4 Commits

Include renames

Author	SHA1	Message	Date
sneak	d5b3b5ebe3	Refuse credentials in a storage URL's endpoint or rclone remote name (closes #322) ... storage_url refused only the outer URL's userinfo and unknown query parameters. Userinfo inside the s3 endpoint= value, and rclone's remote,param=value parameters in the remote name, were accepted and then printed by info, remote info and snapshot create. Both are now refused when the storage URL is parsed, without echoing the value: a host name never contains "@", and an rclone remote name never contains a comma. The rclone case has its own error pointing at rclone config, since the existing credentials error names the s3.* keys. Model: opus-5-5	2026-10-13 11:01:40 +00:00
clawbot	5f6455ba17	Refuse a relative file:// storage_url and decode its escapes (closes #299) ... The path after file:// was used as written. file://dest resolved against the working directory, so a backup run from another directory wrote elsewhere, exited 0 and left a snapshot that could not be restored; my%20stick created a directory with that literal name. Config load now refuses a file:// storage_url whose path is not absolute. ParseStorageURL refuses it too and decodes percent-escapes; a literal space still works. The rule is written in both packages because config cannot import storage, which imports config. A % not followed by two hex digits now fails when the storage is opened, not at config load. Model: opus-5-5	2026-10-13 11:27:59 +02:00
clawbot	39aef1c47c	Stop config set echoing secrets; reject credential-bearing storage URLs (closes #166) ... config set now prints only the key name after a write, never the value: a value may be a secret such as s3.secret_access_key, and echoing it leaks into captured stdout and pasted terminals. The set logic moves into writeConfigSet so this is testable. config set also tightens a pre-existing group- or world-readable config to 0600 after writing; the previous stat-and-preserve-mode block had no effect (os.WriteFile does not change an existing file mode) and is removed. ParseStorageURL now rejects s3:// and rclone:// URLs that carry credentials in the userinfo or an unknown query parameter, naming s3.access_key_id and s3.secret_access_key as where credentials belong. On a url.Parse failure only the inner cause is wrapped, so the raw URL is not echoed. file:// is unchanged. Model: opus-4-8	2026-09-22 12:28:32 +02:00
clawbot	a50e3fa038	Add tests for internal/storage: URL parsing, backends, shared conformance suite (closes #66) ... internal/storage, the package that parses store URLs and selects the backend, had no tests. Adds table-driven tests for URL parsing (each scheme, query parameters, malformed input, unknown scheme, backend type chosen); one shared conformance suite for the Storer interface, run against the file backend in a temp directory and the s3 backend on the in-process harness internal/s3 already uses, so a new backend inherits it; and rclone construction and argument tests using its in-process local backend. A comment records that rclone data operations need a configured remote and are not unit-tested. No production code changed and no defect surfaced. model: claude-opus-4-8 (implementation, review); claude-fable-5-1 (merge)	2026-09-22 00:58:27 +02:00