fix(ci): align lint-safe security paths

apps/aether-tunnel/src/setup/service.rs

@@ -781,7 +781,7 @@ fn write_service_definition(path: &str, content: &str, mode: u32) -> anyhow::Res
         if result.is_err() {
             let _ = std::fs::remove_file(&temporary);
         }
-        return result;
+        result
     }
 
     #[cfg(not(unix))]
@@ -831,7 +831,7 @@ fn validate_private_service_directory(path: &Path) -> anyhow::Result<()> {
             }
             ancestor = directory.parent();
         }
-        return Ok(());
+        Ok(())
     }
 
     #[cfg(not(unix))]
@@ -864,7 +864,7 @@ fn validate_replaceable_service_file(path: &Path) -> anyhow::Result<()> {
             Err(error) if error.kind() == ErrorKind::NotFound => {}
             Err(error) => return Err(error.into()),
         }
-        return Ok(());
+        Ok(())
     }
 
     #[cfg(not(unix))]
@@ -910,7 +910,7 @@ fn ensure_private_service_directory(path: &Path, mode: u32) -> anyhow::Result<()
         }
         directory.set_permissions(std::fs::Permissions::from_mode(mode))?;
         directory.sync_all()?;
-        return Ok(());
+        Ok(())
     }
 
     #[cfg(not(unix))]
@@ -949,7 +949,7 @@ fn open_private_service_log(path: &Path, mode: u32) -> anyhow::Result<()> {
         }
         file.set_permissions(std::fs::Permissions::from_mode(mode))?;
         file.sync_all()?;
-        return Ok(());
+        Ok(())
     }
 
     #[cfg(not(unix))]

apps/aether-tunnel/src/setup/upgrade.rs

@@ -739,7 +739,7 @@ fn atomic_replace_paths(current_exe: &Path, new_binary: &Path) -> anyhow::Result
         }
 
         eprintln!("  Binary replaced: {}", current_exe.display());
-        return Ok(backup_path);
+        Ok(backup_path)
     }
 
     #[cfg(not(unix))]
@@ -792,7 +792,7 @@ fn restore_tunnel_backup_paths(current_exe: &Path, backup_path: &Path) -> anyhow
                 error
             );
         }
-        return Ok(());
+        Ok(())
     }
 
     #[cfg(not(unix))]

apps/aether-tunnel/src/tunnel/client.rs

@@ -563,6 +563,10 @@ fn insert_ascii_header(
     Ok(())
 }
 
+// The handshake transcript has a fixed set of wire fields. Keep the explicit
+// arguments and ordering so the client remains interoperable with existing
+// tunnel servers.
+#[allow(clippy::too_many_arguments)]
 fn insert_tunnel_security_handshake_headers(
     headers: &mut http::HeaderMap,
     key: &str,

apps/aether-tunnel/src/tunnel/stream_handler.rs

@@ -1617,7 +1617,7 @@ where
                         redirect_count,
                         request_body_size.load(Ordering::Relaxed),
                     ),
-                    &error_message,
+                    error_message,
                     total_elapsed,
                 );
                 send_error(frame_tx, stream_id, error_message).await;
@@ -2091,10 +2091,10 @@ async fn handle_stream_inner(
                             redirects_followed,
                             request_body_size.load(Ordering::Relaxed),
                         ),
-                        &error_message,
+                        error_message,
                         overall_start.elapsed(),
                     );
-                    send_error(frame_tx, stream_id, &error_message).await;
+                    send_error(frame_tx, stream_id, error_message).await;
                     return None;
                 }
             }