Every element of the derivation path is hardened, so an index above
2147483647 has no child to derive: the hardened offset wrapped around
and the tool silently produced a non-hardened key that no other
implementation reading the path as written would reproduce. Such an
index is now refused with a message before anything is derived, and
tests pin the refusal at both the derivation and the command level.
Also use the hook path variable in script/install-precommit instead of
repeating the literal beside it.
Model: opus-5
The tool derives ed25519 SSH keys from a BIP-39 mnemonic and prints
them, either as an authorized_keys line or as an unencrypted OpenSSH
private key. Both README test vectors are asserted in the tests.
The mnemonic is looked for in the order the README gives, and refused
when it fails its checksum or when there is nowhere left to look.
The repository standards come with it: the vendored linter
configuration and policies, the script/ entrypoints with a thin
Makefile, and a Gitea workflow. Linting happens only inside the image
built from Dockerfile.lint, which pins the linter by hash, so the root
Dockerfile runs the formatting check, the tests and the build, and
script/cibuild runs the linter before it.
Model: opus-5
