Bug: NumSecrets() always returns 0 due to incorrect directory traversal #4

New Issue

2026-02-08T21:01:50+01:00

clawbot commented

2026-02-08 21:01:50 +01:00

Bug

In internal/vault/vault.go, the NumSecrets() method counts secrets by looking for non-directory files (excluding current) directly under each secret's directory:

for _, vFile := range versionFiles {
    if !vFile.IsDir() && vFile.Name() != "current" {
        count++
        break
    }
}

However, the actual directory structure of a secret is:

secrets.d/<name>/
  current         (file - version pointer)
  versions/       (directory)
    20240101.001/ (directory with actual data)

The only direct children of a secret directory are current (excluded by the filter) and versions (excluded by !vFile.IsDir()). This means the condition is never true and NumSecrets() always returns 0.

Impact

UnlockersRemove uses NumSecrets() to check if removing the last unlocker is safe. Since it always returns 0, users can always remove the last unlocker without --force, even when secrets exist.
The info command may show incorrect secret counts.

Fix

Should check if the versions subdirectory contains entries, or simply check for the existence of the current file.

## Bug In `internal/vault/vault.go`, the `NumSecrets()` method counts secrets by looking for non-directory files (excluding `current`) directly under each secret's directory: ```go for _, vFile := range versionFiles { if !vFile.IsDir() && vFile.Name() != "current" { count++ break } } ``` However, the actual directory structure of a secret is: ``` secrets.d/<name>/ current (file - version pointer) versions/ (directory) 20240101.001/ (directory with actual data) ``` The only direct children of a secret directory are `current` (excluded by the filter) and `versions` (excluded by `!vFile.IsDir()`). This means the condition is **never true** and `NumSecrets()` always returns 0. ## Impact - `UnlockersRemove` uses `NumSecrets()` to check if removing the last unlocker is safe. Since it always returns 0, users can always remove the last unlocker without `--force`, even when secrets exist. - The `info` command may show incorrect secret counts. ## Fix Should check if the `versions` subdirectory contains entries, or simply check for the existence of the `current` file.

clawbot referenced a pull request that will close this issue

2026-02-08 21:06:00 +01:00

Fix NumSecrets() always returning 0 (closes #4) #9

sneak closed this issue

2026-02-09 02:39:30 +01:00

sneak referenced this issue from a commit

2026-02-09 02:39:31 +01:00

Merge pull request 'Fix NumSecrets() always returning 0 (closes #4)' (#9) from clawbot/secret:fix/issue-4 into main

Sign in to join this conversation.