Update golangci-lint to v2.12.2 with canonical config (#29)

Bumps golangci-lint from v2.1.6 (digest-only pin in the `Dockerfile` lint stage) to v2.12.2, pinned by tag and digest (Debian-based image). Replaces `.golangci.yml` with the canonical strict config: all linters enabled except the standard disable list (`exhaustruct`, `depguard`, `godot`, `wsl`, `wrapcheck`, `varnamelen`), `lll` at 88, `funlen` 80/50, `cyclop` 15, `dupl` 100, and test files are now linted (the old config had `tests: false`, an enable-only list of ~20 linters, `lll` 120, and a blanket exclusion of `internal/macse`). The stricter config surfaced ~1550 findings, all fixed: - `wsl_v5` (439) / `nlreturn` (24): blank-line insertions - `lll` (309): line wrapping at 88 columns; long literals split with `+` concatenation, values unchanged - `noinlineerr` (130): `if err := ...` split into assignment plus check - `paralleltest` (116): `t.Parallel()` added to tests without shared state; reasoned `//nolint` where `t.Setenv` or shared fixtures forbid it - `err113` (97): package-level sentinel errors (new `internal/vault/errors.go`), `%w` wrapping, `errors.Is` - `perfsprint` (74) / `modernize` (39) / `intrange`: `strconv`, `errors.New`, `slices.Contains`, `any`, `SplitSeq` - `goconst` (40) / `dupword` (41) / `testifylint` (42) / `thelper` (33): constants, assertion fixes, `t.Helper()` - `noctx` (22): `exec.CommandContext` for gpg/CLI invocations - `testpackage` (18): black-box tests moved to `_test` packages where they use only exported identifiers; white-box files carry a reasoned `//nolint` - `funlen`/`cyclop`/`gocognit`/`nestif`/`dupl`: behavior-preserving helper extraction - assorted singletons: `gosec`, `gosmopolitan`, `funcorder`, `nonamedreturns`, `makezero`, `prealloc`, `godox`, `nolintlint`, `ireturn`, `nilnil`, `gochecknoinits` ## User-visible strings **None changed.** Every error message this branch composes is byte-identical to the one `main` composes. The `err113` sentinels are shaped so `fmt.Errorf` reassembles the original text around them: the sentinel carries the fixed words and the caller supplies the interpolated value in the position it has always occupied. Where the value sits mid-sentence the sentinel holds only a fragment (e.g. `vault.ErrVaultNotFound` is `"does not exist"`, composed by its caller as `vault <name> does not exist`); each such sentinel documents the message it participates in. Verified mechanically, not by inspection: every `fmt.Errorf` and `errors.New` call site in both trees is parsed, the `Error()` text of any sentinel passed to `%w` is substituted in, and the resulting sets of composed message templates are compared. All 350 templates `main` produces are still produced, character for character. The set of lost or altered messages is empty. ## `unlocker list` `findUnlockerIDByMetadata` returns `(string, error)` rather than signalling failure with an empty ID, so an unreadable `unlockers.d` is no longer indistinguishable from "no matching entry". `UnlockersList` skips such an entry with a warning naming the directory — its behavior before the scan was extracted into a helper — instead of emitting a row under a synthesized fallback ID that no `unlocker remove` or `unlocker select` can match and that suppresses the current-unlocker marker. The duplicate-check and shell-completion callers skip on the same condition, matching their pre-extraction behavior. Covered by `internal/cli/unlockers_list_test.go`. `TODO.md` records the change plus follow-ups (version-completion TODOs formerly in code comments, darwin-gated files exceeding 88 columns that Linux CI does not lint). `make check` is green and the pinned v2.12.2 image reports `0 issues.` Note the test suite needs the memlock ulimit from `script/cibuild` for the 10MB memguard test; that requirement is pre-existing. Not changed: `script/bootstrap` installs golangci-lint via the system package manager (no version pin to bump), and `script/lint` invokes whatever `golangci-lint` is on PATH. golangci-lint v2.12 deprecates `gomodguard` in favor of `gomodguard_v2` (warning only); the canonical config owns that decision. Co-authored-by: sneak <sneak@sneak.berlin> Reviewed-on: #29 Co-authored-by: clawbot <clawbot@noreply.example.org> Co-committed-by: clawbot <clawbot@noreply.example.org>
2026-08-10 15:23:33 +02:00
parent 6e5e0db999
commit 41cea400a7
60 changed files with 6867 additions and 4875 deletions
--- a/internal/cli/secrets.go
+++ b/internal/cli/secrets.go
@@ -2,10 +2,12 @@ package cli

 import (
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"log"
 	"path/filepath"
+	"slices"
 	"strings"

 	"git.eeqj.de/sneak/secret/internal/secret"
@@ -20,12 +22,36 @@ const (
 	vaultSecretSeparator = ":"
 	// vaultSecretParts is the number of parts when splitting vault:secret
 	vaultSecretParts = 2
+
+	// initialBufferSize is the starting size for secret read buffers (4KB)
+	initialBufferSize = 4 * 1024
+	// maxSecretSize is the maximum allowed size of a secret (100MB)
+	maxSecretSize = 100 * 1024 * 1024
 )

