docs: add CodeRabbit badge to README

.github/dependabot.yml

@@ -14,8 +14,6 @@ updates:
           - "*"
     commit-message:
       prefix: "chore(deps)"
-    cooldown:
-      default-days: 7
 
   # Maintain GitHub Actions workflows
   - package-ecosystem: "github-actions"
@@ -30,5 +28,3 @@ updates:
           - "*"
     commit-message:
       prefix: "ci(deps)"
-    cooldown:
-      default-days: 7

.github/workflows/artcraft-linux-publish.yml

@@ -13,13 +13,7 @@ jobs:
     runs-on: ubuntu-22.04
     timeout-minutes: 10
     steps:
-      - name: Harden runner
-        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
-        with:
-          egress-policy: audit
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@v7
       - uses: storytold/craft-common-actions/actions/install-apt-packages@main
         with:
           packages: rpm jq binutils zsync
@@ -40,13 +34,7 @@ jobs:
       TAURI_FRONTEND_PATH: ${{ github.workspace }}/frontend
       TAURI_APP_PATH: ${{ github.workspace }}/crates/desktop/artcraft
     steps:
-      - name: Harden runner
-        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
-        with:
-          egress-policy: audit
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@v7
       - uses: storytold/craft-common-actions/actions/install-apt-packages@main
         with:
           packages: libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libssl-dev libclang-dev libasound2-dev libxdo-dev libdbus-1-dev build-essential clang file jq perl cmake nasm rpm zsync gstreamer1.0-plugins-base gstreamer1.0-plugins-good gstreamer1.0-libav
@@ -75,7 +63,7 @@ jobs:
           PKG_CONFIG_LIBDIR_riscv64gc_unknown_linux_gnu=/usr/lib/riscv64-linux-gnu/pkgconfig:/usr/share/pkgconfig
           ENV
           echo "CMAKE_TOOLCHAIN_FILE_riscv64gc_unknown_linux_gnu=$GITHUB_WORKSPACE/packaging/linux/riscv64.cmake" >> "$GITHUB_ENV"
-      - uses: actions/setup-node@0a44ba7841725637a54e2801669c06500c541b61 # v7.0.0
+      - uses: actions/setup-node@v7
         with:
           node-version: '22'
           cache: npm
@@ -92,7 +80,7 @@ jobs:
         working-directory: frontend
       - run: ./node_modules/.bin/nx run artcraft:build
         working-directory: frontend
-      - uses: tauri-apps/tauri-action@fce9c6108b31ea247710505d3aaaa893ee6768d4 # v0.5.18
+      - uses: tauri-apps/tauri-action@fce9c6108b31ea247710505d3aaaa893ee6768d4 # v0
         with:
           projectPath: crates/desktop/artcraft
           args: --target ${{ matrix.target }} --bundles ${{ matrix.bundles }} --config ${{ github.workspace }}/packaging/linux/tauri.conf.json
@@ -101,7 +89,7 @@ jobs:
           ARCH: ${{ matrix.arch }}
           TARGET: ${{ matrix.target }}
         run: packaging/linux/package.sh "$ARCH" "$TARGET"
-      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+      - uses: actions/upload-artifact@v7
         with:
           name: release-linux-${{ matrix.arch }}
           path: dist/release/*
@@ -114,14 +102,8 @@ jobs:
       matrix:
         arch: [x86_64, aarch64]
     steps:
-      - name: Harden runner
-        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
-        with:
-          egress-policy: audit
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+      - uses: actions/checkout@v7
+      - uses: actions/download-artifact@v8
         with:
           name: release-linux-${{ matrix.arch }}
           path: dist/linux
@@ -144,7 +126,7 @@ jobs:
           for package in dist/release/*.pkg.tar.zst; do
             tar --zstd -xOf "$package" .PKGINFO | grep -Fx 'depend = webkit2gtk-4.1'
           done
-      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+      - uses: actions/upload-artifact@v7
         with:
           name: release-arch-${{ matrix.arch }}
           path: dist/release/*.pkg.tar.zst
@@ -163,14 +145,8 @@ jobs:
           - {arch: x86_64, runner: ubuntu-24.04}
           - {arch: aarch64, runner: ubuntu-24.04-arm}
     steps:
-      - name: Harden runner
-        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
-        with:
-          egress-policy: audit
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+      - uses: actions/checkout@v7
+      - uses: actions/download-artifact@v8
         with:
           name: release-linux-${{ matrix.arch }}
           path: dist/linux
@@ -188,7 +164,7 @@ jobs:
           DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
           DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
         run: packaging/linux/flatpak.sh
-      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+      - uses: actions/upload-artifact@v7
         with:
           name: release-flatpak-${{ matrix.arch }}
           path: |
@@ -201,13 +177,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - name: Harden runner
-        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
-        with:
-          egress-policy: audit
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@v7
       - name: Read version
         id: version
         run: echo "value=$(jq -r .version crates/desktop/artcraft/tauri.conf.json)" >> "$GITHUB_OUTPUT"

