8bitAlex
diff --git a/‎site/docs/whats-new.mdx‎
Lines changed: 12 additions & 0 deletions b/‎site/docs/whats-new.mdx‎
Lines changed: 12 additions & 0 deletions
diff --git a/‎src/cmd/context/serve.go‎
Lines changed: 4 additions & 1 deletion b/‎src/cmd/context/serve.go‎
Lines changed: 4 additions & 1 deletion
diff --git a/‎src/cmd/context/serve_test.go‎
Lines changed: 38 additions & 0 deletions b/‎src/cmd/context/serve_test.go‎
Lines changed: 38 additions & 0 deletions
diff --git a/‎src/cmd/raid.go‎
Lines changed: 13 additions & 8 deletions b/‎src/cmd/raid.go‎
Lines changed: 13 additions & 8 deletions
diff --git a/‎src/internal/lib/command.go‎
Lines changed: 6 additions & 4 deletions b/‎src/internal/lib/command.go‎
Lines changed: 6 additions & 4 deletions
@@ -9,6 +9,18 @@ description: Feature-by-feature release notes for Raid.
 
 User-visible changes per release, latest first. For full commit history see the [GitHub releases page](https://github.com/8bitalex/raid/releases).
 
+## 0.17.1 — upcoming
+
+Three pre-v1.0 hardening fixes from the release-readiness review. No behavior change for happy paths; all three are correctness/security bugs with regression tests now in place.
+
+**Telemetry consent prompt no longer gets killed by `--json`.** The first-run prompt previously persisted `decided=off` on any skip signal — including transient ones like `--json`. A user who piped one command through `raid context --json | jq` was silently opted out of telemetry for life. The consent flow now splits skip signals into two tiers: persistent (`--yes` / `--headless` / `RAID_HEADLESS` / non-TTY / `DO_NOT_TRACK`) which still persist `decided=off`, and transient (`--json`) which skip the prompt without writing state. The next interactive run without the transient signal still gets prompted.
+
+**Repo URL credentials no longer leak to `~/.raid/vars` or MCP.** A profile YAML using `https://user:token@github.com/...` as a clone URL no longer persists the credential to disk, no longer surfaces it through the MCP `raid://workspace/vars` resource, and no longer lands verbatim in `$RAID_REPO_<NAME>_URL` for subprocesses. SSH-style `git@host:repo.git` URLs round-trip unchanged. **If you've previously run raid against a profile with embedded clone credentials, rotate the affected token** — this fix prevents new leaks but doesn't scrub historical content from your existing vars file. Re-exported as `raid.ScrubURL`.
+
+**`~/.raid/vars` now written with mode `0600` instead of `0644`.** The vars file persists raid-managed variables (scrubbed repo URLs, `Set`-task values, anything project authors treat as secret-ish) and shouldn't be world-readable. New writes land at `0600` atomically; existing 0644 files are best-effort tightened on the next load.
+
+**MCP read/write race on the workspace context.** mcp-go dispatches tool calls from a 5-worker pool, so MCP read handlers (`raid_list_repos`, `raid_describe_repo`, …) could race with mutating handlers' `ForceLoad` rewrites of the package-global context. Replaced with `atomic.Pointer[Context]`; reads are now well-defined under concurrent writes. Race-detector test pins the contract.
+
 ## 0.17.0 — upcoming
 
 **Optional opt-out telemetry follow-up.** When a user declines the first-run telemetry prompt, raid now asks one follow-up question: may we send a single anonymous event recording your denial? Default is no (capital N) just like the main prompt. If accepted, raid fires exactly one `raid_telemetry_opt_out` event (with `reason: "prompt-declined"`) under explicit per-event consent and then leaves telemetry permanently off — that's the whole transaction. If declined or skipped, raid touches zero endpoints for the remainder of the install. The follow-up runs *only* on the explicit-decline path: non-TTY, headless, `DO_NOT_TRACK`, already-decided, and `raid telemetry ...` invocations skip both prompts. Closes the opt-out-rate measurement gap that's otherwise impossible to fill from website analytics alone.
 
@@ -520,7 +520,10 @@ func handleListRepos(_ stdctx.Context, req mcp.CallToolRequest) (*mcp.CallToolRe
 
 	urls := make(map[string]string, len(active.Repositories))
 	for _, r := range active.Repositories {
-		urls[r.Name] = r.URL
+		// Scrub embedded userinfo so an HTTPS clone URL with a token
+		// (`https://user:token@host/...`) doesn't leak through the
+		// MCP tool result. See raid.ScrubURL for the contract.
+		urls[r.Name] = raid.ScrubURL(r.URL)
 	}
 
 	live := rctx.Get().Workspace.Repos
 
@@ -563,6 +563,44 @@ func TestHandleListRepos_returnsConfiguredReposWithURL(t *testing.T) {
 	}
 }
 