+// Sentinel errors for secret operations
+var (
+	errSecretTooLarge     = errors.New("secret too large: exceeds 100MB limit")
+	errSecretFileTooLarge = errors.New(
+		"secret file too large: exceeds 100MB limit")
+	errSecretNotFound      = errors.New("not found")
+	errSecretExistsNoForce = errors.New(
+		"already exists (use --force to overwrite)")
+	errVaultDoesNotExist           = errors.New("does not exist")
+	errCrossVaultSourceUnqualified = errors.New(
+		"source must specify vault (e.g., vault:secret) for cross-vault move")
+)
+
+// bufferInfo tracks a protected buffer and the number of bytes used in it
+type bufferInfo struct {
+	buffer *memguard.LockedBuffer
+	used   int
+}
+
 // ParseVaultSecretRef parses a "vault:secret" or just "secret" reference
 // Returns (vaultName, secretName, isQualified)
 // If no vault is specified, returns empty vaultName and isQualified=false
-func ParseVaultSecretRef(ref string) (vaultName, secretName string, isQualified bool) {
+func ParseVaultSecretRef(ref string) (string, string, bool) {
 	parts := strings.SplitN(ref, vaultSecretSeparator, vaultSecretParts)
 	if len(parts) == vaultSecretParts {
 		return parts[0], parts[1], true
@@ -42,6 +68,7 @@ func newAddCmd() *cobra.Command {
 		Args:  cobra.ExactArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			secret.Debug("Add command RunE starting", "secret_name", args[0])
+
 			force, _ := cmd.Flags().GetBool("force")
 			secret.Debug("Got force flag", "force", force)

@@ -49,7 +76,9 @@ func newAddCmd() *cobra.Command {
 			if err != nil {
 				return fmt.Errorf("failed to initialize CLI: %w", err)
 			}
+
 			cli.cmd = cmd // Set the command for stdin access
+
 			secret.Debug("Created CLI instance, calling AddSecret")

 			return cli.AddSecret(args[0], force)
@@ -66,6 +95,7 @@ func newGetCmd() *cobra.Command {
 	if err != nil {
 		log.Fatalf("failed to initialize CLI: %v", err)
 	}
+
 	cmd := &cobra.Command{
 		Use:               "get <secret-name>",
 		Short:             "Retrieve a secret from the vault",
@@ -73,6 +103,7 @@ func newGetCmd() *cobra.Command {
 		ValidArgsFunction: getSecretNamesCompletionFunc(cli.fs, cli.stateDir),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			version, _ := cmd.Flags().GetString("version")
+
 			cli, err := NewCLIInstance()
 			if err != nil {
 				return fmt.Errorf("failed to initialize CLI: %w", err)
@@ -92,8 +123,9 @@ func newListCmd() *cobra.Command {
 		Use:     "list [filter]",
 		Aliases: []string{"ls"},
 		Short:   "List all secrets in the current vault",
-		Long:    `List all secrets in the current vault. Optionally filter by substring match in secret name.`,
-		Args:    cobra.MaximumNArgs(1),
+		Long: `List all secrets in the current vault. Optionally filter ` +
+			`by substring match in secret name.`,
+		Args: cobra.MaximumNArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			jsonOutput, _ := cmd.Flags().GetBool("json")
 			quietOutput, _ := cmd.Flags().GetBool("quiet")
@@ -122,8 +154,9 @@ func newImportCmd() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "import <secret-name>",
 		Short: "Import a secret from a file",
-		Long:  `Import a secret from a file and store it in the current vault under the given name.`,
-		Args:  cobra.ExactArgs(1),
+		Long: `Import a secret from a file and store it in the current ` +
+			`vault under the given name.`,
+		Args: cobra.ExactArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			sourceFile, _ := cmd.Flags().GetString("source")
 			force, _ := cmd.Flags().GetBool("force")
@@ -149,12 +182,13 @@ func newRemoveCmd() *cobra.Command {
 	if err != nil {
 		log.Fatalf("failed to initialize CLI: %v", err)
 	}
+
 	cmd := &cobra.Command{
 		Use:     "remove <secret-name>",
 		Aliases: []string{"rm"},
 		Short:   "Remove a secret from the vault",
-		Long: `Remove a secret and all its versions from the current vault. This action is permanent and ` +
-			`cannot be undone.`,
+		Long: `Remove a secret and all its versions from the current ` +
+			`vault. This action is permanent and cannot be undone.`,
 		Args:              cobra.ExactArgs(1),
 		ValidArgsFunction: getSecretNamesCompletionFunc(cli.fs, cli.stateDir),
 		RunE: func(cmd *cobra.Command, args []string) error {
@@ -175,6 +209,7 @@ func newMoveCmd() *cobra.Command {
 	if err != nil {
 		log.Fatalf("failed to initialize CLI: %v", err)
 	}
+
 	cmd := &cobra.Command{
 		Use:     "move <source> <destination>",
 		Aliases: []string{"mv", "rename"},
@@ -190,13 +225,16 @@ For cross-vault moves:

 Cross-vault moves copy ALL versions of the secret, preserving history.
 The source secret is deleted after successful copy.`,
-		Args: cobra.ExactArgs(2), //nolint:mnd // Command requires exactly 2 arguments: source and destination
-		ValidArgsFunction: func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+		Args: cobra.ExactArgs(2), //nolint:mnd // source and destination args
+		ValidArgsFunction: func(
+			cmd *cobra.Command, args []string, toComplete string,
+		) ([]string, cobra.ShellCompDirective) {
 			// Complete vault:secret format
 			return getVaultSecretCompletionFunc(cli.fs, cli.stateDir)(cmd, args, toComplete)
 		},
 		RunE: func(cmd *cobra.Command, args []string) error {
 			force, _ := cmd.Flags().GetBool("force")
+
 			cli, err := NewCLIInstance()
 			if err != nil {
 				return fmt.Errorf("failed to initialize CLI: %w", err)
@@ -206,16 +244,20 @@ The source secret is deleted after successful copy.`,
 		},
 	}

-	cmd.Flags().BoolP("force", "f", false, "Overwrite if destination secret already exists")
+	cmd.Flags().BoolP("force", "f", false,
+		"Overwrite if destination secret already exists")

 	return cmd
 }

 // updateBufferSize updates the buffer size based on usage pattern
 func updateBufferSize(currentSize int, sameSize *int) int {
+	const (
+		doubleAfterBuffers = 2
+		growthFactor       = 2
+	)
+
 	*sameSize++
-	const doubleAfterBuffers = 2
-	const growthFactor = 2
 	if *sameSize >= doubleAfterBuffers {
 		*sameSize = 0

@@ -225,40 +267,21 @@ func updateBufferSize(currentSize int, sameSize *int) int {
 	return currentSize
 }

-// AddSecret adds a secret to the current vault
-func (cli *Instance) AddSecret(secretName string, force bool) error {
-	secret.Debug("CLI AddSecret starting", "secret_name", secretName, "force", force)
-
-	// Get current vault
-	secret.Debug("Getting current vault")
-	vlt, err := vault.GetCurrentVault(cli.fs, cli.stateDir)
-	if err != nil {
-		return err
-	}
-
-	secret.Debug("Got current vault", "vault_name", vlt.GetName())
-
-	// Read secret value directly into protected buffers
-	secret.Debug("Reading secret value from stdin into protected buffers")
-
-	const initialSize = 4 * 1024      // 4KB initial buffer
-	const maxSize = 100 * 1024 * 1024 // 100MB max
-
-	type bufferInfo struct {
-		buffer *memguard.LockedBuffer
-		used   int
+// destroyBuffers destroys every buffer in the list
+func destroyBuffers(buffers []bufferInfo) {
+	for _, b := range buffers {
+		b.buffer.Destroy()
 	}
+}

+// readSecretFromReader reads all data from reader into protected buffers,
+// enforcing the maximum secret size. On failure the accumulated buffers
+// are destroyed; on success the caller must destroy them.
+func readSecretFromReader(reader io.Reader) ([]bufferInfo, int, error) {
 	var buffers []bufferInfo
-	defer func() {
-		for _, b := range buffers {
-			b.buffer.Destroy()
-		}
-	}()

-	reader := cli.cmd.InOrStdin()
 	totalSize := 0
-	currentBufferSize := initialSize
+	currentBufferSize := initialBufferSize
 	sameSize := 0

 	for {
@@ -273,8 +296,10 @@ func (cli *Instance) AddSecret(secretName string, force bool) error {
 			buffers = append(buffers, bufferInfo{buffer: buffer, used: n})
 			totalSize += n

-			if totalSize > maxSize {
-				return fmt.Errorf("secret too large: exceeds 100MB limit")
+			if totalSize > maxSecretSize {
+				destroyBuffers(buffers)
+
+				return nil, 0, errSecretTooLarge
 			}

 			// If we filled the buffer, consider growing for next iteration
@@ -283,13 +308,59 @@ func (cli *Instance) AddSecret(secretName string, force bool) error {
 			}
 		}

-		if err == io.EOF || err == io.ErrUnexpectedEOF {
+		if err == io.EOF || errors.Is(err, io.ErrUnexpectedEOF) {
 			break
 		} else if err != nil {
-			return fmt.Errorf("failed to read secret value: %w", err)
+			destroyBuffers(buffers)
+
+			return nil, 0, err
 		}
 	}

