Check the -o path before looking for the mnemonic (closes #87)

age encrypt and age decrypt looked at the -o path only after the
mnemonic had been obtained, so a path that could never be written
still prompted for the mnemonic or ran the mnemonic command. Both now
refuse, before the key is derived, an -o path that is a directory or a
symlink to one, whose directory is missing or is not a directory, or
that is a symlink pointing at nothing. The check creates nothing;
output still looks at the path when it writes, so the file beside the
target is made when it was before. The README names the -o path among
what is checked first.

Model: opus-5-5

README.md

@@ -100,7 +100,9 @@ m/83696968'/<app>'/<n>'
   to one tool. Each key type's number is spelled the way BIP-85 spells its own
   RSA application (`828365` is the ASCII codes of `R`, `S`, `A` written out):
   SSH is `838372` (`S` `S` `H`), age is `657169` (`A` `G` `E`).
-- `n` is the key index: flag `--index` / `-n`, default `0`.
+- `n` is the key index, a decimal number: flag `--index` / `-n`, default `0`. A
+  leading zero is still decimal (`-n 010` is index 10); a base prefix, an
+  underscore or a sign (`0x10`, `1_0`, `+1`) is refused.
 
 ## Giving it the mnemonic
 
@@ -117,14 +119,24 @@ order; the first one found wins:
 4. A prompt on the terminal with echo turned off.
 
 If none of these is available and standard input is not a terminal, the tool
-refuses and exits with status 1. A mnemonic that fails the BIP-39 checksum is
+refuses and exits with status 1. A mnemonic that is empty, does not have 12, 15,
-refused with a message saying so. Keys are derived from the mnemonic's words
+18, 21 or 24 words, has a word that is not on the BIP-39 word list, or fails the
-joined by single spaces, whatever whitespace is around or between them, so one
+BIP-39 checksum is refused with a message saying which. A word that is not on
-word per line, tabs or extra spaces give the same keys.
+the list is named by its position, never printed. Keys are derived from the
+mnemonic's words joined by single spaces, whatever whitespace is around or
+between them, so one word per line, tabs or extra spaces give the same keys.
+
+The key index, `--words`, the `--to` recipients, the file `age encrypt` or
+`age decrypt` is given to read and its `-o` path are checked before the mnemonic
+is looked for, so a run refused for one of them never prompts for the mnemonic
+or runs the mnemonic command. An `-o` path is refused at that point if it is a
+directory or a symlink to one, if its directory is missing or is not a
+directory, or if it is a symlink that points at nothing.
 
 `KEYFUNC_MNEMONIC` and `KEYFUNC_MNEMONIC_COMMAND` are removed from the
-environment before the system `ssh` (`keyfunc ssh to`) and `sftp`
+environment before the mnemonic command, the system `ssh` (`keyfunc ssh to`) and
-(`keyfunc ssh install`) are started, so the mnemonic is never handed on to them.
+`sftp` (`keyfunc ssh install`) are started, so the mnemonic is never handed on
+to them.
 
 Every command takes `--index` / `-n` and `--mnemonic-command`, and has `--help`.
 `keyfunc --version` prints the version. `make build` stamps it; a binary
@@ -217,11 +229,15 @@ first, or pass `-o StrictHostKeyChecking=accept-new` after `--`.
 
 Derives the key, serves it from an SSH agent that runs inside the tool on a unix
 socket in a new private `0700` temporary directory, then runs the system `ssh`
-with `-o IdentityAgent=<that socket>` followed by the host and all remaining
+with `-o IdentityAgent=<that socket> -o IdentitiesOnly=no` followed by the host
-arguments unchanged. The tool exits with `ssh`'s exit status and removes the
+and all remaining arguments unchanged. Without `IdentitiesOnly=no`, an
-socket and directory on the way out. The private key is never written to disk. A
+`IdentitiesOnly yes` in the user's `ssh` configuration keeps the derived key
-SIGINT, SIGTERM or SIGHUP ends `ssh` and still removes the socket and directory,
+from being offered. The agent holds no other key, so turning it off adds nothing
-and the tool then exits with status 1 unless `ssh` reported one of its own.
+else to what `ssh` offers. The tool exits with `ssh`'s exit status and removes
+the socket and directory on the way out. The private key is never written to
+disk. A SIGINT, SIGTERM or SIGHUP ends `ssh` and still removes the socket and
+directory, and the tool then exits with status 1 unless `ssh` reported one of
+its own.
 
