Skip to content

Credential printing gaps (spec 39) - #67

Merged
llima merged 17 commits into
mainfrom
fix/credential-gaps
Oct 18, 2026
Merged

llima merged 17 commits into
mainfrom
fix/credential-gaps

Conversation

@llima

@llima llima commented Oct 18, 2026

Copy link
Copy Markdown
Owner

Summary

  • Version bumped to 0.32.1 (patch). Merging publishes craftar@0.32.1 to npm after approval in the npm environment.
  • A cache entry no clean registry row vouches for is printed by a label. doctor and cache prune print an entry's name only when a registry row with a clean URL (or the checked workspace) names it. Every other entry reads (a cache entry name — not shown): an orphan, and every entry when CRAFTAR_NO_REGISTRY is set or the registry cannot be read. That covers doctor's nothing names it and a fetch never completed lines, and cache prune's rows, its --json path and its warnings. An entry a flagged row names keeps (a URL with credentials — not shown). With no snapshot, the segment after forges/ in a relayed error is the label. Keys are hidden by merged ranges of the original text, so neither a prefix key nor a key that starts inside another leaves part of a name printed.
  • More forge: spellings are refused as a URL with credentials: a single / after the scheme, and a tab, LF or CR inside the scheme or its ://. This covers craftar.yaml and craftar.local.yaml, init --forge and its questions, and import --write-config, which now exits 1 instead of replacing the value. The interactive init no longer offers a Forge recorded as a path whose spelling holds a credential.
  • In a Forge at schema: 4 or above, a rendered server param holding a credential behind such a control character now fails the plan, as one behind a plain :// did.
  • No emitted byte, lock, registry entry or cache layout changes, and no --json key is added or removed. The README has a new to 0.32.1 block.

Test plan

  • npm run typecheck: exit 0 (on 8023ad7, after the bump)
  • npm run build: exit 0; node bin/craftar.js --version prints 0.32.1
  • npm test (vitest, --maxWorkers=6, without test/ci.test.ts) on 6f29d36, the same source as HEAD minus the version bump: 123 files passed, 1 skipped; 3087 tests passed, 8 skipped. Oracle skipped (no fixture). No emitter, plan, status or apply path changed.
  • Every new test was seen failing against the base src/ before its fix, including the gap-2 CLI tests, the interactive-init test, servedRow and the overlapping-key tests.
  • CI green on Linux and Windows

llima added 17 commits October 18, 2026 13:08
… tab / LF / CR first, as a URL parser does (spec 39)
…by a label — doctor and cache prune (spec 39 gap 1)
…r leaves the rest of a longer one printed (review)
…tarts before another no longer leaves its tail printed (review)
…he same-start choice (review)

Comment-only follow-up to round 4's nits: the two-pass safety rests on every cache key ending in
-<12 hex>, and the longer key's label at a shared start is deliberate.
…solve gives it (Windows CI)

The text carried /tmp/h raw, which on win32 resolves to a drive path, so the segment rule
correctly matched nothing; the message now holds the home as the file system reports it.
@llima
llima merged commit 49251ca into main Oct 18, 2026
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant