Ignore a local config's api_url and token until it is trusted

Merged
RO
2d ago
+1186-31

What

A local .fizzy.yaml keeps setting the account and the board. Its api_url and token now apply only once the file is trusted:

  • fizzy config trust [path] trusts the nearest .fizzy.yaml (or the one at path). It records a digest of the file's api_url and token, so changing either leaves the file untrusted until it is trusted again.
  • fizzy config untrust [path] removes the trust.
  • An untrusted file that sets either key prints one warning on stderr naming what was ignored and how to trust it.
  • fizzy setup trusts the local file it writes.
  • fizzy doctor warns when a local config's settings are being ignored, and config show / config explain report what actually applies.
  • With no profile chosen, the configured account names the stored credential. That credential now goes to its own profile's host rather than the host the YAML config or the default names. The host follows the credential: a profile with no token of its own does not change the host.
  • config trust and config untrust only change local trust records, so they run whatever the profile, account and token settings are.

Trust is stored in trusted-configs.json in the config directory (~/.config/fizzy), updated under a lock. SURFACE.txt is regenerated for the two new commands, and the README, AGENTS.md and the skill describe the behavior.

Why

A .fizzy.yaml is found by walking up from the working directory, so it often comes from a repository someone else wrote. The account and the board are harmless to take from it. The API host and the token decide where a credential is sent and which one, so those should be the person's own choice, made once per file.

Behavior change: an existing .fizzy.yaml that sets api_url or token stops applying them until fizzy config trust is run once in that directory. Files with only account and board are unaffected.

Testing

  • make check passes
  • Unit tests cover trust, untrust, a changed file losing trust, the warning, doctor, config explain, concurrent trust changes, and the profile host with and without a stored token.
  • Ran the built binary against local stand-in servers in an isolated home: an untrusted file's api_url and token are ignored and requests go to the configured host; after fizzy config trust they apply; after editing the file or fizzy config untrust they are ignored again.