Read --index and --words as decimal numbers (closes #75)

Both flags were uint32 flags, which the flag library reads with Go's
base-0 rules, so `-n 010` derived key 8 and `0x10` or `1_0` were
accepted. They are now string flags read by options.Decimal, which
takes decimal digits only: a leading zero stays decimal, and a base
prefix, an underscore or a sign is refused with an error naming the
flag, before the mnemonic is looked for. --help shows both as a
number, and the README says the index is a decimal number.

Model: opus-5-5

README.md

@@ -65,12 +65,10 @@ calls into `internal/`. The packages there are:
   and decrypts with it.
 - `internal/childmnemonic` derives a child mnemonic from the main one using
   BIP-85's own mnemonic application.
-- `internal/signals` catches SIGINT, SIGTERM and SIGHUP for the commands that
-  clean up before they end, and for the mnemonic prompt, which puts the terminal
-  back before the signal ends the tool.
 - `internal/cli` builds the cobra command tree and runs it. Under it,
-  `cli/options` holds the flags every command shares, and `cli/ssh`, `cli/age`
+  `cli/options` holds the flags every command shares, `cli/signals` catches
-  and `cli/mnemonic` are the command groups.
+  SIGINT, SIGTERM and SIGHUP for the commands that clean up before they end, and
+  `cli/ssh`, `cli/age` and `cli/mnemonic` are the command groups.
 - `internal/bip39` is a copy of `github.com/tyler-smith/go-bip39` v1.1.0,
   trimmed to what keyfunc uses.
 
@@ -118,31 +116,17 @@ order; the first one found wins:
 2. Environment variable `KEYFUNC_MNEMONIC_COMMAND`: the same, as a shell command
    held in the environment.
 3. Environment variable `KEYFUNC_MNEMONIC`: the mnemonic itself.
-4. A prompt on the terminal with echo turned off. The mnemonic is what is typed
+4. A prompt on the terminal with echo turned off.
-   up to Enter, and echo is turned back on once it is read. Ctrl-D with nothing
-   typed ends the prompt at once and leaves the mnemonic empty, so the tool
-   refuses it and exits with status 1. After text has been typed, Ctrl-D has to
-   be pressed twice to end the prompt, and the text typed is the mnemonic.
 
 If none of these is available and standard input is not a terminal, the tool
-refuses and exits with status 1. A mnemonic that is empty, does not have 12, 15,
+refuses and exits with status 1. A mnemonic that fails the BIP-39 checksum is
-18, 21 or 24 words, has a word that is not on the BIP-39 word list, or fails the
+refused with a message saying so. Keys are derived from the mnemonic's words
-BIP-39 checksum is refused with a message saying which. A word that is not on
+joined by single spaces, whatever whitespace is around or between them, so one
-the list is named by its position, never printed. Keys are derived from the
+word per line, tabs or extra spaces give the same keys.
-mnemonic's words joined by single spaces, whatever whitespace is around or
-between them, so one word per line, tabs or extra spaces give the same keys.
-
-The key index, `--words`, the `--to` recipients, the file `age encrypt` or
-`age decrypt` is given to read and its `-o` path are checked before the mnemonic
-is looked for, so a run refused for one of them never prompts for the mnemonic
-or runs the mnemonic command. An `-o` path is refused at that point if it is a
-directory or a symlink to one, if its directory is missing or is not a
-directory, or if it is a symlink that points at nothing.
 
 `KEYFUNC_MNEMONIC` and `KEYFUNC_MNEMONIC_COMMAND` are removed from the
-environment before the mnemonic command, the system `ssh` (`keyfunc ssh to`) and
+environment before the system `ssh` (`keyfunc ssh to`) and `sftp`
-`sftp` (`keyfunc ssh install`) are started, so the mnemonic is never handed on
+(`keyfunc ssh install`) are started, so the mnemonic is never handed on to them.
-to them.
 
 Every command takes `--index` / `-n` and `--mnemonic-command`, and has `--help`.
 `keyfunc --version` prints the version. `make build` stamps it; a binary
@@ -235,15 +219,11 @@ first, or pass `-o StrictHostKeyChecking=accept-new` after `--`.
 
 Derives the key, serves it from an SSH agent that runs inside the tool on a unix
 socket in a new private `0700` temporary directory, then runs the system `ssh`
-with `-o IdentityAgent=<that socket> -o IdentitiesOnly=no` followed by the host
+with `-o IdentityAgent=<that socket>` followed by the host and all remaining
-and all remaining arguments unchanged. Without `IdentitiesOnly=no`, an
+arguments unchanged. The tool exits with `ssh`'s exit status and removes the
-`IdentitiesOnly yes` in the user's `ssh` configuration keeps the derived key
+socket and directory on the way out. The private key is never written to disk. A
-from being offered. The agent holds no other key, so turning it off adds nothing
+SIGINT, SIGTERM or SIGHUP ends `ssh` and still removes the socket and directory,
-else to what `ssh` offers. The tool exits with `ssh`'s exit status and removes
+and the tool then exits with status 1 unless `ssh` reported one of its own.
-the socket and directory on the way out. The private key is never written to
-disk. A SIGINT, SIGTERM or SIGHUP ends `ssh` and still removes the socket and
-directory, and the tool then exits with status 1 unless `ssh` reported one of
-its own.
 
 ## age identities: `keyfunc age`
 
@@ -291,9 +271,7 @@ or a device, such as `/dev/null`, is written to directly.
 
 Decrypts the file (or standard input) with the derived identity. Output goes to
 `-o`, which is treated as for `encrypt`, or standard output. If the identity is
-not one of the recipients, the tool says so and exits with status 1. The text
+not one of the recipients, the tool says so and exits with status 1.
-form needs no flag, and up to 1024 bytes of blank lines in front of it are
-skipped, as `age` skips them.
 
 ## Derived mnemonics: `keyfunc mnemonic`
 
@@ -330,11 +308,10 @@ passes through `ssh`'s own exit status.
 
 SIGINT, SIGTERM and SIGHUP end any command at once, at the mnemonic prompt too,
 with the status a shell gives a program killed by that signal (130 for SIGINT).
-At the prompt the terminal's settings are put back as they were first, so echo
+While `age encrypt -o` or `age decrypt -o` is writing a new file or replacing a
-is on again. While `age encrypt -o` or `age decrypt -o` is writing a new file or
+regular one, the signal makes it remove the unfinished file, leave a file
-replacing a regular one, the signal makes it remove the unfinished file, leave a
+already at the named path as it was, and exit with status 1. That holds for a
-file already at the named path as it was, and exit with status 1. That holds for
+signal that has reached `keyfunc` when its input ends; a later one leaves the
-a signal that has reached `keyfunc` when its input ends; a later one leaves the
 whole file in place. Ctrl-C on a pipeline ends the input at the same moment, and
 on Linux `keyfunc` sees the signal first, though no system promises that. A
 named pipe or a device at the `-o` path, or a path that is the same file as

go.mod

@@ -6,11 +6,9 @@ require (
 	filippo.io/age v1.3.2
 	github.com/btcsuite/btcd v0.25.0
 	github.com/btcsuite/btcd/btcutil v1.2.0
-	github.com/creack/pty v1.1.25-0.20260601142114-9246436fffe8 // v1.1.24's Open can return another pty's terminal
 	github.com/spf13/cobra v1.10.2
 	github.com/stretchr/testify v1.12.1
 	golang.org/x/crypto v0.57.0
-	golang.org/x/sys v0.48.0
 	golang.org/x/term v0.46.0
 	sneak.berlin/go/secret v0.0.0-20261007105610-ef0ae90768c8
 )
@@ -24,4 +22,5 @@ require (
 	github.com/kcalvinalvin/anet v0.0.0-20251112173137-d8ddc1f6dbee // indirect
 	github.com/spf13/pflag v1.0.9 // indirect
 	go.yaml.in/yaml/v3 v3.0.5 // indirect
+	golang.org/x/sys v0.48.0 // indirect
 )

