Merge pull request #6 from oposs/integrate/2026-07

Batch: paste/password fixes, MaskedInput adoption (tvision 0.14), form scroll, container classification

Author: oetiker

.gitignore

@@ -11,3 +11,6 @@ docs/book/
 .claude
 *~
 examples/ds-carbo-feh.toml
+
+# SDD / superpowers scratch artifacts
+.superpowers/

CHANGES.md

@@ -10,8 +10,50 @@ All notable changes to eDAPtor are documented here. The format follows
 
 ### Changed
 
+- The password editor's New/Confirm fields now use tvision-rs's native masked
+  field instead of eDAPtor's own hand-rolled masking. Behaviour for the operator
+  is the same or better: typing and pasting a password are robust (the fixes
+  below are now guaranteed by the framework, not a local mirror), and each field
+  gains a **reveal eye** in its last column — hold Space or press-and-hold the
+  eye with the mouse to peek at the password while editing.
+- **The DIT browsing model now classifies containers by `objectClass`, not by
+  whether they happen to have children.** Previously a container was defined as
+  "an entry with ≥1 child", so an *empty* `organizationalUnit` vanished from the
+  **DIT** tree (it showed up misfiled in the **Entries** pane instead), and a
+  sub-OU that itself had children never appeared under its parent in the
+  **Entries** pane (the one-level find skipped it too). eDAPtor now recognizes
+  `organizationalUnit`, `organization`, `dcObject`, `domain` and `container`
+  (case-insensitive) as containers regardless of child count, in addition to
+  "has children". The **DIT** tree lists every container, including empty ones;
+  the **Entries** pane lists all direct children — sub-containers alongside leaf
+  entries — with sub-containers marked with a `▸ ` prefix so they read distinct
+  from plain entries. Selecting a sub-container row opens its own entry in the
+  form for editing, exactly like the existing `‹self›` row.
+
 ### Fixed
 
+- Pasting into a multi-value field (e.g. `givenName`) now works. The inline
+  multi-value editor is eDAPtor's own view rather than a plain input line, and it
+  was silently dropping the terminal's bracketed-paste event; it now inserts the
+  pasted text at the cursor, with each pasted line starting a new value.
+- **Security:** pasting into a password field no longer shows the pasted text in
+  the clear. The masked field forwarded the terminal's bracketed paste straight
+  to its inner input, which rendered the cleartext (and, worse, staged nothing
+  because the masked mirror was never updated). Paste is now masked exactly like
+  typed input — bullets on screen, the real value mirrored for staging — and
+  control characters (a trailing newline, tabs) are stripped.
+- The Set-password dialog now **verifies that the two fields match** before
+  accepting OK. Previously OK always closed the dialog, silently staging nothing
+  when New and Confirm differed (or were empty); it now refuses to close and
+  shows "The two passwords do not match." / "Enter a password." until they agree.
+- Fixed a crash (`removal index … should be < len …`) when editing a password
+  field whose masked mirror had desynced (triggered by the paste bug above); the
+  backspace path is now bounds-safe as a belt-and-braces guard.
+- Read-only multi-value fields edited via the modal picker (`objectClass`,
+  membership, choice, password, …) now **scroll line-by-line** when their value
+  block is taller than the form's viewport, instead of jumping straight to the
+  next field and leaving the block's lower lines unreachable below the frame.
+
 ## 1.3.0 - 2026-07-23
 
 ### New

CLAUDE.md

@@ -2,15 +2,14 @@
 
 A schema-driven TUI LDAP editor (Rust + tvision-rs). Read this before touching the repo.
 
-## Start here: read the handover
+## Start here: read the controller handoff
 
-`docs/HANDOVER.md` carries the **current concern** into each session — what is
-in-flight, what to do next, and the load-bearing facts for it. Read it right after
-pulling. Right now it covers the `feat/shuttle-widget` buttons + resizable-dialog
-work (Tasks 1–4 committed; Task 4 review + manual resize check + Task 5 docs
-remain), driven with the `superpowers:subagent-driven-development` skill against the
-plan in `docs/superpowers/plans/2026-07-03-shuttle-buttons-resize.md` and the SDD
-ledger `.superpowers/sdd/progress.md`.
+`docs/controller-handoff.md` is the starter pack carried into each session — the
+mission, where things stand, what to do next, and the judgment that git can't
+reconstruct. Read it first, then `git log <handoff-commit>..HEAD` (the commit is
+named in its header) for everything that changed since. Write a fresh one via the
+`controller-handoff` skill before rolling over. (This supersedes the old
+`docs/HANDOVER.md` convention.)
 
