[leet-c1]

Hardening items deferred from the v0.9.1 pre-release review, bundled into one PR.

Changes

• The OpenAPI spec fetch goes through the shared transport. docs openapi, docs endpoints and docs endpoint now get:

  • a 32 MiB response cap;
  • the redirect guard, which refuses a redirect to a different path or host;
  • --debug tracing and --max-retries;
  • exit codes that can be classified: 4 for a 404, 5 for a 429, 6 for a 5xx or a redirect loop, 8 for anything else. These apply when no cache is available.

  When a cached spec exists, the fetch makes one attempt, because the stale cache is the fallback. An explicit --max-retries or C1I_MAX_RETRIES overrides that. Offline with a stale cache, a run takes 139 ms instead of 5.4 s.

  This retires a documented exception in CLAUDE.md. docs search and docs page still bypass the transport.

• A fresh cache that can't be read triggers a re-fetch instead of an error.

• A token-sweep race is fixed. The sweep checks the file again just before deleting it, and removes it only if it's still the same file. A fresh token that a concurrent c1i process renames into place is no longer deleted. On Windows, the file id is pinned first, because Lstat loads it lazily.

• A relative home or config dir is refused. With a relative HOME or %AppData%, c1i no longer writes credentials, tokens or ~/.c1i.yaml under the working directory, and it no longer reads ~/.c1i.yaml from there. Before, a .c1i.yaml planted in a repo could redirect url. If C1I_CLIENT_ID and C1I_CLIENT_SECRET were set, those credentials would be sent to that host.

• upgrade no longer runs go env. It reads GOBIN and GOPATH from the environment and the Go env file, in Go's own precedence order. Running go env made the Go toolchain on PATH write telemetry under the user's config dir.

• Uninstall docs now say where the binary lives for each install method, and that Linux follows XDG_CONFIG_HOME.

• golang.org/x/term is bumped to v0.47.0, which brings x/sys v0.49.0.

The CHANGELOG [Unreleased] section has an Upgrading from 0.9.1 note for scripts. It covers the new exit codes, the default retries when no cache exists, and the relative-home refusal.

Verification

• Mutation-checked tests: every new test failed on a mutant that removes its fix. Independent reviewers re-ran 30 mutants across two rounds. All relevant ones are killed; the survivors are equivalent behavior, or the Windows-only pin, since CI runs on Linux.
• Gates with Go 1.27.2:
  • build, and vet for linux, windows and darwin;
  • go test -count=1 -shuffle=on with 3 seeds;
  • golangci-lint (0 issues) and gosec with the CI flags;
  • govulncheck for linux, darwin and windows (0 called);
  • go mod tidy and gitleaks;
  • 7 cross-builds.
• Live checks:
  • docs endpoints returns 820 rows, and docs endpoint gives a deterministic hash;
  • --debug traces the fetch;
  • an offline stale-cache run returns quickly with the warning;
  • a planted ./.c1i.yaml is ignored when HOME is relative;
  • upgrade --check writes no go/telemetry and still detects a GOBIN install.
• Reviews: independent code and docs reviews approved after one fix round.

Not included

• A Windows cmdkey alternative for removing keyring entries is left out of the uninstall docs. It couldn't be verified without a Windows host.
• A max_retries key in ~/.c1i.yaml doesn't override the one-attempt rule. That matches the README, which documents only the flag and the env var as sources.

🤖 Generated with Claude Code