fix(discovery): run VS Code settings before the blind scans, and never invent a password

[PYDuquesnoy]

The VS Code / Server Manager reader in this fork was written, wired into the cascade and unit-tested — and could not run. Two defects, one behaviour change each.

Precedence

discover_iris() had VS Code settings as step 6 of 6, behind the localhost port scan and the Docker scan. On any machine where IRIS answers on localhost or in a container — which is every machine anyone runs this on — a scan won first and .vscode/settings.json was never opened.

It is now step 4, directly after IRIS_CONTAINER and ahead of both scans, for the reason step 3's own comment already gave:

// Must run before the generic localhost scan or another container on port 52773 wins.

Explicit configuration names which instance the user means; a port scan cannot tell one IRIS on 52773 from another. That reasoning was already in the file, applied to the named-container case only.

Important

This moves some people's connection, and is why the bump is minor. A workspace whose settings.json names an instance different from whatever answers on localhost:52773 now connects to the one it names. "active": false opts an entry out.

Credentials

to_iris_connection() ended unwrap_or("SYS") in both the named-server and direct-host paths. Server Manager deliberately does not write the password into settings.json — it keeps it in the OS keychain, which this binary cannot read — so the commonest real entry hit that default and produced a connection that looked configured and could only ever 401, with nothing naming the cause.

The Option<IrisConnection> it returned collapsed "nothing configured here" and "configured but no password" into one None, which is what made inventing the password look reasonable. It is now explicit:

pub enum VsCodeResolution {
    Resolved(IrisConnection),
    NotConfigured,
    MissingPassword { server: Option<String> },
}

• Password falls back to $IRIS_PASSWORD — the intended composition: VS Code supplies host, port and namespace, the environment supplies the secret that lives in the keychain.
• With no password anywhere, discovery warns naming the file, the server and the keychain, then continues — rather than stopping the cascade on a connection that cannot work.
• Username keeps its _SYSTEM default: not a secret, this codebase's documented default everywhere else, and Server Manager does write it. The password is the field it withholds, so the password is the one we refuse to invent.
• An empty string counts as absent. A server: name with no matching entry is a typo and resolves to NotConfigured rather than guessing localhost.

Tests

8 new in vscode_config_tests.rs — both paths, env fallback, inline beating env, empty-as-missing, active:false, dangling name, and a pathPrefix regression guard. 13/13 green, full workspace green, clippy clean (verified with a positive control: the same pipeline reports 1922 warnings under -W clippy::pedantic, so the empty default run is real).

Mutation control — restoring unwrap_or("SYS") turns exactly the three no-password tests red, with the fabricated value quoted in the failure message, and leaves the other ten green:

test an_empty_password_counts_as_missing ... FAILED
test direct_connection_without_a_password_is_not_handed_sys ... FAILED
test named_server_without_a_password_is_not_handed_sys ... FAILED
   resolved with a fabricated password "SYS" — this is the 401 that names no cause
test result: FAILED. 10 passed; 3 failed

Scope — issue 187 stays open

One item deliberately untouched: discover_via_vscode_settings still searches exactly one path, current_dir()/.vscode/settings.json. User-scope VS Code settings — where Server Manager normally keeps servers — are still not read, so a server added through its UI rather than written into the workspace is still not found. There is still no keychain reader; an absent password is now reported rather than invented. Issue 187 stays open for the search-path item.

Also

The module header and the README both carried the "last step" claim; both move with the code. Version 0.17.0, which also releases the #179 line-map fix that has been on master since ec014d6.

Refs #187

🤖 Generated with Claude Code