.github/workflows/artcraft-macos-publish.yml

@@ -10,13 +10,6 @@ on:
 # This workflow creates Universal macOS builds with signing certificate support.
 # On each push to the release branches it will create or update a GitHub release, build your app, and upload the artifacts to the release.
 
-# One release build per branch at a time. A run in progress is never cancelled, because it may
-# already have created or uploaded to the draft release. If more pushes arrive while one runs,
-# GitHub keeps only the newest as pending, so the next build is of the latest commit.
-concurrency:
-  group: macos-release-${{ github.ref }}
-  cancel-in-progress: false
-
 jobs:
   publish-artcraft:
     permissions:
@@ -35,27 +28,17 @@ jobs:
           #   args: ''
 
     runs-on: ${{ matrix.platform }}
-    # Successful builds took 10-22 min (2026-04 to 2026-11).
-    timeout-minutes: 60
     steps:
-      - name: Harden runner
-        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
-        with:
-          egress-policy: audit
-
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@v7
 
       - name: setup node
-        uses: actions/setup-node@0a44ba7841725637a54e2801669c06500c541b61 # v7.0.0
+        uses: actions/setup-node@v7
         with:
           node-version: lts/*
 
       - name: install Rust stable
-        uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1
+        uses: dtolnay/rust-toolchain@stable
         with:
-          toolchain: stable
           targets: ${{ matrix.platform == 'macos-latest-xlarge' && 'aarch64-apple-darwin,x86_64-apple-darwin' || '' }}
 
       - name: install dependencies (ubuntu only)
@@ -234,7 +217,7 @@ jobs:
 
 
       - name: build and publish
-        uses: tauri-apps/tauri-action@fce9c6108b31ea247710505d3aaaa893ee6768d4 # v0.5.18
+        uses: tauri-apps/tauri-action@v0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           APPLE_ID: ${{ secrets.APPLE_ID }}

.github/workflows/artcraft-windows-publish.yml

@@ -10,13 +10,6 @@ on:
 # This workflow creates Windows builds.
 # On each push to the release branches it will create or update a GitHub release, build your app, and upload the artifacts to the release.
 
-# One release build per branch at a time. A run in progress is never cancelled, because it may
-# already have created or uploaded to the draft release. If more pushes arrive while one runs,
-# GitHub keeps only the newest as pending, so the next build is of the latest commit.
-concurrency:
-  group: windows-release-${{ github.ref }}
-  cancel-in-progress: false
-
 jobs:
   publish-artcraft-windows:
     permissions:
@@ -30,22 +23,11 @@ jobs:
             args: ''
 
     runs-on: ${{ matrix.platform }}
-    # Successful builds took 17-36 min (2026-04 to 2026-11); one hung run used the full 6-hour default.
-    timeout-minutes: 90
     steps:
-      - name: Harden runner
-        uses: step-security/harden-runner@1d88384fd173af6ecb012dfd0264a306b711241a # v2.22.4
-        with:
-          egress-policy: audit
-
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@v7
 
       - name: install Rust stable
-        uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1
-        with:
-          toolchain: stable
+        uses: dtolnay/rust-toolchain@stable
 
       - name: install wreq dependencies
         run: |
@@ -57,7 +39,7 @@ jobs:
         shell: cmd
 
       - name: setup node
-        uses: actions/setup-node@0a44ba7841725637a54e2801669c06500c541b61 # v7.0.0
+        uses: actions/setup-node@v7
         with:
           node-version: lts/*
 
@@ -110,7 +92,7 @@ jobs:
           $config | ConvertTo-Json -Depth 10 | Set-Content tauri.conf.json
 
       - name: build and publish
-        uses: tauri-apps/tauri-action@fce9c6108b31ea247710505d3aaaa893ee6768d4 # v0.5.18
+        uses: tauri-apps/tauri-action@v0
         env:
           # NB(bt): This is needed by wreq. Hopefully it doesn't kill Tauri
           RUSTFLAGS: "-C target-feature=+crt-static"

crates/api_clients/artcraft/artcraft_client/Cargo.toml

@@ -33,7 +33,6 @@ chrono.workspace = true
 cookie.workspace = true
 log.workspace = true
 reqwest = { workspace = true, features = ["multipart", "gzip"] }
-tokio = { workspace = true, features = ["fs"] }
 url.workspace = true
 
