@wlfi-agent/cli 1.4.16 → 1.4.18

package/crates/vault-cli-daemon/tests/system_keychain_helper_acl.rs

@@ -64,6 +64,11 @@ mod macos {
 
     #[test]
     fn helper_owned_items_are_not_readable_without_interaction() {
+        if std::env::var_os("WLFI_TEST_ISOLATED").is_some() {
+            eprintln!("skipping macOS keychain ACL integration test under isolated harness");
+            return;
+        }
+
         let helper = PathBuf::from(env!("CARGO_BIN_EXE_wlfi-agent-system-keychain"));
         let temp_dir = unique_temp_dir();
         let keychain_path = temp_dir.join("acl-test.keychain-db");

package/crates/vault-daemon/src/daemon_parts/api_impl_and_utils.rs

@@ -419,7 +419,38 @@ where
                 ));
             }
 
-            let nonce = {
+            let nonce = if request.exact_nonce {
+                {
+                    let reservations = self
+                        .nonce_reservations
+                        .read()
+                        .map_err(|_| DaemonError::LockPoisoned)?;
+                    if reservations.values().any(|reservation| {
+                        reservation.vault_key_id == agent_key.vault_key_id
+                            && reservation.chain_id == request.chain_id
+                            && reservation.nonce == request.min_nonce
+                    }) {
+                        return Err(DaemonError::InvalidNonceReservation(format!(
+                            "nonce {} is already reserved for chain_id {}",
+                            request.min_nonce, request.chain_id
+                        )));
+                    }
+                }
+
+                let next_head = request.min_nonce.checked_add(1).ok_or_else(|| {
+                    DaemonError::InvalidNonceReservation("nonce allocation overflow".to_string())
+                })?;
+                let mut nonce_heads = self
+                    .nonce_heads
+                    .write()
+                    .map_err(|_| DaemonError::LockPoisoned)?;
+                let chain_heads = nonce_heads.entry(agent_key.vault_key_id).or_default();
+                let head = chain_heads.entry(request.chain_id).or_insert(next_head);
+                if *head <= request.min_nonce {
+                    *head = next_head;
+                }
+                request.min_nonce
+            } else {
                 let mut nonce_heads = self
                     .nonce_heads
                     .write()