A withheld change line in the note keeps its key's name; SDK at 5933eb7 (the review of mesh-controller #304)

The router's fallback said a refused note line as "(a line carrying … is withheld here)", so the operator
could not tell which setting held a value they were not shown. A change's line now keeps its key; any other
line, or one whose key is refused too, is said withheld whole. The SDK pin moves to mesh-sdk 5933eb7, where
no two asks digest the same.

modules/messenger/cmd/messenger/holder.go

@@ -896,7 +896,7 @@ func (h *Holder) sayOn(r *Record, what, kind string) Message {
 				continue
 			}
 			if refusal, ok := passes(line); !ok {
-				line = "(a line carrying " + refusal.What + " is withheld here)"
+				line = withheldLine(line, refusal, passes)
 			}
 			note = append(note, line)
 		}
@@ -1146,3 +1146,20 @@ func roughly(d time.Duration) string {
 	}
 	return fmt.Sprintf("%d days", int(d.Hours()/24))
 }
+
+// withheldLine is a note line the rule refused, said withheld: a change's line ("+ key: value") keeps its key's name,
+// so the operator knows which setting holds a value they are not shown (the review of mesh-controller #304); any
+// other line, or one whose key the rule refuses too, is said withheld whole.
+func withheldLine(line string, refusal Refusal, passes func(string) (Refusal, bool)) string {
+	if len(line) > 2 && strings.ContainsRune("+~-=", rune(line[0])) && line[1] == ' ' {
+		key := line[2:]
+		if i := strings.IndexAny(key, ": "); i > 0 {
+			key = key[:i]
+		}
+		named := line[:2] + key + " (a value carrying " + refusal.What + " is withheld here)"
+		if _, ok := passes(named); ok {
+			return named
+		}
+	}
+	return "(a line carrying " + refusal.What + " is withheld here)"
+}

modules/messenger/cmd/messenger/whole_test.go

@@ -208,3 +208,23 @@ func TestEveryKeyAndItsWholeValueIsInTheNoteWhereTheSenderIsProven(t *testing.T)
 		t.Errorf("an ask whose whole details carry a secret was taken")
 	}
 }
+
+// A change's line the rule refuses keeps its key's name in the note (the review of mesh-controller #304): the
+// operator knows which setting holds a value they are not shown. A line whose key the rule refuses too is said
+// withheld whole.
+func TestAWithheldChangeLineKeepsItsKey(t *testing.T) {
+	for line, want := range map[string]string{
+		"+ password: hunter2":                           "+ password (a value carrying a value given to a secret's name is withheld here)",
+		"~ shares: /mnt/media (was: x)":                 "~ shares (a value carrying a file path is withheld here)",
+		"Read it at /etc/x":                             "(a line carrying a file path is withheld here)",
+		"+ ghp_abcdefghijklmnopqrstuvwxyz0123456789: 1": "(a line carrying ",
+	} {
+		refusal, ok := Check(line)
+		if ok {
+			t.Fatalf("%q passes the content rule", line)
+		}
+		if got := withheldLine(line, refusal, Check); !strings.HasPrefix(got, want) {
+			t.Errorf("%q: %q, want %q", line, got, want)
+		}
+	}
+}

modules/messenger/go.mod

@@ -2,4 +2,4 @@ module messenger
 
 go 1.22
 
-require git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261013145622-f4745447ba6d
+require git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261013182924-5933eb757d44

modules/messenger/go.sum

@@ -4,3 +4,5 @@ git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261013141520-9588871d6629 h1:7TYFV1Q6
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261013141520-9588871d6629/go.mod h1:GFuZUElBZ9A++mxgIKo97aXXo+kV0uJ/UkbhQPPIbrY=
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261013145622-f4745447ba6d h1:HEJyqorKktrkJPeeJdwEo0kdrJjH3fm/YVS9MGftCqY=
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261013145622-f4745447ba6d/go.mod h1:GFuZUElBZ9A++mxgIKo97aXXo+kV0uJ/UkbhQPPIbrY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261013182924-5933eb757d44 h1:r5xIo5qWOXQdCSMxvqJy8kV4U+P/QWXFK6971Ha6wU8=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261013182924-5933eb757d44/go.mod h1:GFuZUElBZ9A++mxgIKo97aXXo+kV0uJ/UkbhQPPIbrY=