 ## age identities: `keyfunc age`
 

internal/agekey/agekey.go

@@ -94,15 +94,12 @@ func (k *Key) Identity() string {
 }
 
 // Encrypt copies src to dst, encrypted to this key and to every extra
-// recipient named, so the same mnemonic can always read it back again.
+// recipient given, so the same mnemonic can always read it back again.
 // Armored output is the text form age also reads.
 func (k *Key) Encrypt(
-	dst io.Writer, src io.Reader, to []string, armored bool,
+	dst io.Writer, src io.Reader, to []age.Recipient, armored bool,
 ) error {
-	all, err := recipients(k.identity.Recipient(), to)
+	all := append([]age.Recipient{k.identity.Recipient()}, to...)
-	if err != nil {
-		return err
-	}
 
 	out := dst
 
@@ -113,7 +110,7 @@ func (k *Key) Encrypt(
 		out = text
 	}
 
-	err = encrypt(out, src, all)
+	err := encrypt(out, src, all)
 	if err != nil {
 		return err
 	}
@@ -130,12 +127,12 @@ func (k *Key) Encrypt(
 	return nil
 }
 
-// recipients returns the key's own recipient followed by the ones
+// Recipients reads the recipients named on the command line, for
-// named on the command line, so what the key encrypts it can read.
+// Encrypt to add to the key's own.
-func recipients(mine age.Recipient, to []string) ([]age.Recipient, error) {
+func Recipients(names []string) ([]age.Recipient, error) {
-	list := []age.Recipient{mine}
+	list := make([]age.Recipient, 0, len(names))
 
-	for _, name := range to {
+	for _, name := range names {
 		parsed, err := age.ParseX25519Recipient(name)
 		if err != nil {
 			return nil, fmt.Errorf("reading recipient %q: %w", name, err)

internal/agekey/agekey_test.go

@@ -119,12 +119,12 @@ func TestAnExtraRecipientCanReadItTooAndSoCanTheDerivedOne(t *testing.T) {
 
 	mine, theirs := forIndex(t, 0), forIndex(t, 1)
 
+	to, err := agekey.Recipients([]string{theirs.Recipient()})
+	require.NoError(t, err)
+
 	var sealed bytes.Buffer
 
-	err := mine.Encrypt(
+	err = mine.Encrypt(&sealed, strings.NewReader("hello"), to, false)
-		&sealed, strings.NewReader("hello"),
-		[]string{theirs.Recipient()}, false,
-	)
 	require.NoError(t, err)
 
 	for _, key := range []*agekey.Key{mine, theirs} {
@@ -138,10 +138,7 @@ func TestAnExtraRecipientCanReadItTooAndSoCanTheDerivedOne(t *testing.T) {
 func TestARecipientThatIsNotOneIsRefused(t *testing.T) {
 	t.Parallel()
 
-	err := forIndex(t, 0).Encrypt(
+	_, err := agekey.Recipients([]string{"not a recipient"})
-		&bytes.Buffer{}, strings.NewReader("hello"),
-		[]string{"not a recipient"}, false,
-	)
 	require.Error(t, err)
 }
 

internal/childmnemonic/childmnemonic.go

@@ -29,6 +29,17 @@ const DefaultWords = twelve
 // ErrWordCount is returned for a length this tool does not offer.
 var ErrWordCount = errors.New("a child mnemonic has 12, 18 or 24 words")
 
+// CheckWords refuses a length this tool does not offer, so that the
+// command can turn it down before it looks for the mnemonic.
+func CheckWords(words uint32) error {
+	switch words {
+	case twelve, eighteen, twentyFour:
+		return nil
+	default:
+		return fmt.Errorf("%w, not %d", ErrWordCount, words)
+	}
+}
+
 // Derive returns the English child mnemonic of that many words at that
 // key index, taken from the master key with BIP-85's own mnemonic
 // application, number 39. The words come straight from the BIP-85
@@ -38,13 +49,12 @@ func Derive(
 	master *hdkeychain.ExtendedKey,
 	words, index uint32,
 ) (string, error) {
-	switch words {
+	err := CheckWords(words)
-	case twelve, eighteen, twentyFour:
+	if err != nil {
-	default:
+		return "", err
-		return "", fmt.Errorf("%w, not %d", ErrWordCount, words)
 	}
 
-	err := derive.CheckIndex(index)
+	err = derive.CheckIndex(index)
 	if err != nil {
 		return "", err
 	}

internal/cli/age/age.go

@@ -11,6 +11,7 @@ import (
 	"os"
 	"os/signal"
 	"path/filepath"
+	"syscall"
 
 	"github.com/spf13/cobra"
 	"sneak.berlin/go/keyfunc/internal/agekey"
@@ -108,47 +109,30 @@ func decrypt() *cobra.Command {
 }
 
 // runEncrypt encrypts to the derived recipient and any others given.
+// The recipients are read, the -o path looked at and the input opened
+// before the key is derived, so that a run refused for any of them
+// never asks for the mnemonic.
 func runEncrypt(cmd *cobra.Command, args []string) error {
-	key, err := derived(cmd)
+	names, err := cmd.Flags().GetStringArray("to")
-	if err != nil {
-		return err
-	}
-
-	to, err := cmd.Flags().GetStringArray("to")
 	if err != nil {
 		return fmt.Errorf("reading the recipients: %w", err)
 	}
 
+	to, err := agekey.Recipients(names)
+	if err != nil {
+		return err
+	}
+
 	armored, err := cmd.Flags().GetBool("armor")
 	if err != nil {
 		return fmt.Errorf("reading the armor flag: %w", err)
 	}
 
