A currentvault file naming a vault that does not exist makes secret list report an empty vault with exit 0 #156

New Issue

2026-10-13T00:38:58+02:00

clawbot commented

2026-10-13 00:38:58 +02:00

Severity: minor
Only a damaged state file reaches it, and secret vault select repairs it; but the wrong answer looks like a healthy, empty vault.

What happens: GetCurrentVault reads the name from currentvault and builds the vault from it without checking that vaults.d/<name> exists, and ListSecrets treats a missing secrets.d as "no secrets". An emptied currentvault yields the name vaults.d (the base of vaults.d/), so the current vault becomes the non-existent vaults.d/vaults.d.

Reproduction, after secret init and echo v | secret add s:

: &gt; "$SB_SECRET_STATE_DIR/currentvault"       # or: printf gone &gt; .../currentvault
secret list; echo $?
# No secrets found in current vault.
# Run 'secret add &lt;name&gt;' to create one.
# 0
secret get s                 # Error: secret s not found
echo v | secret add t        # Error: failed to create temporary directory for .../vaults.d/vaults.d/secrets.d/t: ... no such file or directory
secret vault list            # Available vaults: default   (nothing marked current)

secret info shows Current Vault: vaults.d.

Where:

		secret/internal/vault/management.go
		Line 83 in ef0ae90768
	
				func GetCurrentVault(fs afero.Fs, stateDir string) (*Vault, error) {

(GetCurrentVault) and

		secret/internal/vault/management.go
		Line 59 in ef0ae90768
	
				func ResolveVaultSymlink(fs afero.Fs, currentVaultPath string) (string, error) {

(ResolveVaultSymlink).

Correct behaviour: when the name in currentvault is empty, invalid (ValidateVaultName) or names no directory under vaults.d, every command that needs the current vault fails with an error naming the file and saying to run secret vault select <name>; secret vault list still lists the vaults.

Definition of done

list, get, add and the other current-vault commands fail with that error on an emptied or wrong currentvault; vault select fixes it.
A test empties currentvault and requires ListSecrets to return an error; it fails before the fix.

Model: fable-5-1

Severity: minor Only a damaged state file reaches it, and `secret vault select` repairs it; but the wrong answer looks like a healthy, empty vault. What happens: `GetCurrentVault` reads the name from `currentvault` and builds the vault from it without checking that `vaults.d/<name>` exists, and `ListSecrets` treats a missing `secrets.d` as "no secrets". An emptied `currentvault` yields the name `vaults.d` (the base of `vaults.d/`), so the current vault becomes the non-existent `vaults.d/vaults.d`. Reproduction, after `secret init` and `echo v | secret add s`: ``` : > "$SB_SECRET_STATE_DIR/currentvault" # or: printf gone > .../currentvault secret list; echo $? # No secrets found in current vault. # Run 'secret add <name>' to create one. # 0 secret get s # Error: secret s not found echo v | secret add t # Error: failed to create temporary directory for .../vaults.d/vaults.d/secrets.d/t: ... no such file or directory secret vault list # Available vaults: default (nothing marked current) ``` `secret info` shows `Current Vault: vaults.d`. Where: https://git.eeqj.de/sneak/secret/src/commit/ef0ae90768c8b18a829033b3ebd4cf98fcaeb3d1/internal/vault/management.go#L83 (`GetCurrentVault`) and https://git.eeqj.de/sneak/secret/src/commit/ef0ae90768c8b18a829033b3ebd4cf98fcaeb3d1/internal/vault/management.go#L59 (`ResolveVaultSymlink`). Correct behaviour: when the name in `currentvault` is empty, invalid (`ValidateVaultName`) or names no directory under `vaults.d`, every command that needs the current vault fails with an error naming the file and saying to run `secret vault select <name>`; `secret vault list` still lists the vaults. **Definition of done** - `list`, `get`, `add` and the other current-vault commands fail with that error on an emptied or wrong `currentvault`; `vault select` fixes it. - A test empties `currentvault` and requires `ListSecrets` to return an error; it fails before the fix. Model: fable-5-1

sneak was assigned by clawbot

2026-10-13 00:38:58 +02:00

clawbot referenced this issue

2026-10-13 01:17:13 +02:00

Finish 1.0 and tag it; after that, bugfixes only #131

Sign in to join this conversation.