Replaced non-deterministic `time.sleep` calls with active polling loops or
thread joins in `src/tests/` to improve test determinism and reliability.
Modified `test_unlock_sync.py`, `test_nostr_sdk_workflow.py`,
`test_background_relay_check.py`, `test_offline_mode_behavior.py`, and
`test_nostr_index_size.py`.
Generated integrity and audit reports in `reports/test-audit/`.
Completed the scheduler rotation by publishing completion logic and
task log file to `torch/task-logs/daily/`.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Added `pytest.importorskip` calls for `pty` and `termios` to `src/tests/test_ai_tui_agent_harness.py`.
- Formatted `torch/scripts/test-audit/run_python_static_analysis.py` and `torch/scripts/test-audit/run_python_flaky_check.py` using `black`.
Co-authored-by: PR0M3TH3AN <[email protected]>
Added pytest.importorskip calls for 'pty' and 'termios' modules in
test_ai_tui_agent_harness.py to fix test failures on Windows where
these modules are unavailable.
Co-authored-by: PR0M3TH3AN <[email protected]>
Added `pytest.importorskip("pty")` and `pytest.importorskip("termios")` before `_load_harness_module()` call to properly skip `test_ai_tui_agent_harness.py` on Windows environments where these modules are not available. This prevents the `ModuleNotFoundError: No module named 'termios'` error during pytest collection.
Co-authored-by: PR0M3TH3AN <[email protected]>
Fixed broken documentation links pointing to non-existent \`docs/agent-handoffs/learnings\`
and \`docs/prompt-versioning.md\` files in \`TORCH.md\` and \`scheduler-lock.mjs\`.
Completed memory storage/retrieval steps and finalized the scheduler loop by
writing the required \`_completed.md\` task log.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Skip `src/tests/test_ai_tui_agent_harness.py` on Windows to avoid `ImportError` due to missing `termios`/`pty` modules.
- Ensure the harness module is only loaded if the skip condition is not met.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Formatted `src/tests/conftest.py` using `black` to fix CI formatting failures.
- This change ensures compliance with the repository's strict formatting checks (`poetry run black --check .`).
Co-authored-by: PR0M3TH3AN <[email protected]>
- Manually applied PEP 8 formatting (sorted imports, correct spacing) to `src/tests/conftest.py` to satisfy `poetry run black --check .` in CI.
- Retained the robust `try-import-except` logic for `trio` detection.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Made `trio` backend detection in `src/tests/conftest.py` robust by using `try-import-except` instead of `find_spec`, fixing `ModuleNotFoundError` in environments where `find_spec` behavior differs or trio is partially present but not importable.
- Prevented test pollution in `src/tests/test_gui_features.py` by adding `try...finally` block to unsubscribe `refresh_codes` from the global `bus`, ensuring subsequent CLI tests (like `test_nostr_sync`) don't crash due to lingering callbacks.
- Hardened `src/seedpass_gui/app.py` against test-induced errors:
- `TotpViewerWindow.refresh_codes` now accepts `*args, **kwargs` to safely ignore event arguments if called via subscription.
- `MainWindow.vault_locked` catches `ValueError` when closing, handling cases where the window is already detached in test environments.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Restored `src/tests/conftest.py` from `.bak` to fix missing `trio` conditional check, resolving `ModuleNotFoundError: No module named 'trio'`.
- Added `clean_pubsub` autouse fixture to `conftest.py` to clear the global `bus` subscribers between tests. This prevents test pollution that was causing `TypeError` in CLI tests and `ValueError` in GUI tests due to lingering callbacks.
Co-authored-by: PR0M3TH3AN <[email protected]>
Fixes `OSError: [Errno 22] Invalid argument` in Windows CI runs by mocking
`utils.password_prompt.masked_input` in `test_add_and_delete_entry`. This prevents
`msvcrt.getwch()` from being called in non-interactive environments when
`PasswordManager.add_new_fingerprint` requests a password/seed.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Explicitly mocks `utils.seed_prompt.masked_input`, `seedpass.core.manager.masked_input`, and `utils.password_prompt.masked_input` in `test_add_and_delete_entry`.
- This prevents `msvcrt.getwch()` from being called in non-interactive CI environments on Windows, which was causing `OSError: [Errno 22] Invalid argument`.
Co-authored-by: PR0M3TH3AN <[email protected]>
Consolidated duplicated menu loop logic from `_entry_actions_menu`, `_entry_edit_menu`, and `_entry_qr_menu` in `src/seedpass/core/manager.py` into a reusable `run_menu` method in `src/seedpass/core/menu_handler.py`. This improves maintainability by centralizing the loop handling, input prompting, and header clearing logic.
* Added `run_menu` to `MenuHandler`.
* Refactored `_entry_actions_menu` to use `run_menu`.
* Refactored `_entry_edit_menu` to use `run_menu`.
* Refactored `_entry_qr_menu` (NOSTR section) to use `run_menu`.
Co-authored-by: PR0M3TH3AN <[email protected]>
Extracts the hardcoded BeeWare GUI backend configuration (package names, versions, and SHA256 hashes) from `src/seedpass/cli/__init__.py` into a new `GUI_BACKEND_CONFIG` dictionary in `src/constants.py`. This improves maintainability by centralizing configuration and simplifying the CLI logic.