 # Serialization

crates/api_clients/artcraft/artcraft_client/src/endpoints/media_files/legacy_upload_media_file_from_file.rs

@@ -60,7 +60,7 @@ pub async fn legacy_upload_media_file_from_file<P: AsRef<Path>>(
       .build()
       .map_err(|err| StorytellerError::Client(ClientError::from(err)))?;
 
-  let file_bytes = tokio::fs::read(args.path.as_ref()).await
+  let file_bytes = std::fs::read(args.path.as_ref())
       .map_err(|err| StorytellerError::Client(ClientError::from(err)))?;
   let file_name = args.path.as_ref().file_name()
       .and_then(|n| n.to_str()).unwrap_or("file").to_string();

crates/api_clients/artcraft/artcraft_client/src/endpoints/media_files/upload_image_media_file_from_file.rs

@@ -69,7 +69,7 @@ pub async fn upload_image_media_file_from_file_with_idempotency_token<P: AsRef<P
       .build()
       .map_err(|err| StorytellerError::Client(ClientError::from(err)))?;
 
-  let file_bytes = tokio::fs::read(args.path.as_ref()).await
+  let file_bytes = std::fs::read(args.path.as_ref())
       .map_err(|err| StorytellerError::Client(ClientError::from(err)))?;
   let file_name = args.path.as_ref().file_name()
       .and_then(|n| n.to_str()).unwrap_or("file").to_string();

crates/api_clients/artcraft/artcraft_client/src/endpoints/media_files/upload_new_engine_asset_from_file.rs

@@ -35,7 +35,7 @@ pub async fn upload_new_engine_asset_from_file<P: AsRef<Path>>(
   let client = storyteller_client_builder(api_host)
       .build()?;
 
-  let file_bytes = tokio::fs::read(path.as_ref()).await?;
+  let file_bytes = std::fs::read(path.as_ref())?;
   let file_name = path.as_ref().file_name()
       .and_then(|n| n.to_str()).unwrap_or("file").to_string();
   let mut form = Form::new()

crates/api_clients/artcraft/artcraft_client/src/endpoints/media_files/upload_video_media_file_from_file.rs

@@ -61,7 +61,7 @@ pub async fn upload_video_media_file_from_file<P: AsRef<Path>>(
   let client = storyteller_client_builder(args.api_host)
       .build()?;
 
-  let file_bytes = tokio::fs::read(args.path.as_ref()).await?;
+  let file_bytes = std::fs::read(args.path.as_ref())?;
   let file_name = args.path.as_ref().file_name()
       .and_then(|n| n.to_str()).unwrap_or("file").to_string();
   let mut form = Form::new()

crates/api_clients/artcraft/artcraft_client/src/recipes/download_media_file.rs

@@ -1,3 +1,5 @@
+use std::fs;
+use std::io::Write;
 use std::path::{Path, PathBuf};
 
 use log::{info, warn};
@@ -66,7 +68,13 @@ pub async fn download_media_file<P: AsRef<Path>>(
   let bytes = download_bytes(cdn_url).await?;
 
   // 4. Write to disk.
-  tokio::fs::write(&output_path, &bytes).await
+  let mut file = fs::File::create(&output_path)
+    .map_err(|err| StorytellerError::Client(ClientError::IoError(err)))?;
+
+  file.write_all(&bytes)
+    .map_err(|err| StorytellerError::Client(ClientError::IoError(err)))?;
+
+  file.flush()
     .map_err(|err| StorytellerError::Client(ClientError::IoError(err)))?;
 
   info!("Downloaded {} bytes to {:?}", bytes.len(), output_path);

crates/api_clients/artcraft/artcraft_router/Cargo.toml

@@ -31,7 +31,7 @@ reqwest.workspace = true
 serde.workspace = true
 wreq.workspace = true
 serde_derive.workspace = true
-tokio = { workspace = true, features = ["fs"] }
+tokio.workspace = true
 uuid.workspace = true
 
 [dev-dependencies]

crates/api_clients/artcraft/artcraft_router/src/generate/generate_video/providers/kinovi/upload.rs

