cloud pull --encrypt leaves the project without its key path and encrypts referenced libraries #688

Expected Behavior

lean cloud pull --encrypt --key <key> leaves the local project in the same state as lean encrypt --key <key>: files encrypted, encrypted: true and encryption-key-path in the project config, so a later lean cloud push keeps the cloud project encrypted. --decrypt removes encryption-key-path, like lean decrypt. Referenced libraries are pulled as they are in the cloud, the same way lean cloud push --encrypt already leaves them unencrypted.

Actual Behavior

1. PullManager._pull_project sets encrypted but never sets or removes encryption-key-path. PushManager._push_project only re-encrypts when that path is present, so a plain push after pull --encrypt uploads the encrypted file contents as source code with encryption_key='':

$ lean cloud pull --project "Python Project" --encrypt --key key.txt   # cloud project was not encrypted
$ lean cloud push --project "Python Project"
# projects/update is called with main.py = 'iFdKTV...==' (ciphertext) and encryption_key = ''

The cloud project ends up unencrypted, with ciphertext as its code. After pull --decrypt, the stale encryption-key-path stays in the config.

2. PullManager.pull_projects passes the encryption action and key to every pulled project, including the libraries it adds. pull --project P --encrypt therefore encrypts the shared library Library/L on disk and marks it encrypted: true. The push side deliberately skips associated libraries (push_manager.py, "we don't encrypt those"), so the two commands disagree.

Potential Solution

In _pull_project, set encryption-key-path on encrypt and delete it on decrypt, as encrypt.py/decrypt.py do. In pull_projects, apply the encryption action only to the projects that were asked for, not to the libraries added afterwards. I have a PR ready with the fix and tests (fail on master, pass with the fix).

Reproducing the Problem

Run the two commands above on an unencrypted cloud project with a registered key. For the library case, use a project that references a library and check Library/<name>/main.py after the pull.

System Information

lean-cli master at 1873571, Linux.

Checklist

• I have completely filled out this template
• I have confirmed that this issue exists on the current master branch
• I have confirmed that this is not a duplicate issue by searching issues