[cloudsmith-iduffy]

Description

This PR fixes two bugs in CredentialsReader._set_api_key. The first breaks credentials.ini on logout. The second loses a new API key without an error.

cloudsmith logout can break credentials.ini so badly that no later command runs. The pattern in CredentialsReader._set_api_key used \s* after the =. \s also matches a newline, so an empty api_key = line swallowed the blank line and the next section header.

The common way to hit it is to run logout twice. Start with:

[default]
api_key = defaultkey5678

[profile:staging]
api_key = stagingkey1234

The first logout is fine and leaves both keys empty. The second logout turns the file into:

[default]
api_key =
api_key =

After that, every command fails with DuplicateOptionError: ... option 'api_key' in section 'default' already exists, including logout itself, so the user has to fix the file by hand. login and the --save-config options (tokens create, tokens refresh, auth --request-api-key) go through the same function through update_api_key, so they did the same damage when they wrote a key after an empty one.

With this change, the second logout leaves the file as:

[default]
api_key =

[profile:staging]
api_key =

The change is in _set_api_key only:

• The pattern is now ^api_key[ \t]*[=:].*$, so it cannot cross a line. It also accepts :, which configparser reads as a separator. Before, logout said it removed the credentials but left an api_key: ... line in place. This is the same entry pattern that _set_section_value in the same file uses.
• re.sub gets a callable instead of a template string, so a backslash in a key is written as it is.
• The three methods have type hints.

_set_section_value is not a drop-in replacement for the clear. It edits one section and adds the key when the section has none, which would change what logout writes.

Second fix: a missing key was never saved

When credentials.ini has no api_key line in [default], update_api_key changed nothing. create_config_files still printed Credentials config file: ... UPDATED, so login and the --save-config options lost the new key without telling you. For example, a file with only:

[default]

stayed like that. Now it becomes:

[default]
api_key = NEWKEY

When a key is written, _set_api_key now also calls _set_section_value for [default]. That replaces the key there, or adds it when it is missing. When the file has no [default] section, it creates one. The clear path does not call it, so logout never adds a key line.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Refactoring
• Other (please describe)

Additional Notes

• Tests are in the new cloudsmith_cli/cli/tests/test_config.py. They call CredentialsReader on a file in tmp_path, because the logout command tests mock the reader. One test clears a two-key file twice: the first call makes the file that has the empty key, and the second call is the call that broke it. The second test covers the update_api_key path after an empty key. The third test covers a [default] section that has no key. Each test failed before its fix.
• CRLF files: the file is read in text mode, so \r\n becomes \n before the pattern runs and no \r is left behind. The file is written back with the platform line ending. The CRLF case of the clear test compares bytes and has the windows marker. It runs on every platform.
• The windows marker line in pyproject.toml is the same as the one in iduffy/fix-non-ascii-output-crash, which adds the marker and a windows-latest CI job. Whichever PR merges second keeps the line with no conflict. pytest runs with --strict-markers, so this PR has to register the marker itself.
• Not changed: update_api_key writes the new key into every section, not only the active profile. So tokens create --save-config for the default profile also replaces the key in each [profile:NAME] section, and logout clears every section. Logout scopes the keyring step to the active profile but not the file step, and create_config_files has no profile to pass. The intended behaviour is not clear from the code, tests, or docs, so I left it for a separate change.
• A file that an earlier version already broke still fails to parse. You must put the missing section header back by hand.

🤖 Generated with Claude Code

[Copilot]

🟢 Approval recommended

The focused fix preserves existing behavior, covers the reported corruption paths with regression tests, and has no unresolved findings.

No open issues 🎉

What changed in this PR

Fixes credentials-file corruption when logout clears an already-empty API key or login updates one, preserving section headers and the existing all-section behavior.

Changes:

• Restricts API-key replacement to one line, supports : separators, and preserves literal backslashes.
• Adds regression tests for repeated clears, updates after empty keys, and LF/CRLF input.
• Documents the fix and registers the Windows test marker.

File	Description
pyproject.toml	Registers the Windows test marker.
cloudsmith_cli/​cli/​tests/​test_config.py	Tests section preservation during credential edits.
cloudsmith_cli/​cli/​config.py	Fixes API-key replacement and adds type hints.
CHANGELOG.md	Documents the corruption fix and affected commands.

_{Review effort: Balanced}

[cloudsmith-iduffy]

@copilot resolve the merge conflicts on this branch.

[Copilot]

@copilot resolve the merge conflicts on this branch.

Resolved the conflicts and merged master in commit 1265346. The merge is published.