENERATED_END: &str = "<!-- END GENERATED COMMAND REFERENCE -->";
 
 /// Render the generated command-reference region of docs/MANUAL.md,
 /// markers included.
-pub fn generated_manual_commands() -> String {
+fn generated_manual_commands() -> String {
     let cmd = Args::command();
     let mut out = String::new();
     out.push_str(GENERATED_BEGIN);

crates/agentfs-cli/src/knobs.rs

@@ -96,7 +96,7 @@ pub enum KnobClass {
 }
 
 impl KnobClass {
-    pub const fn as_str(self) -> &'static str {
+    const fn as_str(self) -> &'static str {
         match self {
             Self::ProductConfig => "product-config",
             Self::KillSwitch => "kill-switch",
@@ -108,7 +108,6 @@ impl KnobClass {
 /// Code-backed default renderer for generated docs.
 #[derive(Debug, Clone, Copy, Eq, PartialEq)]
 pub enum DefaultValue {
-    Literal(&'static str),
     Unset,
     Removed,
     CloneTimingsEnabled,
@@ -170,9 +169,8 @@ pub enum DefaultValue {
 }
 
 impl DefaultValue {
-    pub fn render(self) -> String {
+    fn render(self) -> String {
         match self {
-            Self::Literal(value) => value.to_string(),
             Self::Unset => "unset".to_string(),
             Self::Removed => "removed".to_string(),
             Self::CloneTimingsEnabled => render_bool(DEFAULT_CLONE_TIMINGS_ENABLED).to_string(),
@@ -262,14 +260,14 @@ fn partial_origin_mode_as_str(mode: agentfs_core::PartialOriginMode) -> &'static
 /// One row in the canonical knob ledger.
 #[derive(Debug, Clone, Copy, Eq, PartialEq)]
 pub struct Knob {
-    pub name: &'static str,
-    pub surface: &'static str,
-    pub class: KnobClass,
-    pub default: DefaultValue,
-    pub owner: &'static str,
-    pub description: &'static str,
-    pub removal_criteria: &'static str,
-    pub gate: &'static str,
+    name: &'static str,
+    surface: &'static str,
+    class: KnobClass,
+    default: DefaultValue,
+    owner: &'static str,
+    description: &'static str,
+    removal_criteria: &'static str,
+    gate: &'static str,
 }
 
 impl Knob {
@@ -675,20 +673,20 @@ const DELETED_COMPAT_KNOBS: &[Knob] = &[Knob::sunset(
 )];
 
 /// Active runtime knobs declared in one table.
-pub fn active_knobs() -> Vec<Knob> {
+fn active_knobs() -> Vec<Knob> {
     let mut knobs = Vec::with_capacity(ACTIVE_COMMON_KNOBS.len() + LINUX_FUSE_KNOBS.len());
     knobs.extend_from_slice(ACTIVE_COMMON_KNOBS);
     knobs.extend_from_slice(LINUX_FUSE_KNOBS);
     knobs
 }
 
 /// Deleted compatibility knobs retained only as sunset documentation.
-pub fn deleted_compat_knobs() -> &'static [Knob] {
+fn deleted_compat_knobs() -> &'static [Knob] {
     DELETED_COMPAT_KNOBS
 }
 
 /// Generate the checked-in docs/KNOBS.md contents.
-pub fn generated_knobs_doc() -> String {
+fn generated_knobs_doc() -> String {
     let active = active_knobs();
     let mut out = String::new();
     out.push_str("# AgentFS Runtime Knobs\n\n");
@@ -788,22 +786,6 @@ mod tests {
         );
     }
 
-    #[test]
-    fn knob_ledger_defaults_are_code_backed() {
-        let literal_defaults = active_knobs()
-            .iter()
-            .chain(deleted_compat_knobs())
-            .filter_map(|knob| match knob.default {
-                DefaultValue::Literal(value) => Some(format!("{}={value}", knob.name)),
-                _ => None,
-            })
-            .collect::<Vec<_>>();
-        assert!(
-            literal_defaults.is_empty(),
-            "knob defaults must render from code Default impls or constants, not hand-written literals: {literal_defaults:?}"
-        );
-    }
-
     #[cfg(target_os = "linux")]
     #[test]
     fn knob_defaults_in_docs_match_runtime_defaults() {

crates/agentfs-cli/src/lib.rs

@@ -20,8 +20,10 @@
 
 pub mod cmd;
 pub mod config;
-pub mod docs;
-pub mod knobs;
+#[cfg(test)]
+mod docs;
+#[cfg(test)]
+mod knobs;
 pub mod logging;
 pub mod opts;