From bfef3e5c1eaed3c064254914c956bdc81f6b6d77 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E9=9B=B7=E7=94=B5=E8=8A=BD=E8=A1=A3?=
 <zhangyanghaha0407@outlook.com>
Date: Mon, 24 Aug 2026 20:24:55 -0400
Subject: [PATCH] Secret: purge stale lower-tier copies on set, warn on
 unreachable rm, fresh 0600

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QKxGW1raAWaqeU8WdHsMsp
---
 bin/omarchy-cn-ai-secret | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/bin/omarchy-cn-ai-secret b/bin/omarchy-cn-ai-secret
index c5b926d1..e9373ead 100755
--- a/bin/omarchy-cn-ai-secret
+++ b/bin/omarchy-cn-ai-secret
@@ -38,13 +38,21 @@ set)
   fi
   if secret_service_ok; then
     printf '%s' "$key" | secret-tool store --label "OmarchyCN AI: $provider" service omarchycn key "ai/$provider"
+    # Purge stale copies in lower-priority backends so get never falls
+    # through to an outdated key
+    if pass_ok; then
+      pass rm -f "omarchycn/ai/$provider" > /dev/null 2>&1 || true
+    fi
+    rm -f "$FILE_PATH"
     echo "Stored in Secret Service (secret-tool)"
   elif pass_ok; then
     printf '%s\n' "$key" | pass insert -m -f "omarchycn/ai/$provider" > /dev/null
+    rm -f "$FILE_PATH"
     echo "Stored in pass (omarchycn/ai/$provider)"
   else
     mkdir -p "$FILE_DIR"
     chmod 700 "$FILE_DIR"
+    rm -f "$FILE_PATH"
     (umask 177 && printf '%s' "$key" > "$FILE_PATH")
     echo "Stored in $FILE_PATH (0600 file fallback — 安装 libsecret 或 pass 可获得更安全的存储)"
   fi
@@ -75,6 +83,9 @@ rm)
     rm -f "$FILE_PATH"
     removed=1
   fi
+  if command -v secret-tool > /dev/null 2>&1 && ! secret_service_ok; then
+    echo "警告: Secret Service 当前不可达，其中的副本（如有）未被清除" >&2
+  fi
   if (( removed == 0 )); then
     echo "No secret stored for $provider" >&2
     exit 1