chore: remove dead code and clear all clippy warnings (#268)

Removed genuinely dead code:
- `InfoTable.connection` — populated but never read; dropped the field and its
  two construction sites.
- `LoadManagedTableResponse.{connection_id, arrow_schema_json}` — deserialize-only
  fields never read.
- `ConnectorEntry.file_format` — deserialize-only field never read.
- `raw_http::TOKEN_REDACT_KEYS` — a dead duplicate of `jwt`'s live copy, used
  only by its own tautological test (removed both).

Tightened suppressions:
- Dropped two over-broad module-level `#![allow(dead_code)]` (raw_http, ingest)
  now that the modules are clean.
- `IndexScope::delete_path` was `#[cfg_attr(not(test), allow(dead_code))]` — dead
  in production but shipped in the binary. Gated with `#[cfg(test)]` so it stays
  a path-shape regression guard without shipping.

Cleared every clippy warning (0 across all targets):
- Rewrote two `match … => false / _ => true` into `!matches!(…)` (skill).
- Collapsed a nested `if let` into a let-chain (test helper).
- Moved a mid-file `#[cfg(test)] mod tests` to the end (jobs).
- Documented `#[allow]`s for the unavoidable ones: `large_enum_variant` on the
  two clap subcommand enums, `too_many_arguments` on an internal auth helper.

Verified: 0 compiler warnings and 0 clippy warnings across all targets, fmt
clean, tests pass, no unused dependencies. Net -23 lines.

Co-authored-by: Eddie A Tejeda <669988+eddietejeda@users.noreply.github.com>

Author: eddietejeda

src/cli.rs

@@ -8,6 +8,9 @@ use crate::commands::skill::SkillCommands;
 use crate::commands::workspace::WorkspaceCommands;
 use clap::Subcommand;
 
+// Variant sizes differ, but a clap command tree is parsed once per invocation
+// and boxing subcommand variants would complicate the derive and match arms.
+#[allow(clippy::large_enum_variant)]
 #[derive(Subcommand)]
 pub enum Commands {
     /// Authenticate or manage auth settings

src/client/ingest.rs

@@ -32,7 +32,6 @@
 //!
 //! The result-reading endpoints are intentionally absent — once a run lands,
 //! that path is the core `query`/`databases`/`results` commands.
-#![allow(dead_code)] // Response structs are read only through serde/printing.
 
 use crate::client::jwt;
 use crate::config;
@@ -967,9 +966,6 @@ pub struct ConnectorEntry {
     /// Kafka entries: `kafka` or `debezium`.
     #[serde(default)]
     pub connector_type: Option<String>,
-    /// Filesystem entries: the file format the entry is named for.
-    #[serde(default)]
-    pub file_format: Option<String>,
     /// Which keys belong in this entry's deliberately free-form config map.
     #[serde(default)]
     pub options_hint: Option<OptionsHint>,

src/client/raw_http.rs

@@ -14,8 +14,6 @@
 
 // Not every helper here is wired to a call site yet; the allow keeps the build
 // warning-free.
-#![allow(dead_code)]
-
 use std::time::Duration;
 
 /// Cap on any single (non-upload) HTTP request. Connection create + synchronous
@@ -29,9 +27,6 @@ const HTTP_REQUEST_TIMEOUT: Duration = Duration::from_secs(300);
 /// server-side.
 const TCP_KEEPALIVE_INTERVAL: Duration = Duration::from_secs(30);
 
