sneak
0538af4487
check / check (pull_request) Successful in 3m31s
config set now prints only the key name after a write, never the value: a value may be a secret such as s3.secret_access_key, and echoing it leaks into captured stdout and pasted terminals. The set logic moves into writeConfigSet so this is testable. config set also tightens a pre-existing group- or world-readable config to 0600 after writing. os.WriteFile does not change an existing file's mode, so the previous stat-and-preserve-mode block had no effect; it is removed. ParseStorageURL now rejects s3:// and rclone:// URLs that carry credentials in the userinfo or an unknown query parameter, and names s3.access_key_id and s3.secret_access_key as where credentials belong; rclone:// accepts no parameters, so a misspelt one is caught rather than silently sending the backup to the default endpoint. On a url.Parse failure only the inner cause is wrapped, so the raw URL is not echoed. file:// is unchanged. Model: opus-4-8