Read secret environment variables once per command, then unset them (closes #60)

init and vault create put the mnemonic into the process environment for
vault.CreateVault to read back, so every program they ran, gpg included,
inherited it, and SB_SECRET_MNEMONIC and SB_UNLOCK_PASSPHRASE were read
at 13 places and never unset. Each command that may need them now reads
both once, in its RunE, into locked buffers on the CLI Instance, and
unsets them at once. The buffers are passed down: vault.CreateVault
takes the mnemonic, a Vault carries Mnemonic and UnlockPassphrase, and
the PGP, keychain and Secure Enclave unlocker constructors take both;
CreatePGPUnlocker sets them on the vault it loads through SetMnemonic
and SetUnlockPassphrase, new in VaultInterface. README warns against
both variables.

Model: opus-5-5

internal/cli/cli.go

@@ -3,8 +3,10 @@ package cli
 
 import (
 	"fmt"
+	"os"
 
 	"git.eeqj.de/sneak/secret/internal/secret"
+	"github.com/awnumar/memguard"
 	"github.com/spf13/afero"
 	"github.com/spf13/cobra"
 )
@@ -14,6 +16,11 @@ type Instance struct {
 	fs       afero.Fs
 	stateDir string
 	cmd      *cobra.Command
+	// Mnemonic and UnlockPassphrase hold the values of SB_SECRET_MNEMONIC
+	// and SB_UNLOCK_PASSPHRASE that readSecretEnv read, or nil when it found
+	// none.
+	Mnemonic         *memguard.LockedBuffer
+	UnlockPassphrase *memguard.LockedBuffer
 }
 
 // NewCLIInstance creates a new CLI instance with the real filesystem
@@ -68,3 +75,43 @@ func (cli *Instance) SetStateDir(stateDir string) {
 func (cli *Instance) GetStateDir() string {
 	return cli.stateDir
 }
+
+// readSecretEnv reads SB_SECRET_MNEMONIC into cli.Mnemonic and
+// SB_UNLOCK_PASSPHRASE into cli.UnlockPassphrase. A command that may need
+// either calls it once, before anything else, and passes the buffers on
+// from there: each variable is unset as soon as it is read, so that the
+// processes this one starts, gpg among them, do not inherit it, and a
+// second read would find nothing. The returned function destroys both
+// buffers.
+func (cli *Instance) readSecretEnv() func() {
+	cli.Mnemonic = readAndUnsetEnv(secret.EnvMnemonic)
+	cli.UnlockPassphrase = readAndUnsetEnv(secret.EnvUnlockPassphrase)
+
+	mnemonic, passphrase := cli.Mnemonic, cli.UnlockPassphrase
+
+	return func() {
+		if mnemonic != nil {
+			mnemonic.Destroy()
+		}
+
+		if passphrase != nil {
+			passphrase.Destroy()
+		}
+	}
+}
+
+// readAndUnsetEnv returns the value of the environment variable name in a
+// locked buffer, or nil when it is unset or empty, and unsets the variable.
+// Unsetting does not erase the value: it stays in this process's memory,
+// and in /proc/<pid>/environ, which shows the environment the process
+// started with. The caller must destroy the returned buffer.
+func readAndUnsetEnv(name string) *memguard.LockedBuffer {
+	value := os.Getenv(name)
+	_ = os.Unsetenv(name)
+
+	if value == "" {
+		return nil
+	}
+
+	return memguard.NewBufferFromBytes([]byte(value))
+}

internal/cli/create_vault_test.go

@@ -2,6 +2,7 @@ package cli_test
 
 import (
 	"bytes"
+	"os"
 	"testing"
 
 	"git.eeqj.de/sneak/secret/internal/cli"
@@ -20,16 +21,27 @@ import (
 // decrypted any more. Each must refuse, change nothing, and leave every
 // vault's secret readable through its passphrase unlocker.
 //
-//nolint:paralleltest // t.Setenv forbids parallel subtests
+//nolint:paralleltest // the cases share cmd
 func TestCreateExistingVaultChangesNothing(t *testing.T) {
-	t.Setenv(secret.EnvMnemonic, testMnemonic)
-	t.Setenv(secret.EnvUnlockPassphrase, testPassphrase)
+	mnemonic := testMnemonicBuffer(t)
+	passphrase := memguard.NewBufferFromBytes([]byte(testPassphrase))
+	t.Cleanup(passphrase.Destroy)
+
+	// newCLI returns an instance on fs given the mnemonic and the unlock
+	// passphrase, as from the environment
+	newCLI := func(fs afero.Fs) *cli.Instance {
+		c := cli.NewCLIInstanceWithStateDir(fs, testStateDir)
+		c.Mnemonic = mnemonic
+		c.UnlockPassphrase = passphrase
+
+		return c
+	}
 
 	// `secret init`, `secret vault create work`, `secret vault select
 	// default`, and the secret "x" in each vault. "work" is then not the
 	// current vault, which creating it again must not change.
 	fs := afero.NewMemMapFs()
-	c := cli.NewCLIInstanceWithStateDir(fs, testStateDir)
+	c := newCLI(fs)
 	cmd := &cobra.Command{}
 
 	require.NoError(t, c.Init(cmd))
@@ -74,7 +86,7 @@ func TestCreateExistingVaultChangesNothing(t *testing.T) {
 		t.Run(tt.command, func(t *testing.T) {
 			fs := newFsFromSnapshot(t, before)
 
-			err := tt.run(cli.NewCLIInstanceWithStateDir(fs, testStateDir))
+			err := tt.run(newCLI(fs))
 
 			require.EqualError(t, err, tt.want)
 			require.Equal(t, before, snapshotStateDir(t, fs))
@@ -85,10 +97,11 @@ func TestCreateExistingVaultChangesNothing(t *testing.T) {
 	// reading each vault's secret once from it shows that it still decrypts
 	// after each case. Without the mnemonic, reading a secret goes through
 	// the vault's passphrase unlocker, which is slow.
-	t.Setenv(secret.EnvMnemonic, "")
-
 	for _, name := range vaults {
-		value, err := vault.NewVault(fs, testStateDir, name).GetSecret("x")
+		vlt := vault.NewVault(fs, testStateDir, name)
+		vlt.UnlockPassphrase = passphrase
+
+		value, err := vlt.GetSecret("x")
 		require.NoError(t, err)
 
 		unchanged := bytes.Equal([]byte("value"), value.Bytes())
@@ -98,19 +111,43 @@ func TestCreateExistingVaultChangesNothing(t *testing.T) {
 	}
 }
 
+// TestVaultCreationLeavesNoSecretInEnvironment is a regression test for
+// https://git.eeqj.de/sneak/secret/issues/60, where `secret init` and
+// `secret vault create` put the mnemonic into the process environment,
+// which every program they ran inherited, and SB_SECRET_MNEMONIC and
+// SB_UNLOCK_PASSPHRASE were never unset. Each command, given both, must
+// leave neither in the environment.
+func TestVaultCreationLeavesNoSecretInEnvironment(t *testing.T) {
+	t.Setenv(secret.EnvStateDir, t.TempDir())
+
+	run := func(args ...string) {
+		t.Setenv(secret.EnvMnemonic, testMnemonic)
+		t.Setenv(secret.EnvUnlockPassphrase, testPassphrase)
+
+		// With no terminal to prompt on, this succeeds only if the command
+		// read both variables
+		_, err := cli.ExecuteCommandInProcess(args, "", nil)
+		require.NoError(t, err)
+
+		for _, name := range []string{secret.EnvMnemonic, secret.EnvUnlockPassphrase} {
+			_, set := os.LookupEnv(name)
+			require.False(t, set, "%s is set after %v", name, args)
+		}
+	}
+
+	run("init")
+	run("vault", "create", "work")
+}
+
 // TestStopAtPassphrasePromptLeavesNothing is a regression test for the
 // review of https://git.eeqj.de/sneak/secret/pulls/82: `secret init` or
 // `secret vault create` stopped at the passphrase prompt left a vault with
 // no unlocker, which neither command would then create again. Each must ask
 // for the passphrase before writing anything.
 //
-//nolint:paralleltest // t.Setenv forbids parallel subtests
+//nolint:paralleltest // the cases share cmd
 func TestStopAtPassphrasePromptLeavesNothing(t *testing.T) {
-	t.Setenv(secret.EnvMnemonic, testMnemonic)
-
-	// Without the passphrase in the environment, both commands prompt for
-	// it, which fails because the tests do not run in a terminal.
-	t.Setenv(secret.EnvUnlockPassphrase, "")
+	mnemonic := testMnemonicBuffer(t)
 
