Conversation
Undline
commented
Apr 7, 2026
Undline
commented
- POST /identities/new: passphrase re-encrypts vault.json, append Ed25519 profile, refresh session
- Nav + dashboard link; profile detail redirect; copy clarifies same passphrase as unlock
- Session idle (30m) and max lifetime (8h) pruning + middleware; replace_session_vault after save
- Unix: vault.json 0o600, vault dir 0o700 after write (no chmod on Windows)
- Tests: session expiry, add identity HTTP + disk, wrong passphrase unchanged vault
- POST /identities/new: passphrase re-encrypts vault.json, append Ed25519 profile, refresh session - Nav + dashboard link; profile detail redirect; copy clarifies same passphrase as unlock - Session idle (30m) and max lifetime (8h) pruning + middleware; replace_session_vault after save - Unix: vault.json 0o600, vault dir 0o700 after write (no chmod on Windows) - Tests: session expiry, add identity HTTP + disk, wrong passphrase unchanged vault Made-with: Cursor
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7a5f65ce53
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| status_code=500, | ||
| ) | ||
|
|
||
| replace_session_vault(sessions, sid, UnlockedVault(profiles)) |
There was a problem hiding this comment.
POST /identities/new writes the updated profile list to disk but only calls replace_session_vault for the current sid. If the vault is unlocked in another active session (for example, a second browser/profile), that session keeps an out-of-date in-memory UnlockedVault, so /identities and /identities/{id} can show stale results until re-unlock. This inconsistency is introduced by the new mutable add-identity flow and is user-visible whenever multiple session records exist concurrently.
Useful? React with 👍 / 👎.
1 participant
