Check errors by identity, not by message text, in tests (closes #49)

Tests that asserted a failure by a fragment of its message now use
errors.Is: a refactor returning the wrong error, or wrapping with %v
instead of %w, now fails them. New tests return each exported error of
internal/vault and pkg/bip85 that no test returned, and check wrapped
causes (os.ErrNotExist, ErrMnemonicMismatch through GetSecret,
ErrInvalidPathComponent through DeriveBIP85Entropy). The 999-versions
test moves into package secret to name its unexported error. Checks of
errors no test can name keep their text; they are listed on the issue.

Model: opus-5-5

AGENTS.md

@@ -4,154 +4,160 @@ Version: 2025-06-08
 
 # Instructions and Contextual Information
 
-* Be direct, robotic, expert, accurate, and professional.
+- Be direct, robotic, expert, accurate, and professional.
 
-* Do not butter me up or kiss my ass.
+- Do not butter me up or kiss my ass.
 
-* Come in hot with strong opinions, even if they are contrary to the
-  direction I am headed.
+- Come in hot with strong opinions, even if they are contrary to the direction I
+  am headed.
 
-* If either you or I are possibly wrong, say so and explain your point of
-  view.
+- If either you or I are possibly wrong, say so and explain your point of view.
 
-* Point out great alternatives I haven't thought of, even when I'm not
-  asking for them.
+- Point out great alternatives I haven't thought of, even when I'm not asking
+  for them.
 
-* Treat me like the world's leading expert in every situation and every
+- Treat me like the world's leading expert in every situation and every
   conversation, and deliver the absolute best recommendations.
 
-* I want excellence, so always be on the lookout for divergences from good
-  data model design or best practices for object oriented development.
+- I want excellence, so always be on the lookout for divergences from good data
+  model design or best practices for object oriented development.
 
-* IMPORTANT: This is production code, not a research or teaching exercise.
+- IMPORTANT: This is production code, not a research or teaching exercise.
   Deliver professional-level results, not prototypes.
 
-* Please read and understand the `README.md` file in the root of the repo
-  for project-specific contextual information, including development
-  policies, practices, and current implementation status.
+- Please read and understand the `README.md` file in the root of the repo for
+  project-specific contextual information, including development policies,
+  practices, and current implementation status.
 
-* Be proactive in suggesting improvements or refactorings in places where we
+- Be proactive in suggesting improvements or refactorings in places where we
   diverge from best practices for clean, modular, maintainable code.
 
 # Policies
 
 1. Before committing, tests must pass (`make test`), linting must pass
-   (`make lint`), and code must be formatted (`make fmt`).  For go, those
+   (`make lint`), and code must be formatted (`make fmt`). For go, those
    makefile targets should use `go fmt` and `go test -v ./...` and
-   `golangci-lint run`.  When you think your changes are complete, rather
-   than making three different tool calls to check, you can just run `make
-   test && make fmt && make lint` as a single tool call which will save
+   `golangci-lint run`. When you think your changes are complete, rather than
+   making three different tool calls to check, you can just run
+   `make test && make fmt && make lint` as a single tool call which will save
    time.
 
-2. Always write a `Makefile` with the default target being `test`, and with
-   a `fmt` target that formats the code.  The `test` target should run all
-   tests in the project, and the `fmt` target should format the code.
-   `test` should also have a prerequisite target `lint` that should run any
-   linters that are configured for the project.
+2. Always write a `Makefile` with the default target being `test`, and with a
+   `fmt` target that formats the code. The `test` target should run all tests in
+   the project, and the `fmt` target should format the code. `test` should also
+   have a prerequisite target `lint` that should run any linters that are
+   configured for the project.
 
-3. After each completed bugfix or feature, the code must be committed.  Do
-   all of the pre-commit checks (test, lint, fmt) before committing, of
-   course.
+3. After each completed bugfix or feature, the code must be committed. Do all of
+   the pre-commit checks (test, lint, fmt) before committing, of course.
 
 4. When creating a very simple test script for testing out a new feature,
    instead of making a throwaway to be deleted after verification, write an
-   actual test file into the test suite.  It doesn't need to be very big or
+   actual test file into the test suite. It doesn't need to be very big or
    complex, but it should be a real test that can be run.
 
 5. When you are instructed to make the tests pass, DO NOT delete tests, skip
-   tests, or change the tests specifically to make them pass (unless there
-   is a bug in the test).  This is cheating, and it is bad.  You should only
-   be modifying the test if it is incorrect or if the test is no longer
-   relevant.  In almost all cases, you should be fixing the code that is
-   being tested, or updating the tests to match a refactored implementation.
+   tests, or change the tests specifically to make them pass (unless there is a
+   bug in the test). This is cheating, and it is bad. You should only be
+   modifying the test if it is incorrect or if the test is no longer relevant.
+   In almost all cases, you should be fixing the code that is being tested, or
+   updating the tests to match a refactored implementation.
 
 6. When dealing with dates and times or timestamps, always use, display, and
-   store UTC.  Set the local timezone to UTC on startup.  If the user needs
-   to see the time in a different timezone, store the user's timezone in a
-   separate field and convert the UTC time to the user's timezone when
-   displaying it.  For internal use and internal applications and
-   administrative purposes, always display UTC.
+   store UTC. Set the local timezone to UTC on startup. If the user needs to see
+   the time in a different timezone, store the user's timezone in a separate
+   field and convert the UTC time to the user's timezone when displaying it. For
+   internal use and internal applications and administrative purposes, always
+   display UTC.
 
 7. Always write tests, even if they are extremely simple and just check for
-   correct syntax (ability to compile/import). If you are writing a new
-   feature, write a test for it.  You don't need to target complete
-   coverage, but you should at least test any new functionality you add.  If
-   you are fixing a bug, write a test first that reproduces the bug, and
-   then fix the bug in the code.
+   correct syntax (ability to compile/import). If you are writing a new feature,
+   write a test for it. You don't need to target complete coverage, but you
+   should at least test any new functionality you add. If you are fixing a bug,
+   write a test first that reproduces the bug, and then fix the bug in the code.
 
-8. When implementing new features, be aware of potential side-effects (such
-   as state files on disk, data in the database, etc.) and ensure that it is
+8. When implementing new features, be aware of potential side-effects (such as
+   state files on disk, data in the database, etc.) and ensure that it is
    possible to mock or stub these side-effects in tests.
 
-9. Always use structured logging.  Log any relevant state/context with the
-   messages (but do not log secrets).  If stdout is not a terminal, output
-   the structured logs in jsonl format.
+9. Always use structured logging. Log any relevant state/context with the
+   messages (but do not log secrets). If stdout is not a terminal, output the
+   structured logs in jsonl format.
 
 10. Avoid using bare strings or numbers in code, especially if they appear
-    anywhere more than once.  Always define a constant (usually at the top
-    of the file) and give it a descriptive name, then use that constant in
-    the code instead of the bare string or number.
+    anywhere more than once. Always define a constant (usually at the top of the
+    file) and give it a descriptive name, then use that constant in the code
+    instead of the bare string or number.
 
 11. You do not need to summarize your changes in the chat after making them.
-    Making the changes and committing them is sufficient.  If anything out
-    of the ordinary happened, please explain it, but in the normal case
-    where you found and fixed the bug, or implemented the feature, there is
-    no need for the end-of-change summary.
+    Making the changes and committing them is sufficient. If anything out of the
+    ordinary happened, please explain it, but in the normal case where you found
+    and fixed the bug, or implemented the feature, there is no need for the
+    end-of-change summary.
 
-12. Do not create additional files in the root directory of the project
-    without asking permission first. Configuration files, documentation, and
-    build files are acceptable in the root, but source code and other files
-    should be organized in appropriate subdirectories.
+12. Do not create additional files in the root directory of the project without
+    asking permission first. Configuration files, documentation, and build files
+    are acceptable in the root, but source code and other files should be
+    organized in appropriate subdirectories.
 
 ## Python-Specific Guidelines
 
-1. **Type Annotations (UP006)**: Use built-in collection types directly for type annotations instead of importing from `typing`. This avoids the UP006 linter error.
-   
-   **Good (modern Python 3.9+):**
-   ```python
-   def process_items(items: list[str]) -> dict[str, int]:
-       counts: dict[str, int] = {}
-       return counts
-   ```
-   
-   **Avoid (triggers UP006):**
-   ```python
-   from typing import List, Dict
-   
-   def process_items(items: List[str]) -> Dict[str, int]:
-       counts: Dict[str, int] = {}
-       return counts
-   ```
-   
-   For optional types, use the `|` operator instead of `Union`:
-   ```python
-   # Good
-   def get_value(key: str) -> str | None:
-       return None
-   
-   # Avoid
-   from typing import Optional, Union
-   def get_value(key: str) -> Optional[str]:
-       return None
-   ```
+1. **Type Annotations (UP006)**: Use built-in collection types directly for type
+   annotations instead of importing from `typing`. This avoids the UP006 linter
+   error.
+
+    **Good (modern Python 3.9+):**
+
+    ```python
+    def process_items(items: list[str]) -> dict[str, int]:
+        counts: dict[str, int] = {}
+        return counts
+    ```
+
+    **Avoid (triggers UP006):**
+
+    ```python
+    from typing import List, Dict
+
+    def process_items(items: List[str]) -> Dict[str, int]:
+        counts: Dict[str, int] = {}
+        return counts
+    ```
+
+    For optional types, use the `|` operator instead of `Union`:
+
+    ```python
+    # Good
+    def get_value(key: str) -> str | None:
+        return None
+
+    # Avoid
+    from typing import Optional, Union
+    def get_value(key: str) -> Optional[str]:
+        return None
+    ```
 
 2. **Import Organization**: Follow the standard Python import order:
-   - Standard library imports
-   - Third-party imports
-   - Local application imports
-   
-   Each group should be separated by a blank line.
+    - Standard library imports
+    - Third-party imports
+    - Local application imports
+
+    Each group should be separated by a blank line.
 
 ## Go-Specific Guidelines
 
-1. **No `panic`, `log.Fatal`, or `os.Exit` in library code.** Always propagate errors via return values.
+1. **No `panic`, `log.Fatal`, or `os.Exit` in library code.** Always propagate
+   errors via return values.
 
-2. **Constructors return `(*T, error)`, not just `*T`.** Callers must handle errors, not crash.
+2. **Constructors return `(*T, error)`, not just `*T`.** Callers must handle
+   errors, not crash.
 
 3. **Wrap errors** with `fmt.Errorf("context: %w", err)` for debuggability.
 
-4. **Never modify linter config** (`.golangci.yml`) to suppress findings. Fix the code.
+4. **Never modify linter config** (`.golangci.yml`) to suppress findings. Fix
+   the code.
 
-5. **All PRs must pass `make check` with zero failures.** No exceptions, no "pre-existing issue" excuses.
+5. **All PRs must pass `make check` with zero failures.** No exceptions, no
+   "pre-existing issue" excuses.
 
 6. **Pin external dependencies by commit hash**, not mutable tags.

README.md

@@ -1,75 +1,90 @@
 # secret - Local Secret Manager
 
-secret is a command-line local secret manager that implements a hierarchical
-key architecture for storing and managing sensitive data. It supports
-multiple vaults, various unlock mechanisms, and provides secure storage
-using the `age` encryption library.
+## Description
 
-It could be used as password manager, but was not designed as such.  I
-created it to scratch an itch for a secure key/value store for replacing a
-bunch of pgp-encrypted files in a directory structure.
+`secret` is a WTFPL-licensed Go command-line local secret manager by
+[@sneak](https://sneak.berlin) that implements a hierarchical key architecture
+for storing and managing sensitive data. It supports multiple vaults, various
+unlock mechanisms, and provides secure storage using the `age` encryption
+library.
 
-## Core Architecture
+## Getting Started
+
+Build from source, then install the binary as `~/bin/secret`:
+
+```bash
+git clone https://git.eeqj.de/sneak/secret.git
+cd secret
+make build     # writes the binary to ./secret
+make install   # builds it and copies it to ~/bin/secret
+```
+
+Generate a mnemonic, create the default vault, then store and read a secret:
+
+```bash
+secret generate mnemonic   # prints a new BIP39 mnemonic; write it down
+secret init                # asks for that mnemonic and an unlocker passphrase
+echo "my-password" | secret add myservice/password
+secret get myservice/password
+```
+
+## Rationale
+
+I created `secret` to scratch an itch: I wanted a secure key/value store to
+replace a bunch of PGP-encrypted files in a directory structure. It could be
+used as a password manager, but was not designed as one.
+
+## Design
 
 ### Three-Layer Key Hierarchy
 
 Secret implements a three-layer key architecture:
 
-1. **Long-term Keys**: Derived from BIP39 mnemonic phrases, these provide
-   the foundation for all encryption
-2. **Unlockers**: Short-term keys that encrypt the long-term keys,
-   supporting multiple authentication methods
-3. **Version-specific Keys**: Per-version keys that encrypt individual
-   secret values
+1. **Long-term Keys**: Derived from BIP39 mnemonic phrases, these provide the
+   foundation for all encryption
+2. **Unlockers**: Short-term keys that encrypt the long-term keys, supporting
+   multiple authentication methods
+3. **Version-specific Keys**: Per-version keys that encrypt individual secret
+   values
 
 ### Version Management
 
 Each secret maintains a history of versions, with each version having:
+
 - Its own encryption key pair
-- Metadata (unencrypted) including creation time and validity period
+- Metadata including creation time and validity period, encrypted to the
+  version's key pair
 - Immutable value storage
-- Atomic version switching via symlink updates
+
+The secret's `current` file names its current version. Switching versions
+replaces that file in one rename, so it is never half-written.
 
 ### Vault System
 
-Vaults provide logical separation of secrets, each with its own long-term
-key and unlocker set. This allows for complete isolation between different
-contexts (work, personal, projects).
-
-## Installation
-
-Build from source:
-```bash
-git clone <repository>
-cd secret
-make build
-```
-
-## Quick Start
-
-1. **Initialize the secret manager**:
-   ```bash
-   secret init
-   ```
-   This creates the default vault and prompts for a BIP39 mnemonic phrase.
-
-2. **Generate a mnemonic** (if needed):
-   ```bash
-   secret generate mnemonic
-   ```
-
-3. **Add a secret**:
-   ```bash
-   echo "my-password" | secret add myservice/password
-   ```
-
-4. **Retrieve a secret**:
-   ```bash
-   secret get myservice/password
-   ```
+Vaults provide logical separation of secrets, each with its own long-term key
+and unlocker set. This allows for complete isolation between different contexts
+(work, personal, projects).
 
 ## Commands Reference
 
+### Confirmation Before Removal
+
+`secret rm`, `secret version rm`, `secret vault remove` and
+`secret unlocker remove` destroy data that exists nowhere else. On a terminal
+each one first asks `[y/N]`, naming exactly what it is about to remove, and goes
+ahead only on `y` or `yes`; any other answer, a bare Enter included, cancels and
+removes nothing. The question is asked only after the command's checks have
+passed, and before it changes anything.
+
+Whether to ask is decided by stdin, where the answer is read from, so
+`secret rm foo | tee log` still asks. When stdin is not a terminal, as in a
+script or a CI job, nobody is there to answer: the command fails at once,
+removes nothing, and says to pass `--force`.
+
+`--force` (`-f`) removes without asking, whatever the command removes: a vault
+that holds secrets and the last unlocker of a vault included. Scripts that
+remove things pass `--force`.
+
 ### Initialization
 
 #### `secret init`
@@ -78,6 +93,7 @@ Initializes the secret manager with a default vault. Prompts for a BIP39
 mnemonic phrase and creates the initial directory structure.
 
 **Environment Variables:**
+
 - `SB_SECRET_MNEMONIC`: Pre-set mnemonic phrase
 - `SB_UNLOCK_PASSPHRASE`: Pre-set unlock passphrase
 
@@ -100,13 +116,13 @@ Switches to the specified vault for subsequent operations.
 
 #### `secret vault remove <name> [--force]` / `secret vault rm` ⚠️ 🛑
 
-**DANGER**: Permanently removes a vault and all its secrets. Like Unix `rm`,
-this command does not ask for confirmation.
+**DANGER**: Permanently removes a vault and all its secrets. It first asks for
+confirmation, naming the vault and how many secrets it holds (see
+[Confirmation Before Removal](#confirmation-before-removal)). The last vault
+cannot be removed. Removing the current vault makes another vault the current
+one.
 
-Requires --force if the vault contains secrets. With --force, will
-automatically switch to another vault if removing the current one.
-
-- `--force, -f`: Force removal even if vault contains secrets
+- `--force, -f`: Remove without asking, also a vault that contains secrets
 - **NO RECOVERY**: All secrets in the vault will be permanently deleted
 
 ### Secret Management
@@ -114,54 +130,66 @@ automatically switch to another vault if removing the current one.
 #### `secret add <secret-name> [--force]`
 
 Adds a secret to the current vault. Reads the secret value from stdin.
+
 - `--force, -f`: Overwrite existing secret
 
-**Secret Name Format:** only ASCII letters, digits, `.`, `-`, `_` and `/`
-are allowed, and a name must not be empty, start with `.` or `/`, end with
-`/`, contain `//`, or have `..` as a path segment.
+**Secret Name Format:** only ASCII letters, digits, `.`, `-`, `_` and `/` are
+allowed, and a name must not be empty, start with `.` or `/`, end with `/`,
+contain `//`, or have `..` as a path segment.
+
 - Forward slashes (`/`) are converted to percent signs (`%`) for storage
 - Examples: `database/password`, `api.key`, `ssh_private_key`
 
 #### `secret get <secret-name> [--version <version>]`
 
 Retrieves and outputs a secret value to stdout.
+
 - `--version, -v`: Get a specific version (default: current)
 
 #### `secret list [filter] [--json]` / `secret ls`
 
-Lists all secrets in the current vault. Optional filter for substring
-matching.
+Lists all secrets in the current vault. Optional filter for substring matching.
 
-#### `secret remove <secret-name>` / `secret rm` ⚠️ 🛑
+#### `secret remove <secret-name> [--force]` / `secret rm` ⚠️ 🛑
 
-**DANGER**: Permanently removes a secret and ALL its versions. Like Unix `rm`, this command does not ask for confirmation.
+**DANGER**: Permanently removes a secret and ALL its versions. It first asks for
+confirmation, naming the secret, its vault and how many versions it has (see
+[Confirmation Before Removal](#confirmation-before-removal)).
+
+- `--force, -f`: Remove without asking
 - **NO RECOVERY**: Once removed, the secret cannot be recovered
-- **ALL VERSIONS DELETED**: Every version of the secret will be permanently deleted
+- **ALL VERSIONS DELETED**: Every version of the secret will be permanently
+  deleted
 
 #### `secret move <source> <destination>` / `secret mv` / `secret rename`
 
 Moves or renames a secret within the current vault.
+
 - Fails if the destination already exists
-- Fails if the destination is the source under another name, such as `foo`
-  for `Foo` on a case-insensitive filesystem (the macOS default); there, to
-  change only the case of a name, move the secret to a third name first
+- Fails if the destination is the source under another name, such as `foo` for
+  `Foo` on a case-insensitive filesystem (the macOS default); there, to change
+  only the case of a name, move the secret to a third name first
 - Preserves all versions and metadata
 
 ### Version Management
 
 #### `secret version list <secret-name>` / `secret version ls`
 
-Lists all versions of a secret showing creation time, status, and validity period.
+Lists all versions of a secret showing creation time, status, and validity
+period.
 
 #### `secret version promote <secret-name> <version>`
 
-Promotes a specific version to current by updating the symlink. Does not
-modify any timestamps, allowing for rollback scenarios.
+Promotes a specific version to current by rewriting the secret's `current` file
+to name it. Does not modify any timestamps, allowing for rollback scenarios.
 
-#### `secret version remove <secret-name> <version>` / `secret version rm` ⚠️ 🛑
+#### `secret version remove <secret-name> <version> [--force]` / `secret version rm` ⚠️ 🛑
 
-**DANGER**: Permanently removes a specific version of a secret. Like Unix
-`rm`, this command does not ask for confirmation.
+**DANGER**: Permanently removes a specific version of a secret. It first asks
+for confirmation, naming the version, the secret and its vault (see
+[Confirmation Before Removal](#confirmation-before-removal)).
+
+- `--force, -f`: Remove without asking
 - **NO RECOVERY**: Once removed, this version cannot be recovered
 - Cannot remove the current version (must promote another version first)
 
@@ -174,6 +202,7 @@ Generates a cryptographically secure BIP39 mnemonic phrase.
 #### `secret generate secret <name> [--length=16] [--type=base58] [--force]`
 
 Generates and stores a random secret.
+
 - `--length, -l`: Length of generated secret (default: 16)
 - `--type, -t`: Type of secret (`base58`, `alnum`)
 - `--force, -f`: Overwrite existing secret
@@ -182,32 +211,40 @@ Generates and stores a random secret.
 
 #### `secret unlocker list [--json]` / `secret unlocker ls`
 
-Lists all unlockers in the current vault with their metadata.
+Lists all unlockers in the current vault with their metadata. An unlocker's ID,
+which `secret unlocker select` and `secret unlocker remove` take, is the name of
+its directory in `unlockers.d`.
 
 #### `secret unlocker add <type> [options]`
 
 Creates a new unlocker of the specified type:
 
 **Types:**
+
 - `passphrase`: Traditional passphrase-protected unlocker
 - `pgp`: Uses an existing GPG key for encryption/decryption
 - `keychain`: macOS Keychain integration (macOS only)
 - `secure-enclave`: Hardware-backed Secure Enclave protection (macOS only)
 
 **Options:**
-- `--keyid <id>`: GPG key ID (optional for PGP type, uses default key if not specified)
 
-A vault has one passphrase unlocker: adding one replaces the one the vault
-has, which is removed only once the new one is the current unlocker.
+- `--keyid <id>`: GPG key ID (optional for PGP type, uses default key if not
+  specified)
+
+A vault has one passphrase unlocker: adding one replaces the one the vault has,
+which is removed only once the new one is the current unlocker.
 
 #### `secret unlocker remove <unlocker-id> [--force]` / `secret unlocker rm` ⚠️ 🛑
 
-**DANGER**: Permanently removes an unlocker. Like Unix `rm`, this command
-does not ask for confirmation.  Cannot remove the last unlocker if the vault
-has secrets unless --force is used. An unlocker directory that
-`secret unlocker list` skips with a warning, because its metadata cannot be
-read or parsed, is removed by the directory name the warning gives.
-- `--force, -f`: Force removal of last unlocker even if vault has secrets
+**DANGER**: Permanently removes an unlocker. It first asks for confirmation,
+naming the unlocker and its vault and saying whether it is the vault's last
+unlocker; for the last one it says how many secrets the vault holds and warns
+that the vault then opens only with its mnemonic (see
+[Confirmation Before Removal](#confirmation-before-removal)). An unlocker
+directory that `secret unlocker list` skips with a warning, because its metadata
+cannot be read or parsed, is removed by the directory name the warning gives.
+
+- `--force, -f`: Remove without asking, even the last unlocker
 - **CRITICAL WARNING**: Without unlockers and without your mnemonic phrase,
   vault data will be PERMANENTLY INACCESSIBLE
 - **NO RECOVERY**: Removing all unlockers without having your mnemonic means
@@ -221,7 +258,8 @@ Selects an unlocker as the current default for operations.
 
 #### `secret import <secret-name> --source <filename>`
 
-Imports a secret from a file and stores it in the current vault under the given name.
+Imports a secret from a file and stores it in the current vault under the given
+name.
 
 #### `secret vault import [vault-name]`
 
@@ -231,7 +269,8 @@ Imports a mnemonic phrase into the specified vault (defaults to "default").
 
 #### `secret encrypt <secret-name> [--input=file] [--output=file]`
 
-Encrypts data using an Age key stored as a secret. If the secret doesn't exist, generates a new Age key.
+Encrypts data using an Age key stored as a secret. If the secret doesn't exist,
+generates a new Age key.
 
 #### `secret decrypt <secret-name> [--input=file] [--output=file]`
 
@@ -241,8 +280,13 @@ Decrypts data using an Age key stored as a secret.
 
