fix(exec): use i64::from() for seccomp syscall numbers to survive autofix

[jdx]

Summary

• The previous as i64 fix for armv7 seccomp build was reverted by autofix-ci because clippy on x86_64 flags it as an unnecessary cast (SYS_* is already i64 there)
• Uses i64::from(syscall) instead, which clippy won't flag and handles both i32 (armv7) and i64 (x86_64/aarch64)

Test plan

• Verify build-tarball-linux-armv7 CI job passes
• Verify clippy/autofix doesn't revert the change

🤖 Generated with Claude Code

---

Note

Low Risk
Low risk: behavior is unchanged, but it touches Linux seccomp rule construction; main risk is mis-conversion of syscall numbers on some architectures.

Overview
Updates the Linux seccomp network filter to build the syscall rule map using i64::from (via .map(i64::from)) instead of casting, and suppresses Clippy’s useless_conversion to prevent autofix from reverting the change.

This keeps syscall keys consistently typed across architectures when inserting SYS_socket/SYS_socketpair rules.

^{Reviewed by Cursor Bugbot for commit c14c90f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[gemini-code-assist]

Code Review

This pull request updates the seccomp filter implementation in src/sandbox/seccomp.rs by casting syscall constants to i64 to resolve compilation errors on certain architectures. Feedback indicates that while this fixes the build, additional changes are required in the architecture matching logic to ensure runtime support for armv7.

[gemini-code-assist]

While this cast fixes the compilation error on armv7, the apply_seccomp_net_filter function will still return an error at runtime on this architecture because arm is not handled in the target_arch match block (lines 24-28). To fully support armv7, you should add "arm" => TargetArch::arm to that match block.

[greptile-apps]

Greptile Summary

This PR fixes a cross-platform compilation issue in src/sandbox/seccomp.rs where syscall as i64 was previously reverted by autofix-ci on x86_64 because clippy flags it as a useless cast (since libc::SYS_* is already i64 on x86_64/aarch64). The fix uses .map(i64::from) on the syscall array (which resolves to From<i32> for i64 on armv7 and the identity From<i64> for i64 on x86_64/aarch64) and adds #[allow(clippy::useless_conversion)] to prevent autofix-ci from reverting it again.

• Replaces syscall as i64 with [...].map(i64::from) to convert syscall numbers to i64 in a clippy-safe way across all architectures
• Adds #[allow(clippy::useless_conversion)] to suppress the clippy warning on x86_64/aarch64 where the From<i64> implementation is the identity conversion
• The approach correctly satisfies the BTreeMap<i64, Vec<SeccompRule>> key type on all targets at compile time

Confidence Score: 5/5

Safe to merge — the fix correctly resolves the cross-platform type mismatch and prevents clippy from reverting it.

The change is minimal and precisely targeted: .map(i64::from) satisfies the BTreeMap<i64, _> key type on all architectures (converting i32 on armv7, identity on x86_64/aarch64), and #[allow(clippy::useless_conversion)] prevents the autofix-ci regression. The previous thread's concern about a compile-time type error is fully addressed by this approach. No logic, security, or correctness issues remain.

No files require special attention.

Important Files Changed

Filename	Overview
src/sandbox/seccomp.rs	Correctly fixes the armv7 compile-time type error by using .map(i64::from) on the syscall array, with #[allow(clippy::useless_conversion)] to prevent autofix-ci from reverting the change on x86_64.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["[libc::SYS_socket, libc::SYS_socketpair]"] -->|".map(i64::from)"| B{Platform}
    B -->|armv7: SYS_* is i32| C["From<i32> for i64 → converts to i64"]
    B -->|x86_64 / aarch64: SYS_* is i64| D["From<i64> for i64 → identity (no-op)"]
    C --> E["syscall: i64"]
    D --> E
    E --> F["rules.insert(syscall, ...)"]
    F --> G["BTreeMap<i64, Vec<SeccompRule>>"]

Loading

_{Reviews (3): Last reviewed commit: "fix(exec): use allow(clippy::useless_con..." | Re-trigger Greptile}

[github-actions]

Hyperfine Performance

mise x -- echo

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
mise-2026.4.3 x -- echo	23.9 ± 0.7	22.3	30.8	1.00
mise x -- echo	24.6 ± 0.6	22.8	28.7	1.03 ± 0.04

mise env

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
mise-2026.4.3 env	23.8 ± 0.7	22.7	28.5	1.00
mise env	24.1 ± 0.4	23.1	25.4	1.01 ± 0.03

mise hook-env

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
mise-2026.4.3 hook-env	24.6 ± 0.4	23.3	25.9	1.00
mise hook-env	24.7 ± 0.6	23.6	31.8	1.00 ± 0.03

mise ls

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
mise-2026.4.3 ls	21.8 ± 0.7	20.3	30.4	1.00
mise ls	22.2 ± 0.7	21.4	31.3	1.02 ± 0.05

xtasks/test/perf

Command	mise-2026.4.3	mise	Variance
install (cached)	153ms	152ms	+0%
ls (cached)	82ms	81ms	+1%
bin-paths (cached)	85ms	86ms	-1%
task-ls (cached)	844ms	808ms	+4%