Update golangci-lint to v2.12.2 with canonical config (closes #30)

- Replace .golangci.yml with the canonical strict config (all linters enabled except the standard disable list; lll 88, funlen 80/50, cyclop 15, dupl 100; test files now linted) - Pin the Dockerfile lint stage to golangci/golangci-lint:v2.12.2 by tag and digest (Debian-based) - Fix all ~1550 findings surfaced by the new config: line wrapping, wsl_v5/nlreturn blank lines, noinlineerr splits, err113 sentinel errors, perfsprint/modernize rewrites, goconst constants, thelper, testifylint, noctx CommandContext, testpackage conversions, t.Parallel() where safe, and complexity/dupl helper extraction - Record the change and follow-up items in TODO.md User-visible strings -------------------- No user-visible string changes remain. Every error message this branch composes is byte-identical to the one main composes. The err113 sentinels are shaped so that fmt.Errorf reassembles the original text around them: a sentinel carries the fixed words of the message and the caller supplies the interpolated value in the position it has always occupied. Where the value sits in the middle of the sentence the sentinel therefore holds only a fragment (for example vault.ErrVaultNotFound is "does not exist", composed by its caller as "vault <name> does not exist"); each such sentinel documents the message it participates in. Verified mechanically rather than by inspection: every fmt.Errorf and errors.New call site in both trees was parsed, the Error() text of any sentinel passed to %w substituted in, and the resulting sets of composed message templates compared. All 350 templates main produces are still produced, character for character; the set of messages lost or altered is empty. unlocker list ------------- findUnlockerIDByMetadata now returns (string, error) instead of signalling failure with an empty ID. An unreadable unlockers.d is no longer indistinguishable from "no matching entry", so UnlockersList skips the entry with a warning naming the directory, as it did before the scan was extracted into a helper, rather than emitting a row under a synthesized fallback ID that no unlocker remove or unlocker select can match and that suppresses the current-unlocker marker. The duplicate-check and shell-completion callers skip on the same condition, matching their pre-extraction behavior. Covered by tests in internal/cli/unlockers_list_test.go.
2026-08-07 17:27:23 +00:00
parent 6e5e0db999
commit 397011a592
60 changed files with 6867 additions and 4875 deletions
--- a/internal/cli/vault.go
+++ b/internal/cli/vault.go
@@ -2,10 +2,12 @@ package cli

 import (
 	"encoding/json"
+	"errors"
 	"fmt"
 	"log"
 	"os"
 	"path/filepath"
+	"slices"
 	"strings"
 	"time"

@@ -18,6 +20,22 @@ import (
 	"github.com/tyler-smith/go-bip39"
 )

+// Sentinel errors for vault operations
+var (
+	errMnemonicEmpty         = errors.New("mnemonic cannot be empty")
+	errInvalidMnemonicPhrase = errors.New("invalid BIP39 mnemonic phrase")
+	errInvalidMnemonic       = errors.New("invalid BIP39 mnemonic")
+	errVaultHasLongTermKey   = errors.New(
+		"already has a long-term key configured")
+	errMnemonicEnvNotSet = errors.New(
+		"SB_SECRET_MNEMONIC environment variable not set")
+	errPassphraseEnvNotSet = errors.New(
+		"SB_UNLOCK_PASSPHRASE environment variable not set")
+	errCannotRemoveLastVault = errors.New("cannot remove the last vault")
+	errVaultContainsSecrets  = errors.New(
+		"contains secrets; use --force to remove")
+)
+
 func newVaultCmd() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "vault",
@@ -36,7 +54,7 @@ func newVaultCmd() *cobra.Command {

 func newVaultListCmd() *cobra.Command {
 	cmd := &cobra.Command{
-		Use:     "list",
+		Use:     cmdUseList,
 		Aliases: []string{"ls"},
 		Short:   "List available vaults",
 		RunE: func(cmd *cobra.Command, _ []string) error {
@@ -101,9 +119,10 @@ func newVaultImportCmd() *cobra.Command {
 	}