 	// An empty state directory for `secret init`, and one holding the vault
 	// "default" for `secret vault create work`.
@@ -118,7 +155,7 @@ func TestStopAtPassphrasePromptLeavesNothing(t *testing.T) {
 	require.NoError(t, empty.MkdirAll(testStateDir, secret.DirPerms))
 
 	withDefault := afero.NewMemMapFs()
-	_, err := vault.CreateVault(withDefault, testStateDir, "default")
+	_, err := vault.CreateVault(withDefault, testStateDir, "default", mnemonic)
 	require.NoError(t, err)
 
 	cmd := &cobra.Command{}
@@ -144,7 +181,12 @@ func TestStopAtPassphrasePromptLeavesNothing(t *testing.T) {
 		t.Run(tt.command, func(t *testing.T) {
 			before := snapshotStateDir(t, tt.fs)
 
-			err := tt.run(cli.NewCLIInstanceWithStateDir(tt.fs, testStateDir))
+			// Given no unlock passphrase, both commands prompt for it, which
+			// fails because the tests do not run in a terminal.
+			c := cli.NewCLIInstanceWithStateDir(tt.fs, testStateDir)
+			c.Mnemonic = mnemonic
+
+			err := tt.run(c)
 
 			require.ErrorContains(t, err, "failed to read passphrase")
 			require.Equal(t, before, snapshotStateDir(t, tt.fs))

internal/cli/crypto.go

@@ -41,6 +41,9 @@ func newCryptoCmd(
 
 			cli.cmd = cmd
 
+			destroySecrets := cli.readSecretEnv()
+			defer destroySecrets()
+
 			return run(cli, args[0], inputFile, outputFile)
 		},
 	}
@@ -156,6 +159,8 @@ func (cli *Instance) Encrypt(secretName, inputFile, outputFile string) error {
 		return err
 	}
 
+	vlt.Mnemonic, vlt.UnlockPassphrase = cli.Mnemonic, cli.UnlockPassphrase
+
 	// Get or create the age secret key for this secret
 	keyBuffer, err := cli.resolveEncryptionKey(vlt, secretName)
 	if err != nil {
@@ -230,6 +235,8 @@ func (cli *Instance) Decrypt(secretName, inputFile, outputFile string) error {
 		return err
 	}
 
+	vlt.Mnemonic, vlt.UnlockPassphrase = cli.Mnemonic, cli.UnlockPassphrase
+
 	// Check if secret exists
 	secretObj := secret.NewSecret(vlt, secretName)
 
@@ -308,13 +315,13 @@ func isValidAgeSecretKey(key string) bool {
 	return err == nil
 }
 
-// getSecretValue retrieves the value of a secret using the appropriate
-// unlocker
+// getSecretValue retrieves the value of a secret with the vault's mnemonic
+// when it has one, else with the current unlocker
 func (cli *Instance) getSecretValue(
 	vlt *vault.Vault, secretObj *secret.Secret,
 ) (*memguard.LockedBuffer, error) {
-	if os.Getenv(secret.EnvMnemonic) != "" {
-		return secretObj.GetValue(nil)
+	if vlt.Mnemonic != nil {
+		return secretObj.GetValue(nil, vlt.Mnemonic)
 	}
 
 	unlocker, err := vlt.GetCurrentUnlocker()
@@ -322,5 +329,5 @@ func (cli *Instance) getSecretValue(
 		return nil, fmt.Errorf("failed to get current unlocker: %w", err)
 	}
 
-	return secretObj.GetValue(unlocker)
+	return secretObj.GetValue(unlocker, nil)
 }

internal/cli/generate.go

@@ -76,6 +76,9 @@ func newGenerateSecretCmd() *cobra.Command {
 				return fmt.Errorf("failed to initialize CLI: %w", err)
 			}
 
+			destroySecrets := cli.readSecretEnv()
+			defer destroySecrets()
+
 			return cli.GenerateSecret(cmd, args[0], length, secretType, force)
 		},
 	}
@@ -167,6 +170,8 @@ func (cli *Instance) GenerateSecret(
 		return err
 	}
 
+	vlt.Mnemonic, vlt.UnlockPassphrase = cli.Mnemonic, cli.UnlockPassphrase
+
 	// Protect the generated secret immediately
 	secretBuffer := memguard.NewBufferFromBytes([]byte(secretValue))
 	defer secretBuffer.Destroy()

internal/cli/init.go

@@ -39,16 +39,20 @@ func RunInit(cmd *cobra.Command, _ []string) error {
 		log.Fatalf("failed to initialize CLI: %v", err)
 	}
 
+	destroySecrets := cli.readSecretEnv()
+	defer destroySecrets()
+
 	return cli.Init(cmd)
 }
 
-// promptMnemonic reads the mnemonic from the environment or interactively.
-// The returned cleanup function must be deferred by the caller.
-func promptMnemonic() (string, func(), error) {
-	if envMnemonic := os.Getenv(secret.EnvMnemonic); envMnemonic != "" {
+// promptMnemonic returns the mnemonic from the environment, cli.Mnemonic,
+// or reads it interactively. The returned cleanup function must be deferred
+// by the caller.
+func (cli *Instance) promptMnemonic() (*memguard.LockedBuffer, func(), error) {
+	if cli.Mnemonic != nil {
 		secret.Debug("Using mnemonic from environment variable")
 
-		return envMnemonic, func() {}, nil
+		return cli.Mnemonic, func() {}, nil
 	}
 
 	secret.Debug("Prompting user for mnemonic phrase")
@@ -58,23 +62,23 @@ func promptMnemonic() (string, func(), error) {
 	if err != nil {
 		secret.Debug("Failed to read mnemonic from stdin", "error", err)
 
-		return "", nil, fmt.Errorf("failed to read mnemonic: %w", err)
+		return nil, nil, fmt.Errorf("failed to read mnemonic: %w", err)
 	}
 
 	fmt.Fprintln(os.Stderr) // Add newline after hidden input
 
-	return mnemonicBuffer.String(), mnemonicBuffer.Destroy, nil
+	return mnemonicBuffer, mnemonicBuffer.Destroy, nil
 }
 
 // setupDefaultVault creates the default vault and derives its long-term
 // identity from the mnemonic
 func (cli *Instance) setupDefaultVault(
-	stateDir, mnemonicStr string,
+	stateDir string, mnemonic *memguard.LockedBuffer,
 ) (*vault.Vault, *age.X25519Identity, error) {
 	// Create the default vault - it will handle key derivation internally
 	secret.Debug("Creating default vault")
 
-	vlt, err := vault.CreateVault(cli.fs, cli.stateDir, "default")
+	vlt, err := vault.CreateVault(cli.fs, cli.stateDir, "default", mnemonic)
 	if err != nil {
 		secret.Debug("Failed to create default vault", "error", err)
 
@@ -92,7 +96,7 @@ func (cli *Instance) setupDefaultVault(
 	}
 
 	// Derive the long-term key using the same index that CreateVault used
-	ltIdentity, err := agehd.DeriveIdentity(mnemonicStr, metadata.DerivationIndex)
+	ltIdentity, err := agehd.DeriveIdentity(mnemonic.String(), metadata.DerivationIndex)
 	if err != nil {
 		secret.Debug("Failed to derive long-term key", "error", err)
 
@@ -136,12 +140,13 @@ func (cli *Instance) initialize(cmd *cobra.Command) error {
 	}
 
 	// Prompt for mnemonic
-	mnemonicStr, cleanupMnemonic, err := promptMnemonic()
+	mnemonic, cleanupMnemonic, err := cli.promptMnemonic()
 	if err != nil {
 		return err
 	}
 	defer cleanupMnemonic()
 
