Update golangci-lint to v2.12.2 with canonical config (#29)

Bumps golangci-lint from v2.1.6 (digest-only pin in the `Dockerfile` lint stage) to v2.12.2, pinned by tag and digest (Debian-based image). Replaces `.golangci.yml` with the canonical strict config: all linters enabled except the standard disable list (`exhaustruct`, `depguard`, `godot`, `wsl`, `wrapcheck`, `varnamelen`), `lll` at 88, `funlen` 80/50, `cyclop` 15, `dupl` 100, and test files are now linted (the old config had `tests: false`, an enable-only list of ~20 linters, `lll` 120, and a blanket exclusion of `internal/macse`). The stricter config surfaced ~1550 findings, all fixed: - `wsl_v5` (439) / `nlreturn` (24): blank-line insertions - `lll` (309): line wrapping at 88 columns; long literals split with `+` concatenation, values unchanged - `noinlineerr` (130): `if err := ...` split into assignment plus check - `paralleltest` (116): `t.Parallel()` added to tests without shared state; reasoned `//nolint` where `t.Setenv` or shared fixtures forbid it - `err113` (97): package-level sentinel errors (new `internal/vault/errors.go`), `%w` wrapping, `errors.Is` - `perfsprint` (74) / `modernize` (39) / `intrange`: `strconv`, `errors.New`, `slices.Contains`, `any`, `SplitSeq` - `goconst` (40) / `dupword` (41) / `testifylint` (42) / `thelper` (33): constants, assertion fixes, `t.Helper()` - `noctx` (22): `exec.CommandContext` for gpg/CLI invocations - `testpackage` (18): black-box tests moved to `_test` packages where they use only exported identifiers; white-box files carry a reasoned `//nolint` - `funlen`/`cyclop`/`gocognit`/`nestif`/`dupl`: behavior-preserving helper extraction - assorted singletons: `gosec`, `gosmopolitan`, `funcorder`, `nonamedreturns`, `makezero`, `prealloc`, `godox`, `nolintlint`, `ireturn`, `nilnil`, `gochecknoinits` ## User-visible strings **None changed.** Every error message this branch composes is byte-identical to the one `main` composes. The `err113` sentinels are shaped so `fmt.Errorf` reassembles the original text around them: the sentinel carries the fixed words and the caller supplies the interpolated value in the position it has always occupied. Where the value sits mid-sentence the sentinel holds only a fragment (e.g. `vault.ErrVaultNotFound` is `"does not exist"`, composed by its caller as `vault <name> does not exist`); each such sentinel documents the message it participates in. Verified mechanically, not by inspection: every `fmt.Errorf` and `errors.New` call site in both trees is parsed, the `Error()` text of any sentinel passed to `%w` is substituted in, and the resulting sets of composed message templates are compared. All 350 templates `main` produces are still produced, character for character. The set of lost or altered messages is empty. ## `unlocker list` `findUnlockerIDByMetadata` returns `(string, error)` rather than signalling failure with an empty ID, so an unreadable `unlockers.d` is no longer indistinguishable from "no matching entry". `UnlockersList` skips such an entry with a warning naming the directory — its behavior before the scan was extracted into a helper — instead of emitting a row under a synthesized fallback ID that no `unlocker remove` or `unlocker select` can match and that suppresses the current-unlocker marker. The duplicate-check and shell-completion callers skip on the same condition, matching their pre-extraction behavior. Covered by `internal/cli/unlockers_list_test.go`. `TODO.md` records the change plus follow-ups (version-completion TODOs formerly in code comments, darwin-gated files exceeding 88 columns that Linux CI does not lint). `make check` is green and the pinned v2.12.2 image reports `0 issues.` Note the test suite needs the memlock ulimit from `script/cibuild` for the 10MB memguard test; that requirement is pre-existing. Not changed: `script/bootstrap` installs golangci-lint via the system package manager (no version pin to bump), and `script/lint` invokes whatever `golangci-lint` is on PATH. golangci-lint v2.12 deprecates `gomodguard` in favor of `gomodguard_v2` (warning only); the canonical config owns that decision. Co-authored-by: sneak <sneak@sneak.berlin> Reviewed-on: #29 Co-authored-by: clawbot <clawbot@noreply.example.org> Co-committed-by: clawbot <clawbot@noreply.example.org>
2026-08-10 15:23:33 +02:00
parent 6e5e0db999
commit 41cea400a7
60 changed files with 6867 additions and 4875 deletions
--- a/internal/cli/vault.go
+++ b/internal/cli/vault.go
@@ -2,10 +2,12 @@ package cli

 import (
 	"encoding/json"
+	"errors"
 	"fmt"
 	"log"
 	"os"
 	"path/filepath"
+	"slices"
 	"strings"
 	"time"

