From f776ce099e2c6bd688140497974181a31f9cdf04 Mon Sep 17 00:00:00 2001 From: smoido Date: Sun, 13 Sep 2026 00:00:46 +0300 Subject: [PATCH] Build the SecureString for an inline key on Windows too The vault is written with ConvertFrom-SecureString -SecureString, so the inline branch has to produce a SecureString as well - it only set the plain text, and under Set-StrictMode the vault write then failed with 'the variable $secure cannot be retrieved'. Caught by running the new form on the Windows box rather than assuming it. Co-Authored-By: Claude Code --- claude-mode.ps1 | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/claude-mode.ps1 b/claude-mode.ps1 index f27bd0b..9a24636 100644 --- a/claude-mode.ps1 +++ b/claude-mode.ps1 @@ -379,7 +379,10 @@ function Set-VaultKey { Initialize-Root if ($Key) { Write-Warn2 'the key was given on the command line, so it is in this shell history - the hidden prompt leaves no trace' - $plain = $Key + $plain = $Key + # The vault is written from a SecureString (DPAPI), so the inline form + # has to produce one too. + $secure = ConvertTo-SecureString -String $Key -AsPlainText -Force } else { Write-Host "Paste the API key for ref '$Ref' (input hidden):" $secure = Read-Host -AsSecureString