go.sum

@@ -13,8 +13,6 @@ github.com/btcsuite/btcd/btcutil v1.2.0/go.mod h1:/Taflm113pYjUpbWKKQEfa6XOtI/+W
 github.com/btcsuite/btcd/chaincfg/chainhash v1.2.0 h1:yMIg99+4aBvqfl/HzJRKfxTX9rGfikoI9uvFzterhc8=
 github.com/btcsuite/btcd/chaincfg/chainhash v1.2.0/go.mod h1:Y72Ren9gfhlEvnwnT78BGcSNO2UMphTKLn9AorF+5rg=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
-github.com/creack/pty v1.1.25-0.20260601142114-9246436fffe8 h1:CY3gjC7naqYGLMiywvj3suPfa1i0p/QEr7o8ujxL/2M=
-github.com/creack/pty v1.1.25-0.20260601142114-9246436fffe8/go.mod h1:08sCNb52WyoAwi2QDyzUCTgcvVFhUzewun7wtTfvcwE=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0 h1:NMZiJj8QnKe1LgsbDayM4UoHwbvwDRwnI3hwNaAHRnc=

internal/agekey/agekey.go

@@ -4,7 +4,6 @@ package agekey
 
 import (
 	"bufio"
-	"bytes"
 	"errors"
 	"fmt"
 	"io"
@@ -95,12 +94,15 @@ func (k *Key) Identity() string {
 }
 
 // Encrypt copies src to dst, encrypted to this key and to every extra
-// recipient given, so the same mnemonic can always read it back again.
+// recipient named, so the same mnemonic can always read it back again.
 // Armored output is the text form age also reads.
 func (k *Key) Encrypt(
-	dst io.Writer, src io.Reader, to []age.Recipient, armored bool,
+	dst io.Writer, src io.Reader, to []string, armored bool,
 ) error {
-	all := append([]age.Recipient{k.identity.Recipient()}, to...)
+	all, err := recipients(k.identity.Recipient(), to)
+	if err != nil {
+		return err
+	}
 
 	out := dst
 
@@ -111,7 +113,7 @@ func (k *Key) Encrypt(
 		out = text
 	}
 
-	err := encrypt(out, src, all)
+	err = encrypt(out, src, all)
 	if err != nil {
 		return err
 	}
@@ -128,12 +130,12 @@ func (k *Key) Encrypt(
 	return nil
 }
 
-// Recipients reads the recipients named on the command line, for
+// recipients returns the key's own recipient followed by the ones
-// Encrypt to add to the key's own.
+// named on the command line, so what the key encrypts it can read.
-func Recipients(names []string) ([]age.Recipient, error) {
+func recipients(mine age.Recipient, to []string) ([]age.Recipient, error) {
-	list := make([]age.Recipient, 0, len(names))
+	list := []age.Recipient{mine}
 
-	for _, name := range names {
+	for _, name := range to {
 		parsed, err := age.ParseX25519Recipient(name)
 		if err != nil {
 			return nil, fmt.Errorf("reading recipient %q: %w", name, err)
@@ -188,18 +190,12 @@ func (k *Key) Decrypt(dst io.Writer, src io.Reader) error {
 }
 
 // unarmored strips the text form when the input begins with the line
-// that starts one, and leaves binary input alone. Like age, it looks
+// that starts one, and leaves binary input alone.
-// past up to 1024 bytes of whitespace for that line, and the text form
-// reader skips blank lines in front of it.
 func unarmored(src io.Reader) io.Reader {
-	const maxWhitespace = 1024
-
 	buffered := bufio.NewReader(src)
 
-	// A shorter input gives an error along with all of it, which is
+	start, err := buffered.Peek(len(armor.Header))
-	// enough to look at.
+	if err == nil && string(start) == armor.Header {
-	start, _ := buffered.Peek(maxWhitespace + len(armor.Header))
-	if bytes.HasPrefix(bytes.TrimSpace(start), []byte(armor.Header)) {
 		return armor.NewReader(buffered)
 	}
 

internal/agekey/agekey_test.go

@@ -2,7 +2,6 @@ package agekey_test
 
 import (
 	"bytes"
-	"io"
 	"strings"
 	"testing"
 
@@ -100,27 +99,6 @@ func TestTheArmoredFormIsText(t *testing.T) {
 	))
 }
 
-func TestTheTextFormIsReadWithWhitespaceInFront(t *testing.T) {
-	t.Parallel()
-
-	key := forIndex(t, 0)
-
-	var sealed bytes.Buffer
-
-	err := key.Encrypt(&sealed, strings.NewReader("hello"), nil, true)
-	require.NoError(t, err)
-
-	// A blank line and a line of two spaces, as pasting can leave. age
-	// refuses spaces on the first line of the text form itself, and so
-	// does this.
-	pasted := io.MultiReader(strings.NewReader("\n  \n"), &sealed)
-
-	var opened bytes.Buffer
-
-	require.NoError(t, key.Decrypt(&opened, pasted))
-	require.Equal(t, "hello", opened.String())
-}
-
 func TestAFileForSomebodyElseIsRefused(t *testing.T) {
 	t.Parallel()
 
@@ -141,12 +119,12 @@ func TestAnExtraRecipientCanReadItTooAndSoCanTheDerivedOne(t *testing.T) {
 
 	mine, theirs := forIndex(t, 0), forIndex(t, 1)
 
-	to, err := agekey.Recipients([]string{theirs.Recipient()})
-	require.NoError(t, err)
-
 	var sealed bytes.Buffer
 
-	err = mine.Encrypt(&sealed, strings.NewReader("hello"), to, false)
+	err := mine.Encrypt(
+		&sealed, strings.NewReader("hello"),
+		[]string{theirs.Recipient()}, false,
+	)
 	require.NoError(t, err)
 
 	for _, key := range []*agekey.Key{mine, theirs} {
@@ -160,7 +138,10 @@ func TestAnExtraRecipientCanReadItTooAndSoCanTheDerivedOne(t *testing.T) {
 func TestARecipientThatIsNotOneIsRefused(t *testing.T) {
 	t.Parallel()
 
-	_, err := agekey.Recipients([]string{"not a recipient"})
+	err := forIndex(t, 0).Encrypt(
+		&bytes.Buffer{}, strings.NewReader("hello"),
+		[]string{"not a recipient"}, false,
+	)
 	require.Error(t, err)
 }
 

internal/childmnemonic/childmnemonic.go

@@ -29,17 +29,6 @@ const DefaultWords = twelve
 // ErrWordCount is returned for a length this tool does not offer.
 var ErrWordCount = errors.New("a child mnemonic has 12, 18 or 24 words")
 