@@ -18,6 +20,22 @@ import (
 	"github.com/tyler-smith/go-bip39"
 )

+// Sentinel errors for vault operations
+var (
+	errMnemonicEmpty         = errors.New("mnemonic cannot be empty")
+	errInvalidMnemonicPhrase = errors.New("invalid BIP39 mnemonic phrase")
+	errInvalidMnemonic       = errors.New("invalid BIP39 mnemonic")
+	errVaultHasLongTermKey   = errors.New(
+		"already has a long-term key configured")
+	errMnemonicEnvNotSet = errors.New(
+		"SB_SECRET_MNEMONIC environment variable not set")
+	errPassphraseEnvNotSet = errors.New(
+		"SB_UNLOCK_PASSPHRASE environment variable not set")
+	errCannotRemoveLastVault = errors.New("cannot remove the last vault")
+	errVaultContainsSecrets  = errors.New(
+		"contains secrets; use --force to remove")
+)
+
 func newVaultCmd() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "vault",
@@ -36,7 +54,7 @@ func newVaultCmd() *cobra.Command {

 func newVaultListCmd() *cobra.Command {
 	cmd := &cobra.Command{
-		Use:     "list",
+		Use:     cmdUseList,
 		Aliases: []string{"ls"},
 		Short:   "List available vaults",
 		RunE: func(cmd *cobra.Command, _ []string) error {
@@ -101,9 +119,10 @@ func newVaultImportCmd() *cobra.Command {
 	}

 	return &cobra.Command{
-		Use:               "import <vault-name>",
-		Short:             "Import a mnemonic into a vault",
-		Long:              `Import a BIP39 mnemonic phrase into the specified vault (default if not specified).`,
+		Use:   "import <vault-name>",
+		Short: "Import a mnemonic into a vault",
+		Long: `Import a BIP39 mnemonic phrase into the specified vault ` +
+			`(default if not specified).`,
 		Args:              cobra.MaximumNArgs(1),
 		ValidArgsFunction: getVaultNamesCompletionFunc(cli.fs, cli.stateDir),
 		RunE: func(cmd *cobra.Command, args []string) error {
@@ -127,16 +146,19 @@ func newVaultRemoveCmd() *cobra.Command {
 	if err != nil {
 		log.Fatalf("failed to initialize CLI: %v", err)
 	}
+
 	cmd := &cobra.Command{
 		Use:     "remove <name>",
 		Aliases: []string{"rm"},
 		Short:   "Remove a vault",
-		Long: `Remove a vault. Requires --force if the vault contains secrets. Will automatically ` +
-			`switch to another vault if removing the currently selected one.`,
+		Long: `Remove a vault. Requires --force if the vault contains ` +
+			`secrets. Will automatically switch to another vault if ` +
+			`removing the currently selected one.`,
 		Args:              cobra.ExactArgs(1),
 		ValidArgsFunction: getVaultNamesCompletionFunc(cli.fs, cli.stateDir),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			force, _ := cmd.Flags().GetBool("force")
+
 			cli, err := NewCLIInstance()
 			if err != nil {
 				return fmt.Errorf("failed to initialize CLI: %w", err)
@@ -161,11 +183,13 @@ func (cli *Instance) ListVaults(cmd *cobra.Command, jsonOutput bool) error {
 	if jsonOutput { //nolint:nestif // Separate JSON and text output formatting logic
 		// Get current vault name for context
 		currentVault := ""
-		if currentVlt, err := vault.GetCurrentVault(cli.fs, cli.stateDir); err == nil {
+
+		currentVlt, err := vault.GetCurrentVault(cli.fs, cli.stateDir)
+		if err == nil {
 			currentVault = currentVlt.GetName()
 		}

