quonfig 1.7.1 → 1.7.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1b22d7d46b27ff2ab1452b41eaa68940d886216aaeb16c61a3faddf0778d352c
-  data.tar.gz: 0ca1f8e621bcfcd839a28d1d754560b5cf023eff205b24b83049196e64a8e4b0
+  metadata.gz: 07d679520810cf5814af80cd173f859976ce05ccd24f2c03bcbd417b57565a17
+  data.tar.gz: aebf8fecb3821bd58cfa1465028ddefadf977e1c4c30d11f18e486ef2c290e67
 SHA512:
-  metadata.gz: 720d2acbfe8d30a785c1197fa319d608b1b4e11a1b60657b23d7b3dd921ed0c4882c99e7446b469a009552f09ca54538482509d9dc6a6968dc11df6f0e42d7c2
-  data.tar.gz: 11a8f0fbb7851dba082a46a7b657e9ec49aa61ae4af155cf9bf2272a35a3e5f75fa8148acdf0f3df8b936798cae5d8619dbc86bb981199f5bf29ceadf5f79567
+  metadata.gz: 8823f04fc9b80149680bb384355309f2df1cca790932ede846c56f2a116f0aa9ae88858f956b43c11360aa546e979777652541e027a1865246335564c2d33b1a
+  data.tar.gz: 1f930fffeba37875820d6871d1b9ec83981579856d12e79a5c812919a1a41f9d262618450e986d138bd1bdd84d69eb9fd4a240bd678cecdfe3bf464c8cd25aa3

data/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 1.7.2 - 2026-10-09
+
+- **Fix (security): `TypeMismatchError` and `EnvVarParseError` messages no longer include the value (qfg-goi1.2.11).** Reading a `confidential` or `decryptWith` config through the wrong typed getter (for example `get_int` on a secret) put the decrypted plaintext into the exception message and into `*_details.error_message`, which end up in logs and error trackers. An unparseable ENV_VAR or a malformed stored duration put the raw value into `EnvVarParseError`. The messages now name the key, the expected type and the actual class (`TypeMismatchError`), or the key, the env var name (or `stored value`) and the target type (`EnvVarParseError`). The doubled word in `expected expected Integer` is fixed. Only the message text changes; the exception classes and when they are raised are unchanged.
+- **Fix: datadir mode and the dev-context loader read their JSON files as UTF-8 whatever the process locale (qfg-goi1.2.11, qfg-xy92).** Under `LANG` unset or `LANG=C` (systemd units, cron, many minimal and distroless images) Ruby's default external encoding is US-ASCII, and any non-ASCII byte in a config file (for example an em dash in a `description`) or in `quonfig.json` made `Client.new` raise `Encoding::InvalidByteSequenceError`, so the app could not boot in datadir mode. The same applied to a non-ASCII email in `~/.quonfig/tokens.json`. These files are now always read as UTF-8.
+- **Fix: `SemanticLoggerFilter` no longer raises out of the host app's log calls (qfg-goi1.2.11).** `Client#get` raises on a resolution error (for example `MissingEnvVarError` when the log level is provided by an env var that is unset on this host, or `DecryptionError`) even when a default is passed, and the filter let that escape, so every log call through SemanticLogger raised. The filter now treats any such error like a missing key: it returns `true` and SemanticLogger's own static level decides.
+- **Docs: the README typed-getter section now matches the code (qfg-goi1.2.11).** It documented `get_string(key, contexts = nil)`, said a missing key or a type mismatch returns `nil`, and said `get_duration` returns `Float` seconds; the examples passed the context as `user: {...}`, which raises `ArgumentError: unknown keyword: :user`. The getters are `get_*(key, default:, context:)`; a missing key returns `default:` or follows `on_no_default` (`:raise` by default); a type mismatch raises `TypeMismatchError`; `get_duration` returns integer milliseconds. No code change.
+- **Fix: concurrent `Quonfig.init` calls build one client (qfg-goi1.2.11).** The "already initialized" check ran outside the write lock, so two threads calling `Quonfig.init` at the same time could each build a `Client`, leaving one orphaned with a live SSE stream and telemetry thread that nothing stopped. The check is now repeated inside the lock; the second caller gets the existing client and the usual "already initialized" warning.
+- **Tests: pin `minitest` below 6 in the Gemfile (qfg-goi1.2.11).** A fresh resolve without `Gemfile.lock` picked minitest 6.0.6, which drops `minitest/mock`, and the suite failed to load. The committed lock already held 5.27.0, so CI was unaffected. No library change.
+- **Fix: `PROP_MATCHES` / `PROP_DOES_NOT_MATCH` regexes have a 0.1s match timeout on Ruby 3.2+ (qfg-goi1.2.11).** A pattern that backtracks catastrophically (backreferences and lookarounds defeat Ruby 3.2's regex memoization) could pin the evaluating thread for seconds to hours. On Ruby 3.2+ the match now stops after 0.1s and the criterion does not match, the same as an invalid regex. Ruby 3.0 and 3.1 have no regex timeout and are unchanged.
+- **Chaos: `server_metric(...)` expectations are now reported as SKIPPED with a reason instead of silently evaluating to 0 and passing (qfg-goi1.1.3).** api-delivery exports its metrics only by OTLP push, so the rig has nothing to scrape; server-side lag is covered by the staging drill (qfg-47c2.19) and the `QuonfigSubscriberLagHigh` alert. Each skipped expectation prints a `SKIP` line with the reason, the scenario summary counts skips separately, and the run ends with a tally of every skipped expression. In a compound expression the skipped leaf is neutral: the other leaves are still enforced (scenario 02 still requires `connected`). No library change.
+- **Chaos: an unknown `client.sdkMetric(...)` name now fails the expectation with `unknown sdkMetric "<name>"` instead of silently evaluating to 0 (qfg-goi1.2.21).** The chaos probe returned 0 for any metric it did not implement, so a typo such as `client.sdkMetric('typo_total') == 0` passed without checking anything. The probe now reports the name as unknown and the evaluator fails loudly, matching sdk-go. Every metric name used by integration-test-data `v2026.10.03` is implemented, so no current result changes. No library change.
+- **CI: the Chaos and Failover Chaos workflows now run integration-test-data `v2026.10.03`, the same tag as the unit and contract tests (qfg-goi1.1.3).** They were on `v2026.05.13` and `v2026.06.19.1`. The new tag adds the continuous freshness hold on scenario 05-sse-down (qfg-e3ja). Both workflows still build api-delivery from `main` on purpose (they exist to catch api-delivery drift) and now write the resolved api-delivery SHA to the run summary. No library change.
+
 ## 1.7.1 - 2026-10-03
 