-// CheckWords refuses a length this tool does not offer, so that the
-// command can turn it down before it looks for the mnemonic.
-func CheckWords(words uint32) error {
-	switch words {
-	case twelve, eighteen, twentyFour:
-		return nil
-	default:
-		return fmt.Errorf("%w, not %d", ErrWordCount, words)
-	}
-}
-
 // Derive returns the English child mnemonic of that many words at that
 // key index, taken from the master key with BIP-85's own mnemonic
 // application, number 39. The words come straight from the BIP-85
@@ -49,12 +38,13 @@ func Derive(
 	master *hdkeychain.ExtendedKey,
 	words, index uint32,
 ) (string, error) {
-	err := CheckWords(words)
+	switch words {
-	if err != nil {
+	case twelve, eighteen, twentyFour:
-		return "", err
+	default:
+		return "", fmt.Errorf("%w, not %d", ErrWordCount, words)
 	}
 
-	err = derive.CheckIndex(index)
+	err := derive.CheckIndex(index)
 	if err != nil {
 		return "", err
 	}

internal/cli/age/age.go

@@ -11,13 +11,12 @@ import (
 	"os"
 	"os/signal"
 	"path/filepath"
-	"syscall"
 
 	"github.com/spf13/cobra"
 	"sneak.berlin/go/keyfunc/internal/agekey"
 	"sneak.berlin/go/keyfunc/internal/cli/options"
+	"sneak.berlin/go/keyfunc/internal/cli/signals"
 	"sneak.berlin/go/keyfunc/internal/derive"
-	"sneak.berlin/go/keyfunc/internal/signals"
 )
 
 // ErrInterrupted is returned when SIGINT, SIGTERM or SIGHUP has been
@@ -109,55 +108,47 @@ func decrypt() *cobra.Command {
 }
 
 // runEncrypt encrypts to the derived recipient and any others given.
-// The recipients are read, the -o path looked at and the input opened
-// before the key is derived, so that a run refused for any of them
-// never asks for the mnemonic.
 func runEncrypt(cmd *cobra.Command, args []string) error {
-	names, err := cmd.Flags().GetStringArray("to")
+	key, err := derived(cmd)
-	if err != nil {
-		return fmt.Errorf("reading the recipients: %w", err)
-	}
-
-	to, err := agekey.Recipients(names)
 	if err != nil {
 		return err
 	}
 
+	to, err := cmd.Flags().GetStringArray("to")
+	if err != nil {
+		return fmt.Errorf("reading the recipients: %w", err)
+	}
+
 	armored, err := cmd.Flags().GetBool("armor")
 	if err != nil {
 		return fmt.Errorf("reading the armor flag: %w", err)
 	}
 
-	err = checkOutput(cmd)
+	return through(cmd, args, func(dst io.Writer, src io.Reader) error {
-	if err != nil {
+		return key.Encrypt(dst, src, to, armored)
-		return err
-	}
-
-	src, closeSrc, err := input(cmd, args)
-	if err != nil {
-		return err
-	}
-
-	defer closeSrc()
-
-	key, err := derived(cmd)
-	if err != nil {
-		return err
-	}
-
-	return through(cmd, src, func(dst io.Writer, plain io.Reader) error {
-		return key.Encrypt(dst, plain, to, armored)
 	})
 }
 
-// runDecrypt decrypts with the derived identity. The -o path is looked
+// runDecrypt decrypts with the derived identity.
-// at and the input opened before the key is derived, as for runEncrypt.
 func runDecrypt(cmd *cobra.Command, args []string) error {
-	err := checkOutput(cmd)
+	key, err := derived(cmd)
 	if err != nil {
 		return err
 	}
 
+	return through(cmd, args, key.Decrypt)
+}
+
+// through opens the input the arguments ask for and hands it to the
+// work, with the file --output names to write to, or the command's own
+// output when it names none or names the same file as that output, and
+// the command's own error output when it names the same file as that.
+// Those two are the streams the tool already has, so whatever they are
+// redirected to is written as the redirect says, never replaced.
+func through(
+	cmd *cobra.Command, args []string,
+	work func(io.Writer, io.Reader) error,
+) error {
 	src, closeSrc, err := input(cmd, args)
 	if err != nil {
 		return err
@@ -165,24 +156,6 @@ func runDecrypt(cmd *cobra.Command, args []string) error {
 
 	defer closeSrc()
 
-	key, err := derived(cmd)
-	if err != nil {
-		return err
-	}
-
-	return through(cmd, src, key.Decrypt)
-}
-
-// through hands the input to the work, with the file --output names to
-// write to, or the command's own output when it names none or names the
-// same file as that output, and the command's own error output when it
-// names the same file as that. Those two are the streams the tool
-// already has, so whatever they are redirected to is written as the
-// redirect says, never replaced.
-func through(
-	cmd *cobra.Command, src io.Reader,
-	work func(io.Writer, io.Reader) error,
-) error {
 	name, err := cmd.Flags().GetString("output")
 	if err != nil {
 		return fmt.Errorf("reading the output file: %w", err)
@@ -236,52 +209,6 @@ func input(cmd *cobra.Command, args []string) (io.Reader, func(), error) {
 	return file, func() { _ = file.Close() }, nil
 }
 
-// checkOutput refuses an -o path that output could not write to,
-// before anything is written: a directory or a symlink to one, one
-// whose directory is missing or is not a directory, or a symlink that
-// points at nothing. It creates nothing; output looks at the path again
-// when it writes.
-func checkOutput(cmd *cobra.Command) error {
-	name, err := cmd.Flags().GetString("output")
-	if err != nil {
-		return fmt.Errorf("reading the output file: %w", err)
-	}
-
-	if name == "" {
-		return nil
-	}
-
-	info, err := os.Lstat(name)
-
-	switch {
-	case errors.Is(err, fs.ErrNotExist):
-		// replace makes its new file in this directory. When the
-		// directory is a file instead, os.Lstat has already failed with
-		// ENOTDIR, the case below.
-		directory := filepath.Dir(name)
-
-		_, err = os.Stat(directory)
-		if err != nil {
-			return fmt.Errorf("looking at %s: %w", directory, err)
-		}
-
-		return nil
-	case err != nil:
-		return fmt.Errorf("looking at %s: %w", name, err)
-	case info.Mode().Type() == fs.ModeSymlink:
-		info, err = os.Stat(name)
-		if err != nil {
-			return fmt.Errorf("following %s: %w", name, err)
-		}
-	}
-
-	if info.IsDir() {
-		return fmt.Errorf("writing to %s: %w", name, syscall.EISDIR)
-	}
-
-	return nil
-}
-
 // output has the work write to the named path, going by what is there
 // without following a final symlink:
 //

internal/cli/age_test.go

@@ -17,7 +17,6 @@ import (
 	"sneak.berlin/go/keyfunc/internal/agekey"
 	"sneak.berlin/go/keyfunc/internal/cli"
 	"sneak.berlin/go/keyfunc/internal/cli/age"
-	"sneak.berlin/go/keyfunc/internal/derive"
 	"sneak.berlin/go/keyfunc/internal/mnemonic"
 )
 
@@ -70,82 +69,6 @@ func TestAnotherRecipientIsAddedAndTheDerivedOneStays(t *testing.T) {
 	)
 }
 
