localvault 1.7.0 → 1.8.1

data/lib/localvault/cli.rb

@@ -5,10 +5,106 @@ require "lipgloss"
 require_relative "env_projection"
 require_relative "key_lookup"
 require_relative "session_cache"
+require_relative "stdin_secret_input"
 require_relative "vault_resolver"
+require_relative "group_catalog"
 
 module LocalVault
   class CLI < Thor
+    USAGE_EXIT_STATUS = 1
+    GROUP_ALL_SENTINEL = "\0localvault-all-groups"
+    GROUP_OFF_SENTINEL = "\0localvault-groups-off"
+    CommandStatus = Data.define(:code) do
+      def self.ok
+        new(0)
+      end
+
+      def self.error
+        new(1)
+      end
+    end
+    class GroupSaveError < Thor::Error
+      attr_reader :kind, :candidates
+
+      def initialize(kind, candidates: [])
+        @kind = kind
+        @candidates = candidates
+        super("group save failed")
+      end
+
+      def exit_status
+        1
+      end
+    end
+    class GroupSelectionError < Thor::Error
+      attr_reader :kind, :query, :candidates
+
+      def initialize(kind, query:, candidates: [])
+        @kind = kind
+        @query = query
+        @candidates = candidates
+        super("group selection failed")
+      end
+
+      def exit_status
+        1
+      end
+    end
+    class SetValueSourceError < Thor::Error
+      attr_reader :kind
+
+      def initialize(kind, message)
+        @kind = kind
+        super(message)
+      end
+
+      def exit_status
+        1
+      end
+    end
+
+    def self.start(given_args = ARGV, config = {})
+      require_relative "cli/error_presenter"
+      config[:shell] ||= Thor::Base.shell.new
+      result = dispatch(nil, normalize_legacy_group_option(given_args.dup), nil, config)
+      result.is_a?(CommandStatus) ? result.code : 0
+    rescue Thor::Error => error
+      ErrorPresenter.new(self, given_args).render(error)
+      error.respond_to?(:exit_status) ? error.exit_status : USAGE_EXIT_STATUS
+    rescue Errno::EPIPE
+      0
+    end
+
+    def self.normalize_legacy_group_option(arguments)
+      command = arguments.first
+      matches = all_commands.keys.select { |name| name.start_with?(command.to_s) }
+      return arguments unless command == "show" || matches == ["show"]
+
+      normalized = []
+      index = 0
+      while index < arguments.length
+        argument = arguments[index]
+        if argument == "--"
+          normalized.concat(arguments[index..])
+          break
+        end
+        if argument == "--group" && arguments[index + 1]&.match?(/\A(?:true|false|t|f)\z/i)
+          enabled = arguments[index + 1].match?(/\A(?:true|t)\z/i)
+          normalized << "--group=#{enabled ? GROUP_ALL_SENTINEL : GROUP_OFF_SENTINEL}"
+          index += 2
+          next
+        end
+
+        case argument
+        when /\A--group=(?:true|t)\z/i then normalized << "--group=#{GROUP_ALL_SENTINEL}"
+        when /\A--group=(?:false|f)\z/i, "--no-group", "--skip-group" then normalized << "--group=#{GROUP_OFF_SENTINEL}"
+        else normalized << argument
+        end
+        index += 1
+      end
+      normalized
+    end
+
     class_option :vault, aliases: "-v", type: :string, desc: "Vault name"
 
