[fylorn]

Review fixes for packs, import and restore on the sync-and-backup branch.

Import

• A pack without secrets reuses the keys here only when overwriting an item whose destination is unchanged: same scheme, host and port (default ports filled in), AWS region, OAuth token endpoint, and proxy type and address. Otherwise the secret stays blank, the row is flagged missing_key, and the upstream comes in disabled. An item imported under another name never takes the keys here. Changing only the path keeps the keys.
• A proxy with a blank password is flagged missing_key.

Restore

• A route whose target names a group that is gone resolves to that group: kept (referenced) when the group is being removed, brought back when only the route is chosen.
• Proxies referenced by this machine's own sections (the sync location's proxy) are kept; a whole restore copies the proxy definition over when the version lacks it.
• Restoring a version from the sync location (sync-…) leaves sync.exclude upstreams, and the items that follow them, out of the comparison; they keep their current place in the order.
• POST /backups/preview accepts items and runs the same plan as POST /backups/restore. The restore now answers RestoreWritten { version, rows }, where rows are the rows actually applied (dependencies included, kept set for what stayed).
• Text that does not read as YAML is no longer recorded as a version; a whole restore takes this machine's sections from the newest readable version that differs from the current text.

Other

• Pinned keys no longer expire. A source replaces its own set under one lock; at most 64 sources (the least recently reported goes), source up to 128 bytes, up to 1024 names of up to 256 bytes each, otherwise 400 with backup.pinned.source_too_long, backup.pinned.too_many or backup.pinned.name_too_long. The older file shapes (a plain array, or {"names": [...]}) read as the blank source.
• Plugin files put back at startup are reloaded by the gateway. They are put back only when neither the script nor the approved copy matches the approved hash, so an unapproved edit is left alone.
• The 64 KiB preference limit is checked for the preferences being written, and write_prefs refuses oversized ones for every writer; a large one already stored no longer blocks imports and restores.
• A passphrase pack that needs more work than allowed reports pack.too_much_work (required, max) instead of pack.corrupt.

Tests

Regression tests cover each item: destination changes (host, port, scheme, AWS region, OAuth endpoint, proxy address) and rename, kept and chosen group routes, the sync proxy in partial and whole restores, excluded upstreams in a synced version, preview and write parity, readable versions, plugin healing and reload, pinned limits, concurrent reports and old files, stored oversized preferences, and the work-factor error.

🤖 Generated with Claude Code