-// The mnemonic command fails in these runs, so the refusal of the index
-// shows that it was checked before the mnemonic was looked for.
-func TestAnAgeIndexWithNoHardenedChildIsRefused(t *testing.T) {
-	t.Setenv(mnemonic.CommandVariable, failingMnemonicCommand)
-
-	for _, command := range []string{"pub", "priv", "encrypt", "decrypt"} {
-		out, err := execute(t, "age", command, "-n", tooLarge)
-		require.ErrorIs(t, err, derive.ErrIndexTooLarge, command)
-		require.Empty(t, out, command)
-	}
-}
-
-// The mnemonic command fails in this run, so the refusal of the
-// recipient shows that it was read before the mnemonic was looked for.
-func TestAnEncryptionToARecipientThatIsNotOneIsRefused(t *testing.T) {
-	t.Setenv(mnemonic.CommandVariable, failingMnemonicCommand)
-
-	plain := written(t, "notes.txt", "the secret\n")
-
-	out, err := execute(t, "age", "encrypt", "--to", "bogus", plain)
-	require.ErrorContains(t, err, `reading recipient "bogus"`)
-	require.Empty(t, out)
-}
-
-// The mnemonic command fails in these runs, so the refusal of the input
-// file shows that it was opened before the mnemonic was looked for.
-func TestAnInputFileThatCannotBeOpenedIsRefused(t *testing.T) {
-	t.Setenv(mnemonic.CommandVariable, failingMnemonicCommand)
-
-	missing := filepath.Join(t.TempDir(), "missing")
-
-	for _, operation := range []string{"encrypt", "decrypt"} {
-		out, err := execute(t, "age", operation, missing)
-		require.ErrorIs(t, err, fs.ErrNotExist, operation)
-		require.Empty(t, out, operation)
-	}
-}
-
-// The mnemonic command fails in these runs, so the refusal of the -o
-// path shows that it was looked at before the mnemonic was looked for.
-func TestAnOutputPathThatCannotBeWrittenIsRefused(t *testing.T) {
-	t.Setenv(mnemonic.CommandVariable, failingMnemonicCommand)
-
-	plain := written(t, "notes.txt", "the secret\n")
-	directory := t.TempDir()
-	missing := filepath.Join(directory, "missing")
-	dangling := filepath.Join(directory, "dangling")
-	require.NoError(t, os.Symlink(missing, dangling))
-
-	toDirectory := filepath.Join(directory, "to-directory")
-	require.NoError(t, os.Symlink(t.TempDir(), toDirectory))
-
-	refusals := map[string]error{
-		filepath.Join(missing, "notes.age"): fs.ErrNotExist,
-		filepath.Join(plain, "notes.age"):   syscall.ENOTDIR,
-		dangling:                            fs.ErrNotExist,
-		directory:                           syscall.EISDIR,
-		toDirectory:                         syscall.EISDIR,
-	}
-
-	for name, refusal := range refusals {
-		out, err := execute(t, "age", "encrypt", "-o", name, plain)
-		require.ErrorIs(t, err, refusal, name)
-		require.Empty(t, out, name)
-
-		out, err = execute(t, "age", "decrypt", "-o", name, plain)
-		require.ErrorIs(t, err, refusal, name)
-		require.Empty(t, out, name)
-	}
-
-	// Nothing was made beside the two symlinks.
-	left, err := os.ReadDir(directory)
-	require.NoError(t, err)
-	require.Len(t, left, 2)
-}
-
 func TestAFileForAnotherKeyIsRefused(t *testing.T) {
 	t.Setenv(mnemonic.Variable, example())
 

internal/cli/cli.go

@@ -87,9 +87,6 @@ func init() {
 // still runs, and "age encrypt -o" and "age decrypt -o" while they
 // write a new file to rename over the named one, so the unfinished file
 // is removed.
-//
-// At the mnemonic prompt the signal is caught only to put the terminal
-// back, and then ends the tool as above.
 func Main() int {
 	err := Root().Execute()
 	if err == nil {

internal/cli/cli_test.go

@@ -34,14 +34,6 @@ const (
 	twentyFour = 24
 )
 
-// tooLarge is the smallest key index with no hardened child.
-const tooLarge = "2147483648"
-
-// failingMnemonicCommand fails loudly, so a run that looks for the
-// mnemonic ends with that failure. A run that ends with the refusal of
-// an argument instead shows that the argument was checked first.
-const failingMnemonicCommand = "echo the mnemonic was looked for >&2; exit 1"
-
 // example returns the mnemonic the README gives its test vectors for:
 // eleven abandons and about.
 func example() string {
@@ -107,25 +99,12 @@ func TestThePrivateKeyMatchesThePublicOne(t *testing.T) {
 	require.Equal(t, vectorOne, back)
 }
 
-// The mnemonic command fails in these runs, so the refusal of the index
-// shows that it was checked before the mnemonic was looked for. The age
-// commands have a test of their own.
 func TestAnIndexWithNoHardenedChildIsRefused(t *testing.T) {
-	t.Setenv(mnemonic.CommandVariable, failingMnemonicCommand)
+	t.Setenv(mnemonic.Variable, example())
 
-	for _, args := range [][]string{
+	out, err := execute(t, "ssh", "pub", "-n", "2147483648")
-		{subcommand, "pub", "-n", tooLarge},
+	require.ErrorIs(t, err, derive.ErrIndexTooLarge)
-		{subcommand, "priv", "-n", tooLarge},
+	require.Empty(t, out)
-		{subcommand, installing, "-n", tooLarge, host},
-		{subcommand, "to", "-n", tooLarge, host},
-		{"mnemonic", "-n", tooLarge},
-	} {
-		name := strings.Join(args, " ")
-
-		out, err := execute(t, args...)
-		require.ErrorIs(t, err, derive.ErrIndexTooLarge, name)
-		require.Empty(t, out, name)
-	}
 }
 
 func TestAnIndexWithALeadingZeroIsDecimal(t *testing.T) {
@@ -144,7 +123,7 @@ func TestAnIndexWithALeadingZeroIsDecimal(t *testing.T) {
 func TestAnIndexThatIsNotDecimalDigitsIsRefused(t *testing.T) {
 	t.Parallel()
 
-	for _, index := range []string{"0x10", "1_0", "+1", "-1", ""} {
+	for _, index := range []string{"0x10", "1_0", "+1", "-1"} {
 		t.Run(index, func(t *testing.T) {
 			t.Parallel()
 
@@ -158,26 +137,6 @@ func TestAnIndexThatIsNotDecimalDigitsIsRefused(t *testing.T) {
 	}
 }
 
-// Neither a command group nor --version reads the index, so these
-// show that it is refused while the flags are parsed.
-func TestAnIndexNotInDecimalIsRefusedBeforeAnyCommandRuns(t *testing.T) {
-	t.Parallel()
-
-	for _, args := range [][]string{
-		{"ssh", "-n", "0x10"},
-		{"-n", "0x10", "--version"},
-	} {
-		t.Run(strings.Join(args, " "), func(t *testing.T) {
-			t.Parallel()
-
-			out, err := execute(t, args...)
-			require.ErrorIs(t, err, strconv.ErrSyntax)
-			require.ErrorContains(t, err, "--index")
-			require.Empty(t, out)
-		})
-	}
-}
-
 func TestTheMnemonicCommandIsUsed(t *testing.T) {
 	t.Setenv(mnemonic.Variable, "")
 
@@ -202,10 +161,8 @@ func TestAChildMnemonicIsPrinted(t *testing.T) {
 	require.NotEqual(t, short, next)
 }
 
-// The mnemonic command fails in this run, so the refusal of the length
-// shows that it was checked before the mnemonic was looked for.
 func TestALengthTheToolDoesNotOfferIsRefused(t *testing.T) {
-	t.Setenv(mnemonic.CommandVariable, failingMnemonicCommand)
+	t.Setenv(mnemonic.Variable, example())
 
 	out, err := execute(t, "mnemonic", "--words", "15")
 	require.ErrorIs(t, err, childmnemonic.ErrWordCount)

internal/cli/mnemonic/mnemonic.go

@@ -3,6 +3,7 @@ package mnemonic
 
 import (
 	"fmt"
+	"strconv"
 
