Read secret environment variables once per command, then unset them (closes #60)

init and vault create put the mnemonic into the process environment for
vault.CreateVault to read back, so every program they ran, gpg included,
inherited it, and SB_SECRET_MNEMONIC and SB_UNLOCK_PASSPHRASE were read
at 13 places and never unset. Each command that may need them now reads
both once, in its RunE, into locked buffers on the CLI Instance, and
unsets them at once. The buffers are passed down: vault.CreateVault
takes the mnemonic, a Vault carries Mnemonic and UnlockPassphrase, and
the PGP, keychain and Secure Enclave unlocker constructors take both;
CreatePGPUnlocker sets them on the vault it loads through SetMnemonic
and SetUnlockPassphrase, new in VaultInterface. README warns against
both variables.

Model: opus-5-5

internal/vault/vault.go

@@ -3,12 +3,12 @@ package vault
 import (
 	"fmt"
 	"log/slog"
-	"os"
 	"path/filepath"
 
 	"filippo.io/age"
 	"git.eeqj.de/sneak/secret/internal/secret"
 	"git.eeqj.de/sneak/secret/pkg/agehd"
+	"github.com/awnumar/memguard"
 	"github.com/spf13/afero"
 )
 
@@ -18,6 +18,13 @@ type Vault struct {
 	fs          afero.Fs
 	stateDir    string
 	longTermKey *age.X25519Identity // In-memory long-term key when unlocked
+	// Mnemonic, when not nil, is what the long-term key is derived from
+	// instead of the current unlocker. The caller destroys it.
+	Mnemonic *memguard.LockedBuffer
+	// UnlockPassphrase, when not nil, is given to the current unlocker
+	// when that is a passphrase unlocker, which otherwise prompts for it.
+	// The caller destroys it.
+	UnlockPassphrase *memguard.LockedBuffer
 }
 
 // NewVault creates a new Vault instance
@@ -56,6 +63,18 @@ func (v *Vault) ClearLongTermKey() {
 	v.longTermKey = nil
 }
 
+// SetMnemonic sets v.Mnemonic, for code that has v only as a
+// secret.VaultInterface.
+func (v *Vault) SetMnemonic(mnemonic *memguard.LockedBuffer) {
+	v.Mnemonic = mnemonic
+}
+
+// SetUnlockPassphrase sets v.UnlockPassphrase, for code that has v only as
+// a secret.VaultInterface.
+func (v *Vault) SetUnlockPassphrase(passphrase *memguard.LockedBuffer) {
+	v.UnlockPassphrase = passphrase
+}
+
 // GetOrDeriveLongTermKey gets the long-term key from memory or derives it
 // from available sources
 func (v *Vault) GetOrDeriveLongTermKey() (*age.X25519Identity, error) {
@@ -66,9 +85,8 @@ func (v *Vault) GetOrDeriveLongTermKey() (*age.X25519Identity, error) {
 
 	secret.Debug("Vault is locked, attempting to unlock", "vault_name", v.Name)
 
-	// Try to derive from environment mnemonic first
-	if envMnemonic := os.Getenv(secret.EnvMnemonic); envMnemonic != "" {
-		return v.deriveLongTermKeyFromMnemonic(envMnemonic)
+	if v.Mnemonic != nil {
+		return v.deriveLongTermKeyFromMnemonic(v.Mnemonic.String())
 	}
 
 	// No mnemonic available, try to use current unlocker
@@ -181,9 +199,9 @@ func (v *Vault) NumSecrets() (int, error) {
 // deriveLongTermKeyFromMnemonic derives the long-term key from the given
 // mnemonic, verifies it against the vault metadata, and caches it in memory.
 func (v *Vault) deriveLongTermKeyFromMnemonic(
-	envMnemonic string,
+	mnemonic string,
 ) (*age.X25519Identity, error) {
-	secret.Debug("Using mnemonic from environment for long-term key derivation",
+	secret.Debug("Using mnemonic for long-term key derivation",
 		"vault_name", v.Name)
 
 	// Load vault metadata to get the derivation index
@@ -199,7 +217,7 @@ func (v *Vault) deriveLongTermKeyFromMnemonic(
 		return nil, fmt.Errorf("failed to load vault metadata: %w", err)
 	}
 
-	ltIdentity, err := agehd.DeriveIdentity(envMnemonic, metadata.DerivationIndex)
+	ltIdentity, err := agehd.DeriveIdentity(mnemonic, metadata.DerivationIndex)
 	if err != nil {
 		secret.Debug("Failed to derive long-term key from mnemonic",
 			"error", err, "vault_name", v.Name)