     def self.help(shell, subcommand = false)
@@ -22,9 +118,13 @@ module LocalVault
       shell.say "  localvault demo               Create a demo vault to explore commands"
       shell.say ""
       shell.say "SECRETS"
-      shell.say "  localvault set KEY VALUE      Store a secret"
+      shell.say "  printf '%s' \"$SECRET\" | localvault set KEY --stdin"
+      shell.say "                              Store a secret without argv/history exposure"
+      shell.say "  localvault set KEY VALUE      Store a secret (compatibility path)"
+      shell.say "  localvault set --group G K V  Store a secret inside group G"
       shell.say "  localvault get KEY            Retrieve a secret"
       shell.say "  localvault show               Display all secrets (masked by default)"
+      shell.say "  localvault groups [QUERY]     List or search stored groups (names only)"
       shell.say "  localvault list               List secret key names"
       shell.say "  localvault delete KEY         Remove a secret"
       shell.say "  localvault import FILE        Bulk-import from .env / .json / .yml"
@@ -71,6 +171,8 @@ module LocalVault
       shell.say "AI / MCP"
       shell.say "  localvault install-mcp        Configure MCP server in your AI tool"
       shell.say "  localvault mcp                Start MCP server (stdio)"
+      shell.say "  localvault mcp --check        Check setup and active-vault readiness"
+      shell.say "  Agents: list names, then use localvault_build_exec for safe injection"
       shell.say ""
       shell.say "LEGACY SHARING  (pre-v1.2 direct share, still works as fallback)"
       shell.say "  localvault keygen             Generate X25519 keypair (same as `keys generate`)"
@@ -82,6 +184,7 @@ module LocalVault
       shell.say "  localvault login --status     Show current login status"
       shell.say "  localvault logout             Log out"
       shell.say "  localvault version            Print version"
+      shell.say "  localvault doctor             Check install and PATH readiness"
       shell.say "  localvault help [COMMAND]     Full help for any command"
       shell.say ""
     end
@@ -110,10 +213,14 @@ module LocalVault
       abort_with e.message
     end
 
-    desc "set KEY VALUE", "Store a secret (supports dot-notation for nested keys)"
+    desc "set KEY [VALUE]", "Store a secret (supports dot-notation for nested keys)"
     long_desc <<~DESC
       Store a secret in the current vault.
 
+      SAFE INPUT (preferred):
+\x05    printf '%s' "$SECRET" | localvault set KEY --stdin
+\x05    printf '%s' "$SECRET" | localvault set --group GROUP KEY --stdin
+
       FLAT KEY (simple):
 \x05    localvault set DATABASE_URL postgres://localhost/myapp
 \x05    localvault set STRIPE_KEY sk_live_abc123
@@ -123,14 +230,47 @@ module LocalVault
 \x05    localvault set platepose.SECRET_KEY_BASE abc123          -v intellectaco
 \x05    localvault set inventlist.STRIPE_KEY sk_live_abc123      -v intellectaco
 
+      GUIDED GROUP SAVE (same storage, easier to discover):
+\x05    localvault set --group GROUP KEY VALUE
+\x05    localvault set GROUP.KEY VALUE
+\x05    localvault groups [QUERY]
+
+      Positional values may be visible in process lists and shell history.
       The dot separates project from key name. One vault can hold many projects.
       Use `localvault show -p platepose -v vault` to view a single project.
       Use `localvault import` to bulk-load from a .env, .json, or .yml file.
     DESC
-    def set(key, value)
+    method_option :group, type: :string, desc: "Store KEY and VALUE inside this named group"
+    method_option :stdin, type: :boolean, default: false, desc: "Read VALUE from stdin instead of argv"
+    def set(key, value = nil)
+      validate_secret_value_source!(value)
       vault = open_vault!
-      vault.set(key, value)
-      $stdout.puts "Set #{key} in vault '#{vault.name}'"
+      if options[:group]
+        group = canonical_group_name(vault, options[:group])
+        validate_group_segment!(group)
+        validate_group_segment!(key)
+        raise GroupSaveError, :collision if vault.all.key?(group) && !vault.all[group].is_a?(Hash)
+        value = read_secret_value(value)
+        vault.set("#{group}.#{key}", value)
+        $stdout.puts "Set #{key} in group `#{group}` in vault `#{vault.name}`."
+        $stdout.puts
+        $stdout.puts "Stored as:"
+        $stdout.puts "  #{group}.#{key}"
+      else
+        value = read_secret_value(value)
+        vault.set(key, value)
+        $stdout.puts "Set #{key} in vault '#{vault.name}'"
+      end
+    rescue StdinSecretInput::InteractiveInput, StdinSecretInput::InvalidEncoding => e
+      raise SetValueSourceError.new(:stdin, e.message)
+    rescue Vault::InvalidKeyName => e
+      raise GroupSaveError, :invalid if options[:group]
+      abort_with e.message
+      CommandStatus.error
+    rescue RuntimeError => e
+      raise GroupSaveError, :collision if options[:group]
+      abort_with e.message
+      CommandStatus.error
     end
 
     desc "get KEY", "Retrieve a secret value by key"
@@ -185,6 +325,30 @@ module LocalVault
       vault.list.each { |key| $stdout.puts key }
     end
 