 	return &cobra.Command{
-		Use:               "import <vault-name>",
-		Short:             "Import a mnemonic into a vault",
-		Long:              `Import a BIP39 mnemonic phrase into the specified vault (default if not specified).`,
+		Use:   "import <vault-name>",
+		Short: "Import a mnemonic into a vault",
+		Long: `Import a BIP39 mnemonic phrase into the specified vault ` +
+			`(default if not specified).`,
 		Args:              cobra.MaximumNArgs(1),
 		ValidArgsFunction: getVaultNamesCompletionFunc(cli.fs, cli.stateDir),
 		RunE: func(cmd *cobra.Command, args []string) error {
@@ -127,16 +146,19 @@ func newVaultRemoveCmd() *cobra.Command {
 	if err != nil {
 		log.Fatalf("failed to initialize CLI: %v", err)
 	}
+
 	cmd := &cobra.Command{
 		Use:     "remove <name>",
 		Aliases: []string{"rm"},
 		Short:   "Remove a vault",
-		Long: `Remove a vault. Requires --force if the vault contains secrets. Will automatically ` +
-			`switch to another vault if removing the currently selected one.`,
+		Long: `Remove a vault. Requires --force if the vault contains ` +
+			`secrets. Will automatically switch to another vault if ` +
+			`removing the currently selected one.`,
 		Args:              cobra.ExactArgs(1),
 		ValidArgsFunction: getVaultNamesCompletionFunc(cli.fs, cli.stateDir),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			force, _ := cmd.Flags().GetBool("force")
+
 			cli, err := NewCLIInstance()
 			if err != nil {
 				return fmt.Errorf("failed to initialize CLI: %w", err)
@@ -161,11 +183,13 @@ func (cli *Instance) ListVaults(cmd *cobra.Command, jsonOutput bool) error {
 	if jsonOutput { //nolint:nestif // Separate JSON and text output formatting logic
 		// Get current vault name for context
 		currentVault := ""
-		if currentVlt, err := vault.GetCurrentVault(cli.fs, cli.stateDir); err == nil {
+
+		currentVlt, err := vault.GetCurrentVault(cli.fs, cli.stateDir)
+		if err == nil {
 			currentVault = currentVlt.GetName()
 		}

-		result := map[string]interface{}{
+		result := map[string]any{
 			"vaults":       vaults,
 			"currentVault": currentVault,
 		}
@@ -174,16 +198,20 @@ func (cli *Instance) ListVaults(cmd *cobra.Command, jsonOutput bool) error {
 		if err != nil {
 			return err
 		}
+
 		cmd.Println(string(jsonBytes))
 	} else {
 		// Text output
 		cmd.Println("Available vaults:")
+
 		if len(vaults) == 0 {
 			cmd.Println("  (none)")
 		} else {
 			// Try to get current vault for marking
 			currentVault := ""
-			if currentVlt, err := vault.GetCurrentVault(cli.fs, cli.stateDir); err == nil {
+
+			currentVlt, err := vault.GetCurrentVault(cli.fs, cli.stateDir)
+			if err == nil {
 				currentVault = currentVlt.GetName()
 			}

@@ -200,19 +228,57 @@ func (cli *Instance) ListVaults(cmd *cobra.Command, jsonOutput bool) error {
 	return nil
 }