 ### Directory Structure
 
+The state directory is `berlin.sneak.pkg.secret` in the user's configuration
+directory: on Linux `$XDG_CONFIG_HOME`, or `~/.config` when that is unset; on
+macOS `~/Library/Application Support`. When `SB_SECRET_STATE_DIR` is set, it is
+the state directory instead. On Linux:
+
 ```
-~/.local/share/secret/
+~/.config/berlin.sneak.pkg.secret/
 ├── vaults.d/
 │   ├── default/
 │   │   ├── unlockers.d/
@@ -255,12 +299,12 @@ Decrypts data using an Age key stored as a secret.
 │   │   │   │   │   │   ├── pub.age     # Version public key
 │   │   │   │   │   │   ├── priv.age    # Version private key (encrypted)
 │   │   │   │   │   │   ├── value.age   # Encrypted value
-│   │   │   │   │   │   └── metadata.json # Unencrypted metadata
+│   │   │   │   │   │   └── metadata.age # Encrypted metadata
 │   │   │   │   │   └── 20231216.001/   # Another version
-│   │   │   │   └── current -> versions/20231216.001
+│   │   │   │   └── current              # Current version's name: 20231216.001
 │   │   │   └── database%password/       # Secret: database/password
 │   │   │       ├── versions/
-│   │   │       └── current -> versions/20231215.001
+│   │   │       └── current              # Current version's name: 20231215.001
 │   │   ├── vault-metadata.json          # Vault metadata
 │   │   ├── pub.age                      # Long-term public key
 │   │   └── current-unlocker             # Current unlocker's directory name
@@ -270,49 +314,61 @@ Decrypts data using an Age key stored as a secret.
 │       ├── vault-metadata.json
 │       ├── pub.age
 │       └── current-unlocker
-└── currentvault -> vaults.d/default
+├── currentvault                         # Current vault's name: default
+└── lock                                 # Locked by each command that changes anything
 ```
 
+`current`, `currentvault` and `current-unlocker` are plain files that each hold
+one name. Changing one replaces it in one rename, so it is never half-written.
+
 ### Key Management and Encryption Flow
 
 #### 1: Long-term Keys
-- **Source**: Derived from BIP39 mnemonic phrases using hierarchical deterministic (HD) key derivation
+
+- **Source**: Derived from BIP39 mnemonic phrases using hierarchical
+  deterministic (HD) key derivation
 - **Purpose**: Master keys for each vault, used to encrypt secret-specific keys
-- **Storage**: Public key stored as `pub.age`, private key encrypted by unlockers
+- **Storage**: Public key stored as `pub.age`, private key encrypted by
+  unlockers
 
 #### 2: Unlockers
 
 Unlockers provide different authentication methods to access the long-term keys:
 
 1. **Passphrase Unlockers**:
-   - Encrypted with user-provided passphrase
-   - Stored as encrypted Age keys
-   - Cross-platform compatible
+    - Encrypted with user-provided passphrase
+    - Stored as encrypted Age keys
+    - Cross-platform compatible
 
 2. **PGP Unlockers**:
-   - Uses existing GPG key infrastructure
-   - Leverages existing key management workflows
-   - Strong authentication through GPG
+    - Uses existing GPG key infrastructure
+    - Leverages existing key management workflows
+    - Strong authentication through GPG
 
 3. **Keychain Unlockers** (macOS only):
-   - Stores unlock keys in macOS Keychain
-   - Protected by system authentication (Touch ID, password)
-   - Automatic unlocking when Keychain is unlocked
-   - Cross-application integration
+    - Stores unlock keys in macOS Keychain
+    - Kept on this Mac only: the keychain item is never synced to other devices
+    - Automatic unlocking when Keychain is unlocked
+    - Cross-application integration
 
 4. **Secure Enclave Unlockers** (macOS):
-   - Hardware-backed key storage using Apple Secure Enclave
-   - Uses `sc_auth` / CryptoTokenKit for SE key management (no Apple Developer Program required)
-   - ECIES encryption: vault long-term key encrypted directly by SE hardware
-   - Protected by biometric authentication (Touch ID) or system password
+    - Hardware-backed key storage using Apple Secure Enclave
+    - Uses `sc_auth` / CryptoTokenKit for SE key management (no Apple Developer
+      Program required)
+    - ECIES encryption: the vault long-term key is encrypted directly to the SE
+      key, and only the SE can decrypt it
+    - The SE key cannot leave this Mac; using it asks for no Touch ID or
+      password
 
-Each vault maintains its own set of unlockers and one long-term key. The long-term key is encrypted to each unlocker, allowing any authorized unlocker to access vault secrets.
+Each vault maintains its own set of unlockers and one long-term key. The
+long-term key is encrypted to each unlocker, allowing any authorized unlocker to
+access vault secrets.
 
 #### 3: Secret-specific Keys
 
 - Each secret version has its own encryption key pair
 - Private key encrypted to the vault's long-term key
-- Provides forward secrecy and granular access control
+- A version's private key decrypts only that version's value and metadata
 
 ### Environment Variables
 
@@ -326,18 +382,19 @@ they hold. Other processes running as the same user can read a process's
 environment (on Linux, from `/proc/<pid>/environ`). Every child process of the
 shell or script that sets them inherits them, `gpg` included. Set on a command
 line or in a CI job, they end up in shell history and CI logs. `secret` unsets
-each one as soon as it has read it, so that the programs it runs itself, such
-as `gpg`, do not inherit it, but that erases nothing: the environment the
-process started with, and its memory, still hold the value. The interactive
-prompt, which every command except `secret vault import` offers when the
-variable is not set, is the safer default; `secret vault import` has no prompt
-and needs both variables.
+each one as soon as it has read it, so that the programs it runs itself, such as
+`gpg`, do not inherit it, but that erases nothing: the environment the process
+started with, and its memory, still hold the value. The interactive prompt,
+which every command except `secret vault import` offers when the variable is not
+set, is the safer default; `secret vault import` has no prompt and needs both
+variables.
 
 ## Security Features
 
 ### Encryption
 
-- Uses the [age encryption library](https://age-encryption.org/) with X25519 keys
+- Uses the [age encryption library](https://age-encryption.org/) with X25519
+  keys
 - All private keys are encrypted at rest
 - No plaintext secrets stored on disk
 
@@ -356,7 +413,8 @@ and needs both variables.
 
 - Hardware token support via PGP/GPG integration
 - macOS Keychain integration for system-level security
-- Secure Enclave integration for hardware-backed key protection (macOS, via `sc_auth` / CryptoTokenKit)
+- Secure Enclave integration for hardware-backed key protection (macOS, via
+  `sc_auth` / CryptoTokenKit)
 
 ## Examples
 
@@ -377,7 +435,7 @@ secret list
 secret get database/prod/password
 secret get services/api/key
 
-# Remove a secret ⚠️ 🛑 (NO CONFIRMATION - PERMANENT!)
+# Remove a secret ⚠️ 🛑 (asks first - PERMANENT!)
 secret remove ssh/servers/web01
 ```
 
@@ -400,11 +458,12 @@ echo "personal-email-pass" | secret add email/password
 # List all vaults
 secret vault list
 
-# Remove a vault ⚠️ 🛑 (NO CONFIRMATION - PERMANENT!)
+# Remove a vault ⚠️ 🛑 (--force: NO CONFIRMATION - PERMANENT!)
 secret vault remove personal --force
 ```
 
 ### Advanced Authentication
+
 ```bash
 # Add multiple unlock methods
 secret unlocker add passphrase              # Password-based
@@ -418,7 +477,7 @@ secret unlocker list
 # Select a specific unlocker
 secret unlocker select <unlocker-id>
 
-# Remove an unlocker ⚠️ 🛑 (NO CONFIRMATION!)
+# Remove an unlocker ⚠️ 🛑 (asks first!)
 secret unlocker remove <unlocker-id>
 ```
 
@@ -431,7 +490,7 @@ secret version list database/prod/password
 # Promote an older version to current
 secret version promote database/prod/password 20231215.001
 
