This cost grom his stored password once. Two unit tests ran at the same
time: one redirected the config directory through `BENILLA_HOME`, which
is process-wide, while the other stood up `LoginPlugin`, whose `build`
had just gained a call to `migrate_plaintext`. So his real
`autologin.toml` was upgraded against a key file that was not the one
beside it — the plaintext was cleared and the blob replacing it does not
decrypt. He types the password once more and `remember` stores it
properly, since a blob that answers empty does not match and is resealed.
Two fixes, and the second is the one that matters.
The migration is now `#[cfg(not(test))]`: it was the only line in that
plugin's build that writes to the player's own config directory, and no
test has any business there.
`autologin::sealed` encrypts and then **reads the blob back**, and
refuses to clear the plaintext unless the round trip holds. That would
have prevented this on its own, and it closes the general hole rather
than this instance of it: `credential.rs` already carries a note about a
scheme that round-trips with itself while being wrong, and this is the
same mistake one level up — the cipher was right, the *key* was what
disagreed, and the only readable copy of the password was thrown away
before anything checked.
A test drives the keep-it branch through the hermetic capture flag, the
one state where sealing honestly cannot work, and asserts the plaintext
is still there afterwards. An ignored `live_check` test reads the real
store by hand and prints lengths only, never the password; it is what
caught this.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SgstFWtn1RxEJ5kVrpgYwn
gromandClaude Opus 5
152788d894