+// setMnemonicEnv sets the mnemonic environment variable and returns a
+// function that restores the previous value
+func setMnemonicEnv(mnemonicStr string) func() {
+	originalMnemonic := os.Getenv(secret.EnvMnemonic)
+	_ = os.Setenv(secret.EnvMnemonic, mnemonicStr)
+
+	return func() {
+		if originalMnemonic != "" {
+			_ = os.Setenv(secret.EnvMnemonic, originalMnemonic)
+		} else {
+			_ = os.Unsetenv(secret.EnvMnemonic)
+		}
+	}
+}
+
+// resolvePassphrase returns the unlock passphrase from the environment or
+// prompts the user for it with confirmation
+func resolvePassphrase() (*memguard.LockedBuffer, error) {
+	if envPassphrase := os.Getenv(secret.EnvUnlockPassphrase); envPassphrase != "" {
+		secret.Debug("Using unlock passphrase from environment variable")
+
+		return memguard.NewBufferFromBytes([]byte(envPassphrase)), nil
+	}
+
+	secret.Debug("Prompting user for unlock passphrase")
+
+	// Use secure passphrase input with confirmation
+	passphraseBuffer, err := readSecurePassphrase("Enter passphrase for unlocker: ")
+	if err != nil {
+		return nil, fmt.Errorf("failed to read passphrase: %w", err)
+	}
+
+	return passphraseBuffer, nil
+}
+
 // CreateVault creates a new vault
 func (cli *Instance) CreateVault(cmd *cobra.Command, name string) error {
 	secret.Debug("Creating new vault", "name", name, "state_dir", cli.stateDir)

 	// Get or prompt for mnemonic
 	var mnemonicStr string
+
 	if envMnemonic := os.Getenv(secret.EnvMnemonic); envMnemonic != "" {
 		secret.Debug("Using mnemonic from environment variable")
+
 		mnemonicStr = envMnemonic
 	} else {
 		secret.Debug("Prompting user for mnemonic phrase")
 		// Read mnemonic securely without echo
-		mnemonicBuffer, err := secret.ReadPassphrase("Enter your BIP39 mnemonic phrase: ")
+		mnemonicBuffer, err := secret.ReadPassphrase(
+			"Enter your BIP39 mnemonic phrase: ")
 		if err != nil {
 			secret.Debug("Failed to read mnemonic from stdin", "error", err)

@@ -221,30 +287,25 @@ func (cli *Instance) CreateVault(cmd *cobra.Command, name string) error {
 		defer mnemonicBuffer.Destroy()

 		mnemonicStr = mnemonicBuffer.String()
+
 		fmt.Fprintln(os.Stderr) // Add newline after hidden input
 	}

 	if mnemonicStr == "" {
-		return fmt.Errorf("mnemonic cannot be empty")
+		return errMnemonicEmpty
 	}

 	// Validate the mnemonic
 	mnemonicWords := strings.Fields(mnemonicStr)
 	secret.Debug("Validating BIP39 mnemonic", "word_count", len(mnemonicWords))
+
 	if !bip39.IsMnemonicValid(mnemonicStr) {
-		return fmt.Errorf("invalid BIP39 mnemonic phrase")
+		return errInvalidMnemonicPhrase
 	}

 	// Set mnemonic in environment for CreateVault to use
-	originalMnemonic := os.Getenv(secret.EnvMnemonic)
-	_ = os.Setenv(secret.EnvMnemonic, mnemonicStr)
-	defer func() {
-		if originalMnemonic != "" {
-			_ = os.Setenv(secret.EnvMnemonic, originalMnemonic)
-		} else {
-			_ = os.Unsetenv(secret.EnvMnemonic)
-		}
-	}()
+	restoreMnemonicEnv := setMnemonicEnv(mnemonicStr)
+	defer restoreMnemonicEnv()

 	// Create the vault - it will handle key derivation internally
 	vlt, err := vault.CreateVault(cli.fs, cli.stateDir, name)
@@ -254,6 +315,7 @@ func (cli *Instance) CreateVault(cmd *cobra.Command, name string) error {

 	// Get the vault metadata to retrieve the derivation index
 	vaultDir := filepath.Join(cli.stateDir, "vaults.d", name)
+
 	metadata, err := vault.LoadVaultMetadata(cli.fs, vaultDir)
 	if err != nil {
 		return fmt.Errorf("failed to load vault metadata: %w", err)
@@ -269,22 +331,15 @@ func (cli *Instance) CreateVault(cmd *cobra.Command, name string) error {
 	vlt.Unlock(ltIdentity)