@@ -24,7 +24,7 @@ pub(crate) async fn upload_to_kinovi_web(
       .unwrap_or_else(|| "jpg".to_string());
 
   let file_bytes = match maybe_local_path {
-    Some(local_path) => match tokio::fs::read(local_path).await {
+    Some(local_path) => match std::fs::read(local_path) {
       Ok(bytes) => {
         info!("Reusing predownloaded file for kinovi upload: {}", source_url);
         bytes

crates/api_clients/midjourney_client/src/credentials/credential_manager.rs

@@ -93,7 +93,7 @@ impl MidjourneyCredentialManager {
     let _guard = self.mutation.lock().await;
     // Remove every format, so a later startup cannot migrate a logged-out account.
     for path in self.legacy_paths.iter().chain([&self.credential_path]) {
-      match tokio::fs::remove_file(path).await {
+      match std::fs::remove_file(path) {
         Ok(()) => {},
         Err(err) if err.kind() == std::io::ErrorKind::NotFound => {},
         Err(err) => return Err(err.into()),

crates/api_clients/openai_sora_client/src/requests/deprecated/job_status/sora_job_status.rs

@@ -11,7 +11,7 @@ use errors::AnyhowResult;
 use log::{debug, error, warn};
 use serde_derive::{Deserialize, Serialize};
 use std::fmt::{Debug, Display};
-use std::path::Path;
+use std::{fs::File, io::Write, path::Path};
 use url::Url;
 use wreq::Client;
 
@@ -271,7 +271,9 @@ pub async fn get_image_gen_status(status_request: &StatusRequest, credentials: &
 
 pub async fn save_generations_to_dir(generations: &[Generation], dir: &str) -> AnyhowResult<()> {
   let dir = Path::new(dir);
-  tokio::fs::create_dir_all(dir).await?;
+  if !dir.exists() {
+    std::fs::create_dir_all(dir)?;
+  }
   for generation in generations {
     let response = wreq::get(generation.url.clone()).send().await?;
     let image_bytes = response.bytes().await?;
@@ -280,13 +282,15 @@ pub async fn save_generations_to_dir(generations: &[Generation], dir: &str) -> A
     let ext = url.path().split(".").last().unwrap_or("png");
     let path = Path::new(dir).join(format!("{}.{}", generation.id, ext));
 
-    tokio::fs::write(path, &image_bytes).await?;
+    let mut file = File::create(path)?;
+    file.write_all(&image_bytes)?;
 
     let thumbnail_url = generation.encodings.thumbnail.path.clone();
     let thumbnail_response = wreq::get(thumbnail_url).send().await?;
     let thumbnail_bytes = thumbnail_response.bytes().await?;
     let thumbnail_path = Path::new(dir).join(format!("{}_thumbnail.{}", generation.id, ext));
-    tokio::fs::write(thumbnail_path, &thumbnail_bytes).await?;
+    let mut thumbnail_file = File::create(thumbnail_path)?;
+    thumbnail_file.write_all(&thumbnail_bytes)?;
   }
 
   Ok(())

crates/desktop/artcraft/src/services/midjourney/threads/upload_midjourney_batch.rs

@@ -119,7 +119,7 @@ pub(super) async fn upload_midjourney_batch(maybe_app_handle: Option<&AppHandle>
     }
   }
 
-  if let Err(err) = tokio::fs::remove_file(MidjourneyUploadCheckpoint::path(app_data_root, local_task)).await {
+  if let Err(err) = std::fs::remove_file(MidjourneyUploadCheckpoint::path(app_data_root, local_task)) {
     log::warn!("Could not remove completed Midjourney upload checkpoint: {}", err);
   }
   Ok(())

crates/desktop/artcraft/src/services/midjourney/utils/download_midjourney_image.rs

@@ -2,6 +2,8 @@ use crate::core::state::data_dir::app_data_root::AppDataRoot;
 use crate::core::state::data_dir::trait_data_subdir::DataSubdir;
 use errors::AnyhowResult;
 use midjourney_client::utils::get_image_url::get_image_url;
+use std::fs::File;
+use std::io::Write;
 use std::path::PathBuf;
 use url::Url;
 use midjourney_client::utils::image_downloader_client::ImageDownloaderClient;
@@ -26,7 +28,8 @@ pub async fn download_midjourney_image(
   let download_filename = format!("{}_{}.{}", job_id, index, ext);
   let download_path = tempdir.join(download_filename);
 
-  tokio::fs::write(&download_path, &image_bytes).await?;
+  let mut file = File::create(&download_path)?;
+  file.write_all(&image_bytes)?;
 
   Ok(download_path)
 }

crates/desktop/artcraft/src/services/sora/state/initialize_sora_jwt_bearer_token.rs

