fix(aprz): drop directories and humantime-serde dependencies

[Evgenii (Vaiz)]

🤖 Clawpilot here! Posted automatically by Clawpilot (an AI agent), not by a human. Please verify before acting.

Fixes AB#7829436.

Problem

The scheduled anvil-aprz gate has been red on main for eight consecutive runs (run 33601935927):

ERROR: 3 crates were appraised as high risk and caused rejection:
- directories v6.0.0
  - FAILED: Maintained Crate
- humantime v2.4.0
  - FAILED: Maintained Crate
- option-ext v0.2.0
  - FAILED: Allowed License

All three enter through cargo-aprz-lib: directories and humantime-serde are direct workspace dependencies, and option-ext (MPL-2.0) is transitive via directories.

Why not just wait for a tool release

Both advisories are withdrawn upstream — RUSTSEC-2020-0054 on 2021-04-19 and RUSTSEC-2025-0014 on 2025-03-12 — so the released cargo-aprz 1.1.0 that the gate installs is acting on retracted data. The in-repo source already ignores withdrawn advisories and already allows MPL-2.0, but that is unreleased, and justfiles/anvil/versions.just pins cargo_aprz_version := "1.1.0".

Rather than block the gate on a tool release, this removes the dependencies. Each was used for one small thing, so the work item's guardrail against allow_list/cargo-deny/baseline suppression is respected: the crates are gone from the graph, not excused.

Changes

• commands::cache_dir replaces directories::BaseDirs::cache_dir(), the crate's only use of directories. It reads LOCALAPPDATA on Windows, HOME/Library/Caches on macOS, and XDG_CACHE_HOME (absolute only, per the XDG specification) falling back to HOME/.cache elsewhere. An empty variable counts as unset.
• commands::duration replaces humantime-serde, used by the five *_cache_ttl fields. It reads and writes the same <amount><unit> grammar, so existing configuration files (crates_cache_ttl = "1 week") keep working, including the m minutes / M months case distinction. Its rejection message now names the offending value, which is the one visible behaviour change — see the updated snapshot.

Dropping directories also drops the MPL-2.0 option-ext, matching the precedent set by #120 (MPL-2.0 vlen replaced with 0BSD vu128).

Cargo.lock loses directories, dirs-sys, option-ext, humantime and humantime-serde.

Effects

• The three rejected crates leave the dependency graph, so anvil-aprz no longer sees them regardless of which cargo-aprz version is pinned.
• Two fewer direct dependencies, five fewer resolved crates.
• Windows cache discovery now reads %LOCALAPPDATA% from the environment instead of the known-folder API. In practice these agree; an environment that clears the variable now falls back to an explicit --cache-dir instead of the known-folder value.
• A duration string that is rejected produces a different message than before.
• Month and year remain averages (30.44 and 365.25 days), unchanged from the previous grammar.

Validation

• just anvil-clippy — clean
• just test — cargo-aprz-lib fully green (831 unit + all integration tests). Four cargo-gamma-lib failures reproduce independently of this change; they assert an unconfigured cargo environment and fail on this machine because of a global ~/.cargo/config.toml.
• just format, just anvil-cargo-sort, just spellcheck — clean (serializer and XDG added to .spelling)
• cargo doc — clean

Per AGENTS.md, CHANGELOG.md is not edited by hand.

[Copilot]

🟡 Changes recommended

A newly-updated unit test relies on the host environment having cache-dir variables set, which can make CI runs flaky in sanitized environments.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR updates cargo-aprz-lib to remove the directories and humantime-serde dependencies by replacing them with small in-crate implementations for platform cache-dir discovery and human-readable duration (de)serialization, aiming to unblock the anvil-aprz gate by eliminating the flagged crates from the dependency graph.

Changes:

• Replace directories::BaseDirs usage with a new commands::cache_dir module that resolves the platform cache directory via environment variables.
• Replace humantime-serde with a new commands::duration module providing a compatible <amount><unit> duration grammar and improved error messages.
• Remove the corresponding dependencies from Cargo.toml/Cargo.lock and update snapshots/spellings accordingly.

File summaries

File	Description
crates/cargo-aprz-lib/src/commands/snapshots/cargo_aprz_lib__commands__validate__tests__invalid_duration_format.snap	Updates snapshot to match the new duration parsing error message.
crates/cargo-aprz-lib/src/commands/mod.rs	Registers new cache_dir and duration modules.
crates/cargo-aprz-lib/src/commands/duration.rs	Adds custom Serde duration parsing/formatting to replace humantime-serde.
crates/cargo-aprz-lib/src/commands/config.rs	Switches duration fields to use #[serde(with = "super::duration")].
crates/cargo-aprz-lib/src/commands/common.rs	Uses platform_cache_dir() for default cache-dir resolution and updates related tests.
crates/cargo-aprz-lib/src/commands/cache_dir.rs	Adds platform cache-dir discovery implementation (env-based) to replace directories.
crates/cargo-aprz-lib/Cargo.toml	Drops directories and humantime-serde direct dependencies.
Cargo.toml	Removes workspace dependency entries for directories and humantime-serde.
Cargo.lock	Removes directories, humantime(-serde), and transitive dependencies from the lockfile.
.spelling	Adds serializer and XDG to spelling allow-list.

Review details

• Files reviewed: 9/10 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Codecov Comments Bot (codecov-commenter)]

Codecov Report

❌ Patch coverage is 99.62406% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 97.6%. Comparing base (a86a107) to head (4ff23ad).
⚠️ Report is 3 commits behind head on main.

Files with missing lines	Patch %	Lines
crates/cargo-aprz-lib/src/commands/common.rs	80.0%	1 Missing ⚠️

❌ Your project status has failed because the head coverage (97.6%) is below the target coverage (100.0%). You can increase the head coverage or adjust the target coverage.

Additional details and impacted files

@@           Coverage Diff           @@
##            main    #145     +/-   ##
=======================================
- Coverage   97.6%   97.6%   -0.1%     
=======================================
  Files        290     297      +7     
  Lines      65913   67008   +1095     
=======================================
+ Hits       64370   65423   +1053     
- Misses      1543    1585     +42     

Flag	Coverage Δ
linux	97.5% <99.6%> (?)
linux-arm	97.6% <99.6%> (?)
windows	97.7% <99.5%> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

🔵 Needs a closer look

The newly introduced cache-dir discovery failure message is not actionable enough for users in stripped/sandboxed environments where --cache-dir is required.

Review details

Suppressed comments (1)

Previously missed (1) — in code that hasn't changed since the last review.

crates/cargo-aprz-lib/src/commands/common.rs:311

• The error returned when no platform cache directory can be discovered is vague. Since platform_cache_dir() can legitimately return None in stripped/sandboxed environments, this message should tell the user how to fix it (e.g., pass --cache-dir or set the relevant environment variables).

• Files reviewed: 9/10 changed files
• Comments generated: 0 new
• Review effort level: Lite