+    desc "groups [QUERY]", "List or search stored secret groups without revealing values"
+    long_desc <<~DESC
+      Discover dot-notation namespaces and flat-key prefix groups.
+
+\x05    localvault groups
+\x05    localvault groups str
+\x05    localvault show --group STRIPE
+\x05    localvault set --group STRIPE API_KEY VALUE
+    DESC
+    def groups(query = nil)
+      vault = open_vault!
+      matches = GroupCatalog.new(vault.all).search(query)
+      if matches.empty?
+        $stdout.puts "No groups match #{query}"
+        return
+      end
+
+      heading = query ? "Groups matching `#{query}`" : "Groups"
+      $stdout.puts "#{heading} in vault `#{vault.name}`:"
+      $stdout.puts
+      $stdout.printf("  %-20s %-6s %s\n", "Group", "Keys", "Kind")
+      matches.each { |group| $stdout.printf("  %-20s %-6d %s\n", group.name, group.count, group.kind) }
+    end
+
     desc "delete KEY", "Remove a secret or entire project group"
     long_desc <<~DESC
       Delete a single key or an entire project group.
@@ -350,14 +514,15 @@ module LocalVault
 \x05    localvault show -p platepose -v intellectaco  # one project only
 \x05    localvault show -p platepose -v intellectaco --reveal
     DESC
-    method_option :group,   type: :boolean, default: false, desc: "Group flat keys by common prefix"
+    method_option :group, type: :string, lazy_default: GROUP_ALL_SENTINEL, desc: "Show all groups or one group by name"
     method_option :reveal,  type: :boolean, default: false, desc: "Show full values instead of masking"
     method_option :project, aliases: "-p", type: :string,   desc: "Show only this project group"
     def show
       vault = open_vault!
       secrets = vault.all
 
-      if secrets.empty?
+      named_group_query = options[:group] && ![GROUP_ALL_SENTINEL, GROUP_OFF_SENTINEL].include?(options[:group])
+      if secrets.empty? && !named_group_query
         $stdout.puts "No secrets in vault '#{vault.name}'."
         return
       end
@@ -369,7 +534,17 @@ module LocalVault
           return
         end
         render_table(group.sort.to_h, "#{vault.name}/#{options[:project]}", reveal: options[:reveal])
-      elsif options[:group] || secrets.values.any? { |v| v.is_a?(Hash) }
+      elsif options[:group] && ![GROUP_ALL_SENTINEL, GROUP_OFF_SENTINEL].include?(options[:group])
+        match = GroupCatalog.new(secrets).resolve(options[:group])
+        if match.group
+          entries = match.group.entries.to_h { |entry| [entry.label, entry.value] }
+          render_table(entries, "#{vault.name}/#{match.group.name}", reveal: options[:reveal])
+        elsif match.kind == :ambiguous
+          raise GroupSelectionError.new(:ambiguous, query: options[:group], candidates: match.groups.map(&:name))
+        else
+          raise GroupSelectionError.new(:absent, query: options[:group])
+        end
+      elsif options[:group] != GROUP_OFF_SENTINEL && (options[:group] || secrets.values.any? { |v| v.is_a?(Hash) })
         render_grouped_table(secrets, vault.name, reveal: options[:reveal])
       else
         render_table(secrets.sort.to_h, vault.name, reveal: options[:reveal])
@@ -468,8 +643,44 @@ module LocalVault
     end
 