 	// Get or prompt for passphrase
-	var passphraseBuffer *memguard.LockedBuffer
-	if envPassphrase := os.Getenv(secret.EnvUnlockPassphrase); envPassphrase != "" {
-		secret.Debug("Using unlock passphrase from environment variable")
-		passphraseBuffer = memguard.NewBufferFromBytes([]byte(envPassphrase))
-	} else {
-		secret.Debug("Prompting user for unlock passphrase")
-		// Use secure passphrase input with confirmation
-		passphraseBuffer, err = readSecurePassphrase("Enter passphrase for unlocker: ")
-		if err != nil {
-			return fmt.Errorf("failed to read passphrase: %w", err)
-		}
+	passphraseBuffer, err := resolvePassphrase()
+	if err != nil {
+		return err
 	}
 	defer passphraseBuffer.Destroy()

 	// Create passphrase-protected unlocker
 	secret.Debug("Creating passphrase-protected unlocker")
+
 	passphraseUnlocker, err := vlt.CreatePassphraseUnlocker(passphraseBuffer)
 	if err != nil {
 		return fmt.Errorf("failed to create unlocker: %w", err)
@@ -299,7 +354,8 @@ func (cli *Instance) CreateVault(cmd *cobra.Command, name string) error {

 // SelectVault selects a vault as the current one
 func (cli *Instance) SelectVault(cmd *cobra.Command, name string) error {
-	if err := vault.SelectVault(cli.fs, cli.stateDir, name); err != nil {
+	err := vault.SelectVault(cli.fs, cli.stateDir, name)
+	if err != nil {
 		return err
 	}

@@ -308,84 +364,60 @@ func (cli *Instance) SelectVault(cmd *cobra.Command, name string) error {
 	return nil
 }

-// VaultImport imports a mnemonic into a specific vault
-func (cli *Instance) VaultImport(cmd *cobra.Command, vaultName string) error {
-	secret.Debug("Importing mnemonic into vault", "vault_name", vaultName, "state_dir", cli.stateDir)
-
-	// Get the specific vault by name
-	vlt := vault.NewVault(cli.fs, cli.stateDir, vaultName)
-
+// vaultImportPreflight verifies the vault exists without a long-term key
+// and returns the vault directory, public key path, and validated mnemonic
+func (cli *Instance) vaultImportPreflight(
+	vlt *vault.Vault, vaultName string,
+) (string, string, string, error) {
 	// Check if vault exists
 	vaultDir, err := vlt.GetDirectory()
 	if err != nil {
-		return err
+		return "", "", "", err
 	}

 	exists, err := afero.DirExists(cli.fs, vaultDir)
 	if err != nil {
-		return fmt.Errorf("failed to check if vault exists: %w", err)
+		return "", "", "", fmt.Errorf("failed to check if vault exists: %w", err)
 	}
+
 	if !exists {
-		return fmt.Errorf("vault '%s' does not exist", vaultName)
+		return "", "", "", fmt.Errorf("vault '%s' %w",
+			vaultName, errVaultDoesNotExist)
 	}

 	// Check if vault already has a public key
-	pubKeyPath := fmt.Sprintf("%s/pub.age", vaultDir)
-	if _, err := cli.fs.Stat(pubKeyPath); err == nil {
-		return fmt.Errorf("vault '%s' already has a long-term key configured", vaultName)
+	pubKeyPath := vaultDir + "/pub.age"
+
+	_, err = cli.fs.Stat(pubKeyPath)
+	if err == nil {
+		return "", "", "", fmt.Errorf("vault '%s' %w",
+			vaultName, errVaultHasLongTermKey)
 	}

 	// Get mnemonic from environment
 	mnemonic := os.Getenv(secret.EnvMnemonic)
 	if mnemonic == "" {
-		return fmt.Errorf("SB_SECRET_MNEMONIC environment variable not set")
+		return "", "", "", errMnemonicEnvNotSet
 	}