 	"github.com/spf13/cobra"
 	"sneak.berlin/go/keyfunc/internal/childmnemonic"
@@ -31,10 +32,9 @@ func Command() *cobra.Command {
 		},
 	}
 
-	words := options.Decimal(childmnemonic.DefaultWords)
+	cmd.Flags().String(
-	cmd.Flags().Var(
+		"words", strconv.Itoa(childmnemonic.DefaultWords),
-		&words, "words",
+		"the `number` of words in the child mnemonic: 12, 18 or 24",
-		"how long the child mnemonic is: 12, 18 or 24 words",
 	)
 
 	return cmd
@@ -47,12 +47,7 @@ func derived(cmd *cobra.Command) (string, error) {
 		return "", err
 	}
 
-	words, err := cmd.Flags().GetUint32("words")
+	words, err := options.Decimal(cmd, "words")
-	if err != nil {
-		return "", fmt.Errorf("reading the word count: %w", err)
-	}
-
-	err = childmnemonic.CheckWords(words)
 	if err != nil {
 		return "", err
 	}

internal/cli/options/options.go

@@ -7,7 +7,6 @@ import (
 	"strconv"
 
 	"github.com/spf13/cobra"
-	"sneak.berlin/go/keyfunc/internal/derive"
 	"sneak.berlin/go/keyfunc/internal/mnemonic"
 )
 
@@ -18,27 +17,35 @@ func Add(cmd *cobra.Command) {
 		"mnemonic-command", "",
 		"shell command whose output is the mnemonic",
 	)
-	cmd.PersistentFlags().VarP(
+	cmd.PersistentFlags().StringP(
-		new(Decimal), "index", "n",
+		"index", "n", "0",
-		"which key to derive",
+		"which key to derive, as a decimal `number`",
 	)
 }
 
-// Index returns the key index the user asked for, and refuses one above
+// Index returns the key index the user asked for.
-// derive.MaxIndex. Every command calls it before it looks for the
-// mnemonic.
 func Index(cmd *cobra.Command) (uint32, error) {
-	index, err := cmd.Flags().GetUint32("index")
+	return Decimal(cmd, "index")
+}
+
+// Decimal reads the named string flag as a number written in decimal
+// digits only: a leading zero is still decimal, and a base prefix, an
+// underscore or a sign is refused. The back-quoted word in the usage
+// of such a flag is what --help shows as its type.
+func Decimal(cmd *cobra.Command, name string) (uint32, error) {
+	text, err := cmd.Flags().GetString(name)
 	if err != nil {
-		return 0, fmt.Errorf("reading the index: %w", err)
+		return 0, fmt.Errorf("reading --%s: %w", name, err)
 	}
 
-	err = derive.CheckIndex(index)
+	number, err := strconv.ParseUint(text, 10, 32)
 	if err != nil {
-		return 0, err
+		return 0, fmt.Errorf(
+			"reading --%s as a decimal number: %w", name, err,
+		)
 	}
 
-	return index, nil
+	return uint32(number), nil
 }
 
 // Mnemonic returns the mnemonic, from the first source that has one.
@@ -50,33 +57,3 @@ func Mnemonic(cmd *cobra.Command) (string, error) {
 
 	return mnemonic.Read(cmd.Context(), command)
 }
-
-// Decimal is a flag value for a number written in decimal digits only.
-// The flag library's own uint32 flags read 010 as octal 8 and also
-// take 0x10 or 1_0.
-type Decimal uint32
-
-// String returns the number in decimal digits.
-func (d *Decimal) String() string {
-	return strconv.FormatUint(uint64(*d), 10)
-}
-
-// Set reads text as a decimal number that fits in 32 bits: a leading
-// zero is still decimal, and a base prefix, an underscore or a sign is
-// refused.
-func (d *Decimal) Set(text string) error {
-	number, err := strconv.ParseUint(text, 10, 32)
-	if err != nil {
-		return err
-	}
-
-	*d = Decimal(number)
-
-	return nil
-}
-
-// Type is what --help shows as the flag's type, and what GetUint32
-// checks before it reads the value back.
-func (d *Decimal) Type() string {
-	return "uint32"
-}

internal/cli/prompt_test.go

@@ -1,133 +0,0 @@
-package cli_test
-
-import (
-	"bufio"
-	"io"
-	"os"
-	"os/exec"
-	"strings"
-	"syscall"
-	"testing"
-	"time"
-
-	"github.com/creack/pty"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"golang.org/x/term"
-	"sneak.berlin/go/keyfunc/internal/mnemonic"
-)
-
-// TestEndOfInputAtThePromptEndsTheTool starts "age pub" and, at the
-// prompt, types Ctrl-D. The tool has to end with status 1, say that the
-// mnemonic is empty, and leave the terminal set as it found it, so with
-// echo on again.
-//
-// pty.Open returns the two ends of a new terminal: tty is the end the
-// tool uses as its terminal, and ptmx the end the test reads what the
-// terminal shows from and types into.
-func TestEndOfInputAtThePromptEndsTheTool(t *testing.T) {
-	t.Setenv(mnemonic.Variable, "")
-	t.Setenv(mnemonic.CommandVariable, "")
-
-	ptmx, tty, err := pty.Open()
-	require.NoError(t, err)
-
-	defer func() { _ = ptmx.Close() }()
-	defer func() { _ = tty.Close() }()
-
-	before, err := term.GetState(int(tty.Fd()))
-	require.NoError(t, err)
-
-	command, terminal := prompted(t, ptmx, tty)
-
-	_, err = ptmx.WriteString("\x04") // Ctrl-D
-	require.NoError(t, err)
-
-	waitForTool(t, "Ctrl-D at the prompt", command)
-	require.Equal(t, failedStatus, command.ProcessState.ExitCode())
-
-	after, err := term.GetState(int(tty.Fd()))
-	require.NoError(t, err)
-	require.Equal(t, before, after, "the terminal settings were not restored")
-
-	// With the tool ended and this end closed too, ptmx gives what is
-	// left on the terminal and then an error.
-	require.NoError(t, tty.Close())
-
-	said, _ := io.ReadAll(terminal)
-	require.Contains(t, string(said), mnemonic.ErrEmpty.Error())
-}
-
-// TestASignalAtThePromptPutsTheTerminalBack starts "age pub" and, at
-// the prompt, once the tool has turned echo off, sends it SIGINT. The
-// tool has to be ended by SIGINT, which a shell reports as status 130,
-// and leave the terminal set as it found it, so with echo on again.
-func TestASignalAtThePromptPutsTheTerminalBack(t *testing.T) {
-	t.Setenv(mnemonic.Variable, "")
-	t.Setenv(mnemonic.CommandVariable, "")
-
-	ptmx, tty, err := pty.Open()
-	require.NoError(t, err)
-
-	defer func() { _ = ptmx.Close() }()
-	defer func() { _ = tty.Close() }()
-
-	before, err := term.GetState(int(tty.Fd()))
-	require.NoError(t, err)
-
-	command, _ := prompted(t, ptmx, tty)
-
-	// The prompt is shown just before echo is turned off, and the
-	// signal has to come while it is off.
-	require.Eventually(t, func() bool {
-		now, err := term.GetState(int(tty.Fd()))
-
-		return err == nil && !assert.ObjectsAreEqual(before, now)
-	}, 5*time.Second, 5*time.Millisecond, "the tool did not turn echo off")
-
-	require.NoError(t, command.Process.Signal(syscall.SIGINT))
-	waitForTool(t, "SIGINT at the prompt", command)
-
-	status, ok := command.ProcessState.Sys().(syscall.WaitStatus)
-	require.True(t, ok)
-	require.True(t, status.Signaled(), "the tool was not ended by the signal")
-	require.Equal(t, syscall.SIGINT, status.Signal())
-
-	after, err := term.GetState(int(tty.Fd()))
-	require.NoError(t, err)
-	require.Equal(t, before, after, "the terminal settings were not restored")
-}
-
-// prompted starts "age pub" as a subprocess, for a test that has set no
-// mnemonic, with the terminal's tty end on all three streams, and
-// returns once the tool has shown the prompt. The reader returned reads
-// what the terminal shows from its ptmx end. Reading ptmx stops at a
-// deadline, so a prompt that never comes fails the test instead of
-// hanging it.
-func prompted(t *testing.T, ptmx, tty *os.File) (*exec.Cmd, *bufio.Reader) {
-	t.Helper()
-
-	require.NoError(t, ptmx.SetReadDeadline(time.Now().Add(10*time.Second)))
-
-	//nolint:gosec // this test's own binary as the tool
-	command := exec.CommandContext(t.Context(), os.Args[0], "age", "pub")
-
-	command.Env = append(os.Environ(), runAsTool+"=1")
-	command.Stdin = tty
-	command.Stdout = tty
-	command.Stderr = tty
-
-	require.NoError(t, command.Start())
-
-	var shown string
-
-	terminal := bufio.NewReader(ptmx)
-	for !strings.HasSuffix(shown, "mnemonic: ") {
-		char, err := terminal.ReadByte()
-		require.NoError(t, err, "the tool did not prompt: %q", shown)
-
-		shown += string(char)
-	}
-
-	return command, terminal
-}