+	return buffers, totalSize, nil
+}
+
+// combineBuffers copies the used portions of buffers into a single
+// protected buffer of totalSize bytes
+func combineBuffers(buffers []bufferInfo, totalSize int) *memguard.LockedBuffer {
+	valueBuffer := memguard.NewBuffer(totalSize)
+
+	offset := 0
+	for _, b := range buffers {
+		copy(valueBuffer.Bytes()[offset:], b.buffer.Bytes()[:b.used])
+		offset += b.used
+	}
+
+	return valueBuffer
+}
+
+// AddSecret adds a secret to the current vault
+func (cli *Instance) AddSecret(secretName string, force bool) error {
+	secret.Debug("CLI AddSecret starting", "secret_name", secretName, "force", force)
+
+	// Get current vault
+	secret.Debug("Getting current vault")
+
+	vlt, err := vault.GetCurrentVault(cli.fs, cli.stateDir)
+	if err != nil {
+		return err
+	}
+
+	secret.Debug("Got current vault", "vault_name", vlt.GetName())
+
+	// Read secret value directly into protected buffers
+	secret.Debug("Reading secret value from stdin into protected buffers")
+
+	buffers, totalSize, err := readSecretFromReader(cli.cmd.InOrStdin())
+	if err != nil {
+		if errors.Is(err, errSecretTooLarge) {
+			return err
+		}
+
+		return fmt.Errorf("failed to read secret value: %w", err)
+	}
+	defer destroyBuffers(buffers)
+
 	// Check for trailing newline in the last buffer
 	if len(buffers) > 0 && totalSize > 0 {
 		lastBuffer := &buffers[len(buffers)-1]
@@ -299,21 +370,19 @@ func (cli *Instance) AddSecret(secretName string, force bool) error {
 		}
 	}

-	secret.Debug("Read secret value from stdin", "value_length", totalSize, "buffers", len(buffers))
+	secret.Debug("Read secret value from stdin",
+		"value_length", totalSize, "buffers", len(buffers))

 	// Combine all buffers into a single protected buffer
-	valueBuffer := memguard.NewBuffer(totalSize)
+	valueBuffer := combineBuffers(buffers, totalSize)
 	defer valueBuffer.Destroy()

-	offset := 0
-	for _, b := range buffers {
-		copy(valueBuffer.Bytes()[offset:], b.buffer.Bytes()[:b.used])
-		offset += b.used
-	}
-
 	// Add the secret to the vault
-	secret.Debug("Calling vault.AddSecret", "secret_name", secretName, "value_length", valueBuffer.Size(), "force", force)
-	if err := vlt.AddSecret(secretName, valueBuffer, force); err != nil {
+	secret.Debug("Calling vault.AddSecret", "secret_name", secretName,
+		"value_length", valueBuffer.Size(), "force", force)
+
+	err = vlt.AddSecret(secretName, valueBuffer, force)
+	if err != nil {
 		secret.Debug("vault.AddSecret failed", "error", err)

 		return err
@@ -330,8 +399,11 @@ func (cli *Instance) GetSecret(cmd *cobra.Command, secretName string) error {
 }

 // GetSecretWithVersion retrieves and prints a specific version of a secret
-func (cli *Instance) GetSecretWithVersion(cmd *cobra.Command, secretName string, version string) error {
-	secret.Debug("GetSecretWithVersion called", "secretName", secretName, "version", version)
+func (cli *Instance) GetSecretWithVersion(
+	cmd *cobra.Command, secretName string, version string,
+) error {
+	secret.Debug("GetSecretWithVersion called",
+		"secretName", secretName, "version", version)

 	// Store the command for output
 	cli.cmd = cmd
@@ -351,6 +423,7 @@ func (cli *Instance) GetSecretWithVersion(cmd *cobra.Command, secretName string,
 	} else {
 		value, err = vlt.GetSecretVersion(secretName, version)
 	}
+
 	if err != nil {
 		secret.Debug("Failed to get secret", "error", err)

@@ -361,6 +434,7 @@ func (cli *Instance) GetSecretWithVersion(cmd *cobra.Command, secretName string,

 	// Print the secret value to stdout
 	_, _ = cli.Print(string(value))
+
 	secret.Debug("Printed value to stdout")

 	// Debug: Log what we're actually printing
@@ -375,7 +449,9 @@ func (cli *Instance) GetSecretWithVersion(cmd *cobra.Command, secretName string,
 }

 // ListSecrets lists all secrets in the current vault
-func (cli *Instance) ListSecrets(cmd *cobra.Command, jsonOutput bool, quietOutput bool, filter string) error {
+func (cli *Instance) ListSecrets(
+	cmd *cobra.Command, jsonOutput bool, quietOutput bool, filter string,
+) error {
 	// Get current vault
 	vlt, err := vault.GetCurrentVault(cli.fs, cli.stateDir)
 	if err != nil {
@@ -390,6 +466,7 @@ func (cli *Instance) ListSecrets(cmd *cobra.Command, jsonOutput bool, quietOutpu

 	// Filter secrets if filter is provided
 	var filteredSecrets []string
+
 	if filter != "" {
 		for _, secretName := range secrets {
 			if strings.Contains(secretName, filter) {
@@ -400,100 +477,132 @@ func (cli *Instance) ListSecrets(cmd *cobra.Command, jsonOutput bool, quietOutpu
 		filteredSecrets = secrets
 	}