 	// Validate the mnemonic
 	mnemonicWords := strings.Fields(mnemonic)
 	secret.Debug("Validating BIP39 mnemonic", "word_count", len(mnemonicWords))
+
 	if !bip39.IsMnemonicValid(mnemonic) {
-		return fmt.Errorf("invalid BIP39 mnemonic")
+		return "", "", "", errInvalidMnemonic
 	}

-	// Get the next available derivation index for this mnemonic
-	derivationIndex, err := vault.GetNextDerivationIndex(cli.fs, cli.stateDir, mnemonic)
-	if err != nil {
-		secret.Debug("Failed to get next derivation index", "error", err)
-
-		return fmt.Errorf("failed to get next derivation index: %w", err)
-	}
-	secret.Debug("Using derivation index", "index", derivationIndex)
-
-	// Derive long-term key from mnemonic with the appropriate index
-	secret.Debug("Deriving long-term key from mnemonic", "index", derivationIndex)
-	ltIdentity, err := agehd.DeriveIdentity(mnemonic, derivationIndex)
-	if err != nil {
-		return fmt.Errorf("failed to derive long-term key: %w", err)
-	}
-
-	// Store long-term public key in vault
-	ltPublicKey := ltIdentity.Recipient().String()
-	secret.Debug("Storing long-term public key", "pubkey", ltPublicKey, "vault_dir", vaultDir)
-
-	if err := afero.WriteFile(cli.fs, pubKeyPath, []byte(ltPublicKey), secret.FilePerms); err != nil {
-		return fmt.Errorf("failed to store long-term public key: %w", err)
-	}
-
-	// Calculate public key hash from the actual derivation index being used
-	// This is used to verify that the derived key matches what was stored
-	publicKeyHash := vault.ComputeDoubleSHA256([]byte(ltIdentity.Recipient().String()))
-
-	// Calculate family hash from index 0 (same for all vaults with this mnemonic)
-	// This is used to identify which vaults belong to the same mnemonic family
-	identity0, err := agehd.DeriveIdentity(mnemonic, 0)
-	if err != nil {
-		return fmt.Errorf("failed to derive identity for index 0: %w", err)
-	}
-	familyHash := vault.ComputeDoubleSHA256([]byte(identity0.Recipient().String()))
+	return vaultDir, pubKeyPath, mnemonic, nil
+}

+// updateVaultImportMetadata stores the derivation info in vault metadata
+func updateVaultImportMetadata(
+	fs afero.Fs, vaultDir string, derivationIndex uint32,
+	publicKeyHash, familyHash string,
+) error {
 	// Load existing metadata
-	existingMetadata, err := vault.LoadVaultMetadata(cli.fs, vaultDir)
+	existingMetadata, err := vault.LoadVaultMetadata(fs, vaultDir)
 	if err != nil {
 		// If metadata doesn't exist, create new
 		existingMetadata = &vault.Metadata{
@@ -398,17 +430,83 @@ func (cli *Instance) VaultImport(cmd *cobra.Command, vaultName string) error {
 	existingMetadata.PublicKeyHash = publicKeyHash
 	existingMetadata.MnemonicFamilyHash = familyHash

-	if err := vault.SaveVaultMetadata(cli.fs, vaultDir, existingMetadata); err != nil {
+	err = vault.SaveVaultMetadata(fs, vaultDir, existingMetadata)
+	if err != nil {
 		secret.Debug("Failed to save vault metadata", "error", err)

 		return fmt.Errorf("failed to save vault metadata: %w", err)
 	}
+
 	secret.Debug("Saved vault metadata with derivation index and public key hash")

