[SkippySteve]

sops edit --show-master-keys (-s) silently discards the edit. The command exits 0 and rewrites the file with a new MAC and lastmodified, but with the old content.

Cause: with -s, runEditorUntilOk reloads the full tree (data + metadata) from the editor's file and then does opts.Tree = &t. That only updates the local copy of opts. edit() then encrypts and emits its own, unchanged tree. This goes back to the store refactor in #335.

Fix: update the caller's tree in place (*opts.Tree = t, keeping FilePath), and only assign Branches in the non--s path, where the editor sees just the data.

Reproduction with a throwaway age key, and an editor script that changes password: old to password: new:

sops built from main:
  sops edit    s.yaml  → exit 0, decrypts to: password: new
  sops edit -s s.yaml  → exit 0, decrypts to: password: old   ← edit lost
this branch:
  sops edit    s.yaml  → exit 0, decrypts to: password: new
  sops edit -s s.yaml  → exit 0, decrypts to: password: new

Test: a new cmd/sops/edit_test.go (TestEditKeepsChanges, run with and without ShowMasterKeys) encrypts a file with a generated age key, runs edit() with a scripted SOPS_EDITOR, and decrypts the result. On main the show-master-keys case fails (expected "secret: new\n", actual "secret: old\n"). The small shared helpers are in cmd/sops/helpers_test.go. They isolate HOME and the SOPS_AGE_* variables so a developer's own keys are never used. go test ./cmd/... ., go vet and gofmt are clean on Go 1.25.