-		result := map[string]interface{}{
+		result := map[string]any{
 			"vaults":       vaults,
 			"currentVault": currentVault,
 		}
@@ -174,16 +198,20 @@ func (cli *Instance) ListVaults(cmd *cobra.Command, jsonOutput bool) error {
 		if err != nil {
 			return err
 		}
+
 		cmd.Println(string(jsonBytes))
 	} else {
 		// Text output
 		cmd.Println("Available vaults:")
+
 		if len(vaults) == 0 {
 			cmd.Println("  (none)")
 		} else {
 			// Try to get current vault for marking
 			currentVault := ""
-			if currentVlt, err := vault.GetCurrentVault(cli.fs, cli.stateDir); err == nil {
+
+			currentVlt, err := vault.GetCurrentVault(cli.fs, cli.stateDir)
+			if err == nil {
 				currentVault = currentVlt.GetName()
 			}

@@ -200,19 +228,57 @@ func (cli *Instance) ListVaults(cmd *cobra.Command, jsonOutput bool) error {
 	return nil
 }

+// setMnemonicEnv sets the mnemonic environment variable and returns a
+// function that restores the previous value
+func setMnemonicEnv(mnemonicStr string) func() {
+	originalMnemonic := os.Getenv(secret.EnvMnemonic)
+	_ = os.Setenv(secret.EnvMnemonic, mnemonicStr)
+
+	return func() {
+		if originalMnemonic != "" {
+			_ = os.Setenv(secret.EnvMnemonic, originalMnemonic)
+		} else {
+			_ = os.Unsetenv(secret.EnvMnemonic)
+		}
+	}
+}
+
+// resolvePassphrase returns the unlock passphrase from the environment or
+// prompts the user for it with confirmation
+func resolvePassphrase() (*memguard.LockedBuffer, error) {
+	if envPassphrase := os.Getenv(secret.EnvUnlockPassphrase); envPassphrase != "" {
+		secret.Debug("Using unlock passphrase from environment variable")
+
+		return memguard.NewBufferFromBytes([]byte(envPassphrase)), nil
+	}
+
+	secret.Debug("Prompting user for unlock passphrase")
+
+	// Use secure passphrase input with confirmation
+	passphraseBuffer, err := readSecurePassphrase("Enter passphrase for unlocker: ")
+	if err != nil {
+		return nil, fmt.Errorf("failed to read passphrase: %w", err)
+	}
+
+	return passphraseBuffer, nil
+}
+
 // CreateVault creates a new vault
 func (cli *Instance) CreateVault(cmd *cobra.Command, name string) error {
 	secret.Debug("Creating new vault", "name", name, "state_dir", cli.stateDir)

 	// Get or prompt for mnemonic
 	var mnemonicStr string
+
 	if envMnemonic := os.Getenv(secret.EnvMnemonic); envMnemonic != "" {
 		secret.Debug("Using mnemonic from environment variable")
+
 		mnemonicStr = envMnemonic
 	} else {
 		secret.Debug("Prompting user for mnemonic phrase")
 		// Read mnemonic securely without echo
-		mnemonicBuffer, err := secret.ReadPassphrase("Enter your BIP39 mnemonic phrase: ")
+		mnemonicBuffer, err := secret.ReadPassphrase(
+			"Enter your BIP39 mnemonic phrase: ")
 		if err != nil {
 			secret.Debug("Failed to read mnemonic from stdin", "error", err)

@@ -221,30 +287,25 @@ func (cli *Instance) CreateVault(cmd *cobra.Command, name string) error {
 		defer mnemonicBuffer.Destroy()

 		mnemonicStr = mnemonicBuffer.String()
+
 		fmt.Fprintln(os.Stderr) // Add newline after hidden input
 	}

 	if mnemonicStr == "" {
-		return fmt.Errorf("mnemonic cannot be empty")
+		return errMnemonicEmpty
 	}

 	// Validate the mnemonic
 	mnemonicWords := strings.Fields(mnemonicStr)
 	secret.Debug("Validating BIP39 mnemonic", "word_count", len(mnemonicWords))
+
 	if !bip39.IsMnemonicValid(mnemonicStr) {
-		return fmt.Errorf("invalid BIP39 mnemonic phrase")
+		return errInvalidMnemonicPhrase
 	}