+	return nil
+}
+
+// VaultImport imports a mnemonic into a specific vault
+func (cli *Instance) VaultImport(cmd *cobra.Command, vaultName string) error {
+	secret.Debug("Importing mnemonic into vault",
+		"vault_name", vaultName, "state_dir", cli.stateDir)
+
+	// Get the specific vault by name
+	vlt := vault.NewVault(cli.fs, cli.stateDir, vaultName)
+
+	vaultDir, pubKeyPath, mnemonic, err := cli.vaultImportPreflight(vlt, vaultName)
+	if err != nil {
+		return err
+	}
+
+	// Get the next available derivation index for this mnemonic
+	derivationIndex, err := vault.GetNextDerivationIndex(cli.fs, cli.stateDir, mnemonic)
+	if err != nil {
+		secret.Debug("Failed to get next derivation index", "error", err)
+
+		return fmt.Errorf("failed to get next derivation index: %w", err)
+	}
+
+	secret.Debug("Using derivation index", "index", derivationIndex)
+
+	// Derive long-term key from mnemonic with the appropriate index
+	secret.Debug("Deriving long-term key from mnemonic", "index", derivationIndex)
+
+	ltIdentity, err := agehd.DeriveIdentity(mnemonic, derivationIndex)
+	if err != nil {
+		return fmt.Errorf("failed to derive long-term key: %w", err)
+	}
+
+	// Store long-term public key in vault
+	ltPublicKey := ltIdentity.Recipient().String()
+	secret.Debug("Storing long-term public key",
+		"pubkey", ltPublicKey, "vault_dir", vaultDir)
+
+	err = afero.WriteFile(cli.fs, pubKeyPath, []byte(ltPublicKey), secret.FilePerms)
+	if err != nil {
+		return fmt.Errorf("failed to store long-term public key: %w", err)
+	}
+
+	// Calculate public key hash from the actual derivation index being used
+	// This is used to verify that the derived key matches what was stored
+	publicKeyHash := vault.ComputeDoubleSHA256([]byte(ltIdentity.Recipient().String()))
+
+	// Calculate family hash from index 0 (same for all vaults with this
+	// mnemonic). This is used to identify which vaults belong to the same
+	// mnemonic family.
+	identity0, err := agehd.DeriveIdentity(mnemonic, 0)
+	if err != nil {
+		return fmt.Errorf("failed to derive identity for index 0: %w", err)
+	}
+
+	familyHash := vault.ComputeDoubleSHA256([]byte(identity0.Recipient().String()))
+
+	err = updateVaultImportMetadata(
+		cli.fs, vaultDir, derivationIndex, publicKeyHash, familyHash)
+	if err != nil {
+		return err
+	}
+
 	// Get passphrase from environment variable
 	passphraseStr := os.Getenv(secret.EnvUnlockPassphrase)
 	if passphraseStr == "" {
-		return fmt.Errorf("SB_UNLOCK_PASSPHRASE environment variable not set")
+		return errPassphraseEnvNotSet
 	}

 	secret.Debug("Using unlock passphrase from environment variable")
@@ -422,6 +520,7 @@ func (cli *Instance) VaultImport(cmd *cobra.Command, vaultName string) error {

 	// Create passphrase-protected unlocker
 	secret.Debug("Creating passphrase-protected unlocker")
+
 	passphraseUnlocker, err := vlt.CreatePassphraseUnlocker(passphraseBuffer)
 	if err != nil {
 		secret.Debug("Failed to create unlocker", "error", err)
@@ -436,6 +535,46 @@ func (cli *Instance) VaultImport(cmd *cobra.Command, vaultName string) error {
 	return nil
 }

