mirror of
https://github.com/PR0M3TH3AN/SeedPass.git
synced 2026-11-01 10:22:03 +00:00
thePR0M3TH3ANandClaude Opus 5
688a5d392a
The TUI's three plaintext exports (document, database, 2FA codes) passed mode 0o600 to writeFile and a comment asserted the result. But mode applies only when the file is created: exporting over an existing 0644 file left it 0644 -- for the 2FA export, that is every TOTP secret in the vault sitting world-readable -- and a pre-planted symlink at the destination could redirect the plaintext somewhere else entirely. The CLI already avoided both by writing through atomicWrite (fresh 0600 inode, then rename) and explained why; the TUI regressed it. All three exports now go through one helper that asks before overwriting -- the TUI silently clobbered where the CLI required --overwrite -- and then writes via atomicWrite, so the mode and the symlink safety hold whether or not the destination existed. Tests: a pre-existing 0644 file at the destination comes back 0600 with the export's contents, and declining the overwrite leaves the original bytes untouched. Co-Authored-By: Claude Opus 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01Tkj4rzKBA3uhfgk7kqjsb8