Give each failure one error value (closes #113)

internal/cli drops its copies of vault.ErrSecretNotFound, ErrVaultNotFound,
ErrVersionNotFound and ErrSecretExists and of the secret package's keychain
and Secure Enclave errors, and its second error for an unknown unlocker
type, an invalid mnemonic, a length below 1, an unsupported secret type and
an oversized secret. vault.ErrNilValueBuffer becomes
secret.ErrNilValueBuffer. Every error of secret.ReadPassphrase wraps
ErrPassphraseNotRead. ResolveGPGKeyFingerprint returns ErrGPGKeyNotFound for
a key the keyring lacks. storeInKeychain returns errNilDataBuffer. bip85's
ErrPasswordTooShort and ErrEncodedTooShort go with their unreachable checks,
as does the macOS check in macOS-only code. Tests that matched these
errors' text use errors.Is.

Model: opus-5-5

internal/cli/unlockers.go

@@ -39,15 +39,10 @@ var (
 	errInvalidUnlockerType = errors.New("invalid unlocker type")
 	errKeyIDOnlyForPGP     = errors.New(
 		"--keyid flag is only valid for PGP unlockers")
-	errKeychainMacOSOnly = errors.New(
-		"keychain unlockers are only supported on macOS")
-	errSecureEnclaveMacOSOnly = errors.New(
-		"secure enclave unlockers are only supported on macOS")
 	// errGPGKeyAlreadyUnlocker carries only the message tail; the caller
 	// composes "GPG key <id> is already added as an unlocker".
 	errGPGKeyAlreadyUnlocker = errors.New(
 		"is already added as an unlocker")
-	errUnsupportedUnlockerType = errors.New("unsupported unlocker type")
 )
 
 // UnlockerInfo represents unlocker information for display
@@ -439,7 +434,7 @@ func (cli *Instance) UnlockersAdd(unlockerType string, cmd *cobra.Command) error
 		}
 
 		return fmt.Errorf("%w: %s (supported: %s)",
-			errUnsupportedUnlockerType, unlockerType, supportedTypes)
+			errInvalidUnlockerType, unlockerType, supportedTypes)
 	}
 }
 
@@ -474,7 +469,7 @@ func (cli *Instance) addPassphraseUnlocker(cmd *cobra.Command) error {
 		// Use secure passphrase input with confirmation
 		passphraseBuffer, err = readSecurePassphrase("Enter passphrase for unlocker: ")
 		if err != nil {
-			return fmt.Errorf("failed to read passphrase: %w", err)
+			return err
 		}
 		defer passphraseBuffer.Destroy()
 	}
@@ -494,10 +489,6 @@ func (cli *Instance) addPassphraseUnlocker(cmd *cobra.Command) error {
 
 // addKeychainUnlocker creates a macOS Keychain unlocker in the current vault
 func (cli *Instance) addKeychainUnlocker(cmd *cobra.Command) error {
-	if runtime.GOOS != platformDarwin {
-		return errKeychainMacOSOnly
-	}
-
 	keychainUnlocker, err := secret.CreateKeychainUnlocker(
 		cli.fs, cli.stateDir, cli.Mnemonic, cli.UnlockPassphrase)
 	if err != nil {
@@ -525,10 +516,6 @@ func (cli *Instance) addKeychainUnlocker(cmd *cobra.Command) error {
 // addSecureEnclaveUnlocker creates a Secure Enclave unlocker in the
 // current vault
 func (cli *Instance) addSecureEnclaveUnlocker(cmd *cobra.Command) error {
-	if runtime.GOOS != platformDarwin {
-		return errSecureEnclaveMacOSOnly
-	}
-
 	seUnlocker, err := secret.CreateSecureEnclaveUnlocker(
 		cli.fs, cli.stateDir, cli.Mnemonic, cli.UnlockPassphrase)
 	if err != nil {