thePR0M3TH3AN/SeedPass
1
0 Fork 0
mirror of https://github.com/PR0M3TH3AN/SeedPass.git synced 2026-10-30 09:22:03 +00:00
Code Issues Packages Projects Releases Wiki Activity
1,529 Commits 12 Branches 5 Tags
379d4ee98df6455ff3da1f1e771ea2da2222e9fb
Commit Graph
1529 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
google-labs-jules[bot]andPR0M3TH3AN 379d4ee98d Refactor BIP85: Remove redundant elif block 
Co-authored-by: PR0M3TH3AN <[email protected]>
 2026-02-16 17:40:47 +00:00
thePR0M3TH3AN 46f753a11a Merge pull request #870 from PR0M3TH3AN/fix-key-derivation-salt-12798847451274058286 
🔒 Fix Weak Key Derivation by Adding Salt
 2026-02-16 12:24:12 -05:00
thePR0M3TH3AN 8adc1e7220 Merge pull request #869 from PR0M3TH3AN/improve-inmemory-secret-error-handling-18204251655789169400 
Improve InMemorySecret wiped state error handling and testing
 2026-02-16 12:23:12 -05:00
google-labs-jules[bot]andPR0M3TH3AN 75fe5bc382 Fix weak key derivation by adding salt to parent seed encryption 
Introduced a random salt to key derivation for parent seed encryption to prevent rainbow table attacks. The salt is now stored in the `parent_seed.enc` file header (V3 format).

*   Modified `src/utils/key_derivation.py` to accept optional `salt` argument.
*   Modified `src/seedpass/core/encryption.py` to read/write salt in `parent_seed.enc` using V3 format (V3:salt:nonce:ciphertext).
*   Modified `src/seedpass/core/manager.py` to generate salt for new seeds and read salt for existing ones.
*   Added auto-upgrade logic for legacy (no salt) seeds upon access.
*   Updated tests to verify salt usage and backward compatibility.

Co-authored-by: PR0M3TH3AN <[email protected]>
 2026-02-16 17:22:54 +00:00
google-labs-jules[bot]andPR0M3TH3AN d729466513 test(utils): Add test and error handling for wiped InMemorySecret 
- Updated `InMemorySecret.get_bytes()` in `src/utils/memory_protection.py` to raise a `RuntimeError` if the secret has been wiped, replacing the previous `AttributeError`.
- Added `test_access_after_wipe_raises_error` to `src/tests/test_memory_protection.py` to verify this behavior.

Co-authored-by: PR0M3TH3AN <[email protected]>
 2026-02-16 17:21:45 +00:00
thePR0M3TH3AN 21c25a0b63 Merge pull request #868 from PR0M3TH3AN/security-fix-path-traversal-17059275168502501133 
🔒 Security Fix: Arbitrary File Read via Path Traversal in import_vault
 2026-02-16 12:21:21 -05:00
thePR0M3TH3AN a442229629 Merge pull request #867 from PR0M3TH3AN/fix-path-traversal-backup-parent-seed-11848666276588647800 
Fix arbitrary file write via path traversal in backup_parent_seed
 2026-02-16 12:20:37 -05:00
google-labs-jules[bot]andPR0M3TH3AN 9c6b6d221c Fix Arbitrary File Read via Path Traversal in import_vault endpoint 
Co-authored-by: PR0M3TH3AN <[email protected]>
 2026-02-16 17:20:28 +00:00
google-labs-jules[bot]andPR0M3TH3AN 91f39007f0 Fix arbitrary file write via path traversal in backup_parent_seed 
The `backup_parent_seed` API endpoint was vulnerable to arbitrary file write via path traversal.
The `path` parameter was used directly to create a `Path` object, which was then passed to `_pm.handle_backup_reveal_parent_seed`.
This allowed an attacker to specify an arbitrary path (e.g., `../../evil_file`), which would be used by `encrypt_and_save_file` to write the encrypted seed to that location.

This commit fixes the vulnerability by validating that the `path` parameter is a valid filename (i.e., does not contain path separators or parent directory references) before processing it. This ensures that the backup file is always created within the intended fingerprint directory.

Co-authored-by: PR0M3TH3AN <[email protected]>
 2026-02-16 17:17:44 +00:00
thePR0M3TH3AN 335de7abe3 Merge pull request #865 from PR0M3TH3AN/fix-sensitive-token-leak-stdout-13051886765392610577 
🔒 Fix sensitive API token exposure in stdout
 2026-02-16 11:48:09 -05:00
google-labs-jules[bot]andPR0M3TH3AN 99baf16b1b 🔒 Fix sensitive API token exposure in stdout 
Removed the `print` statement in `src/seedpass/api.py` that leaked the
API token to stdout.

