sneak
4ebae029cb
check / check (push) Waiting to run
addVersion wrote the new version before it unlocked the vault to set notAfter on the version being replaced, so a wrong passphrase or mnemonic left an extra version behind. It now unlocks the vault and loads that version's metadata first; writing notAfter and switching current still come after the new version is saved. generate secret --force and import --force take the same path. The time set as the new version's notBefore and the replaced version's notAfter is taken after the unlock, which can wait for the passphrase. updatePreviousVersion asks for the long-term key again. The vault keeps it in memory after the first unlock, so this neither prompts nor derives it a second time. Model: opus-5-5