-	if jsonOutput { //nolint:nestif // Separate JSON and table output formatting logic
-		// For JSON output, get metadata for each secret
-		secretsWithMetadata := make([]map[string]interface{}, 0, len(filteredSecrets))
-
-		for _, secretName := range filteredSecrets {
-			secretInfo := map[string]interface{}{
-				"name": secretName,
-			}
-
-			// Try to get metadata using GetSecretObject
-			if secretObj, err := vlt.GetSecretObject(secretName); err == nil {
-				metadata := secretObj.GetMetadata()
-				secretInfo["created_at"] = metadata.CreatedAt
-				secretInfo["updated_at"] = metadata.UpdatedAt
-			}
-
-			secretsWithMetadata = append(secretsWithMetadata, secretInfo)
-		}
-
-		output := map[string]interface{}{
-			"secrets": secretsWithMetadata,
-		}
-		if filter != "" {
-			output["filter"] = filter
-		}
-
-		jsonBytes, err := json.MarshalIndent(output, "", "  ")
-		if err != nil {
-			return fmt.Errorf("failed to marshal JSON: %w", err)
-		}
-
-		_, _ = fmt.Fprintln(cmd.OutOrStdout(), string(jsonBytes))
-	} else if quietOutput {
+	switch {
+	case jsonOutput:
+		return printSecretsJSON(cmd, vlt, filteredSecrets, filter)
+	case quietOutput:
 		// Quiet output - just secret names
 		for _, secretName := range filteredSecrets {
 			_, _ = fmt.Fprintln(cmd.OutOrStdout(), secretName)
 		}
-	} else {
-		// Pretty table output
-		out := cmd.OutOrStdout()
-		if len(filteredSecrets) == 0 {
-			if filter != "" {
-				_, _ = fmt.Fprintf(out, "No secrets found in vault '%s' matching filter '%s'.\n", vlt.GetName(), filter)
-			} else {
-				_, _ = fmt.Fprintln(out, "No secrets found in current vault.")
-				_, _ = fmt.Fprintln(out, "Run 'secret add <name>' to create one.")
-			}

-			return nil
-		}
-
-		// Get current vault name for display
-		if filter != "" {
-			_, _ = fmt.Fprintf(out, "Secrets in vault '%s' matching '%s':\n\n", vlt.GetName(), filter)
-		} else {
-			_, _ = fmt.Fprintf(out, "Secrets in vault '%s':\n\n", vlt.GetName())
-		}
-
-		// Calculate the maximum name length for proper column alignment
-		maxNameLen := len("NAME") // Start with header length
-		for _, secretName := range filteredSecrets {
-			if len(secretName) > maxNameLen {
-				maxNameLen = len(secretName)
-			}
-		}
-		// Add some padding
-		maxNameLen += 2
-
-		// Print headers with dynamic width
-		nameFormat := fmt.Sprintf("%%-%ds", maxNameLen)
-		_, _ = fmt.Fprintf(out, nameFormat+" %-20s\n", "NAME", "LAST UPDATED")
-		_, _ = fmt.Fprintf(out, nameFormat+" %-20s\n", strings.Repeat("-", len("NAME")), "------------")
-
-		for _, secretName := range filteredSecrets {
-			lastUpdated := "unknown"
-			if secretObj, err := vlt.GetSecretObject(secretName); err == nil {
-				metadata := secretObj.GetMetadata()
-				lastUpdated = metadata.UpdatedAt.Format("2006-01-02 15:04")
-			}
-			_, _ = fmt.Fprintf(out, nameFormat+" %-20s\n", secretName, lastUpdated)
-		}
-
-		_, _ = fmt.Fprintf(out, "\nTotal: %d secret(s)", len(filteredSecrets))
-		if filter != "" {
-			_, _ = fmt.Fprintf(out, " (filtered from %d)", len(secrets))
-		}
-		_, _ = fmt.Fprintln(out)
+		return nil
+	default:
+		return printSecretsTable(cmd, vlt, filteredSecrets, filter, len(secrets))
 	}
+}
+
+// printSecretsJSON prints the filtered secrets with metadata as JSON
+func printSecretsJSON(
+	cmd *cobra.Command, vlt *vault.Vault, filteredSecrets []string, filter string,
+) error {
+	// For JSON output, get metadata for each secret
+	secretsWithMetadata := make([]map[string]any, 0, len(filteredSecrets))
+
+	for _, secretName := range filteredSecrets {
+		secretInfo := map[string]any{
+			"name": secretName,
+		}
+
+		// Try to get metadata using GetSecretObject
+		secretObj, err := vlt.GetSecretObject(secretName)
+		if err == nil {
+			metadata := secretObj.GetMetadata()
+			secretInfo["created_at"] = metadata.CreatedAt
+			secretInfo["updated_at"] = metadata.UpdatedAt
+		}
+
+		secretsWithMetadata = append(secretsWithMetadata, secretInfo)
+	}
+
+	output := map[string]any{
+		"secrets": secretsWithMetadata,
+	}
+	if filter != "" {
+		output["filter"] = filter
+	}
+
+	jsonBytes, err := json.MarshalIndent(output, "", "  ")
+	if err != nil {
+		return fmt.Errorf("failed to marshal JSON: %w", err)
+	}
+
+	_, _ = fmt.Fprintln(cmd.OutOrStdout(), string(jsonBytes))
+
+	return nil
+}
+
+// printSecretsTable prints the filtered secrets as a formatted table
+func printSecretsTable(
+	cmd *cobra.Command, vlt *vault.Vault,
+	filteredSecrets []string, filter string, totalCount int,
+) error {
+	// Pretty table output
+	out := cmd.OutOrStdout()
+
+	if len(filteredSecrets) == 0 {
+		if filter != "" {
+			_, _ = fmt.Fprintf(out,
+				"No secrets found in vault '%s' matching filter '%s'.\n",
+				vlt.GetName(), filter)
+		} else {
+			_, _ = fmt.Fprintln(out, "No secrets found in current vault.")
+			_, _ = fmt.Fprintln(out, "Run 'secret add <name>' to create one.")
+		}
+
+		return nil
+	}
+
+	// Get current vault name for display
+	if filter != "" {
+		_, _ = fmt.Fprintf(out, "Secrets in vault '%s' matching '%s':\n\n",
+			vlt.GetName(), filter)
+	} else {
+		_, _ = fmt.Fprintf(out, "Secrets in vault '%s':\n\n", vlt.GetName())
+	}
+
+	// Calculate the maximum name length for proper column alignment
+	maxNameLen := len("NAME") // Start with header length
+	for _, secretName := range filteredSecrets {
+		if len(secretName) > maxNameLen {
+			maxNameLen = len(secretName)
+		}
+	}
+	// Add some padding
+	maxNameLen += 2
+
+	// Print headers with dynamic width
+	nameFormat := fmt.Sprintf("%%-%ds", maxNameLen)
+	_, _ = fmt.Fprintf(out, nameFormat+" %-20s\n", "NAME", "LAST UPDATED")
+	_, _ = fmt.Fprintf(out, nameFormat+" %-20s\n",
+		strings.Repeat("-", len("NAME")), "------------")
+
+	for _, secretName := range filteredSecrets {
+		lastUpdated := "unknown"
+
+		secretObj, err := vlt.GetSecretObject(secretName)
+		if err == nil {
+			metadata := secretObj.GetMetadata()
+			lastUpdated = metadata.UpdatedAt.Format("2006-01-02 15:04")
+		}
+
+		_, _ = fmt.Fprintf(out, nameFormat+" %-20s\n", secretName, lastUpdated)
+	}
+
+	_, _ = fmt.Fprintf(out, "\nTotal: %d secret(s)", len(filteredSecrets))
+	if filter != "" {
+		_, _ = fmt.Fprintf(out, " (filtered from %d)", totalCount)
+	}
+
+	_, _ = fmt.Fprintln(out)