-# Remove an old version ⚠️ 🛑 (NO CONFIRMATION - PERMANENT!)
+# Remove an old version ⚠️ 🛑 (asks first - PERMANENT!)
 secret version remove database/prod/password 20231214.001
 ```
 
@@ -451,21 +510,31 @@ secret decrypt encryption/mykey --input document.txt.age --output document.txt
 ## Technical Details
 
 ### Cryptographic Primitives
+
 - **Key Derivation**: BIP32/BIP39 hierarchical deterministic key derivation
 - **Encryption**: Age (X25519 + ChaCha20-Poly1305)
 - **Authentication**: Poly1305 MAC
 - **Hashing**: Double SHA-256 for public key identification
 
 ### File Formats
-- **age Files**: Standard age encryption format (.age extension)
-- **Metadata**: Unencrypted JSON format with timestamps and type information
-- **Vault Metadata**: JSON containing vault name, creation time, derivation index, and public key hash
+
+- **age Files**: Standard age encryption format (.age extension), except
+  `pub.age`, which holds an age public key as text
+- **Metadata**: `vault-metadata.json` and `unlocker-metadata.json` are
+  unencrypted JSON with a creation time, and `unlocker-metadata.json` also
+  records the unlocker's type; a version's `metadata.age` is JSON encrypted to
+  the version's public key
+- **Vault Metadata**: JSON containing creation time, derivation index, and the
+  public key hashes described below
 
 ### Vault Management
 
-- **Derivation Index**: Each vault uses a unique derivation index from the mnemonic, and thus a unique key pair
-- **Public Key Hash**: Double SHA-256 hash of the index-0 public key identifies vaults from the same mnemonic
-- **Automatic Key Derivation**: When creating vaults with a mnemonic, keys are automatically derived
+- **Derivation Index**: Each vault uses a unique derivation index from the
+  mnemonic, and thus a unique key pair
+- **Public Key Hash**: Double SHA-256 hash of the vault's public key; the same
+  hash of the index-0 public key identifies vaults from the same mnemonic
+- **Automatic Key Derivation**: When creating vaults with a mnemonic, keys are
+  automatically derived
 
 ### Cross-Platform Support
 
@@ -501,6 +570,7 @@ to add or use them.
 ## Development
 
 ### Building
+
 ```bash
 make build    # Build binary
 make test     # Run tests
@@ -508,11 +578,11 @@ make lint     # Run linter
 ```
 
 ### Testing
+
 The project includes comprehensive tests:
+
 ```bash
 make test     # Run all tests
-go test ./... # Unit tests
-go test -tags=integration -v ./internal/cli  # Integration tests
 ```
 
 ## Entrypoints
@@ -520,61 +590,68 @@ go test -tags=integration -v ./internal/cli  # Integration tests
 This repository adheres to the
 [Scripts to Rule Them All](https://github.com/github/scripts-to-rule-them-all)
 standard: normalized scripts in `script/` are the entrypoints for the
-development workflow, and the Makefile targets are thin shims that call
-them. We provide:
+development workflow, and the Makefile targets are thin shims that call them. We
+provide:
 
-- `script/bootstrap` — install all dependencies (Go, Go module
-  download), idempotently; golangci-lint is not installed, it runs in
-  docker
+- `script/bootstrap` — install all dependencies (Go, Go module download),
+  idempotently; golangci-lint is not installed, it runs in docker
 - `script/setup` — make a fresh clone ready for development: runs
   `script/bootstrap`, then `script/install-precommit`
-- `script/projectname` — output the project name (`secret`); used by
-  other scripts such as `script/docker`
-- `script/build` — build the `secret` binary into the repo root, stamping
-  the version (`VERSION` from the environment, else `git describe`) and
-  the git commit
-- `script/test` — run `go vet` and the test suite (verbose rerun on
-  failure)
-- `script/lint` — run `golangci-lint` in docker only: builds
-  `Dockerfile.lint`, where the linter is a build step that runs on every
-  call, also on an unchanged tree
-- `script/lint-darwin` — run `go vet` and `golangci-lint` in docker on
-  the code as a macOS build compiles it (`GOOS=darwin`), which a Linux
-  build never compiles; cgo is off, so the keychain unlocker's calls into
-  the keychain (`internal/secret/keychainunlocker_cgo.go`, and
-  `keychainunlocker_test.go`) and the Secure Enclave bindings
-  (`internal/macse`) are not checked
+- `script/projectname` — output the project name (`secret`); used by other
+  scripts such as `script/docker`
+- `script/build` — build the `secret` binary into the repo root, stamping the
+  version (`VERSION` from the environment, else `git describe`) and the git
+  commit
+- `script/test` — run `go vet` and the test suite (verbose rerun on failure)
+- `script/lint` — run `golangci-lint` in docker only: builds `Dockerfile.lint`,
+  where the linter is a build step that runs on every call, also on an unchanged
+  tree
+- `script/lint-darwin` — run `go vet` and `golangci-lint` in docker on the code
+  as a macOS build compiles it (`GOOS=darwin`), which a Linux build never
+  compiles; cgo is off, so the keychain unlocker's calls into the keychain
+  (`internal/secret/keychainunlocker_cgo.go`, and `keychainunlocker_test.go`)
+  and the Secure Enclave bindings (`internal/macse`) are not checked
 - `script/fmt` — format all Go code (writes)
 - `script/fmt-check` — check formatting without writing
-- `script/check` — run `script/test`, `script/lint`,
-  `script/lint-darwin`, and `script/fmt-check`
+- `script/check` — run `script/test`, `script/lint`, `script/lint-darwin`, and
+  `script/fmt-check`
 - `script/docker` — build the Docker image tagged with the project name
-- `script/cibuild` — CI entrypoint: `docker build --ulimit
-  memlock=-1:-1 .` (memguard needs mlock; the Dockerfile runs the
-  checks), with a new `CHECK_EPOCH` build argument on every run so the
-  checks run again on an unchanged tree
-- `script/precommit` — pre-commit checks: `go mod tidy` verification,
-  then `script/check`
-- `script/install-precommit` — install the git pre-commit hook that
-  runs `script/precommit`
+- `script/cibuild` — CI entrypoint: `docker build --ulimit memlock=-1:-1 .`
+  (memguard needs mlock; the Dockerfile runs the checks), with a new
+  `CHECK_EPOCH` build argument on every run so the checks run again on an
+  unchanged tree
+- `script/precommit` — pre-commit checks: `go mod tidy` verification, then
+  `script/check`
+- `script/install-precommit` — install the git pre-commit hook that runs
+  `script/precommit`
 
 ## Features
 
-- **Multiple Authentication Methods**: Supports passphrase, PGP, macOS Keychain, and Secure Enclave unlockers
+- **Multiple Authentication Methods**: Supports passphrase, PGP, macOS Keychain,
+  and Secure Enclave unlockers
 - **Vault Isolation**: Complete separation between different vaults
 - **Per-Secret Encryption**: Each secret has its own encryption key
 - **BIP39 Mnemonic Support**: Keyless operation using mnemonic phrases
 - **Cross-Platform**: Works on macOS, Linux, and other Unix-like systems
 
-# Author
+## TODO
 
-Made with love and lots of expensive SOTA AI by
-[sneak](https://sneak.berlin) in Berlin in the summer of 2025.
+Open work is tracked on the
+[issue tracker](https://git.eeqj.de/sneak/secret/issues), which is
+authoritative. The work to be done before 1.0 is the
+[`1.0.0` milestone](https://git.eeqj.de/sneak/secret/milestone/12). `TODO.md`
+records the steps completed so far.
 
-Released as a free software gift to the world, no strings attached, under
-the [WTFPL](https://www.wtfpl.net/) license.
+## License
+
+Released as a free software gift to the world, no strings attached, under the
+[WTFPL](https://www.wtfpl.net/) license; see [`LICENSE`](LICENSE).
+
+## Author
+
+Made with love and lots of expensive SOTA AI by [@sneak](https://sneak.berlin)
+in Berlin in the summer of 2025.
 
 Contact: [sneak@sneak.berlin](mailto:sneak@sneak.berlin)
 
 [https://keys.openpgp.org/vks/v1/by-fingerprint/5539AD00DE4C42F3AFE11575052443F4DF2A55C2](https://keys.openpgp.org/vks/v1/by-fingerprint/5539AD00DE4C42F3AFE11575052443F4DF2A55C2)
-

TODO.md

@@ -1,30 +1,133 @@
 # Workflow
 
-* branch (from `main`)
-* do the work in Next Step
-* move Next Step to the top of Completed Steps
-* move the top item of Future Steps into Next Step
-* commit (`TODO.md` changes in the same commit as the work)
-* merge to `main` if the branch is not protected, otherwise open a PR
-* push
+- branch from `next`
+- do the Next Step: the next open issue in the `1.0.0` milestone
+- log it at the top of Completed Steps
+- commit (`TODO.md` changes in the same commit as the work)
+- push, and open a PR against `next`
 
 # Status
 
-pre-1.0. No git tags. TODO.md carries open 1.0 security blockers. Work in
-flight on branch secure-enclave-unlocker (clean tree as of 2026-07-06).
+pre-1.0. No git tags. Open work is tracked on the issue tracker, which is
+authoritative.
 
 # Next Step
 
-Bring the repo into policy compliance in one commit:
-
-- Add fmt-check and hooks targets to the Makefile (test/lint/fmt/check/
-  docker already exist).
-- Add REPO_POLICIES.md and .editorconfig.
-- Add .gitea/workflows/check.yml running make check.
-- Verify Dockerfile base images are pinned by sha256.
+Take the next open issue in the `1.0.0` milestone:
+https://git.eeqj.de/sneak/secret/milestone/12
 
 # Completed Steps
 
+- 2026-10-04: Tests check which error a failure returns with `errors.Is`,
+  not by matching words of its message
+  (https://git.eeqj.de/sneak/secret/issues/49). Every exported error that
+  can be returned has a test that the function returns it, and errors
+  wrapping a cause are checked through the wrapping. Checks that still match
+  text, because the error has no exported value the test can name, are
+  listed on the issue.
+- 2026-10-04: When a vault cannot be opened through its current unlocker,
+  because a file the unlocker needs is missing or damaged, its keychain item
+  or Secure Enclave key is gone, or the passphrase is wrong, the error now
+  ends by naming the vault, saying that it still opens with its mnemonic,
+  and that `secret unlocker add passphrase`, run with `SB_SECRET_MNEMONIC`
+  set to it, gives the vault a new unlocker; for a vault that is not the
+  current one, as in `secret move` between vaults, it says to run
+  `secret vault select` first (https://git.eeqj.de/sneak/secret/issues/47).
+  Before, it ended with the bare cause. The advice is given only when the
+  vault metadata records the key the mnemonic derives, so not for a vault
+  created without a mnemonic, and not when the passphrase could not be read
+  at all. `secret vault import` is not named: it refuses a vault that has a
+  long-term key. `secret encrypt` and `secret decrypt` now read the key
+  secret through `vault.GetSecret`, as `secret get` does, so they give the
+  same advice; `Secret.GetValue`, the other way to get the long-term key, is
+  removed. When a secret's `current` file cannot be read, the error says
+  that `secret version list` lists its versions and `secret version promote`
+  makes one current. The causes stay wrapped.
+- 2026-10-04: An unlocker's ID is the name of its directory in `unlockers.d`,
+  so no two unlockers of a vault share one
+  (https://git.eeqj.de/sneak/secret/issues/98). Before, a keychain or Secure
+  Enclave unlocker's ID was its creation time to the minute and the host name,
+  and a passphrase unlocker's the time to the minute, so two created within a
+  minute shared an ID, and `unlocker select`, `unlocker remove` and the
+  selection `unlocker add` makes acted on the older one. A PGP unlocker's ID
+  was `pgp-` and its key's fingerprint; a second PGP unlocker for a key is
+  still refused, now by comparing the fingerprint in the other unlockers'
+  metadata. `unlocker list` and the shell completion of `unlocker select` and
+  `unlocker remove` take each ID from the directory the unlocker was read
+  from, no longer by matching metadata, so two unlockers with the same
+  metadata are listed apart; an unlocker of an unknown type is listed under
+  its directory name, and completion now offers Secure Enclave unlockers too.
+  The keychain and Secure Enclave code was type-checked by
+  `script/lint-darwin`, never run; a test on Linux lists, completes, selects
+  and removes each of two passphrase unlockers with the same metadata by its
+  own ID.
+- 2026-10-04: README's Storage Architecture, `secret version promote`,
+  Technical Details and Testing text matches the code
+  (https://git.eeqj.de/sneak/secret/issues/102). `current` and
+  `currentvault` are plain files holding a name, not symbolic links; a
+  version's metadata is the encrypted `metadata.age`; the state directory is
+  `berlin.sneak.pkg.secret` in the user's configuration directory, not
+  `~/.local/share/secret`, and holds the `lock` file. Also corrected: the
+  code sets up no Touch ID for the keychain or Secure Enclave unlocker, and
+  the Secure Enclave only decrypts; per-version keys give no forward
+  secrecy; `pub.age` is not age-encrypted; vault metadata holds no vault
+  name. Testing lists only `make test`.
+- 2026-10-04: `secret init` and `secret vault create` create a vault whole or
+  not at all (https://git.eeqj.de/sneak/secret/issues/105).
+  `vault.CreateVault` now takes the unlocker passphrase too, writes the vault
+  directory with its metadata, long-term public key and passphrase unlocker,
+  `longterm.age` included, into a temporary directory, renames that into
+  `vaults.d` once it is complete, and only then makes the vault current.
+  Before, either command killed after the passphrase prompt but before the
+  unlocker was written left a vault with no unlocker, which `vault create` had
+  already made current and which neither command would create again. Killed
+  part-way now, it leaves no vault, and the next command that takes the lock
+  deletes the temporary directory; or, killed between the rename and making
+  the vault current, a complete vault that is not current, which
+  `secret vault select` makes current.
+- 2026-10-04: A failed `secret unlocker add keychain` or
+  `secret unlocker add secure-enclave` no longer leaves its keychain item or
+  Secure Enclave key behind (https://git.eeqj.de/sneak/secret/issues/89).
+  `CreateSecureEnclaveUnlocker` gets the long-term key before it creates the
+  Secure Enclave key, so that a wrong passphrase creates none, and deletes the
+  key again if encrypting with it or writing the unlocker then fails.
+  `macse.CreateKey` finds the new key's hash right after `sc_auth` creates
+  it, and fails with an error naming the key's label if it cannot; it deletes
+  the key again if getting its public key then fails. The Objective-C was only
+  read, never compiled or run, and so was `macse_darwin.go`, which is cgo only.
+  `CreateKeychainUnlocker` writes all of the unlocker's files, the metadata
+  among them, before it stores the item in the keychain, and deletes the item
+  again if moving the unlocker into place then fails. A failure to delete is
+  reported along with the first error. The tests of this run only on macOS:
+  the Secure Enclave one in a build with cgo on a Mac with a Secure Enclave,
+  the keychain one in a build with cgo.
+- 2026-10-04: What a command killed part-way left under a `.tmp-` name
+  (https://git.eeqj.de/sneak/secret/issues/75), the temporary directories
+  of `secret.TempDirFor` and the temporary files of
+  `secret.WriteFileAtomic`, encrypted keys included, is deleted by the next
+  command that takes the state directory lock. Before, it stayed until
+  deleted by hand. A command writes `finished` into the lock file just
+  before it releases the lock; the next one to take the lock searches only
+  when it does not find that, so after a command that finished nothing is
+  searched, however many secrets and versions there are. The search looks
+  in the state directory, each vault, each secret and each version, the
+  only directories those helpers make them in. A command that only reads
+  takes no lock and deletes nothing. A failure to delete is warned about
+  and the command goes on. An unlocker directory with no metadata file was
+  already removed by `secret unlocker remove` given its directory name; a
+  test now shows it.
+- 2026-10-04: An age identity's private key goes into a locked buffer
+  through `secret.IdentityToLockedBuffer` everywhere
+  (https://git.eeqj.de/sneak/secret/issues/38): the vault's long-term key
+  when a passphrase, PGP, keychain or Secure Enclave unlocker is created,
+  the new unlocker's own key, a new secret version's key, and the key
+  `secret encrypt` generates. Before, each place converted the string age
+  returns to bytes and left the string in ordinary memory. The function
+  moves the string's own bytes into the buffer, which overwrites them; the
+  copies age makes while writing the string remain, as its comment says.
+  The 1.0 memory-security entry below no longer lists these places,
+  `internal/cli/crypto.go` among them, nor `version.go:155`, which was
+  `internal/secret/version.go`, not `internal/cli/version.go`.
 - 2026-10-04: `script/lint-darwin` (`make lint-darwin`) runs `go vet` and
   `golangci-lint` in docker on the code as a macOS build compiles it
   (`GOOS=darwin`), with cgo off
@@ -46,6 +149,20 @@ Bring the repo into policy compliance in one commit:
   long-term key from the mnemonic through the same function as the keychain
   unlocker instead of a copy of it. Lines over 88 columns in the files the
   check cannot see are wrapped.
+- 2026-10-04: `secret rm`, `secret version rm`, `secret vault remove` and
+  `secret unlocker remove` ask `[y/N]` before removing anything
+  (https://git.eeqj.de/sneak/secret/issues/39), naming what they remove: the
+  secret, its vault and its version count; the version, secret and vault; the
+  vault and its secret count; the unlocker, its vault and whether it is the
+  last, and for the last the vault's secret count and that the vault then
+  opens only with its mnemonic. Only `y` or `yes` goes ahead. Without
+  `--force`, a command whose stdin is not a terminal fails at once. `--force`
+  (now also on `rm` and `version rm`) removes without asking; it replaces the
+  old refusals to remove a vault with secrets or the last unlocker of one
+  without `--force`, which the question now covers. The checks run, and the
+  question is asked, before the state directory lock is taken; under the
+  lock the checks run again, and if they would ask a different question,
+  nothing is removed. `secret rm` fails when it cannot count the versions.
 - 2026-10-04: A crash while an unlocker is being replaced no longer leaves a
   current unlocker that cannot open the vault
   (https://git.eeqj.de/sneak/secret/issues/71). Every new unlocker gets a
@@ -208,16 +325,7 @@ Bring the repo into policy compliance in one commit:
   `current-unlocker` never go missing. New versions, new secrets and
   cross-vault copies are built in a temporary directory and renamed
   into place, and removals rename out of the way first, so a version
-  or secret is never half-added and never half-removed. An
-  interrupted command can still leave:
-    - from `init` or `vault create` killed after the passphrase prompt
-      but before the unlocker is written, a vault with no unlocker,
-      which `vault create` has already made the current vault;
-    - data under a `.tmp-` name in the state directory: a secret,
-      version or unlocker being added, or the secret, version, unlocker
-      or vault being removed, encrypted keys included. Nothing deletes
-      it; it must be deleted by hand
-      (https://git.eeqj.de/sneak/secret/issues/75).
+  or secret is never half-added and never half-removed.
 - 2026-10-03: The checks run before changing a vault now stop with an
   error naming the path and cause when they cannot read what they
   inspect, instead of reading the failure as "nothing there": the
@@ -273,8 +381,15 @@ Bring the repo into policy compliance in one commit:
   `findUnlockerIDByMetadata` now returns an error so `unlocker list`
   skips an unreadable `unlockers.d` entry with a warning instead of
   emitting a fabricated fallback ID.
+- 2026-08-07: Added `.editorconfig`
+  (https://git.eeqj.de/sneak/secret/issues/27).
 - 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints,
   Makefile shims, README Entrypoints section
+- 2026-07-07: Added `REPO_POLICIES.md` and the `make hooks` target;
+  `.gitea/workflows/check.yml` now runs `script/cibuild`.
+- 2026-03-30: Added the `make fmt-check` target and
+  `.gitea/workflows/check.yml`, which runs `docker build` on every push; the
+  `Dockerfile` base images are pinned by sha256.
 - 2026-03-11: Secure Enclave unlocker for hardware-backed secret
   protection, plus review fixes (stub panics, derivation index, tests,
   README) on branch secure-enclave-unlocker.
@@ -296,8 +411,6 @@ Bring the repo into policy compliance in one commit:
 
 # Future Steps
 
-- Compliance (after Next Step lands): keep main green under the new
-  .gitea workflow; run make check before every merge.
 - Implement version-number shell completion for the second arg of
   `secret version promote` and `secret version rm`
   (`internal/cli/version.go`; was an in-code TODO removed for godox).
@@ -312,36 +425,16 @@ Bring the repo into policy compliance in one commit:
   never run on them, so it would likely find more there than the line
   lengths. No macOS test runs in CI. A macOS runner would cover all of it
   (asked on https://git.eeqj.de/sneak/secret/issues/50).
-- Merge secure-enclave-unlocker to main once review is done.
 - 1.0 critical security blockers (from repo TODO.md):
-    - Command injection: GPG key IDs passed unescaped to exec.Command
-      (pgpunlocker.go:323-327); data.String() passed unescaped to the
-      security command (keychainunlocker.go:472-476).
-    - Memory security: age identity .String() creates unprotected
-      copies (keychainunlocker.go:356, pgpunlocker.go:256,
-      version.go:155); age secret key held in a plain string in
-      cli/crypto.go:86,91,113; private keys exposed via buffer.Bytes()
-      to GPGEncryptFunc and EncryptWithPassphrase.
-    - Input validation: no maximum secret size (DoS).
-    - Timing attacks: bytes.Equal passphrase compare (cli/init.go:
-      209-216); non-constant-time public key compare (vault.go:95-100).
-- High priority:
-    - Secure temporary file handling and cleanup.
-    - Initialize a default unlock key at vault creation.
-    - Confirmation prompts for destructive operations (keys rm, vault
-      deletion).
-    - Add secret rm and vault deletion commands.
+    - Memory security: age writes an identity's private key out as a string in
+      ordinary memory, and the copies it makes on the way stay there
+      (`secret.IdentityToLockedBuffer` overwrites only the string itself).
 - Medium priority:
     - Standardize error messages; stop leaking internals.
-    - Graceful handling of corrupted or missing key files with recovery
-      suggestions.
-    - Validate GPG key existence before creating PGP unlock keys.
     - Split oversized CLI functions.
-    - mlock/munlock for sensitive allocations.
 - Cleanups: read statedir from environment or default instead of
   passing it around.
-- Enhancements: help examples, shell completion, colored output,
-  --quiet flag, name suggestions on miss, audit logging, hardware
-  integration tests (Keychain, GPG), naming consistency, vault
-  export/import, batch operations, search, secret metadata
+- Enhancements: help examples, colored output, --quiet flag, name suggestions on
+  miss, audit logging, hardware integration tests (Keychain, GPG), naming
+  consistency, vault export/import, batch operations, search, secret metadata
   (descriptions, tags).

go.mod

@@ -9,6 +9,7 @@ require (
 	github.com/btcsuite/btcd/btcec/v2 v2.1.3
 	github.com/btcsuite/btcd/btcutil v1.1.6
 	github.com/btcsuite/btcutil v0.0.0-20190425235716-9e5f4b9a998d
+	github.com/creack/pty v1.1.24
 	github.com/keybase/go-keychain v0.0.0-20230307172405-3e4884637dd1
 	github.com/oklog/ulid/v2 v2.1.1
 	github.com/spf13/afero v1.14.0

go.sum

@@ -35,6 +35,8 @@ github.com/btcsuite/snappy-go v1.0.0/go.mod h1:8woku9dyThutzjeg+3xrA5iCpBRH8XEEg
 github.com/btcsuite/websocket v0.0.0-20150119174127-31079b680792/go.mod h1:ghJtEyQwv5/p4Mg4C0fgbePVuGr935/5ddU9Z3TmDRY=
 github.com/btcsuite/winsvc v1.0.0/go.mod h1:jsenWakMcC0zFBFurPLEAyrnc/teJEM1O46fmI40EZs=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
+github.com/creack/pty v1.1.24 h1:bJrF4RRfyJnbTJqzRLHzcGaZK1NeM5kTC9jGgovnR1s=
+github.com/creack/pty v1.1.24/go.mod h1:08sCNb52WyoAwi2QDyzUCTgcvVFhUzewun7wtTfvcwE=
 github.com/davecgh/go-spew v0.0.0-20171005155431-ecdeabc65495/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=

internal/cli/cli.go

@@ -3,6 +3,7 @@ package cli
 
 import (
 	"fmt"
+	"io"
 	"os"
 
 	"git.eeqj.de/sneak/secret/internal/secret"
@@ -21,6 +22,10 @@ type Instance struct {
 	// none.
 	Mnemonic         *memguard.LockedBuffer
 	UnlockPassphrase *memguard.LockedBuffer
+	// terminal, when set, stands in for the terminal that confirm reads
+	// the user's answer from; only tests set it. When it is nil, confirm
+	// reads stdin, and only when stdin is a terminal.
+	terminal io.Reader
 }
 
 // NewCLIInstance creates a new CLI instance with the real filesystem

internal/cli/completions.go

@@ -1,10 +1,10 @@
 package cli
 
 import (
-	"path/filepath"
+	"maps"
+	"slices"
 	"strings"
 
-	"git.eeqj.de/sneak/secret/internal/secret"
 	"git.eeqj.de/sneak/secret/internal/vault"
 	"github.com/spf13/afero"
 	"github.com/spf13/cobra"
@@ -44,7 +44,7 @@ func getSecretNamesCompletionFunc(fs afero.Fs, stateDir string) func(