-	return through(cmd, args, func(dst io.Writer, src io.Reader) error {
+	err = checkOutput(cmd)
-		return key.Encrypt(dst, src, to, armored)
-	})
-}
-
-// runDecrypt decrypts with the derived identity.
-func runDecrypt(cmd *cobra.Command, args []string) error {
-	key, err := derived(cmd)
 	if err != nil {
 		return err
 	}
 
-	return through(cmd, args, key.Decrypt)
-}
-
-// through opens the input the arguments ask for and hands it to the
-// work, with the file --output names to write to, or the command's own
-// output when it names none or names the same file as that output, and
-// the command's own error output when it names the same file as that.
-// Those two are the streams the tool already has, so whatever they are
-// redirected to is written as the redirect says, never replaced.
-func through(
-	cmd *cobra.Command, args []string,
-	work func(io.Writer, io.Reader) error,
-) error {
 	src, closeSrc, err := input(cmd, args)
 	if err != nil {
 		return err
@@ -156,6 +140,49 @@ func through(
 
 	defer closeSrc()
 
+	key, err := derived(cmd)
+	if err != nil {
+		return err
+	}
+
+	return through(cmd, src, func(dst io.Writer, plain io.Reader) error {
+		return key.Encrypt(dst, plain, to, armored)
+	})
+}
+
+// runDecrypt decrypts with the derived identity. The -o path is looked
+// at and the input opened before the key is derived, as for runEncrypt.
+func runDecrypt(cmd *cobra.Command, args []string) error {
+	err := checkOutput(cmd)
+	if err != nil {
+		return err
+	}
+
+	src, closeSrc, err := input(cmd, args)
+	if err != nil {
+		return err
+	}
+
+	defer closeSrc()
+
+	key, err := derived(cmd)
+	if err != nil {
+		return err
+	}
+
+	return through(cmd, src, key.Decrypt)
+}
+
+// through hands the input to the work, with the file --output names to
+// write to, or the command's own output when it names none or names the
+// same file as that output, and the command's own error output when it
+// names the same file as that. Those two are the streams the tool
+// already has, so whatever they are redirected to is written as the
+// redirect says, never replaced.
+func through(
+	cmd *cobra.Command, src io.Reader,
+	work func(io.Writer, io.Reader) error,
+) error {
 	name, err := cmd.Flags().GetString("output")
 	if err != nil {
 		return fmt.Errorf("reading the output file: %w", err)
@@ -209,6 +236,52 @@ func input(cmd *cobra.Command, args []string) (io.Reader, func(), error) {
 	return file, func() { _ = file.Close() }, nil
 }
 
+// checkOutput refuses an -o path that output could not write to,
+// before anything is written: a directory or a symlink to one, one
+// whose directory is missing or is not a directory, or a symlink that
+// points at nothing. It creates nothing; output looks at the path again
+// when it writes.
+func checkOutput(cmd *cobra.Command) error {
+	name, err := cmd.Flags().GetString("output")
+	if err != nil {
+		return fmt.Errorf("reading the output file: %w", err)
+	}
+
+	if name == "" {
+		return nil
+	}
+
+	info, err := os.Lstat(name)
+
+	switch {
+	case errors.Is(err, fs.ErrNotExist):
+		// replace makes its new file in this directory. When the
+		// directory is a file instead, os.Lstat has already failed with
+		// ENOTDIR, the case below.
+		directory := filepath.Dir(name)
+
+		_, err = os.Stat(directory)
+		if err != nil {
+			return fmt.Errorf("looking at %s: %w", directory, err)
+		}
+
+		return nil
+	case err != nil:
+		return fmt.Errorf("looking at %s: %w", name, err)
+	case info.Mode().Type() == fs.ModeSymlink:
+		info, err = os.Stat(name)
+		if err != nil {
+			return fmt.Errorf("following %s: %w", name, err)
+		}
+	}
+
+	if info.IsDir() {
+		return fmt.Errorf("writing to %s: %w", name, syscall.EISDIR)
+	}
+
+	return nil
+}
+
 // output has the work write to the named path, going by what is there
 // without following a final symlink:
 //

internal/cli/age_test.go

@@ -17,6 +17,7 @@ import (
 	"sneak.berlin/go/keyfunc/internal/agekey"
 	"sneak.berlin/go/keyfunc/internal/cli"
 	"sneak.berlin/go/keyfunc/internal/cli/age"
+	"sneak.berlin/go/keyfunc/internal/derive"
 	"sneak.berlin/go/keyfunc/internal/mnemonic"
 )
 
@@ -69,6 +70,82 @@ func TestAnotherRecipientIsAddedAndTheDerivedOneStays(t *testing.T) {
 	)
 }
 
