Merge pull request #1019 from apple-ouyang/codex/refresh-security-seed-before-sync

Fix stale Security Seed after remote rebuild

src/modules/core/ModuleReplicator.ts

@@ -49,7 +49,8 @@ async function canReplicateWithPBKDF2(
     // Showing message is false: that because be shown here. (And it is a fatal error, no way to hide it).
     // tagged as network error at beginning for error filtering with NetworkWarningStyles
     const ensureMessage = `${MARK_LOG_NETWORK_ERROR}Failed to initialise the encryption key, preventing replication.`;
-    const ensureResult = await replicator.ensurePBKDF2Salt(currentSettings, showMessage, true);
+    // A remote database rebuild replaces the Security Seed while this process may still hold the previous one.
+    const ensureResult = await replicator.ensurePBKDF2Salt(currentSettings, showMessage, false);
     if (!ensureResult) {
         errorManager.showError(ensureMessage, showMessage ? LOG_LEVEL_NOTICE : LOG_LEVEL_INFO);
         return false;

src/modules/core/ModuleReplicator.unit.spec.ts

@@ -0,0 +1,48 @@
+import { describe, expect, it, vi } from "vitest";
+import { ModuleReplicator } from "./ModuleReplicator";
+
+describe("ModuleReplicator", () => {
+    it("refreshes the remote Security Seed before replication", async () => {
+        const ensurePBKDF2Salt = vi.fn(async () => true);
+        let beforeReplicate: ((showMessage: boolean) => Promise<boolean>) | undefined;
+        const addHandler = vi.fn((handler: (showMessage: boolean) => Promise<boolean>, priority?: number) => {
+            if (priority === 20) {
+                beforeReplicate = handler;
+            }
+        });
+        const services = {
+            API: { isOnline: true },
+            replicator: {
+                onReplicatorInitialised: { addHandler: vi.fn() },
+                getActiveReplicator: () => ({ ensurePBKDF2Salt }),
+            },
+            setting: { currentSettings: () => ({}) },
+            databaseEvents: { onDatabaseInitialised: { addHandler: vi.fn() } },
+            appLifecycle: { onSettingLoaded: { addHandler: vi.fn() } },
+            replication: {
+                parseSynchroniseResult: { addHandler: vi.fn() },
+                onBeforeReplicate: { addHandler },
+                onReplicationFailed: { addHandler: vi.fn() },
+            },
+        };
+        const module = {
+            _unresolvedErrorManager: {
+                showError: vi.fn(),
+                clearError: vi.fn(),
+            },
+            _onReplicatorInitialised: vi.fn(),
+            _everyOnDatabaseInitialized: vi.fn(),
+            _everyOnloadAfterLoadSettings: vi.fn(),
+            _parseReplicationResult: vi.fn(),
+            _everyBeforeReplicate: vi.fn(),
+            onReplicationFailed: vi.fn(),
+        };
+
+        ModuleReplicator.prototype.onBindFunction.call(module, {} as never, services as never);
+        expect(beforeReplicate).toBeDefined();
+
+        await beforeReplicate!(false);
+
+        expect(ensurePBKDF2Salt).toHaveBeenCalledWith({}, false, false);
+    });
+});

updates.md

@@ -5,6 +5,10 @@ The head note of 0.25 is now in [updates_old.md](https://github.com/vrtmrz/obsid
 
 ## Unreleased
 
+### Fixed
+
+- Refresh the remote Security Seed before each replication, preventing a client that remained open during a remote database rebuild from uploading data encrypted with the previous seed (#1018).
+
 ## 0.25.81
 
 14th July, 2026