@@ -14,7 +14,7 @@ pub async fn initialize_sora_jwt_bearer_token(app_data_root: &AppDataRoot) -> An
     return Ok(()); // Bearer token already exists.
   }
 
-  let cookie = tokio::fs::read_to_string(app_data_root.get_sora_cookie_file_path()).await?
+  let cookie = std::fs::read_to_string(app_data_root.get_sora_cookie_file_path())?
       .trim()
       .to_string();
 
@@ -22,7 +22,7 @@ pub async fn initialize_sora_jwt_bearer_token(app_data_root: &AppDataRoot) -> An
 
   let bearer = generate_bearer_jwt_with_cookie(&cookie).await?;
 
-  tokio::fs::write(app_data_root.get_sora_bearer_token_file_path(), bearer).await?;
+  std::fs::write(app_data_root.get_sora_bearer_token_file_path(), bearer)?;
 
   Ok(())
 }

crates/desktop/artcraft/src/services/sora/state/read_sora_credentials_from_disk_with_upgrade.rs

@@ -8,7 +8,8 @@ use openai_sora_client::creds::sora_jwt_bearer_token::SoraJwtBearerToken;
 use openai_sora_client::creds::sora_sentinel::SoraSentinel;
 use openai_sora_client::creds::sora_sentinel_token::SoraSentinelToken;
 use openai_sora_client::recipes::maybe_upgrade_or_renew_session::maybe_upgrade_or_renew_session;
-use tokio::fs::{read_to_string, write};
+use std::fs::{read_to_string, OpenOptions};
+use std::io::Write;
 
 pub async fn read_sora_credentials_from_disk_with_upgrade(app_data_root: &AppDataRoot) -> AnyhowResult<SoraCredentialSet> {
   let cookie_file = app_data_root.get_sora_cookie_file_path();
@@ -20,7 +21,7 @@ pub async fn read_sora_credentials_from_disk_with_upgrade(app_data_root: &AppDat
     return Err(anyhow!("Cookie file does not exist: {:?}", cookie_file));
   }
 
-  let value = read_to_string(cookie_file).await?
+  let value = read_to_string(cookie_file)?
       .trim()
       .to_string();
 
@@ -31,14 +32,14 @@ pub async fn read_sora_credentials_from_disk_with_upgrade(app_data_root: &AppDat
   let mut sentinel_token = None;
 
   if bearer_file.exists() {
-    let value = read_to_string(&bearer_file).await?
+    let value = read_to_string(&bearer_file)?
         .trim()
         .to_string();
     bearer = Some(SoraJwtBearerToken::new(value)?);
   }
 
   if legacy_sentinel_file.exists() {
-    let value = read_to_string(&legacy_sentinel_file).await?
+    let value = read_to_string(&legacy_sentinel_file)?
         .trim()
         .to_string();
 
@@ -46,7 +47,7 @@ pub async fn read_sora_credentials_from_disk_with_upgrade(app_data_root: &AppDat
   }
 
   if sentinel_token_file.exists() {
-    let value = read_to_string(&sentinel_token_file).await?
+    let value = read_to_string(&sentinel_token_file)?
         .trim()
         .to_string();
 
@@ -72,7 +73,14 @@ pub async fn read_sora_credentials_from_disk_with_upgrade(app_data_root: &AppDat
       info!("Persisting bearer token value...");
       let value = bearer.token_str();
 
-      write(&bearer_file, value.as_bytes()).await?;
+      let mut file = OpenOptions::new()
+          .create(true)
+          .write(true)
+          .truncate(true)
+          .open(&bearer_file)?;
+
+      file.write_all(value.as_bytes())?;
+      file.flush()?;
     }
   }
 
@@ -81,7 +89,14 @@ pub async fn read_sora_credentials_from_disk_with_upgrade(app_data_root: &AppDat
       info!("Persisting sentinel value...");
       let value = sentinel.get_sentinel();
 
-      write(&legacy_sentinel_file, value.as_bytes()).await?;
+      let mut file = OpenOptions::new()
+          .create(true)
+          .write(true)
+          .truncate(true)
+          .open(&legacy_sentinel_file)?;
+
+      file.write_all(value.as_bytes())?;
+      file.flush()?;
     }
   }
   
@@ -90,7 +105,14 @@ pub async fn read_sora_credentials_from_disk_with_upgrade(app_data_root: &AppDat
       info!("Persisting sentinel token...");
       let value = sentinel_token.to_persistent_storage_json()?;
 