+// The mnemonic command fails in these runs, so the refusal of the index
+// shows that it was checked before the mnemonic was looked for.
+func TestAnAgeIndexWithNoHardenedChildIsRefused(t *testing.T) {
+	t.Setenv(mnemonic.CommandVariable, failingMnemonicCommand)
+
+	for _, command := range []string{"pub", "priv", "encrypt", "decrypt"} {
+		out, err := execute(t, "age", command, "-n", tooLarge)
+		require.ErrorIs(t, err, derive.ErrIndexTooLarge, command)
+		require.Empty(t, out, command)
+	}
+}
+
+// The mnemonic command fails in this run, so the refusal of the
+// recipient shows that it was read before the mnemonic was looked for.
+func TestAnEncryptionToARecipientThatIsNotOneIsRefused(t *testing.T) {
+	t.Setenv(mnemonic.CommandVariable, failingMnemonicCommand)
+
+	plain := written(t, "notes.txt", "the secret\n")
+
+	out, err := execute(t, "age", "encrypt", "--to", "bogus", plain)
+	require.ErrorContains(t, err, `reading recipient "bogus"`)
+	require.Empty(t, out)
+}
+
+// The mnemonic command fails in these runs, so the refusal of the input
+// file shows that it was opened before the mnemonic was looked for.
+func TestAnInputFileThatCannotBeOpenedIsRefused(t *testing.T) {
+	t.Setenv(mnemonic.CommandVariable, failingMnemonicCommand)
+
+	missing := filepath.Join(t.TempDir(), "missing")
+
+	for _, operation := range []string{"encrypt", "decrypt"} {
+		out, err := execute(t, "age", operation, missing)
+		require.ErrorIs(t, err, fs.ErrNotExist, operation)
+		require.Empty(t, out, operation)
+	}
+}
+
+// The mnemonic command fails in these runs, so the refusal of the -o
+// path shows that it was looked at before the mnemonic was looked for.
+func TestAnOutputPathThatCannotBeWrittenIsRefused(t *testing.T) {
+	t.Setenv(mnemonic.CommandVariable, failingMnemonicCommand)
+
+	plain := written(t, "notes.txt", "the secret\n")
+	directory := t.TempDir()
+	missing := filepath.Join(directory, "missing")
+	dangling := filepath.Join(directory, "dangling")
+	require.NoError(t, os.Symlink(missing, dangling))
+
+	toDirectory := filepath.Join(directory, "to-directory")
+	require.NoError(t, os.Symlink(t.TempDir(), toDirectory))
+
+	refusals := map[string]error{
+		filepath.Join(missing, "notes.age"): fs.ErrNotExist,
+		filepath.Join(plain, "notes.age"):   syscall.ENOTDIR,
+		dangling:                            fs.ErrNotExist,
+		directory:                           syscall.EISDIR,
+		toDirectory:                         syscall.EISDIR,
+	}
+
+	for name, refusal := range refusals {
+		out, err := execute(t, "age", "encrypt", "-o", name, plain)
+		require.ErrorIs(t, err, refusal, name)
+		require.Empty(t, out, name)
+
+		out, err = execute(t, "age", "decrypt", "-o", name, plain)
+		require.ErrorIs(t, err, refusal, name)
+		require.Empty(t, out, name)
+	}
+
+	// Nothing was made beside the two symlinks.
+	left, err := os.ReadDir(directory)
+	require.NoError(t, err)
+	require.Len(t, left, 2)
+}
+
 func TestAFileForAnotherKeyIsRefused(t *testing.T) {
 	t.Setenv(mnemonic.Variable, example())
 

internal/cli/cli_test.go

@@ -2,6 +2,7 @@ package cli_test
 
 import (
 	"bytes"
+	"strconv"
 	"strings"
 	"testing"
 
@@ -33,6 +34,14 @@ const (
 	twentyFour = 24
 )
 
+// tooLarge is the smallest key index with no hardened child.
+const tooLarge = "2147483648"
+
+// failingMnemonicCommand fails loudly, so a run that looks for the
+// mnemonic ends with that failure. A run that ends with the refusal of
+// an argument instead shows that the argument was checked first.
+const failingMnemonicCommand = "echo the mnemonic was looked for >&2; exit 1"
+
 // example returns the mnemonic the README gives its test vectors for:
 // eleven abandons and about.
 func example() string {
@@ -98,12 +107,75 @@ func TestThePrivateKeyMatchesThePublicOne(t *testing.T) {
 	require.Equal(t, vectorOne, back)
 }
 
+// The mnemonic command fails in these runs, so the refusal of the index
+// shows that it was checked before the mnemonic was looked for. The age
+// commands have a test of their own.
 func TestAnIndexWithNoHardenedChildIsRefused(t *testing.T) {
+	t.Setenv(mnemonic.CommandVariable, failingMnemonicCommand)
+
+	for _, args := range [][]string{
+		{subcommand, "pub", "-n", tooLarge},
+		{subcommand, "priv", "-n", tooLarge},
+		{subcommand, installing, "-n", tooLarge, host},
+		{subcommand, "to", "-n", tooLarge, host},
+		{"mnemonic", "-n", tooLarge},
+	} {
+		name := strings.Join(args, " ")
+
+		out, err := execute(t, args...)
+		require.ErrorIs(t, err, derive.ErrIndexTooLarge, name)
+		require.Empty(t, out, name)
+	}
+}
+
+func TestAnIndexWithALeadingZeroIsDecimal(t *testing.T) {
 	t.Setenv(mnemonic.Variable, example())
 