 	return nil
 }

 // ImportSecret imports a secret from a file
-func (cli *Instance) ImportSecret(cmd *cobra.Command, secretName, sourceFile string, force bool) error {
+func (cli *Instance) ImportSecret(
+	cmd *cobra.Command, secretName, sourceFile string, force bool,
+) error {
 	// Get current vault
 	vlt, err := vault.GetCurrentVault(cli.fs, cli.stateDir)
 	if err != nil {
@@ -506,75 +615,34 @@ func (cli *Instance) ImportSecret(cmd *cobra.Command, secretName, sourceFile str
 		return fmt.Errorf("failed to open file %s: %w", sourceFile, err)
 	}
 	defer func() {
-		if err := file.Close(); err != nil {
-			secret.Warn("Failed to close file", "error", err)
+		closeErr := file.Close()
+		if closeErr != nil {
+			secret.Warn("Failed to close file", "error", closeErr)
 		}
 	}()

-	const initialSize = 4 * 1024      // 4KB initial buffer
-	const maxSize = 100 * 1024 * 1024 // 100MB max
+	buffers, totalSize, err := readSecretFromReader(file)
+	if err != nil {
+		if errors.Is(err, errSecretTooLarge) {
+			return errSecretFileTooLarge
+		}

-	type bufferInfo struct {
-		buffer *memguard.LockedBuffer
-		used   int
-	}
-
-	var buffers []bufferInfo
-	defer func() {
-		for _, b := range buffers {
-			b.buffer.Destroy()
-		}
-	}()
-
-	totalSize := 0
-	currentBufferSize := initialSize
-	sameSize := 0
-
-	for {
-		// Create a new buffer
-		buffer := memguard.NewBuffer(currentBufferSize)
-		n, err := io.ReadFull(file, buffer.Bytes())
-
-		if n == 0 {
-			// No data read, destroy the unused buffer
-			buffer.Destroy()
-		} else {
-			buffers = append(buffers, bufferInfo{buffer: buffer, used: n})
-			totalSize += n
-
-			if totalSize > maxSize {
-				return fmt.Errorf("secret file too large: exceeds 100MB limit")
-			}
-
-			// If we filled the buffer, consider growing for next iteration
-			if n == currentBufferSize {
-				currentBufferSize = updateBufferSize(currentBufferSize, &sameSize)
-			}
-		}
-
-		if err == io.EOF || err == io.ErrUnexpectedEOF {
-			break
-		} else if err != nil {
-			return fmt.Errorf("failed to read secret from file %s: %w", sourceFile, err)
-		}
+		return fmt.Errorf("failed to read secret from file %s: %w", sourceFile, err)
 	}
+	defer destroyBuffers(buffers)

