sneak
6cf93386ff
check / check (push) Waiting to run
A move between two vaults unlocked them while holding the state directory lock, and unlocking can ask for a passphrase, so every other changing command waited at that prompt. moveSecretCrossVault now checks the move, refusing an existing destination secret without --force, unlocks both vaults, and only then takes the lock. Under the lock, it checks that the destination vault still has the long-term key it unlocked, and copySecretAndRemoveSource checks the move again before it copies. A move within a vault takes the lock in moveSecretWithinVault, so MoveSecret takes none itself. The error for a vault created again with another key, shared with secret unlocker add, now ends "nothing was changed". The two tests of a source that cannot be removed now call copySecretAndRemoveSource, since the lock refuses their wrapped filesystems. Model: opus-5-5