-	out, err := execute(t, "ssh", "pub", "-n", "2147483648")
+	line := run(t, "ssh", "pub", "-n", "010")
-	require.ErrorIs(t, err, derive.ErrIndexTooLarge)
+	require.Equal(t, run(t, "ssh", "pub", "-n", "10"), line)
-	require.Empty(t, out)
+	require.True(t,
+		strings.HasSuffix(strings.TrimSpace(line), " keyfunc/ssh/10"),
+	)
+}
+
+// The mnemonic command in these runs fails, so a refusal naming the
+// flag shows that the number was refused before the mnemonic was
+// looked for.
+func TestAnIndexThatIsNotDecimalDigitsIsRefused(t *testing.T) {
+	t.Parallel()
+
+	for _, index := range []string{"0x10", "1_0", "+1", "-1", ""} {
+		t.Run(index, func(t *testing.T) {
+			t.Parallel()
+
+			out, err := execute(t,
+				"ssh", "pub", "-n", index, "--mnemonic-command", "exit 1",
+			)
+			require.ErrorIs(t, err, strconv.ErrSyntax)
+			require.ErrorContains(t, err, "--index")
+			require.Empty(t, out)
+		})
+	}
+}
+
+// Neither a command group nor --version reads the index, so these
+// show that it is refused while the flags are parsed.
+func TestAnIndexNotInDecimalIsRefusedBeforeAnyCommandRuns(t *testing.T) {
+	t.Parallel()
+
+	for _, args := range [][]string{
+		{"ssh", "-n", "0x10"},
+		{"-n", "0x10", "--version"},
+	} {
+		t.Run(strings.Join(args, " "), func(t *testing.T) {
+			t.Parallel()
+
+			out, err := execute(t, args...)
+			require.ErrorIs(t, err, strconv.ErrSyntax)
+			require.ErrorContains(t, err, "--index")
+			require.Empty(t, out)
+		})
+	}
 }
 
 func TestTheMnemonicCommandIsUsed(t *testing.T) {
@@ -130,14 +202,32 @@ func TestAChildMnemonicIsPrinted(t *testing.T) {
 	require.NotEqual(t, short, next)
 }
 
+// The mnemonic command fails in this run, so the refusal of the length
+// shows that it was checked before the mnemonic was looked for.
 func TestALengthTheToolDoesNotOfferIsRefused(t *testing.T) {
-	t.Setenv(mnemonic.Variable, example())
+	t.Setenv(mnemonic.CommandVariable, failingMnemonicCommand)
 
 	out, err := execute(t, "mnemonic", "--words", "15")
 	require.ErrorIs(t, err, childmnemonic.ErrWordCount)
 	require.Empty(t, out)
 }
 
+func TestTheWordCountIsDecimal(t *testing.T) {
+	t.Setenv(mnemonic.Variable, example())
+
+	words := strings.Fields(run(t, "mnemonic", "--words", "012"))
+	require.Len(t, words, twelve)
+
+	// As for the index, the failing mnemonic command shows that the
+	// number was refused first.
+	out, err := execute(t,
+		"mnemonic", "--words", "0x18", "--mnemonic-command", "exit 1",
+	)
+	require.ErrorIs(t, err, strconv.ErrSyntax)
+	require.ErrorContains(t, err, "--words")
+	require.Empty(t, out)
+}
+
 // run executes the tool with the given arguments and returns what it
 // wrote to standard output.
 func run(t *testing.T, args ...string) string {

internal/cli/mnemonic/mnemonic.go

@@ -31,8 +31,9 @@ func Command() *cobra.Command {
 		},
 	}
 
-	cmd.Flags().Uint32(
+	words := options.Decimal(childmnemonic.DefaultWords)
-		"words", childmnemonic.DefaultWords,
+	cmd.Flags().Var(
+		&words, "words",
 		"how long the child mnemonic is: 12, 18 or 24 words",
 	)
 
@@ -51,6 +52,11 @@ func derived(cmd *cobra.Command) (string, error) {
 		return "", fmt.Errorf("reading the word count: %w", err)
 	}
 
+	err = childmnemonic.CheckWords(words)
+	if err != nil {
+		return "", err
+	}
+
 	parent, err := options.Mnemonic(cmd)
 	if err != nil {
 		return "", err

internal/cli/options/options.go

@@ -4,8 +4,10 @@ package options
 
 import (
 	"fmt"
+	"strconv"
 
 	"github.com/spf13/cobra"
+	"sneak.berlin/go/keyfunc/internal/derive"
 	"sneak.berlin/go/keyfunc/internal/mnemonic"
 )
 
@@ -16,19 +18,26 @@ func Add(cmd *cobra.Command) {
 		"mnemonic-command", "",
 		"shell command whose output is the mnemonic",
 	)
-	cmd.PersistentFlags().Uint32P(
+	cmd.PersistentFlags().VarP(
-		"index", "n", 0,
+		new(Decimal), "index", "n",
 		"which key to derive",
 	)
 }
 