 }
 
 // getUnlockerIDsCompletionFunc returns a completion function that provides
-// unlocker IDs
+// unlocker IDs, the names of the unlockers' directories in unlockers.d
 func getUnlockerIDsCompletionFunc(fs afero.Fs, stateDir string) func(
 	cmd *cobra.Command, args []string, toComplete string,
 ) ([]string, cobra.ShellCompDirective) {
@@ -57,38 +57,15 @@ func getUnlockerIDsCompletionFunc(fs afero.Fs, stateDir string) func(
 			return nil, cobra.ShellCompDirectiveNoFileComp
 		}
 
-		// Get unlocker metadata list
-		unlockerMetadataList, err := vlt.ListUnlockers()
+		unlockerMetadata, err := vlt.ListUnlockers()
 		if err != nil {
 			return nil, cobra.ShellCompDirectiveNoFileComp
 		}
 
-		// Get vault directory
-		vaultDir, err := vlt.GetDirectory()
-		if err != nil {
-			return nil, cobra.ShellCompDirectiveNoFileComp
-		}
-
-		// Collect unlocker IDs
 		var completions []string
 
-		unlockersDir := filepath.Join(vaultDir, "unlockers.d")
-
-		for _, metadata := range unlockerMetadataList {
-			// Get the actual unlocker ID by creating the unlocker instance
-			id, err := findUnlockerIDByMetadata(
-				fs, unlockersDir, metadata, false,
-			)
-			if err != nil {
-				secret.Warn(
-					"Could not read unlockers directory during completion, "+
-						"skipping unlocker",
-					"unlockers_dir", unlockersDir, "error", err)
-
-				continue
-			}
-
-			if id != "" && strings.HasPrefix(id, toComplete) {
+		for _, id := range slices.Sorted(maps.Keys(unlockerMetadata)) {
+			if strings.HasPrefix(id, toComplete) {
 				completions = append(completions, id)
 			}
 		}

internal/cli/confirm.go

@@ -0,0 +1,108 @@
+package cli
+
+import (
+	"bufio"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"strings"
+
+	"git.eeqj.de/sneak/secret/internal/vault"
+	"github.com/spf13/cobra"
+	"golang.org/x/term"
+)
+
+// Sentinel errors for asking the user to confirm a removal
+var (
+	errNoTerminal = errors.New("stdin is not a terminal, so there is " +
+		"nobody to ask for confirmation; pass --force to remove without asking")
+	errNotConfirmed       = errors.New("cancelled; nothing was removed")
+	errChangedWhileAsking = errors.New("what was to be removed changed " +
+		"while waiting for the answer; nothing was removed")
+)
+
+// askThenLock asks the user to confirm a removal, unless force is set, and
+// then takes the state directory lock and returns the function that
+// releases it. find makes the command's checks, keeps what it found for
+// the caller to remove, and returns the question that names it. find runs
+// before the question, which is asked without the lock so that no other
+// command waits while the user answers, and runs again once the lock is
+// taken. That run is the last, so the caller removes what find found under
+// the lock. If its question then differs from the one the user answered,
+// something changed in between, and askThenLock fails.
+func (cli *Instance) askThenLock(
+	cmd *cobra.Command, force bool, find func() (string, error),
+) (func(), error) {
+	asked := ""
+
+	if !force {
+		question, err := find()
+		if err != nil {
+			return nil, err
+		}
+
+		err = cli.confirm(cmd, question)
+		if err != nil {
+			return nil, err
+		}
+
+		asked = question
+	}
+
+	release, err := vault.LockStateDir(cli.fs, cli.stateDir)
+	if err != nil {
+		return nil, err
+	}
+
+	question, err := find()
+	if err == nil && !force && question != asked {
+		err = errChangedWhileAsking
+	}
+
+	if err != nil {
+		release()
+
+		return nil, err
+	}
+
+	return release, nil
+}
+
+// confirm asks question and returns nil only when the user answers y or
+// yes; any other answer, a bare Enter included, cancels. When stdin is not
+// a terminal it asks nothing and fails at once: nobody is there to answer,
+// and waiting for an answer would hang a script. Stdin decides, not
+// stdout, because the answer is read from stdin: `secret rm foo | tee log`
+// still asks. The question goes to stderr.
+func (cli *Instance) confirm(cmd *cobra.Command, question string) error {
+	answers := cli.terminal
+	if answers == nil {
+		answers = cmd.InOrStdin()
+
+		if !isTerminal(answers) {
+			return errNoTerminal
+		}
+	}
+
+	_, _ = fmt.Fprintf(cmd.ErrOrStderr(), "%s [y/N] ", question)
+
+	answer, err := bufio.NewReader(answers).ReadString('\n')
+	if err != nil && !errors.Is(err, io.EOF) {
+		return fmt.Errorf("failed to read the answer: %w", err)
+	}
+
+	switch strings.ToLower(strings.TrimSpace(answer)) {
+	case "y", "yes":
+		return nil
+	default:
+		return errNotConfirmed
+	}
+}
+
+// isTerminal reports whether r is a terminal.
+func isTerminal(r io.Reader) bool {
+	file, ok := r.(*os.File)
+
+	return ok && term.IsTerminal(int(file.Fd()))
+}

internal/cli/confirm_test.go

@@ -0,0 +1,411 @@
+// Confirmation Tests
+//
+// `secret rm`, `secret version rm`, `secret vault remove` and
+// `secret unlocker remove` ask the user to confirm on a terminal, naming
+// what they are about to remove, and remove it only on y or yes. --force
+// skips the question. Without --force, a command whose stdin is not a
+// terminal fails at once, since nobody is there to answer.
+//
+// The tests answer through Instance.terminal, which stands in for a
+// terminal. Without it, whether stdin is a terminal decides; the tests in
+// integration_test.go that run `secret rm` on a pseudo-terminal cover that.
+
+//nolint:testpackage // sets the unexported terminal field of Instance
+package cli
+
+import (
+	"bufio"
+	"bytes"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"git.eeqj.de/sneak/secret/internal/secret"
+	"git.eeqj.de/sneak/secret/internal/vault"
+	"github.com/spf13/afero"
+	"github.com/spf13/cobra"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+const (
+	// confirmTestSecret is the secret the tests remove, or remove a
+	// version of, in the vault "work".
+	confirmTestSecret = "test/secret"
+
+	// lastUnlockerRemoval names the case that removes the only unlocker.
+	lastUnlockerRemoval = "unlocker rm, the last one"
+)
+
+// removal is one removal command, set up on its own state directory.
+type removal struct {
+	fs  afero.Fs
+	run func(cli *Instance, cmd *cobra.Command, force bool) error
+	// removed is the directory the command removes.
+	removed string
+	// question is the question the command asks.
+	question string
+}
+
+// newConfirmTestVaults returns an in-memory state directory with the
+// vaults "other" and "work", the current one. "work" holds two versions of
+// confirmTestSecret and the given number of PGP unlockers. It returns the
+// directory of "work" and the older version.
+func newConfirmTestVaults(
+	t *testing.T, unlockers int,
+) (*afero.MemMapFs, string, string) {
+	t.Helper()
+
+	fs := &afero.MemMapFs{}
+	mnemonic := testMnemonicBuffer(t)
+
+	_, err := vault.CreateVault(fs, testStateDir, "other", mnemonic, nil)
+	require.NoError(t, err)
+
+	vlt, err := vault.CreateVault(fs, testStateDir, "work", mnemonic, nil)
+	require.NoError(t, err)
+
+	addTestSecret(t, vlt, []byte("older"), false)
+	addTestSecret(t, vlt, []byte("newer"), true)
+
+	vaultDir, err := vlt.GetDirectory()
+	require.NoError(t, err)
+
+	versions, err := secret.ListVersions(fs,
+		filepath.Join(vaultDir, "secrets.d", "test%secret"))
+	require.NoError(t, err)
+	require.Len(t, versions, 2)
+
+	for i := range unlockers {
+		writePGPUnlocker(t, fs, filepath.Join(vaultDir, "unlockers.d"),
+			fmt.Sprintf("pgp-%d", i),
+			time.Date(2026, time.October, 4, 12, i, 0, 0, time.UTC),
+			listTestGPGKeyID+string(rune('A'+i)))
+	}
+
+	// ListVersions lists the newest version first.
+	return fs, vaultDir, versions[1]
+}
+
+// newRemoval sets up the removal the command names.
+func newRemoval(t *testing.T, command string) removal {
+	t.Helper()
+
+	unlockers := 2
+	if command == lastUnlockerRemoval {
+		unlockers = 1
+	}
+
+	fs, workDir, older := newConfirmTestVaults(t, unlockers)
+	// The first unlocker's directory name, written by newConfirmTestVaults
+	unlockerID := "pgp-0"
+
+	removeFirstUnlocker := func(cli *Instance, cmd *cobra.Command, force bool) error {
+		return cli.UnlockersRemove(unlockerID, force, cmd)
+	}
+
+	switch command {
+	case "rm":
+		return removal{
+			fs: fs,
+			run: func(cli *Instance, cmd *cobra.Command, force bool) error {
+				return cli.RemoveSecret(cmd, confirmTestSecret, force)
+			},
+			removed: filepath.Join(workDir, "secrets.d", "test%secret"),
+			question: "Permanently remove secret 'test/secret' and its 2 " +
+				"version(s) from vault 'work'?",
+		}
+	case "version rm":
+		return removal{
+			fs: fs,
+			run: func(cli *Instance, cmd *cobra.Command, force bool) error {
+				return cli.RemoveVersion(cmd, confirmTestSecret, older, force)
+			},
+			removed: filepath.Join(
+				workDir, "secrets.d", "test%secret", "versions", older),
+			question: "Permanently remove version " + older +
+				" of secret 'test/secret' from vault 'work'?",
+		}
+	case "vault rm":
+		return removal{
+			fs: fs,
+			run: func(cli *Instance, cmd *cobra.Command, force bool) error {
+				return cli.RemoveVault(cmd, "work", force)
+			},
+			removed:  workDir,
+			question: "Permanently remove vault 'work' and its 1 secret(s)?",
+		}
+	case "unlocker rm":
+		return removal{
+			fs:      fs,
+			run:     removeFirstUnlocker,
+			removed: filepath.Join(workDir, "unlockers.d", unlockerID),
+			question: "Permanently remove unlocker '" + unlockerID +
+				"' from vault 'work'? It is not the vault's last unlocker.",
+		}
+	case lastUnlockerRemoval:
+		return removal{
+			fs:      fs,
+			run:     removeFirstUnlocker,
+			removed: filepath.Join(workDir, "unlockers.d", unlockerID),
+			question: "Permanently remove unlocker '" + unlockerID +
+				"', the last unlocker of vault 'work', which holds 1 " +
+				"secret(s)? Without an unlocker the vault opens only " +
+				"with its mnemonic.",
+		}
+	}
+
+	t.Fatalf("no removal %q", command)
+
+	return removal{}
+}
+
+// removalCommands lists the commands newRemoval sets up.
+func removalCommands() []string {
+	return []string{
+		"rm", "version rm", "vault rm", "unlocker rm", lastUnlockerRemoval,
+	}
+}
+
+// newConfirmTestCommand returns a command whose output is discarded and
+// whose stderr, where the question goes, is the returned buffer.
+func newConfirmTestCommand() (*cobra.Command, *bytes.Buffer) {
+	var stderr bytes.Buffer
+
+	cmd := &cobra.Command{}
+	cmd.SetOut(io.Discard)
+	cmd.SetErr(&stderr)
+
+	return cmd, &stderr
+}
+
+// requireExists asserts whether the directory dir exists.
+func requireExists(t *testing.T, fs afero.Fs, dir string, want bool) {
+	t.Helper()
+
+	exists, err := afero.DirExists(fs, dir)
+	require.NoError(t, err)
+	require.Equal(t, want, exists, dir)
+}
+
+// TestConfirmAnswers checks which answers confirm accepts: y or yes, in
+// any case, around which spaces do not matter.
+func TestConfirmAnswers(t *testing.T) {
+	t.Parallel()
+
+	for answer, want := range map[string]error{
+		"y\n":       nil,
+		"Y\n":       nil,
+		"yes\n":     nil,
+		"  YES  \n": nil,
+		"y":         nil,
+		"\n":        errNotConfirmed,
+		"":          errNotConfirmed,
+		"n\n":       errNotConfirmed,
+		"yy\n":      errNotConfirmed,
+		"no\ny\n":   errNotConfirmed,
+	} {
+		t.Run(fmt.Sprintf("%q", answer), func(t *testing.T) {
+			t.Parallel()
+
+			cli := &Instance{terminal: strings.NewReader(answer)}
+			cmd, stderr := newConfirmTestCommand()
+
+			err := cli.confirm(cmd, "Remove it?")
+
+			require.ErrorIs(t, err, want)
+			assert.Equal(t, "Remove it? [y/N] ", stderr.String())
+		})
+	}
+}
+
+// TestRemovalAnsweredYesRemoves checks that each removal asks its question
+// and removes what it names when the user answers y.
+func TestRemovalAnsweredYesRemoves(t *testing.T) {
+	t.Parallel()
+
+	for _, command := range removalCommands() {
+		t.Run(command, func(t *testing.T) {
+			t.Parallel()
+
+			r := newRemoval(t, command)
+			requireExists(t, r.fs, r.removed, true)
+
+			cli := NewCLIInstanceWithStateDir(r.fs, testStateDir)
+			cli.terminal = strings.NewReader("y\n")
+			cmd, stderr := newConfirmTestCommand()
+
+			require.NoError(t, r.run(cli, cmd, false))
+
+			assert.Equal(t, r.question+" [y/N] ", stderr.String())
+			requireExists(t, r.fs, r.removed, false)
+		})
+	}
+}
+
+// TestRemovalDeclinedLeavesEverything checks that each removal changes
+// nothing when the user answers anything but y or yes, a bare Enter
+// included.
+func TestRemovalDeclinedLeavesEverything(t *testing.T) {
+	t.Parallel()
+
+	for _, command := range removalCommands() {
+		for _, answer := range []string{"\n", "n\n", ""} {
+			t.Run(fmt.Sprintf("%s %q", command, answer), func(t *testing.T) {
+				t.Parallel()
+
+				r := newRemoval(t, command)
+				before := stateDirModTimes(t, r.fs)
+
+				cli := NewCLIInstanceWithStateDir(r.fs, testStateDir)
+				cli.terminal = strings.NewReader(answer)
+				cmd, stderr := newConfirmTestCommand()
+
+				err := r.run(cli, cmd, false)
+
+				require.ErrorIs(t, err, errNotConfirmed)
+				assert.Equal(t, r.question+" [y/N] ", stderr.String())
+				assert.Equal(t, before, stateDirModTimes(t, r.fs))
+			})
+		}
+	}
+}
+
+// TestRemovalForcedAsksNothing checks that each removal with --force
+// removes what it would have named without asking, and without reading
+// its input, which is not a terminal.
+func TestRemovalForcedAsksNothing(t *testing.T) {
+	t.Parallel()
+
+	for _, command := range removalCommands() {
+		t.Run(command, func(t *testing.T) {
+			t.Parallel()
+
+			r := newRemoval(t, command)
+
+			input := strings.NewReader("n\n")
+			cli := NewCLIInstanceWithStateDir(r.fs, testStateDir)
+			cmd, stderr := newConfirmTestCommand()
+			cmd.SetIn(input)
+
+			require.NoError(t, r.run(cli, cmd, true))
+
+			assert.Empty(t, stderr.String(), "asked with --force")
+			assert.Equal(t, 2, input.Len(), "read its input with --force")
+			requireExists(t, r.fs, r.removed, false)
+		})
+	}
+}
+
+// TestRemovalWithoutTerminalFailsAtOnce checks that each removal without
+// --force, whose input is not a terminal, fails at once telling the user
+// to pass --force, and changes nothing. The input is a pipe that nobody
+// writes to or closes, so reading it would block for good.
+func TestRemovalWithoutTerminalFailsAtOnce(t *testing.T) {
+	t.Parallel()
+
+	for _, command := range removalCommands() {
+		t.Run(command, func(t *testing.T) {
+			t.Parallel()
+
+			r := newRemoval(t, command)
+			before := stateDirModTimes(t, r.fs)
+
+			input, inputWriter, err := os.Pipe()
+			require.NoError(t, err)
+
+			t.Cleanup(func() {
+				_ = inputWriter.Close()
+				_ = input.Close()
+			})
+
+			cli := NewCLIInstanceWithStateDir(r.fs, testStateDir)
+			cmd, stderr := newConfirmTestCommand()
+			cmd.SetIn(input)
+
+			done := make(chan error, 1)
+
+			go func() { done <- r.run(cli, cmd, false) }()
+
+			select {
+			case err := <-done:
+				require.ErrorIs(t, err, errNoTerminal)
+				assert.Contains(t, err.Error(), "pass --force")
+			case <-time.After(lockWait):
+				// Closing the pipe ends the read, and frees the lock if
+				// the command holds it.
+				_ = inputWriter.Close()
+
+				t.Fatal("waited for an answer on input that is not a terminal")
+			}
+
+			assert.Empty(t, stderr.String(), "asked without a terminal")
+			assert.Equal(t, before, stateDirModTimes(t, r.fs))
+		})
+	}
+}
+
+// TestRemovalAsksWithoutHoldingLock checks that while `secret rm` waits
+// for its answer, another command can take the state directory lock and
+// change the secret, and that the removal then removes nothing, since the
+// secret is no longer what the question named.
+func TestRemovalAsksWithoutHoldingLock(t *testing.T) {
+	t.Parallel()
+
+	r := newRemoval(t, "rm")
+
+	answers, answerWriter := io.Pipe()
+	questions, questionWriter := io.Pipe()
+
+	// Closing the answers ends the read if the test fails while the
+	// command waits for one.
+	t.Cleanup(func() { _ = answerWriter.Close() })
+
+	rm := NewCLIInstanceWithStateDir(r.fs, testStateDir)
+	rm.terminal = answers
+	cmd := &cobra.Command{}
+	cmd.SetOut(io.Discard)
+	cmd.SetErr(questionWriter)
+
+	done := make(chan error, 1)
+
+	go func() { done <- r.run(rm, cmd, false) }()
+
+	question, err := bufio.NewReader(questions).ReadString(']')
+	require.NoError(t, err)
+	require.Equal(t, r.question+" [y/N]", question)
+
+	// Adds a third version while rm waits for its answer.
+	add := NewCLIInstanceWithStateDir(r.fs, testStateDir)
+	add.Mnemonic = testMnemonicBuffer(t)
+	add.cmd = &cobra.Command{}
+	add.cmd.SetIn(strings.NewReader("newest"))
+	add.cmd.SetOut(io.Discard)
+
+	added := make(chan error, 1)
+
+	go func() { added <- add.AddSecret(confirmTestSecret, true) }()
+
+	select {
+	case err := <-added:
+		require.NoError(t, err)
+	case <-time.After(lockWait):
+		t.Fatal("secret add waited for the lock while secret rm asked")
+	}
+
+	_, err = answerWriter.Write([]byte("y\n"))
+	require.NoError(t, err)
+
+	select {
+	case err := <-done:
+		require.ErrorIs(t, err, errChangedWhileAsking)
+	case <-time.After(lockWait):
+		t.Fatal("secret rm did not finish once answered")
+	}
+
+	requireExists(t, r.fs, r.removed, true)
+}

internal/cli/create_vault_test.go

@@ -2,7 +2,11 @@ package cli_test
 
 import (
 	"bytes"
+	"io"
+	"maps"
 	"os"
+	"slices"
+	"strings"
 	"testing"
 
 	"git.eeqj.de/sneak/secret/internal/cli"
@@ -62,22 +66,18 @@ func TestCreateExistingVaultChangesNothing(t *testing.T) {
 
 	tests := []struct {
 		command string
-		want    string
 		run     func(c *cli.Instance) error
 	}{
 		{
 			"init",
-			"failed to create default vault: vault default already exists",
 			func(c *cli.Instance) error { return c.Init(cmd) },
 		},
 		{
 			"vault create default",
-			"vault default already exists",
 			func(c *cli.Instance) error { return c.CreateVault(cmd, "default") },
 		},
 		{
 			"vault create work",
-			"vault work already exists",
 			func(c *cli.Instance) error { return c.CreateVault(cmd, "work") },
 		},
 	}
@@ -88,7 +88,7 @@ func TestCreateExistingVaultChangesNothing(t *testing.T) {
 
 			err := tt.run(newCLI(fs))
 
-			require.EqualError(t, err, tt.want)
+			require.ErrorIs(t, err, vault.ErrVaultExists)
 			require.Equal(t, before, snapshotStateDir(t, fs))
 		})
 	}
@@ -155,7 +155,7 @@ func TestStopAtPassphrasePromptLeavesNothing(t *testing.T) {
 	require.NoError(t, empty.MkdirAll(testStateDir, secret.DirPerms))
 
 	withDefault := afero.NewMemMapFs()
-	_, err := vault.CreateVault(withDefault, testStateDir, "default", mnemonic)
+	_, err := vault.CreateVault(withDefault, testStateDir, "default", mnemonic, nil)
 	require.NoError(t, err)
 
 	cmd := &cobra.Command{}
@@ -193,3 +193,190 @@ func TestStopAtPassphrasePromptLeavesNothing(t *testing.T) {
 		})
 	}
 }
+
+// TestStopDuringCreateLeavesWholeVaultOrNone is a regression test for
+// https://git.eeqj.de/sneak/secret/issues/105: `secret init` or `secret vault
+// create` killed after the passphrase prompt but before the unlocker was
+// written left a vault with no unlocker, which neither command would then
+// create again. After the prompt, each command changes the state directory
+// only through vault.CreateVault. The test makes that call as the command
+// does and records the state directory before each change it makes, and once
+// after it returns: what a stop at that point leaves. Each must hold either
+// no vault, and not name it current, or exactly the finished vault, which
+// opens with the passphrase through its current unlocker. The command run
+// again after a stop first takes the lock, which must delete what the stop
+// left under a temporary name. Running the command is slow, so it runs once
+// on each different state the lock leaves, and must create the vault there,
+// or refuse the one there.
+//
+//nolint:paralleltest // commands on the in-memory filesystem share one lock
+func TestStopDuringCreateLeavesWholeVaultOrNone(t *testing.T) {
+	mnemonic := testMnemonicBuffer(t)
+	passphrase := memguard.NewBufferFromBytes([]byte(testPassphrase))
+	t.Cleanup(passphrase.Destroy)
+
+	cmd := &cobra.Command{}
+	cmd.SetOut(io.Discard)
+
+	t.Run("init", func(t *testing.T) {
+		// From an empty state directory
+		fs := afero.NewMemMapFs()
+		require.NoError(t, fs.MkdirAll(testStateDir, secret.DirPerms))
+
+		requireStopsLeaveWholeVaultOrNone(t, fs, "default", mnemonic, passphrase,
+			func(c *cli.Instance) error { return c.Init(cmd) })
+	})
+
+	t.Run("vault create work", func(t *testing.T) {
+		// From a state directory holding the vault "default"
+		fs := afero.NewMemMapFs()
+		_, err := vault.CreateVault(fs, testStateDir, "default", mnemonic, nil)
+		require.NoError(t, err)
+
+		requireStopsLeaveWholeVaultOrNone(t, fs, "work", mnemonic, passphrase,
+			func(c *cli.Instance) error { return c.CreateVault(cmd, "work") })
+	})
+}
+
+// requireStopsLeaveWholeVaultOrNone checks, as
+// TestStopDuringCreateLeavesWholeVaultOrNone describes, the stops of the
+// command run, creating the vault name on fs with mnemonic and passphrase.
+// Run again where the vault is there, the command must fail with
+// vault.ErrVaultExists.
+func requireStopsLeaveWholeVaultOrNone(
+	t *testing.T, fs afero.Fs, name string,
+	mnemonic, passphrase *memguard.LockedBuffer,
+	run func(c *cli.Instance) error,
+) {
+	t.Helper()
+
+	var stops []map[string]string
+
+	record := func() { stops = append(stops, snapshotStateDir(t, fs)) }
+
+	_, err := vault.CreateVault(hookFs{Fs: fs, before: record},
+		testStateDir, name, mnemonic, passphrase)
+	require.NoError(t, err)
+	record()
+
+	vaultDir := testStateDir + "/vaults.d/" + name
+	require.NotContains(t, stops[0], vaultDir+"/", "no stop before the vault")
+
+	finished := entriesUnder(stops[len(stops)-1], vaultDir)
+
+	opener := vault.NewVault(fs, testStateDir, name)
+	opener.UnlockPassphrase = passphrase
+
+	key, err := opener.UnlockVault()
+	require.NoError(t, err)
+	require.Equal(t, finished[vaultDir+"/pub.age"], key.Recipient().String())
+
+	// Each different state the command run again finds once it holds the lock
+	var locked []map[string]string
+
+	for i, stop := range stops {
+		if _, there := stop[vaultDir+"/"]; there {
+			require.Equal(t, finished, entriesUnder(stop, vaultDir),
+				"stop %d left a partial vault", i)
+		} else {
+			require.NotEqual(t, name, stop[testStateDir+"/currentvault"],
+				"stop %d made a missing vault current", i)
+		}
+
+		stopped := newFsFromSnapshot(t, stop)
+		release, err := vault.LockStateDir(stopped, testStateDir)
+		require.NoError(t, err)
+		release()
+
+		state := snapshotStateDir(t, stopped)
+		for path := range state {
+			require.NotContains(t, path, ".tmp-", "stop %d", i)
+		}
+
+		if !slices.ContainsFunc(locked, func(s map[string]string) bool {
+			return maps.Equal(s, state)
+		}) {
+			locked = append(locked, state)
+		}
+	}
+
+	for _, state := range locked {
+		c := cli.NewCLIInstanceWithStateDir(newFsFromSnapshot(t, state), testStateDir)
+		c.Mnemonic = mnemonic
+		c.UnlockPassphrase = passphrase
+
+		if _, there := state[vaultDir+"/"]; there {
+			require.ErrorIs(t, run(c), vault.ErrVaultExists)
+		} else {
+			require.NoError(t, run(c))
+		}
+	}
+}
+
+// entriesUnder returns the entries of a tree recorded by snapshotStateDir
+// that are under dir.
+func entriesUnder(tree map[string]string, dir string) map[string]string {
+	entries := map[string]string{}
+
+	for path, content := range tree {
+		if strings.HasPrefix(path, dir+"/") {
+			entries[path] = content
+		}
+	}
+
+	return entries
+}
+
+// hookFs passes every call through to Fs, but first calls before for each
+// call that can change the filesystem.
+type hookFs struct {
+	afero.Fs
+
+	before func()
+}
+
+//nolint:ireturn // implements afero.Fs
+func (h hookFs) Create(name string) (afero.File, error) {
+	h.before()
+
+	return h.Fs.Create(name)
+}
+
+//nolint:ireturn // implements afero.Fs
+func (h hookFs) OpenFile(
+	name string, flag int, perm os.FileMode,
+) (afero.File, error) {
+	h.before()
+
+	return h.Fs.OpenFile(name, flag, perm)
+}
+
+func (h hookFs) Mkdir(name string, perm os.FileMode) error {
+	h.before()
+
+	return h.Fs.Mkdir(name, perm)
+}
+
+func (h hookFs) MkdirAll(path string, perm os.FileMode) error {
+	h.before()
+
+	return h.Fs.MkdirAll(path, perm)
+}
+
+func (h hookFs) Remove(name string) error {
+	h.before()
+
+	return h.Fs.Remove(name)
+}
+
+func (h hookFs) RemoveAll(path string) error {
+	h.before()
+
+	return h.Fs.RemoveAll(path)
+}
+
+func (h hookFs) Rename(oldname, newname string) error {
+	h.before()
+
+	return h.Fs.Rename(oldname, newname)
+}

internal/cli/crypto.go

@@ -91,8 +91,7 @@ func (cli *Instance) storeNewEncryptionKey(
 		return nil, fmt.Errorf("failed to generate age key: %w", err)
 	}
 
-	// Store the generated key directly in a secure buffer
-	secureBuffer := memguard.NewBufferFromBytes([]byte(identity.String()))
+	secureBuffer := secret.IdentityToLockedBuffer(identity)
 
 	err = vlt.AddSecret(secretName, secureBuffer, false)
 	if err != nil {
@@ -131,7 +130,7 @@ func (cli *Instance) resolveEncryptionKey(
 	}
 
 	// Secret exists, get the age secret key from it
-	secretBuffer, err := cli.getSecretValue(vlt, secretObj)
+	secretBuffer, err := vlt.GetSecret(secretName)
 	if err != nil {
 		return nil, fmt.Errorf("failed to get secret value: %w", err)
 	}
@@ -250,7 +249,7 @@ func (cli *Instance) Decrypt(secretName, inputFile, outputFile string) error {
 	}
 
 	// Get the age secret key from the secret
-	secretBuffer, err := cli.getSecretValue(vlt, secretObj)
+	secretBuffer, err := vlt.GetSecret(secretName)
 	if err != nil {
 		return fmt.Errorf("failed to get secret value: %w", err)
 	}
@@ -314,20 +313,3 @@ func isValidAgeSecretKey(key string) bool {
 
 	return err == nil
 }
-
-// getSecretValue retrieves the value of a secret with the vault's mnemonic
