[leet-c1]

Housekeeping before cutting v0.9.1. It fixes the gaps a pre-release review found across everything merged since v0.9.0 (#147–#151), and stamps the changelog.

Fixes

• docs endpoint output is now deterministic. The $ref resolver shared one "seen" set across sibling nodes and walked maps in Go's random order, so whichever sibling came first got the expanded schema. 12 runs of docs endpoint /api/v1/users gave 7 different outputs; it now gives 1. Keys are visited in sorted order, and nothing is dropped: a later sibling's bare $ref points at an expansion earlier in the same output.
• No home directory means no OpenAPI cache. When the home dir is unknown, the cache is skipped. Before, the spec was written into ./.c1i/cache/ in the working directory.
• A bad download no longer poisons the cache. A 200 response is cached only if it parses as an OpenAPI document with paths. The write is atomic (temp file, then rename), and the leftover-file prune runs only after a successful rename. On an unparseable body or a failed read, c1i falls back to the existing cache.
• A stale cache is no longer served silently. When a fetch fails and an expired copy is served, c1i prints one line on stderr naming its age, for example Warning: using cached OpenAPI spec from 3d ago (…). stdout is unchanged. A fresh cache hit stays silent.

Docs and help

• Bash completion: now installs to ~/.local/share/bash-completion/completions/c1i. The old path needed root.
• Service principals: delete and credentials revoke are soft. get and credentials get still return the record at exit 0, with no field marking it. Verified live on a lab tenant: the principal's user.status stays ENABLED, only the lists omit the record, and users get <sp-id> shows "status": "DELETED". This is in the README, the help text, and cmd/agents.md.
• docs endpoints --filter: the help now says it also matches operation descriptions.
• agents.md: notes the stale-cache warning, and one paragraph is rewrapped.

Tests

• Delete-safety gaps closed:
  • the cache prune leaves an empty subdirectory alone;
  • the token sweep leaves token-shaped decoys in the config root and in the c1i dir alone;
  • the prune's relative-dir guard has a direct test again.
• Windows-safe: the cache tests now set USERPROFILE as well as HOME.
• Mutation-checked: each new test was confirmed to fail on a mutant that removes its fix. Independent review re-ran 14 mutants: 12 are killed, and the 2 that survive are harmless cleanup paths.

CHANGELOG

• Stamped ## [0.9.1] - 2026-10-09, with an empty [Unreleased] above and the link refs updated.
• Security comes first: v0.9.0 binaries were built with Go 1.27.1, which carries 9 vulnerabilities in code c1i calls.
• Upgrading from 0.9.0 lists the behavior changes: the renamed cache file, the prune of foreign files in ~/.c1i/cache/, and the token-file sweep.

Verification

• Gates (Go 1.27.2):
  • build, plus vet for linux and windows;
  • go test -count=1 -shuffle=on with 3 seeds;
  • golangci-lint (0 issues) and gosec with the CI flags;
  • govulncheck on linux, darwin and windows: 0 called vulnerabilities;
  • go mod tidy and gitleaks;
  • cross-compiles for darwin/arm64, windows/amd64 and linux/arm64;
  • no outdated direct dependencies.
• Live checks:
  • 10 runs of docs endpoint give one hash;
  • with HOME unset, nothing is written to the working directory;
  • an offline fallback prints the warning, with stdout clean.
• Reviews: independent code and docs/CHANGELOG reviews, re-checked after fixes.

After merge

1. Tag v0.9.1.
2. Update the public docs pages in a separate PR: the new spec source and cache, an uninstall section, the token sweep, and the soft-delete note.

🤖 Generated with Claude Code