-// Index returns the key index the user asked for.
+// Index returns the key index the user asked for, and refuses one above
+// derive.MaxIndex. Every command calls it before it looks for the
+// mnemonic.
 func Index(cmd *cobra.Command) (uint32, error) {
 	index, err := cmd.Flags().GetUint32("index")
 	if err != nil {
 		return 0, fmt.Errorf("reading the index: %w", err)
 	}
 
+	err = derive.CheckIndex(index)
+	if err != nil {
+		return 0, err
+	}
+
 	return index, nil
 }
 
@@ -41,3 +50,33 @@ func Mnemonic(cmd *cobra.Command) (string, error) {
 
 	return mnemonic.Read(cmd.Context(), command)
 }
+
+// Decimal is a flag value for a number written in decimal digits only.
+// The flag library's own uint32 flags read 010 as octal 8 and also
+// take 0x10 or 1_0.
+type Decimal uint32
+
+// String returns the number in decimal digits.
+func (d *Decimal) String() string {
+	return strconv.FormatUint(uint64(*d), 10)
+}
+
+// Set reads text as a decimal number that fits in 32 bits: a leading
+// zero is still decimal, and a base prefix, an underscore or a sign is
+// refused.
+func (d *Decimal) Set(text string) error {
+	number, err := strconv.ParseUint(text, 10, 32)
+	if err != nil {
+		return err
+	}
+
+	*d = Decimal(number)
+
+	return nil
+}
+
+// Type is what --help shows as the flag's type, and what GetUint32
+// checks before it reads the value back.
+func (d *Decimal) Type() string {
+	return "uint32"
+}

internal/cli/ssh/install.go

@@ -16,6 +16,7 @@ import (
 
 	"github.com/spf13/cobra"
 	"sneak.berlin/go/keyfunc/internal/cli/signals"
+	"sneak.berlin/go/keyfunc/internal/mnemonic"
 )
 
 // Where the key goes on the host and what the file it arrives in is
@@ -220,7 +221,7 @@ func session(
 
 	//nolint:gosec // the options are the user's own, meant for sftp
 	command := exec.CommandContext(cmd.Context(), "sftp", argv...)
-	command.Env = childEnv()
+	command.Env = mnemonic.ChildEnv()
 	command.Stdin = strings.NewReader(strings.Join(batch, "\n") + "\n")
 	command.Stdout = &said
 	command.Stderr = &said

internal/cli/ssh/ssh.go

@@ -3,13 +3,10 @@ package ssh
 
 import (
 	"fmt"
-	"os"
-	"strings"
 
 	"github.com/spf13/cobra"
 	"sneak.berlin/go/keyfunc/internal/cli/options"
 	"sneak.berlin/go/keyfunc/internal/derive"
-	"sneak.berlin/go/keyfunc/internal/mnemonic"
 	"sneak.berlin/go/keyfunc/internal/sshkey"
 )
 
@@ -87,26 +84,6 @@ func write(cmd *cobra.Command, text string) error {
 	return nil
 }
 
-// childEnv is the tool's environment with the mnemonic variables taken
-// out, for the ssh and sftp children it starts. "ssh to" exists so the
-// private key never leaves the tool; the mnemonic, from either variable,
-// must not leave it either.
-func childEnv() []string {
-	environ := os.Environ()
-	kept := make([]string, 0, len(environ))
-
-	for _, entry := range environ {
-		name, _, _ := strings.Cut(entry, "=")
-		if name == mnemonic.Variable || name == mnemonic.CommandVariable {
-			continue
-		}
-
-		kept = append(kept, entry)
-	}
-
-	return kept
-}
-
 // addComment gives a command its comment flag.
 func addComment(cmd *cobra.Command) {
 	cmd.Flags().String(

internal/cli/ssh/to.go

@@ -11,6 +11,7 @@ import (
 
 	"github.com/spf13/cobra"
 	"sneak.berlin/go/keyfunc/internal/cli/signals"
+	"sneak.berlin/go/keyfunc/internal/mnemonic"
 )
 
 // StatusError says the tool should end with the status ssh ended with.
@@ -57,8 +58,13 @@ func to() *cobra.Command {
 
 			defer served.Stop()
 
+			// IdentitiesOnly yes in the user's ssh configuration
+			// would keep the agent's key from being offered. The
+			// agent holds only the derived key, so turning it off
+			// adds no other key.
 			argv := slices.Concat([]string{
 				"-o", "IdentityAgent=" + served.Socket(),
+				"-o", "IdentitiesOnly=no",
 			}, args)
 
 			return connect(ctx, argv)
@@ -79,7 +85,7 @@ func to() *cobra.Command {
 func connect(ctx context.Context, argv []string) error {
 	//nolint:gosec // the arguments are the user's own, meant for ssh
 	command := exec.CommandContext(ctx, "ssh", argv...)
-	command.Env = childEnv()
+	command.Env = mnemonic.ChildEnv()
 	command.Stdin = os.Stdin
 	command.Stdout = os.Stdout
 	command.Stderr = os.Stderr

internal/cli/ssh_test.go

@@ -587,7 +587,7 @@ func TestSSHIsPointedAtTheAgentAndItsStatusIsHandedOn(t *testing.T) {
 
 	given := recorded(t, arguments)
 	require.Equal(t, "-o", given[0])
-	require.Equal(t, []string{host, remoteCommand}, given[2:])
+	require.Equal(t, []string{host, remoteCommand}, given[4:])
 