 ## At the start of every session: pull first
 
@@ -54,6 +53,16 @@ When in doubt about where something goes: details → mdBook, orientation → RE
 - `examples/config.toml` — the annotated reference config that
   `docs/src/configuration/full-example.md` embeds. Keep the two consistent.
 
+## Upstream framework: tvision-rs
+
+edaptor is built on **tvision-rs** and regularly upstreams reusable widgets to it
+(the Shuttle view, the ListViewer find, InputLine bracketed paste). The working
+checkout of that crate lives at **`../rstv`** (sibling of this repo,
+`/home/oetiker/checkouts/rstv`). When a fix or feature belongs in the framework
+rather than in edaptor, develop it there — iterate from edaptor via a `path`
+dependency on `../rstv`, then release a tagged version and bump the `tvision-rs`
+requirement in `Cargo.toml` back to the published crate.
+
 ## Build, test, lint
 
 `cargo`/`make` from the repo root. **Cap parallelism at 4 cores** (shared machine):

Cargo.lock

@@ -22,8 +22,8 @@ chumsky = "0.12"
 oid = "0.3"
 unicode-width = "0.2"
 # tvision-rs is the TUI framework driving the edaptor browser (tree / leaf list / entry form).
-# 0.13.1: InputLine handles Event::Paste, so terminal pastes reach form fields.
-tvision-rs = "0.13.1"
+# 0.14.0: native InputLine masking + RevealEye/MaskedInput (replaces the local password mirror).
+tvision-rs = "0.14.0"
 
 [dev-dependencies]
 tempfile = "3"