+	mnemonicStr := mnemonic.String()
 	if mnemonicStr == "" {
 		secret.Debug("Empty mnemonic provided")
 
@@ -162,18 +167,14 @@ func (cli *Instance) initialize(cmd *cobra.Command) error {
 
 	// Ask for the unlocker passphrase before creating the vault, so that
 	// stopping at the prompt leaves no vault without an unlocker behind
-	passphraseBuffer, err := resolvePassphrase()
+	passphraseBuffer, cleanupPassphrase, err := cli.resolvePassphrase()
 	if err != nil {
 		return err
 	}
-	defer passphraseBuffer.Destroy()
-
-	// Set mnemonic in environment for CreateVault to use
-	restoreMnemonicEnv := setMnemonicEnv(mnemonicStr)
-	defer restoreMnemonicEnv()
+	defer cleanupPassphrase()
 
 	// Create the default vault and derive its long-term key
-	vlt, ltIdentity, err := cli.setupDefaultVault(stateDir, mnemonicStr)
+	vlt, ltIdentity, err := cli.setupDefaultVault(stateDir, mnemonic)
 	if err != nil {
 		return err
 	}

internal/cli/integration_test.go

@@ -286,7 +286,7 @@ func TestSecretManagerIntegration(t *testing.T) {
 	// Test 25: Concurrent operations
 	// Purpose: Test multiple simultaneous operations
 	// Expected: Proper locking/synchronization, no corruption
-	test25ConcurrentOperations(t, testMnemonic, runSecret, runSecretWithEnv)
+	test25ConcurrentOperations(t, tempDir, secretPath, testMnemonic, runSecret)
 
 	// Test 26: Large secret values
 	// Purpose: Test with large secret values (e.g., certificates)
@@ -2009,28 +2009,35 @@ func test24EnvironmentVariables(t *testing.T, tempDir, secretPath, testMnemonic,
 	assert.Equal(t, "env-test-value", strings.TrimSpace(string(cmdOutput2)))
 }
 
-func test25ConcurrentOperations(t *testing.T, testMnemonic string, runSecret func(...string) (string, error), runSecretWithEnv func(map[string]string, ...string) (string, error)) {
+func test25ConcurrentOperations(t *testing.T, tempDir, secretPath, testMnemonic string, runSecret func(...string) (string, error)) {
 	t.Helper()
 
 	// Make sure we're in default vault
 	_, err := runSecret("vault", "select", "default")
 	require.NoError(t, err, "vault select should succeed")
 
-	// Run multiple concurrent reads
+	// Run multiple concurrent reads, as separate processes: within one
+	// process the first command to read the mnemonic would unset it for
+	// the others
 	const numReaders = 5
 
 	errCh := make(chan error, numReaders)
 
 	for i := range numReaders {
 		go func(id int) {
-			output, err := runSecretWithEnv(map[string]string{
-				secret.EnvMnemonic: testMnemonic,
-			}, "get", "database/password")
+			cmd := exec.CommandContext(t.Context(), secretPath, "get", "database/password")
+			cmd.Env = []string{
+				secret.EnvStateDir + "=" + tempDir,
+				secret.EnvMnemonic + "=" + testMnemonic,
+				"PATH=" + os.Getenv("PATH"),
+				"HOME=" + os.Getenv("HOME"),
+			}
+			output, err := cmd.Output()
 
 			switch {
 			case err != nil:
 				errCh <- fmt.Errorf("reader %d failed: %w", id, err)
-			case strings.TrimSpace(output) == "":
+			case strings.TrimSpace(string(output)) == "":
 				errCh <- fmt.Errorf("%w: reader %d", errEmptyValue, id)
 			default:
 				errCh <- nil

internal/cli/lock_test.go

@@ -52,15 +52,18 @@ func lockInBackground(t *testing.T, fs afero.Fs) <-chan func() {
 }
 
 // addAtOnce runs one add of the secret name per value, all at once, and
-// returns their errors.
+// returns their errors. Each add is given mnemonic, which a forced add
+// needs.
 func addAtOnce(
 	fs afero.Fs, stateDir, name string, force bool, values []string,
+	mnemonic *memguard.LockedBuffer,
 ) []error {
 	errs := make(chan error, len(values))
 
 	for _, value := range values {
 		go func() {
 			cli := NewCLIInstanceWithStateDir(fs, stateDir)
+			cli.Mnemonic = mnemonic
 			cli.cmd = &cobra.Command{}
 			cli.cmd.SetIn(strings.NewReader(value))
 
@@ -92,9 +95,9 @@ func numbered(prefix string, count int) []string {
 // forced adds read the same highest version number and overwrite each
 // other's version. With it they behave as if run one after another.
 //
-//nolint:paralleltest // t.Setenv forbids parallel subtests
+//nolint:paralleltest // times commands against the in-memory lock all tests share
 func TestConcurrentAddsKeepEveryVersion(t *testing.T) {
-	t.Setenv(secret.EnvMnemonic, testMnemonic)
+	mnemonic := testMnemonicBuffer(t)
 
 	const adds = 8
 
@@ -107,14 +110,14 @@ func TestConcurrentAddsKeepEveryVersion(t *testing.T) {
 		{"real", afero.NewOsFs(), t.TempDir()},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
-			_, err := vault.CreateVault(tc.fs, tc.stateDir, "default")
+			_, err := vault.CreateVault(tc.fs, tc.stateDir, "default", mnemonic)
 			require.NoError(t, err)
 
 			// One add creates the secret; the others find that it exists
 			created := 0
 
 			for _, err := range addAtOnce(tc.fs, tc.stateDir, "shared", false,
-				numbered("create", adds)) {
+				numbered("create", adds), mnemonic) {
 				if err == nil {
 					created++
 				} else {
@@ -126,13 +129,15 @@ func TestConcurrentAddsKeepEveryVersion(t *testing.T) {
 
 			// Every forced add stores a version of its own
 			for _, err := range addAtOnce(tc.fs, tc.stateDir, "shared", true,
-				numbered("force", adds)) {
+				numbered("force", adds), mnemonic) {
 				require.NoError(t, err)
 			}
 
 			vlt, err := vault.GetCurrentVault(tc.fs, tc.stateDir)
 			require.NoError(t, err)
 
+			vlt.Mnemonic = mnemonic
+
 			vaultDir, err := vlt.GetDirectory()
 			require.NoError(t, err)
 
@@ -176,11 +181,11 @@ func (r *readNotifier) Read(p []byte) (int, error) {
 // taken the state directory lock before reading, it would hold the lock
 // while waiting for encrypt's output, and encrypt would wait for the lock
 // to store its key: neither would finish.
+//
+//nolint:paralleltest // times commands against the in-memory lock all tests share
 func TestEncryptPipedIntoAdd(t *testing.T) {
-	t.Setenv(secret.EnvMnemonic, testMnemonic)
-
 	fs := afero.NewMemMapFs()
-	_, err := vault.CreateVault(fs, testStateDir, "default")
+	_, err := vault.CreateVault(fs, testStateDir, "default", testMnemonicBuffer(t))
 	require.NoError(t, err)
 	require.NoError(t, afero.WriteFile(fs, testInput, []byte("piped"), 0o600))
 
@@ -283,14 +288,16 @@ func setupEveryCommand(
 ) (string, string) {
 	t.Helper()
 
-	other, err := vault.CreateVault(fs, testStateDir, "other")
+	mnemonic := testMnemonicBuffer(t)
+
+	other, err := vault.CreateVault(fs, testStateDir, "other", mnemonic)
 	require.NoError(t, err)
 
 	otherDir, err := other.GetDirectory()
 	require.NoError(t, err)
 	require.NoError(t, fs.Remove(filepath.Join(otherDir, "pub.age")))
 
-	vlt, err := vault.CreateVault(fs, testStateDir, "work")
+	vlt, err := vault.CreateVault(fs, testStateDir, "work", mnemonic)
 	require.NoError(t, err)
 
 	addTestSecret(t, vlt, []byte("older"), false)
@@ -363,7 +370,12 @@ func requireWaitsForLock(
 	release = sync.OnceFunc(release)
 	defer release()
 