 	// Combine all buffers into a single protected buffer
-	valueBuffer := memguard.NewBuffer(totalSize)
+	valueBuffer := combineBuffers(buffers, totalSize)
 	defer valueBuffer.Destroy()

-	offset := 0
-	for _, b := range buffers {
-		copy(valueBuffer.Bytes()[offset:], b.buffer.Bytes()[:b.used])
-		offset += b.used
-	}
-
 	// Store the secret in the vault
-	if err := vlt.AddSecret(secretName, valueBuffer, force); err != nil {
+	err = vlt.AddSecret(secretName, valueBuffer, force)
+	if err != nil {
 		return err
 	}

-	cmd.Printf("Successfully imported secret '%s' from file '%s'\n", secretName, sourceFile)
+	cmd.Printf("Successfully imported secret '%s' from file '%s'\n",
+		secretName, sourceFile)

 	return nil
 }
@@ -600,29 +668,36 @@ func (cli *Instance) RemoveSecret(cmd *cobra.Command, secretName string, _ bool)
 	if err != nil {
 		return fmt.Errorf("failed to check if secret exists: %w", err)
 	}
+
 	if !exists {
-		return fmt.Errorf("secret '%s' not found", secretName)
+		return fmt.Errorf("secret '%s' %w", secretName, errSecretNotFound)
 	}

 	// Count versions for information
 	versionsDir := filepath.Join(secretDir, "versions")
 	versionCount := 0
-	if entries, err := afero.ReadDir(cli.fs, versionsDir); err == nil {
+
+	entries, err := afero.ReadDir(cli.fs, versionsDir)
+	if err == nil {
 		versionCount = len(entries)
 	}

 	// Remove the secret directory
-	if err := cli.fs.RemoveAll(secretDir); err != nil {
+	err = cli.fs.RemoveAll(secretDir)
+	if err != nil {
 		return fmt.Errorf("failed to remove secret: %w", err)
 	}

-	cmd.Printf("Removed secret '%s' (%d version(s) deleted)\n", secretName, versionCount)
+	cmd.Printf("Removed secret '%s' (%d version(s) deleted)\n",
+		secretName, versionCount)

 	return nil
 }

 // MoveSecret moves or renames a secret (within or across vaults)
-func (cli *Instance) MoveSecret(cmd *cobra.Command, source, dest string, force bool) error {
+func (cli *Instance) MoveSecret(
+	cmd *cobra.Command, source, dest string, force bool,
+) error {
 	// Parse source and destination
 	srcVaultName, srcSecretName, srcQualified := ParseVaultSecretRef(source)
 	destVaultName, destSecretName, destQualified := ParseVaultSecretRef(dest)
@@ -634,25 +709,20 @@ func (cli *Instance) MoveSecret(cmd *cobra.Command, source, dest string, force b

 	// Cross-vault move requires source to be qualified
 	if !srcQualified {
-		return fmt.Errorf("source must specify vault (e.g., vault:secret) for cross-vault move")
+		return errCrossVaultSourceUnqualified
 	}

 	// If destination is not qualified (no colon), check if it's a vault name
 	// Format: "work:secret default" means move to vault "default"
-	// Format: "work:secret default:newname" means move to vault "default" with new name
+	// Format: "work:secret default:newname" means move to vault "default"
+	// with a new name
 	if !destQualified {
 		// Check if dest is actually a vault name
 		vaults, err := vault.ListVaults(cli.fs, cli.stateDir)
-		if err == nil {
-			for _, v := range vaults {
-				if v == dest {
-					// dest is a vault name, use source secret name
-					destVaultName = dest
-					destSecretName = srcSecretName
-
-					break
-				}
-			}
+		if err == nil && slices.Contains(vaults, dest) {
+			// dest is a vault name, use source secret name
+			destVaultName = dest
+			destSecretName = srcSecretName
 		}

 		// If destVaultName is still empty, dest is a secret name in source vault
@@ -670,7 +740,8 @@ func (cli *Instance) MoveSecret(cmd *cobra.Command, source, dest string, force b
 	// Same vault? Use simple rename if possible (optimization)
 	if srcVaultName == destVaultName {
 		// Select the vault and do a simple move
-		if err := vault.SelectVault(cli.fs, cli.stateDir, srcVaultName); err != nil {
+		err := vault.SelectVault(cli.fs, cli.stateDir, srcVaultName)
+		if err != nil {
 			return fmt.Errorf("failed to select vault '%s': %w", srcVaultName, err)
 		}

@@ -678,11 +749,14 @@ func (cli *Instance) MoveSecret(cmd *cobra.Command, source, dest string, force b
 	}

