Repository navigation
Say why a seed read failed, and try it once more - #24
Merged
Merged
Conversation
Nothing here was ever tagged, so anyone who cloned since 2026-07-29 holds a copy with defects that are mostly silent — a watch that reports running jobs as finished, a precedence rule that discards every documented override, a submit that fails on any current OpenSSH. The changelog leads with what CHANGED rather than what was added, because that is the part that can surprise someone upgrading: sbatch arguments are quoted now, a remote script path is literal, and watch has a third exit status. The examples directory had only the hardest case, a cluster behind a full-tunnel VPN that also enforces TOTP. Most people start with neither, and README solicits worked profiles from contributors — so the simple shape should be there to copy.
A first tag makes version a question with an answer, and CHANGELOG.md opens with behaviour changes — so a caller has to be able to tell which side of them it is on. Nothing in the tool could say. `version` is dispatched before the profile loads, like `init`: a setup that does not load is exactly when someone needs to report which copy they are running. `doctor` opens with the same line, since that output is what gets pasted into an issue. A test holds the string equal to the newest heading in CHANGELOG.md, so a tag cannot drift from what the tool reports. Verified by mutation: drifting the string fails three assertions, dropping the doctor line fails one, and moving the dispatch after the loader fails the two that cover a broken profile. Also corrects two claims in the changelog itself — the repository's public date, which was off by a timezone, and the assertion count. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The "Known limitations" section said no part of this release had been exercised against a live SLURM controller. That is no longer true: one end-to-end run — open, render, submit, queue, watch to completion, fetch, cancel, close — was made against a TOTP-gated cluster behind a VPN, and behaved as documented. Stated as one site and one SLURM version, which is what it is, rather than as a compatibility claim. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
A failed read sent the backend's stderr to /dev/null, so open, doctor and status all said "no seed — run store-seed" while the seed sat in the keychain, refused for one request only. The backend's own message, its exit status and, for the keychain, the macOS session the read ran in are now appended to HS_TOTP_ERROR_LOG, and the hint repeats the latest reason. The seed itself is never written anywhere. The read is tried once more after HS_TOTP_READ_RETRY_DELAY seconds, which absorbs a refusal that clears by itself; not after a cancelled prompt, and not for a missing seed file. Thirteen new assertions, with `security` shadowed throughout; they fail on the previous code. Suite: 207 passed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #23 (base
chore/release-v0.1.0), because the entry belongs in its CHANGELOG.A failed seed read sent the backend's stderr to
/dev/null.open,doctorandstatusthen reported "no seed — run store-seed", including when the seed was stored and the keychain had refused a single request. That points the user towards re-enrolling a factor that is fine, and leaves an intermittent refusal with nothing to diagnose it from.Changes, in
lib/totp.sh:HS_TOTP_ERROR_LOG. The default is$HS_CONFIG_DIR/<profile>.totp-errors.log, created 0600. The line records the time, backend, attempt, exit status, the backend's message and, for the keychain,launchctl managername. Only stderr is written. The seed is handed on withprintf, a builtin, so as before it reaches no argv, no environment and no file.open,doctorandstatusrepeats the latest reason. The store-seed advice remains as the fallback.HS_TOTP_READ_RETRY_DELAYseconds (default 2). There is no retry after a cancelled prompt, or for a missing seed file.The two new keys are documented in
config.example.SECURITY.md,docs/2fa-enrollment.mdandCHANGELOG.mdare updated.Tests: 13 new assertions, 207 in total, with
securityshadowed throughout. Against the previouslib/totp.sh, 11 of the 13 fail; the other two assert that nothing is written, which also held before. shellcheck, run as in CI, is clean.Generated with Claude Code