+	unlockPassphrase := memguard.NewBufferFromBytes([]byte(testPassphrase))
+	defer unlockPassphrase.Destroy()
+
 	cli := NewCLIInstanceWithStateDir(fs, testStateDir)
+	cli.Mnemonic = testMnemonicBuffer(t)
+	cli.UnlockPassphrase = unlockPassphrase
 	cli.cmd = &cobra.Command{}
 	cli.cmd.SetIn(strings.NewReader("value"))
 	cli.cmd.SetOut(io.Discard)
@@ -400,11 +412,8 @@ func requireWaitsForLock(
 // TestChangingCommandsWaitForLock checks that each command that changes the
 // state directory waits for its lock.
 //
-//nolint:paralleltest // t.Setenv forbids parallel subtests
+//nolint:paralleltest // waitingForLock sees any test's command waiting for the lock
 func TestChangingCommandsWaitForLock(t *testing.T) {
-	t.Setenv(secret.EnvMnemonic, testMnemonic)
-	t.Setenv(secret.EnvUnlockPassphrase, testPassphrase)
-
 	for _, tc := range []struct {
 		name         string
 		withUnlocker bool
@@ -468,15 +477,18 @@ func TestChangingCommandsWaitForLock(t *testing.T) {
 // TestEncryptWithExistingKeyTakesNoLock checks that secret encrypt with a
 // key that already exists, which only reads the state directory, finishes
 // while another command holds the state directory lock.
+//
+//nolint:paralleltest // times commands against the in-memory lock all tests share
 func TestEncryptWithExistingKeyTakesNoLock(t *testing.T) {
-	t.Setenv(secret.EnvMnemonic, testMnemonic)
+	mnemonic := testMnemonicBuffer(t)
 
 	fs := afero.NewMemMapFs()
-	_, err := vault.CreateVault(fs, testStateDir, "default")
+	_, err := vault.CreateVault(fs, testStateDir, "default", mnemonic)
 	require.NoError(t, err)
 	require.NoError(t, afero.WriteFile(fs, testInput, []byte("input"), 0o600))
 
 	encrypt := NewCLIInstanceWithStateDir(fs, testStateDir)
+	encrypt.Mnemonic = mnemonic
 	encrypt.cmd = &cobra.Command{}
 	encrypt.cmd.SetOut(io.Discard)
 
@@ -505,11 +517,11 @@ func TestEncryptWithExistingKeyTakesNoLock(t *testing.T) {
 // state directory lock by the time it writes its output. Holding it while
 // streaming would stall every other changing command for as long as the
 // stream lasts, and forever when the other end of the pipe is one of them.
+//
+//nolint:paralleltest // times commands against the in-memory lock all tests share
 func TestEncryptStreamsUnlocked(t *testing.T) {
-	t.Setenv(secret.EnvMnemonic, testMnemonic)
-
 	fs := afero.NewMemMapFs()
-	_, err := vault.CreateVault(fs, testStateDir, "default")
+	_, err := vault.CreateVault(fs, testStateDir, "default", testMnemonicBuffer(t))
 	require.NoError(t, err)
 	require.NoError(t, afero.WriteFile(fs, testInput, []byte("streamed"), 0o600))
 

internal/cli/move_test.go

@@ -6,7 +6,6 @@ import (
 	"testing"
 
 	"git.eeqj.de/sneak/secret/internal/cli"
-	"git.eeqj.de/sneak/secret/internal/secret"
 	"git.eeqj.de/sneak/secret/internal/vault"
 	"github.com/awnumar/memguard"
 	"github.com/spf13/afero"
@@ -20,9 +19,9 @@ import (
 // move within "work" left "work" the current vault. "default" is the current
 // vault in every case, and each case runs on its own copy of the state
 // directory.
-//
-//nolint:paralleltest // newTwoVaultFs uses t.Setenv
 func TestRejectedMoveWithinVaultLeavesStateUnchanged(t *testing.T) {
+	t.Parallel()
+
 	before := snapshotStateDir(t, newTwoVaultFs(t))
 	require.Equal(t, "default", before[testStateDir+"/currentvault"])
 
@@ -72,6 +71,8 @@ func TestRejectedMoveWithinVaultLeavesStateUnchanged(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.command, func(t *testing.T) {
+			t.Parallel()
+
 			fs := newFsFromSnapshot(t, before)
 			c := cli.NewCLIInstanceWithStateDir(fs, testStateDir)
 
@@ -86,9 +87,9 @@ func TestRejectedMoveWithinVaultLeavesStateUnchanged(t *testing.T) {
 // TestMoveWithinOtherVaultKeepsCurrentVault checks that `secret mv work:x
 // work:y`, with "default" the current vault, renames "x" to "y" in "work" and
 // leaves "default" the current vault.
-//
-//nolint:paralleltest // newTwoVaultFs uses t.Setenv
 func TestMoveWithinOtherVaultKeepsCurrentVault(t *testing.T) {
+	t.Parallel()
+
 	fs := newTwoVaultFs(t)
 	c := cli.NewCLIInstanceWithStateDir(fs, testStateDir)
 
@@ -111,10 +112,8 @@ func TestMoveWithinOtherVaultKeepsCurrentVault(t *testing.T) {
 // the secret "x", and the secrets.d of "other" is a link to that of
 // "default", so other:x is default:x. Each move must be rejected and leave
 // the secret and the links as they were.
-//
-//nolint:paralleltest // t.Setenv
 func TestMoveOntoSameSecretUnderAnotherNameIsRejected(t *testing.T) {
-	t.Setenv(secret.EnvMnemonic, testMnemonic)
+	t.Parallel()
 
 	const isSame = "is the same secret on this filesystem"
 
@@ -150,15 +149,17 @@ func TestMoveOntoSameSecretUnderAnotherNameIsRejected(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.command, func(t *testing.T) {
+			t.Parallel()
+
 			fs := afero.NewOsFs()
 			stateDir := t.TempDir()
 			vaultsDir := filepath.Join(stateDir, "vaults.d")
 
 			// "default" is created last, so it is the current vault.
-			_, err := vault.CreateVault(fs, stateDir, "other")
+			_, err := vault.CreateVault(fs, stateDir, "other", testMnemonicBuffer(t))
 			require.NoError(t, err)
 
-			vlt, err := vault.CreateVault(fs, stateDir, "default")
+			vlt, err := vault.CreateVault(fs, stateDir, "default", testMnemonicBuffer(t))
 			require.NoError(t, err)
 
 			err = vlt.AddSecret("x", memguard.NewBufferFromBytes([]byte("value")), false)
@@ -199,12 +200,12 @@ func TestMoveOntoSameSecretUnderAnotherNameIsRejected(t *testing.T) {
 // and "foo" are two secrets, `secret mv --force Foo foo` still replaces "foo"
 // with "Foo".
 func TestForcedCaseOnlyMoveOnCaseSensitiveFilesystem(t *testing.T) {
-	t.Setenv(secret.EnvMnemonic, testMnemonic)
+	t.Parallel()
 
 	fs := afero.NewOsFs()
 	stateDir := t.TempDir()
 
-	vlt, err := vault.CreateVault(fs, stateDir, "default")
+	vlt, err := vault.CreateVault(fs, stateDir, "default", testMnemonicBuffer(t))
 	require.NoError(t, err)
 
 	err = vlt.AddSecret("Foo", memguard.NewBufferFromBytes([]byte("upper")), false)

internal/cli/path_traversal_test.go

@@ -33,6 +33,17 @@ const (
 	missingFile = "/no/such/file"
 )
 
+// testMnemonicBuffer returns testMnemonic in a locked buffer that is
+// destroyed when the test ends.
+func testMnemonicBuffer(t *testing.T) *memguard.LockedBuffer {
+	t.Helper()
+
+	mnemonic := memguard.NewBufferFromBytes([]byte(testMnemonic))
+	t.Cleanup(mnemonic.Destroy)
+
+	return mnemonic
+}
+
 // The state directory newTwoVaultFs copies, recorded by snapshotStateDir.
 // Creating a passphrase unlocker is slow by design, so the vaults are made
 // once, by the first test that needs them.
@@ -52,13 +63,12 @@ var (
 func newTwoVaultFs(t *testing.T) afero.Fs {
 	t.Helper()
 