     desc "mcp", "Start MCP server (stdio)"
+    long_desc <<~DESC
+      Start LocalVault's stdio MCP server for an AI client.
+
+      Install and verify:
+\x05    localvault install-mcp [claude-code|cursor|windsurf]
+\x05    localvault mcp --check
+\x05    localvault show
+
+      Do not run `localvault mcp` directly to test it: stdio servers wait for
+      JSON-RPC input and therefore appear idle. Use `--check`, then restart the
+      configured AI client.
+
+      Agents should call `list_secrets`, then `localvault_build_exec` to inject
+      secrets into a subprocess. Plaintext `get_secret` requires the explicit
+      `allow_plaintext: true` acknowledgement.
+    DESC
+    method_option :check, type: :boolean, default: false, desc: "Check installation and active-vault readiness, then exit"
     def mcp
-      require "localvault/mcp/server"
+      if options[:check]
+        require_relative "mcp/tools"
+        status = VaultResolver.readiness_status(options[:vault])
+        ready = status["active_vault_unlocked"]
+        tool_names = MCP::Tools::DEFINITIONS.map { |definition| definition.fetch("name") }
+        $stdout.puts "LocalVault #{VERSION}"
+        $stdout.puts "Home: #{Config.root_path}"
+        $stdout.puts "MCP readiness: #{ready ? "ready" : "locked"}"
+        $stdout.puts "Active vault: #{status["active_vault"]} (#{status["active_vault_source"]})"
+        $stdout.puts "Vault session: #{ready ? "available" : "unlock with `localvault show`"}"
+        $stdout.puts "MCP tools: #{tool_names.join(", ")}"
+        $stdout.puts "Plaintext gate: enabled"
+        $stdout.puts "Server instructions: enabled"
+        $stdout.puts
+        $stdout.puts "Safe agent workflow: list_secrets → localvault_build_exec → run the generated command"
+        $stdout.puts "Plaintext retrieval is opt-in with allow_plaintext: true."
+        return ready ? CommandStatus.ok : CommandStatus.error
+      end
+
+      require_relative "mcp/server"
       MCP::Server.new.start
     end
 
@@ -1281,8 +1492,48 @@ module LocalVault
       $stdout.puts "localvault #{VERSION}"
     end
 
+    desc "doctor", "Check install and PATH readiness"
+    long_desc <<~DESC
+      Check whether the localvault executable selected by PATH matches the
+      install you expect.
+
+      This catches common Homebrew/asdf shadowing issues after upgrades:
+\x05    localvault doctor
+\x05    which -a localvault
+    DESC
+    def doctor
+      paths = localvault_paths
+      warnings = localvault_path_warnings(paths)
+
+      $stdout.puts "LocalVault doctor"
+      $stdout.puts "Version: localvault #{VERSION}"
+      $stdout.puts "Home: #{Config.root_path}"
+
+      if paths.empty?
+        $stdout.puts "Executable selected by PATH: not found"
+      else
+        $stdout.puts "Executable selected by PATH: #{paths.first}"
+        $stdout.puts "All localvault executables on PATH:"
+        paths.each_with_index { |path, index| $stdout.puts "  #{index + 1}. #{path}" }
+      end
+
+      if warnings.empty?
+        $stdout.puts "PATH: ok"
+        CommandStatus.ok
+      else
+        $stdout.puts
+        warnings.each { |warning| $stdout.puts "Warning: #{warning}" }
+        $stdout.puts
+        $stdout.puts "Suggested checks:"
+        $stdout.puts "  asdf reshim ruby"
+        $stdout.puts "  hash -r"
+        $stdout.puts "  which -a localvault"
+        CommandStatus.error
+      end
+    end
+
     def self.exit_on_failure?
-      true
+      false
     end
 
     no_commands do
@@ -1307,6 +1558,39 @@ module LocalVault
 
     private
 
+    def validate_secret_value_source!(value)
+      if options[:stdin] && !value.nil?
+        raise SetValueSourceError.new(:multiple, "Use either a positional VALUE or --stdin, not both.")
+      end
+
+      return if options[:stdin] || !value.nil?
+
+      raise SetValueSourceError.new(:missing, "Provide a VALUE or read one with --stdin.")
+    end
+
+    def read_secret_value(value)
+      return value unless options[:stdin]
+
+      StdinSecretInput.read($stdin)
+    end
+
+    def canonical_group_name(vault, supplied)
+      groups = GroupCatalog.new(vault.all).groups
+      return supplied if groups.any? { |group| group.name == supplied }
+
+      insensitive = groups.select { |group| group.name.casecmp?(supplied) }
+      return insensitive.first.name if insensitive.one?
+      raise GroupSaveError.new(:ambiguous, candidates: insensitive.map(&:name)) if insensitive.length > 1
+
+      supplied
+    end
+
+    def validate_group_segment!(segment)
+      unless segment.match?(Vault::KEY_SEGMENT_PATTERN) && segment.length <= 128
+        raise GroupSaveError, :invalid
+      end
+    end
+
     # ── Demo data ──────────────────────────────────────────────────
     DEMO_DATA = {
       "default" => {
@@ -1694,22 +1978,57 @@ module LocalVault
     def print_next_steps(client_name)
       $stdout.puts ""
       $stdout.puts "Next steps:"
-      $stdout.puts "  1. Restart #{client_name}"
-      $stdout.puts "  2. Unlock your vault once:  localvault show"
-      $stdout.puts "  3. The AI can now access secrets from your default vault"
+      $stdout.puts "  1. Unlock your vault once:  localvault show"
+      $stdout.puts "  2. Verify readiness:         localvault mcp --check"
+      $stdout.puts "  3. Restart #{client_name}"
+      $stdout.puts "  4. Ask the agent to list names, then use localvault_build_exec"
+      $stdout.puts "     for process injection. Plaintext get_secret is explicit opt-in."
       $stdout.puts "     Switch vaults: localvault switch <vault>"
     end
 
