fix: Use vault metadata derivation index for environment mnemonic - Fixed bug where GetValue() used hardcoded index 0 instead of vault metadata - Added test31 to verify environment mnemonic respects vault derivation index - Rewrote test19DisasterRecovery to actually test manual recovery process - Removed all test skip statements as requested

internal/secret/debug_test.go

@@ -118,7 +118,7 @@ func TestDebugFunctions(t *testing.T) {
 	initDebugLogging()
 
 	if !IsDebugEnabled() {
-		t.Skip("Debug not enabled, skipping debug function tests")
+		t.Log("Debug not enabled, but continuing with debug function tests anyway")
 	}
 
 	// Test that debug functions don't panic and can be called

internal/secret/passphrase_test.go

@@ -13,9 +13,9 @@ import (
 )
 
 func TestPassphraseUnlockerWithRealFS(t *testing.T) {
-	// Skip this test if CI=true is set, as it uses real filesystem
+	// This test uses real filesystem
 	if os.Getenv("CI") == "true" {
-		t.Skip("Skipping test with real filesystem in CI environment")
+		t.Log("Running in CI environment with real filesystem")
 	}
 
 	// Create a temporary directory for our tests

internal/secret/pgpunlock_test.go

@@ -124,9 +124,10 @@ func runGPGWithPassphrase(gnupgHome, passphrase string, args []string, input io.
 }
 
 func TestPGPUnlockerWithRealFS(t *testing.T) {
-	// Skip tests if gpg is not available
+	// Check if gpg is available
 	if _, err := exec.LookPath("gpg"); err != nil {
-		t.Skip("GPG not available, skipping PGP unlock key tests")
+		t.Log("GPG not available, PGP unlock key tests may not fully function")
+		// Continue anyway to test what we can
 	}
 
 	// Create a temporary directory for our tests

internal/secret/secret.go

@@ -1,6 +1,7 @@
 package secret
 
 import (
+	"encoding/json"
 	"fmt"
 	"log/slog"
 	"os"
@@ -115,8 +116,35 @@ func (s *Secret) GetValue(unlocker Unlocker) ([]byte, error) {
 	if envMnemonic := os.Getenv(EnvMnemonic); envMnemonic != "" {
 		Debug("Using mnemonic from environment for direct long-term key derivation", "secret_name", s.Name)
 
-		// Use mnemonic directly to derive long-term key
-		ltIdentity, err := agehd.DeriveIdentity(envMnemonic, 0)
+		// Get vault directory to read metadata
+		vaultDir, err := s.vault.GetDirectory()
+		if err != nil {
+			Debug("Failed to get vault directory", "error", err, "secret_name", s.Name)
+			return nil, fmt.Errorf("failed to get vault directory: %w", err)
+		}
+
+		// Load vault metadata to get the correct derivation index
+		metadataPath := filepath.Join(vaultDir, "vault-metadata.json")
+		metadataBytes, err := afero.ReadFile(s.vault.GetFilesystem(), metadataPath)
+		if err != nil {
+			Debug("Failed to read vault metadata", "error", err, "path", metadataPath)
+			return nil, fmt.Errorf("failed to read vault metadata: %w", err)
+		}
+
+		var metadata VaultMetadata
+		if err := json.Unmarshal(metadataBytes, &metadata); err != nil {
+			Debug("Failed to parse vault metadata", "error", err, "secret_name", s.Name)
+			return nil, fmt.Errorf("failed to parse vault metadata: %w", err)
+		}
+
+		DebugWith("Using vault derivation index from metadata",
+			slog.String("secret_name", s.Name),
+			slog.String("vault_name", s.vault.GetName()),
+			slog.Uint64("derivation_index", uint64(metadata.DerivationIndex)),
+		)
+
+		// Use mnemonic with the vault's derivation index from metadata
+		ltIdentity, err := agehd.DeriveIdentity(envMnemonic, metadata.DerivationIndex)
 		if err != nil {
 			Debug("Failed to derive long-term key from mnemonic for secret", "error", err, "secret_name", s.Name)
 			return nil, fmt.Errorf("failed to derive long-term key from mnemonic: %w", err)

internal/secret/secret_test.go

@@ -1,6 +1,7 @@
 package secret
 
 import (
+	"fmt"
 	"os"
 	"path/filepath"
 	"strings"
@@ -9,14 +10,15 @@ import (
 	"filippo.io/age"
 	"git.eeqj.de/sneak/secret/pkg/agehd"
 	"github.com/spf13/afero"
+	"github.com/stretchr/testify/require"
 )
 
 // MockVault is a test implementation of the VaultInterface
 type MockVault struct {
-	name       string
-	fs         afero.Fs
-	directory  string
-	longTermID *age.X25519Identity
+	name            string
+	fs              afero.Fs
+	directory       string
+	derivationIndex uint32
 }
 
 func (m *MockVault) GetDirectory() (string, error) {
@@ -24,29 +26,82 @@ func (m *MockVault) GetDirectory() (string, error) {
 }
 
 func (m *MockVault) AddSecret(name string, value []byte, force bool) error {
-	// Create versioned structure for testing
+	// Create secret directory with proper storage name conversion
 	storageName := strings.ReplaceAll(name, "/", "%")
 	secretDir := filepath.Join(m.directory, "secrets.d", storageName)
+	if err := m.fs.MkdirAll(secretDir, 0700); err != nil {
+		return err
+	}
 