- Adds `GUI_BACKEND_CONFIG` to `src/constants.py`.
- Updates `src/seedpass/cli/__init__.py` to import and use `GUI_BACKEND_CONFIG`.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Introduced `_clear_header_add_entry`, `_mark_dirty`, `_sync_and_pause` helpers.
- Introduced `_entry_op_context` context manager for error handling.
- Applied these patterns to `handle_add_totp`, `handle_add_ssh_key`, `handle_add_seed`, `handle_add_pgp`, `handle_add_nostr_key`, `handle_add_key_value`, and `handle_add_managed_account`.
- Ensured `is_dirty` flag is set immediately after entry creation to prevent data loss if subsequent UI steps are cancelled.
Co-authored-by: PR0M3TH3AN <[email protected]>
This change explicitly adds `pycryptodome` to `pyproject.toml` and `src/requirements.txt` to resolve a `ModuleNotFoundError` when generating PGP RSA keys. The `Crypto` namespace provided by `pycryptodome` is required by `src/seedpass/core/password_generation.py`.
Verified with `reproduce_issue.py` (which now passes) and `src/tests/test_pgp_entry.py`.
Co-authored-by: PR0M3TH3AN <[email protected]>
Add `src/tests/test_fingerprint.py` to cover:
- Happy path fingerprint generation.
- Custom fingerprint length.
- Input normalization (whitespace/case).
- Error handling via mocked exception in `hashlib.sha256`.
- Invalid input handling (NoneType).
This addresses the gap where the exception path in `src/utils/fingerprint.py` was unreachable with standard inputs.
Co-authored-by: PR0M3TH3AN <[email protected]>
This change mitigates an arbitrary file overwrite vulnerability in the
`backup_parent_seed` API endpoint. Previously, the endpoint did not
check if the destination file already existed, allowing attackers or
accidental misuse to overwrite critical files if the path validation
passed.
The fix introduces a check using `resolved_path.exists()` after path
validation. If the file exists, the request is rejected with a
409 Conflict error.
A reproduction test case confirmed the vulnerability and verified the
fix. Regression tests on the API passed successfully.
Co-authored-by: PR0M3TH3AN <[email protected]>
Extracted the monolithic `display_sensitive_entry_info` method from `PasswordManager` into a new `DisplayService` class in `src/seedpass/core/display_service.py`. This improves maintainability and separation of concerns.
- Created `src/seedpass/core/display_service.py` with `DisplayService` class.
- Implemented specific display methods for each entry type (TOTP, SSH, SEED, PGP, Nostr, Key/Value, Managed Account, Password).
- Updated `src/seedpass/core/manager.py` to use `DisplayService`.
- Verified with existing tests `test_manager_retrieve_totp.py` and `test_manager_search_display.py`.
Co-authored-by: PR0M3TH3AN <[email protected]>
Refactors `import_vault` endpoint in `src/seedpass/api.py` to use `asyncio.to_thread` for blocking file I/O and synchronous `PasswordManager.handle_import_database` calls.
Replaces synchronous `pm.sync_vault()` with `await pm.sync_vault_async()` (with fallback) to prevent blocking the event loop or triggering `asyncio.run` errors.
This change ensures the API remains responsive during large vault imports.
Verified with a custom benchmark script showing concurrent requests are no longer blocked.
Co-authored-by: PR0M3TH3AN <[email protected]>
This commit adds a new test file `src/tests/test_stats_manager.py` to verify the functionality of the `StatsManager.reset` method. The test ensures that the `reset` method correctly resets the internal `_displayed` flag, allowing stats to be displayed again after a reset.
Testing:
- Added `test_stats_manager_reset` which mocks the manager and verifies `display_stats` calls before and after reset.
- Verified the test passes in isolation.
- Skipped full integration tests due to environment limitations, but the change is isolated to a new test file and does not modify production code.
Co-authored-by: PR0M3TH3AN <[email protected]>
Added two new test cases to `src/tests/test_atomic_write.py`:
- `test_atomic_write_cleanup_on_failure`: Verifies that the temporary file is deleted if the write operation fails.
- `test_atomic_write_preserves_existing_on_failure`: Verifies that an existing destination file is preserved if the write operation fails.
These tests ensure the robustness of the `atomic_write` utility function.
Co-authored-by: PR0M3TH3AN <[email protected]>
This commit addresses a security vulnerability where legacy Fernet keys
were derived using PBKDF2 with an empty salt (b"").
Changes:
- Modified `_derive_legacy_key_from_password` to accept an optional `salt`
parameter.
- Updated `EncryptionManager.decrypt_legacy` to attempt decryption using
a salt derived from the user's fingerprint (unique per user) before
falling back to the empty salt for backward compatibility.
- Added a new test file `src/tests/test_legacy_salt_fix.py` to verify the
new logic.
Rationale: Using a unique salt per user is standard practice to prevent
precomputed attacks. While legacy vaults cannot be retroactively
secured, this change ensures that any future legacy-style derivations
use a unique salt if possible, while maintaining access to existing
vaults.
Co-authored-by: PR0M3TH3AN <[email protected]>
