Fix integration tests: correct vault derivation index and debug test failures

internal/vault/metadata.go

@@ -8,6 +8,7 @@ import (
 	"path/filepath"
 
 	"git.eeqj.de/sneak/secret/internal/secret"
+	"git.eeqj.de/sneak/secret/pkg/agehd"
 	"github.com/spf13/afero"
 )
 
@@ -24,8 +25,16 @@ func ComputeDoubleSHA256(data []byte) string {
 	return hex.EncodeToString(secondHash[:])
 }
 
-// GetNextDerivationIndex finds the next available derivation index for a given mnemonic hash
-func GetNextDerivationIndex(fs afero.Fs, stateDir string, mnemonicHash string) (uint32, error) {
+// GetNextDerivationIndex finds the next available derivation index for a given mnemonic
+// by deriving the public key for index 0 and using its hash to identify related vaults
+func GetNextDerivationIndex(fs afero.Fs, stateDir string, mnemonic string) (uint32, error) {
+	// First, derive the public key for index 0 to get our identifier
+	identity0, err := agehd.DeriveIdentity(mnemonic, 0)
+	if err != nil {
+		return 0, fmt.Errorf("failed to derive identity for index 0: %w", err)
+	}
+	pubKeyHash := ComputeDoubleSHA256([]byte(identity0.Recipient().String()))
+
 	vaultsDir := filepath.Join(stateDir, "vaults.d")
 
 	// Check if vaults directory exists
@@ -44,9 +53,8 @@ func GetNextDerivationIndex(fs afero.Fs, stateDir string, mnemonicHash string) (
 		return 0, fmt.Errorf("failed to read vaults directory: %w", err)
 	}
 
-	// Track the highest index for this mnemonic
-	var highestIndex uint32 = 0
-	foundMatch := false
+	// Track which indices are in use for this mnemonic
+	usedIndices := make(map[uint32]bool)
 
 	for _, entry := range entries {
 		if !entry.IsDir() {
@@ -67,22 +75,19 @@ func GetNextDerivationIndex(fs afero.Fs, stateDir string, mnemonicHash string) (
 			continue
 		}
 
-		// Check if this vault uses the same mnemonic
-		if metadata.MnemonicHash == mnemonicHash {
-			foundMatch = true
-			if metadata.DerivationIndex >= highestIndex {
-				highestIndex = metadata.DerivationIndex
-			}
+		// Check if this vault uses the same mnemonic by comparing public key hashes
+		if metadata.PublicKeyHash == pubKeyHash {
+			usedIndices[metadata.DerivationIndex] = true
 		}
 	}
 
-	// If we found a match, use the next index
-	if foundMatch {
-		return highestIndex + 1, nil
+	// Find the first available index
+	var index uint32 = 0
+	for usedIndices[index] {
+		index++
 	}
 
-	// No existing vault with this mnemonic, start at 0
-	return 0, nil
+	return index, nil
 }
 
 // SaveVaultMetadata saves vault metadata to the vault directory