 	// Cross-vault move
-	return cli.moveSecretCrossVault(cmd, srcVaultName, srcSecretName, destVaultName, destSecretName, force)
+	return cli.moveSecretCrossVault(
+		cmd, srcVaultName, srcSecretName, destVaultName, destSecretName, force)
 }

 // moveSecretWithinVault handles rename within the current vault
-func (cli *Instance) moveSecretWithinVault(cmd *cobra.Command, source, dest string, force bool) error {
+func (cli *Instance) moveSecretWithinVault(
+	cmd *cobra.Command, source, dest string, force bool,
+) error {
 	currentVlt, err := vault.GetCurrentVault(cli.fs, cli.stateDir)
 	if err != nil {
 		return err
@@ -702,7 +776,7 @@ func (cli *Instance) moveSecretWithinVault(cmd *cobra.Command, source, dest stri
 	}

 	if !exists {
-		return fmt.Errorf("secret '%s' not found", source)
+		return fmt.Errorf("secret '%s' %w", source, errSecretNotFound)
 	}

 	destEncoded := strings.ReplaceAll(dest, "/", "%")
@@ -715,15 +789,17 @@ func (cli *Instance) moveSecretWithinVault(cmd *cobra.Command, source, dest stri

 	if exists {
 		if !force {
-			return fmt.Errorf("secret '%s' already exists (use --force to overwrite)", dest)
+			return fmt.Errorf("secret '%s' %w", dest, errSecretExistsNoForce)
 		}

-		if err := cli.fs.RemoveAll(destDir); err != nil {
+		err = cli.fs.RemoveAll(destDir)
+		if err != nil {
 			return fmt.Errorf("failed to remove existing destination: %w", err)
 		}
 	}

-	if err := cli.fs.Rename(sourceDir, destDir); err != nil {
+	err = cli.fs.Rename(sourceDir, destDir)
+	if err != nil {
 		return fmt.Errorf("failed to move secret: %w", err)
 	}

@@ -741,8 +817,8 @@ func (cli *Instance) moveSecretCrossVault(
 ) error {
 	// Get source vault
 	srcVault := vault.NewVault(cli.fs, cli.stateDir, srcVaultName)
-	srcVaultDir, err := srcVault.GetDirectory()

+	srcVaultDir, err := srcVault.GetDirectory()
 	if err != nil {
 		return fmt.Errorf("failed to get source vault directory: %w", err)
 	}
@@ -750,7 +826,7 @@ func (cli *Instance) moveSecretCrossVault(
 	// Verify source vault exists
 	exists, err := afero.DirExists(cli.fs, srcVaultDir)
 	if err != nil || !exists {
-		return fmt.Errorf("source vault '%s' does not exist", srcVaultName)
+		return fmt.Errorf("source vault '%s' %w", srcVaultName, errVaultDoesNotExist)
 	}

 	// Verify source secret exists
@@ -759,13 +835,14 @@ func (cli *Instance) moveSecretCrossVault(

 	exists, err = afero.DirExists(cli.fs, srcSecretDir)
 	if err != nil || !exists {
-		return fmt.Errorf("secret '%s' not found in vault '%s'", srcSecretName, srcVaultName)
+		return fmt.Errorf("secret '%s' %w in vault '%s'",
+			srcSecretName, errSecretNotFound, srcVaultName)
 	}

 	// Get destination vault
 	destVault := vault.NewVault(cli.fs, cli.stateDir, destVaultName)
-	destVaultDir, err := destVault.GetDirectory()

+	destVaultDir, err := destVault.GetDirectory()
 	if err != nil {
 		return fmt.Errorf("failed to get destination vault directory: %w", err)
 	}
@@ -773,7 +850,8 @@ func (cli *Instance) moveSecretCrossVault(
 	// Verify destination vault exists
 	exists, err = afero.DirExists(cli.fs, destVaultDir)
 	if err != nil || !exists {
-		return fmt.Errorf("destination vault '%s' does not exist", destVaultName)
+		return fmt.Errorf("destination vault '%s' %w",
+			destVaultName, errVaultDoesNotExist)
 	}

 	// Unlock destination vault (will fail if neither mnemonic nor unlocker available)
@@ -787,12 +865,15 @@ func (cli *Instance) moveSecretCrossVault(
 	versionCount := len(versions)

 	// Copy all versions
-	if err := destVault.CopySecretAllVersions(srcVault, srcSecretName, destSecretName, force); err != nil {
+	err = destVault.CopySecretAllVersions(
+		srcVault, srcSecretName, destSecretName, force)
+	if err != nil {
 		return err
 	}

 	// Delete source secret
-	if err := cli.fs.RemoveAll(srcSecretDir); err != nil {
+	err = cli.fs.RemoveAll(srcSecretDir)
+	if err != nil {
 		// Copy succeeded but delete failed - warn but don't fail
 		cmd.Printf("Warning: copied secret but failed to remove source: %v\n", err)
 		cmd.Printf("Moved secret '%s:%s' to '%s:%s' (%d version(s))\n",