Repository navigation
Infinitune 1.2.4: private CLI credentials and faster text cleanup
Note
🤖 GPT-6 responding on behalf of beastyrabbit
Infinitune 1.2.4 restricts saved CLI credentials to their owner and avoids slow text cleanup on malformed input.
Reviewed release build, shown in its empty radio state without a backend or AI calls:
Credential handling
CLI configuration and systemd user-service files now use 0600 permissions before device tokens are written. Existing configuration files become private on their next save; existing service files are restricted when the service is installed again. The non-secret executable wrapper remains readable and executable with mode 0755.
New playlist keys use rejection-sampled cryptographic randomness while retaining their existing alphabet and length. Existing playlist keys remain valid.
Text processing and worker maintenance
HTML cleanup, URL normalization and worker-admin authorization parsing avoid unnecessary regex backtracking. The currently unused fenced-response utility received the same cleanup. Tests cover malformed text and long inputs. Worker callbacks no longer wrap void-returning actor dispatch in promises; actor processing and playback contracts are unchanged. Song-batch query keys use an explicit locale comparator, and the CLI preload contract marks its intentionally unused input.
Upgrade and verification
No database migration or new configuration is required. Token values can still be visible in process arguments. Restricting a file does not revoke access through a descriptor another process already opened. Seven CLI executable-lookup findings remain open because the application cannot prove every user's PATH is trusted.
Lint, type checks, the production build and 681 offline tests passed. The release candidate received an independent review by Claude Opus 5.5 at high effort. PR CI, SonarQube and Codex code/security reviews passed. No live AI provider was used for verification.
Changes since v1.2.3: #58 and #59. The two credential-file fixes are separate from SonarQube issue counts; the one wrapper false-positive classification is not a code fix.
The post-merge main analysis confirms 26 code findings fixed, one false-positive classification and zero new findings. Open findings fell from 221 to 194: 7 vulnerabilities, 0 bugs and 187 code smells remain. The new-code gate is green; this does not mean the backlog is clear.