-// when it has one, else with the current unlocker
-func (cli *Instance) getSecretValue(
-	vlt *vault.Vault, secretObj *secret.Secret,
-) (*memguard.LockedBuffer, error) {
-	if vlt.Mnemonic != nil {
-		return secretObj.GetValue(nil, vlt.Mnemonic)
-	}
-
-	unlocker, err := vlt.GetCurrentUnlocker()
-	if err != nil {
-		return nil, fmt.Errorf("failed to get current unlocker: %w", err)
-	}
-
-	return secretObj.GetValue(unlocker, nil)
-}

internal/cli/init.go

@@ -6,13 +6,10 @@ import (
 	"log"
 	"log/slog"
 	"os"
-	"path/filepath"
 	"strings"
 
-	"filippo.io/age"
 	"git.eeqj.de/sneak/secret/internal/secret"
 	"git.eeqj.de/sneak/secret/internal/vault"
-	"git.eeqj.de/sneak/secret/pkg/agehd"
 	"github.com/awnumar/memguard"
 	"github.com/spf13/cobra"
 	"github.com/tyler-smith/go-bip39"
@@ -70,43 +67,6 @@ func (cli *Instance) promptMnemonic() (*memguard.LockedBuffer, func(), error) {
 	return mnemonicBuffer, mnemonicBuffer.Destroy, nil
 }
 
-// setupDefaultVault creates the default vault and derives its long-term
-// identity from the mnemonic
-func (cli *Instance) setupDefaultVault(
-	stateDir string, mnemonic *memguard.LockedBuffer,
-) (*vault.Vault, *age.X25519Identity, error) {
-	// Create the default vault - it will handle key derivation internally
-	secret.Debug("Creating default vault")
-
-	vlt, err := vault.CreateVault(cli.fs, cli.stateDir, "default", mnemonic)
-	if err != nil {
-		secret.Debug("Failed to create default vault", "error", err)
-
-		return nil, nil, fmt.Errorf("failed to create default vault: %w", err)
-	}
-
-	// Get the vault metadata to retrieve the derivation index
-	vaultDir := filepath.Join(stateDir, "vaults.d", "default")
-
-	metadata, err := vault.LoadVaultMetadata(cli.fs, vaultDir)
-	if err != nil {
-		secret.Debug("Failed to load vault metadata", "error", err)
-
-		return nil, nil, fmt.Errorf("failed to load vault metadata: %w", err)
-	}
-
-	// Derive the long-term key using the same index that CreateVault used
-	ltIdentity, err := agehd.DeriveIdentity(mnemonic.String(), metadata.DerivationIndex)
-	if err != nil {
-		secret.Debug("Failed to derive long-term key", "error", err)
-
-		return nil, nil, fmt.Errorf(
-			"failed to derive long-term key from mnemonic: %w", err)
-	}
-
-	return vlt, ltIdentity, nil
-}
-
 // Init initializes the secret manager, holding the state directory lock
 // while initialize runs
 func (cli *Instance) Init(cmd *cobra.Command) error {
@@ -173,34 +133,31 @@ func (cli *Instance) initialize(cmd *cobra.Command) error {
 	}
 	defer cleanupPassphrase()
 
-	// Create the default vault and derive its long-term key
-	vlt, ltIdentity, err := cli.setupDefaultVault(stateDir, mnemonic)
+	// Create the default vault with its passphrase unlocker
+	secret.Debug("Creating default vault")
+
+	vlt, err := vault.CreateVault(cli.fs, cli.stateDir, "default",
+		mnemonic, passphraseBuffer)
+	if err != nil {
+		secret.Debug("Failed to create default vault", "error", err)
+
+		return fmt.Errorf("failed to create default vault: %w", err)
+	}
+
+	ltIdentity, err := vlt.GetOrDeriveLongTermKey()
+	if err != nil {
+		return fmt.Errorf("failed to get long-term key: %w", err)
+	}
+
+	unlocker, err := vlt.GetCurrentUnlocker()
 	if err != nil {
 		return err
 	}
 
-	ltPubKey := ltIdentity.Recipient().String()
-
-	// Unlock the vault with the derived long-term key
-	vlt.Unlock(ltIdentity)
-
-	// Create passphrase-protected unlocker
-	secret.Debug("Creating passphrase-protected unlocker")
-
-	passphraseUnlocker, err := vlt.CreatePassphraseUnlocker(passphraseBuffer)
-	if err != nil {
-		secret.Debug("Failed to create unlocker", "error", err)
-
-		return fmt.Errorf("failed to create unlocker: %w", err)
-	}
-
-	// Note: CreatePassphraseUnlocker already encrypts and writes the long-term
-	// private key to longterm.age, so no need to do it again here.
-
 	if cmd != nil {
 		cmd.Printf("\nDefault vault created and configured\n")
-		cmd.Printf("Long-term public key: %s\n", ltPubKey)
-		cmd.Printf("Unlocker ID: %s\n", passphraseUnlocker.GetID())
+		cmd.Printf("Long-term public key: %s\n", ltIdentity.Recipient().String())
+		cmd.Printf("Unlocker ID: %s\n", unlocker.GetID())
 		cmd.Println("\nYour secret manager is ready to use!")
 		cmd.Println("Note: When using SB_SECRET_MNEMONIC environment variable,")
 		cmd.Println("unlockers are not required for secret operations.")

internal/cli/integration_test.go

@@ -2,10 +2,13 @@
 package cli_test
 
 import (
+	"bufio"
+	"bytes"
 	"context"
 	"encoding/json"
 	"errors"
 	"fmt"
+	"io"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -16,7 +19,11 @@ import (
 
 	"git.eeqj.de/sneak/secret/internal/cli"
 	"git.eeqj.de/sneak/secret/internal/secret"
+	"git.eeqj.de/sneak/secret/internal/vault"
 	"git.eeqj.de/sneak/secret/pkg/agehd"
+	"github.com/awnumar/memguard"
+	"github.com/creack/pty"
+	"github.com/spf13/afero"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -673,10 +680,10 @@ func test06GetSecret(t *testing.T, testMnemonic string, runSecret func(...string
 	require.NoError(t, err, "get secret should succeed")
 	assert.Equal(t, "password123", strings.TrimSpace(output), "should return correct secret value")
 
-	// Test that without mnemonic, we get an error
-	output, err = runSecret("get", "database/password")
-	require.Error(t, err, "get should fail without unlock method")
-	assert.Contains(t, output, "failed to unlock vault", "should indicate unlock failure")
+	// Test that without mnemonic, we get an error: the passphrase unlocker
+	// cannot ask for its passphrase, as the tests have no terminal
+	_, err = runSecret("get", "database/password")
+	require.ErrorIs(t, err, secret.ErrPassphraseNotRead, "get should fail without unlock method")
 }
 
 func test07AddSecretVersion(t *testing.T, tempDir, testMnemonic string, runSecret func(...string) (string, error), runSecretWithEnv func(map[string]string, ...string) (string, error), runSecretWithStdin func(string, map[string]string, ...string) (string, error)) {
@@ -832,12 +839,11 @@ func test09GetSpecificVersion(t *testing.T, tempDir, testMnemonic string, runSec
 	assert.Equal(t, "newpassword456", strings.TrimSpace(output), "should return new secret value without --version")
 
 	// An empty --version is not a version; it does not mean the current one
-	output, err = runSecretWithEnv(map[string]string{
+	_, err = runSecretWithEnv(map[string]string{
 		secret.EnvMnemonic: testMnemonic,
 	}, "get", "--version", "", "database/password")
 
-	require.Error(t, err, "get with an empty version should fail")
-	assert.Contains(t, output, "version '' not found", "should reject the empty version")
+	require.ErrorIs(t, err, vault.ErrVersionNotFound, "should reject the empty version")
 }
 
 func test10PromoteVersion(t *testing.T, tempDir, testMnemonic string, runSecret func(...string) (string, error), runSecretWithEnv func(map[string]string, ...string) (string, error)) {
@@ -1151,11 +1157,7 @@ func testInvalidSecretNames(t *testing.T, testMnemonic string, runSecretWithStdi
 			shouldFail := slices.Contains(definitelyInvalid, invalidName)
 
 			if shouldFail {
-				require.Error(t, err, "add '%s' should fail", invalidName)
-
-				if err != nil {
-					assert.Contains(t, output, "invalid secret name", "should indicate invalid name for '%s'", invalidName)
-				}
+				require.ErrorIs(t, err, vault.ErrInvalidSecretName, "add '%s' should fail", invalidName)
 			} else {
 				// For the slash cases and .hidden, they might succeed
 				// Just log what happened
@@ -1303,9 +1305,8 @@ func test12cCrossVaultMove(t *testing.T, testMnemonic string, runSecretWithEnv f
 	require.NoError(t, err, "add force/test in work should succeed")
 
 	// Move without force should fail
-	output, err = runSecretWithEnv(env, "move", "work:force/test", "default")
-	require.Error(t, err, "move without force should fail when dest exists")
-	assert.Contains(t, output, "already exists", "should indicate destination exists")
+	_, err = runSecretWithEnv(env, "move", "work:force/test", "default")
+	require.ErrorIs(t, err, vault.ErrSecretExists, "move without force should fail when dest exists")
 
 	// Move with force should succeed
 	output, err = runSecretWithEnv(env, "move", "--force", "work:force/test", "default")
@@ -1420,9 +1421,8 @@ func test14SwitchVault(t *testing.T, tempDir string, runSecret func(...string) (
 	require.NoError(t, err, "vault select default should succeed")
 
 	// Test selecting non-existent vault
-	output, err := runSecret("vault", "select", "nonexistent")
-	require.Error(t, err, "selecting non-existent vault should fail")
-	assert.Contains(t, output, "does not exist", "should indicate vault doesn't exist")
+	_, err = runSecret("vault", "select", "nonexistent")
+	require.ErrorIs(t, err, vault.ErrVaultNotFound, "selecting non-existent vault should fail")
 }
 
 func test15VaultIsolation(t *testing.T, testMnemonic string, runSecret func(...string) (string, error), runSecretWithEnv func(map[string]string, ...string) (string, error), runSecretWithStdin func(string, map[string]string, ...string) (string, error)) {
@@ -1443,11 +1443,10 @@ func test15VaultIsolation(t *testing.T, testMnemonic string, runSecret func(...s
 	require.NoError(t, err, "vault select work should succeed")
 
 	// Try to get the default-only secret (should fail)
-	output, err := runSecretWithEnv(map[string]string{
+	_, err = runSecretWithEnv(map[string]string{
 		secret.EnvMnemonic: testMnemonic,
 	}, "get", "default-only/secret")
-	require.Error(t, err, "should not be able to get default vault secret from work vault")
-	assert.Contains(t, output, "not found", "should indicate secret not found")
+	require.ErrorIs(t, err, vault.ErrSecretNotFound, "should not be able to get default vault secret from work vault")
 
 	// Add a unique secret to work vault
 	_, err = runSecretWithStdin("work-vault-secret", map[string]string{
@@ -1460,14 +1459,13 @@ func test15VaultIsolation(t *testing.T, testMnemonic string, runSecret func(...s
 	require.NoError(t, err, "vault select default should succeed")
 
 	// Try to get the work-only secret (should fail)
-	output, err = runSecretWithEnv(map[string]string{
+	_, err = runSecretWithEnv(map[string]string{
 		secret.EnvMnemonic: testMnemonic,
 	}, "get", "work-only/secret")
-	require.Error(t, err, "should not be able to get work vault secret from default vault")
-	assert.Contains(t, output, "not found", "should indicate secret not found")
+	require.ErrorIs(t, err, vault.ErrSecretNotFound, "should not be able to get work vault secret from default vault")
 
 	// Verify we can still get the default-only secret
-	output, err = runSecretWithEnv(map[string]string{
+	output, err := runSecretWithEnv(map[string]string{
 		secret.EnvMnemonic: testMnemonic,
 	}, "get", "default-only/secret")
 	require.NoError(t, err, "get default-only secret should succeed")
@@ -1579,11 +1577,10 @@ func test17ImportFromFile(t *testing.T, tempDir, testMnemonic string, runSecretW
 	// Just verify the import succeeded
 
 	// Test importing non-existent file
-	output, err = runSecretWithEnv(map[string]string{
+	_, err = runSecretWithEnv(map[string]string{
 		secret.EnvMnemonic: testMnemonic,
 	}, "import", "imported/nonexistent", "--source", "/nonexistent/file")
-	require.Error(t, err, "importing non-existent file should fail")
-	assert.Contains(t, output, "failed", "should indicate failure")
+	require.ErrorIs(t, err, os.ErrNotExist, "importing non-existent file should fail")
 
 	// Verify filesystem structure
 	defaultVaultDir := filepath.Join(tempDir, "vaults.d", "default")
@@ -1898,11 +1895,10 @@ func test23ErrorHandling(t *testing.T, tempDir, secretPath, testMnemonic string,
 	t.Helper()
 
 	// Get non-existent secret
-	output, err := runSecretWithEnv(map[string]string{
+	_, err := runSecretWithEnv(map[string]string{
 		secret.EnvMnemonic: testMnemonic,
 	}, "get", "nonexistent/secret")
-	require.Error(t, err, "get non-existent secret should fail")
-	assert.Contains(t, output, "not found", "should indicate secret not found")
+	require.ErrorIs(t, err, vault.ErrSecretNotFound, "get non-existent secret should fail")
 
 	// Add secret without mnemonic or unlocker
 	unsetMnemonic := os.Getenv(secret.EnvMnemonic)
@@ -1932,13 +1928,12 @@ func test23ErrorHandling(t *testing.T, tempDir, secretPath, testMnemonic string,
 	// Invalid secret names (already tested in test 12)
 
 	// Non-existent vault operations
-	output, err = runSecret("vault", "select", "nonexistent")
-	require.Error(t, err, "select non-existent vault should fail")
-	assert.Contains(t, output, "does not exist", "should indicate vault doesn't exist")
+	_, err = runSecret("vault", "select", "nonexistent")
+	require.ErrorIs(t, err, vault.ErrVaultNotFound, "select non-existent vault should fail")
 
 	// Import to non-existent vault with test passphrase
 	testPassphrase := "test-passphrase-123" // Define testPassphrase locally
-	output, err = runSecretWithEnv(map[string]string{
+	output, err := runSecretWithEnv(map[string]string{
 		secret.EnvMnemonic:         testMnemonic,
 		secret.EnvUnlockPassphrase: testPassphrase,
 	}, "vault", "import", "nonexistent")
@@ -1946,11 +1941,10 @@ func test23ErrorHandling(t *testing.T, tempDir, secretPath, testMnemonic string,
 	assert.Contains(t, output, "does not exist", "should indicate vault doesn't exist")
 
 	// Get specific version that doesn't exist
-	output, err = runSecretWithEnv(map[string]string{
+	_, err = runSecretWithEnv(map[string]string{
 		secret.EnvMnemonic: testMnemonic,
 	}, "get", "--version", "99999999.999", "database/password")
-	require.Error(t, err, "get non-existent version should fail")
-	assert.Contains(t, output, "not found", "should indicate version not found")
+	require.ErrorIs(t, err, vault.ErrVersionNotFound, "get non-existent version should fail")
 
 	// Promote non-existent version
 	output, err = runSecretWithEnv(map[string]string{
@@ -2360,11 +2354,10 @@ func test30BackupRestore(t *testing.T, tempDir, secretPath, testMnemonic string,
 	assert.NotEmpty(t, output, "restored secret should have value")
 
 	// Verify post-backup secret is gone
-	output, err = runSecretWithEnv(map[string]string{
+	_, err = runSecretWithEnv(map[string]string{
 		secret.EnvMnemonic: testMnemonic,
 	}, "get", "post-backup/secret")
-	require.Error(t, err, "post-backup secret should not exist after restore")
-	assert.Contains(t, output, "not found", "should indicate secret not found")
+	require.ErrorIs(t, err, vault.ErrSecretNotFound, "post-backup secret should not exist after restore")
 
 	t.Log("Backup and restore completed successfully")
 }
@@ -2429,8 +2422,7 @@ func test31EnvMnemonicUsesVaultDerivationIndex(t *testing.T, tempDir, secretPath
 		t.Logf("Output: %s", getOutput)
 
 		// This is the expected behavior with the current bug
-		require.Error(t, err, "get should fail due to wrong derivation index")
-		assert.Contains(t, getOutput, "derived public key does not match vault", "should indicate key derivation failure")
+		require.ErrorIs(t, err, vault.ErrMnemonicMismatch, "get should fail due to wrong derivation index")
 
 		// Document what should happen when the bug is fixed
 		t.Log("When the bug is fixed, GetValue should read vault metadata and use derivation index 1")
@@ -2543,3 +2535,145 @@ func copyFile(src, dst string) error {
 
 	return nil
 }
+
+// secretRmCommand makes a state directory whose vault "default" holds the
+// secret "x", and returns `secret rm x` on the built binary against it, and
+// the directory of "x". The vault has no unlocker, so making it derives no
+// key from a passphrase.
+func secretRmCommand(ctx context.Context, t *testing.T) (*exec.Cmd, string) {
+	t.Helper()
+
+	stateDir := t.TempDir()
+
+	mnemonic := memguard.NewBufferFromBytes([]byte(testMnemonic))
+	defer mnemonic.Destroy()
+
+	vlt, err := vault.CreateVault(afero.NewOsFs(), stateDir, "default", mnemonic, nil)
+	require.NoError(t, err)
+
+	value := memguard.NewBufferFromBytes([]byte("value"))
+	defer value.Destroy()
+
+	require.NoError(t, vlt.AddSecret("x", value, false))
+
+	//nolint:gosec // G204: test executes the freshly built secret binary
+	cmd := exec.CommandContext(ctx, secretBinaryPath(t), "rm", "x")
+	cmd.Env = []string{
+		secret.EnvStateDir + "=" + stateDir,
+		"PATH=" + os.Getenv("PATH"),
+		"HOME=" + os.Getenv("HOME"),
+	}
+
+	return cmd, filepath.Join(stateDir, "vaults.d", "default", "secrets.d", "x")
+}
+
+// TestRemoveWithoutTerminalFailsAtOnce runs `secret rm` without --force,
+// with a stdin that is not a terminal and never delivers anything, as in a
+// script or a CI job. It must fail at once, telling the user to pass
+// --force, instead of waiting for an answer, and remove nothing.
+func TestRemoveWithoutTerminalFailsAtOnce(t *testing.T) {
+	t.Parallel()
+
+	// Nobody writes to or closes the pipe, so reading it would block for good.
+	stdin, stdinWriter, err := os.Pipe()
+	require.NoError(t, err)
+
+	defer func() {
+		_ = stdinWriter.Close()
+		_ = stdin.Close()
+	}()
+
+	ctx, cancel := context.WithTimeout(t.Context(), time.Minute)
+	defer cancel()
+
+	cmd, secretDir := secretRmCommand(ctx, t)
+	cmd.Stdin = stdin
+
+	output, err := cmd.CombinedOutput()
+
+	require.NoError(t, ctx.Err(), "secret rm waited for an answer")
+	require.Error(t, err)
+	assert.Contains(t, string(output), "pass --force")
+	assert.DirExists(t, secretDir)
+}
+
+// The next two tests run `secret rm` with a terminal on stdin or on stdout
+// and stderr, not both: whether it asks must depend on stdin alone, where
+// the answer is read from. pty.Open returns the two ends of a new terminal:
+// tty is the end a program uses as its terminal, and ptmx the end the test
+// reads what the terminal shows from and types into.
+
+// TestRemoveIgnoresTerminalOnStdout runs `echo y | secret rm x` at a
+// terminal. stdin is a pipe, so nobody can answer there, and the command
+// must fail as in a script, removing nothing.
+func TestRemoveIgnoresTerminalOnStdout(t *testing.T) {
+	t.Parallel()
+
+	ctx, cancel := context.WithTimeout(t.Context(), time.Minute)
+	defer cancel()
+
+	cmd, secretDir := secretRmCommand(ctx, t)
+
+	ptmx, tty, err := pty.Open()
+	require.NoError(t, err)
+
+	defer func() { _ = ptmx.Close() }()
+
+	cmd.Stdin = strings.NewReader("y\n")
+	cmd.Stdout = tty
+	cmd.Stderr = tty
+
+	require.NoError(t, cmd.Start())
+
+	_ = tty.Close()
+
+	// The read ends once secret rm has exited and so closed the terminal.
+	shown, _ := io.ReadAll(ptmx)
+
+	require.Error(t, cmd.Wait())
+	assert.Contains(t, string(shown), "pass --force")
+	assert.DirExists(t, secretDir)
+}
+
+// TestRemoveAsksAtTerminalOnStdin runs `secret rm x | cat` at a terminal.
+// It must ask on the terminal, and remove the secret when y is typed there.
+func TestRemoveAsksAtTerminalOnStdin(t *testing.T) {
+	t.Parallel()
+
+	ctx, cancel := context.WithTimeout(t.Context(), time.Minute)
+	defer cancel()
+
+	cmd, secretDir := secretRmCommand(ctx, t)
+
+	ptmx, tty, err := pty.Open()
+	require.NoError(t, err)
+
+	defer func() { _ = ptmx.Close() }()
+
+	cmd.Stdin = tty
+	// Not a file, so exec.Cmd connects stdout through a pipe.
+	cmd.Stdout = io.Discard
+	cmd.Stderr = tty
+
+	require.NoError(t, cmd.Start())
+
+	_ = tty.Close()
+
+	var (
+		shown []byte
+		char  byte
+	)
+
+	terminal := bufio.NewReader(ptmx)
+	for !bytes.HasSuffix(shown, []byte("[y/N] ")) {
+		char, err = terminal.ReadByte()
+		require.NoError(t, err, "secret rm ended without asking: %s", shown)
+
+		shown = append(shown, char)
+	}
+
+	_, err = ptmx.WriteString("y\n")
+	require.NoError(t, err)
+	require.NoError(t, cmd.Wait())
+	assert.NoDirExists(t, secretDir)
+}

internal/cli/leftovers_test.go

@@ -0,0 +1,74 @@
+package cli_test
+
+import (
+	"io"
+	"testing"
+
+	"git.eeqj.de/sneak/secret/internal/cli"
+	"git.eeqj.de/sneak/secret/internal/secret"
+	"git.eeqj.de/sneak/secret/internal/vault"
+	"github.com/spf13/afero"
+	"github.com/spf13/cobra"
+	"github.com/stretchr/testify/require"
+)
+
+// TestLeftoversRemovedByNextChangingCommand is a regression test for
+// https://git.eeqj.de/sneak/secret/issues/75. It plants what a command
+// killed part-way leaves in each directory where secret.TempDirFor and
+// secret.WriteFileAtomic make temporary entries: a temporary directory
+// holding a vault, secret, unlocker or version being added or removed, and
+// a temporary file beside a file being replaced. `secret list` must leave
+// them all, and the next command that takes the state directory lock, here
+// `secret vault select` of the vault already current, must delete exactly
+// them: a vault named like a temporary directory stays. The copy has no
+// lock file yet, so that command, as after a killed one, finds no mark that
+// the last holder of the lock finished.
+func TestLeftoversRemovedByNextChangingCommand(t *testing.T) {
+	t.Parallel()
+
+	fs := newTwoVaultFs(t)
+
+	_, err := vault.CreateVault(fs, testStateDir, ".tmp-0", nil, nil)
+	require.NoError(t, err)
+	require.NoError(t, vault.SelectVault(fs, testStateDir, "default"))
+
+	before := snapshotStateDir(t, fs)
+
+	vaultDir := testStateDir + "/vaults.d/default"
+	secretDir := vaultDir + "/secrets.d/x"
+
+	versions, err := secret.ListVersions(fs, secretDir)
+	require.NoError(t, err)
+	require.Len(t, versions, 1)
+
+	for _, dir := range []string{
+		testStateDir + "/.tmp-1/default",
+		vaultDir + "/.tmp-2/x",
+		secretDir + "/.tmp-3/" + testVersion,
+	} {
+		require.NoError(t, fs.MkdirAll(dir, secret.DirPerms))
+		require.NoError(t, afero.WriteFile(fs, dir+"/value.age",
+			[]byte("encrypted"), secret.FilePerms))
+	}
+
+	for _, file := range []string{
+		testStateDir + "/.currentvault.tmp-4",
+		vaultDir + "/.current-unlocker.tmp-5",
+		secretDir + "/.current.tmp-6",
+		secretDir + "/versions/" + versions[0] + "/.metadata.age.tmp-7",
+	} {
+		require.NoError(t, afero.WriteFile(fs, file,
+			[]byte("partial"), secret.FilePerms))
+	}
+
+	planted := snapshotStateDir(t, fs)
+	c := cli.NewCLIInstanceWithStateDir(fs, testStateDir)
+	cmd := &cobra.Command{}
+	cmd.SetOut(io.Discard)
+
+	require.NoError(t, c.ListSecrets(cmd, false, false, ""))
+	require.Equal(t, planted, snapshotStateDir(t, fs))
+
+	require.NoError(t, c.SelectVault(cmd, "default"))
+	require.Equal(t, before, snapshotStateDir(t, fs))
+}

internal/cli/lock_test.go

@@ -110,7 +110,7 @@ func TestConcurrentAddsKeepEveryVersion(t *testing.T) {
 		{"real", afero.NewOsFs(), t.TempDir()},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
-			_, err := vault.CreateVault(tc.fs, tc.stateDir, "default", mnemonic)
+			_, err := vault.CreateVault(tc.fs, tc.stateDir, "default", mnemonic, nil)
 			require.NoError(t, err)
 
 			// One add creates the secret; the others find that it exists
@@ -185,7 +185,7 @@ func (r *readNotifier) Read(p []byte) (int, error) {
 //nolint:paralleltest // times commands against the in-memory lock all tests share
 func TestEncryptPipedIntoAdd(t *testing.T) {
 	fs := afero.NewMemMapFs()
-	_, err := vault.CreateVault(fs, testStateDir, "default", testMnemonicBuffer(t))
+	_, err := vault.CreateVault(fs, testStateDir, "default", testMnemonicBuffer(t), nil)
 	require.NoError(t, err)
 	require.NoError(t, afero.WriteFile(fs, testInput, []byte("piped"), 0o600))
 
@@ -241,8 +241,10 @@ func TestFailedCommandReleasesLock(t *testing.T) {
 	fs := afero.NewMemMapFs()
 	cli := NewCLIInstanceWithStateDir(fs, testStateDir)
 
-	// Fails once it holds the lock: there is no current vault
-	err := cli.RemoveSecret(&cobra.Command{}, "missing", false)
+	// Fails once it holds the lock: there is no current vault. Without
+	// --force it would fail before taking the lock, on the check it makes
+	// before asking.
+	err := cli.RemoveSecret(&cobra.Command{}, "missing", true)
 	require.Error(t, err)
 
 	select {
@@ -290,14 +292,14 @@ func setupEveryCommand(
 
 	mnemonic := testMnemonicBuffer(t)
 
-	other, err := vault.CreateVault(fs, testStateDir, "other", mnemonic)
+	other, err := vault.CreateVault(fs, testStateDir, "other", mnemonic, nil)
 	require.NoError(t, err)
 
 	otherDir, err := other.GetDirectory()
 	require.NoError(t, err)
 	require.NoError(t, fs.Remove(filepath.Join(otherDir, "pub.age")))
 
-	vlt, err := vault.CreateVault(fs, testStateDir, "work", mnemonic)
+	vlt, err := vault.CreateVault(fs, testStateDir, "work", mnemonic, nil)
 	require.NoError(t, err)
 
 	addTestSecret(t, vlt, []byte("older"), false)
@@ -360,7 +362,6 @@ func requireWaitsForLock(
 
 	fs := afero.NewMemMapFs()
 	olderVersion, unlockerID := setupEveryCommand(t, fs, withUnlocker)
-	before := stateDirModTimes(t, fs)
 
 	release, err := vault.LockStateDir(fs, testStateDir)
 	require.NoError(t, err)
@@ -370,6 +371,9 @@ func requireWaitsForLock(
 	release = sync.OnceFunc(release)
 	defer release()
 
+	// Taken only now, since taking the lock writes the lock file.
+	before := stateDirModTimes(t, fs)
+
 	unlockPassphrase := memguard.NewBufferFromBytes([]byte(testPassphrase))
 	defer unlockPassphrase.Destroy()
 
@@ -431,8 +435,8 @@ func TestChangingCommandsWaitForLock(t *testing.T) {
 		{"encrypt", false, func(cli *Instance, _, _ string) error {
 			return cli.Encrypt("key", testInput, "")
 		}},
-		{"rm", false, func(cli *Instance, _, _ string) error {
-			return cli.RemoveSecret(cli.cmd, "test/secret", false)
+		{"rm --force", false, func(cli *Instance, _, _ string) error {
+			return cli.RemoveSecret(cli.cmd, "test/secret", true)
 		}},
 		{"move", false, func(cli *Instance, _, _ string) error {
 			return cli.MoveSecret(cli.cmd, "test/secret", "moved", false)
@@ -440,8 +444,8 @@ func TestChangingCommandsWaitForLock(t *testing.T) {
 		{"version promote", false, func(cli *Instance, olderVersion, _ string) error {
 			return cli.PromoteVersion(cli.cmd, "test/secret", olderVersion)
