Create a vault whole in a temporary directory, then select it (closes #105)

vault.CreateVault takes the unlocker passphrase and writes the vault
directory, its metadata, long-term public key and passphrase unlocker
into a temporary directory, renames that into vaults.d once complete,
and only then makes the vault current. secret init and secret vault
create call it once instead of adding the unlocker afterwards, so a
kill part-way leaves either no vault, whose temporary directory the
next command that takes the lock deletes, or a complete one. A test
records the state directory before every change the call makes and
checks each state, and the command run again from it.

Model: opus-5-5

internal/cli/init.go

@@ -6,13 +6,10 @@ import (
 	"log"
 	"log/slog"
 	"os"
-	"path/filepath"
 	"strings"
 
-	"filippo.io/age"
 	"git.eeqj.de/sneak/secret/internal/secret"
 	"git.eeqj.de/sneak/secret/internal/vault"
-	"git.eeqj.de/sneak/secret/pkg/agehd"
 	"github.com/awnumar/memguard"
 	"github.com/spf13/cobra"
 	"github.com/tyler-smith/go-bip39"
@@ -70,43 +67,6 @@ func (cli *Instance) promptMnemonic() (*memguard.LockedBuffer, func(), error) {
 	return mnemonicBuffer, mnemonicBuffer.Destroy, nil
 }
 
-// setupDefaultVault creates the default vault and derives its long-term
-// identity from the mnemonic
-func (cli *Instance) setupDefaultVault(
-	stateDir string, mnemonic *memguard.LockedBuffer,
-) (*vault.Vault, *age.X25519Identity, error) {
-	// Create the default vault - it will handle key derivation internally
-	secret.Debug("Creating default vault")
-
-	vlt, err := vault.CreateVault(cli.fs, cli.stateDir, "default", mnemonic)
-	if err != nil {
-		secret.Debug("Failed to create default vault", "error", err)
-
-		return nil, nil, fmt.Errorf("failed to create default vault: %w", err)
-	}
-
-	// Get the vault metadata to retrieve the derivation index
-	vaultDir := filepath.Join(stateDir, "vaults.d", "default")
-
-	metadata, err := vault.LoadVaultMetadata(cli.fs, vaultDir)
-	if err != nil {
-		secret.Debug("Failed to load vault metadata", "error", err)
-
-		return nil, nil, fmt.Errorf("failed to load vault metadata: %w", err)
-	}
-
-	// Derive the long-term key using the same index that CreateVault used
-	ltIdentity, err := agehd.DeriveIdentity(mnemonic.String(), metadata.DerivationIndex)
-	if err != nil {
-		secret.Debug("Failed to derive long-term key", "error", err)
-
-		return nil, nil, fmt.Errorf(
-			"failed to derive long-term key from mnemonic: %w", err)
-	}
-
-	return vlt, ltIdentity, nil
-}
-
 // Init initializes the secret manager, holding the state directory lock
 // while initialize runs
 func (cli *Instance) Init(cmd *cobra.Command) error {
@@ -173,34 +133,31 @@ func (cli *Instance) initialize(cmd *cobra.Command) error {
 	}
 	defer cleanupPassphrase()
 
-	// Create the default vault and derive its long-term key
-	vlt, ltIdentity, err := cli.setupDefaultVault(stateDir, mnemonic)
+	// Create the default vault with its passphrase unlocker
+	secret.Debug("Creating default vault")
+
+	vlt, err := vault.CreateVault(cli.fs, cli.stateDir, "default",
+		mnemonic, passphraseBuffer)
+	if err != nil {
+		secret.Debug("Failed to create default vault", "error", err)
+
+		return fmt.Errorf("failed to create default vault: %w", err)
+	}
+
+	ltIdentity, err := vlt.GetOrDeriveLongTermKey()
+	if err != nil {
+		return fmt.Errorf("failed to get long-term key: %w", err)
+	}
+
+	unlocker, err := vlt.GetCurrentUnlocker()
 	if err != nil {
 		return err
 	}
 
-	ltPubKey := ltIdentity.Recipient().String()
-
-	// Unlock the vault with the derived long-term key
-	vlt.Unlock(ltIdentity)
-
-	// Create passphrase-protected unlocker
-	secret.Debug("Creating passphrase-protected unlocker")
-
-	passphraseUnlocker, err := vlt.CreatePassphraseUnlocker(passphraseBuffer)
-	if err != nil {
-		secret.Debug("Failed to create unlocker", "error", err)
-
-		return fmt.Errorf("failed to create unlocker: %w", err)
-	}
-
-	// Note: CreatePassphraseUnlocker already encrypts and writes the long-term
-	// private key to longterm.age, so no need to do it again here.
-
 	if cmd != nil {
 		cmd.Printf("\nDefault vault created and configured\n")
-		cmd.Printf("Long-term public key: %s\n", ltPubKey)
-		cmd.Printf("Unlocker ID: %s\n", passphraseUnlocker.GetID())
+		cmd.Printf("Long-term public key: %s\n", ltIdentity.Recipient().String())
+		cmd.Printf("Unlocker ID: %s\n", unlocker.GetID())
 		cmd.Println("\nYour secret manager is ready to use!")
 		cmd.Println("Note: When using SB_SECRET_MNEMONIC environment variable,")
 		cmd.Println("unlockers are not required for secret operations.")