 - **Behaviour change (bug fix): weighted rollouts now hash non-ASCII text the same way as every other Quonfig SDK (qfg-1mvb).** The MurmurHash3 used to pick a weighted variant counted characters instead of UTF-8 bytes, so a config key or hash value containing non-ASCII text (for example `josé`, `日本語`, `🚀`) hashed to a different number than sdk-java, sdk-python, sdk-go and sdk-node. It now hashes the UTF-8 bytes. Ruby users whose hash value (or the flag's key) contains non-ASCII characters may move to a different variant on upgrade; afterwards they get the same variant as in the other SDKs. ASCII-only values and keys are unchanged.

data/README.md

@@ -35,8 +35,8 @@ limit   = client.get_int('rate-limit')
 name    = client.get_string('app.display-name')
 regions = client.get_string_list('allowed-regions')
 
-# Context-aware evaluation — pass a context hash as the last argument
-value = client.get_string('homepage-hero', user: { key: 'user-123', country: 'US' })
+# Context-aware evaluation — pass a context hash with `context:`
+value = client.get_string('homepage-hero', context: { user: { key: 'user-123', country: 'US' } })
 ```
 
 ## Context
@@ -47,7 +47,7 @@ attach a context in three ways:
 ### 1. Per-call context
 
 ```ruby
-client.get_bool('beta-feature', user: { key: 'user-123', plan: 'pro' })
+client.get_bool('beta-feature', context: { user: { key: 'user-123', plan: 'pro' } })
 ```
 
 ### 2. `with_context` block
@@ -333,31 +333,43 @@ model.
 
 ## Typed getters
 
-Each typed getter takes a config key and an optional context hash. If the key
-is missing or the stored value does not match the requested type, the getter
-returns `nil`.
-
-| Method                                          | Returns                       |
-|-------------------------------------------------|-------------------------------|
-| `get_string(key, contexts = nil)`               | `String` or `nil`             |
-| `get_int(key, contexts = nil)`                  | `Integer` or `nil`            |
-| `get_float(key, contexts = nil)`                | `Float` or `nil`              |
-| `get_bool(key, contexts = nil)`                 | `true`, `false`, or `nil`     |
-| `get_string_list(key, contexts = nil)`          | `Array<String>` or `nil`      |
-| `get_duration(key, contexts = nil)`             | `Float` (seconds) or `nil`    |
-| `get_json(key, contexts = nil)`                 | `Hash`, `Array`, or `nil`     |
-| `enabled?(feature_name, contexts = nil)`        | `true` or `false`             |
+Each typed getter takes a config key plus two optional keyword arguments:
+`default:` (returned when the key is missing) and `context:` (a context hash
+for this call). On a `BoundClient` (see `with_context` above) the getters take
+only `default:`; the context is the bound one.
+
+- **Missing key:** returns `default:` when you pass one. Without a default the
+  `on_no_default` option decides: `:raise` (the default) raises
+  `Quonfig::Errors::MissingDefaultError`, `:return_nil` returns `nil`.
+- **Wrong type:** a value that does not match the getter's type (for example
+  `get_int` on a string config) raises `Quonfig::Errors::TypeMismatchError`,
+  with or without a `default:`.
+
+| Method                                              | Returns                                   |
+|-----------------------------------------------------|-------------------------------------------|
+| `get_string(key, default:, context:)`               | `String`                                  |
+| `get_int(key, default:, context:)`                  | `Integer`                                 |
+| `get_float(key, default:, context:)`                | `Float`                                   |
+| `get_bool(key, default:, context:)`                 | `true` or `false`                         |
+| `get_string_list(key, default:, context:)`          | `Array<String>`                           |
+| `get_duration(key, default:, context:)`             | `Integer` (milliseconds)                  |
+| `get_json(key, default:, context:)`                 | `Hash`, `Array`, or a scalar              |
+| `enabled?(feature_name, context = nil)`             | `true` or `false` (`false` when missing)  |
+
+`get_duration` returns integer milliseconds (`PT1.5S` is `1500`). A duration
+value that is not valid ISO-8601 returns `default:` and logs one warning per
+key; with no default it follows `on_no_default`.
 
 Example:
 