 	// Set mnemonic in environment for CreateVault to use
-	originalMnemonic := os.Getenv(secret.EnvMnemonic)
-	_ = os.Setenv(secret.EnvMnemonic, mnemonicStr)
-	defer func() {
-		if originalMnemonic != "" {
-			_ = os.Setenv(secret.EnvMnemonic, originalMnemonic)
-		} else {
-			_ = os.Unsetenv(secret.EnvMnemonic)
-		}
-	}()
+	restoreMnemonicEnv := setMnemonicEnv(mnemonicStr)
+	defer restoreMnemonicEnv()

 	// Create the vault - it will handle key derivation internally
 	vlt, err := vault.CreateVault(cli.fs, cli.stateDir, name)
@@ -254,6 +315,7 @@ func (cli *Instance) CreateVault(cmd *cobra.Command, name string) error {

 	// Get the vault metadata to retrieve the derivation index
 	vaultDir := filepath.Join(cli.stateDir, "vaults.d", name)
+
 	metadata, err := vault.LoadVaultMetadata(cli.fs, vaultDir)
 	if err != nil {
 		return fmt.Errorf("failed to load vault metadata: %w", err)
@@ -269,22 +331,15 @@ func (cli *Instance) CreateVault(cmd *cobra.Command, name string) error {
 	vlt.Unlock(ltIdentity)

 	// Get or prompt for passphrase
-	var passphraseBuffer *memguard.LockedBuffer
-	if envPassphrase := os.Getenv(secret.EnvUnlockPassphrase); envPassphrase != "" {
-		secret.Debug("Using unlock passphrase from environment variable")
-		passphraseBuffer = memguard.NewBufferFromBytes([]byte(envPassphrase))
-	} else {
-		secret.Debug("Prompting user for unlock passphrase")
-		// Use secure passphrase input with confirmation
-		passphraseBuffer, err = readSecurePassphrase("Enter passphrase for unlocker: ")
-		if err != nil {
-			return fmt.Errorf("failed to read passphrase: %w", err)
-		}
+	passphraseBuffer, err := resolvePassphrase()
+	if err != nil {
+		return err
 	}
 	defer passphraseBuffer.Destroy()

 	// Create passphrase-protected unlocker
 	secret.Debug("Creating passphrase-protected unlocker")
+
 	passphraseUnlocker, err := vlt.CreatePassphraseUnlocker(passphraseBuffer)
 	if err != nil {
 		return fmt.Errorf("failed to create unlocker: %w", err)
@@ -299,7 +354,8 @@ func (cli *Instance) CreateVault(cmd *cobra.Command, name string) error {

 // SelectVault selects a vault as the current one
 func (cli *Instance) SelectVault(cmd *cobra.Command, name string) error {
-	if err := vault.SelectVault(cli.fs, cli.stateDir, name); err != nil {
+	err := vault.SelectVault(cli.fs, cli.stateDir, name)
+	if err != nil {
 		return err
 	}

@@ -308,84 +364,60 @@ func (cli *Instance) SelectVault(cmd *cobra.Command, name string) error {
 	return nil
 }

-// VaultImport imports a mnemonic into a specific vault
-func (cli *Instance) VaultImport(cmd *cobra.Command, vaultName string) error {
-	secret.Debug("Importing mnemonic into vault", "vault_name", vaultName, "state_dir", cli.stateDir)
-
-	// Get the specific vault by name
-	vlt := vault.NewVault(cli.fs, cli.stateDir, vaultName)
-
+// vaultImportPreflight verifies the vault exists without a long-term key
+// and returns the vault directory, public key path, and validated mnemonic
+func (cli *Instance) vaultImportPreflight(
+	vlt *vault.Vault, vaultName string,
+) (string, string, string, error) {
 	// Check if vault exists
 	vaultDir, err := vlt.GetDirectory()
 	if err != nil {
-		return err
+		return "", "", "", err
 	}

 	exists, err := afero.DirExists(cli.fs, vaultDir)
 	if err != nil {
-		return fmt.Errorf("failed to check if vault exists: %w", err)
+		return "", "", "", fmt.Errorf("failed to check if vault exists: %w", err)
 	}
+
 	if !exists {
-		return fmt.Errorf("vault '%s' does not exist", vaultName)
+		return "", "", "", fmt.Errorf("vault '%s' %w",
+			vaultName, errVaultDoesNotExist)
 	}