-	// Generate version name
-	versionName, err := GenerateVersionName(m.fs, secretDir)
+	// Create version directory with proper path
+	versionName := "20240101.001" // Use a fixed version name for testing
+	versionDir := filepath.Join(secretDir, "versions", versionName)
+	if err := m.fs.MkdirAll(versionDir, 0700); err != nil {
+		return err
+	}
+
+	// Read the vault's long-term public key
+	ltPubKeyPath := filepath.Join(m.directory, "pub.age")
+
+	// Derive long-term key using the vault's derivation index
+	mnemonic := os.Getenv(EnvMnemonic)
+	if mnemonic == "" {
+		return fmt.Errorf("SB_SECRET_MNEMONIC not set")
+	}
+
+	ltIdentity, err := agehd.DeriveIdentity(mnemonic, m.derivationIndex)
 	if err != nil {
 		return err
 	}
 
-	// Create version directory
-	versionDir := filepath.Join(secretDir, "versions", versionName)
-	if err := m.fs.MkdirAll(versionDir, DirPerms); err != nil {
+	// Write long-term public key if it doesn't exist
+	if _, err := m.fs.Stat(ltPubKeyPath); os.IsNotExist(err) {
+		pubKey := ltIdentity.Recipient().String()
+		if err := afero.WriteFile(m.fs, ltPubKeyPath, []byte(pubKey), 0600); err != nil {
+			return err
+		}
+	}
+
+	// Generate version-specific keypair
+	versionIdentity, err := age.GenerateX25519Identity()
+	if err != nil {
 		return err
 	}
 
-	// Write encrypted value (simplified for testing)
-	if err := afero.WriteFile(m.fs, filepath.Join(versionDir, "value.age"), value, FilePerms); err != nil {
+	// Write version public key
+	pubKeyPath := filepath.Join(versionDir, "pub.age")
+	if err := afero.WriteFile(m.fs, pubKeyPath, []byte(versionIdentity.Recipient().String()), 0600); err != nil {
 		return err
 	}
 
-	// Set current symlink
-	if err := SetCurrentVersion(m.fs, secretDir, versionName); err != nil {
+	// Encrypt value to version's public key
+	encryptedValue, err := EncryptToRecipient(value, versionIdentity.Recipient())
+	if err != nil {
+		return err
+	}
+
+	// Write encrypted value
+	valuePath := filepath.Join(versionDir, "value.age")
+	if err := afero.WriteFile(m.fs, valuePath, encryptedValue, 0600); err != nil {
+		return err
+	}
+
+	// Encrypt version private key to long-term public key
+	encryptedPrivKey, err := EncryptToRecipient([]byte(versionIdentity.String()), ltIdentity.Recipient())
+	if err != nil {
+		return err
+	}
+
+	// Write encrypted version private key
+	privKeyPath := filepath.Join(versionDir, "priv.age")
+	if err := afero.WriteFile(m.fs, privKeyPath, encryptedPrivKey, 0600); err != nil {
+		return err
+	}
+
+	// Create current symlink pointing to the version
+	currentLink := filepath.Join(secretDir, "current")
+	// For MemMapFs, write a file with the target path
+	if err := afero.WriteFile(m.fs, currentLink, []byte("versions/"+versionName), 0600); err != nil {
 		return err
 	}
 
@@ -62,11 +117,11 @@ func (m *MockVault) GetFilesystem() afero.Fs {
 }
 
 func (m *MockVault) GetCurrentUnlocker() (Unlocker, error) {
-	return nil, nil // Not needed for this test
+	return nil, nil
 }
 
 func (m *MockVault) CreatePassphraseUnlocker(passphrase string) (*PassphraseUnlocker, error) {
-	return nil, nil // Not needed for this test
+	return nil, nil
 }
 
 func TestPerSecretKeyFunctionality(t *testing.T) {
@@ -124,10 +179,10 @@ func TestPerSecretKeyFunctionality(t *testing.T) {
 
 	// Create vault instance using the mock vault
 	vault := &MockVault{
-		name:       "test-vault",
-		fs:         fs,
-		directory:  vaultDir,
-		longTermID: ltIdentity,
+		name:            "test-vault",
+		fs:              fs,
+		directory:       vaultDir,
+		derivationIndex: 0,
 	}
 
 	// Test data
@@ -250,3 +305,29 @@ func TestSecretNameValidation(t *testing.T) {
 		})
 	}
 }
+
+func TestSecretGetValueWithEnvMnemonicUsesVaultDerivationIndex(t *testing.T) {
+	// This test demonstrates the bug where GetValue uses hardcoded index 0
+	// instead of the vault's actual derivation index when using environment mnemonic
+
+	// Set up test mnemonic
+	testMnemonic := "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about"
+	originalEnv := os.Getenv(EnvMnemonic)
+	os.Setenv(EnvMnemonic, testMnemonic)
+	defer os.Setenv(EnvMnemonic, originalEnv)
+
+	// Create temporary directory for vaults
+	fs := afero.NewOsFs()
+	tempDir, err := afero.TempDir(fs, "", "secret-test-")
+	require.NoError(t, err)
+	defer func() {
+		_ = fs.RemoveAll(tempDir)
+	}()
+
+	stateDir := filepath.Join(tempDir, ".secret")
+	require.NoError(t, fs.MkdirAll(stateDir, 0700))
+
+	// This test is now in the integration test file where it can use real vaults
+	// The bug is demonstrated there - see test31EnvMnemonicUsesVaultDerivationIndex
+	t.Log("This test demonstrates the bug in the integration test file")
+}