 	// The stand-in wrote the path down only because there really was
 	// a socket there while it ran.
@@ -596,6 +596,26 @@ func TestSSHIsPointedAtTheAgentAndItsStatusIsHandedOn(t *testing.T) {
 	require.NoDirExists(t, filepath.Dir(socket))
 }
 
+func TestIdentitiesOnlyIsTurnedOffBeforeTheHost(t *testing.T) {
+	t.Setenv(mnemonic.Variable, example())
+
+	arguments, _ := pretendCall(t)
+
+	_, err := execute(t, subcommand, "to", host, remoteCommand)
+
+	var passed ssh.StatusError
+
+	require.ErrorAs(t, err, &passed)
+
+	// IdentitiesOnly yes in the user's ssh configuration keeps ssh
+	// from offering the agent's key. An option given before the host
+	// wins over the configuration.
+	given := recorded(t, arguments)
+	require.Equal(t,
+		[]string{"-o", "IdentitiesOnly=no", host, remoteCommand}, given[2:],
+	)
+}
+
 func TestTheToolEndsWithTheStatusSSHEndedWith(t *testing.T) {
 	t.Setenv(mnemonic.Variable, example())
 

internal/mnemonic/mnemonic.go

@@ -8,6 +8,7 @@ import (
 	"fmt"
 	"os"
 	"os/exec"
+	"slices"
 	"strings"
 
 	"golang.org/x/term"
@@ -29,6 +30,28 @@ var ErrMissing = errors.New(
 	"no mnemonic given and standard input is not a terminal",
 )
 
+// The lengths a BIP-39 mnemonic may have.
+const (
+	twelve     = 12
+	fifteen    = 15
+	eighteen   = 18
+	twentyOne  = 21
+	twentyFour = 24
+)
+
+// ErrEmpty is returned for a mnemonic with no words in it, such as the
+// output of a mnemonic command that printed nothing.
+var ErrEmpty = errors.New("the mnemonic is empty")
+
+// ErrWordCount is returned for a mnemonic with a number of words that
+// BIP-39 does not allow.
+var ErrWordCount = errors.New("a mnemonic has 12, 15, 18, 21 or 24 words")
+
+// ErrUnknownWord is returned for a mnemonic with a word that is not on
+// the BIP-39 English word list. The error gives the word's position,
+// never the word, so the mnemonic stays out of the message.
+var ErrUnknownWord = errors.New("not on the BIP-39 word list")
+
 // ErrChecksum is returned for a mnemonic that fails the BIP-39
 // checksum.
 var ErrChecksum = errors.New("the mnemonic fails its BIP-39 checksum")
@@ -63,6 +86,7 @@ func Read(ctx context.Context, command string) (string, error) {
 func run(ctx context.Context, command string) (string, error) {
 	//nolint:gosec // running the user's own command is the point
 	shell := exec.CommandContext(ctx, "sh", "-c", command)
+	shell.Env = ChildEnv()
 
 	var complaint bytes.Buffer
 
@@ -83,6 +107,25 @@ func run(ctx context.Context, command string) (string, error) {
 	return string(out), nil
 }
 
+// ChildEnv is the tool's environment with the mnemonic variables taken
+// out, for the programs the tool starts: the mnemonic command, ssh and
+// sftp. The mnemonic, from either variable, never leaves the tool.
+func ChildEnv() []string {
+	environ := os.Environ()
+	kept := make([]string, 0, len(environ))
+
+	for _, entry := range environ {
+		name, _, _ := strings.Cut(entry, "=")
+		if name == Variable || name == CommandVariable {
+			continue
+		}
+
+		kept = append(kept, entry)
+	}
+
+	return kept
+}
+
 // ask prompts on the terminal with echo turned off.
 func ask() (string, error) {
 	fd := int(os.Stdin.Fd())
@@ -106,13 +149,34 @@ func ask() (string, error) {
 
 // checked joins the words with single spaces, whatever whitespace
 // separated them, since the seed is computed over the string itself,
-// and refuses a mnemonic that does not pass the BIP-39 checksum.
+// and refuses a mnemonic that is not a valid BIP-39 mnemonic, with an
-func checked(words string) (string, error) {
+// error that says what is wrong with it.
-	words = strings.Join(strings.Fields(words), " ")
+func checked(text string) (string, error) {
+	words := strings.Fields(text)
 
-	if !bip39.IsMnemonicValid(words) {
+	switch len(words) {
+	case 0:
+		return "", ErrEmpty
+	case twelve, fifteen, eighteen, twentyOne, twentyFour:
+	default:
+		return "", fmt.Errorf("%w, not %d", ErrWordCount, len(words))
+	}
+
+	wordList := bip39.English()
+
+	for i, word := range words {
+		if !slices.Contains(wordList, word) {
+			return "", fmt.Errorf(
+				"word %d of the mnemonic is %w", i+1, ErrUnknownWord,
+			)
+		}
+	}
+
+	joined := strings.Join(words, " ")
+
+	if !bip39.IsMnemonicValid(joined) {
 		return "", ErrChecksum
 	}
 