 		}},
-		{"version rm", false, func(cli *Instance, olderVersion, _ string) error {
-			return cli.RemoveVersion(cli.cmd, "test/secret", olderVersion)
+		{"version rm --force", false, func(cli *Instance, olderVersion, _ string) error {
+			return cli.RemoveVersion(cli.cmd, "test/secret", olderVersion, true)
 		}},
 		{"vault create", false, func(cli *Instance, _, _ string) error {
 			return cli.CreateVault(cli.cmd, "created")
@@ -452,13 +456,13 @@ func TestChangingCommandsWaitForLock(t *testing.T) {
 		{"vault import", false, func(cli *Instance, _, _ string) error {
 			return cli.VaultImport(cli.cmd, "other")
 		}},
-		{"vault rm", false, func(cli *Instance, _, _ string) error {
-			return cli.RemoveVault(cli.cmd, "other", false)
+		{"vault rm --force", false, func(cli *Instance, _, _ string) error {
+			return cli.RemoveVault(cli.cmd, "other", true)
 		}},
 		{"unlocker add", false, func(cli *Instance, _, _ string) error {
 			return cli.UnlockersAdd("passphrase", cli.cmd)
 		}},
-		{"unlocker rm", true, func(cli *Instance, _, unlockerID string) error {
+		{"unlocker rm --force", true, func(cli *Instance, _, unlockerID string) error {
 			return cli.UnlockersRemove(unlockerID, true, cli.cmd)
 		}},
 		{"unlocker select", true, func(cli *Instance, _, unlockerID string) error {
@@ -483,7 +487,7 @@ func TestEncryptWithExistingKeyTakesNoLock(t *testing.T) {
 	mnemonic := testMnemonicBuffer(t)
 
 	fs := afero.NewMemMapFs()
-	_, err := vault.CreateVault(fs, testStateDir, "default", mnemonic)
+	_, err := vault.CreateVault(fs, testStateDir, "default", mnemonic, nil)
 	require.NoError(t, err)
 	require.NoError(t, afero.WriteFile(fs, testInput, []byte("input"), 0o600))
 
@@ -521,7 +525,7 @@ func TestEncryptWithExistingKeyTakesNoLock(t *testing.T) {
 //nolint:paralleltest // times commands against the in-memory lock all tests share
 func TestEncryptStreamsUnlocked(t *testing.T) {
 	fs := afero.NewMemMapFs()
-	_, err := vault.CreateVault(fs, testStateDir, "default", testMnemonicBuffer(t))
+	_, err := vault.CreateVault(fs, testStateDir, "default", testMnemonicBuffer(t), nil)
 	require.NoError(t, err)
 	require.NoError(t, afero.WriteFile(fs, testInput, []byte("streamed"), 0o600))
 

internal/cli/move_test.go

@@ -30,6 +30,8 @@ func TestRejectedMoveWithinVaultLeavesStateUnchanged(t *testing.T) {
 		workX      = "work:x"
 	)
 
+	// internal/cli declares these errors itself and does not export them, so
+	// only their text can be compared.
 	tests := []struct {
 		command      string
 		source, dest string
@@ -52,21 +54,6 @@ func TestRejectedMoveWithinVaultLeavesStateUnchanged(t *testing.T) {
 			"mv --force nosuch:x nosuch:y", "nosuch:x", "nosuch:y", true,
 			"vault 'nosuch' does not exist",
 		},
-		// Each of these spells "work" a second way. The spelling is not a
-		// valid vault name, so the move is not taken for a move between two
-		// vaults, which would delete the destination, here the source.
-		{
-			"mv --force work:x work/:x", workX, "work/:x", true,
-			vault.ValidateVaultName("work/").Error(),
-		},
-		{
-			"mv --force work/:x work:", "work/:x", "work:", true,
-			vault.ValidateVaultName("work/").Error(),
-		},
-		{
-			"mv --force work:x ./work:x", workX, "./work:x", true,
-			vault.ValidateVaultName("./work").Error(),
-		},
 	}
 
 	for _, tt := range tests {
@@ -82,6 +69,26 @@ func TestRejectedMoveWithinVaultLeavesStateUnchanged(t *testing.T) {
 			require.EqualError(t, err, tt.wantErr)
 		})
 	}
+
+	// Each of these spells "work" a second way. The spelling is not a valid
+	// vault name, so the move is not taken for a move between two vaults,
+	// which would delete the destination, here the source.
+	invalidNames := []struct{ source, dest string }{
+		{workX, "work/:x"},
+		{"work/:x", "work:"},
+		{workX, "./work:x"},
+	}
+
+	for _, tt := range invalidNames {
+		t.Run("mv --force "+tt.source+" "+tt.dest, func(t *testing.T) {
+			t.Parallel()
+
+			requireRejectedAndUnchanged(t, before, vault.ErrInvalidVaultName,
+				func(c *cli.Instance) error {
+					return c.MoveSecret(&cobra.Command{}, tt.source, tt.dest, true)
+				})
+		})
+	}
 }
 
 // TestMoveWithinOtherVaultKeepsCurrentVault checks that `secret mv work:x
@@ -156,10 +163,10 @@ func TestMoveOntoSameSecretUnderAnotherNameIsRejected(t *testing.T) {
 			vaultsDir := filepath.Join(stateDir, "vaults.d")
 
 			// "default" is created last, so it is the current vault.
-			_, err := vault.CreateVault(fs, stateDir, "other", testMnemonicBuffer(t))
+			_, err := vault.CreateVault(fs, stateDir, "other", testMnemonicBuffer(t), nil)
 			require.NoError(t, err)
 
-			vlt, err := vault.CreateVault(fs, stateDir, "default", testMnemonicBuffer(t))
+			vlt, err := vault.CreateVault(fs, stateDir, "default", testMnemonicBuffer(t), nil)
 			require.NoError(t, err)
 
 			err = vlt.AddSecret("x", memguard.NewBufferFromBytes([]byte("value")), false)
@@ -205,7 +212,7 @@ func TestForcedCaseOnlyMoveOnCaseSensitiveFilesystem(t *testing.T) {
 	fs := afero.NewOsFs()
 	stateDir := t.TempDir()
 
-	vlt, err := vault.CreateVault(fs, stateDir, "default", testMnemonicBuffer(t))
+	vlt, err := vault.CreateVault(fs, stateDir, "default", testMnemonicBuffer(t), nil)
 	require.NoError(t, err)
 
 	err = vlt.AddSecret("Foo", memguard.NewBufferFromBytes([]byte("upper")), false)

internal/cli/path_traversal_test.go

@@ -68,7 +68,7 @@ func newTwoVaultFs(t *testing.T) afero.Fs {
 		mnemonic := testMnemonicBuffer(t)
 
 		for _, name := range []string{"work", "default"} {
-			vlt, err := vault.CreateVault(fs, testStateDir, name, mnemonic)
+			vlt, err := vault.CreateVault(fs, testStateDir, name, mnemonic, nil)
 			require.NoError(t, err)
 
 			err = vlt.AddSecret("x", memguard.NewBufferFromBytes([]byte("value")), false)
@@ -90,6 +90,8 @@ func newTwoVaultFs(t *testing.T) afero.Fs {
 // snapshotStateDir maps every file under the state directory to its
 // contents, and every directory, written with a trailing "/", to "". Two
 // snapshots are equal only if nothing in it was added, removed or changed.
+// The lock file, which every command that takes the lock writes, is left
+// out.
 func snapshotStateDir(t *testing.T, fs afero.Fs) map[string]string {
 	t.Helper()
 
@@ -102,6 +104,10 @@ func snapshotStateDir(t *testing.T, fs afero.Fs) map[string]string {
 			return err
 		}
 
+		if path == testStateDir+"/lock" {
+			return nil
+		}
+
 		if info.IsDir() {
 			tree[path+"/"] = ""
 
@@ -148,11 +154,10 @@ func newFsFromSnapshot(t *testing.T, tree map[string]string) afero.Fs {
 }
 
 // requireRejectedAndUnchanged runs a command on a copy of the state
-// directory recorded in before. It requires an error with exactly the
-// message of want, so that a later check rejecting the argument does not
-// count, and everything under the state directory as it was: the error
-// alone proves nothing, since it could come after the vault had already
-// been deleted.
+// directory recorded in before. It requires the error want, so that a later
+// check rejecting the argument does not count, and everything under the
+// state directory as it was: the error alone proves nothing, since it could
+// come after the vault had already been deleted.
 func requireRejectedAndUnchanged(
 	t *testing.T, before map[string]string, want error,
 	run func(c *cli.Instance) error,
@@ -164,14 +169,14 @@ func requireRejectedAndUnchanged(
 	err := run(cli.NewCLIInstanceWithStateDir(fs, testStateDir))
 
 	require.Equal(t, before, snapshotStateDir(t, fs))
-	require.EqualError(t, err, want.Error())
+	require.ErrorIs(t, err, want)
 }
 
 // TestInvalidSecretNameLeavesVaultsUnchanged is a regression test for
 // https://git.eeqj.de/sneak/secret/issues/33, where `secret rm ..` deleted
 // the whole vault, and `secret rm .` or `secret rm ""` every secret in it.
-// Moves and imports use --force, so that only the name check stands in
-// the way.
+// Removals, moves and imports use --force, so that only the name check
+// stands in the way.
 //
 //nolint:paralleltest // the cases share cmd
 func TestInvalidSecretNameLeavesVaultsUnchanged(t *testing.T) {
@@ -187,77 +192,76 @@ func TestInvalidSecretNameLeavesVaultsUnchanged(t *testing.T) {
 	cmd := &cobra.Command{}
 
 	tests := []struct {
-		command  string
-		rejected string // the secret name the command must reject
-		run      func(c *cli.Instance) error
+		command string
+		run     func(c *cli.Instance) error
 	}{
-		{"rm ..", "..", func(c *cli.Instance) error {
-			return c.RemoveSecret(cmd, "..", false)
+		{"rm --force ..", func(c *cli.Instance) error {
+			return c.RemoveSecret(cmd, "..", true)
 		}},
-		{"rm .", ".", func(c *cli.Instance) error {
-			return c.RemoveSecret(cmd, ".", false)
+		{"rm --force .", func(c *cli.Instance) error {
+			return c.RemoveSecret(cmd, ".", true)
 		}},
-		{`rm ""`, "", func(c *cli.Instance) error {
-			return c.RemoveSecret(cmd, "", false)
+		{`rm --force ""`, func(c *cli.Instance) error {
+			return c.RemoveSecret(cmd, "", true)
 		}},
-		{"rm ../../etc", "../../etc", func(c *cli.Instance) error {
-			return c.RemoveSecret(cmd, "../../etc", false)
+		{"rm --force ../../etc", func(c *cli.Instance) error {
+			return c.RemoveSecret(cmd, "../../etc", true)
 		}},
-		{"mv --force .. x", "..", func(c *cli.Instance) error {
+		{"mv --force .. x", func(c *cli.Instance) error {
 			return c.MoveSecret(cmd, "..", "x", true)
 		}},
-		{"mv --force x ..", "..", func(c *cli.Instance) error {
+		{"mv --force x ..", func(c *cli.Instance) error {
 			return c.MoveSecret(cmd, "x", "..", true)
 		}},
-		{`mv --force x ""`, "", func(c *cli.Instance) error {
+		{`mv --force x ""`, func(c *cli.Instance) error {
 			return c.MoveSecret(cmd, "x", "", true)
 		}},
 		// "work" is not the current vault: a move within it must not
 		// select it when a name is rejected.
-		{"mv --force work:.. work:x", "..", func(c *cli.Instance) error {
+		{"mv --force work:.. work:x", func(c *cli.Instance) error {
 			return c.MoveSecret(cmd, "work:..", "work:x", true)
 		}},
-		{"mv --force work:x work:..", "..", func(c *cli.Instance) error {
+		{"mv --force work:x work:..", func(c *cli.Instance) error {
 			return c.MoveSecret(cmd, "work:x", "work:..", true)
 		}},
-		{"mv --force default:.. work", "..", func(c *cli.Instance) error {
+		{"mv --force default:.. work", func(c *cli.Instance) error {
 			return c.MoveSecret(cmd, "default:..", "work", true)
 		}},
-		{"mv --force default:.. work:y", "..", func(c *cli.Instance) error {
+		{"mv --force default:.. work:y", func(c *cli.Instance) error {
 			return c.MoveSecret(cmd, "default:..", "work:y", true)
 		}},
-		{"mv --force default:x work:..", "..", func(c *cli.Instance) error {
+		{"mv --force default:x work:..", func(c *cli.Instance) error {
 			return c.MoveSecret(cmd, "default:x", "work:..", true)
 		}},
-		{"import --force ..", "..", func(c *cli.Instance) error {
+		{"import --force ..", func(c *cli.Instance) error {
 			return c.ImportSecret(cmd, "..", missingFile, true)
 		}},
-		{"import --force .", ".", func(c *cli.Instance) error {
+		{"import --force .", func(c *cli.Instance) error {
 			return c.ImportSecret(cmd, ".", missingFile, true)
 		}},
-		{"import --force ../../etc", "../../etc", func(c *cli.Instance) error {
+		{"import --force ../../etc", func(c *cli.Instance) error {
 			return c.ImportSecret(cmd, "../../etc", missingFile, true)
 		}},
-		{"version list ..", "..", func(c *cli.Instance) error {
+		{"version list ..", func(c *cli.Instance) error {
 			return c.ListVersions(cmd, "..")
 		}},
-		{"version promote ..", "..", func(c *cli.Instance) error {
+		{"version promote ..", func(c *cli.Instance) error {
 			return c.PromoteVersion(cmd, "..", testVersion)
 		}},
-		{"version rm ..", "..", func(c *cli.Instance) error {
-			return c.RemoveVersion(cmd, "..", testVersion)
+		{"version rm --force ..", func(c *cli.Instance) error {
+			return c.RemoveVersion(cmd, "..", testVersion, true)
 		}},
-		{"encrypt ..", "..", func(c *cli.Instance) error {
+		{"encrypt ..", func(c *cli.Instance) error {
 			return c.Encrypt("..", "", "")
 		}},
-		{"decrypt ..", "..", func(c *cli.Instance) error {
+		{"decrypt ..", func(c *cli.Instance) error {
 			return c.Decrypt("..", "", "")
 		}},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.command, func(t *testing.T) {
-			requireRejectedAndUnchanged(t, before, vault.ValidateSecretName(tt.rejected), tt.run)
+			requireRejectedAndUnchanged(t, before, vault.ErrInvalidSecretName, tt.run)
 		})
 	}
 }
@@ -279,8 +283,8 @@ func TestInvalidVersionLeavesVaultsUnchanged(t *testing.T) {
 		command string
 		run     func(c *cli.Instance, version string) error
 	}{
-		{"version rm x", func(c *cli.Instance, version string) error {
-			return c.RemoveVersion(cmd, "x", version)
+		{"version rm --force x", func(c *cli.Instance, version string) error {
+			return c.RemoveVersion(cmd, "x", version, true)
 		}},
 		{"version promote x", func(c *cli.Instance, version string) error {
 			return c.PromoteVersion(cmd, "x", version)
@@ -293,10 +297,18 @@ func TestInvalidVersionLeavesVaultsUnchanged(t *testing.T) {
 	for _, tt := range commands {
 		for _, version := range []string{"", ".", "..", "../../..", "a/b"} {
 			t.Run(fmt.Sprintf("%s %q", tt.command, version), func(t *testing.T) {
+				fs := newFsFromSnapshot(t, before)
+
+				err := tt.run(cli.NewCLIInstanceWithStateDir(fs, testStateDir), version)
+
+				require.Equal(t, before, snapshotStateDir(t, fs))
+
+				// Compared as text: `version rm` and `version promote` return
+				// internal/cli's own error of this text, which errors.Is does
+				// not match to vault.ErrVersionNotFound.
 				want := fmt.Errorf("version '%s' %w '%s'",
 					version, vault.ErrVersionNotFound, "x")
-				requireRejectedAndUnchanged(t, before, want,
-					func(c *cli.Instance) error { return tt.run(c, version) })
+				require.EqualError(t, err, want.Error())
 			})
 		}
 	}
@@ -349,7 +361,7 @@ func TestInvalidVaultNameLeavesStateUnchanged(t *testing.T) {
 	for _, tt := range commands {
 		for _, name := range []string{"", ".", "..", "a/b"} {
 			t.Run(fmt.Sprintf(tt.command, name), func(t *testing.T) {
-				requireRejectedAndUnchanged(t, before, vault.ValidateVaultName(name),
+				requireRejectedAndUnchanged(t, before, vault.ErrInvalidVaultName,
 					func(c *cli.Instance) error {
 						c.Mnemonic = mnemonic
 						c.UnlockPassphrase = passphrase
@@ -361,9 +373,9 @@ func TestInvalidVaultNameLeavesStateUnchanged(t *testing.T) {
 	}
 }
 
-// TestRemoveVersionRemovesOnlyThatVersion checks that `secret version rm`
-// with a version that is not the current one removes that version and
-// changes nothing else.
+// TestRemoveVersionRemovesOnlyThatVersion checks that
+// `secret version rm --force` with a version that is not the current one
+// removes that version and changes nothing else.
 func TestRemoveVersionRemovesOnlyThatVersion(t *testing.T) {
 	t.Parallel()
 
@@ -389,7 +401,7 @@ func TestRemoveVersionRemovesOnlyThatVersion(t *testing.T) {
 	require.Contains(t, before, oldDir)
 
 	c := cli.NewCLIInstanceWithStateDir(fs, testStateDir)
-	err = c.RemoveVersion(&cobra.Command{}, "x", versions[1])
+	err = c.RemoveVersion(&cobra.Command{}, "x", versions[1], true)
 	require.NoError(t, err)
 
 	// Expected: the state as before without everything under oldDir.

internal/cli/secrets.go

@@ -205,19 +205,25 @@ func newRemoveCmd() *cobra.Command {
 		Aliases: []string{"rm"},
 		Short:   "Remove a secret from the vault",
 		Long: `Remove a secret and all its versions from the current ` +
-			`vault. This action is permanent and cannot be undone.`,
+			`vault. This action is permanent and cannot be undone. ` +
+			`Asks for confirmation first; when stdin is not a terminal, ` +
+			`fails unless --force is given.`,
 		Args:              cobra.ExactArgs(1),
 		ValidArgsFunction: getSecretNamesCompletionFunc(cli.fs, cli.stateDir),
 		RunE: func(cmd *cobra.Command, args []string) error {
+			force, _ := cmd.Flags().GetBool("force")
+
 			cli, err := NewCLIInstance()
 			if err != nil {
 				return fmt.Errorf("failed to initialize CLI: %w", err)
 			}
 
-			return cli.RemoveSecret(cmd, args[0], false)
+			return cli.RemoveSecret(cmd, args[0], force)
 		},
 	}
 
+	cmd.Flags().BoolP("force", "f", false, "Remove without asking for confirmation")
+
 	return cmd
 }
 
@@ -699,29 +705,64 @@ func (cli *Instance) ImportSecret(
 	return nil
 }
 
-// RemoveSecret removes a secret from the vault
-func (cli *Instance) RemoveSecret(cmd *cobra.Command, secretName string, _ bool) error {
+// RemoveSecret removes a secret and all its versions from the current
+// vault, after asking the user to confirm unless force is set.
+func (cli *Instance) RemoveSecret(
+	cmd *cobra.Command, secretName string, force bool,
+) error {
 	err := vault.ValidateSecretName(secretName)
 	if err != nil {
 		return err
 	}
 
-	release, err := vault.LockStateDir(cli.fs, cli.stateDir)
+	var found secretToRemove
+
+	release, err := cli.askThenLock(cmd, force, func() (string, error) {
+		var err error
+
+		found, err = cli.findSecretToRemove(secretName)
+
+		return found.question, err
+	})
 	if err != nil {
 		return err
 	}
 	defer release()
 
-	// Get current vault
-	currentVlt, err := vault.GetCurrentVault(cli.fs, cli.stateDir)
+	err = secret.RemoveDirAtomic(cli.fs, found.dir)
 	if err != nil {
-		return err
+		return fmt.Errorf("failed to remove secret: %w", err)
+	}
+
+	cmd.Printf("Removed secret '%s' (%d version(s) deleted)\n",
+		secretName, found.versions)
+
+	return nil
+}
+
+// secretToRemove is what removing a secret removes, as findSecretToRemove
+// found it.
+type secretToRemove struct {
+	// dir is the secret's directory, which holds all its versions.
+	dir      string
+	versions int
+	// question names what is removed, for the user to confirm.
+	question string
+}
+
+// findSecretToRemove checks that the secret exists in the current vault
+// and counts its versions.
+func (cli *Instance) findSecretToRemove(
+	secretName string,
+) (secretToRemove, error) {
+	currentVlt, err := vault.GetCurrentVault(cli.fs, cli.stateDir)
+	if err != nil {
+		return secretToRemove{}, err
 	}
 
-	// Check if secret exists
 	vaultDir, err := currentVlt.GetDirectory()
 	if err != nil {
-		return err
+		return secretToRemove{}, err
 	}
 
 	encodedName := strings.ReplaceAll(secretName, "/", "%")
@@ -729,32 +770,30 @@ func (cli *Instance) RemoveSecret(cmd *cobra.Command, secretName string, _ bool)
 
 	exists, err := afero.DirExists(cli.fs, secretDir)
 	if err != nil {
-		return fmt.Errorf("failed to check if secret exists: %w", err)
+		return secretToRemove{},
+			fmt.Errorf("failed to check if secret exists: %w", err)
 	}
 
 	if !exists {
-		return fmt.Errorf("secret '%s' %w", secretName, errSecretNotFound)
+		return secretToRemove{},
+			fmt.Errorf("secret '%s' %w", secretName, errSecretNotFound)
 	}
 
-	// Count versions for information
-	versionsDir := filepath.Join(secretDir, "versions")
-	versionCount := 0
-
-	entries, err := afero.ReadDir(cli.fs, versionsDir)
-	if err == nil {
-		versionCount = len(entries)
+	// A secret without a versions directory has no versions, and can
+	// still be removed.
+	versions, err := afero.ReadDir(cli.fs, filepath.Join(secretDir, "versions"))
+	if err != nil && !errors.Is(err, os.ErrNotExist) {
+		return secretToRemove{}, fmt.Errorf(
+			"failed to count the versions of secret '%s': %w", secretName, err)
 	}
 
-	// Remove the secret directory
-	err = secret.RemoveDirAtomic(cli.fs, secretDir)
-	if err != nil {
-		return fmt.Errorf("failed to remove secret: %w", err)
-	}
-
-	cmd.Printf("Removed secret '%s' (%d version(s) deleted)\n",
-		secretName, versionCount)
-
-	return nil
+	return secretToRemove{
+		dir:      secretDir,
+		versions: len(versions),
+		question: fmt.Sprintf("Permanently remove secret '%s' and its %d "+
+			"version(s) from vault '%s'?",
+			secretName, len(versions), currentVlt.GetName()),
+	}, nil
 }
 
 // MoveSecret moves or renames a secret (within or across vaults), holding

internal/cli/secrets_size_test.go

@@ -71,7 +71,8 @@ func newSizeTestVault(t *testing.T) (afero.Fs, *vault.Vault) {
 	fs := afero.NewMemMapFs()
 
 	// Create vault
-	_, err := vault.CreateVault(fs, testStateDir, testVaultName, testMnemonicBuffer(t))
+	_, err := vault.CreateVault(fs, testStateDir, testVaultName,
+		testMnemonicBuffer(t), nil)
 	require.NoError(t, err)
 
 	// Set current vault
@@ -92,8 +93,8 @@ func newSizeTestVault(t *testing.T) (afero.Fs, *vault.Vault) {
 }
 
 // runAddSecretSizeCase adds a secret of the given size through stdin and
-// verifies the outcome.
-func runAddSecretSizeCase(t *testing.T, size int, wantErr bool, errMsg string) {
+// verifies the outcome: wantErr, or the secret stored when wantErr is nil.
+func runAddSecretSizeCase(t *testing.T, size int, wantErr error) {
 	t.Helper()
 	skipIfLockedMemoryTooLow(t, size)
 
@@ -127,9 +128,8 @@ func runAddSecretSizeCase(t *testing.T, size int, wantErr bool, errMsg string) {
 	secretName := fmt.Sprintf("test-secret-%d", size)
 	err = cli.AddSecret(secretName, false)
 
-	if wantErr {
-		require.Error(t, err)
-		assert.Contains(t, err.Error(), errMsg)
+	if wantErr != nil {
+		require.ErrorIs(t, err, wantErr)
 
 		return
 	}
@@ -147,8 +147,8 @@ func runAddSecretSizeCase(t *testing.T, size int, wantErr bool, errMsg string) {
 }
 
 // runImportSecretSizeCase imports a secret file of the given size and
-// verifies the outcome.
-func runImportSecretSizeCase(t *testing.T, size int, wantErr bool, errMsg string) {
+// verifies the outcome: wantErr, or the secret stored when wantErr is nil.
+func runImportSecretSizeCase(t *testing.T, size int, wantErr error) {
 	t.Helper()
 	skipIfLockedMemoryTooLow(t, size)
 
@@ -180,9 +180,8 @@ func runImportSecretSizeCase(t *testing.T, size int, wantErr bool, errMsg string
 	secretName := fmt.Sprintf("imported-secret-%d", size)
 	err = cli.ImportSecret(cmd, secretName, testFile, false)
 
-	if wantErr {
-		require.Error(t, err)
-		assert.Contains(t, err.Error(), errMsg)
+	if wantErr != nil {
+		require.ErrorIs(t, err, wantErr)
 
 		return
 	}
@@ -204,57 +203,48 @@ func runImportSecretSizeCase(t *testing.T, size int, wantErr bool, errMsg string
 //nolint:paralleltest // together the subtests lock more than the memlock limit
 func TestAddSecretVariousSizes(t *testing.T) {
 	tests := []struct {
-		name        string
-		size        int
-		shouldError bool
-		errorMsg    string
+		name    string
+		size    int
+		wantErr error
 	}{
 		{
-			name:        "1KB secret",
-			size:        1024,
-			shouldError: false,
+			name: "1KB secret",
+			size: 1024,
 		},
 		{
-			name:        "10KB secret",
-			size:        10 * 1024,
-			shouldError: false,
+			name: "10KB secret",
+			size: 10 * 1024,
 		},
 		{
-			name:        "100KB secret",
-			size:        100 * 1024,
-			shouldError: false,
+			name: "100KB secret",
+			size: 100 * 1024,
 		},
 		{
-			name:        "1MB secret",
-			size:        1024 * 1024,
-			shouldError: false,
+			name: "1MB secret",
+			size: 1024 * 1024,
 		},
 		{
-			name:        "10MB secret",
-			size:        10 * 1024 * 1024,
-			shouldError: false,
+			name: "10MB secret",
+			size: 10 * 1024 * 1024,
 		},
 		{
-			name:        "99MB secret",
-			size:        99 * 1024 * 1024,
-			shouldError: false,
+			name: "99MB secret",
+			size: 99 * 1024 * 1024,
 		},
 		{
-			name:        "100MB secret minus 1 byte",
-			size:        100*1024*1024 - 1,
-			shouldError: false,
+			name: "100MB secret minus 1 byte",
+			size: 100*1024*1024 - 1,
 		},
 		{
-			name:        "101MB secret - should fail",
-			size:        101 * 1024 * 1024,
-			shouldError: true,
-			errorMsg:    "secret too large: exceeds 100MB limit",
+			name:    "101MB secret - should fail",
+			size:    101 * 1024 * 1024,
+			wantErr: errSecretTooLarge,
 		},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			runAddSecretSizeCase(t, tt.size, tt.shouldError, tt.errorMsg)
+			runAddSecretSizeCase(t, tt.size, tt.wantErr)
 		})
 	}
 }
@@ -264,57 +254,48 @@ func TestAddSecretVariousSizes(t *testing.T) {
 //nolint:paralleltest // together the subtests lock more than the memlock limit
 func TestImportSecretVariousSizes(t *testing.T) {
 	tests := []struct {
-		name        string
-		size        int
-		shouldError bool
-		errorMsg    string
+		name    string
+		size    int
+		wantErr error
 	}{
 		{
-			name:        "1KB file",
-			size:        1024,
-			shouldError: false,
+			name: "1KB file",
+			size: 1024,
 		},
 		{
-			name:        "10KB file",
-			size:        10 * 1024,
-			shouldError: false,
+			name: "10KB file",
+			size: 10 * 1024,
 		},
 		{
-			name:        "100KB file",
-			size:        100 * 1024,
-			shouldError: false,
+			name: "100KB file",
+			size: 100 * 1024,
 		},
 		{
-			name:        "1MB file",
-			size:        1024 * 1024,
-			shouldError: false,
+			name: "1MB file",
+			size: 1024 * 1024,
 		},
 		{
-			name:        "10MB file",
-			size:        10 * 1024 * 1024,
-			shouldError: false,
+			name: "10MB file",
+			size: 10 * 1024 * 1024,
 		},
 		{
-			name:        "99MB file",
-			size:        99 * 1024 * 1024,
-			shouldError: false,
+			name: "99MB file",
+			size: 99 * 1024 * 1024,
 		},
 		{
-			name:        "100MB file",
-			size:        100 * 1024 * 1024,
-			shouldError: false,
+			name: "100MB file",
+			size: 100 * 1024 * 1024,
 		},
 		{
-			name:        "101MB file - should fail",
-			size:        101 * 1024 * 1024,
-			shouldError: true,
-			errorMsg:    "secret file too large: exceeds 100MB limit",
+			name:    "101MB file - should fail",
+			size:    101 * 1024 * 1024,
+			wantErr: errSecretFileTooLarge,
 		},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			runImportSecretSizeCase(t, tt.size, tt.shouldError, tt.errorMsg)