     no_commands do
       def find_binary(name)
-        path = `which #{name} 2>/dev/null`.strip
-        path.empty? ? nil : path
+        executable_paths_for(name).first
       end
 
       def system_command_exists?(cmd)
         !find_binary(cmd).nil?
       end
 
+      def localvault_paths
+        executable_paths_for("localvault")
+      end
+
+      def executable_paths_for(name)
+        ENV.fetch("PATH", "").split(File::PATH_SEPARATOR).filter_map do |directory|
+          next if directory.empty?
+
+          path = File.join(directory, name)
+          path if File.executable?(path) && !File.directory?(path)
+        end.uniq
+      end
+
+      def localvault_path_warnings(paths)
+        warnings = []
+        if paths.empty?
+          warnings << "localvault is not on PATH. Brew upgrades may be installed but unreachable."
+          return warnings
+        end
+
+        if paths.first.include?("/.asdf/shims/") && paths.any? { |path| homebrew_localvault_path?(path) }
+          warnings << "PATH selects an asdf shim before Homebrew localvault. " \
+            "A stale shim can hide the upgraded brew executable."
+        elsif paths.length > 1
+          warnings << "Multiple localvault executables are on PATH. Confirm the first entry is the one you intend."
+        end
+
+        warnings
+      end
+
+      def homebrew_localvault_path?(path)
+        path.start_with?("/opt/homebrew/bin/", "/usr/local/bin/")
+      end
+
       def cursor_settings_path
         File.expand_path("~/.cursor/mcp.json")
       end

data/lib/localvault/env_projection.rb

@@ -1,3 +1,5 @@
+require_relative "input_validation"
+
 module LocalVault
   module EnvProjection
     class InvalidMapping < StandardError; end
@@ -34,7 +36,10 @@ module LocalVault
     def self.parse_selectors(value)
       values = Array(value).compact.flat_map { |v| v.to_s.split(",") }
       selectors = values.map(&:strip).reject(&:empty?)
+      selectors.each { |selector| InputValidation.selector!(selector) }
       selectors.empty? ? nil : selectors
+    rescue InputValidation::InvalidInput => e
+      raise InvalidMapping, e.message
     end
 
     def self.parse_map(value)
@@ -43,10 +48,12 @@ module LocalVault
 
         key, env_name = pair.split("=", 2).map(&:strip)
         raise InvalidMapping, "Invalid map '#{pair}'. Use KEY=ENV_NAME" if key.to_s.empty? || env_name.to_s.empty?
-        raise InvalidMapping, "Invalid environment variable name '#{env_name}'" unless safe_env_name?(env_name)
+        InputValidation.mapping!(key, env_name)
 
         hash[key] = env_name
       end
+    rescue InputValidation::InvalidInput => e
+      raise InvalidMapping, e.message
     end
 
     def self.profile_config(profile)