-	t.Setenv(secret.EnvMnemonic, testMnemonic)
-
 	twoVaultsOnce.Do(func() {
 		fs := afero.NewMemMapFs()
+		mnemonic := testMnemonicBuffer(t)
 
 		for _, name := range []string{"work", "default"} {
-			vlt, err := vault.CreateVault(fs, testStateDir, name)
+			vlt, err := vault.CreateVault(fs, testStateDir, name, mnemonic)
 			require.NoError(t, err)
 
 			err = vlt.AddSecret("x", memguard.NewBufferFromBytes([]byte("value")), false)
@@ -163,7 +173,7 @@ func requireRejectedAndUnchanged(
 // Moves and imports use --force, so that only the name check stands in
 // the way.
 //
-//nolint:paralleltest // newTwoVaultFs uses t.Setenv
+//nolint:paralleltest // the cases share cmd
 func TestInvalidSecretNameLeavesVaultsUnchanged(t *testing.T) {
 	// Creating a passphrase unlocker is slow by design, so the vaults are
 	// created once and each case runs on its own copy of them.
@@ -259,7 +269,7 @@ func TestInvalidSecretNameLeavesVaultsUnchanged(t *testing.T) {
 // `secret version rm x ""` every version of x. A version argument is
 // accepted only if it is one of the versions `secret version list` lists.
 //
-//nolint:paralleltest // newTwoVaultFs uses t.Setenv
+//nolint:paralleltest // the cases share cmd
 func TestInvalidVersionLeavesVaultsUnchanged(t *testing.T) {
 	before := snapshotStateDir(t, newTwoVaultFs(t))
 
@@ -297,15 +307,17 @@ func TestInvalidVersionLeavesVaultsUnchanged(t *testing.T) {
 // `secret vault import ..` wrote a long-term key and an unlocker into the
 // state directory itself, and `secret vault select ..` made it the current
 // vault. Each command that takes a vault name must reject an invalid one
-// before building a path from it. The mnemonic and the passphrase are set,
-// and moves and removals use --force, so that only the name check stands
-// in the way.
+// before building a path from it. The instance is given the mnemonic and
+// the passphrase, and moves and removals use --force, so that only the name
+// check stands in the way.
 //
-//nolint:paralleltest // newTwoVaultFs uses t.Setenv
+//nolint:paralleltest // the cases share cmd
 func TestInvalidVaultNameLeavesStateUnchanged(t *testing.T) {
 	before := snapshotStateDir(t, newTwoVaultFs(t))
 
-	t.Setenv(secret.EnvUnlockPassphrase, testPassphrase)
+	mnemonic := testMnemonicBuffer(t)
+	passphrase := memguard.NewBufferFromBytes([]byte(testPassphrase))
+	t.Cleanup(passphrase.Destroy)
 
 	cmd := &cobra.Command{}
 
@@ -338,7 +350,12 @@ func TestInvalidVaultNameLeavesStateUnchanged(t *testing.T) {
 		for _, name := range []string{"", ".", "..", "a/b"} {
 			t.Run(fmt.Sprintf(tt.command, name), func(t *testing.T) {
 				requireRejectedAndUnchanged(t, before, vault.ValidateVaultName(name),
-					func(c *cli.Instance) error { return tt.run(c, name) })
+					func(c *cli.Instance) error {
+						c.Mnemonic = mnemonic
+						c.UnlockPassphrase = passphrase
+
+						return tt.run(c, name)
+					})
 			})
 		}
 	}
@@ -347,14 +364,16 @@ func TestInvalidVaultNameLeavesStateUnchanged(t *testing.T) {
 // TestRemoveVersionRemovesOnlyThatVersion checks that `secret version rm`
 // with a version that is not the current one removes that version and
 // changes nothing else.
-//
-//nolint:paralleltest // newTwoVaultFs uses t.Setenv
 func TestRemoveVersionRemovesOnlyThatVersion(t *testing.T) {
+	t.Parallel()
+
 	fs := newTwoVaultFs(t)
 
 	vlt, err := vault.GetCurrentVault(fs, testStateDir)
 	require.NoError(t, err)
 
+	vlt.Mnemonic = testMnemonicBuffer(t)
+
 	// A second version of "x" becomes the current one.
 	err = vlt.AddSecret("x", memguard.NewBufferFromBytes([]byte("new")), true)
 	require.NoError(t, err)
@@ -388,9 +407,9 @@ func TestRemoveVersionRemovesOnlyThatVersion(t *testing.T) {
 // TestMoveToVaultNameRenamesInCurrentVault checks that `secret mv x work`,
 // where "work" is also the name of a vault, renames the secret "x" to "work"
 // in the current vault and changes nothing else.
-//
-//nolint:paralleltest // newTwoVaultFs uses t.Setenv
 func TestMoveToVaultNameRenamesInCurrentVault(t *testing.T) {
+	t.Parallel()
+
 	before := snapshotStateDir(t, newTwoVaultFs(t))
 	fs := newFsFromSnapshot(t, before)
 

internal/cli/secrets.go

@@ -81,6 +81,9 @@ func newAddCmd() *cobra.Command {
 
 			cli.cmd = cmd // Set the command for stdin access
 
+			destroySecrets := cli.readSecretEnv()
+			defer destroySecrets()
+
 			secret.Debug("Created CLI instance, calling AddSecret")
 
 			return cli.AddSecret(args[0], force)
@@ -111,6 +114,9 @@ func newGetCmd() *cobra.Command {
 				return fmt.Errorf("failed to initialize CLI: %w", err)
 			}
 
+			destroySecrets := cli.readSecretEnv()
+			defer destroySecrets()
+
 			// Without --version, get the current version. A given
 			// --version is checked as typed, so an empty one is rejected.
 			if !cmd.Flags().Changed("version") {
@@ -174,6 +180,9 @@ func newImportCmd() *cobra.Command {
 				return fmt.Errorf("failed to initialize CLI: %w", err)
 			}
 
+			destroySecrets := cli.readSecretEnv()
+			defer destroySecrets()
+
 			return cli.ImportSecret(cmd, args[0], sourceFile, force)
 		},
 	}
@@ -248,6 +257,9 @@ The source secret is deleted after successful copy.`,
 				return fmt.Errorf("failed to initialize CLI: %w", err)
 			}
 
+			destroySecrets := cli.readSecretEnv()
+			defer destroySecrets()
+
 			return cli.MoveSecret(cmd, args[0], args[1], force)
 		},
 	}
@@ -354,6 +366,8 @@ func (cli *Instance) AddSecret(secretName string, force bool) error {
 		return err
 	}
 
+	vlt.Mnemonic, vlt.UnlockPassphrase = cli.Mnemonic, cli.UnlockPassphrase
+
 	secret.Debug("Got current vault", "vault_name", vlt.GetName())
 
 	// Read secret value directly into protected buffers
@@ -420,6 +434,8 @@ func (cli *Instance) GetSecret(cmd *cobra.Command, secretName string) error {
 		return err
 	}
 
+	vlt.Mnemonic, vlt.UnlockPassphrase = cli.Mnemonic, cli.UnlockPassphrase
+
 	value, err := vlt.GetSecret(secretName)
 	if err != nil {
 		return err
@@ -448,6 +464,8 @@ func (cli *Instance) GetSecretWithVersion(
 		return err
 	}
 
+	vlt.Mnemonic, vlt.UnlockPassphrase = cli.Mnemonic, cli.UnlockPassphrase
+
 	// Get the secret value
 	value, err := vlt.GetSecretVersion(secretName, version)
 	if err != nil {
@@ -633,6 +651,8 @@ func (cli *Instance) ImportSecret(
 		return err
 	}
 
+	vlt.Mnemonic, vlt.UnlockPassphrase = cli.Mnemonic, cli.UnlockPassphrase
+
 	// Read secret value from the source file into protected buffers
 	file, err := cli.fs.Open(sourceFile)
 	if err != nil {
@@ -993,6 +1013,10 @@ func (cli *Instance) moveSecretCrossVault(
 			destVault.Name, destSecretName)
 	}
 