 ```ruby
 client.get_string('app.display-name')
-client.get_int('rate-limit', user: { key: 'user-123' })
-client.get_float('pricing.multiplier')
-client.get_bool('flags.new-checkout')
-client.get_string_list('allowed-regions')
-client.get_duration('request-timeout')
-client.get_json('homepage.layout')
+client.get_int('rate-limit', default: 100, context: { user: { key: 'user-123' } })
+client.get_float('pricing.multiplier', default: 1.0)
+client.get_bool('flags.new-checkout', default: false)
+client.get_string_list('allowed-regions', default: [])
+client.get_duration('request-timeout', default: 5_000) # milliseconds
+client.get_json('homepage.layout', default: {})
 client.enabled?('beta-feature', user: { key: 'user-123' })
 ```
 

data/lib/quonfig/client.rb

@@ -1830,7 +1830,7 @@ module Quonfig
         # JSON values are returned as-is (Hash, Array, or scalar from the wire).
         value
       when Class
-        raise Quonfig::Errors::TypeMismatchError.new(key, "expected #{expected_type}", value) unless value.is_a?(expected_type)
+        raise Quonfig::Errors::TypeMismatchError.new(key, expected_type.to_s, value) unless value.is_a?(expected_type)
 
         value
       else

data/lib/quonfig/datadir.rb

@@ -39,7 +39,10 @@ module Quonfig
            .sort
            .each do |filename|
           path = File.join(dir, filename)
-          raw = JSON.parse(File.read(path))
+          # Always read as UTF-8: under LANG unset / LANG=C the process
+          # default is US-ASCII and JSON.parse would raise on any non-ASCII
+          # byte (qfg-goi1.2.11 / qfg-xy92).
+          raw = JSON.parse(File.read(path, encoding: 'UTF-8'))
           raise ArgumentError, "[quonfig] config has empty key — file is not a Quonfig Config: #{path}" if raw['key'].nil? || raw['key'].to_s.empty?
 
           coerce_numeric_values(raw)
@@ -68,7 +71,7 @@ module Quonfig
 
       raise ArgumentError, "[quonfig] Datadir is missing quonfig.json: #{quonfig_path}" unless File.exist?(quonfig_path)
 
-      environments = JSON.parse(File.read(quonfig_path)).fetch('environments', [])
+      environments = JSON.parse(File.read(quonfig_path, encoding: 'UTF-8')).fetch('environments', [])
 
       raise Quonfig::Errors::InvalidEnvironmentError.new(environment, environments) if !environments.empty? && !environments.include?(environment)
 

data/lib/quonfig/dev_context.rb

@@ -21,7 +21,8 @@ module Quonfig
       return nil unless File.exist?(path)
 
       raw = begin
-        File.read(path)
+        # UTF-8 regardless of the process locale (qfg-goi1.2.11 / qfg-xy92).
+        File.read(path, encoding: 'UTF-8')
       rescue StandardError => e
         LOG.warn "dev-context: could not read #{path} (#{e.class}: #{e.message}); skipping injection"
         return nil

data/lib/quonfig/errors/env_var_parse_error.rb

@@ -3,7 +3,7 @@
 module Quonfig
   module Errors
     class EnvVarParseError < Quonfig::Error
-      def initialize(env_var, config, env_var_name)
+      def initialize(_env_var, config, env_var_name)
         key, value_type =
           if config.is_a?(Hash)
             [config[:key] || config['key'],
@@ -11,7 +11,9 @@ module Quonfig
           else
             [config.key, config.value_type]
           end
-        super("Evaluating #{key} couldn't coerce #{env_var_name} of #{env_var} to #{value_type}")
+        # +_env_var+ (the raw value) is deliberately left out of the message:
+        # an env var or stored value can be a secret (qfg-goi1.2.11).
+        super("Evaluating #{key} couldn't coerce #{env_var_name} to #{value_type}")
       end
     end
   end

data/lib/quonfig/errors/type_mismatch_error.rb

@@ -3,8 +3,12 @@
