Secret: purge stale lower-tier copies on set, warn on unreachable rm, fresh 0600

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QKxGW1raAWaqeU8WdHsMsp

bin/omarchy-cn-ai-secret

@@ -38,13 +38,21 @@ set)
   fi
   if secret_service_ok; then
     printf '%s' "$key" | secret-tool store --label "OmarchyCN AI: $provider" service omarchycn key "ai/$provider"
+    # Purge stale copies in lower-priority backends so get never falls
+    # through to an outdated key
+    if pass_ok; then
+      pass rm -f "omarchycn/ai/$provider" > /dev/null 2>&1 || true
+    fi
+    rm -f "$FILE_PATH"
     echo "Stored in Secret Service (secret-tool)"
   elif pass_ok; then
     printf '%s\n' "$key" | pass insert -m -f "omarchycn/ai/$provider" > /dev/null
+    rm -f "$FILE_PATH"
     echo "Stored in pass (omarchycn/ai/$provider)"
   else
     mkdir -p "$FILE_DIR"
     chmod 700 "$FILE_DIR"
+    rm -f "$FILE_PATH"
     (umask 177 && printf '%s' "$key" > "$FILE_PATH")
     echo "Stored in $FILE_PATH (0600 file fallback — 安装 libsecret 或 pass 可获得更安全的存储)"
   fi
@@ -75,6 +83,9 @@ rm)
     rm -f "$FILE_PATH"
     removed=1
   fi
+  if command -v secret-tool > /dev/null 2>&1 && ! secret_service_ok; then
+    echo "警告: Secret Service 当前不可达，其中的副本（如有）未被清除" >&2
+  fi
   if (( removed == 0 )); then
     echo "No secret stored for $provider" >&2
     exit 1