+			runImportSecretSizeCase(t, tt.size, tt.wantErr)
 		})
 	}
 }

internal/cli/unlock_failure_test.go

@@ -0,0 +1,374 @@
+// Unlock Failure Tests
+//
+// When a vault cannot be opened through its current unlocker, because a
+// file the unlocker needs is missing or the passphrase is wrong, the error
+// keeps its cause and ends by saying that the mnemonic still opens that
+// vault, but only for a vault that the mnemonic does open, and not when the
+// passphrase could not be read at all. When a secret's current file is
+// missing, the error says how to make a version current again. Each test
+// that pins such advice also follows it.
+
+package cli_test
+
+import (
+	"bytes"
+	"io"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"testing"
+
+	"filippo.io/age"
+	"git.eeqj.de/sneak/secret/internal/cli"
+	"git.eeqj.de/sneak/secret/internal/secret"
+	"git.eeqj.de/sneak/secret/internal/vault"
+	"github.com/awnumar/memguard"
+	"github.com/spf13/afero"
+	"github.com/spf13/cobra"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+const (
+	// mnemonicAdvice ends the error when the current vault "default", which
+	// its mnemonic opens, cannot be opened through its current unlocker.
+	mnemonicAdvice = "; the vault 'default' still opens with its mnemonic: " +
+		"run 'secret unlocker add passphrase' with SB_SECRET_MNEMONIC set " +
+		"to the mnemonic to give it a new unlocker"
+
+	// versionAdvice ends the error when a secret's current file cannot be
+	// read.
+	versionAdvice = "; this file only names the current version: " +
+		"'secret version list' lists the secret's versions, and " +
+		"'secret version promote' makes one of them current"
+
+	// unlockTestVaultDir is the directory of the vault "default" of
+	// newTwoVaultFs, the current vault, whose secret "x" is "value".
+	unlockTestVaultDir = testStateDir + "/vaults.d/default"
+)
+
+// currentUnlockerDir returns the directory of the current unlocker of the
+// vault in vaultDir on fs.
+func currentUnlockerDir(t *testing.T, fs afero.Fs, vaultDir string) string {
+	t.Helper()
+
+	unlockerName, err := afero.ReadFile(fs,
+		filepath.Join(vaultDir, "current-unlocker"))
+	require.NoError(t, err)
+
+	return filepath.Join(vaultDir, "unlockers.d", string(unlockerName))
+}
+
+// newUnlockTestCLI returns the directory of the current unlocker of the
+// vault "default" on fs, a copy of the vaults of newTwoVaultFs, and a CLI
+// instance on fs that has the unlock passphrase, as from the environment,
+// but not the mnemonic.
+func newUnlockTestCLI(t *testing.T, fs afero.Fs) (string, *cli.Instance) {
+	t.Helper()
+
+	c := cli.NewCLIInstanceWithStateDir(fs, testStateDir)
+	c.UnlockPassphrase = memguard.NewBufferFromBytes([]byte(testPassphrase))
+	t.Cleanup(c.UnlockPassphrase.Destroy)
+
+	return currentUnlockerDir(t, fs, unlockTestVaultDir), c
+}
+
+// discardCmd returns a command whose output is discarded.
+func discardCmd() *cobra.Command {
+	cmd := &cobra.Command{}
+	cmd.SetOut(io.Discard)
+
+	return cmd
+}
+
+// getSecret returns what `secret get name` prints.
+func getSecret(t *testing.T, c *cli.Instance, name string) string {
+	t.Helper()
+
+	var out bytes.Buffer
+
+	cmd := &cobra.Command{}
+	cmd.SetOut(&out)
+	require.NoError(t, c.GetSecret(cmd, name))
+
+	return out.String()
+}
+
+// TestUnlockFailureNamesMnemonic checks the error of `secret get` when a
+// file that opening the vault through its current unlocker needs is
+// missing: it keeps the cause, which names the file, and ends with the
+// advice that the mnemonic still opens the vault. The test then follows
+// that advice: `secret unlocker add passphrase`, with the mnemonic, gives
+// the vault a new unlocker, which opens it.
+func TestUnlockFailureNamesMnemonic(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		file       string // the file removed
+		inVaultDir bool   // the file is the vault's, not the unlocker's
+		want       string // the message before the cause
+	}{
+		{
+			file:       "current-unlocker",
+			inVaultDir: true,
+			want: "failed to unlock vault: failed to get long-term key: " +
+				"failed to get current unlocker: " +
+				"failed to read current unlocker: ",
+		},
+		{
+			file: "priv.age",
+			want: "failed to unlock vault: failed to get long-term key: " +
+				"failed to get unlocker identity: " +
+				"failed to read unlocker private key: ",
+		},
+		{
+			file: "longterm.age",
+			want: "failed to unlock vault: failed to get long-term key: " +
+				"failed to read encrypted long-term private key: ",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.file, func(t *testing.T) {
+			t.Parallel()
+
+			fs := newTwoVaultFs(t)
+			unlockerDir, c := newUnlockTestCLI(t, fs)
+
+			path := filepath.Join(unlockerDir, tt.file)
+
+			if tt.inVaultDir {
+				path = filepath.Join(unlockTestVaultDir, tt.file)
+			}
+
+			require.NoError(t, fs.Remove(path))
+
+			err := c.GetSecret(discardCmd(), "x")
+
+			var cause *os.PathError
+
+			require.ErrorAs(t, err, &cause)
+			require.ErrorIs(t, err, os.ErrNotExist)
+			assert.Equal(t, path, cause.Path)
+
+			require.EqualError(t, err, tt.want+cause.Error()+mnemonicAdvice)
+
+			c.Mnemonic = testMnemonicBuffer(t)
+			require.NoError(t, c.UnlockersAdd("passphrase", discardCmd()))
+
+			c.Mnemonic = nil
+			assert.Equal(t, "value", getSecret(t, c, "x"))
+		})
+	}
+}
+
+// TestWrongPassphraseNamesMnemonic checks the error of `secret get` given a
+// passphrase that does not decrypt the passphrase unlocker: it keeps age's
+// error and ends with the advice that the mnemonic still opens the vault.
+func TestWrongPassphraseNamesMnemonic(t *testing.T) {
+	t.Parallel()
+
+	_, c := newUnlockTestCLI(t, newTwoVaultFs(t))
+	c.UnlockPassphrase = memguard.NewBufferFromBytes([]byte("wrong passphrase"))
+	t.Cleanup(c.UnlockPassphrase.Destroy)
+
+	err := c.GetSecret(discardCmd(), "x")
+
+	var noMatch *age.NoIdentityMatchError
+
+	require.ErrorAs(t, err, &noMatch)
+
+	require.EqualError(t, err, "failed to unlock vault: "+
+		"failed to get long-term key: failed to get unlocker identity: "+
+		"failed to decrypt unlocker private key: failed to create decryptor: "+
+		noMatch.Error()+mnemonicAdvice)
+}
+
+// TestMoveUnlockFailureNamesVault checks the error of `secret move` into
+// the vault "work", which is not the current vault, when "work" cannot be
+// opened through its current unlocker: the advice names "work" and says to
+// select it first, since `secret unlocker add` acts on the current vault.
+// The test then follows that advice, and the move succeeds.
+func TestMoveUnlockFailureNamesVault(t *testing.T) {
+	t.Parallel()
+
+	fs := newTwoVaultFs(t)
+	_, c := newUnlockTestCLI(t, fs)
+
+	path := filepath.Join(
+		currentUnlockerDir(t, fs, testStateDir+"/vaults.d/work"), "priv.age")
+	require.NoError(t, fs.Remove(path))
+
+	err := c.MoveSecret(discardCmd(), "default:x", "work:y", false)
+
+	var cause *os.PathError
+
+	require.ErrorAs(t, err, &cause)
+	assert.Equal(t, path, cause.Path)
+
+	require.EqualError(t, err, "failed to unlock destination vault 'work': "+
+		"failed to get unlocker identity: failed to read unlocker private key: "+
+		cause.Error()+"; the vault 'work' still opens with its mnemonic: "+
+		"run 'secret vault select work', then 'secret unlocker add passphrase' "+
+		"with SB_SECRET_MNEMONIC set to the mnemonic to give it a new unlocker")
+
+	require.NoError(t, c.SelectVault(discardCmd(), "work"))
+
+	c.Mnemonic = testMnemonicBuffer(t)
+	require.NoError(t, c.UnlockersAdd("passphrase", discardCmd()))
+
+	c.Mnemonic = nil
+	require.NoError(t, c.MoveSecret(discardCmd(), "default:x", "work:y", false))
+	assert.Equal(t, "value", getSecret(t, c, "y"))
+}
+
+// TestPassphraseNotReadNamesNoMnemonic runs `secret get x` on the built
+// binary without SB_UNLOCK_PASSPHRASE and with a stdin that is not a
+// terminal, so the passphrase cannot be read. The unlocker was not tried,
+// and adding one would need a passphrase read the same way, so the error
+// is the cause alone, without the advice to use the mnemonic.
+func TestPassphraseNotReadNamesNoMnemonic(t *testing.T) {
+	t.Parallel()
+
+	stateDir := t.TempDir()
+
+	mnemonic := memguard.NewBufferFromBytes([]byte(testMnemonic))
+	defer mnemonic.Destroy()
+
+	passphrase := memguard.NewBufferFromBytes([]byte(testPassphrase))
+	defer passphrase.Destroy()
+
+	vlt, err := vault.CreateVault(
+		afero.NewOsFs(), stateDir, "default", mnemonic, passphrase)
+	require.NoError(t, err)
+
+	value := memguard.NewBufferFromBytes([]byte("value"))
+	defer value.Destroy()
+
+	require.NoError(t, vlt.AddSecret("x", value, false))
+
+	//nolint:gosec // G204: test executes the freshly built secret binary
+	cmd := exec.CommandContext(t.Context(), secretBinaryPath(t), "get", "x")
+	cmd.Env = []string{
+		secret.EnvStateDir + "=" + stateDir,
+		"PATH=" + os.Getenv("PATH"),
+		"HOME=" + os.Getenv("HOME"),
+	}
+
+	output, err := cmd.CombinedOutput()
+	require.Error(t, err)
+
+	assert.Equal(t, "Error: failed to unlock vault: "+
+		"failed to get long-term key: failed to get unlocker identity: "+
+		"failed to read passphrase: cannot read passphrase from non-terminal "+
+		"stdin (piped input or script). Please set the SB_UNLOCK_PASSPHRASE "+
+		"environment variable or run interactively\n", string(output))
+}
+
+// TestCryptoUnlockFailureNamesMnemonic checks that `secret encrypt` and
+// `secret decrypt`, reading the key secret, end with the same advice as
+// `secret get` when the vault cannot be opened through its current
+// unlocker.
+func TestCryptoUnlockFailureNamesMnemonic(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		command string
+		run     func(c *cli.Instance) error
+	}{
+		{"encrypt", func(c *cli.Instance) error { return c.Encrypt("x", "", "") }},
+		{"decrypt", func(c *cli.Instance) error { return c.Decrypt("x", "", "") }},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.command, func(t *testing.T) {
+			t.Parallel()
+
+			fs := newTwoVaultFs(t)
+			unlockerDir, c := newUnlockTestCLI(t, fs)
+
+			path := filepath.Join(unlockerDir, "priv.age")
+			require.NoError(t, fs.Remove(path))
+
+			err := tt.run(c)
+
+			var cause *os.PathError
+
+			require.ErrorAs(t, err, &cause)
+			assert.Equal(t, path, cause.Path)
+
+			require.EqualError(t, err, "failed to get secret value: "+
+				"failed to unlock vault: failed to get long-term key: "+
+				"failed to get unlocker identity: "+
+				"failed to read unlocker private key: "+cause.Error()+
+				mnemonicAdvice)
+		})
+	}
+}
+
+// TestMissingCurrentFileNamesVersionCommands checks the error of `secret
+// get` when the secret's current file is missing: it keeps the cause, which
+// names the file, and ends with the advice that says how to make a version
+// current again. The test then follows that advice.
+func TestMissingCurrentFileNamesVersionCommands(t *testing.T) {
+	t.Parallel()
+
+	fs := newTwoVaultFs(t)
+	_, c := newUnlockTestCLI(t, fs)
+
+	secretDir := filepath.Join(unlockTestVaultDir, "secrets.d", "x")
+	path := filepath.Join(secretDir, "current")
+	require.NoError(t, fs.Remove(path))
+
+	err := c.GetSecret(discardCmd(), "x")
+
+	var cause *os.PathError
+
+	require.ErrorAs(t, err, &cause)
+	require.ErrorIs(t, err, os.ErrNotExist)
+	assert.Equal(t, path, cause.Path)
+
+	require.EqualError(t, err, "failed to get current version: "+
+		"failed to read current version file: "+cause.Error()+versionAdvice)
+
+	versions, err := afero.ReadDir(fs, filepath.Join(secretDir, "versions"))
+	require.NoError(t, err)
+	require.Len(t, versions, 1)
+
+	var out bytes.Buffer
+
+	cmd := &cobra.Command{}
+	cmd.SetOut(&out)
+	require.NoError(t, c.ListVersions(cmd, "x"))
+	assert.Contains(t, out.String(), versions[0].Name())
+
+	require.NoError(t, c.PromoteVersion(cmd, "x", versions[0].Name()))
+	assert.Equal(t, "value", getSecret(t, c, "x"))
+}
+
+// TestUnlockFailureWithoutLongTermKeyNamesNoMnemonic checks that a vault
+// created without a mnemonic, which no mnemonic opens, gets no advice to
+// use one: `secret unlocker add passphrase` there fails with the cause
+// alone.
+func TestUnlockFailureWithoutLongTermKeyNamesNoMnemonic(t *testing.T) {
+	t.Parallel()
+
+	fs := afero.NewMemMapFs()
+
+	_, err := vault.CreateVault(fs, testStateDir, "keyless", nil, nil)
+	require.NoError(t, err)
+
+	c := cli.NewCLIInstanceWithStateDir(fs, testStateDir)
+	c.UnlockPassphrase = memguard.NewBufferFromBytes([]byte(testPassphrase))
+	t.Cleanup(c.UnlockPassphrase.Destroy)
+
+	err = c.UnlockersAdd("passphrase", discardCmd())
+
+	var cause *os.PathError
+
+	require.ErrorAs(t, err, &cause)
+
+	require.EqualError(t, err, "failed to get long-term key: "+
+		"failed to get current unlocker: failed to read current unlocker: "+
+		cause.Error())
+}

internal/cli/unlockers.go

@@ -6,6 +6,7 @@ import (
 	"errors"
 	"fmt"
 	"log"
+	"maps"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -47,7 +48,6 @@ var (
 	errGPGKeyAlreadyUnlocker = errors.New(
 		"is already added as an unlocker")
 	errUnsupportedUnlockerType = errors.New("unsupported unlocker type")
-	errLastUnlocker            = errors.New("refusing to remove last unlocker")
 )
 
 // UnlockerInfo represents unlocker information for display
@@ -267,10 +267,11 @@ func newUnlockerRemoveCmd() *cobra.Command {
 		Use:     "remove <unlocker-id>",
 		Aliases: []string{"rm"},
 		Short:   "Remove an unlocker",
-		Long: `Remove an unlocker from the current vault. Cannot remove ` +
-			`the last unlocker if the vault has secrets unless --force is ` +
-			`used. Warning: Without unlockers and without your mnemonic, ` +
-			`vault data will be permanently inaccessible.`,
+		Long: `Remove an unlocker from the current vault. Asks for ` +
+			`confirmation first, saying whether it is the vault's last ` +
+			`unlocker; when stdin is not a terminal, fails unless --force ` +
+			`is given. Warning: Without unlockers and without your ` +
+			`mnemonic, vault data will be permanently inaccessible.`,
 		Args:              cobra.ExactArgs(1),
 		ValidArgsFunction: getUnlockerIDsCompletionFunc(cli.fs, cli.stateDir),
 		RunE: func(cmd *cobra.Command, args []string) error {
@@ -286,7 +287,7 @@ func newUnlockerRemoveCmd() *cobra.Command {
 	}
 
 	cmd.Flags().BoolP("force", "f", false,
-		"Force removal of last unlocker even if vault has secrets")
+		"Remove without asking for confirmation, even the last unlocker")
 
 	return cmd
 }
@@ -313,91 +314,8 @@ func newUnlockerSelectCmd() *cobra.Command {
 	}
 }
 
-// unlockerIDFromDir constructs an unlocker of the given metadata type
-// rooted at unlockerDir and returns its ID. Returns "" for unknown types
-// and, when includeSecureEnclave is false, for secure enclave unlockers.
-func unlockerIDFromDir(
-	fs afero.Fs, unlockerDir string, metadata secret.UnlockerMetadata,
-	includeSecureEnclave bool,
-) string {
-	// Create the appropriate unlocker instance
-	var unlocker secret.Unlocker
-
-	switch metadata.Type {
-	case unlockerTypePassphrase:
-		unlocker = secret.NewPassphraseUnlocker(fs, unlockerDir, metadata)
-	case unlockerTypeKeychain:
-		unlocker = secret.NewKeychainUnlocker(fs, unlockerDir, metadata)
-	case unlockerTypePGP:
-		unlocker = secret.NewPGPUnlocker(fs, unlockerDir, metadata)
-	case unlockerTypeSecureEnclave:
-		if includeSecureEnclave {
-			unlocker = secret.NewSecureEnclaveUnlocker(fs, unlockerDir, metadata)
-		}
-	}
-
-	if unlocker == nil {
-		return ""
-	}
-
-	return unlocker.GetID()
-}
-
-// findUnlockerIDByMetadata scans unlockersDir for the directory whose
-// stored metadata matches the given type and creation time and returns
-// the matching unlocker's ID. It returns ("", nil) when the directory is
-// readable but holds no match, and a non-nil error when the directory
-// itself cannot be read. Callers must distinguish the two: an unreadable
-// directory means the unlocker's real ID is unknowable, so the entry has
-// to be skipped rather than reported under a synthesized ID.
-//
-// A metadata file that cannot be read or parsed is skipped without a
-// warning: every caller gets metadata from vault.ListUnlockers first,
-// which has already warned about that directory.
-func findUnlockerIDByMetadata(
-	fs afero.Fs, unlockersDir string, metadata secret.UnlockerMetadata,
-	includeSecureEnclave bool,
-) (string, error) {
-	files, err := afero.ReadDir(fs, unlockersDir)
-	if err != nil {
-		return "", fmt.Errorf(
-			"failed to read unlockers directory %s: %w", unlockersDir, err,
-		)
-	}
-
-	for _, file := range files {
-		if !file.IsDir() {
-			continue
-		}
-
-		unlockerDir := filepath.Join(unlockersDir, file.Name())
-		metadataPath := filepath.Join(unlockerDir, "unlocker-metadata.json")
-
-		// Check if this is the right unlocker by comparing metadata
-		metadataBytes, err := afero.ReadFile(fs, metadataPath)
-		if err != nil {
-			continue
-		}
-
-		var diskMetadata secret.UnlockerMetadata
-
-		err = json.Unmarshal(metadataBytes, &diskMetadata)
-		if err != nil {
-			continue
-		}
-
-		// Match by type and creation time
-		if diskMetadata.Type == metadata.Type &&
-			diskMetadata.CreatedAt.Equal(metadata.CreatedAt) {
-			return unlockerIDFromDir(fs, unlockerDir, diskMetadata,
-				includeSecureEnclave), nil
-		}
-	}
-
-	return "", nil
-}
-
-// UnlockersList lists unlockers in the current vault
+// UnlockersList lists unlockers in the current vault, each under its ID,
+// the name of its directory in unlockers.d
 func (cli *Instance) UnlockersList(jsonOutput bool) error {
 	// Get current vault
 	vlt, err := vault.GetCurrentVault(cli.fs, cli.stateDir)
@@ -413,58 +331,23 @@ func (cli *Instance) UnlockersList(jsonOutput bool) error {
 		currentUnlockerID = currentUnlocker.GetID()
 	}
 
-	// Get the metadata first
-	unlockerMetadataList, err := vlt.ListUnlockers()
+	unlockerMetadata, err := vlt.ListUnlockers()
 	if err != nil {
 		return err
 	}
 
-	// Load actual unlocker objects to get the proper IDs
 	var unlockers []UnlockerInfo
 
-	for _, metadata := range unlockerMetadataList {
-		// Create unlocker instance to get the proper ID
-		vaultDir, err := vlt.GetDirectory()
-		if err != nil {
-			secret.Warn("Could not get vault directory while listing unlockers",
-				"error", err)
+	for _, unlockerID := range slices.Sorted(maps.Keys(unlockerMetadata)) {
+		metadata := unlockerMetadata[unlockerID]
 
-			continue
-		}
-
-		// Find the unlocker directory by type and created time
-		unlockersDir := filepath.Join(vaultDir, "unlockers.d")
-
-		unlockerID, err := findUnlockerIDByMetadata(
-			cli.fs, unlockersDir, metadata, true,
-		)
-		if err != nil {
-			secret.Warn("Could not read unlockers directory, skipping unlocker",
-				"unlockers_dir", unlockersDir, "error", err)
-
-			continue
-		}
-
-		// Get the proper ID using the unlocker's ID() method
-		var properID string
-		if unlockerID != "" {
-			properID = unlockerID
-		} else {
-			// Generate ID as fallback
-			properID = fmt.Sprintf("%s-%s",
-				metadata.CreatedAt.Format("2006-01-02.15.04"), metadata.Type)
-			secret.Warn("Could not create unlocker instance, using fallback ID",
-				"fallback_id", properID, "type", metadata.Type)
-		}
-
-		unlockerInfo := UnlockerInfo{
-			ID:        properID,
+		unlockers = append(unlockers, UnlockerInfo{
+			ID:        unlockerID,
 			Type:      metadata.Type,
 			CreatedAt: metadata.CreatedAt,
 			Flags:     metadata.Flags,
-			IsCurrent: properID == currentUnlockerID,
-		}
-		unlockers = append(unlockers, unlockerInfo)
+			IsCurrent: unlockerID == currentUnlockerID,
+		})
 	}
 
 	if jsonOutput {
@@ -697,9 +580,7 @@ func (cli *Instance) addPGPUnlocker(cmd *cobra.Command) error {
 	}
 
 	// Check if this GPG key is already added
-	expectedID := "pgp-" + fingerprint
-
-	exists, err := cli.checkUnlockerExists(vlt, expectedID)
+	exists, err := cli.pgpUnlockerExists(vlt, fingerprint)
 	if err != nil {
 		return fmt.Errorf(
 			"could not check whether GPG key %s is already an unlocker: %w",
@@ -726,55 +607,85 @@ func (cli *Instance) addPGPUnlocker(cmd *cobra.Command) error {
 	return nil
 }
 
-// UnlockersRemove removes an unlocker, holding the state directory lock
-// while removeUnlocker runs
+// UnlockersRemove removes an unlocker from the current vault, after asking
+// the user to confirm unless force is set.
 func (cli *Instance) UnlockersRemove(
 	unlockerID string, force bool, cmd *cobra.Command,
 ) error {
-	release, err := vault.LockStateDir(cli.fs, cli.stateDir)
+	var found unlockerToRemove
+
+	release, err := cli.askThenLock(cmd, force, func() (string, error) {
+		var err error
+
+		found, err = cli.findUnlockerToRemove(unlockerID)
+
+		return found.question, err
+	})
 	if err != nil {
 		return err
 	}
 	defer release()
 
-	return cli.removeUnlocker(unlockerID, force, cmd)
+	return cli.removeUnlocker(unlockerID, found, cmd)
 }
 
-// removeUnlocker removes an unlocker with safety checks
-func (cli *Instance) removeUnlocker(
-	unlockerID string, force bool, cmd *cobra.Command,
-) error {
-	// Get current vault
+// unlockerToRemove is what removing an unlocker removes, as
+// findUnlockerToRemove found it.
+type unlockerToRemove struct {
+	vlt *vault.Vault
+	// last is set when the unlocker counts as the vault's last one, and
+	// secrets is then the number of secrets in the vault.
+	last    bool
+	secrets int
+	// question names what is removed, for the user to confirm.
+	question string
+}
+
+// findUnlockerToRemove checks that the current vault has the unlocker and
+// finds whether it is the vault's last one.
+func (cli *Instance) findUnlockerToRemove(
+	unlockerID string,
+) (unlockerToRemove, error) {
 	vlt, err := vault.GetCurrentVault(cli.fs, cli.stateDir)
 	if err != nil {
-		return err
+		return unlockerToRemove{}, err
+	}
+
+	exists, err := vlt.HasUnlocker(unlockerID)
+	if err != nil {
+		return unlockerToRemove{}, err
+	}
+
+	if !exists {
+		return unlockerToRemove{}, fmt.Errorf("unlocker with ID %s %w",
+			unlockerID, vault.ErrUnlockerNotFound)
 	}
 
 	// Get list of unlockers. It leaves out a directory whose metadata file
 	// is missing or cannot be checked for, read or parsed.
 	unlockers, err := vlt.ListUnlockers()
 	if err != nil {
-		return fmt.Errorf("failed to list unlockers: %w", err)
+		return unlockerToRemove{},
+			fmt.Errorf("failed to list unlockers: %w", err)
 	}
 
 	vaultDir, err := vlt.GetDirectory()
 	if err != nil {
-		return fmt.Errorf("failed to get vault directory: %w", err)
+		return unlockerToRemove{},
+			fmt.Errorf("failed to get vault directory: %w", err)
 	}
 
 	unlockersDir := filepath.Join(vaultDir, "unlockers.d")
 
-	// Check if we're removing the last unlocker
-	removingLast := false
+	found := unlockerToRemove{
+		vlt: vlt,
+		question: fmt.Sprintf("Permanently remove unlocker '%s' from vault "+
+			"'%s'? It is not the vault's last unlocker.",
+			unlockerID, vlt.GetName()),
+	}
 
 	if len(unlockers) == 1 {
-		lastID, err := findUnlockerIDByMetadata(
-			cli.fs, unlockersDir, unlockers[0], true)
-		if err != nil {
-			return err
-		}
-
-		removingLast = lastID == unlockerID
+		_, found.last = unlockers[unlockerID]
 	}
 
 	// unlockerID may instead name a directory left out of the list. If its
@@ -783,34 +694,36 @@ func (cli *Instance) removeUnlocker(
 	// for or read, the unlocker may be the only working one, so removing it
 	// counts as removing the last unlocker.
 	if metadataUnreadable(cli.fs, filepath.Join(unlockersDir, unlockerID)) {
-		removingLast = true
+		found.last = true
 	}
 
-	if removingLast {
-		// Check if vault has secrets
-		numSecrets, err := vlt.NumSecrets()
+	if found.last {
+		found.secrets, err = vlt.NumSecrets()
 		if err != nil {
-			return fmt.Errorf("failed to count secrets: %w", err)
+			return unlockerToRemove{},
+				fmt.Errorf("failed to count secrets: %w", err)
 		}
 
-		if numSecrets > 0 && !force {
-			cmd.Println("ERROR: Cannot remove the last unlocker when the " +
-				"vault contains secrets.")
-			cmd.Println("WARNING: Without unlockers, you MUST have your " +
-				"mnemonic phrase to decrypt the vault.")
-			cmd.Println("If you want to proceed anyway, use --force")
-
-			return errLastUnlocker
-		}
-
-		if numSecrets > 0 && force {
-			cmd.Println("WARNING: Removing the last unlocker. You MUST " +
-				"have your mnemonic phrase to access this vault again!")
-		}
+		found.question = fmt.Sprintf("Permanently remove unlocker '%s', "+
+			"the last unlocker of vault '%s', which holds %d secret(s)? "+
+			"Without an unlocker the vault opens only with its mnemonic.",
+			unlockerID, vlt.GetName(), found.secrets)
 	}
 
-	// Remove the unlocker
-	err = vlt.RemoveUnlocker(unlockerID)
+	return found, nil
+}
+
+// removeUnlocker removes the unlocker that findUnlockerToRemove found. The
+// caller holds the state directory lock.
+func (cli *Instance) removeUnlocker(
+	unlockerID string, found unlockerToRemove, cmd *cobra.Command,
+) error {
+	if found.last && found.secrets > 0 {
+		cmd.Println("WARNING: Removing the last unlocker. You MUST " +
+			"have your mnemonic phrase to access this vault again!")
+	}
+
+	err := found.vlt.RemoveUnlocker(unlockerID)
 	if err != nil {
 		return err
 	}
@@ -851,16 +764,16 @@ func (cli *Instance) UnlockerSelect(unlockerID string) error {
 	return vlt.SelectUnlocker(unlockerID)
 }
 
-// checkUnlockerExists reports whether the vault already has an unlocker
-// with the given ID. It returns an error, and no answer, when unlockers.d
-// or an unlocker's metadata file cannot be read; the caller must then not
-// create the unlocker. It reads unlockers.d itself because
-// vault.ListUnlockers skips an unlocker it cannot read, which suits
+// pgpUnlockerExists reports whether the vault already has a PGP unlocker
