Nils Andreas Svee
2cdc084ef1
--hmac "" silently produced an empty-byte HMAC key at the protocol boundary, so an accidentally-empty shell expansion (--hmac "$VAR") could look like auth was deliberately enabled while actually using a predictable empty key. Reject a zero-length --hmac value at parse time in the client CLI, the TUI client (via the shared CommonClientArgs), and the server CLI. Non-empty values, including whitespace-only ones, are accepted exactly as supplied.