Enhanced the API server and CLI to support secure token management:
- Added `SEEDPASS_API_TOKEN` environment variable support in both
  `api.py` and `cli.py`.
- Added a `--token` option to the `api start` CLI command.
- Redirected the auto-generated token output to stderr instead of stdout.
- Updated `api stop` to respect the `SEEDPASS_API_TOKEN` environment
  variable.

These changes prevent the API token from being easily logged in insecure
environments where stdout is captured.

Co-authored-by: PR0M3TH3AN <[email protected]>
 2026-02-16 16:47:51 +00:00
thePR0M3TH3AN d594d689d1 Merge pull request #864 from PR0M3TH3AN/remove-dead-code-imghdr-stub-1860538532359934490 
🧹 [code health] Remove dead code from src/utils/imghdr_stub.py
 2026-02-16 11:42:20 -05:00
google-labs-jules[bot]andPR0M3TH3AN cc42e7d6f0 chore: remove dead code from src/utils/imghdr_stub.py 
Removed the `test()` and `testall()` functions and the `if __name__ == "__main__":` block which were used for manual testing and are not needed by the codebase.
This improves maintainability and readability by focusing the module on its core functionality.

Co-authored-by: PR0M3TH3AN <[email protected]>
 2026-02-16 16:42:01 +00:00
thePR0M3TH3AN 8436311fa3 Merge pull request #863 from PR0M3TH3AN/agents/weekly/changelog-agent-2026-02-16-10358382466638125890 
docs(ai): weekly changelog draft
 2026-02-16 08:22:18 -05:00
thePR0M3TH3AN 61e7a9b045 Merge pull request #862 from PR0M3TH3AN/agents/daily/style-agent-16187229397196533781 
style-agent: daily run
 2026-02-16 08:21:39 -05:00
google-labs-jules[bot]andPR0M3TH3AN 9a2a8fd77d docs(ai): weekly changelog draft 
Co-authored-by: PR0M3TH3AN <[email protected]>
 2026-02-16 12:56:27 +00:00
google-labs-jules[bot]andPR0M3TH3AN 0a349df058 chore(ai): style-agent run 
- Formatted 8 files with black.
- Ran flake8 and logged warnings.
- Verified with pytest.
- Scheduler operations completed (lock check, lock, complete).
- Wrote task log to torch/task-logs/daily/.

Co-authored-by: PR0M3TH3AN <[email protected]>
 2026-02-16 12:54:54 +00:00
thePR0M3TH3AN 4dbd1db8c2 Merge pull request #861 from PR0M3TH3AN/agents/weekly/bug-reproducer-agent-innerhtml-repro-16374670332915725002 
Weekly Scheduler Run: bug-reproducer-agent
 2026-02-16 07:14:21 -05:00
google-labs-jules[bot]andPR0M3TH3AN 39f0407143 feat: reproduce innerhtml usage in torch/landing/index.html 
- added reproduction script `torch/examples/reproducers/ISSUE_daily_style-agent_innerhtml/repro.py`
- updated `torch/src/issues/ISSUE_daily_style-agent_innerhtml.md` with reproduction results
- added `torch/KNOWN_ISSUES.md` with issue entry
- added missing scripts to `torch/package.json`
- generated scheduler artifacts (CONTEXT, TODO, DECISIONS, TEST_LOG, task-logs/weekly)

Co-authored-by: PR0M3TH3AN <[email protected]>
 2026-02-16 12:08:16 +00:00
google-labs-jules[bot]andPR0M3TH3AN 5f3d790822 feat: reproduce innerhtml usage in torch/landing/index.html 
- added reproduction script `torch/examples/reproducers/ISSUE_daily_style-agent_innerhtml/repro.py`
- updated `torch/src/issues/ISSUE_daily_style-agent_innerhtml.md` with reproduction results
- added `torch/KNOWN_ISSUES.md` with issue entry
- added missing scripts to `torch/package.json`
- generated scheduler artifacts (CONTEXT, TODO, DECISIONS, TEST_LOG, task-logs/weekly)

Co-authored-by: PR0M3TH3AN <[email protected]>
 2026-02-16 11:57:32 +00:00
thePR0M3TH3AN 1e2c865b04 Merge pull request #860 from PR0M3TH3AN/agents/daily/scheduler-update-agent-1850363096375555446 
docs(prompts): sync roster.json and scheduler rosters with prompt directories
 2026-02-16 06:40:19 -05:00
google-labs-jules[bot]andPR0M3TH3AN 6871ce2b68 docs(prompts): sync roster.json and scheduler rosters with prompt directories 
- Update src/prompts/roster.json with current agents
- Update src/prompts/daily-scheduler.md roster table
- Update src/prompts/weekly-scheduler.md roster table
- Create run artifacts (context, todo, decisions, test_logs)
- Create daily task log

