[dgrieser]

Fixes the findings of a code review of v0.2.1. Every fix has a test that fails without it.

Security

• selfupdate: credential leak on cross-origin redirects (P1). Go's HTTP client copies every header of the first request to a redirect and strips only Authorization and cookies itself. PRIVATE-TOKEN, JOB-TOKEN and DEPLOY-TOKEN therefore reached whatever host a GitLab package download redirected to, such as object storage. The credential header is now dropped as soon as a redirect leaves the origin (scheme, host and port) of the first request, and stays off if a later redirect returns there. A caller's CheckRedirect still applies. Affects v0.1.0 to v0.2.1 when downloading from GitLab with a token.

Fixes

• secret: Fallback with an unavailable keyring and an empty file store (P2). Get returned only the keyring failure, which Resolve treats as fatal, so it never prompted. The error now wraps ErrNotFound as well as the keyring failure.
• secret: piped secret on an open pipe (P2). Resolve read up to MaxLen or EOF before looking for the newline, so a pipe that stayed open blocked it. It now reads up to the first newline only and leaves the rest of stdin unread.
• cobrax: spaced booleans across commands (P2). Marked flag names were collected from the whole command tree, so marking a --stable also rewrote b --stable false. JoinSpacedBoolValues now resolves the selected command the way cobra does and joins only flags that command has marked, its own or inherited.
• live: retained frame (P2). Draw kept the caller's slice; reusing it for the next frame changed how far the next draw moved up. It now keeps a copy.
• pick: tall checklists and toggles (P2). All rows were drawn whatever the terminal height, so a long set scrolled off and redraws piled up. They now draw a row window that follows the cursor, with an "N of M" line while rows are hidden.
• pick: lazy view load (P2). The first switch to a view with Load dropped the selected key and landed on the first row. The key is now kept until the rows are loaded.
• pick: group-view titles (P3). View.Title was applied only to views with their own rows. Group-filtered views now use it too.

Behavior changes

• JoinSpacedBoolValues no longer joins a flag the selected command does not have.
• Fallback.Get returns an error matching ErrNotFound where it returned only the primary's failure.
• A piped secret no longer consumes the rest of stdin.

Verification

• go test -race ./...
• golangci-lint (with gosec) for GOOS linux, darwin and windows: 0 issues
• go mod tidy -diff, cross-builds for linux, darwin, windows and freebsd

🤖 Generated with Claude Code