data/lib/localvault/group_catalog.rb

@@ -0,0 +1,67 @@
+module LocalVault
+  class GroupCatalog
+    Entry = Data.define(:label, :value, :source_kind)
+    Group = Data.define(:name, :kind, :entries) do
+      def count
+        entries.length
+      end
+    end
+    Match = Data.define(:kind, :query, :groups) do
+      def group
+        groups.one? ? groups.first : nil
+      end
+    end
+
+    attr_reader :groups
+
+    def initialize(secrets)
+      grouped = {}
+
+      secrets.each do |name, value|
+        if value.is_a?(Hash)
+          append_namespace(grouped, name, value)
+        elsif name.include?("_")
+          append_entry(grouped, name.split("_", 2).first, Entry.new(name, value, :prefix))
+        end
+      end
+
+      @groups = grouped.map do |name, entries|
+        kinds = entries.map(&:source_kind).uniq
+        kind = kinds.length > 1 ? :mixed : kinds.first
+        Group.new(name, kind, entries.sort_by(&:label).freeze)
+      end.sort_by { |group| [group.name.downcase, group.name] }.freeze
+    end
+
+    def search(query = nil)
+      return groups if query.nil? || query.empty?
+
+      needle = query.downcase
+      groups.select { |group| group.name.downcase.start_with?(needle) }
+    end
+
+    def resolve(query)
+      exact = groups.select { |group| group.name == query }
+      return Match.new(:exact, query, exact) if exact.one?
+
+      insensitive = groups.select { |group| group.name.casecmp?(query) }
+      return Match.new(:unique, query, insensitive) if insensitive.one?
+      return Match.new(:ambiguous, query, insensitive) if insensitive.length > 1
+
+      matches = search(query)
+      kind = matches.one? ? :unique : (matches.empty? ? :absent : :ambiguous)
+      Match.new(kind, query, matches)
+    end
+
+    private
+
+    def append_namespace(grouped, name, values)
+      values.each do |label, value|
+        append_entry(grouped, name, Entry.new(label, value, :namespace))
+      end
+    end
+
+    def append_entry(grouped, name, entry)
+      (grouped[name] ||= []) << entry
+    end
+  end
+end

data/lib/localvault/input_validation.rb

@@ -0,0 +1,80 @@
+module LocalVault
+  module InputValidation
+    class InvalidInput < StandardError; end
+
+    SEGMENT_PATTERN = /\A[A-Za-z_][A-Za-z0-9_]*\z/
+    VAULT_PATTERN = /\A[A-Za-z0-9][A-Za-z0-9_-]{0,63}\z/
+    PROFILES = %w[aws].freeze
+
+    module_function
+
+    def selector!(value)
+      string!(value, "selector")
+      reject_delimiters!(value, "selector")
+      parts = value.split(".", -1)
+      valid = parts.length == 1 ? segment?(parts.first) :
+        parts.length == 2 && segment?(parts.first) && (segment?(parts.last) || parts.last == "*")
+      raise InvalidInput, "selector must be KEY, GROUP.KEY, or GROUP.*" unless valid
+
+      value
+    end
+
+    def mapping!(source, target)
+      selector!(source)
+      raise InvalidInput, "mapping source must be an exact key" if source.end_with?(".*")
+      string!(target, "mapping target")
+      reject_delimiters!(target, "mapping target")
+      raise InvalidInput, "mapping target must be an environment variable name" unless segment?(target)
+
+      [source, target]
+    end
+
+    def project!(value)
+      string!(value, "project")
+      reject_delimiters!(value, "project")
+      raise InvalidInput, "project must be one key segment" unless segment?(value)
+
+      value
+    end
+
+    def vault_name!(value)
+      string!(value, "vault")
+      raise InvalidInput, "vault must be a valid vault name" unless value.match?(VAULT_PATTERN)
+
+      value
+    end
+
+    def argv!(value)
+      unless value.is_a?(Array) && !value.empty? &&
+          value.all? { |token| token.is_a?(String) && !token.empty? && !token.include?("\0") }
+        raise InvalidInput, "command must be a non-empty array of non-empty NUL-free strings"
+      end
+
+      value
+    end
+
+    def profile!(value)
+      string!(value, "profile")
+      raise InvalidInput, "profile must be one of: #{PROFILES.join(", ")}" unless PROFILES.include?(value)
+
+      value
+    end
+
+    def segment?(value)
+      value.is_a?(String) && value.match?(SEGMENT_PATTERN)
+    end
+
+    def string!(value, label)
+      raise InvalidInput, "#{label} must be a non-empty string" unless value.is_a?(String) && !value.empty?
+      raise InvalidInput, "#{label} must not contain NUL bytes" if value.include?("\0")
+    end
+
+    def reject_delimiters!(value, label)
+      if value.include?(",") || value.include?("=")
+        raise InvalidInput, "#{label} must not contain commas or equals signs"
+      end
+    end
+
+    private_class_method :string!, :reject_delimiters!
+  end
+end