[cloudsmith-iduffy]

Description

A package manager often runs its credential helper from a process that does not have the environment of the shell that ran cloudsmith credential-helper install, for example Docker Desktop, an IDE or a build agent. The flags and CLOUDSMITH_* variables that you gave at install time are then lost. This PR adds the shared code that writes those settings into the launcher. The Docker helper (#512) and the NuGet provider (#494) use it.

• install keeps every option that has a CLOUDSMITH_* environment variable and got its value from a flag or the environment, also from a flag on a parent command such as cloudsmith -P work credential-helper install …. The list comes from the Click options themselves, so a new option is kept with no extra code. Values from config.ini are not written, because the helper reads that file itself. The keyring settings come from the hidden options that refactor(no-ticket): read the keyring settings through Click #515 adds to main.
• The API key, the keyring key, the custom headers and the proxy URL are never written, because other users can read the launcher. OIDC tokens are not options, so they are never written either.
• write_launcher(env=...) writes the settings as export lines, or as set lines in a Windows batch file. They replace the values of the caller, so the helper gives the same result as the install.
• On Windows, batch_value() refuses a value that a batch file cannot hold: ", %, a line break, or non-ASCII text outside the user profile. A non-ASCII path under the profile becomes %USERPROFILE%. The path of the standalone binary goes through the same check.
• An installer opts in with KEEPS_INSTALL_TIME_SETTINGS = True. No installer opts in in this PR.

#!/bin/sh
export CLOUDSMITH_WORKSPACE=acme
export CLOUDSMITH_PROFILE=work
exec cloudsmith credential-helper docker "$@"

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Refactoring
• Other (please describe)

Additional Notes

This code was in #494. I moved it here and replaced its fixed list of settings with the loop over the Click options.

The install tests now remove CLOUDSMITH_* variables from the environment, so a direnv shell does not change their result.

There is no CHANGELOG entry, because nothing changes for users until an installer opts in.

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

No registered installer enables or forwards the captured settings, leaving the feature inactive.

1 open issue

• Real installers omit captured settings from generated launchers · New

What changed in this PR

Adds infrastructure for credential-helper launchers to retain install-time settings across different runtime environments.

Changes:

• Captures selected CLI and environment settings.
• Adds launcher environment exports and Windows value validation.
• Tests settings capture, path resolution, and Windows encoding safeguards.

File	Description
cloudsmith_cli/​credential_helpers/​launchers.py	Adds settings normalization and platform-specific environment rendering.
cloudsmith_cli/​cli/​tests/​commands/​test_credential_helper_install.py	Tests settings capture and launcher value handling.
cloudsmith_cli/​cli/​commands/​credential_helper/​manage.py	Collects settings for opted-in installers.

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Saved TLS settings can incorrectly re-enable certificate verification on replay, while the tests remove safeguards that prevent real error reports.

2 open issues

• Replay saves raw TLS aliases instead of resolved verification setting · New
• Clearing install settings re-enables real telemetry in tests · New

1 resolved since last review

• Real installers omit captured settings from generated launchers

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No active review issues remain for the shared credential-helper launcher settings infrastructure.

No open issues 🎉

2 resolved since last review

• Clearing install settings re-enables real telemetry in tests
• Replay saves raw TLS aliases instead of resolved verification setting

_{Review effort: Balanced}