Cargo.toml

@@ -0,0 +1,139 @@
+# Controller Handoff — edaptor batch: MaskedInput adoption + form/browser fixes
+
+> Starter pack for the next controller session. This handoff lives in ONE
+> worktree — run `git worktree list` first and confirm this is the workstream
+> you're resuming. Read this first, then `git log <handoff-commit>..HEAD` for
+> everything that changed since. Detail is NOT here — it's in git + the reports
+> (§6). Before you rewrite this file at your own handoff: read the previous
+> version (`git show HEAD:docs/controller-handoff.md`) and carry forward any
+> lesson in §4/§5 that is still true. Fresh synthesis, not blank page. On merge
+> into another branch, rewrite that branch's handoff to the merged reality.
+
+Handoff commit: 9589a21 (branch `integrate/2026-07`)   Date: 2026-07-24   Reason: milestone before rollover
+Worktree / branch: main checkout `/home/oetiker/checkouts/edaptor` @ integrate/2026-07
+Sibling worktrees: none. rstv (tvision-rs source) sits at `/home/oetiker/checkouts/rstv` (sibling repo, not a worktree).
+
+## 1. Mission
+edaptor is a schema-driven TUI LDAP editor on **tvision-rs**. This session did two
+things: (A) shipped **tvision-rs 0.14.0** — native `InputLine` password masking +
+a `RevealEye` toggle + a `MaskedInput` composite (the structural cure for a class
+of password bugs), now **released to crates.io**; and (B) a batch of edaptor fixes
+on top of Track A (the carried-over paste/password bugfixes), all combined into
+**`integrate/2026-07`** and opened as **edaptor PR #6**.
+
+## 2. Where we are now
+- **tvision-rs 0.14.0 — DONE & RELEASED.** PR #21 merged, tag v0.14.0 published.
+  edaptor pins `tvision-rs = "0.14.0"`.
+- **edaptor `integrate/2026-07` — PR #6 open, green, NOT merged.** It merges Track A
+  + three reviewed fixes (all green together: 890 lib tests, clippy `-D warnings`,
+  fmt clean):
+  1. Track A (`fix/multivalue-paste`): multi-value paste + password paste/confirm/
+     backspace fixes.
+  2. `feat/adopt-masked-input`: delete the hand-rolled password mirror, adopt
+     native `MaskedInput` (−377 lines). Supersedes Track A's password-mirror fixes.
+  3. `fix/launch-value-scroll`: read-only multi-value blocks now scroll line-by-line.
+  4. `fix/container-classification`: containers classified by objectClass, empty OUs
+     in the tree, sub-containers in the entry pane.
+- `main` was clean/synced with origin at handoff. The four sibling branches are all
+  merged into `integrate/2026-07`.
+- **carbo still runs plain v1.3.0 — the live panic + silent-password bugs are STILL
+  in production.** Redeploy is the last pending action (needs explicit go-ahead).
+
+## 3. Do this next
+1. **Get PR #6 merged** (oposs/edaptor#6) — user reviews/merges to `main`.
+2. **Redeploy carbo** from the merged binary (recipe in §4) — it has live bugs.
+   Production + ssh: confirm before running.
+3. Optional follow-ups (not blocking): the two tangential shuttle bugs (§7), and
+   sub-container navigate-on-Enter (§7).
+
+## 4. Lessons & traps  ← the irreplaceable part
+- **The whole password-bug cluster was ONE root cause: an unhandled `Event::Paste`
+  in a custom view.** tvision delivers terminal bracketed paste as `Event::Paste`
+  (routed like a KeyDown), distinct from `Event::Command(Command::PASTE)` (Ctrl+V).
+  A `match` on only `KeyDown` silently drops it. Now moot in the password field
+  (native `MaskedInput`), but the pattern recurs — when "paste doesn't work", look
+  for a view that doesn't handle `Event::Paste`.
+- **Rust method-resolution trap in `MaskedInput` (carry forward for ANY tvision
+  composite):** an inherent `&mut self value()` is silently shadowed by the
+  `View::value(&self)` default (which returns `None`) at the dot-call site → your
+  getter returns `None` and no error. Fix: make the inherent getter `&self`, and
+  **explicitly override `value`/`set_value`/`set_value_ctx` in `impl View`** so the
+  `#[delegate]` macro doesn't forward to `Group`'s no-op defaults. A dedicated
+  round-trip-through-`Box<dyn View>` test guards it.
+- **tvision facts (0.14):** timers are **synchronous** via `Context::set_timer`/
+  `kill_timer` over an injected `TimerQueue` — there is **no** `Deferred::SetTimer`.
+  `InputLine::SURFACE_ROLES` is **not pub**. **Theme glyphs live in `Glyphs`**
+  (`reveal_eye_hidden`/`reveal_eye_revealed`); widgets read `ctx.glyphs()` — do NOT
+  bake glyphs into a widget config (that was a review finding). Masked clipboard
+  guard keys on `mask.is_some()` (blocks copy even when *revealed* — a deliberate
+  security choice), not on `masking()`.
+- **rstv release hygiene:** `.github/workflows/release.yml` OWNS version bumps +
+  CHANGELOG rollover. A feature branch must ONLY add notes under `## Unreleased`
+  and must NOT bump `Cargo.toml`/tag. (We tripped this and had to revert.)
+- **The "form scroll" bug was NOT the shuttle** (the shuttle works). It was the
+  form's read-only **`LaunchValueView`** launch block: single focus stop, passes
+  Up/Down straight through, no internal scroll → tall blocks unreachable. Fix is
+  **geometry-driven in the form** (`ScrollGroup::scroll_block_edge`) — the block
+  exposes **no cursor** (a caret would wrongly imply editability). Don't add a caret
+  to a read-only block.
+- **Container classification:** a node is a container if its objectClass ∈
+  {organizationalUnit, organization, dcObject, domain, container} (case-insensitive)
+  OR it has children. **`is_branch` (pure has-children) is STILL load-bearing for the
+  promote/demote child-count reflow — do NOT replace it.** Only tree membership
+  (`branch_dns`), panel-2 exclusion, AND the `upsert` **tree-dirty signal** moved to
+  container terms. The upsert-signal gap (still keyed on `is_branch` after the rest
+  moved) was a real review catch: a live-created/relabelled empty OU didn't refresh
+  panel 1 until a rescan. Snapshot `was_container` before mutating, like `was_branch`.
+- **`.superpowers/` is now gitignored in edaptor** (it was NOT — a subagent report
+  file leaked into a commit; cleaned in the integration merge). Reports are scratch.
+- **carbo deploy recipe:** cargo target dir is redirected to
+  `/home/oetiker/scratch/cargo-target` (NOT `./target`) — use `cargo metadata` to
+  find the binary. edaptor has **no `--version`**. Build release locally (this box
+  glibc 2.39 → carbo Ubuntu 26.04 glibc 2.43; older→newer is safe), `scp` to
+  `ds-carbo-feh-adm:/tmp`, `ssh -t ds-carbo-feh-adm` (passwordless sudo) → back up
+  `/usr/local/bin/edaptor` to a dated `.bak`, then `install -m0755`. Config:
+  `/etc/edaptor/ds-carbo-feh.toml`.
+
+## 5. Don'ts & constraints
+- **≤ 4 cores** for all compiles/tests (shared 128-core box). Never two building
+  subagents at once. `podman` not docker; `pnpm` not npm.
+- **Confirm before ssh / carbo redeploy** — production, outward-facing; back up the
+  old binary first.
+- **Don't push/merge/redeploy without the user's explicit go-ahead.**
+- **Settled — do not relitigate:** container rule = objectClass set OR has-children;
+  panel 2 shows sub-containers (▸) + leaves; a sub-container row **opens its entry**
+  (navigate-on-Enter is a *future option*, not a bug); `MaskedInput` reveal is
+  **non-sticky** (Space = 1 s peek); eye glyphs are **theme-controlled**; the masked
+  clipboard block covers the revealed state too.
+- Don't reintroduce the removed `[profile.picker.<attr>]` / `[profile.password]`
+  config layers.
+
+## 6. Where the detail lives
+- Change history: `git log 70eb910..HEAD` on `integrate/2026-07` (the whole batch).
+- **edaptor PR #6** (oposs/edaptor#6); **tvision PR #21** (oposs... `oetiker/tvision-rs#21`, MERGED).
+- Subagent reports (gitignored scratch): `.superpowers/adopt-masked-input-report.md`,
+  `.superpowers/launch-scroll-report.md`, `.superpowers/container-classification-report.md`.
+- Key files: `src/ui/pw_editor.rs` (MaskedInput adoption), `src/ui/panes/form.rs` +
+  `src/ui/scroll_group.rs` (`scroll_block_edge` launch-block scroll),
+  `src/workflows/structure.rs` (`is_container`, `upsert` tree-dirty signal),
+  `src/ui/panes/leaf.rs` + `src/workflows/labels.rs` + `leaf_search.rs` (panel-2
+  children incl. sub-containers).
+
+## 7. Open questions / pending decisions
+- Merge PR #6 + redeploy carbo — pending user.
+- **Sub-container navigate-on-Enter**: selecting a sub-container row currently opens
+  its entry (like `‹self›`). Navigate-the-tree-into-it was considered and left out
+  (ambiguous UX, not requested). Revisit if the user wants folder-style nav.
+- **Two tangential shuttle bugs** found during investigation, deliberately NOT fixed:
+  (1) list scrollbar step goes stale after a dialog resize (framework: `Group`/
+  `Window::on_bounds_changed` doesn't cascade to children); (2) the Available list
+  resets to the top on every refresh/move (`new_list` always `reset_focus=true`).
+
+## 8. Staleness watch
+- PR #6 may already be merged — check `gh pr view 6`; if merged, `integrate/2026-07`
+  and the four sibling branches may be deleted.
+- carbo may already be redeployed — verify (no `--version`; check the `.bak` date
+  on `ds-carbo-feh-adm`).
+- `main` was clean at handoff; re-check `git log main` and `git status`.
+- This file was written on the integration branch; after PR #6 merges, `main`'s
+  handoff IS this file — keep it honest or rewrite to the merged reality.