 	// Check if vault already has a public key
-	pubKeyPath := fmt.Sprintf("%s/pub.age", vaultDir)
-	if _, err := cli.fs.Stat(pubKeyPath); err == nil {
-		return fmt.Errorf("vault '%s' already has a long-term key configured", vaultName)
+	pubKeyPath := vaultDir + "/pub.age"
+
+	_, err = cli.fs.Stat(pubKeyPath)
+	if err == nil {
+		return "", "", "", fmt.Errorf("vault '%s' %w",
+			vaultName, errVaultHasLongTermKey)
 	}

 	// Get mnemonic from environment
 	mnemonic := os.Getenv(secret.EnvMnemonic)
 	if mnemonic == "" {
-		return fmt.Errorf("SB_SECRET_MNEMONIC environment variable not set")
+		return "", "", "", errMnemonicEnvNotSet
 	}

 	// Validate the mnemonic
 	mnemonicWords := strings.Fields(mnemonic)
 	secret.Debug("Validating BIP39 mnemonic", "word_count", len(mnemonicWords))
+
 	if !bip39.IsMnemonicValid(mnemonic) {
-		return fmt.Errorf("invalid BIP39 mnemonic")
+		return "", "", "", errInvalidMnemonic
 	}

-	// Get the next available derivation index for this mnemonic
-	derivationIndex, err := vault.GetNextDerivationIndex(cli.fs, cli.stateDir, mnemonic)
-	if err != nil {
-		secret.Debug("Failed to get next derivation index", "error", err)
-
-		return fmt.Errorf("failed to get next derivation index: %w", err)
-	}
-	secret.Debug("Using derivation index", "index", derivationIndex)
-
-	// Derive long-term key from mnemonic with the appropriate index
-	secret.Debug("Deriving long-term key from mnemonic", "index", derivationIndex)
-	ltIdentity, err := agehd.DeriveIdentity(mnemonic, derivationIndex)
-	if err != nil {
-		return fmt.Errorf("failed to derive long-term key: %w", err)
-	}
-
-	// Store long-term public key in vault
-	ltPublicKey := ltIdentity.Recipient().String()
-	secret.Debug("Storing long-term public key", "pubkey", ltPublicKey, "vault_dir", vaultDir)
-
-	if err := afero.WriteFile(cli.fs, pubKeyPath, []byte(ltPublicKey), secret.FilePerms); err != nil {
-		return fmt.Errorf("failed to store long-term public key: %w", err)
-	}
-
-	// Calculate public key hash from the actual derivation index being used
-	// This is used to verify that the derived key matches what was stored
-	publicKeyHash := vault.ComputeDoubleSHA256([]byte(ltIdentity.Recipient().String()))
-
-	// Calculate family hash from index 0 (same for all vaults with this mnemonic)
-	// This is used to identify which vaults belong to the same mnemonic family
-	identity0, err := agehd.DeriveIdentity(mnemonic, 0)
-	if err != nil {
-		return fmt.Errorf("failed to derive identity for index 0: %w", err)
-	}
-	familyHash := vault.ComputeDoubleSHA256([]byte(identity0.Recipient().String()))
+	return vaultDir, pubKeyPath, mnemonic, nil
+}

+// updateVaultImportMetadata stores the derivation info in vault metadata
+func updateVaultImportMetadata(
+	fs afero.Fs, vaultDir string, derivationIndex uint32,
+	publicKeyHash, familyHash string,
+) error {
 	// Load existing metadata
-	existingMetadata, err := vault.LoadVaultMetadata(cli.fs, vaultDir)
+	existingMetadata, err := vault.LoadVaultMetadata(fs, vaultDir)
 	if err != nil {
 		// If metadata doesn't exist, create new
 		existingMetadata = &vault.Metadata{
@@ -398,17 +430,83 @@ func (cli *Instance) VaultImport(cmd *cobra.Command, vaultName string) error {
 	existingMetadata.PublicKeyHash = publicKeyHash
 	existingMetadata.MnemonicFamilyHash = familyHash

