clawbot
f081505f78
check / check (push) Waiting to run
secret add, import and generate secret crashed with memguard's panic once a value outgrew the locked-memory limit, and because the value was held twice, half the usual 8 MiB limit was enough. secret now raises the limit to the hard limit at startup. The value is read a page at a time into a memguard.Stream, which keeps it encrypted, then copied once into locked memory after its size is checked against 100 MiB and against the limit less 16 pages for the command's keys. It comes out of the stream through Next, not Read: Read re-encrypts a leftover piece, and memguard hangs if that runs out of locked memory. Judgement call: with a limit of 64 KiB or less, nothing can be stored. Model: opus-5-5