chore: fix Rust clippy/fmt errors and add Rust linting to CI

.claude/CLAUDE.md

@@ -42,20 +42,20 @@ just start         # Run agent (tsx src/agent/index.ts)
 
 # ── Testing ──
 just test          # Run TypeScript tests
-just test-rust     # Run Rust tests (analysis-guest)
-just test-all      # Run all tests (TS + Rust)
+just test-analysis-guest  # Run Rust tests (analysis-guest)
+just test-all            # Run all tests (TS + Rust)
 
 # ── Formatting ──
-just fmt           # Format TypeScript/JavaScript
-just fmt-rust      # Format Rust (analysis-guest)
-just fmt-runtime   # Format Rust (sandbox/runtime)
-just fmt-all       # Format all code
+just fmt                 # Format TypeScript/JavaScript
+just fmt-analysis-guest  # Format Rust (analysis-guest)
+just fmt-runtime         # Format Rust (sandbox/runtime)
+just fmt-all             # Format all code
 
 # ── Linting ──
-just lint          # TypeScript: fmt-check + typecheck
-just lint-rust     # Rust: clippy + fmt-check (analysis-guest)
-just lint-runtime  # Rust: clippy + fmt-check (runtime)
-just lint-all      # All lints
+just lint                # TypeScript: fmt-check + typecheck
+just lint-analysis-guest # Rust: clippy + fmt-check (analysis-guest)
+just lint-runtime        # Rust: clippy + fmt-check (runtime)
+just lint-all            # All lints
 
 # ── Quality Gate ──
 just check         # Full quality gate: lint-all + test-all

.github/copilot-instructions.md

@@ -46,7 +46,7 @@ Individual commands:
 | `just fmt` | Format TS/JS with Prettier | Before committing |
 | `just lint` | `fmt-check` + `tsc --noEmit` | Quick validation |
 | `just test` | Run Vitest suite (30 test files, ~1700 tests) | After TS changes |
-| `just test-rust` | Run Rust tests in code-validator | After Rust changes |
+| `just test-analysis-guest` | Run Rust tests in code-validator | After Rust changes |
 | `just test-all` | Both TS + Rust tests | Full validation |
 | `just start` | Run agent with `tsx` (no build needed) | Dev/testing |
 | `just binary-release` | Build standalone binary to `dist/bin/hyperagent` | Release builds |
@@ -93,5 +93,5 @@ Before considering a change complete:
 1. `just fmt` — all code formatted
 2. `just lint` — TypeScript compiles with zero errors
 3. `just test` — all ~1700 tests pass
-4. If Rust code was changed: `just test-rust` passes
+4. If Rust code was changed: `just test-analysis-guest` passes
 5. No new `expect`/`unwrap`/`assert` in production TS code

.github/instructions/tests.instructions.md

@@ -10,7 +10,7 @@ Vitest test suite for Hyperagent.
 
 ```bash
 just test          # Run all TypeScript tests
-just test-rust     # Run Rust tests (analysis-guest)
+just test-analysis-guest  # Run Rust tests (analysis-guest)
 just test-all      # Run both
 ```
 

.github/workflows/pr-validate.yml

@@ -36,14 +36,11 @@ jobs:
       - name: Setup
         run: just setup
 
-      - name: Format check
-        run: npm run fmt:check
+      - name: Lint (TS + Rust)
+        run: just lint-all
 
-      - name: Typecheck
-        run: npm run typecheck
-
-      - name: Test
-        run: just test
+      - name: Test (TS + Rust)
+        run: just test-all
 
   # Build and test on all hypervisor configurations (1ES runners have Rust + just)
   # NOTE: Windows WHP support is temporarily disabled pending upstream

CLAUDE.md

@@ -42,20 +42,20 @@ just start         # Run agent (tsx src/agent/index.ts)
 
 # ── Testing ──
 just test          # Run TypeScript tests
-just test-rust     # Run Rust tests (analysis-guest)
-just test-all      # Run all tests (TS + Rust)
+just test-analysis-guest  # Run Rust tests (analysis-guest)
+just test-all            # Run all tests (TS + Rust)
 
 # ── Formatting ──
-just fmt           # Format TypeScript/JavaScript
-just fmt-rust      # Format Rust (analysis-guest)
-just fmt-runtime   # Format Rust (sandbox/runtime)
-just fmt-all       # Format all code
+just fmt                 # Format TypeScript/JavaScript
+just fmt-analysis-guest  # Format Rust (analysis-guest)
+just fmt-runtime         # Format Rust (sandbox/runtime)
+just fmt-all             # Format all code
 
 # ── Linting ──
-just lint          # TypeScript: fmt-check + typecheck
-just lint-rust     # Rust: clippy + fmt-check (analysis-guest)
-just lint-runtime  # Rust: clippy + fmt-check (runtime)
-just lint-all      # All lints
+just lint                # TypeScript: fmt-check + typecheck
+just lint-analysis-guest # Rust: clippy + fmt-check (analysis-guest)
+just lint-runtime        # Rust: clippy + fmt-check (runtime)
+just lint-all            # All lints
 
 # ── Quality Gate ──
 just check         # Full quality gate: lint-all + test-all

Justfile

@@ -171,17 +171,17 @@ lint: fmt-check typecheck
     @echo "✅ Lint passed — looking sharp"
 
 # Lint Rust code in analysis-guest
-lint-rust:
+lint-analysis-guest:
     cd "{{analysis-guest-dir}}" && cargo fmt --check && cargo clippy --workspace -- -D warnings
-    @echo "✅ Rust lint passed"
+    @echo "✅ Analysis-guest lint passed"
 