+// TestHandleListRepos_scrubsCredentialBearingURL pins bug C2 at the
+// MCP handler boundary: a clone URL with embedded userinfo
+// (`https://user:token@host/...`) must come back through
+// raid_list_repos with the credentials stripped. The unit test on
+// ScrubURL alone isn't enough — a future refactor that bypasses the
+// helper here would still pass that test but reintroduce the leak.
+func TestHandleListRepos_scrubsCredentialBearingURL(t *testing.T) {
+	body := `name: test-fixture
+repositories:
+  - name: demo-repo
+    path: ` + "/tmp/raid-cmd-context-test-demo-repo-DOES-NOT-EXIST" + `
+    url: https://alice:s3cret@github.com/org/demo.git
+`
+	loadTestProfile(t, body)
+
+	res, err := handleListRepos(stdctx.Background(), mcp.CallToolRequest{})
+	if err != nil {
+		t.Fatalf("handleListRepos: %v", err)
+	}
+	if res.IsError {
+		t.Fatalf("expected ok, got error: %s", toolResultText(res))
+	}
+	raw := toolResultText(res)
+	if strings.Contains(raw, "alice") || strings.Contains(raw, "s3cret") {
+		t.Fatalf("MCP response leaked credentials: %s", raw)
+	}
+	var entries []listReposEntry
+	if err := json.Unmarshal([]byte(raw), &entries); err != nil {
+		t.Fatalf("body not JSON: %v", err)
+	}
+	if len(entries) != 1 {
+		t.Fatalf("expected 1 repo, got %d: %+v", len(entries), entries)
+	}
+	if entries[0].URL != "https://github.com/org/demo.git" {
+		t.Errorf("repo URL = %q, want scrubbed scheme+host+path", entries[0].URL)
+	}
+}
+
 func TestHandleDescribeRepo_lookupByName(t *testing.T) {
 	loadTestProfile(t, minimalTestProfileBody)
 
 
@@ -169,15 +169,20 @@ func executeRoot(args []string) int {
 
 	// First-run consent prompt for telemetry. Runs only for non-info,
 	// non-telemetry-subcommand invocations to avoid prompting on
-	// `raid --help`, `raid telemetry on`, and similar. The prompt
-	// itself no-ops when stdin isn't a TTY, when --yes/--headless is
-	// set, when --json is set, or when RAID_HEADLESS=1 in the env
-	// (CI / agent-host opt-in path), so it's safe in non-interactive
-	// contexts. See telemetry.MaybePromptForConsent for the full skip
-	// matrix.
+	// `raid --help`, `raid telemetry on`, and similar.
+	//
+	// Skip signals split into two tiers. Persistent — `--yes` /
+	// `--headless`, `RAID_HEADLESS=1`, non-TTY stdin, DO_NOT_TRACK —
+	// all reflect "this host is non-interactive long-term" and cause
+	// MaybePromptForConsent to persist decided=off so we don't keep
+	// re-prompting. Transient — `--json` — is just "this one command
+	// wants machine-readable output" and must NOT poison the consent
+	// state. The split was added after a real bug where one
+	// `raid context --json | jq` silently opted the user out for life.
 	if !info && !isTelemetrySubcommand(args) {
-		skip := headlessFromArgs(args) || jsonModeFromArgs(args) || lib.IsHeadless()
-		switch telemetry.MaybePromptForConsent(skip) {
+		skipPersistent := headlessFromArgs(args) || lib.IsHeadless()
+		skipTransient := jsonModeFromArgs(args)
+		switch telemetry.MaybePromptForConsent(skipPersistent, skipTransient) {
 		case telemetry.PromptAccepted:
 			// User opted in via the first-run prompt — fire the
 			// adoption event so `raid telemetry on` and the prompt
 
@@ -67,18 +67,20 @@ func (c Command) IsZero() bool {
 
 // GetCommands returns all commands available in the active profile.
 func GetCommands() []Command {
-	if context == nil {
+	ctx := loadContext()
+	if ctx == nil {
 		return nil
 	}
-	return context.Profile.Commands
+	return ctx.Profile.Commands
 }
 
 // GetRepos returns the repositories in the active profile.
 func GetRepos() []Repo {
-	if context == nil {
+	ctx := loadContext()
+	if ctx == nil {
 		return nil
 	}
-	return context.Profile.Repositories
+	return ctx.Profile.Repositories
 }
 
 // ExecuteCommand runs the tasks for the named command, applying any output configuration.
Original file line number	Diff line number	Diff line change
`@@ -67,18 +67,20 @@ func (c Command) IsZero() bool {`
`67`	`67`
`68`	`68`	`// GetCommands returns all commands available in the active profile.`
`69`	`69`	`func GetCommands() []Command {`
`70`		`- if context == nil {`
	`70`	`+ ctx := loadContext()`
	`71`	`+ if ctx == nil {`
`71`	`72`	`return nil`
`72`	`73`	`}`
`73`		`- return context.Profile.Commands`
	`74`	`+ return ctx.Profile.Commands`
`74`	`75`	`}`
`75`	`76`
`76`	`77`	`// GetRepos returns the repositories in the active profile.`
`77`	`78`	`func GetRepos() []Repo {`
`78`		`- if context == nil {`
	`79`	`+ ctx := loadContext()`
	`80`	`+ if ctx == nil {`
`79`	`81`	`return nil`
`80`	`82`	`}`
`81`		`- return context.Profile.Repositories`
	`83`	`+ return ctx.Profile.Repositories`
`82`	`84`	`}`
`83`	`85`
`84`	`86`	`// ExecuteCommand runs the tasks for the named command, applying any output configuration.`