4 Commits

Include renames

Author	SHA1	Message	Date
sneak	8e94253e4c	Refuse credentials in a storage URL's endpoint or rclone remote name (closes #322) ... storage_url refused only the outer URL's userinfo and unknown query parameters. Userinfo inside the s3 endpoint= value, and rclone's remote,param=value parameters in the remote name, were accepted and then printed by info, remote info and snapshot create. Both are now refused without echoing the value: a host name never contains "@", and an rclone remote name never contains a comma. The comma is checked before url.Parse, because url.Parse refuses a name such as ":s3,secret_access_key=..." or "x,secret=a:b", and its error prints the name from the colon on. The rclone case has its own error pointing at rclone config, since the existing credentials error names the s3.* keys. Model: opus-5-5	2026-10-13 15:51:48 +00:00
clawbot	5f6455ba17	Refuse a relative file:// storage_url and decode its escapes (closes #299) ... The path after file:// was used as written. file://dest resolved against the working directory, so a backup run from another directory wrote elsewhere, exited 0 and left a snapshot that could not be restored; my%20stick created a directory with that literal name. Config load now refuses a file:// storage_url whose path is not absolute. ParseStorageURL refuses it too and decodes percent-escapes; a literal space still works. The rule is written in both packages because config cannot import storage, which imports config. A % not followed by two hex digits now fails when the storage is opened, not at config load. Model: opus-5-5	2026-10-13 11:27:59 +02:00
clawbot	39aef1c47c	Stop config set echoing secrets; reject credential-bearing storage URLs (closes #166) ... config set now prints only the key name after a write, never the value: a value may be a secret such as s3.secret_access_key, and echoing it leaks into captured stdout and pasted terminals. The set logic moves into writeConfigSet so this is testable. config set also tightens a pre-existing group- or world-readable config to 0600 after writing; the previous stat-and-preserve-mode block had no effect (os.WriteFile does not change an existing file mode) and is removed. ParseStorageURL now rejects s3:// and rclone:// URLs that carry credentials in the userinfo or an unknown query parameter, naming s3.access_key_id and s3.secret_access_key as where credentials belong. On a url.Parse failure only the inner cause is wrapped, so the raw URL is not echoed. file:// is unchanged. Model: opus-4-8	2026-09-22 12:28:32 +02:00
clawbot	a50e3fa038	Add tests for internal/storage: URL parsing, backends, shared conformance suite (closes #66) ... internal/storage, the package that parses store URLs and selects the backend, had no tests. Adds table-driven tests for URL parsing (each scheme, query parameters, malformed input, unknown scheme, backend type chosen); one shared conformance suite for the Storer interface, run against the file backend in a temp directory and the s3 backend on the in-process harness internal/s3 already uses, so a new backend inherits it; and rclone construction and argument tests using its in-process local backend. A comment records that rclone data operations need a configured remote and are not unit-tested. No production code changed and no defect surfaced. model: claude-opus-4-8 (implementation, review); claude-fable-5-1 (merge)	2026-09-22 00:58:27 +02:00