docs/controller-handoff.md

@@ -86,8 +86,10 @@ currently selected branch.
    you type a value into a field, the default never overwrites it.
 3. Fill in the remaining fields (the form title reads `New entry`).
 4. Press **`Alt+S`**. The change is an LDIF *add*; review the preview and confirm
-   to create the entry. The new entry appears in the **Entries** pane, and if it
-   gives its parent its first child, the parent is promoted to a branch in the
+   to create the entry. The new entry appears in the **Entries** pane, and if its
+   parent was not already recognized as a container (i.e. not one of
+   `organizationalUnit`/`organization`/`dcObject`/`domain`/`container`, and had no
+   other children), gaining its first child now promotes the parent into the
    **DIT** tree.
 
 ### Where a new entry is created
@@ -142,9 +144,13 @@ Press **`Alt+D`** in the **Entries** pane to delete the highlighted entry.
 
 1. A confirmation overlay appears (`[Y]es` / `[N]o`).
 2. Confirm with **`Y`** to apply the delete; **`N`** (or `Esc`) aborts.
-3. After a successful delete the parent's entry list is recomputed locally; if
-   you removed the parent's last child, the parent is demoted from a branch back
-   to a leaf in the **DIT** tree.
+3. After a successful delete the parent's entry list is recomputed locally. If
+   the parent is a recognized container class (an OU, for example), it stays in
+   the **DIT** tree even after losing its last child — now shown as an empty
+   container, not demoted. Only a parent that was in the tree *solely* because it
+   had children (not a recognized container class) disappears from the **DIT**
+   tree and reverts to being listed as a plain entry in its own parent's
+   **Entries** pane.
 
 All of create, edit, rename, and delete funnel through the same
 diff → ChangeSet → LDIF-preview → apply pipeline; see

docs/src/usage/crud.md

@@ -14,6 +14,9 @@ by default). The schema-generated raw field for that attribute is suppressed, so
 there is one clear place to set the password.
 
 - Type the password once, then again to confirm — they must match.
+- Each field shows only bullets while you type; a small **reveal eye** sits in
+  its last column — hold <kbd>Space</kbd>, or press and hold the eye with the
+  mouse, to peek at what you've typed.
 - The cleartext is sent to the directory; the **LDIF preview masks it as
   `********`**, so the actual password never appears on screen.
 - Like any other field, the password is applied as part of the form's normal