-      write(&sentinel_token_file, value.as_bytes()).await?;
+      let mut file = OpenOptions::new()
+          .create(true)
+          .write(true)
+          .truncate(true)
+          .open(&sentinel_token_file)?;
+
+      file.write_all(value.as_bytes())?;
+      file.flush()?;
     }
   }
 

crates/desktop/artcraft/src/services/sora/state/sora_credential_manager.rs

@@ -162,7 +162,14 @@ impl SoraCredentialManager {
 
     self.holder.set_credentials(&creds)?;
 
-    tokio::fs::write(self.app_data_root.get_sora_legacy_sentinel_file_path(), sentinel.as_bytes()).await?;
+    let mut file = OpenOptions::new()
+        .create(true)
+        .write(true)
+        .truncate(true)
+        .open(self.app_data_root.get_sora_legacy_sentinel_file_path())?;
+
+    file.write_all(sentinel.as_bytes())?;
+    file.flush()?;
 
     Ok(creds)
   }

crates/lib/url_utils/src/download_extension/download_extension.rs

@@ -1,3 +1,4 @@
+
 /// When downloading a remote file, it makes sense to try to match the same file extension (with reasonable safeguards).
 #[deprecated(note = "Use `Extension` in `url_utils::extension::extension` instead")]
 #[derive(Debug, Copy, Clone, Eq, PartialEq)]

crates/lib/url_utils/src/download_extension/extract_download_extension_from_url.rs

@@ -12,7 +12,9 @@ pub fn extract_download_extension_from_url_str(url: &str) -> Option<DownloadExte
 #[deprecated(note = "Use `extract_extension_from_url` in `url_utils::extension::extract_extension_from_url` instead")]
 pub fn extract_download_extension_from_url(url: &Url) -> Option<DownloadExtension> {
   let path = url.path();
-  let extension = std::path::Path::new(path).extension().and_then(|ext| ext.to_str())?;
+  let extension = std::path::Path::new(path)
+      .extension()
+      .and_then(|ext| ext.to_str())?;
   DownloadExtension::try_from_str(extension)
 }
 
@@ -24,14 +26,14 @@ mod tests {
   #[test]
   fn success_case() {
     let url = "https://storyteller.ai/example.jpg";
-    let maybe_extension = extract_download_extension_from_url_str(url);
+    let maybe_extension= extract_download_extension_from_url_str(url);
     assert_eq!(maybe_extension, Some(DownloadExtension::Jpg));
   }
 
   #[test]
   fn difficult_url() {
     let url = "https://videos.youtube.com/foo/bar/files/00000000-f19a-1275-a092-caa60b38f8d2%2Fraw?se=2025-11-21T22%3A26%3A53Z&sp=r&sv=2024-08-09&sr=b&skoid=8cfff87a-01fc-27c1-9091-32999dcd1389&sktid=aa8ccaf6-e6da-484e-ab11-9c7496c21c53&skt=2025-11-17T21%3A09%3A08Z&ske=2025-10-23T21%3A14%3A08Z&sks=b&skv=2024-08-04&sig=T2U6%2Brw9WJdJagBkCL4/GlFr72KhZGP3QPlobIO7JlU%3D&ac=oaisdsorprnorthcentralus";
-    let maybe_extension = extract_download_extension_from_url_str(url);
+    let maybe_extension= extract_download_extension_from_url_str(url);
     assert!(maybe_extension.is_none());
   }
 }

crates/lib/url_utils/src/download_extension/mod.rs

@@ -1,4 +1,3 @@
-#[expect(clippy::module_inception, reason = "Preserve the existing public module path")]
 mod download_extension;
 pub mod extract_download_extension_from_url;
 

crates/lib/url_utils/src/extension/extension.rs

@@ -1,6 +1,5 @@
 use std::borrow::Cow;
 use std::fmt;
-use std::hash::{Hash, Hasher};
 
 /// A file extension that can be either a compile-time constant or a runtime-parsed value.
 ///
@@ -17,7 +16,7 @@ use std::hash::{Hash, Hasher};
 /// assert_eq!(ext.without_period(), "mp4");
 /// assert_eq!(ext.with_period(), ".mp4");
 /// ```
-#[derive(Clone, Eq)]
+#[derive(Clone, Eq, Hash)]
 pub struct Extension {
   /// The extension without the leading period, e.g. "png", "mp4".
   value: Cow<'static, str>,
@@ -35,14 +34,20 @@ impl Extension {
   /// const MP4: Extension = Extension::from_static("mp4", ".mp4");
   /// ```
   pub const fn from_static(ext: &'static str, dotted: &'static str) -> Self {
-    Self { value: Cow::Borrowed(ext), dotted: Cow::Borrowed(dotted) }
+    Self {
+      value: Cow::Borrowed(ext),
+      dotted: Cow::Borrowed(dotted),
+    }
   }
 