 module Quonfig
   module Errors
     class TypeMismatchError < Quonfig::Error
+      # The message names the key, the expected type and the actual value's
+      # class only. The value itself is never interpolated: it can be a
+      # decrypted secret, and exception messages end up in logs and error
+      # trackers (qfg-goi1.2.11).
       def initialize(key, expected, actual_value)
-        super("Quonfig value for key '#{key}' expected #{expected}, got #{actual_value.class}: #{actual_value.inspect}")
+        super("Quonfig value for key '#{key}' expected #{expected}, got #{actual_value.class}")
       end
     end
   end

data/lib/quonfig/evaluator.rb

@@ -56,6 +56,14 @@ module Quonfig
 
     MAGIC_CURRENT_TIME_PROPS = %w[quonfig.current-time prefab.current-time reforge.current-time].freeze
 
+    # PROP_MATCHES / PROP_DOES_NOT_MATCH match timeout (qfg-goi1.2.11). Ruby
+    # 3.2+ supports Regexp.new(src, timeout:); Regexp::TimeoutError is a
+    # RegexpError, so a pattern that runs away (backreferences and lookarounds
+    # defeat Onigmo's memoization) does not match instead of pinning a
+    # thread. Ruby 3.0/3.1 have no timeout and are unchanged.
+    REGEX_MATCH_TIMEOUT_SECONDS = 0.1
+    REGEX_TIMEOUT_SUPPORTED = Regexp.respond_to?(:timeout)
+
     attr_reader :store
     attr_accessor :project_env_id, :env_id
 
@@ -218,7 +226,7 @@ module Quonfig
         mv = hget(match_value, :value)
         if context_exists && context_value.is_a?(String) && mv.is_a?(String)
           begin
-            re = Regexp.new(mv)
+            re = REGEX_TIMEOUT_SUPPORTED ? Regexp.new(mv, timeout: REGEX_MATCH_TIMEOUT_SECONDS) : Regexp.new(mv)
             matched = re.match?(context_value)
             return matched == (operator == OP_PROP_MATCHES)
           rescue RegexpError

data/lib/quonfig/quonfig.rb

@@ -11,6 +11,14 @@ module Quonfig
     end
 
     @@lock.with_write_lock do
+      # Re-check under the lock: two threads can both pass the check above,
+      # and the loser must not build (and orphan) a second Client with its
+      # own SSE stream and telemetry thread (qfg-goi1.2.11).
+      unless @singleton.nil?
+        LOG.warn 'Quonfig already initialized.'
+        next @singleton
+      end
+
       @singleton = Quonfig::Client.new(options)
     end
   end

data/lib/quonfig/semantic_logger_filter.rb

@@ -52,6 +52,10 @@ module Quonfig
 
     # SemanticLogger filter contract: return true to emit, false to suppress.
     # Missing config key → return true so SemanticLogger's static level decides.
+    # A resolution error (unset ENV_VAR, decryption failure, ...) is treated
+    # the same way: the filter runs inside the host app's log calls and must
+    # never raise out of them (qfg-goi1.2.11). Nothing is logged here, since
+    # logging from inside a log filter can recurse.
     def call(log)
       configured = @client.get(@config_key, nil, context_for(log))
       return true if configured.nil?
@@ -59,6 +63,8 @@ module Quonfig
       log_severity = LEVELS[log.level] || LEVELS[:debug]
       min_severity = LEVELS[normalize_level(configured)] || LEVELS[:debug]
       log_severity >= min_severity
+    rescue StandardError
+      true
     end
 
     private

data/lib/quonfig/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Quonfig
-  VERSION = '1.7.1'
+  VERSION = '1.7.2'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: quonfig
 version: !ruby/object:Gem::Version
-  version: 1.7.1
+  version: 1.7.2
 platform: ruby
 authors:
 - Jeff Dwyer
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-03 00:00:00.000000000 Z
+date: 2026-10-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport