config set now prints only the key name after a write, never the value:
a value may be a secret such as s3.secret_access_key, and echoing it
leaks into captured stdout and pasted terminals. The set logic moves
into writeConfigSet so this is testable.
config set also tightens a pre-existing group- or world-readable config
to 0600 after writing. os.WriteFile does not change an existing file's
mode, so the previous stat-and-preserve-mode block had no effect; it is
removed.
ParseStorageURL now rejects s3:// and rclone:// URLs that carry
credentials in the userinfo or an unknown query parameter, and names
s3.access_key_id and s3.secret_access_key as where credentials belong;
rclone:// accepts no parameters, so a misspelt one is caught rather than
silently sending the backup to the default endpoint. On a url.Parse
failure only the inner cause is wrapped, so the raw URL is not echoed.
file:// is unchanged.
Model: opus-4-8
sneak