Make another unlocker current when the current one is removed (closes #137)
check / check (push) Canceled after 0s

Removing the vault's current unlocker left current-unlocker naming it,
so every command that opened the vault failed although another
unlocker remained, and the error pointed at the mnemonic.
RemoveUnlocker now makes the first other unlocker, in the order
`secret unlocker list` shows, current before the removal and returns
its ID, which `secret unlocker remove` prints; removing the last
unlocker also removes current-unlocker. When current-unlocker names an
unlocker that does not exist and the vault has others, the error wraps
ErrUnlockerNotFound and says to run `secret unlocker select`, without
the mnemonic advice.

Unverified: no test covers that advice for a vault other than the
current one, which gets `secret vault select` first.

Model: opus-5-5
This commit is contained in:
2026-10-14 18:16:59 +00:00
parent fd6c5df1a8
commit b9c552c3cc
8 changed files with 253 additions and 25 deletions
+6
View File
@@ -241,6 +241,12 @@ that the vault then opens only with its mnemonic (see
[Confirmation Before Removal](#confirmation-before-removal)). An unlocker
directory that `secret unlocker list` skips with a warning, because its metadata
cannot be read or parsed, is removed by the directory name the warning gives.
Removing the current unlocker makes the first of the vault's other unlockers, in
the order `secret unlocker list` shows them, the current one, and says which;
removing the last unlocker leaves the vault without a current unlocker. When
`current-unlocker` names an unlocker that does not exist and the vault has
others, opening the vault fails with an error that says to select one of them
with `secret unlocker select`.
- `--force, -f`: Remove without asking, even the last unlocker
- **CRITICAL WARNING**: Without unlockers and without your mnemonic phrase,