+	// Copying needs the long-term keys of both vaults
+	srcVault.Mnemonic, srcVault.UnlockPassphrase = cli.Mnemonic, cli.UnlockPassphrase
+	destVault.Mnemonic, destVault.UnlockPassphrase = cli.Mnemonic, cli.UnlockPassphrase
+
 	// Unlock destination vault (will fail if neither mnemonic nor unlocker available)
 	_, err = destVault.GetOrDeriveLongTermKey()
 	if err != nil {

internal/cli/secrets_size_test.go

@@ -10,7 +10,6 @@ import (
 	"strings"
 	"testing"
 
-	"git.eeqj.de/sneak/secret/internal/secret"
 	"git.eeqj.de/sneak/secret/internal/vault"
 	"git.eeqj.de/sneak/secret/pkg/agehd"
 	"github.com/spf13/afero"
@@ -71,11 +70,8 @@ func newSizeTestVault(t *testing.T) (afero.Fs, *vault.Vault) {
 
 	fs := afero.NewMemMapFs()
 
-	// Set test mnemonic
-	t.Setenv(secret.EnvMnemonic, testMnemonic)
-
 	// Create vault
-	_, err := vault.CreateVault(fs, testStateDir, testVaultName)
+	_, err := vault.CreateVault(fs, testStateDir, testVaultName, testMnemonicBuffer(t))
 	require.NoError(t, err)
 
 	// Set current vault
@@ -205,7 +201,7 @@ func runImportSecretSizeCase(t *testing.T, size int, wantErr bool, errMsg string
 
 // TestAddSecretVariousSizes tests adding secrets of various sizes through stdin
 //
-//nolint:paralleltest // subtests use t.Setenv via newSizeTestVault
+//nolint:paralleltest // together the subtests lock more than the memlock limit
 func TestAddSecretVariousSizes(t *testing.T) {
 	tests := []struct {
 		name        string
@@ -265,7 +261,7 @@ func TestAddSecretVariousSizes(t *testing.T) {
 
 // TestImportSecretVariousSizes tests importing secrets of various sizes from files
 //
-//nolint:paralleltest // subtests use t.Setenv via newSizeTestVault
+//nolint:paralleltest // together the subtests lock more than the memlock limit
 func TestImportSecretVariousSizes(t *testing.T) {
 	tests := []struct {
 		name        string
@@ -325,7 +321,7 @@ func TestImportSecretVariousSizes(t *testing.T) {
 
 // TestAddSecretBufferGrowth tests that our buffer growth strategy works correctly
 //
-//nolint:paralleltest // subtests use t.Setenv via newSizeTestVault
+//nolint:paralleltest // together the subtests lock more than the memlock limit
 func TestAddSecretBufferGrowth(t *testing.T) {
 	// Test various sizes that should trigger buffer growth
 	sizes := []int{
@@ -392,9 +388,9 @@ func TestAddSecretBufferGrowth(t *testing.T) {
 }
 
 // TestAddSecretStreamingBehavior tests that we handle streaming input correctly
-//
-//nolint:paralleltest // uses t.Setenv via newSizeTestVault
 func TestAddSecretStreamingBehavior(t *testing.T) {
+	t.Parallel()
+
 	fs, vlt := newSizeTestVault(t)
 
 	// Create a custom reader that simulates slow streaming input

internal/cli/unlockers.go

@@ -16,7 +16,6 @@ import (
 
 	"git.eeqj.de/sneak/secret/internal/secret"
 	"git.eeqj.de/sneak/secret/internal/vault"
-	"github.com/awnumar/memguard"
 	"github.com/spf13/afero"
 	"github.com/spf13/cobra"
 )
@@ -230,6 +229,9 @@ func newUnlockerAddCmd() *cobra.Command {
 				return fmt.Errorf("failed to initialize CLI: %w", err)
 			}
 
+			destroySecrets := cli.readSecretEnv()
+			defer destroySecrets()
+
 			unlockerType := args[0]
 
 			// Validate unlocker type
@@ -580,19 +582,19 @@ func (cli *Instance) addPassphraseUnlocker(cmd *cobra.Command) error {
 	// For passphrase unlockers, we don't need the vault to be unlocked
 	// The CreatePassphraseUnlocker method will handle getting the
 	// long-term key
+	vlt.Mnemonic, vlt.UnlockPassphrase = cli.Mnemonic, cli.UnlockPassphrase
 
-	// Check if passphrase is set in environment variable
-	var passphraseBuffer *memguard.LockedBuffer
-	if envPassphrase := os.Getenv(secret.EnvUnlockPassphrase); envPassphrase != "" {
-		passphraseBuffer = memguard.NewBufferFromBytes([]byte(envPassphrase))
-	} else {
+	// The new unlocker gets the passphrase from the environment, which also
+	// unlocks the current passphrase unlocker, else the one entered here
+	passphraseBuffer := cli.UnlockPassphrase
+	if passphraseBuffer == nil {
 		// Use secure passphrase input with confirmation
 		passphraseBuffer, err = readSecurePassphrase("Enter passphrase for unlocker: ")
 		if err != nil {
 			return fmt.Errorf("failed to read passphrase: %w", err)
 		}
+		defer passphraseBuffer.Destroy()
 	}
-	defer passphraseBuffer.Destroy()
 
 	passphraseUnlocker, err := vlt.CreatePassphraseUnlocker(passphraseBuffer)
 	if err != nil {
@@ -613,7 +615,8 @@ func (cli *Instance) addKeychainUnlocker(cmd *cobra.Command) error {
 		return errKeychainMacOSOnly
 	}
 
-	keychainUnlocker, err := secret.CreateKeychainUnlocker(cli.fs, cli.stateDir)
+	keychainUnlocker, err := secret.CreateKeychainUnlocker(
+		cli.fs, cli.stateDir, cli.Mnemonic, cli.UnlockPassphrase)
 	if err != nil {
 		return fmt.Errorf("failed to create macOS Keychain unlocker: %w", err)
 	}
@@ -643,7 +646,8 @@ func (cli *Instance) addSecureEnclaveUnlocker(cmd *cobra.Command) error {
 		return errSecureEnclaveMacOSOnly
 	}
 
-	seUnlocker, err := secret.CreateSecureEnclaveUnlocker(cli.fs, cli.stateDir)
+	seUnlocker, err := secret.CreateSecureEnclaveUnlocker(
+		cli.fs, cli.stateDir, cli.Mnemonic, cli.UnlockPassphrase)
 	if err != nil {
 		return fmt.Errorf("failed to create Secure Enclave unlocker: %w", err)
 	}
@@ -707,8 +711,8 @@ func (cli *Instance) addPGPUnlocker(cmd *cobra.Command) error {
 		return fmt.Errorf("GPG key %s %w", gpgKeyID, errGPGKeyAlreadyUnlocker)
 	}
 
-	pgpUnlocker, err := secret.CreatePGPUnlocker(
-		cli.fs, cli.stateDir, gpgKeyID, fingerprint)
+	pgpUnlocker, err := secret.CreatePGPUnlocker(cli.fs, cli.stateDir,
+		gpgKeyID, fingerprint, cli.Mnemonic, cli.UnlockPassphrase)
 	if err != nil {
 		return err
 	}

internal/cli/unlockers_add_test.go

@@ -5,7 +5,6 @@ import (
 	"path/filepath"
 	"testing"
 
-	"git.eeqj.de/sneak/secret/internal/secret"
 	"git.eeqj.de/sneak/secret/internal/vault"
 	"github.com/awnumar/memguard"
 	"github.com/spf13/afero"
@@ -24,28 +23,31 @@ const (
 
 // TestAddPGPUnlocker adds a PGP unlocker for a throwaway GPG key to a vault
 // with a passphrase unlocker, getting the vault's long-term key from the
-// mnemonic or, with the mnemonic unset, from the passphrase unlocker. It
-// then reads a secret with neither the mnemonic nor the passphrase set, so
+// mnemonic or, with no mnemonic given, from the passphrase unlocker. It
+// then reads a secret with neither the mnemonic nor the passphrase given, so
 // through the new unlocker, which the add selects.
+//
+//nolint:paralleltest // t.Setenv (GNUPGHOME) forbids parallel tests
 func TestAddPGPUnlocker(t *testing.T) {
 	newTestGPGKey(t)
 
