v0.4.1

0.4.1 fixes places where reqtrail's output said something untrue or unsafe. No transport code changed: what run sends is byte-for-byte what 0.4.0 sent.

Every sample below was captured from the release commit 2a85d12, not written by hand.

Two workspaces that worked in 0.4.0 now refuse

Both were being turned into output the file did not express.

A URL with userinfo. 0.4.0 displayed user:pw@ and sent neither the userinfo nor an Authorization header.

$ reqtrail resolve userinfo.json
reqtrail: url: the URL contains userinfo (user:password@); reqtrail does not send it, so it refuses to show it. Put credentials in a header instead [url.userinfo]
[exit 1]

A file that is not valid UTF-8. 0.4.0 replaced a bad byte with U+FFFD and resolved a raw 0x80 to %EF%BF%BD, exit 0.

$ reqtrail resolve bad-utf8.json
reqtrail: bad-utf8.json: file is not valid UTF-8; reqtrail reads it byte for byte and will not repair it [workspace.encoding]
[exit 1]

Output that is now true

A mask stands for bytes that are sent. An empty secret showed ?k=•••• in 0.4.0; the wire carried ?k=.

$ EMPTY= reqtrail resolve empty.json
GET https://api.example.com/x?k=
Host: api.example.com  (derived)

Substitutions
  url  {{$env.EMPTY}}  environment  •••• (masked)
warning: url: environment variable EMPTY is set but empty
[exit 0]

A secret is never named by its code point. For a one-character secret Ā, 0.4.0's refusal contained U+0100 — the whole value in another notation.

$ reqtrail resolve charset.json
reqtrail: headers[0]: the value of "{{$env.KEY}}" contains a character the transport will not accept; it is not shown because the value is secret. Header values may contain tab, U+0020-U+007E and U+0080-U+00FF [header.charset]
[exit 1]

A workspace cannot rewrite your terminal line. A carriage return in a key used to return the cursor and overwrite reqtrail:. CR, bidi controls and line separators are now escaped, in workspace content and in echoed arguments.

$ reqtrail resolve cr.json
reqtrail: x\u000dFAKE: all good: unknown key "x\u000dFAKE: all good"; allowed here: "version, variables, requests" [schema.unknown-key]
[exit 1]

--help and the README no longer say run shows the request before sending it. It never did: run sends, then shows the request with the status. To see a request without sending it, use resolve.

reqtrail ui says it is a snapshot, in its startup banner and on the page: it shows the file as it was when it started, and needs a restart after an edit.

Also: root-level refusal paths lose a stray leading dot (oops, not .oops), and the README's "not here" list no longer says run does not exist.

Still true in 0.4.1

• run sends before it displays, and has no timeout.
• Closing stdout early (reqtrail --help | head -n 0) prints a Node stack trace.
• An IPv6 literal URL fails as a DNS error, and a URL ending in a bare ? is sent without the ?.

These are the next releases' work.

Evidence, with every prediction resolved and the one that was wrong kept as written: HONESTY-PATCH-EVIDENCE.md.