Merge remote-tracking branch 'origin/dev/v2.1' into feat/warn-unknown-sockguard-env

[scttbnsn]

Viper's AutomaticEnv only consults a variable for a key it already knows about, so SOCKGUARD_LISTEN_SOCKT=/run/sockguard.sock was read by nothing: the listener stayed on its config-file or default value and no output said so. That's the dangerous direction for a default-deny proxy, because the operator believes they tightened something. sockguard serve and sockguard validate now both check the environment at startup and log one line per unrecognized SOCKGUARD_* variable, naming the variable and, when the spelling is within two edits of a real one, the variable it was probably meant to be. Only the name is logged, never the value, since a typo lands on a variable holding a credential as easily as on one holding a socket path. The warning is advisory and never fails startup. What counts as recognized is reconstructed from the loader's own Viper state, the registerDefaults walk over Config's mapstructure tags plus the config file, so it can't drift from what Viper binds, and a key that exists only because the YAML declares it isn't reported as ignored. Tecnativa compat vars carry no SOCKGUARD_ prefix and are never flagged.

New tests. In app/internal/cmd/serve_warn_test.go, TestWarnUnknownEnvVarsNamesEachUnknownOnce covers one line per unknown variable, deduplication of a repeat, and that the value never reaches the log; TestWarnUnknownEnvVarsIgnoresKnownAndCompatVariables covers correctly spelled keys at three nesting depths plus the unprefixed Tecnativa vars staying silent; TestWarnUnknownEnvVarsSuggestsNearestKnownVariable is a table over a dropped letter, a missing underscore, a singular for a plural, and a name with nothing close enough to suggest. TestRunServeWarnsOnUnknownEnvVar and TestRunValidateWarnsOnUnknownEnvVar (in app/internal/cmd/validate_test.go) prove each command actually emits it rather than just exposing the helper. In app/internal/config/env_unknown_test.go, TestUnknownEnvVarsAcceptsKeysTheConfigFileDeclares pins the case that drove the file-aware derivation, since a pointer block declared in YAML really is overridable from the environment, and TestUnknownEnvVarsSurvivesAnUnusableConfigFile covers a missing or malformed file falling back to the schema half instead of accepting everything. Every one of them fails with the warning stubbed out.

CHANGELOG entry went under ### Added.

Changelog

• ✨ Added warnings for unknown SOCKGUARD_* variables in serve and validate.

• ✨ Added typo suggestions with did_you_mean for close variable names.

• ✨ Added warning deduplication and value omission.

• ✨ Added recognition of schema keys, defaults, mapstructure tags, and YAML-declared keys.

• ✨ Added tests for warnings, suggestions, compatibility variables, config files, and command integration.

• ✨ Added configuration documentation.

• Verify warning detection does not widen accepted socket or configuration access.

• Verify malformed or unreadable configuration files cannot suppress unknown-variable warnings.

• Verify warning output remains stable and does not expose environment values.

[vercel]

Deployment failed for project sockguard-website with the following error:

Resource is limited - try again in 24 hours (more than 100, code: "api-deployments-free-per-day").

Learn More: https://vercel.com/codeswhat?upgradeToPro=build-rate-limit

[biggest-littlest]

Reviewed against the CHANGELOG entry and the diff; CI green outside the qlty/Vercel quota noise.

[ALARGECOMPANY]

Reviewed against the CHANGELOG entry and the diff; CI green outside the qlty/Vercel quota noise.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: 8df3c48f-7370-431e-aa34-5d6506cf8409

📥 Commits

Reviewing files that changed from the base of the PR and between 7c82201 and d6573a7.

⛔ Files ignored due to path filters (1)

• CHANGELOG.md is excluded by !CHANGELOG.md

📒 Files selected for processing (7)

• app/internal/cmd/serve.go
• app/internal/cmd/serve_warn_test.go
• app/internal/cmd/validate.go
• app/internal/cmd/validate_test.go
• app/internal/config/env_unknown.go
• app/internal/config/env_unknown_test.go
• docs/content/docs/configuration.mdx

---

📝 Walkthrough

Walkthrough

The change detects unrecognized SOCKGUARD_* environment variables from schema and YAML-declared keys. It deduplicates names and adds close-match suggestions without retaining values. sockguard serve and sockguard validate emit warnings before configuration validation. Tests cover filtering, suggestions, redaction, startup behavior, and stderr output. Documentation describes the warning format and compatibility-variable handling.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/warn-unknown-sockguard-env

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}