+	passphrase := memguard.NewBufferFromBytes([]byte(testPassphrase))
+	t.Cleanup(passphrase.Destroy)
+
 	tests := []struct {
 		name string
-		// mnemonic is the mnemonic set while the unlocker is added.
-		mnemonic string
+		// mnemonic is the mnemonic given while the unlocker is added, or nil.
+		mnemonic *memguard.LockedBuffer
 	}{
-		{"long-term key from the mnemonic", testMnemonic},
-		{"long-term key from the current unlocker", ""},
+		{"long-term key from the mnemonic", testMnemonicBuffer(t)},
+		{"long-term key from the current unlocker", nil},
 	}
 
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			t.Setenv(secret.EnvMnemonic, testMnemonic)
-			t.Setenv(secret.EnvUnlockPassphrase, testPassphrase)
-
 			fs := afero.NewMemMapFs()
-			vlt, err := vault.CreateVault(fs, listTestStateDir, listTestVaultName)
+			vlt, err := vault.CreateVault(fs, listTestStateDir, listTestVaultName,
+				testMnemonicBuffer(t))
 			require.NoError(t, err)
 
 			err = vlt.AddSecret(addTestSecretName,
@@ -56,15 +58,13 @@ func TestAddPGPUnlocker(t *testing.T) {
 				memguard.NewBufferFromBytes([]byte(testPassphrase)))
 			require.NoError(t, err)
 
-			t.Setenv(secret.EnvMnemonic, test.mnemonic)
-
 			instance, cmd := newTestInstance(fs)
+			instance.Mnemonic = test.mnemonic
+			instance.UnlockPassphrase = passphrase
+
 			cmd.Flags().String("keyid", unreadableTestGPGUserID, "")
 			require.NoError(t, instance.UnlockersAdd(unlockerTypePGP, cmd))
 
-			t.Setenv(secret.EnvMnemonic, "")
-			t.Setenv(secret.EnvUnlockPassphrase, "")
-
 			reopened := vault.NewVault(fs, listTestStateDir, listTestVaultName)
 
 			current, err := reopened.GetCurrentUnlocker()

internal/cli/vault.go

@@ -5,7 +5,6 @@ import (
 	"errors"
 	"fmt"
 	"log"
-	"os"
 	"path/filepath"
 	"slices"
 	"strings"
@@ -85,6 +84,9 @@ func newVaultCreateCmd() *cobra.Command {
 				return fmt.Errorf("failed to initialize CLI: %w", err)
 			}
 
+			destroySecrets := cli.readSecretEnv()
+			defer destroySecrets()
+
 			return cli.CreateVault(cmd, args[0])
 		},
 	}
@@ -136,6 +138,9 @@ func newVaultImportCmd() *cobra.Command {
 				return fmt.Errorf("failed to initialize CLI: %w", err)
 			}
 
+			destroySecrets := cli.readSecretEnv()
+			defer destroySecrets()
+
 			return cli.VaultImport(cmd, vaultName)
 		},
 	}
@@ -228,28 +233,14 @@ func (cli *Instance) ListVaults(cmd *cobra.Command, jsonOutput bool) error {
 	return nil
 }
 
-// setMnemonicEnv sets the mnemonic environment variable and returns a
-// function that restores the previous value
-func setMnemonicEnv(mnemonicStr string) func() {
-	originalMnemonic := os.Getenv(secret.EnvMnemonic)
-	_ = os.Setenv(secret.EnvMnemonic, mnemonicStr)
-
-	return func() {
-		if originalMnemonic != "" {
-			_ = os.Setenv(secret.EnvMnemonic, originalMnemonic)
-		} else {
-			_ = os.Unsetenv(secret.EnvMnemonic)
-		}
-	}
-}
-
-// resolvePassphrase returns the unlock passphrase from the environment or
-// prompts the user for it with confirmation
-func resolvePassphrase() (*memguard.LockedBuffer, error) {
-	if envPassphrase := os.Getenv(secret.EnvUnlockPassphrase); envPassphrase != "" {
+// resolvePassphrase returns the unlock passphrase from the environment,
+// cli.UnlockPassphrase, or prompts the user for it with confirmation. The
+// returned cleanup function must be deferred by the caller.
+func (cli *Instance) resolvePassphrase() (*memguard.LockedBuffer, func(), error) {
+	if cli.UnlockPassphrase != nil {
 		secret.Debug("Using unlock passphrase from environment variable")
 
-		return memguard.NewBufferFromBytes([]byte(envPassphrase)), nil
+		return cli.UnlockPassphrase, func() {}, nil
 	}
 
 	secret.Debug("Prompting user for unlock passphrase")
@@ -257,10 +248,10 @@ func resolvePassphrase() (*memguard.LockedBuffer, error) {
 	// Use secure passphrase input with confirmation
 	passphraseBuffer, err := readSecurePassphrase("Enter passphrase for unlocker: ")
 	if err != nil {
-		return nil, fmt.Errorf("failed to read passphrase: %w", err)
+		return nil, nil, fmt.Errorf("failed to read passphrase: %w", err)
 	}
 
-	return passphraseBuffer, nil
+	return passphraseBuffer, passphraseBuffer.Destroy, nil
 }
 
 // CreateVault creates a new vault
@@ -273,30 +264,13 @@ func (cli *Instance) CreateVault(cmd *cobra.Command, name string) error {
 	}
 	defer release()
 
-	// Get or prompt for mnemonic
-	var mnemonicStr string
-
-	if envMnemonic := os.Getenv(secret.EnvMnemonic); envMnemonic != "" {
-		secret.Debug("Using mnemonic from environment variable")
-
-		mnemonicStr = envMnemonic
-	} else {
-		secret.Debug("Prompting user for mnemonic phrase")
-		// Read mnemonic securely without echo
-		mnemonicBuffer, err := secret.ReadPassphrase(
-			"Enter your BIP39 mnemonic phrase: ")
-		if err != nil {
-			secret.Debug("Failed to read mnemonic from stdin", "error", err)
-
-			return fmt.Errorf("failed to read mnemonic: %w", err)
-		}
-		defer mnemonicBuffer.Destroy()
-
-		mnemonicStr = mnemonicBuffer.String()
-
-		fmt.Fprintln(os.Stderr) // Add newline after hidden input
+	mnemonic, cleanupMnemonic, err := cli.promptMnemonic()
+	if err != nil {
+		return err
 	}
+	defer cleanupMnemonic()
 
+	mnemonicStr := mnemonic.String()
 	if mnemonicStr == "" {
 		return errMnemonicEmpty
 	}
@@ -311,18 +285,14 @@ func (cli *Instance) CreateVault(cmd *cobra.Command, name string) error {
 
 	// Ask for the unlocker passphrase before creating the vault, so that
 	// stopping at the prompt leaves no vault without an unlocker behind
-	passphraseBuffer, err := resolvePassphrase()
+	passphraseBuffer, cleanupPassphrase, err := cli.resolvePassphrase()
 	if err != nil {
 		return err
 	}
-	defer passphraseBuffer.Destroy()
-
-	// Set mnemonic in environment for CreateVault to use
-	restoreMnemonicEnv := setMnemonicEnv(mnemonicStr)
-	defer restoreMnemonicEnv()
+	defer cleanupPassphrase()
 
 	// Create the vault - it will handle key derivation internally
-	vlt, err := vault.CreateVault(cli.fs, cli.stateDir, name)
+	vlt, err := vault.CreateVault(cli.fs, cli.stateDir, name, mnemonic)
 	if err != nil {
 		return err
 	}
@@ -412,11 +382,12 @@ func (cli *Instance) vaultImportPreflight(
 	}
 
 	// Get mnemonic from environment
-	mnemonic := os.Getenv(secret.EnvMnemonic)
-	if mnemonic == "" {
+	if cli.Mnemonic == nil {
 		return "", "", "", errMnemonicEnvNotSet
 	}
 