   /// Creates an `Extension` from a `&str` at runtime.
   /// The input must NOT include a leading period.
   pub fn new(ext: &str) -> Self {
-    let dotted = format!(".{ext}");
-    Self { value: Cow::Owned(ext.to_string()), dotted: Cow::Owned(dotted) }
+    let dotted = format!(".{}", ext);
+    Self {
+      value: Cow::Owned(ext.to_string()),
+      dotted: Cow::Owned(dotted),
+    }
   }
 
   /// Returns the extension without the leading period, e.g. `"png"`.
@@ -62,12 +67,6 @@ impl PartialEq for Extension {
   }
 }
 
-impl Hash for Extension {
-  fn hash<H: Hasher>(&self, state: &mut H) {
-    self.value.hash(state);
-  }
-}
-
 impl fmt::Debug for Extension {
   fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
     write!(f, "Extension(\"{}\")", self.value)
@@ -136,28 +135,12 @@ mod tests {
 
   #[test]
   fn display() {
-    assert_eq!(format!("{PNG}"), "png");
+    assert_eq!(format!("{}", PNG), "png");
     assert_eq!(format!("{}", Extension::new("xyz")), "xyz");
   }
 
   #[test]
   fn debug() {
-    assert_eq!(format!("{PNG:?}"), "Extension(\"png\")");
-  }
-
-  #[test]
-  fn hash_matches_equality() {
-    let plain = Extension::from_static("png", ".png");
-    let inconsistent = Extension::from_static("png", ".not-a-suffix");
-    assert_eq!(plain, inconsistent);
-    assert_eq!(hash(&plain), hash(&inconsistent));
-  }
-
-  fn hash(extension: &Extension) -> u64 {
-    use std::collections::hash_map::DefaultHasher;
-
-    let mut hasher = DefaultHasher::new();
-    extension.hash(&mut hasher);
-    hasher.finish()
+    assert_eq!(format!("{:?}", PNG), "Extension(\"png\")");
   }
 }

crates/lib/url_utils/src/extension/extract_extension_from_url.rs

@@ -6,13 +6,24 @@ use url::Url;
 // TODO: Lookups against these as lists will be slow
 
 /// Known image extensions.
-const KNOWN_IMAGE_EXTENSIONS: &[Extension] = &[Extension::from_static("png", ".png"), Extension::from_static("jpg", ".jpg"), Extension::from_static("jpeg", ".jpeg"), Extension::from_static("webp", ".webp")];
+const KNOWN_IMAGE_EXTENSIONS: &[Extension] = &[
+  Extension::from_static("png", ".png"),
+  Extension::from_static("jpg", ".jpg"),
+  Extension::from_static("jpeg", ".jpeg"),
+  Extension::from_static("webp", ".webp"),
+];
 
 /// Known audio extensions.
-const KNOWN_AUDIO_EXTENSIONS: &[Extension] = &[Extension::from_static("wav", ".wav"), Extension::from_static("mp3", ".mp3")];
+const KNOWN_AUDIO_EXTENSIONS: &[Extension] = &[
+  Extension::from_static("wav", ".wav"),
+  Extension::from_static("mp3", ".mp3"),
+];
 
 /// Known video extensions.
-const KNOWN_VIDEO_EXTENSIONS: &[Extension] = &[Extension::from_static("mp4", ".mp4"), Extension::from_static("webm", ".webm")];
+const KNOWN_VIDEO_EXTENSIONS: &[Extension] = &[
+  Extension::from_static("mp4", ".mp4"),
+  Extension::from_static("webm", ".webm"),
+];
 
 /// Controls which extensions are accepted when extracting from a URL.
 pub enum ExtractExtensions {
@@ -51,7 +62,9 @@ pub fn extract_extension_from_url_str(url: &str, accept: &ExtractExtensions) ->
 /// Extracts a file extension from a parsed `Url`, filtered by `accept`.
 pub fn extract_extension_from_url(url: &Url, accept: &ExtractExtensions) -> Option<Extension> {
   let path = url.path();
-  let raw_ext = std::path::Path::new(path).extension().and_then(|ext| ext.to_str())?;
+  let raw_ext = std::path::Path::new(path)
+    .extension()
+    .and_then(|ext| ext.to_str())?;
 