-	return words, nil
+	return joined, nil
 }

internal/mnemonic/mnemonic_test.go

@@ -1,6 +1,8 @@
 package mnemonic_test
 
 import (
+	"os"
+	"path/filepath"
 	"strings"
 	"testing"
 
@@ -61,6 +63,31 @@ func TestTheMnemonicInTheEnvironmentComesLast(t *testing.T) {
 	require.Equal(t, fromVariable, words)
 }
 
+func TestTheMnemonicIsNotHandedToTheCommand(t *testing.T) {
+	const marker = "KEYFUNC_TEST_MARKER"
+
+	t.Setenv(mnemonic.CommandVariable, prints(fromCommandVariable))
+	t.Setenv(mnemonic.Variable, fromVariable)
+	t.Setenv(marker, "reaches the command")
+
+	path := filepath.Join(t.TempDir(), "environment")
+
+	words, err := mnemonic.Read(
+		t.Context(), "env > '"+path+"'; "+prints(example()),
+	)
+	require.NoError(t, err)
+	require.Equal(t, example(), words)
+
+	//nolint:gosec // the path is a temporary file of the test's own
+	content, err := os.ReadFile(path)
+	require.NoError(t, err)
+
+	environment := string(content)
+	require.NotContains(t, environment, mnemonic.Variable+"=")
+	require.NotContains(t, environment, mnemonic.CommandVariable+"=")
+	require.Contains(t, environment, marker+"=")
+}
+
 func TestAFailingCommandSaysWhatWentWrong(t *testing.T) {
 	t.Setenv(mnemonic.CommandVariable, "")
 	t.Setenv(mnemonic.Variable, "")
@@ -70,6 +97,27 @@ func TestAFailingCommandSaysWhatWentWrong(t *testing.T) {
 	require.Contains(t, err.Error(), "nothing here")
 }
 
+func TestValidMnemonicsOf15To24WordsAreAccepted(t *testing.T) {
+	t.Setenv(mnemonic.CommandVariable, "")
+
+	// abandon repeated, then the last word that makes the checksum
+	// match: 15, 18, 21 and 24 words.
+	valid := []string{
+		strings.Repeat("abandon ", 14) + "address",
+		strings.Repeat("abandon ", 17) + "agent",
+		strings.Repeat("abandon ", 20) + "admit",
+		strings.Repeat("abandon ", 23) + "art",
+	}
+
+	for _, words := range valid {
+		t.Setenv(mnemonic.Variable, words)
+
+		got, err := mnemonic.Read(t.Context(), "")
+		require.NoError(t, err)
+		require.Equal(t, words, got)
+	}
+}
+
 func TestABadChecksumIsRefused(t *testing.T) {
 	t.Setenv(mnemonic.CommandVariable, "")
 	t.Setenv(mnemonic.Variable, broken())
@@ -78,6 +126,38 @@ func TestABadChecksumIsRefused(t *testing.T) {
 	require.ErrorIs(t, err, mnemonic.ErrChecksum)
 }
 
+func TestACommandThatPrintsNothingGivesAnEmptyMnemonic(t *testing.T) {
+	t.Setenv(mnemonic.CommandVariable, "")
+	t.Setenv(mnemonic.Variable, "")
+
+	_, err := mnemonic.Read(t.Context(), "true")
+	require.ErrorIs(t, err, mnemonic.ErrEmpty)
+	require.NotContains(t, err.Error(), "checksum")
+}
+
+func TestAWrongWordCountIsRefused(t *testing.T) {
+	t.Setenv(mnemonic.CommandVariable, "")
+	t.Setenv(mnemonic.Variable, strings.Repeat("abandon ", 3))
+
+	_, err := mnemonic.Read(t.Context(), "")
+	require.ErrorIs(t, err, mnemonic.ErrWordCount)
+	require.ErrorContains(t, err, "not 3")
+	require.NotContains(t, err.Error(), "checksum")
+}
+
+func TestAWordNotOnTheListIsNamedByPositionOnly(t *testing.T) {
+	const typo = "abuot"
+
+	t.Setenv(mnemonic.CommandVariable, "")
+	t.Setenv(mnemonic.Variable, strings.Repeat("abandon ", 11)+typo)
+
+	_, err := mnemonic.Read(t.Context(), "")
+	require.ErrorIs(t, err, mnemonic.ErrUnknownWord)
+	require.ErrorContains(t, err, "word 12 ")
+	require.NotContains(t, err.Error(), typo)
+	require.NotContains(t, err.Error(), "checksum")
+}
+
 func TestNothingToReadAndNobodyToAsk(t *testing.T) {
 	t.Setenv(mnemonic.CommandVariable, "")
 	t.Setenv(mnemonic.Variable, "")