Findings in configuration loading and writing (tms/src/Config, common/src/BBYaml, tms/src/Project). Fixes for YAML escaping and comments are in #35, and atomic writes in #37.

1. config-write and server-add/enable/remove save the merged configuration (reproduced). They write Config, which merges the global file, tms.config.local.yaml, extra config files and -p: overrides, back into the main tms.config.yaml. Reproduced with tms 3.5: a define that exists only in tms.config.local.yaml appeared in tms.config.yaml after a plain tms server-enable community false. Machine-specific settings therefore leak into a file people commit.
2. The same define in two config layers aborts every command (reproduced). TDefinesSectionConf creates a Duplicated dictionary that is never cleared, and the same section objects are reused for the global, main and local files. With - MYDEF under configuration for all products: compilation options: defines: in both tms.config.yaml and tms.config.local.yaml, every command fails with Duplicated item in section defines: "MYDEF" is already defined. In line 4 of file "…\tms.config.local.yaml".
3. -p: arrays can't hold Windows paths. TBBCmdReader.ProcessArray splits every element at its first :, so -p:…additional products folders=[c:\MyProducts] stores a folder named c.
4. -p: can't address ids containing - or _. TBBCmdReader.AdaptForCmd replaces - and _ with spaces in every section name, product and server ids included, and ValidateId allows both characters. -p:configuration for xor-el.crypto-lib-4-pascal:… looks up xor el.crypto lib 4 pascal.
5. Wildcard precedence for product configuration may be inverted. LoopOverAllMatches sorts longer patterns first (Right.Length - Left.Length) and applies the matches in order, so the last one wins. A setting for tms.* therefore overrides one for tms.biz.* on tms.biz.x. If the most specific match is meant to win, as in BestMatch, the order is reversed.
6. A relative working folder follows the current directory. TBuildFolders.RootFolder is TPath.GetFullPath(FRootFolder), which resolves against the current directory. Other relative paths in the config, such as automatic snapshots, resolve against the config folder. Running tms -config X\tms.config.yaml from elsewhere therefore puts metadata in a different tree.
7. GetEmptySubfolder never skips the folders it means to. TDirectory.GetDirectories returns full paths, so SubFolder.StartsWith('.') and StartsWith('__') are never true. A .git or __history folder next to the single product folder makes it count as two, and the product is not found.
8. Storing empty data leaves stale data. TFileSystemPersistence.Store exits on Data = '', so a previous uninstall or hash record stays in place and Retrieve returns old content.
9. An API response that isn't a JSON object causes an access violation. In URepositoryManager (e.g. CheckProductsLoaded), TJSONObject(TJSONObject.ParseJSONValue(...)) is a hard cast, and JObj.Values['value'] is used without checks. A 200 response with an HTML page (captive portal), an empty body or a JSON array gives an access violation instead of a readable error.

How these were found, and caveats

• They come from a code review of public main at d7b22be. You mentioned on smartsetup-registry#11 that your internal tree is ahead, so some of these may already be fixed. Please close anything that is.
• I checked every item against the source before posting. Items marked (reproduced) were also reproduced with tms.exe 3.5 or a Debug build. The others are from reading the code only.
• My environment: Windows 11, Delphi 13 (RAD Studio 37.0), Win64. I did not look at Linux64 or macOS behaviour, and I did not run tmstest.
• The review was done with an AI coding assistant (Claude Code), then checked as described. Please treat each item as a report to confirm, not a certainty.
• I've opened PRs for the issues that had clear fixes (Don't let one registry entry take a whole server down (smartsetup-registry#11) #29–tmsgui: fix default sort column and per-product progress column #40). They are linked where relevant, and this issue lists only what is not fixed in them.

🤖 Generated with Claude Code