Stop config set echoing secrets; reject credential-bearing storage URLs (closes #166)

config set now prints only the key name after a write, never the value: a value may be a secret such as s3.secret_access_key, and echoing it leaks into captured stdout and pasted terminals. The set logic moves into writeConfigSet so this is testable.

config set also tightens a pre-existing group- or world-readable config to 0600 after writing; the previous stat-and-preserve-mode block had no effect (os.WriteFile does not change an existing file mode) and is removed.

ParseStorageURL now rejects s3:// and rclone:// URLs that carry credentials in the userinfo or an unknown query parameter, naming s3.access_key_id and s3.secret_access_key as where credentials belong. On a url.Parse failure only the inner cause is wrapped, so the raw URL is not echoed. file:// is unchanged.

Model: opus-4-8

internal/cli/config.go

@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"errors"
 	"fmt"
+	"io"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -379,40 +380,53 @@ Examples:
 				return err
 			}
 
-			root, err := loadYAMLFile(path)
-			if err != nil {
-				return err
-			}
-
-			err = yamlPathSet(root, strings.Split(args[0], "."), args[1])
-			if err != nil {
-				return err
-			}
-
-			out, err := marshalConfigYAML(root)
-			if err != nil {
-				return fmt.Errorf("marshaling config: %w", err)
-			}
-
-			mode := os.FileMode(configFileMode)
-
-			info, statErr := os.Stat(path)
-			if statErr == nil {
-				mode = info.Mode().Perm()
-			}
-
-			err = os.WriteFile(path, out, mode)
-			if err != nil {
-				return fmt.Errorf("writing config file: %w", err)
-			}
-
-			_, _ = fmt.Fprintf(os.Stdout, "%s = %s\n", args[0], args[1])
-
-			return nil
+			return writeConfigSet(os.Stdout, path, args[0], args[1])
 		},
 	}
 }
 
+// writeConfigSet applies key=value to the config at path, writes it back
+// owner-only, and confirms the write by printing just the key name to w.
+// The value is never echoed: it may be a secret such as
+// s3.secret_access_key, and captured stdout or a pasted terminal would
+// then leak it.
+func writeConfigSet(w io.Writer, path, key, value string) error {
+	root, err := loadYAMLFile(path)
+	if err != nil {
+		return err
+	}
+
+	err = yamlPathSet(root, strings.Split(key, "."), value)
+	if err != nil {
+		return err
+	}
+
+	out, err := marshalConfigYAML(root)
+	if err != nil {
+		return fmt.Errorf("marshaling config: %w", err)
+	}
+
+	err = os.WriteFile(path, out, configFileMode)
+	if err != nil {
+		return fmt.Errorf("writing config file: %w", err)
+	}
+
+	// os.WriteFile does not change the mode of a file that already exists,
+	// so a config that was group- or world-readable stays that way. As it
+	// may hold S3 credentials, tighten it to owner-only after writing.
+	info, statErr := os.Stat(path)
+	if statErr == nil && info.Mode().Perm()&0o044 != 0 {
+		err = os.Chmod(path, configFileMode)
+		if err != nil {
+			return fmt.Errorf("tightening config file permissions: %w", err)
+		}
+	}
+
+	_, _ = fmt.Fprintln(w, key)
+
+	return nil
+}
+
 // marshalConfigYAML renders a config document tree with 2-space indentation,
 // matching defaultConfigTemplate. yaml.Marshal defaults to 4 spaces, which
 // would reindent the whole file on the first `config set` despite the promise