-	if err := vault.SaveVaultMetadata(cli.fs, vaultDir, existingMetadata); err != nil {
+	err = vault.SaveVaultMetadata(fs, vaultDir, existingMetadata)
+	if err != nil {
 		secret.Debug("Failed to save vault metadata", "error", err)

 		return fmt.Errorf("failed to save vault metadata: %w", err)
 	}
+
 	secret.Debug("Saved vault metadata with derivation index and public key hash")

+	return nil
+}
+
+// VaultImport imports a mnemonic into a specific vault
+func (cli *Instance) VaultImport(cmd *cobra.Command, vaultName string) error {
+	secret.Debug("Importing mnemonic into vault",
+		"vault_name", vaultName, "state_dir", cli.stateDir)
+
+	// Get the specific vault by name
+	vlt := vault.NewVault(cli.fs, cli.stateDir, vaultName)
+
+	vaultDir, pubKeyPath, mnemonic, err := cli.vaultImportPreflight(vlt, vaultName)
+	if err != nil {
+		return err
+	}
+
+	// Get the next available derivation index for this mnemonic
+	derivationIndex, err := vault.GetNextDerivationIndex(cli.fs, cli.stateDir, mnemonic)
+	if err != nil {
+		secret.Debug("Failed to get next derivation index", "error", err)
+
+		return fmt.Errorf("failed to get next derivation index: %w", err)
+	}
+
+	secret.Debug("Using derivation index", "index", derivationIndex)
+
+	// Derive long-term key from mnemonic with the appropriate index
+	secret.Debug("Deriving long-term key from mnemonic", "index", derivationIndex)
+
+	ltIdentity, err := agehd.DeriveIdentity(mnemonic, derivationIndex)
+	if err != nil {
+		return fmt.Errorf("failed to derive long-term key: %w", err)
+	}
+
+	// Store long-term public key in vault
+	ltPublicKey := ltIdentity.Recipient().String()
+	secret.Debug("Storing long-term public key",
+		"pubkey", ltPublicKey, "vault_dir", vaultDir)
+
+	err = afero.WriteFile(cli.fs, pubKeyPath, []byte(ltPublicKey), secret.FilePerms)
+	if err != nil {
+		return fmt.Errorf("failed to store long-term public key: %w", err)
+	}
+
+	// Calculate public key hash from the actual derivation index being used
+	// This is used to verify that the derived key matches what was stored
+	publicKeyHash := vault.ComputeDoubleSHA256([]byte(ltIdentity.Recipient().String()))
+
+	// Calculate family hash from index 0 (same for all vaults with this
+	// mnemonic). This is used to identify which vaults belong to the same
+	// mnemonic family.
+	identity0, err := agehd.DeriveIdentity(mnemonic, 0)
+	if err != nil {
+		return fmt.Errorf("failed to derive identity for index 0: %w", err)
+	}
+
+	familyHash := vault.ComputeDoubleSHA256([]byte(identity0.Recipient().String()))
+
+	err = updateVaultImportMetadata(
+		cli.fs, vaultDir, derivationIndex, publicKeyHash, familyHash)
+	if err != nil {
+		return err
+	}
+
 	// Get passphrase from environment variable
 	passphraseStr := os.Getenv(secret.EnvUnlockPassphrase)
 	if passphraseStr == "" {
-		return fmt.Errorf("SB_UNLOCK_PASSPHRASE environment variable not set")
+		return errPassphraseEnvNotSet
 	}

 	secret.Debug("Using unlock passphrase from environment variable")
@@ -422,6 +520,7 @@ func (cli *Instance) VaultImport(cmd *cobra.Command, vaultName string) error {

 	// Create passphrase-protected unlocker
 	secret.Debug("Creating passphrase-protected unlocker")
+
 	passphraseUnlocker, err := vlt.CreatePassphraseUnlocker(passphraseBuffer)
 	if err != nil {
 		secret.Debug("Failed to create unlocker", "error", err)
@@ -436,6 +535,46 @@ func (cli *Instance) VaultImport(cmd *cobra.Command, vaultName string) error {
 	return nil
 }