 # Format Rust code in analysis-guest
-fmt-rust:
+fmt-analysis-guest:
     cd "{{analysis-guest-dir}}" && cargo fmt
 
 # Test Rust code in analysis-guest
 # Note: --test-threads=1 required because QuickJS context isn't thread-safe
-test-rust:
+test-analysis-guest:
     cd "{{analysis-guest-dir}}" && cargo test --workspace -- --test-threads=1
 
 # ── HyperAgent Runtime (native modules) ──────────────────────────────
@@ -210,15 +210,15 @@ fmt-runtime:
     cd "{{runtime-dir}}" && cargo +1.89 fmt --all
 
 # Full lint: TypeScript + Rust (analysis-guest + runtime)
-lint-all: lint lint-rust lint-runtime
+lint-all: lint lint-analysis-guest lint-runtime
     @echo "✅ All lints passed"
 
 # Full format: TypeScript + Rust
-fmt-all: fmt fmt-rust fmt-runtime
+fmt-all: fmt fmt-analysis-guest fmt-runtime
     @echo "✅ All code formatted"
 
 # Full test: TypeScript + Rust
-test-all: test test-rust
+test-all: test test-analysis-guest
     @echo "✅ All tests passed"
 
 # ── OOXML Validation ─────────────────────────────────────────────────

docs/DEVELOPMENT.md

@@ -160,7 +160,7 @@ npm test -- tests/plugin-manager.test.ts
 npm test -- --coverage
 
 # Rust tests only
-just test-rust               # Tests analysis-guest
+just test-analysis-guest      # Tests analysis-guest
 
 # All tests (TS + Rust)
 just test-all
@@ -187,10 +187,10 @@ just fmt           # Format TS/JS
 just lint          # Check format + typecheck
 
 # Rust only
-just fmt-rust      # Format analysis-guest Rust
-just lint-rust     # Clippy + format check for analysis-guest
-just fmt-runtime   # Format runtime Rust
-just lint-runtime  # Clippy + format check for runtime
+just fmt-analysis-guest  # Format analysis-guest Rust
+just lint-analysis-guest # Clippy + format check for analysis-guest
+just fmt-runtime         # Format runtime Rust
+just lint-runtime        # Clippy + format check for runtime
 
 # Everything (TS + Rust)
 just fmt-all       # Format all code

src/code-validator/guest/README.md

@@ -163,7 +163,7 @@ Analyze a library tarball for security issues.
 just test
 
 # Rust tests only
-just test-rust
+just test-analysis-guest
 
 # Node.js tests only
 just test-node

src/code-validator/guest/host/src/runtime.rs

@@ -94,13 +94,12 @@ pub(crate) fn get_analysis_runtime() -> Option<Handle> {
 ///
 /// After calling this, `get_analysis_runtime()` will return `None`.
 pub(crate) fn shutdown_runtime() {
-    if let Some(mutex) = ANALYSIS_RUNTIME.get() {
-        if let Ok(mut guard) = mutex.lock() {
-            if let Some(rt) = guard.take() {
-                eprintln!("[hyperlight-analysis] Shutting down runtime...");
-                rt.shutdown_timeout(SHUTDOWN_TIMEOUT);
-                eprintln!("[hyperlight-analysis] Runtime shutdown complete");
-            }
-        }
+    if let Some(mutex) = ANALYSIS_RUNTIME.get()
+        && let Ok(mut guard) = mutex.lock()
+        && let Some(rt) = guard.take()
+    {
+        eprintln!("[hyperlight-analysis] Shutting down runtime...");
+        rt.shutdown_timeout(SHUTDOWN_TIMEOUT);
+        eprintln!("[hyperlight-analysis] Runtime shutdown complete");
     }
 }

src/code-validator/guest/host/src/sandbox.rs

@@ -36,8 +36,8 @@ use hyperlight_host::sandbox::uninitialized::GuestBinary;
 use hyperlight_host::{MultiUseSandbox, UninitializedSandbox};
 use napi::bindgen_prelude::*;
 
-use crate::runtime::get_analysis_runtime;
 use crate::ANALYSIS_RUNTIME;
+use crate::runtime::get_analysis_runtime;
 
 /// Heap size for the guest (16 MB).
 const GUEST_HEAP_SIZE: u64 = 16 * 1024 * 1024;
@@ -76,12 +76,8 @@ const GUEST_OUTPUT_SIZE: usize = 4 * 1024 * 1024;
 pub async fn call_guest_function(function_name: &str, input: String) -> Result<String> {
     let function_name = function_name.to_string();
 
-    let handle = get_analysis_runtime().ok_or_else(|| {
-        Error::new(
-            Status::GenericFailure,
-            "Analysis runtime not available",
-        )
-    })?;
+    let handle = get_analysis_runtime()
+        .ok_or_else(|| Error::new(Status::GenericFailure, "Analysis runtime not available"))?;
 
     // Run the blocking Hyperlight operations on the runtime's thread pool
     handle
@@ -101,12 +97,8 @@ pub async fn call_guest_function_2(
 ) -> Result<String> {
     let function_name = function_name.to_string();
 
-    let handle = get_analysis_runtime().ok_or_else(|| {
-        Error::new(
-            Status::GenericFailure,
-            "Analysis runtime not available",
-        )
-    })?;
+    let handle = get_analysis_runtime()
+        .ok_or_else(|| Error::new(Status::GenericFailure, "Analysis runtime not available"))?;
 
     // Run the blocking Hyperlight operations on the runtime's thread pool
     handle