Co-authored-by: PR0M3TH3AN <[email protected]>
 2026-02-16 11:32:13 +00:00
thePR0M3TH3AN 5bdde403e6 Merge pull request #859 from PR0M3TH3AN/setup-torch-14198365201963154658 
Setup TORCH agent system
 2026-02-16 06:15:19 -05:00
google-labs-jules[bot]andPR0M3TH3AN 77be82c09a Setup TORCH agent system 
- Created `torch/` directory and initialized package.json
- Installed TORCH dependency from https://github.com/PR0M3TH3AN/TORCH
- Initialized TORCH environment with `npx torch-lock init`
- Updated .gitignore to exclude node_modules and generated files

Co-authored-by: PR0M3TH3AN <[email protected]>
 2026-02-16 05:33:36 +00:00
thePR0M3TH3AN a31db2bcd6 Update installation command in README.md 
Add SEEDPASS_HEADLESS environment variable for installation.
 2025-11-04 17:57:34 -05:00
thePR0M3TH3AN c9e7278c57 update 2025-11-04 17:36:36 -05:00
thePR0M3TH3AN c7f4617bba update 2025-11-04 17:09:34 -05:00
thePR0M3TH3AN 7bbe63261d update 2025-11-04 16:56:23 -05:00
thePR0M3TH3AN 80ea67e832 update 2025-11-04 16:47:19 -05:00
thePR0M3TH3AN 0d3d972abb Merge pull request #712 from PR0M3TH3AN/beta 
Beta
 2025-08-02 21:18:20 -04:00
thePR0M3TH3AN aeb146f862 Merge pull request #711 from PR0M3TH3AN/codex/add-password-mode-selection-and-quick-mode 
feat: add quick password entry mode
 2025-08-02 16:52:38 -04:00
thePR0M3TH3AN 7f503f0787 feat: add quick password entry mode 2025-08-02 16:43:43 -04:00
thePR0M3TH3AN 7a8c0aef86 Merge pull request #710 from PR0M3TH3AN/codex/add-entry-type-to-search-results 
Include entry type in search results
 2025-08-02 16:34:01 -04:00
thePR0M3TH3AN dcd095d1af Include entry type in search results 2025-08-02 16:26:52 -04:00
thePR0M3TH3AN b4f792ad67 Merge pull request #709 from PR0M3TH3AN/codex/add-key-validation-module-and-update-entrymanager 
Add key validation helpers and enforce in entry management
 2025-08-01 10:43:47 -04:00
thePR0M3TH3AN cc8fba9f12 Add key validation utilities and integrate 2025-08-01 10:38:40 -04:00
thePR0M3TH3AN 20896812a4 Merge pull request #708 from PR0M3TH3AN/codex/fix-exit-error-in-seedpass 
Fix crash when exiting without Nostr client
 2025-08-01 09:50:58 -04:00
thePR0M3TH3AN 144751ef02 fix exit crash when nostr client missing 2025-08-01 09:28:49 -04:00
thePR0M3TH3AN 05d4bd94b6 Merge pull request #707 from PR0M3TH3AN/codex/fix-stats-screen-display-duration 
Fix stats screen clearing bug
 2025-08-01 08:49:15 -04:00
thePR0M3TH3AN 9adb539b84 Keep stats screen visible 2025-08-01 08:32:44 -04:00
thePR0M3TH3AN 64339b0c20 Merge pull request #706 from PR0M3TH3AN/codex/update-installation-script-and-documentation 
Improve install script dependency handling
 2025-07-31 22:06:30 -04:00
thePR0M3TH3AN 4ccdd2b3df feat(install): auto install gtk deps 2025-07-31 21:42:28 -04:00
thePR0M3TH3AN 61f1f5c02f Merge pull request #705 from PR0M3TH3AN/codex/revise-start_background_sync-implementation 
Implement async sync worker cleanup
 2025-07-31 21:37:14 -04:00
thePR0M3TH3AN 77757152d7 Add async background sync task management 2025-07-31 19:38:09 -04:00
thePR0M3TH3AN 265817b67d Merge pull request #704 from PR0M3TH3AN/codex/add-nostr-backup-restoration-features 
Add Nostr restore guidance
 2025-07-31 19:28:22 -04:00
thePR0M3TH3AN e3bd669668 Add Nostr restore guidance and tests 2025-07-31 18:28:48 -04:00
thePR0M3TH3AN f58ed03e6f Merge pull request #703 from PR0M3TH3AN/codex/add-statsmanager-module-and-integrate-functionality 
Implement stats manager for one-time display
 2025-07-31 16:11:56 -04:00
thePR0M3TH3AN 6d82ef1815 Add StatsManager for single display 2025-07-31 16:01:40 -04:00
thePR0M3TH3AN a4ddd120c8 Merge pull request #702 from PR0M3TH3AN/codex/edit-manager.py-to-handle-import-errors 
Improve database import validation
 2025-07-31 15:53:07 -04:00
thePR0M3TH3AN 47da67b37c Improve import handling 2025-07-31 15:47:24 -04:00