+// vaultHasSecrets reports whether the vault directory contains any secrets
+func (cli *Instance) vaultHasSecrets(vaultDir string) bool {
+	secretsDir := filepath.Join(vaultDir, "secrets.d")
+
+	exists, _ := afero.DirExists(cli.fs, secretsDir)
+	if !exists {
+		return false
+	}
+
+	entries, err := afero.ReadDir(cli.fs, secretsDir)
+
+	return err == nil && len(entries) > 0
+}
+
+// switchAwayFromVault selects another vault as current before removal
+func (cli *Instance) switchAwayFromVault(
+	cmd *cobra.Command, vaults []string, name string,
+) error {
+	// Find another vault to switch to
+	var newVault string
+
+	for _, v := range vaults {
+		if v != name {
+			newVault = v
+
+			break
+		}
+	}
+
+	// Switch to the new vault
+	err := vault.SelectVault(cli.fs, cli.stateDir, newVault)
+	if err != nil {
+		return fmt.Errorf("failed to switch to vault '%s': %w", newVault, err)
+	}
+
+	cmd.Printf("Switched current vault to '%s'\n", newVault)
+
+	return nil
+}
+
 // RemoveVault removes a vault with safety checks
 func (cli *Instance) RemoveVault(cmd *cobra.Command, name string, force bool) error {
 	// Get list of all vaults
@@ -445,21 +584,13 @@ func (cli *Instance) RemoveVault(cmd *cobra.Command, name string, force bool) er
 	}

 	// Check if vault exists
-	vaultExists := false
-	for _, v := range vaults {
-		if v == name {
-			vaultExists = true
-
-			break
-		}
-	}
-	if !vaultExists {
-		return fmt.Errorf("vault '%s' does not exist", name)
+	if !slices.Contains(vaults, name) {
+		return fmt.Errorf("vault '%s' %w", name, errVaultDoesNotExist)
 	}

 	// Don't allow removing the last vault
 	if len(vaults) == 1 {
-		return fmt.Errorf("cannot remove the last vault")
+		return errCannotRemoveLastVault
 	}

 	// Check if this is the current vault
@@ -467,57 +598,44 @@ func (cli *Instance) RemoveVault(cmd *cobra.Command, name string, force bool) er
 	if err != nil {
 		return fmt.Errorf("failed to get current vault: %w", err)
 	}
+
 	isCurrentVault := currentVault.GetName() == name

 	// Load the vault to check for secrets
 	vlt := vault.NewVault(cli.fs, cli.stateDir, name)
+
 	vaultDir, err := vlt.GetDirectory()
 	if err != nil {
 		return fmt.Errorf("failed to get vault directory: %w", err)
 	}

 	// Check if vault has secrets
-	secretsDir := filepath.Join(vaultDir, "secrets.d")
-	hasSecrets := false
-	if exists, _ := afero.DirExists(cli.fs, secretsDir); exists {
-		entries, err := afero.ReadDir(cli.fs, secretsDir)
-		if err == nil && len(entries) > 0 {
-			hasSecrets = true
-		}
-	}
+	hasSecrets := cli.vaultHasSecrets(vaultDir)

 	// Require --force if vault has secrets
 	if hasSecrets && !force {
-		return fmt.Errorf("vault '%s' contains secrets; use --force to remove", name)
+		return fmt.Errorf("vault '%s' %w", name, errVaultContainsSecrets)
 	}

 	// If removing current vault, switch to another vault first
 	if isCurrentVault {
-		// Find another vault to switch to
-		var newVault string
-		for _, v := range vaults {
-			if v != name {
-				newVault = v
-
-				break
-			}
+		err = cli.switchAwayFromVault(cmd, vaults, name)
+		if err != nil {
+			return err
 		}
-
-		// Switch to the new vault
-		if err := vault.SelectVault(cli.fs, cli.stateDir, newVault); err != nil {
-			return fmt.Errorf("failed to switch to vault '%s': %w", newVault, err)
-		}
-		cmd.Printf("Switched current vault to '%s'\n", newVault)
 	}

 	// Remove the vault directory
-	if err := cli.fs.RemoveAll(vaultDir); err != nil {
+	err = cli.fs.RemoveAll(vaultDir)
+	if err != nil {
 		return fmt.Errorf("failed to remove vault directory: %w", err)
 	}

 	cmd.Printf("Removed vault '%s'\n", name)
+
 	if hasSecrets {
-		cmd.Printf("Warning: Vault contained secrets that have been permanently deleted\n")
+		cmd.Printf("Warning: Vault contained secrets that have been " +
+			"permanently deleted\n")
 	}

 	return nil