[cloudsmith-iduffy]

Description

cloudsmith credential-helper install terraform puts every helper arg into the credentials_helper "cloudsmith" block as "<arg>", with no escaping. The args include the resolved --config-file and --credentials-file paths. On Windows those paths look like C:\Users\jo\config.ini, and \U is not a valid escape in HCL. Terraform then rejects the whole CLI config file, so every Terraform command fails, and the user's other settings in that file stop working too.

Before:

credentials_helper "cloudsmith" {
  args = ["-w", "acme", "--config-file", "C:\Users\jo\config.ini"]
}

Error: Error parsing <CLI config file>: At <line>:<column>: illegal char escape

After:

credentials_helper "cloudsmith" {
  args = ["-w", "acme", "--config-file", "C:\\Users\\jo\\config.ini"]
}

What changed in terraformrc.py:

• render_block escapes \ and ". It writes ${ and control characters as \uXXXX escapes.
• render_block raises TypeError for a bare string or a non-string item. A bare string would otherwise render one arg per character.
• _BLOCK_RE ignores a } inside a quoted string. Before this change, an arg with a } cut the match short, so the next install or uninstall left part of the old block behind. Run the install again to repair a block that an earlier version wrote.

I checked the escaping against Terraform 1.16. Terraform reads the CLI config with HCL 1, not HCL 2, so the usual $${ and %%{ escapes do not apply:

• ${x} and %{x} are already literal. $${x} is not an escape: the helper gets $${x} as written.
• After a raw ${, HCL 1 stops decoding escapes. "${C:\\x}" reaches the helper with two backslashes.
• \u0024{ decodes to ${ and does not start that mode, so the CLI writes ${ that way.

To check this, I put a small helper into ~/.terraform.d/plugins that writes its argv to a file. Then I ran terraform init against a module on an unknown registry host. For a Windows path, ", ${, }, {, %{, a newline, a control character, and non-ASCII text, the argv was the same as the Python list I passed to render_block.

To reproduce the bug on macOS or Linux, use a directory whose name has a backslash in it:

H=$(mktemp -d); mkdir -p "$H/Users\\jo"; printf '[default]\n' > "$H/Users\\jo/config.ini"
HOME=$H TF_CLI_CONFIG_FILE=$H/terraformrc CLOUDSMITH_NO_KEYRING=1 \
  cloudsmith credential-helper install terraform -w acme -r repo -C "$H/Users\\jo/config.ini"
TF_CLI_CONFIG_FILE=$H/terraformrc terraform version

On master, terraform version prints illegal char escape. On this branch, it does not print an error.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Refactoring
• Other (please describe)

Additional Notes

• The Windows path test has the windows marker. It still runs on Linux and macOS. This PR registers the marker with the same line as fix(no-ticket): print ASCII text in mcp configure, download and update #525 and fix(no-ticket): keep credentials.ini sections and save missing API keys #533. Those PRs add the windows-latest CI job that runs -m "windows and not integration", so whichever merges first owns the line.
• This is not a breaking change. Terraform reads the same arg values as before for every arg that worked before. Only the text in the file is different.

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

Quotes in valid HCL comments prevent block detection, causing reinstall to append duplicate helper blocks and uninstall to leave them untouched.

1 open issue

• HCL comments with quotes prevent existing block matching · New

What changed in this PR

This PR fixes Terraform credential-helper argument escaping, particularly for Windows configuration paths, and improves matching of helper blocks containing quoted braces.

Changes:

• Escape HCL-sensitive characters and reject invalid argument types.
• Update block matching and add regression tests for escaping and replacement.
• Register the shared windows test marker and document the fix.

File	Description
pyproject.toml	Register the windows pytest marker.
cloudsmith_cli/​credential_helpers/​terraform/​terraformrc.py	Escape arguments, validate types, and recognize quoted braces.
cloudsmith_cli/​cli/​tests/​test_credential_helper_terraform_installer.py	Test escaping, invalid arguments, and block replacement.
CHANGELOG.md	Describe the Terraform fix and recovery instructions.

_{Review effort: Balanced}

[cloudsmith-iduffy]

@copilot resolve the merge conflicts on this branch.

[Copilot]

@copilot resolve the merge conflicts on this branch.

Merged the latest master and resolved the CHANGELOG.md conflict in db1d476.