internal/cli/signals/signals.go

@@ -1,9 +1,5 @@
-// Package signals catches SIGINT, SIGTERM and SIGHUP, the signals that
+// Package signals catches the signals that end the tool, for the
-// end the tool, for the commands that clean up before they end and for
+// commands that clean up before they end.
-// the mnemonic prompt, which puts the terminal back before the signal
-// ends the tool. Go keeps an inherited ignore only for SIGHUP and
-// SIGINT, so a SIGTERM the tool was started with set to be ignored is
-// not left ignored.
 package signals
 
 import (
@@ -15,8 +11,8 @@ import (
 
 // Context is signal.NotifyContext for SIGINT, SIGTERM and SIGHUP: the
 // context it returns is cancelled when one of them arrives, and stop
-// stops catching them. It leaves out SIGHUP or SIGINT if the tool was
+// stops catching them. It leaves out any of the three the tool was
-// started with it set to be ignored, as nohup does with SIGHUP, because
+// started with set to be ignored, as nohup does with SIGHUP, because
 // catching a signal turns an ignored one back on and would end a run
 // that was meant to survive it.
 func Context(parent context.Context) (context.Context, context.CancelFunc) {
@@ -41,8 +37,8 @@ func Notify(c chan<- os.Signal) {
 	}
 }
 
-// caught returns SIGINT, SIGTERM and SIGHUP, less any that
+// caught returns those of SIGINT, SIGTERM and SIGHUP that the tool was
-// signal.Ignored reports as ignored.
+// not started with set to be ignored.
 func caught() []os.Signal {
 	endings := []os.Signal{syscall.SIGINT, syscall.SIGTERM, syscall.SIGHUP}
 	kept := make([]os.Signal, 0, len(endings))

internal/cli/ssh/install.go

@@ -15,8 +15,7 @@ import (
 	"time"
 
 	"github.com/spf13/cobra"
-	"sneak.berlin/go/keyfunc/internal/mnemonic"
+	"sneak.berlin/go/keyfunc/internal/cli/signals"
-	"sneak.berlin/go/keyfunc/internal/signals"
 )
 
 // Where the key goes on the host and what the file it arrives in is
@@ -221,7 +220,7 @@ func session(
 
 	//nolint:gosec // the options are the user's own, meant for sftp
 	command := exec.CommandContext(cmd.Context(), "sftp", argv...)
-	command.Env = mnemonic.ChildEnv()
+	command.Env = childEnv()
 	command.Stdin = strings.NewReader(strings.Join(batch, "\n") + "\n")
 	command.Stdout = &said
 	command.Stderr = &said

internal/cli/ssh/ssh.go

@@ -3,10 +3,13 @@ package ssh
 
 import (
 	"fmt"
+	"os"
+	"strings"
 
 	"github.com/spf13/cobra"
 	"sneak.berlin/go/keyfunc/internal/cli/options"
 	"sneak.berlin/go/keyfunc/internal/derive"
+	"sneak.berlin/go/keyfunc/internal/mnemonic"
 	"sneak.berlin/go/keyfunc/internal/sshkey"
 )
 
@@ -84,6 +87,26 @@ func write(cmd *cobra.Command, text string) error {
 	return nil
 }
 
+// childEnv is the tool's environment with the mnemonic variables taken
+// out, for the ssh and sftp children it starts. "ssh to" exists so the
+// private key never leaves the tool; the mnemonic, from either variable,
+// must not leave it either.
+func childEnv() []string {
+	environ := os.Environ()
+	kept := make([]string, 0, len(environ))
+
+	for _, entry := range environ {
+		name, _, _ := strings.Cut(entry, "=")
+		if name == mnemonic.Variable || name == mnemonic.CommandVariable {
+			continue
+		}
+
+		kept = append(kept, entry)
+	}
+
+	return kept
+}
+
 // addComment gives a command its comment flag.
 func addComment(cmd *cobra.Command) {
 	cmd.Flags().String(

internal/cli/ssh/to.go

@@ -10,8 +10,7 @@ import (
 	"syscall"
 
 	"github.com/spf13/cobra"
-	"sneak.berlin/go/keyfunc/internal/mnemonic"
+	"sneak.berlin/go/keyfunc/internal/cli/signals"
-	"sneak.berlin/go/keyfunc/internal/signals"
 )
 
 // StatusError says the tool should end with the status ssh ended with.
@@ -58,13 +57,8 @@ func to() *cobra.Command {
 
 			defer served.Stop()
 
-			// IdentitiesOnly yes in the user's ssh configuration
-			// would keep the agent's key from being offered. The
-			// agent holds only the derived key, so turning it off
-			// adds no other key.
 			argv := slices.Concat([]string{
 				"-o", "IdentityAgent=" + served.Socket(),
-				"-o", "IdentitiesOnly=no",
 			}, args)
 
 			return connect(ctx, argv)
@@ -85,7 +79,7 @@ func to() *cobra.Command {
 func connect(ctx context.Context, argv []string) error {
 	//nolint:gosec // the arguments are the user's own, meant for ssh
 	command := exec.CommandContext(ctx, "ssh", argv...)
-	command.Env = mnemonic.ChildEnv()
+	command.Env = childEnv()
 	command.Stdin = os.Stdin
 	command.Stdout = os.Stdout
 	command.Stderr = os.Stderr

internal/cli/ssh_test.go

@@ -587,7 +587,7 @@ func TestSSHIsPointedAtTheAgentAndItsStatusIsHandedOn(t *testing.T) {
 
 	given := recorded(t, arguments)
 	require.Equal(t, "-o", given[0])
-	require.Equal(t, []string{host, remoteCommand}, given[4:])
+	require.Equal(t, []string{host, remoteCommand}, given[2:])
 
