security-high high

Using std::fs::write directly to write the encryption key is insecure because it does not guarantee restrictive file permissions (such as 0o600) and is not atomic, which could lead to key file corruption if interrupted.

Instead, use the existing ensure_key_dir helper to secure the parent directory and save_key_file to write the key atomically with secure permissions.

 let _ = ensure_key_dir(key_file);
 if let Err(e) = save_key_file(key_file, b64_key.trim()) {
 eprintln!(
 "Warning: failed to mirror keyring key to '{}': {}",
 key_file.display(),
 e
 );
 }

security-high high

Using std::fs::write directly to write the encryption key is insecure because it does not guarantee restrictive file permissions (such as 0o600) and is not atomic, which could lead to key file corruption if interrupted.

Instead, use the existing ensure_key_dir helper to secure the parent directory and save_key_file to write the key atomically with secure permissions.

 let _ = ensure_key_dir(key_file);
 if let Err(e) = save_key_file(key_file, b64_key.trim()) {
 eprintln!(
 "Warning: failed to mirror keyring key to '{}': {}",
 key_file.display(),
 e
 );
 }

critical

The current implementation uses std::fs::write, which is not atomic. This could lead to a corrupted .encryption_key file if the process is interrupted, which would be as severe as the bug this PR aims to fix. Additionally, std::fs::create_dir_all is used without setting secure permissions on the directory, and the error message is not sanitized, which violates a repository rule.

To address these issues, you should use the existing helper functions:

• ensure_key_dir to create the directory with secure permissions (0700).
• save_key_file which performs an atomic write.
• sanitize_for_terminal on the error message.

 if let Err(e) = ensure_key_dir(key_file) {
 eprintln!(
 "Warning: failed to create secure directory for '{}': {}",
 key_file.display(),
 sanitize_for_terminal(&e.to_string())
 );
 }
 if let Err(e) = save_key_file(key_file, b64_key.trim()) {
 eprintln!(
 "Warning: failed to mirror keyring key to '{}': {}",
 key_file.display(),
 sanitize_for_terminal(&e.to_string())
 );
 }

high

Performing an atomic write (which includes an fsync call) on every single CLI invocation is highly inefficient and introduces unnecessary startup latency and disk wear. Since the key in the keyring is already mirrored to the .encryption_key file in most cases, we should first check if the file already exists and contains the correct key before attempting to write to it.

 let mut needs_write = true;
 if let Some(existing_key) = read_key_file(key_file) {
 if existing_key == arr {
 needs_write = false;
 }
 }
 if needs_write {
 if let Err(e) = ensure_key_dir(key_file) {
 eprintln!(
 "Warning: failed to set up key directory '{}': {}",
 key_file.display(),
 e
 );
 }
 if let Err(e) = save_key_file(key_file, b64_key.trim()) {
 eprintln!(
 "Warning: failed to mirror keyring key to '{}': {}",
 key_file.display(),
 e
 );
 }
 }

high

If ensure_key_dir fails, the parent directory cannot be created, which guarantees that save_key_file will also fail. This results in redundant I/O attempts and duplicate warning messages printed to the terminal. We should only attempt to write the key file if the directory setup succeeds.

 match ensure_key_dir(key_file) {
 Ok(()) => {
 if let Err(e) = save_key_file(key_file, b64_key.trim()) {
 eprintln!(
 "Warning: failed to mirror keyring key to '{}': {}",
 key_file.display(),
 sanitize_for_terminal(&e.to_string())
 );
 }
 }
 Err(e) => {
 eprintln!(
 "Warning: failed to set up key directory '{}': {}",
 key_file.display(),
 sanitize_for_terminal(&e.to_string())
 );
 }
 }

high

If ensure_key_dir fails, the parent directory cannot be created, which guarantees that save_key_file will also fail. This results in redundant I/O attempts and duplicate warning messages printed to the terminal. We should only attempt to write the key file if the directory setup succeeds.

 match ensure_key_dir(key_file) {
 Ok(()) => {
 if let Err(e) = save_key_file(key_file, b64_key.trim()) {
 eprintln!(
 "Warning: failed to mirror keyring key to '{}': {}",
 key_file.display(),
 sanitize_for_terminal(&e.to_string())
 );
 }
 }
 Err(e) => {
 eprintln!(
 "Warning: failed to set up key directory '{}': {}",
 key_file.display(),
 sanitize_for_terminal(&e.to_string())
 );
 }
 }

high

If ensure_key_dir fails, the parent directory cannot be created or accessed, meaning any subsequent call to save_key_file is guaranteed to fail. This results in redundant I/O operations and duplicate warning messages printed to the terminal. Using else if prevents the write attempt when directory setup fails.

 if let Err(e) = ensure_key_dir(key_file) {
 eprintln!(
 "Warning: failed to set up key directory '{}': {}",
 key_file.display(),
 sanitize_for_terminal(&e.to_string())
 );
 } else if let Err(e) = save_key_file(key_file, b64_key.trim()) {
 eprintln!(
 "Warning: failed to mirror keyring key to '{}': {}",
 key_file.display(),
 sanitize_for_terminal(&e.to_string())
 );
 }

high

If ensure_key_dir fails, the parent directory cannot be created or accessed, meaning any subsequent call to save_key_file is guaranteed to fail. This results in redundant I/O operations and duplicate warning messages printed to the terminal. Using else if prevents the write attempt when directory setup fails.

 if let Err(e) = ensure_key_dir(key_file) {
 eprintln!(
 "Warning: failed to set up key directory '{}': {}",
 key_file.display(),
 sanitize_for_terminal(&e.to_string())
 );
 } else if let Err(e) = save_key_file(key_file, b64_key.trim()) {
 eprintln!(
 "Warning: failed to mirror keyring key to '{}': {}",
 key_file.display(),
 sanitize_for_terminal(&e.to_string())
 );
 }

high

If ensure_key_dir fails, the parent directory does not exist or has incorrect permissions, meaning any subsequent attempt to write the key file via save_key_file is guaranteed to fail. We should avoid calling save_key_file if ensure_key_dir returns an error to prevent redundant system calls and duplicate warning logs.

 if let Err(e) = ensure_key_dir(key_file) {
 eprintln!(
 "Warning: failed to set up key directory '{}': {}",
 key_file.display(),
 sanitize_for_terminal(&e.to_string())
 );
 } else if let Err(e) = save_key_file(key_file, b64_key.trim()) {
 eprintln!(
 "Warning: failed to mirror keyring key to '{}': {}",
 key_file.display(),
 sanitize_for_terminal(&e.to_string())
 );
 }

high

If ensure_key_dir fails, the parent directory does not exist or has incorrect permissions, meaning any subsequent attempt to write the key file via save_key_file is guaranteed to fail. We should avoid calling save_key_file if ensure_key_dir returns an error to prevent redundant system calls and duplicate warning logs.

 if let Err(e) = ensure_key_dir(key_file) {
 eprintln!(
 "Warning: failed to set up key directory '{}': {}",
 key_file.display(),
 sanitize_for_terminal(&e.to_string())
 );
 } else if let Err(e) = save_key_file(key_file, b64_key.trim()) {
 eprintln!(
 "Warning: failed to mirror keyring key to '{}': {}",
 key_file.display(),
 sanitize_for_terminal(&e.to_string())
 );
 }