4 Commits

Include renames

Author	SHA1	Message	Date
clawbot	015730fb05	Delete .tmp- leftovers of a killed command when the lock is next taken (closes #75) ... A command killed part-way could leave a temporary file or directory of secret.WriteFileAtomic or secret.TempDirFor, encrypted keys included, for good. LockStateDir now empties the lock file once it holds the lock and writes "finished" there just before releasing it. A holder that does not find that deletes such leftovers from the state directory, each vault, each secret and each version, the only places those helpers make them, matching names that start with "." and hold ".tmp-". After a command that finished nothing is searched, so the added time does not grow with the number of secrets and versions. A test shows that `unlocker remove` removes an unlocker directory with no metadata file. Model: opus-5-5	2026-10-04 19:25:25 +02:00
clawbot	7e4e0f7806	Give every new unlocker a directory of its own (closes #71) ... A passphrase unlocker added to a vault that had one, and a PGP, keychain or Secure Enclave unlocker added on the same day as another of its type, were written into the existing unlocker's directory file by file, so a crash part-way left a current unlocker whose files did not belong together. Unlocker directories, keychain items and Secure Enclave keys are now named with the time to the nanosecond, and secret.WriteDir refuses a directory that exists. Adding a passphrase unlocker writes the new one, points current-unlocker at it, and only then removes the vault's other passphrase unlockers. Model: opus-5-5	2026-10-04 16:58:45 +02:00
clawbot	596b978cb1	Leave no partial unlocker directory when adding an unlocker fails (closes #48) ... CreatePGPUnlocker looked up the GPG key's fingerprint, and the keychain unlocker got the long-term key, only after writing part of the unlocker, so a failure there left a directory with no metadata. Both now do every step that can fail before writing anything. `secret unlocker add pgp` looks the fingerprint up once, for its duplicate check, and passes it to CreatePGPUnlocker to record. All four unlocker types write their files through the new secret.WriteDir, which builds a new directory in a temporary directory, renames it into place when complete and removes it on a failure. A directory that already exists, as when an unlocker replaces one of the same name, is written in place and never removed. Model: opus-5-5	2026-10-04 12:58:50 +02:00
clawbot	32a61ff963	Lock the state directory and write vault files atomically (closes #34) ... Each command that changes the state directory holds one lock: flock(2) on `lock` in the state directory, dropped by the kernel if the process dies, or a process-wide mutex on the in-memory test filesystem. It covers the state directory, not each vault, because `currentvault`, `vault create` and cross-vault moves span vaults, and a lock file in a vault would be deleted by `vault remove` under a waiting command. Files go through `secret.WriteFileAtomic`; versions, new secrets and cross-vault copies are built in a temporary directory and renamed into place; removals rename out of the way first. Left for later: replacing an unlocker (#71) and deleting what an interrupted command leaves under a `.tmp-` name (#75). Model: opus-5-5 Co-authored-by: clawbot <sneak+clawbot@sneak.cloud>	2026-10-04 04:57:58 +02:00