 	// The stand-in wrote the path down only because there really was
 	// a socket there while it ran.
@@ -596,26 +596,6 @@ func TestSSHIsPointedAtTheAgentAndItsStatusIsHandedOn(t *testing.T) {
 	require.NoDirExists(t, filepath.Dir(socket))
 }
 
-func TestIdentitiesOnlyIsTurnedOffBeforeTheHost(t *testing.T) {
-	t.Setenv(mnemonic.Variable, example())
-
-	arguments, _ := pretendCall(t)
-
-	_, err := execute(t, subcommand, "to", host, remoteCommand)
-
-	var passed ssh.StatusError
-
-	require.ErrorAs(t, err, &passed)
-
-	// IdentitiesOnly yes in the user's ssh configuration keeps ssh
-	// from offering the agent's key. An option given before the host
-	// wins over the configuration.
-	given := recorded(t, arguments)
-	require.Equal(t,
-		[]string{"-o", "IdentitiesOnly=no", host, remoteCommand}, given[2:],
-	)
-}
-
 func TestTheToolEndsWithTheStatusSSHEndedWith(t *testing.T) {
 	t.Setenv(mnemonic.Variable, example())
 

internal/mnemonic/mnemonic.go

@@ -8,7 +8,6 @@ import (
 	"fmt"
 	"os"
 	"os/exec"
-	"slices"
 	"strings"
 
 	"golang.org/x/term"
@@ -30,28 +29,6 @@ var ErrMissing = errors.New(
 	"no mnemonic given and standard input is not a terminal",
 )
 
-// The lengths a BIP-39 mnemonic may have.
-const (
-	twelve     = 12
-	fifteen    = 15
-	eighteen   = 18
-	twentyOne  = 21
-	twentyFour = 24
-)
-
-// ErrEmpty is returned for a mnemonic with no words in it, such as the
-// output of a mnemonic command that printed nothing.
-var ErrEmpty = errors.New("the mnemonic is empty")
-
-// ErrWordCount is returned for a mnemonic with a number of words that
-// BIP-39 does not allow.
-var ErrWordCount = errors.New("a mnemonic has 12, 15, 18, 21 or 24 words")
-
-// ErrUnknownWord is returned for a mnemonic with a word that is not on
-// the BIP-39 English word list. The error gives the word's position,
-// never the word, so the mnemonic stays out of the message.
-var ErrUnknownWord = errors.New("not on the BIP-39 word list")
-
 // ErrChecksum is returned for a mnemonic that fails the BIP-39
 // checksum.
 var ErrChecksum = errors.New("the mnemonic fails its BIP-39 checksum")
@@ -86,7 +63,6 @@ func Read(ctx context.Context, command string) (string, error) {
 func run(ctx context.Context, command string) (string, error) {
 	//nolint:gosec // running the user's own command is the point
 	shell := exec.CommandContext(ctx, "sh", "-c", command)
-	shell.Env = ChildEnv()
 
 	var complaint bytes.Buffer
 
@@ -107,25 +83,6 @@ func run(ctx context.Context, command string) (string, error) {
 	return string(out), nil
 }
 
-// ChildEnv is the tool's environment with the mnemonic variables taken
-// out, for the programs the tool starts: the mnemonic command, ssh and
-// sftp. The mnemonic, from either variable, never leaves the tool.
-func ChildEnv() []string {
-	environ := os.Environ()
-	kept := make([]string, 0, len(environ))
-
-	for _, entry := range environ {
-		name, _, _ := strings.Cut(entry, "=")
-		if name == Variable || name == CommandVariable {
-			continue
-		}
-
-		kept = append(kept, entry)
-	}
-
-	return kept
-}
-
 // ask prompts on the terminal with echo turned off.
 func ask() (string, error) {
 	fd := int(os.Stdin.Fd())
@@ -136,7 +93,7 @@ func ask() (string, error) {
 
 	fmt.Fprint(os.Stderr, "mnemonic: ")
 
-	typed, err := readWithoutEcho()
+	typed, err := term.ReadPassword(fd)
 
 	fmt.Fprintln(os.Stderr)
 
@@ -144,39 +101,18 @@ func ask() (string, error) {
 		return "", fmt.Errorf("reading the mnemonic: %w", err)
 	}
 
-	return checked(typed)
+	return checked(string(typed))
 }
 
 // checked joins the words with single spaces, whatever whitespace
 // separated them, since the seed is computed over the string itself,
-// and refuses a mnemonic that is not a valid BIP-39 mnemonic, with an
+// and refuses a mnemonic that does not pass the BIP-39 checksum.
-// error that says what is wrong with it.
+func checked(words string) (string, error) {
-func checked(text string) (string, error) {
+	words = strings.Join(strings.Fields(words), " ")
-	words := strings.Fields(text)
 
-	switch len(words) {
+	if !bip39.IsMnemonicValid(words) {
-	case 0:
-		return "", ErrEmpty
-	case twelve, fifteen, eighteen, twentyOne, twentyFour:
-	default:
-		return "", fmt.Errorf("%w, not %d", ErrWordCount, len(words))
-	}
-
-	wordList := bip39.English()
-
-	for i, word := range words {
-		if !slices.Contains(wordList, word) {
-			return "", fmt.Errorf(
-				"word %d of the mnemonic is %w", i+1, ErrUnknownWord,
-			)
-		}
-	}
-
-	joined := strings.Join(words, " ")
-
-	if !bip39.IsMnemonicValid(joined) {
 		return "", ErrChecksum
 	}
 
-	return joined, nil
+	return words, nil
 }

internal/mnemonic/mnemonic_test.go

@@ -1,8 +1,6 @@
 package mnemonic_test
 
 import (
-	"os"
-	"path/filepath"
 	"strings"
 	"testing"
 
@@ -63,31 +61,6 @@ func TestTheMnemonicInTheEnvironmentComesLast(t *testing.T) {
 	require.Equal(t, fromVariable, words)
 }
 
-func TestTheMnemonicIsNotHandedToTheCommand(t *testing.T) {
-	const marker = "KEYFUNC_TEST_MARKER"
-
-	t.Setenv(mnemonic.CommandVariable, prints(fromCommandVariable))
-	t.Setenv(mnemonic.Variable, fromVariable)
-	t.Setenv(marker, "reaches the command")
-
-	path := filepath.Join(t.TempDir(), "environment")
-
-	words, err := mnemonic.Read(
-		t.Context(), "env > '"+path+"'; "+prints(example()),
-	)
-	require.NoError(t, err)
-	require.Equal(t, example(), words)
-
-	//nolint:gosec // the path is a temporary file of the test's own
-	content, err := os.ReadFile(path)
-	require.NoError(t, err)
-
-	environment := string(content)
-	require.NotContains(t, environment, mnemonic.Variable+"=")
-	require.NotContains(t, environment, mnemonic.CommandVariable+"=")
-	require.Contains(t, environment, marker+"=")
-}
-
 func TestAFailingCommandSaysWhatWentWrong(t *testing.T) {
 	t.Setenv(mnemonic.CommandVariable, "")
 	t.Setenv(mnemonic.Variable, "")
@@ -97,27 +70,6 @@ func TestAFailingCommandSaysWhatWentWrong(t *testing.T) {
 	require.Contains(t, err.Error(), "nothing here")
 }
 
