- Restore missing source files in `torch/src/` from `torch-lock` dependency.
- Setup ESLint in `torch/`.
- Fix linting issues in `src/lock-ops.mjs`, `src/lock-utils.mjs`, `src/ops.mjs`, `src/services/memory/embedder.js`.
- Mark 'Verify with lint' as completed in `src/todo/TODO_2026-02-14T13-30-00Z.md`.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Rename `torch/src/todo/TODO_2026-02-16T11:47:38Z.md` to `torch/src/todo/TODO_2026-02-16T11-47-38Z.md`
- Removes colons from the filename to fix "invalid path" errors on Windows CI runners
Co-authored-by: PR0M3TH3AN <[email protected]>
The file src/nostr/event_handler.py does not exist in the codebase, and EventHandler is not used in src/nostr/client.py.
However, src/repo-context.txt incorrectly contained references to this file and usage.
This change updates src/repo-context.txt to remove the hallucinated/outdated code references, aligning the documentation with the actual codebase state.
Attempts to remove unused imports in src/nostr/client.py were reverted as tests rely on monkeypatching them.
Co-authored-by: PR0M3TH3AN <[email protected]>
Added `src/tests/test_core_api_services.py` to test public methods of
`VaultService`, `ProfileService`, `SyncService`, `EntryService`,
`ConfigService`, `UtilityService`, and `NostrService` in `src/seedpass/core/api.py`.
These tests ensure proper thread safety (locking) and delegation to
the underlying `PasswordManager` and its components.
Key improvements:
- Verified locking behavior for thread-safe operations.
- Validated delegation logic for all service methods.
- Covered edge cases like default vs. custom password generation policies.
- Mocked external dependencies (pubsub bus, manager components) to isolate service logic.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Implement `escapeHtml` function in `docs/assets/theme.js`
- Update `highlight` function to safely escape content before wrapping matches in `<mark>` tags
- Update `torch/src/todo/TODO_2026-02-16T11:47:38Z.md` to mark task as completed
Co-authored-by: PR0M3TH3AN <[email protected]>
Adds comprehensive tests for `src/utils/imghdr_stub.py` to ensure it correctly identifies image headers, covering all supported formats and edge cases. This is crucial as `imghdr` is removed in Python 3.13 and this stub is used by dependencies like `pgpy`.
- Added `src/tests/test_imghdr_stub.py` covering:
- `what()` function with file paths, Path objects, file-like objects, and bytes.
- All supported image formats (JPEG, PNG, GIF, TIFF, etc.).
- Edge cases (empty file, short file, unknown type).
- Verified tests pass locally.
Co-authored-by: PR0M3TH3AN <[email protected]>
Replaced insecure string comparison with `secrets.compare_digest` in `_check_token` to prevent timing attacks.
Added a test case for missing token to ensure robust error handling.
Co-authored-by: PR0M3TH3AN <[email protected]>
Refactored `_fetch_chunks_with_retry` in `src/nostr/client.py` to fetch snapshot chunks concurrently using `asyncio.gather`.
Introduced a `asyncio.Semaphore(10)` to limit concurrency and prevent overwhelming relays.
Extracted single chunk fetch logic into `_fetch_single_chunk` helper method.
Added `sys.path` fix to `src/tests/test_nostr_snapshot.py` to enable running tests.
Performance improvement: ~10x speedup for 10 chunks (1.0s -> 0.1s in local reproduction).
Co-authored-by: PR0M3TH3AN <[email protected]>
Extracts common logic for path preparation and lock acquisition into a private helper function `_get_portalocker_lock`. This simplifies `exclusive_lock` and `shared_lock` implementations.
Also updates the docstring for `exclusive_lock` to correctly describe the file mode as "binary read/write mode" (r+b) instead of "binary append mode".
Co-authored-by: PR0M3TH3AN <[email protected]>
- Add `get_totp_secret` to `EntryManager` and `EntryService` to allow retrieving the secret (derived or imported) without calculating the code.
- Update `TotpViewerWindow` in GUI to cache TOTP secrets locally. This prevents expensive PBKDF2/BIP39 derivation on every UI refresh (every second).
- Clean up unused imports and f-strings in `entry_management.py`.
Benchmarks show a ~9x speedup for 10 frames (50 entries) and >100x speedup for steady state.
Co-authored-by: PR0M3TH3AN <[email protected]>
Introduced a random salt to key derivation for parent seed encryption to prevent rainbow table attacks. The salt is now stored in the `parent_seed.enc` file header (V3 format).
* Modified `src/utils/key_derivation.py` to accept optional `salt` argument.
* Modified `src/seedpass/core/encryption.py` to read/write salt in `parent_seed.enc` using V3 format (V3:salt:nonce:ciphertext).
* Modified `src/seedpass/core/manager.py` to generate salt for new seeds and read salt for existing ones.
* Added auto-upgrade logic for legacy (no salt) seeds upon access.
* Updated tests to verify salt usage and backward compatibility.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Updated `InMemorySecret.get_bytes()` in `src/utils/memory_protection.py` to raise a `RuntimeError` if the secret has been wiped, replacing the previous `AttributeError`.
- Added `test_access_after_wipe_raises_error` to `src/tests/test_memory_protection.py` to verify this behavior.
Co-authored-by: PR0M3TH3AN <[email protected]>
The `backup_parent_seed` API endpoint was vulnerable to arbitrary file write via path traversal.
The `path` parameter was used directly to create a `Path` object, which was then passed to `_pm.handle_backup_reveal_parent_seed`.
This allowed an attacker to specify an arbitrary path (e.g., `../../evil_file`), which would be used by `encrypt_and_save_file` to write the encrypted seed to that location.
This commit fixes the vulnerability by validating that the `path` parameter is a valid filename (i.e., does not contain path separators or parent directory references) before processing it. This ensures that the backup file is always created within the intended fingerprint directory.
Co-authored-by: PR0M3TH3AN <[email protected]>
Removed the `print` statement in `src/seedpass/api.py` that leaked the
API token to stdout.
Enhanced the API server and CLI to support secure token management:
- Added `SEEDPASS_API_TOKEN` environment variable support in both
`api.py` and `cli.py`.
- Added a `--token` option to the `api start` CLI command.
- Redirected the auto-generated token output to stderr instead of stdout.
- Updated `api stop` to respect the `SEEDPASS_API_TOKEN` environment
variable.
These changes prevent the API token from being easily logged in insecure
environments where stdout is captured.
Co-authored-by: PR0M3TH3AN <[email protected]>
Removed the `test()` and `testall()` functions and the `if __name__ == "__main__":` block which were used for manual testing and are not needed by the codebase.
This improves maintainability and readability by focusing the module on its core functionality.
Co-authored-by: PR0M3TH3AN <[email protected]>