-/// JSON keys whose values are redacted in debug request/response logging.
-pub const TOKEN_REDACT_KEYS: &[&str] = &["access_token", "refresh_token", "api_token", "code"];
-
 /// A timeout-bounded blocking client for ordinary raw requests (token mints,
 /// session mints, arbitrary GETs).
 pub fn build_http_client() -> reqwest::blocking::Client {
@@ -50,12 +45,4 @@ mod tests {
     fn http_client_builds() {
         let _ = build_http_client();
     }
-
-    #[test]
-    fn redact_keys_cover_token_fields() {
-        // Guards against silently dropping a sensitive key from debug logs.
-        assert!(TOKEN_REDACT_KEYS.contains(&"access_token"));
-        assert!(TOKEN_REDACT_KEYS.contains(&"refresh_token"));
-        assert!(TOKEN_REDACT_KEYS.contains(&"api_token"));
-    }
 }

src/commands/auth.rs

@@ -244,6 +244,7 @@ fn is_already_signed_in(profile_config: &config::ProfileConfig) -> bool {
 /// 3. Opens the browser and waits for the OAuth/registration callback.
 /// 4. Calls `exchange(code, code_verifier, port)` to mint a JWT session.
 /// 5. Saves the session, prints `success_print`, and displays the workspace.
+#[allow(clippy::too_many_arguments)]
 fn run_browser_auth(
     profile_config: &config::ProfileConfig,
     opening_msg: &str,

src/commands/databases.rs

@@ -395,8 +395,6 @@ struct DatabaseAttachment {
 
 #[derive(Deserialize)]
 struct InfoTable {
-    #[allow(dead_code)]
-    connection: String,
     schema: String,
     table: String,
     synced: bool,
@@ -426,13 +424,9 @@ struct CreateDatabaseResponse {
 
 #[derive(Deserialize)]
 struct LoadManagedTableResponse {
-    #[allow(dead_code)]
-    connection_id: String,
     schema_name: String,
     table_name: String,
     row_count: u64,
-    #[allow(dead_code)]
-    arrow_schema_json: String,
 }
 
 impl From<hotdata::models::DatabaseDetailResponse> for Database {
@@ -955,7 +949,6 @@ fn collect_tables(
             .tables
             .into_iter()
             .map(|t| InfoTable {
-                connection: t.connection,
                 schema: t.schema,
                 table: t.table,
                 synced: t.synced,
@@ -979,7 +972,6 @@ fn collect_tables(
         ))
         .unwrap_or_else(|e| e.exit());
         out.extend(resp.tables.into_iter().map(|t| InfoTable {
-            connection: t.connection,
             schema: t.schema,
             table: t.table,
             synced: t.synced,
@@ -2258,7 +2250,6 @@ mod tests {
         let rows = table_rows(
             "default",
             vec![InfoTable {
-                connection: "ignored".into(),
                 schema: "public".into(),
                 table: "orders".into(),
                 synced: true,

src/commands/indexes.rs

@@ -407,9 +407,10 @@ impl IndexScope<'_> {
         }
     }
 
-    // Retained for path-shape regression tests; delete now routes through the
-    // SDK `indexes()` handle by scope variant rather than a formatted path.
-    #[cfg_attr(not(test), allow(dead_code))]
+    // Retained only for path-shape regression tests; delete now routes through
+    // the SDK `indexes()` handle by scope variant rather than a formatted path.
+    // `#[cfg(test)]` keeps it as a test guard without shipping it in the binary.
+    #[cfg(test)]
     fn delete_path(&self, index_name: &str) -> String {
         match self {
             IndexScope::Connection {

src/commands/ingest.rs

@@ -71,6 +71,8 @@ use crate::util;
 /// Wire values for the ingest type; the CLI spells the first one `one-time`.
 const TYPES: [&str; 3] = ["one-time", "scheduled", "continuous"];
 
+// Parsed once per invocation; boxing clap variants isn't worth the churn.
+#[allow(clippy::large_enum_variant)]
 #[derive(clap::Subcommand)]
 pub enum IngestCommands {
     /// Create a load definition

src/commands/jobs.rs

@@ -138,37 +138,6 @@ pub fn get(job_id: &str, workspace_id: &str, format: &str) {
     }
 }
 
