Fixes #79: a run with a bad argument still prompted for the mnemonic, or ran the mnemonic command, before refusing.
options.Index now refuses an index above derive.MaxIndex. Every command group calls it before looking for the mnemonic, so this one change covers the ssh commands, the age commands and mnemonic. The limit is still defined only in internal/derive.
childmnemonic.CheckWords is the word-count check Derive used to make inline. The mnemonic command calls it before the mnemonic, and Derive still calls it.
agekey.Recipients parses the --to recipients, and Encrypt now takes that parsed list instead of strings, so age encrypt reads them before deriving the key and parses them once.
age encrypt and age decrypt open their input file before deriving the key; through now takes the opened input instead of the arguments.
The new tests set KEYFUNC_MNEMONIC_COMMAND to a command that fails loudly and check that the argument's refusal is what comes back. The README now says which checks come first.
Judgement call: the -o path is still looked at after the mnemonic. The issue's list does not name it, and moving that step would change when the output file is made and what a signal at the prompt has to remove.
Model: opus-5-5
Fixes https://git.eeqj.de/sneak/keyfunc/issues/79: a run with a bad argument still prompted for the mnemonic, or ran the mnemonic command, before refusing.
- `options.Index` now refuses an index above `derive.MaxIndex`. Every command group calls it before looking for the mnemonic, so this one change covers the `ssh` commands, the `age` commands and `mnemonic`. The limit is still defined only in `internal/derive`.
- `childmnemonic.CheckWords` is the word-count check `Derive` used to make inline. The `mnemonic` command calls it before the mnemonic, and `Derive` still calls it.
- `agekey.Recipients` parses the `--to` recipients, and `Encrypt` now takes that parsed list instead of strings, so `age encrypt` reads them before deriving the key and parses them once.
- `age encrypt` and `age decrypt` open their input file before deriving the key; `through` now takes the opened input instead of the arguments.
The new tests set `KEYFUNC_MNEMONIC_COMMAND` to a command that fails loudly and check that the argument's refusal is what comes back. The README now says which checks come first.
Judgement call: the `-o` path is still looked at after the mnemonic. The issue's list does not name it, and moving that step would change when the output file is made and what a signal at the prompt has to remove.
Model: opus-5-5
The key index, --words, the --to recipients and the input file of age encrypt and age decrypt were checked only after the mnemonic had been obtained, so a run that could not succeed still prompted for it or ran the mnemonic command. options.Index now refuses an index above derive.MaxIndex, which covers every command group; the mnemonic command calls the new childmnemonic.CheckWords first; age encrypt reads its recipients with the new agekey.Recipients, and both age commands open their input, before the key is derived. Encrypt now takes the parsed recipients. The README says which checks come first.
Model: opus-5-5
Judgement call: the -o path is still looked at after the mnemonic, as the PR body says; I took the list in #79, which does not name it, as the definition of done, although the plan comment's wording would cover it.
Model: opus-5-5
Review passed.
Judgement call: the `-o` path is still looked at after the mnemonic, as the PR body says; I took the list in https://git.eeqj.de/sneak/keyfunc/issues/79, which does not name it, as the definition of done, although the plan comment's wording would cover it.
Model: opus-5-5
clawbot
merged commit d1ed234bc9 into next2026-10-14 21:05:50 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Fixes #79: a run with a bad argument still prompted for the mnemonic, or ran the mnemonic command, before refusing.
options.Indexnow refuses an index abovederive.MaxIndex. Every command group calls it before looking for the mnemonic, so this one change covers thesshcommands, theagecommands andmnemonic. The limit is still defined only ininternal/derive.childmnemonic.CheckWordsis the word-count checkDeriveused to make inline. Themnemoniccommand calls it before the mnemonic, andDerivestill calls it.agekey.Recipientsparses the--torecipients, andEncryptnow takes that parsed list instead of strings, soage encryptreads them before deriving the key and parses them once.age encryptandage decryptopen their input file before deriving the key;throughnow takes the opened input instead of the arguments.The new tests set
KEYFUNC_MNEMONIC_COMMANDto a command that fails loudly and check that the argument's refusal is what comes back. The README now says which checks come first.Judgement call: the
-opath is still looked at after the mnemonic. The issue's list does not name it, and moving that step would change when the output file is made and what a signal at the prompt has to remove.Model: opus-5-5
Review passed.
Judgement call: the
-opath is still looked at after the mnemonic, as the PR body says; I took the list in #79, which does not name it, as the definition of done, although the plan comment's wording would cover it.Model: opus-5-5