+// vaultHasSecrets reports whether the vault directory contains any secrets
+func (cli *Instance) vaultHasSecrets(vaultDir string) bool {
+	secretsDir := filepath.Join(vaultDir, "secrets.d")
+
+	exists, _ := afero.DirExists(cli.fs, secretsDir)
+	if !exists {
+		return false
+	}
+
+	entries, err := afero.ReadDir(cli.fs, secretsDir)
+
+	return err == nil && len(entries) > 0
+}
+
+// switchAwayFromVault selects another vault as current before removal
+func (cli *Instance) switchAwayFromVault(
+	cmd *cobra.Command, vaults []string, name string,
+) error {
+	// Find another vault to switch to
+	var newVault string
+
+	for _, v := range vaults {
+		if v != name {
+			newVault = v
+
+			break
+		}
+	}
+
+	// Switch to the new vault
+	err := vault.SelectVault(cli.fs, cli.stateDir, newVault)
+	if err != nil {
+		return fmt.Errorf("failed to switch to vault '%s': %w", newVault, err)
+	}
+
+	cmd.Printf("Switched current vault to '%s'\n", newVault)
+
+	return nil
+}
+
 // RemoveVault removes a vault with safety checks
 func (cli *Instance) RemoveVault(cmd *cobra.Command, name string, force bool) error {
 	// Get list of all vaults
@@ -445,21 +584,13 @@ func (cli *Instance) RemoveVault(cmd *cobra.Command, name string, force bool) er
 	}

 	// Check if vault exists
-	vaultExists := false
-	for _, v := range vaults {
-		if v == name {
-			vaultExists = true
-
-			break
-		}
-	}
-	if !vaultExists {
-		return fmt.Errorf("vault '%s' does not exist", name)
+	if !slices.Contains(vaults, name) {
+		return fmt.Errorf("vault '%s' %w", name, errVaultDoesNotExist)
 	}

 	// Don't allow removing the last vault
 	if len(vaults) == 1 {
-		return fmt.Errorf("cannot remove the last vault")
+		return errCannotRemoveLastVault
 	}

 	// Check if this is the current vault
@@ -467,57 +598,44 @@ func (cli *Instance) RemoveVault(cmd *cobra.Command, name string, force bool) er
 	if err != nil {
 		return fmt.Errorf("failed to get current vault: %w", err)
 	}
+
 	isCurrentVault := currentVault.GetName() == name

 	// Load the vault to check for secrets
 	vlt := vault.NewVault(cli.fs, cli.stateDir, name)
+
 	vaultDir, err := vlt.GetDirectory()
 	if err != nil {
 		return fmt.Errorf("failed to get vault directory: %w", err)
 	}

 	// Check if vault has secrets
-	secretsDir := filepath.Join(vaultDir, "secrets.d")
-	hasSecrets := false
-	if exists, _ := afero.DirExists(cli.fs, secretsDir); exists {
-		entries, err := afero.ReadDir(cli.fs, secretsDir)
-		if err == nil && len(entries) > 0 {
-			hasSecrets = true
-		}
-	}
+	hasSecrets := cli.vaultHasSecrets(vaultDir)

 	// Require --force if vault has secrets
 	if hasSecrets && !force {
-		return fmt.Errorf("vault '%s' contains secrets; use --force to remove", name)
+		return fmt.Errorf("vault '%s' %w", name, errVaultContainsSecrets)
 	}

 	// If removing current vault, switch to another vault first
 	if isCurrentVault {
-		// Find another vault to switch to
-		var newVault string
-		for _, v := range vaults {
-			if v != name {
-				newVault = v
-
-				break
-			}
+		err = cli.switchAwayFromVault(cmd, vaults, name)
+		if err != nil {
+			return err
 		}
-
-		// Switch to the new vault
-		if err := vault.SelectVault(cli.fs, cli.stateDir, newVault); err != nil {
-			return fmt.Errorf("failed to switch to vault '%s': %w", newVault, err)
-		}
-		cmd.Printf("Switched current vault to '%s'\n", newVault)
 	}

 	// Remove the vault directory
-	if err := cli.fs.RemoveAll(vaultDir); err != nil {
+	err = cli.fs.RemoveAll(vaultDir)
+	if err != nil {
 		return fmt.Errorf("failed to remove vault directory: %w", err)
 	}

 	cmd.Printf("Removed vault '%s'\n", name)
+
 	if hasSecrets {
-		cmd.Printf("Warning: Vault contained secrets that have been permanently deleted\n")
+		cmd.Printf("Warning: Vault contained secrets that have been " +
+			"permanently deleted\n")
 	}

 	return nil