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use hotdata::models::ListJobsResponse;
-
-    // Regression for #160: a `managed_load` row must deserialize, not blow up
-    // the whole `jobs list` response. Proves SDK 0.6.0's JobType carries the
-    // variant the server emits for `databases load`.
-    #[test]
-    fn list_response_with_managed_load_deserializes() {
-        let body = r#"{
-            "jobs": [
-                {
-                    "id": "job_1",
-                    "job_type": "managed_load",
-                    "status": "succeeded",
-                    "attempts": 1,
-                    "created_at": "2026-06-18T06:00:00Z"
-                }
-            ]
-        }"#;
-        let resp: ListJobsResponse = serde_json::from_str(body).expect("managed_load must parse");
-        assert_eq!(resp.jobs[0].job_type, JobType::ManagedLoad);
-    }
-
-    #[test]
-    fn parse_job_type_accepts_managed_load() {
-        assert_eq!(parse_job_type("managed_load"), Some(JobType::ManagedLoad));
-    }
-}
-
 fn fetch_jobs(
     api: &Api,
     job_type: Option<&str>,
@@ -242,3 +211,34 @@ pub fn list(
         _ => unreachable!(),
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use hotdata::models::ListJobsResponse;
+
+    // Regression for #160: a `managed_load` row must deserialize, not blow up
+    // the whole `jobs list` response. Proves SDK 0.6.0's JobType carries the
+    // variant the server emits for `databases load`.
+    #[test]
+    fn list_response_with_managed_load_deserializes() {
+        let body = r#"{
+            "jobs": [
+                {
+                    "id": "job_1",
+                    "job_type": "managed_load",
+                    "status": "succeeded",
+                    "attempts": 1,
+                    "created_at": "2026-06-18T06:00:00Z"
+                }
+            ]
+        }"#;
+        let resp: ListJobsResponse = serde_json::from_str(body).expect("managed_load must parse");
+        assert_eq!(resp.jobs[0].job_type, JobType::ManagedLoad);
+    }
+
+    #[test]
+    fn parse_job_type_accepts_managed_load() {
+        assert_eq!(parse_job_type("managed_load"), Some(JobType::ManagedLoad));
+    }
+}

src/commands/skill.rs

@@ -146,10 +146,8 @@ pub fn maybe_auto_update_after_cli_upgrade() {
     }
 
     let current = Version::parse(CURRENT_VERSION).expect("invalid package version");
-    let needs_refresh = match read_installed_version() {
-        Some(v) if v >= current && all_skill_stores_present() => false,
-        _ => true,
-    };
+    let needs_refresh =
+        !matches!(read_installed_version(), Some(v) if v >= current && all_skill_stores_present());
     if !needs_refresh {
         clear_skill_auto_update_suppression();
         return;
@@ -170,10 +168,8 @@ pub fn maybe_auto_update_after_cli_upgrade() {
     let _symlinks = ensure_symlinks();
     remove_retired_skills_global();
 
-    let still_needed = match read_installed_version() {
-        Some(v) if v >= current && all_skill_stores_present() => false,
-        _ => true,
-    };
+    let still_needed =
+        !matches!(read_installed_version(), Some(v) if v >= current && all_skill_stores_present());
 
     if still_needed {
         suppress_skill_auto_update_for_this_cli();

tests/common/mod.rs

@@ -204,10 +204,10 @@ pub fn shared_database_id(cli: &Cli) -> String {
     let listing = cli.json(&["databases", "list", "-o", "json"]);
     if let Some(arr) = listing.as_array() {
         for db in arr {
-            if db.get("name").and_then(|v| v.as_str()) == Some(SHARED_DATABASE_NAME) {
-                if let Some(id) = db.get("id").and_then(|v| v.as_str()) {
-                    return id.to_string();
-                }
+            if db.get("name").and_then(|v| v.as_str()) == Some(SHARED_DATABASE_NAME)
+                && let Some(id) = db.get("id").and_then(|v| v.as_str())
+            {
+                return id.to_string();
             }
         }
     }