-func TestValidMnemonicsOf15To24WordsAreAccepted(t *testing.T) {
-	t.Setenv(mnemonic.CommandVariable, "")
-
-	// abandon repeated, then the last word that makes the checksum
-	// match: 15, 18, 21 and 24 words.
-	valid := []string{
-		strings.Repeat("abandon ", 14) + "address",
-		strings.Repeat("abandon ", 17) + "agent",
-		strings.Repeat("abandon ", 20) + "admit",
-		strings.Repeat("abandon ", 23) + "art",
-	}
-
-	for _, words := range valid {
-		t.Setenv(mnemonic.Variable, words)
-
-		got, err := mnemonic.Read(t.Context(), "")
-		require.NoError(t, err)
-		require.Equal(t, words, got)
-	}
-}
-
 func TestABadChecksumIsRefused(t *testing.T) {
 	t.Setenv(mnemonic.CommandVariable, "")
 	t.Setenv(mnemonic.Variable, broken())
@@ -126,38 +78,6 @@ func TestABadChecksumIsRefused(t *testing.T) {
 	require.ErrorIs(t, err, mnemonic.ErrChecksum)
 }
 
-func TestACommandThatPrintsNothingGivesAnEmptyMnemonic(t *testing.T) {
-	t.Setenv(mnemonic.CommandVariable, "")
-	t.Setenv(mnemonic.Variable, "")
-
-	_, err := mnemonic.Read(t.Context(), "true")
-	require.ErrorIs(t, err, mnemonic.ErrEmpty)
-	require.NotContains(t, err.Error(), "checksum")
-}
-
-func TestAWrongWordCountIsRefused(t *testing.T) {
-	t.Setenv(mnemonic.CommandVariable, "")
-	t.Setenv(mnemonic.Variable, strings.Repeat("abandon ", 3))
-
-	_, err := mnemonic.Read(t.Context(), "")
-	require.ErrorIs(t, err, mnemonic.ErrWordCount)
-	require.ErrorContains(t, err, "not 3")
-	require.NotContains(t, err.Error(), "checksum")
-}
-
-func TestAWordNotOnTheListIsNamedByPositionOnly(t *testing.T) {
-	const typo = "abuot"
-
-	t.Setenv(mnemonic.CommandVariable, "")
-	t.Setenv(mnemonic.Variable, strings.Repeat("abandon ", 11)+typo)
-
-	_, err := mnemonic.Read(t.Context(), "")
-	require.ErrorIs(t, err, mnemonic.ErrUnknownWord)
-	require.ErrorContains(t, err, "word 12 ")
-	require.NotContains(t, err.Error(), typo)
-	require.NotContains(t, err.Error(), "checksum")
-}
-
 func TestNothingToReadAndNobodyToAsk(t *testing.T) {
 	t.Setenv(mnemonic.CommandVariable, "")
 	t.Setenv(mnemonic.Variable, "")

internal/mnemonic/prompt_notunix.go

@@ -1,18 +0,0 @@
-//go:build !aix && !darwin && !dragonfly && !freebsd && !linux && !netbsd && !openbsd && !solaris && !zos
-
-package mnemonic
-
-import (
-	"os"
-
-	"golang.org/x/term"
-)
-
-// readWithoutEcho reads one line from the terminal on standard input
-// with echo turned off, through term.ReadPassword, on the systems
-// prompt_unix.go is not built for, such as Windows.
-func readWithoutEcho() (string, error) {
-	typed, err := term.ReadPassword(int(os.Stdin.Fd()))
-
-	return string(typed), err
-}

internal/mnemonic/prompt_unix.go

@@ -1,111 +0,0 @@
-//go:build aix || darwin || dragonfly || freebsd || linux || netbsd || openbsd || solaris || zos
-
-package mnemonic
-
-import (
-	"bufio"
-	"errors"
-	"fmt"
-	"io"
-	"os"
-	"os/signal"
-
-	"golang.org/x/sys/unix"
-	"sneak.berlin/go/keyfunc/internal/signals"
-)
-
-// readWithoutEcho reads one line from the terminal on standard input
-// with echo turned off. The line ends at a newline or at the end of
-// input (Ctrl-D). The terminal is set as term.ReadPassword sets it;
-// ReadPassword itself is not used here because it never sees the end
-// of input and goes on waiting.
-//
-// Meanwhile SIGINT, SIGTERM and SIGHUP are caught, as signals.Notify
-// catches them. One that has arrived by the time the line is read puts
-// the terminal back as it was and then ends the tool, as it would have
-// ended it if it were not caught.
-func readWithoutEcho() (string, error) {
-	fd := int(os.Stdin.Fd())
-
-	settings, err := unix.IoctlGetTermios(fd, ioctlReadTermios)
-	if err != nil {
-		return "", fmt.Errorf("reading the terminal settings: %w", err)
-	}
-
-	// Caught from before echo is turned off, so that no signal can end
-	// the tool with echo off.
-	received := make(chan os.Signal, 1)
-	signals.Notify(received)
-
-	defer signal.Stop(received)
-
-	hidden := *settings
-	hidden.Lflag &^= unix.ECHO
-	hidden.Lflag |= unix.ICANON | unix.ISIG
-	hidden.Iflag |= unix.ICRNL
-
-	err = unix.IoctlSetTermios(fd, ioctlWriteTermios, &hidden)
-	if err != nil {
-		return "", fmt.Errorf("turning echo off: %w", err)
-	}
-
-	var (
-		typed  string
-		failed error
-	)
-
-	read := make(chan struct{})
-
-	go func() {
-		// With ICANON set, a read from the terminal returns at most one
-		// line, so the buffer takes nothing past the newline.
-		typed, failed = bufio.NewReader(os.Stdin).ReadString('\n')
-
-		close(read)
-	}()
-
-	var ending os.Signal
-
-	select {
-	case <-read:
-	case ending = <-received:
-	}
-
-	// The terminal is put back while the signals are still caught, so
-	// that none can end the tool with echo off. Stop returns only once
-	// every signal the tool has received has been handed over, so one
-	// that came as the line was read is in received by then.
-	_ = unix.IoctlSetTermios(fd, ioctlWriteTermios, settings)
-
-	signal.Stop(received)
-
-	if len(received) > 0 {
-		ending = <-received
-	}
-
-	if ending != nil {
-		return "", endBy(ending)
-	}
-
-	if errors.Is(failed, io.EOF) {
-		return typed, nil
-	}
-
-	return typed, failed
-}
-
-// endBy sends the tool the signal again, now that nothing catches it,
-// so that it ends the tool, and waits for that. It returns only if the
-// signal could not be sent.
-func endBy(ending os.Signal) error {
-	tool, err := os.FindProcess(os.Getpid())
-	if err == nil {
-		err = tool.Signal(ending)
-	}
-
-	if err != nil {
-		return fmt.Errorf("ending the tool by %s: %w", ending, err)
-	}
-
-	select {}
-}

internal/mnemonic/termios_bsd.go

@@ -1,12 +0,0 @@
-//go:build darwin || dragonfly || freebsd || netbsd || openbsd
-
-package mnemonic
-
-import "golang.org/x/sys/unix"
-
-// The requests that read and set the terminal settings, as
-// golang.org/x/term names them.
-const (
-	ioctlReadTermios  = unix.TIOCGETA
-	ioctlWriteTermios = unix.TIOCSETA
-)

internal/mnemonic/termios_other.go

@@ -1,12 +0,0 @@
-//go:build aix || linux || solaris || zos
-
-package mnemonic
-
-import "golang.org/x/sys/unix"
-
-// The requests that read and set the terminal settings, as
-// golang.org/x/term names them.
-const (
-	ioctlReadTermios  = unix.TCGETS
-	ioctlWriteTermios = unix.TCSETS
-)