   let lower = raw_ext.to_lowercase();
   let candidate = Extension::new(&lower);
@@ -59,40 +72,27 @@ pub fn extract_extension_from_url(url: &Url, accept: &ExtractExtensions) -> Opti
   match accept {
     ExtractExtensions::All => Some(candidate),
     ExtractExtensions::Set(set) => {
-      if set.contains(&candidate) {
-        Some(candidate)
-      } else {
-        None
-      }
-    },
+      if set.contains(&candidate) { Some(candidate) } else { None }
+    }
     ExtractExtensions::KnownImage => {
-      if slice_contains(KNOWN_IMAGE_EXTENSIONS, &candidate) {
-        Some(candidate)
-      } else {
-        None
-      }
-    },
+      if slice_contains(KNOWN_IMAGE_EXTENSIONS, &candidate) { Some(candidate) } else { None }
+    }
     ExtractExtensions::KnownAudio => {
-      if slice_contains(KNOWN_AUDIO_EXTENSIONS, &candidate) {
-        Some(candidate)
-      } else {
-        None
-      }
-    },
+      if slice_contains(KNOWN_AUDIO_EXTENSIONS, &candidate) { Some(candidate) } else { None }
+    }
     ExtractExtensions::KnownVideo => {
-      if slice_contains(KNOWN_VIDEO_EXTENSIONS, &candidate) {
-        Some(candidate)
-      } else {
-        None
-      }
-    },
+      if slice_contains(KNOWN_VIDEO_EXTENSIONS, &candidate) { Some(candidate) } else { None }
+    }
     ExtractExtensions::KnownMedia => {
-      if slice_contains(KNOWN_IMAGE_EXTENSIONS, &candidate) || slice_contains(KNOWN_AUDIO_EXTENSIONS, &candidate) || slice_contains(KNOWN_VIDEO_EXTENSIONS, &candidate) {
+      if slice_contains(KNOWN_IMAGE_EXTENSIONS, &candidate)
+        || slice_contains(KNOWN_AUDIO_EXTENSIONS, &candidate)
+        || slice_contains(KNOWN_VIDEO_EXTENSIONS, &candidate)
+      {
         Some(candidate)
       } else {
         None
       }
-    },
+    }
   }
 }
 
@@ -190,14 +190,19 @@ mod tests {
 
   #[test]
   fn set_matches_custom_list() {
-    let accept = ExtractExtensions::from_vec(vec![Extension::from_static("csv", ".csv"), Extension::from_static("tsv", ".tsv")]);
+    let accept = ExtractExtensions::from_vec(vec![
+      Extension::from_static("csv", ".csv"),
+      Extension::from_static("tsv", ".tsv"),
+    ]);
     let ext = extract_extension_from_url_str("https://example.com/data.csv", &accept);
     assert_eq!(ext.unwrap().without_period(), "csv");
   }
 
   #[test]
   fn set_rejects_non_member() {
-    let accept = ExtractExtensions::from_vec(vec![Extension::from_static("csv", ".csv")]);
+    let accept = ExtractExtensions::from_vec(vec![
+      Extension::from_static("csv", ".csv"),
+    ]);
     let ext = extract_extension_from_url_str("https://example.com/data.png", &accept);
     assert!(ext.is_none());
   }
@@ -210,7 +215,10 @@ mod tests {
 
   #[test]
   fn query_params_ignored() {
-    let ext = extract_extension_from_url_str("https://example.com/file.mp4?token=abc&format=hd", &ExtractExtensions::KnownVideo);
+    let ext = extract_extension_from_url_str(
+      "https://example.com/file.mp4?token=abc&format=hd",
+      &ExtractExtensions::KnownVideo,
+    );
     assert_eq!(ext.unwrap().without_period(), "mp4");
   }
 
@@ -222,7 +230,8 @@ mod tests {
   }
 
   fn extract_extension_all(url: &str) -> Option<String> {
-    extract_extension_from_url_str(url, &ExtractExtensions::All).map(|ext| ext.without_period().to_string())
+    extract_extension_from_url_str(url, &ExtractExtensions::All)
+        .map(|ext| ext.without_period().to_string())
   }
 
   #[test]

crates/lib/url_utils/src/extension/mod.rs

@@ -1,3 +1,2 @@
-#[expect(clippy::module_inception, reason = "Preserve the existing public module path")]
 pub mod extension;
-pub mod extract_extension_from_url;
+pub mod extract_extension_from_url;

crates/lib/url_utils/src/lib.rs

@@ -1,3 +1,2 @@
 pub mod extension;
-#[expect(deprecated, reason = "Keep the public compatibility module while downstream users migrate to Extension")]
-pub mod download_extension;
+pub mod download_extension;