+	mnemonic := cli.Mnemonic.String()
+
 	// Validate the mnemonic
 	mnemonicWords := strings.Fields(mnemonic)
 	secret.Debug("Validating BIP39 mnemonic", "word_count", len(mnemonicWords))
@@ -539,17 +510,13 @@ func (cli *Instance) importMnemonic(cmd *cobra.Command, vaultName string) error
 	}
 
 	// Get passphrase from environment variable
-	passphraseStr := os.Getenv(secret.EnvUnlockPassphrase)
-	if passphraseStr == "" {
+	passphraseBuffer := cli.UnlockPassphrase
+	if passphraseBuffer == nil {
 		return errPassphraseEnvNotSet
 	}
 
 	secret.Debug("Using unlock passphrase from environment variable")
 
-	// Create secure buffer for passphrase
-	passphraseBuffer := memguard.NewBufferFromBytes([]byte(passphraseStr))
-	defer passphraseBuffer.Destroy()
-
 	// Unlock the vault with the derived long-term key
 	vlt.Unlock(ltIdentity)
 

internal/cli/version.go

@@ -54,6 +54,9 @@ func VersionCommands(cli *Instance) *cobra.Command {
 		Args:              cobra.ExactArgs(1),
 		ValidArgsFunction: getSecretNamesCompletionFunc(cli.fs, cli.stateDir),
 		RunE: func(cmd *cobra.Command, args []string) error {
+			destroySecrets := cli.readSecretEnv()
+			defer destroySecrets()
+
 			return cli.ListVersions(cmd, args[0])
 		},
 	}
@@ -172,6 +175,8 @@ func (cli *Instance) ListVersions(cmd *cobra.Command, secretName string) error {
 		currentVersion = ""
 	}
 
+	vlt.Mnemonic, vlt.UnlockPassphrase = cli.Mnemonic, cli.UnlockPassphrase
+
 	// Get long-term key for decrypting metadata
 	ltIdentity, err := vlt.GetOrDeriveLongTermKey()
 	if err != nil {

internal/cli/version_test.go

@@ -45,6 +45,17 @@ const (
 	testStateDir = "/test/state"
 )
 
+// testMnemonicBuffer returns testMnemonic in a locked buffer that is
+// destroyed when the test ends.
+func testMnemonicBuffer(t *testing.T) *memguard.LockedBuffer {
+	t.Helper()
+
+	mnemonic := memguard.NewBufferFromBytes([]byte(testMnemonic))
+	t.Cleanup(mnemonic.Destroy)
+
+	return mnemonic
+}
+
 // Helper function to add a version of the "test/secret" secret to the
 // vault with proper buffer protection
 func addTestSecret(t *testing.T, vlt *vault.Vault, value []byte, force bool) {
@@ -61,11 +72,8 @@ func addTestSecret(t *testing.T, vlt *vault.Vault, value []byte, force bool) {
 func setupTestVault(t *testing.T, fs afero.Fs) {
 	t.Helper()
 
-	// Set mnemonic for testing
-	t.Setenv(secret.EnvMnemonic, testMnemonic)
-
 	// Create vault
-	vlt, err := vault.CreateVault(fs, testStateDir, "default")
+	vlt, err := vault.CreateVault(fs, testStateDir, "default", testMnemonicBuffer(t))
 	require.NoError(t, err)
 
 	// Derive and store long-term key from mnemonic
@@ -83,11 +91,13 @@ func setupTestVault(t *testing.T, fs afero.Fs) {
 	require.NoError(t, err)
 }
 
-//nolint:paralleltest // uses t.Setenv via setupTestVault
 func TestListVersionsCommand(t *testing.T) {
+	t.Parallel()
+
 	fs := afero.NewMemMapFs()
 	stateDir := testStateDir
 	cli := NewCLIInstanceWithStateDir(fs, stateDir)
+	cli.Mnemonic = testMnemonicBuffer(t)
 
 	// Set up vault with long-term key
 	setupTestVault(t, fs)
@@ -96,6 +106,8 @@ func TestListVersionsCommand(t *testing.T) {
 	vlt, err := vault.GetCurrentVault(fs, stateDir)
 	require.NoError(t, err)
 
+	vlt.Mnemonic = cli.Mnemonic
+
 	addTestSecret(t, vlt, []byte("version-1"), false)
 
 	time.Sleep(10 * time.Millisecond)
@@ -139,8 +151,9 @@ func TestListVersionsCommand(t *testing.T) {
 	assert.Equal(t, 2, versionLines)
 }
 
-//nolint:paralleltest // uses t.Setenv via setupTestVault
 func TestListVersionsNonExistentSecret(t *testing.T) {
+	t.Parallel()
+
 	fs := afero.NewMemMapFs()
 	stateDir := testStateDir
 	cli := NewCLIInstanceWithStateDir(fs, stateDir)
@@ -161,8 +174,9 @@ func TestListVersionsNonExistentSecret(t *testing.T) {
 	assert.Contains(t, err.Error(), "not found")
 }
 
-//nolint:paralleltest // uses t.Setenv via setupTestVault
 func TestPromoteVersionCommand(t *testing.T) {
+	t.Parallel()
+
 	fs := afero.NewMemMapFs()
 	stateDir := testStateDir
 	cli := NewCLIInstanceWithStateDir(fs, stateDir)
@@ -174,6 +188,8 @@ func TestPromoteVersionCommand(t *testing.T) {
 	vlt, err := vault.GetCurrentVault(fs, stateDir)
 	require.NoError(t, err)
 
+	vlt.Mnemonic = testMnemonicBuffer(t)
+
 	addTestSecret(t, vlt, []byte("version-1"), false)
 
 	time.Sleep(10 * time.Millisecond)
@@ -224,8 +240,9 @@ func TestPromoteVersionCommand(t *testing.T) {
 	assert.Equal(t, []byte("version-1"), promoted.Bytes())
 }
 
-//nolint:paralleltest // uses t.Setenv via setupTestVault
 func TestPromoteNonExistentVersion(t *testing.T) {
+	t.Parallel()
+
 	fs := afero.NewMemMapFs()
 	stateDir := testStateDir
 	cli := NewCLIInstanceWithStateDir(fs, stateDir)
@@ -252,11 +269,13 @@ func TestPromoteNonExistentVersion(t *testing.T) {
 	assert.Contains(t, err.Error(), "not found")
 }
 
-//nolint:paralleltest // uses t.Setenv via setupTestVault
 func TestGetSecretWithVersion(t *testing.T) {
+	t.Parallel()
+
 	fs := afero.NewMemMapFs()
 	stateDir := testStateDir
 	cli := NewCLIInstanceWithStateDir(fs, stateDir)
+	cli.Mnemonic = testMnemonicBuffer(t)
 
 	// Set up vault with long-term key
 	setupTestVault(t, fs)
@@ -265,6 +284,8 @@ func TestGetSecretWithVersion(t *testing.T) {
 	vlt, err := vault.GetCurrentVault(fs, stateDir)
 	require.NoError(t, err)
 
+	vlt.Mnemonic = cli.Mnemonic
+
 	addTestSecret(t, vlt, []byte("version-1"), false)
 
 	time.Sleep(10 * time.Millisecond)
@@ -298,10 +319,12 @@ func TestGetSecretWithVersion(t *testing.T) {
 	assert.Equal(t, "version-1", buf.String())
 }
 
-//nolint:paralleltest // uses t.Setenv via setupTestVault
 func TestGetSecretWritesBinaryValue(t *testing.T) {
+	t.Parallel()
+
 	fs := afero.NewMemMapFs()
 	cli := NewCLIInstanceWithStateDir(fs, testStateDir)
+	cli.Mnemonic = testMnemonicBuffer(t)
 
 	setupTestVault(t, fs)
 
@@ -361,8 +384,9 @@ func TestVersionCommandStructure(t *testing.T) {
 	assert.Equal(t, "Promote a specific version to current", promoteCmd.Short)
 }
 
-//nolint:paralleltest // uses t.Setenv via setupTestVault
 func TestListVersionsEmptyOutput(t *testing.T) {
+	t.Parallel()
+
 	fs := afero.NewMemMapFs()
 	stateDir := testStateDir
 	cli := NewCLIInstanceWithStateDir(fs, stateDir)