Name only the mnemonic when it cannot be read (closes #115)

secret init and secret vault create read the mnemonic with the new
secret.ReadMnemonic, whose every error wraps the new
secret.ErrMnemonicNotRead. It shares the terminal read with ReadPassphrase,
whose errors still wrap ErrPassphraseNotRead. Without a terminal the error
names the environment variable that gives the value instead:
SB_SECRET_MNEMONIC for the mnemonic, SB_UNLOCK_PASSPHRASE for the
passphrase. A test pins the message of init without a terminal.

Model: opus-5-5

internal/cli/create_vault_test.go

@@ -5,6 +5,7 @@ import (
 	"io"
 	"maps"
 	"os"
+	"os/exec"
 	"slices"
 	"strings"
 	"testing"
@@ -194,6 +195,37 @@ func TestStopAtPassphrasePromptLeavesNothing(t *testing.T) {
 	}
 }
 
+// TestMnemonicNotReadNamesOnlyMnemonic is a regression test for
+// https://git.eeqj.de/sneak/secret/issues/115: `secret init` without
+// SB_SECRET_MNEMONIC and with a stdin that is not a terminal said "failed to
+// read mnemonic: failed to read passphrase: ...". The error must wrap
+// secret.ErrMnemonicNotRead and name the mnemonic only. The message is
+// pinned on the built binary, whose stdin is surely not a terminal.
+func TestMnemonicNotReadNamesOnlyMnemonic(t *testing.T) {
+	t.Parallel()
+
+	c := cli.NewCLIInstanceWithStateDir(afero.NewMemMapFs(), testStateDir)
+	require.ErrorIs(t, c.Init(discardCmd()), secret.ErrMnemonicNotRead)
+
+	stateDir := t.TempDir()
+
+	//nolint:gosec // G204: test executes the freshly built secret binary
+	cmd := exec.CommandContext(t.Context(), secretBinaryPath(t), "init")
+	cmd.Env = []string{
+		secret.EnvStateDir + "=" + stateDir,
+		"PATH=" + os.Getenv("PATH"),
+		"HOME=" + os.Getenv("HOME"),
+	}
+
+	output, err := cmd.CombinedOutput()
+	require.Error(t, err)
+
+	require.Equal(t, "Initialized secrets manager at: "+stateDir+"\n"+
+		"Error: failed to read mnemonic: stdin is not a terminal (piped input "+
+		"or script). Please set the SB_SECRET_MNEMONIC environment variable "+
+		"or run interactively\n", string(output))
+}
+
 // TestStopDuringCreateLeavesWholeVaultOrNone is a regression test for
 // https://git.eeqj.de/sneak/secret/issues/105: `secret init` or `secret vault
 // create` killed after the passphrase prompt but before the unlocker was

internal/cli/init.go

@@ -55,11 +55,11 @@ func (cli *Instance) promptMnemonic() (*memguard.LockedBuffer, func(), error) {
 	secret.Debug("Prompting user for mnemonic phrase")
 
 	// Read mnemonic securely without echo
-	mnemonicBuffer, err := secret.ReadPassphrase("Enter your BIP39 mnemonic phrase: ")
+	mnemonicBuffer, err := secret.ReadMnemonic("Enter your BIP39 mnemonic phrase: ")
 	if err != nil {
 		secret.Debug("Failed to read mnemonic from stdin", "error", err)
 
-		return nil, nil, fmt.Errorf("failed to read mnemonic: %w", err)
+		return nil, nil, err
 	}
 
 	fmt.Fprintln(os.Stderr) // Add newline after hidden input

internal/cli/unlock_failure_test.go

@@ -260,9 +260,9 @@ func TestPassphraseNotReadNamesNoMnemonic(t *testing.T) {
 
 	assert.Equal(t, "Error: failed to unlock vault: "+
 		"failed to get long-term key: failed to get unlocker identity: "+
-		"failed to read passphrase: cannot read passphrase from non-terminal "+
-		"stdin (piped input or script). Please set the SB_UNLOCK_PASSPHRASE "+
-		"environment variable or run interactively\n", string(output))
+		"failed to read passphrase: stdin is not a terminal (piped input or "+
+		"script). Please set the SB_UNLOCK_PASSPHRASE environment variable or "+
+		"run interactively\n", string(output))
 }
 
 // TestCryptoUnlockFailureNamesMnemonic checks that `secret encrypt` and