When you run
echo "ok" >> "/home/user/.local/novault.lock"
and then some time later run
novault get user@site.com
the PW gets typed right away.
IMHO the ok should not be written to the lock file until a get request is issued.
Or maybe the get request should clear the lock file right after it's ran, and wait for a new ok before typing the PW.