+// for the GPG key with the given fingerprint. It returns an error, and no
+// answer, when unlockers.d or an unlocker's metadata file cannot be read;
+// the caller must then not create the unlocker. It reads unlockers.d itself
+// because vault.ListUnlockers skips an unlocker it cannot read, which suits
 // `unlocker list` but not this check: the skipped unlocker may be the
 // duplicate. A directory whose metadata file is missing or corrupt is not
 // a working unlocker and is passed over.
-func (cli *Instance) checkUnlockerExists(
-	vlt *vault.Vault, unlockerID string,
+func (cli *Instance) pgpUnlockerExists(
+	vlt *vault.Vault, fingerprint string,
 ) (bool, error) {
 	vaultDir, err := vlt.GetDirectory()
 	if err != nil {
@@ -899,14 +812,14 @@ func (cli *Instance) checkUnlockerExists(
 			)
 		}
 
-		var metadata secret.UnlockerMetadata
+		var metadata secret.PGPUnlockerMetadata
 
 		err = json.Unmarshal(metadataBytes, &metadata)
 		if err != nil {
 			continue
 		}
 
-		if unlockerIDFromDir(cli.fs, unlockerDir, metadata, true) == unlockerID {
+		if metadata.Type == unlockerTypePGP && metadata.GPGKeyID == fingerprint {
 			return true, nil
 		}
 	}

internal/cli/unlockers_add_test.go

@@ -47,7 +47,7 @@ func TestAddPGPUnlocker(t *testing.T) {
 		t.Run(test.name, func(t *testing.T) {
 			fs := afero.NewMemMapFs()
 			vlt, err := vault.CreateVault(fs, listTestStateDir, listTestVaultName,
-				testMnemonicBuffer(t))
+				testMnemonicBuffer(t), nil)
 			require.NoError(t, err)
 
 			err = vlt.AddSecret(addTestSecretName,

internal/cli/unlockers_corrupt_test.go

@@ -4,15 +4,17 @@
 // by its ID. These tests give the first unlocker, which sorts before the
 // one the commands act on, metadata that is not JSON, and check that the
 // commands step past it, and that it can itself be removed by its
-// directory name, which `secret unlocker list` names in its warning. A
-// last test checks that an unlocker whose metadata file cannot be read is
-// removed by its directory name only as the last unlocker is.
+// directory name, which `secret unlocker list` names in its warning, as can
+// one with no metadata file. A last test checks that an unlocker whose
+// metadata file cannot be read counts as the last unlocker when it is
+// removed by its directory name.
 
 //nolint:testpackage // white-box test of unexported internals
 package cli
 
 import (
 	"path/filepath"
+	"strings"
 	"testing"
 
 	"git.eeqj.de/sneak/secret/internal/vault"
@@ -44,7 +46,7 @@ func TestUnlockerSelectSkipsCorruptUnlocker(t *testing.T) {
 	fs := newCorruptUnlockerVault(t)
 	instance, _ := newTestInstance(fs)
 
-	require.NoError(t, instance.UnlockerSelect("pgp-"+listTestGPGKeyID+"B"))
+	require.NoError(t, instance.UnlockerSelect(listTestUnlockerDirTwo))
 
 	current, err := afero.ReadFile(fs,
 		filepath.Join(testVaultDir(listTestVaultName), "current-unlocker"))
@@ -56,37 +58,27 @@ func TestUnlockerSelectSkipsCorruptUnlocker(t *testing.T) {
 }
 
 // TestUnlockerRemoveWithCorruptUnlocker asserts that the second unlocker
-// can be removed, unless the vault holds secrets: the corrupt unlocker
-// cannot unlock the vault, so the second is its last. The corrupt one can
-// be removed by its directory name without --force even then.
+// counts as the vault's last one, since the corrupt unlocker cannot unlock
+// the vault, and that the corrupt one, removed by its directory name, does
+// not. Either is removed once the user confirms.
 func TestUnlockerRemoveWithCorruptUnlocker(t *testing.T) {
 	t.Parallel()
 
 	tests := []struct {
 		name        string
 		unlockerID  string
-		withSecret  bool
-		wantErr     error
+		wantLast    bool
 		wantEntries []string
 	}{
 		{
 			name:        "the other unlocker",
-			unlockerID:  "pgp-" + listTestGPGKeyID + "B",
+			unlockerID:  listTestUnlockerDirTwo,
+			wantLast:    true,
 			wantEntries: []string{listTestUnlockerDirOne},
 		},
-		{
-			name:       "the other unlocker, the last one, with secrets",
-			unlockerID: "pgp-" + listTestGPGKeyID + "B",
-			withSecret: true,
-			wantErr:    errLastUnlocker,
-			wantEntries: []string{
-				listTestUnlockerDirOne, listTestUnlockerDirTwo,
-			},
-		},
 		{
 			name:        "the corrupt unlocker by its directory name",
 			unlockerID:  listTestUnlockerDirOne,
-			withSecret:  true,
 			wantEntries: []string{listTestUnlockerDirTwo},
 		},
 	}
@@ -96,14 +88,16 @@ func TestUnlockerRemoveWithCorruptUnlocker(t *testing.T) {
 			t.Parallel()
 
 			fs := newCorruptUnlockerVault(t)
-			if tt.withSecret {
-				writeTestSecret(t, fs, testVaultDir(listTestVaultName))
-			}
+			writeTestSecret(t, fs, testVaultDir(listTestVaultName))
 
 			instance, cmd := newTestInstance(fs)
 
-			err := instance.UnlockersRemove(tt.unlockerID, false, cmd)
-			require.ErrorIs(t, err, tt.wantErr)
+			found, err := instance.findUnlockerToRemove(tt.unlockerID)
+			require.NoError(t, err)
+			assert.Equal(t, tt.wantLast, found.last)
+
+			instance.terminal = strings.NewReader("y\n")
+			require.NoError(t, instance.UnlockersRemove(tt.unlockerID, false, cmd))
 
 			assertDirEntries(t, fs,
 				filepath.Join(testVaultDir(listTestVaultName),
@@ -113,13 +107,42 @@ func TestUnlockerRemoveWithCorruptUnlocker(t *testing.T) {
 	}
 }
 
-// TestUnlockerRemoveWithUnreadableMetadata asserts that removing the only
-// unlocker of a vault with secrets by its directory name, when its
-// metadata file cannot be checked for or read, is refused without --force:
-// listing leaves it out, but it may still be the vault's only working
-// unlocker. With --force it is removed. The state directory lock refuses
-// the failing filesystem, so the test calls removeUnlocker, which
-// UnlockersRemove runs once it holds the lock.
+// TestUnlockerRemoveWithoutMetadata asserts that a partial unlocker
+// directory, one with no metadata file, removed by its directory name from
+// a vault with secrets, does not count as the vault's last unlocker, since
+// it cannot unlock the vault, so the question says it is not. It is
+// removed once the user confirms.
+func TestUnlockerRemoveWithoutMetadata(t *testing.T) {
+	t.Parallel()
+
+	fs := newListTestVault(t, 2)
+	vaultDir := testVaultDir(listTestVaultName)
+	unlockersDir := filepath.Join(vaultDir, listTestUnlockersDirName)
+
+	require.NoError(t, fs.Remove(filepath.Join(
+		unlockersDir, listTestUnlockerDirOne, listTestMetadataFileName)))
+	writeTestSecret(t, fs, vaultDir)
+
+	instance, cmd := newTestInstance(fs)
+
+	found, err := instance.findUnlockerToRemove(listTestUnlockerDirOne)
+	require.NoError(t, err)
+	assert.False(t, found.last)
+	assert.Contains(t, found.question, "not the vault's last unlocker")
+
+	instance.terminal = strings.NewReader("y\n")
+	require.NoError(t, instance.UnlockersRemove(listTestUnlockerDirOne, false, cmd))
+	assertDirEntries(t, fs, unlockersDir, listTestUnlockerDirTwo)
+}
+
+// TestUnlockerRemoveWithUnreadableMetadata asserts that the only unlocker
+// of a vault with secrets, removed by its directory name when its metadata
+// file cannot be checked for or read, counts as the vault's last unlocker,
+// so the question warns that it is: listing leaves it out, but it may
+// still be the vault's only working unlocker. It is then removed. The
+// state directory lock refuses the failing filesystem, so the test calls
+// findUnlockerToRemove and removeUnlocker, which UnlockersRemove runs to
+// make its checks and, once it holds the lock, to remove the unlocker.
 func TestUnlockerRemoveWithUnreadableMetadata(t *testing.T) {
 	t.Parallel()
 
@@ -155,12 +178,13 @@ func TestUnlockerRemoveWithUnreadableMetadata(t *testing.T) {
 
 			instance, cmd := newTestInstance(tt.wrap(base))
 
-			err := instance.removeUnlocker(listTestUnlockerDirOne, false, cmd)
-			require.ErrorIs(t, err, errLastUnlocker)
-			assertDirEntries(t, base, unlockersDir, listTestUnlockerDirOne)
+			found, err := instance.findUnlockerToRemove(listTestUnlockerDirOne)
+			require.NoError(t, err)
+			assert.True(t, found.last)
+			assert.Contains(t, found.question, "the last unlocker")
 
 			require.NoError(t,
-				instance.removeUnlocker(listTestUnlockerDirOne, true, cmd))
+				instance.removeUnlocker(listTestUnlockerDirOne, found, cmd))
 			assertDirEntries(t, base, unlockersDir)
 		})
 	}

internal/cli/unlockers_ids_test.go

@@ -0,0 +1,79 @@
+//nolint:testpackage // white-box test of unexported internals
+package cli
+
+import (
+	"encoding/json"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"git.eeqj.de/sneak/secret/internal/secret"
+	"git.eeqj.de/sneak/secret/internal/vault"
+	"github.com/spf13/afero"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestSameMetadataUnlockersHaveTheirOwnIDs writes two passphrase unlockers
+// side by side whose metadata is the same, creation time included, as
+// copying an unlocker directory leaves them. It asserts that `unlocker
+// list` and the shell completion of `unlocker select` and `unlocker remove`
+// give each its own ID, and that each is selected and removed by its ID
+// alone. Keychain and Secure Enclave unlockers, which only macOS can add,
+// get their IDs the same way.
+func TestSameMetadataUnlockersHaveTheirOwnIDs(t *testing.T) {
+	t.Parallel()
+
+	fs := afero.NewMemMapFs()
+	_, err := vault.CreateVault(fs, listTestStateDir, listTestVaultName,
+		testMnemonicBuffer(t), nil)
+	require.NoError(t, err)
+
+	vaultDir := testVaultDir(listTestVaultName)
+	unlockersDir := filepath.Join(vaultDir, listTestUnlockersDirName)
+	dirNames := []string{
+		"passphrase-2026-10-04.12.30.00.000000000",
+		"passphrase-2026-10-04.12.30.00.000000000-copy",
+	}
+
+	metadata, err := json.Marshal(secret.UnlockerMetadata{
+		Type:      unlockerTypePassphrase,
+		CreatedAt: time.Date(2026, time.October, 4, 12, 30, 0, 0, time.UTC),
+	})
+	require.NoError(t, err)
+
+	for _, dirName := range dirNames {
+		dir := filepath.Join(unlockersDir, dirName)
+		require.NoError(t, fs.MkdirAll(dir, listTestDirPerm))
+		require.NoError(t, afero.WriteFile(fs,
+			filepath.Join(dir, listTestMetadataFileName), metadata,
+			listTestFilePerm))
+	}
+
+	listed := listUnlockersJSON(t, fs)
+	require.Len(t, listed, len(dirNames))
+
+	completed, _ := getUnlockerIDsCompletionFunc(fs, listTestStateDir)(
+		nil, nil, "")
+	assert.Equal(t, dirNames, completed)
+
+	instance, cmd := newTestInstance(fs)
+
+	for i, unlocker := range listed {
+		assert.Equal(t, dirNames[i], unlocker.ID)
+
+		require.NoError(t, instance.UnlockerSelect(unlocker.ID))
+
+		current, err := afero.ReadFile(fs,
+			filepath.Join(vaultDir, "current-unlocker"))
+		require.NoError(t, err)
+		assert.Equal(t, dirNames[i], string(current))
+	}
+
+	// The second one first: an ID both shared would remove the first one
+	require.NoError(t, instance.UnlockersRemove(listed[1].ID, true, cmd))
+	assertDirEntries(t, fs, unlockersDir, dirNames[0])
+
+	require.NoError(t, instance.UnlockersRemove(listed[0].ID, true, cmd))
+	assertDirEntries(t, fs, unlockersDir)
+}

internal/cli/unlockers_list_test.go

@@ -1,25 +1,13 @@
 // Unlocker List Tests
 //
-// Tests for `secret unlocker list` behavior when the unlockers.d directory,
-// or an unlocker's metadata in it, cannot be read while the listing is
-// being rendered:
+// Tests for `secret unlocker list` behavior when an unlocker's metadata
+// cannot be read or used:
 //
-//   - TestUnlockersListSkipsUnreadableUnlockersDir: an unreadable
-//     unlockers.d yields no rows rather than rows bearing synthesized IDs.
-//   - TestUnlockersListSkipsOnlyUnreadableEntries: a readable entry is
-//     still listed, with its real ID and its current-unlocker marker,
-//     when a later entry's scan fails.
 //   - TestUnlockersListToleratesCorruptMetadata: one unlocker's corrupt
 //     metadata does not stop the others from being listed.
 //   - TestUnlockersListSkipsUnreadableMetadata: an unlocker whose metadata
 //     file cannot be checked for or read is left out, and the other is
 //     still listed.
-//
-// The listing resolves each unlocker's real ID by rescanning unlockers.d
-// after the vault has already enumerated it. If that rescan fails the ID
-// is unknowable, so the entry must be skipped: a synthesized ID matches
-// no `unlocker remove` or `unlocker select` argument and would also
-// suppress the current-unlocker marker.
 
 //nolint:testpackage // white-box test of unexported internals
 package cli
@@ -48,18 +36,16 @@ const (
 	// listTestVaultName is the name of that synthetic vault.
 	listTestVaultName = "default"
 
-	// listTestGPGKeyID is the GPG key ID recorded in the readable PGP
-	// unlocker's metadata. The unlocker's real ID is derived from it, and
-	// differs from the timestamp-derived fallback ID.
+	// listTestGPGKeyID is the GPG key ID recorded, with a letter appended,
+	// in the PGP unlockers' metadata.
 	listTestGPGKeyID = "DEADBEEFDEADBEEF"
 
 	// listTestUnlockerDirOne and listTestUnlockerDirTwo are the unlocker
-	// directory names under unlockers.d.
+	// directory names under unlockers.d, and so the unlockers' IDs.
 	listTestUnlockerDirOne = "host-pgp-2026-08-09"
 	listTestUnlockerDirTwo = "host-pgp-2026-08-10"
 
-	// listTestUnlockersDirName is the directory the listing rescans to
-	// resolve unlocker IDs.
+	// listTestUnlockersDirName is the directory holding the unlockers.
 	listTestUnlockersDirName = "unlockers.d"
 
 	// listTestMetadataFileName is the per-unlocker metadata file name.
@@ -74,25 +60,16 @@ const (
 // a successful open of unlockers.d.
 var errUnlockersDirUnreadable = errors.New("permission denied")
 
-// unlockersDirFailFs makes unlockers.d unreadable once it has been opened
-// successfully openBudget times. This reproduces the directory becoming
-// unreadable (permission change, partially restored backup, EIO) between
-// the vault's own enumeration and the per-entry rescan that resolves
-// unlocker IDs.
+// unlockersDirFailFs fails every open of unlockers.d, as when the
+// directory cannot be read.
 type unlockersDirFailFs struct {
 	afero.Fs
-
-	openBudget int
-	opens      int
 }
 
 //nolint:ireturn // afero.File is the interface required by afero.Fs
 func (f *unlockersDirFailFs) Open(name string) (afero.File, error) {
 	if filepath.Base(name) == listTestUnlockersDirName {
-		f.opens++
-		if f.opens > f.openBudget {
-			return nil, errUnlockersDirUnreadable
-		}
+		return nil, errUnlockersDirUnreadable
 	}
 
 	//nolint:wrapcheck // test double must return the wrapped Fs error as-is
@@ -142,8 +119,8 @@ func (f *metadataStatFailFs) Stat(name string) (os.FileInfo, error) {
 	return f.Fs.Stat(name)
 }
 
-// writePGPUnlocker writes a PGP unlocker directory with metadata that
-// yields the real ID "pgp-<keyID>".
+// writePGPUnlocker writes a PGP unlocker directory named dirName, with
+// metadata recording the GPG key ID keyID.
 func writePGPUnlocker(
 	t *testing.T, fs afero.Fs, unlockersDir, dirName string,
 	createdAt time.Time, keyID string,
@@ -224,44 +201,6 @@ func listUnlockersJSON(t *testing.T, fs afero.Fs) []UnlockerInfo {
 	return decoded.Unlockers
 }
 
-// TestUnlockersListSkipsUnreadableUnlockersDir asserts that an unlockers.d
-// which becomes unreadable after the vault enumerated it produces no rows,
-// rather than rows carrying fabricated fallback IDs.
-func TestUnlockersListSkipsUnreadableUnlockersDir(t *testing.T) {
-	t.Parallel()
-
-	base := newListTestVault(t, 1)
-	// Budget of one: the vault's own ListUnlockers scan succeeds, the
-	// per-entry rescan that resolves the ID fails.
-	fs := &unlockersDirFailFs{Fs: base, openBudget: 1}
-
-	unlockers := listUnlockersJSON(t, fs)
-
-	assert.Empty(t, unlockers,
-		"an unreadable unlockers.d must yield no rows, not fabricated IDs")
-}
-
-// TestUnlockersListSkipsOnlyUnreadableEntries asserts that a readable
-// entry survives with its real ID and current-unlocker marker when a later
-// entry's rescan fails.
-func TestUnlockersListSkipsOnlyUnreadableEntries(t *testing.T) {
-	t.Parallel()
-
-	base := newListTestVault(t, 2)
-	// Budget of two: ListUnlockers plus the first entry's rescan succeed,
-	// the second entry's rescan fails.
-	fs := &unlockersDirFailFs{Fs: base, openBudget: 2}
-
-	unlockers := listUnlockersJSON(t, fs)
-
-	require.Len(t, unlockers, 1,
-		"only the entry whose directory was readable may be listed")
-	assert.Equal(t, "pgp-"+listTestGPGKeyID+"A", unlockers[0].ID,
-		"the surviving row must carry the real unlocker ID")
-	assert.True(t, unlockers[0].IsCurrent,
-		"the current-unlocker marker must survive the skip")
-}
-
 // TestUnlockersListReadableEntriesAreListed is the control case: with a
 // fully readable unlockers.d every entry is listed with its real ID.
 func TestUnlockersListReadableEntriesAreListed(t *testing.T) {
@@ -272,20 +211,21 @@ func TestUnlockersListReadableEntriesAreListed(t *testing.T) {
 	unlockers := listUnlockersJSON(t, base)
 
 	require.Len(t, unlockers, 2)
-	assert.Equal(t, "pgp-"+listTestGPGKeyID+"A", unlockers[0].ID)
-	assert.Equal(t, "pgp-"+listTestGPGKeyID+"B", unlockers[1].ID)
+	assert.Equal(t, listTestUnlockerDirOne, unlockers[0].ID)
+	assert.Equal(t, listTestUnlockerDirTwo, unlockers[1].ID)
 	assert.True(t, unlockers[0].IsCurrent)
 	assert.False(t, unlockers[1].IsCurrent)
 }
 
 // TestUnlockersListToleratesCorruptMetadata asserts that one unlocker with
 // corrupt metadata does not stop the listing. Metadata that is not JSON
-// leaves that unlocker out; PGP metadata without a usable GPG key ID lists
-// it as "pgp-unknown". The healthy unlocker is listed with its real ID.
+// leaves that unlocker out; PGP metadata without a usable GPG key ID, and
+// metadata of an unknown type, are still listed, under the directory name
+// like any other. The healthy unlocker is listed with its real ID.
 func TestUnlockersListToleratesCorruptMetadata(t *testing.T) {
 	t.Parallel()
 
-	healthyID := "pgp-" + listTestGPGKeyID + "A"
+	healthyID := listTestUnlockerDirOne
 
 	tests := []struct {
 		name     string
@@ -300,12 +240,17 @@ func TestUnlockersListToleratesCorruptMetadata(t *testing.T) {
 		{
 			name:     "GPG key ID of the wrong type",
 			metadata: `{"type": "pgp", "gpgKeyId": 42}`,
-			wantIDs:  []string{healthyID, "pgp-unknown"},
+			wantIDs:  []string{healthyID, listTestUnlockerDirTwo},
 		},
 		{
 			name:     "GPG key ID missing",
 			metadata: `{"type": "pgp"}`,
-			wantIDs:  []string{healthyID, "pgp-unknown"},
+			wantIDs:  []string{healthyID, listTestUnlockerDirTwo},
+		},
+		{
+			name:     "unknown type",
+			metadata: `{"type": "unknown"}`,
+			wantIDs:  []string{healthyID, listTestUnlockerDirTwo},
 		},
 	}
 
@@ -371,7 +316,7 @@ func TestUnlockersListSkipsUnreadableMetadata(t *testing.T) {
 
 			require.Len(t, unlockers, 1,
 				"only the unlocker with usable metadata may be listed")
-			assert.Equal(t, "pgp-"+listTestGPGKeyID+"B", unlockers[0].ID,
+			assert.Equal(t, listTestUnlockerDirTwo, unlockers[0].ID,
 				"the listed row must carry the real unlocker ID")
 		})
 	}

internal/cli/unreadable_dir_test.go

@@ -2,15 +2,18 @@
 //
 // The checks that guard adding a PGP unlocker (is this key already an
 // unlocker?), removing the last unlocker and removing a vault (does the
-// vault hold secrets?), and importing a mnemonic (does the vault already
-// have a long-term key?) each look at the vault on disk before acting.
+// vault hold secrets?), removing a secret (how many versions does it
+// have?), and importing a mnemonic (does the vault already have a
+// long-term key?) each look at the vault on disk before acting.
 // When that look fails they must refuse to act, not read the failure as
 // "nothing there" and go ahead.
 //
 // The tests make the look fail with a wrapper around the in-memory
 // filesystem, which the state directory lock refuses. So they call the
-// function each command runs once it holds the lock, such as removeVault
-// for RemoveVault.
+// function each command runs once it holds the lock, such as addPGPUnlocker
+// for UnlockersAdd, or, for a removal, the function that makes its checks,
+// such as findVaultToRemove for RemoveVault, which runs again under the
+// lock before anything is removed, with --force or without.
 
 //nolint:testpackage // white-box test of unexported internals
 package cli
@@ -285,10 +288,9 @@ func TestRemoveLastUnlockerAbortsWhenSecretsUnreadable(t *testing.T) {
 
 			base := newListTestVault(t, 1)
 			writeTestSecret(t, base, vaultDir)
-			instance, cmd := newTestInstance(&statFailFs{Fs: base, path: path})
+			instance, _ := newTestInstance(&statFailFs{Fs: base, path: path})
 
-			err := instance.removeUnlocker(
-				"pgp-"+listTestGPGKeyID+"A", false, cmd)
+			_, err := instance.findUnlockerToRemove(listTestUnlockerDirOne)
 
 			require.ErrorIs(t, err, errStatFailed)
 			assertDirEntries(t, base, unlockersDir, listTestUnlockerDirOne)
@@ -332,9 +334,9 @@ func TestRemoveVaultAbortsWhenSecretsDirUnreadable(t *testing.T) {
 
 			base := newListTestVault(t, 1)
 			writeTestSecret(t, base, vaultDir)
-			instance, cmd := newTestInstance(tt.failFs(base))
+			instance, _ := newTestInstance(tt.failFs(base))
 
-			err := instance.removeVault(cmd, unreadableTestOtherVault, false)
+			_, err := instance.findVaultToRemove(unreadableTestOtherVault)
 
 			require.ErrorIs(t, err, tt.wantErr)
 
@@ -345,6 +347,31 @@ func TestRemoveVaultAbortsWhenSecretsDirUnreadable(t *testing.T) {
 	}
 }
 
+// TestRemoveSecretAbortsWhenVersionsUnreadable asserts that a secret is
+// kept when its versions directory exists but cannot be listed, so that
+// the question cannot say how many versions would be removed.
+func TestRemoveSecretAbortsWhenVersionsUnreadable(t *testing.T) {
+	t.Parallel()
+
+	secretDir := filepath.Join(testVaultDir(listTestVaultName),
+		unreadableTestSecretsDirName, unreadableTestSecretName)
+	versionsDir := filepath.Join(secretDir, "versions")
+
+	base := newListTestVault(t, 1)
+	writeTestSecret(t, base, testVaultDir(listTestVaultName))
+	require.NoError(t, base.MkdirAll(versionsDir, listTestDirPerm))
+
+	instance, _ := newTestInstance(&openFailFs{Fs: base, path: versionsDir})
+
+	_, err := instance.findSecretToRemove(unreadableTestSecretName)
+
+	require.ErrorIs(t, err, errOpenFailed)
+
+	exists, err := afero.DirExists(base, secretDir)
+	require.NoError(t, err)
+	assert.True(t, exists, "the secret must not be removed")
+}
+
 // TestVaultImportAbortsWhenPubKeyUnreadable asserts that a mnemonic import
 // stops when whether the vault already has a long-term key cannot be
 // determined.

internal/cli/vault.go

@@ -31,8 +31,6 @@ var (
 	errPassphraseEnvNotSet = errors.New(
 		"SB_UNLOCK_PASSPHRASE environment variable not set")
 	errCannotRemoveLastVault = errors.New("cannot remove the last vault")
-	errVaultContainsSecrets  = errors.New(
-		"contains secrets; use --force to remove")
 )
 
 func newVaultCmd() *cobra.Command {
@@ -156,9 +154,12 @@ func newVaultRemoveCmd() *cobra.Command {
 		Use:     "remove <name>",
 		Aliases: []string{"rm"},
 		Short:   "Remove a vault",
-		Long: `Remove a vault. Requires --force if the vault contains ` +
-			`secrets. Will automatically switch to another vault if ` +
-			`removing the currently selected one.`,
+		Long: `Remove a vault and all its secrets. Asks for ` +
+			`confirmation first, naming how many secrets the vault ` +
+			`holds; when stdin is not a terminal, fails unless --force ` +
+			`is given. Will automatically switch to another vault if ` +
+			`removing the currently selected one. The last vault ` +
+			`cannot be removed.`,
 		Args:              cobra.ExactArgs(1),
 		ValidArgsFunction: getVaultNamesCompletionFunc(cli.fs, cli.stateDir),
 		RunE: func(cmd *cobra.Command, args []string) error {
@@ -173,7 +174,8 @@ func newVaultRemoveCmd() *cobra.Command {
 		},
 	}
 
-	cmd.Flags().BoolP("force", "f", false, "Force removal even if vault contains secrets")
+	cmd.Flags().BoolP("force", "f", false,
+		"Remove without asking for confirmation, even a vault that contains secrets")
 
 	return cmd
 }
@@ -291,40 +293,26 @@ func (cli *Instance) CreateVault(cmd *cobra.Command, name string) error {
 	}
 	defer cleanupPassphrase()
 
-	// Create the vault - it will handle key derivation internally
-	vlt, err := vault.CreateVault(cli.fs, cli.stateDir, name, mnemonic)
+	// Create the vault with its passphrase unlocker
+	vlt, err := vault.CreateVault(cli.fs, cli.stateDir, name,
+		mnemonic, passphraseBuffer)
 	if err != nil {
 		return err
 	}
 
-	// Get the vault metadata to retrieve the derivation index
-	vaultDir := filepath.Join(cli.stateDir, "vaults.d", name)
-
-	metadata, err := vault.LoadVaultMetadata(cli.fs, vaultDir)
+	ltIdentity, err := vlt.GetOrDeriveLongTermKey()
 	if err != nil {
-		return fmt.Errorf("failed to load vault metadata: %w", err)
+		return fmt.Errorf("failed to get long-term key: %w", err)
 	}
 
-	// Derive the long-term key using the same index that CreateVault used
-	ltIdentity, err := agehd.DeriveIdentity(mnemonicStr, metadata.DerivationIndex)
+	unlocker, err := vlt.GetCurrentUnlocker()
 	if err != nil {
-		return fmt.Errorf("failed to derive long-term key from mnemonic: %w", err)
-	}
-
-	// Unlock the vault with the derived long-term key
-	vlt.Unlock(ltIdentity)
-
-	// Create passphrase-protected unlocker
-	secret.Debug("Creating passphrase-protected unlocker")
-
-	passphraseUnlocker, err := vlt.CreatePassphraseUnlocker(passphraseBuffer)
-	if err != nil {
-		return fmt.Errorf("failed to create unlocker: %w", err)
+		return err
 	}
 
 	cmd.Printf("Created vault '%s'\n", vlt.GetName())
 	cmd.Printf("Long-term public key: %s\n", ltIdentity.Recipient().String())
-	cmd.Printf("Unlocker ID: %s\n", passphraseUnlocker.GetID())
+	cmd.Printf("Unlocker ID: %s\n", unlocker.GetID())
 
 	return nil
 }
@@ -537,27 +525,27 @@ func (cli *Instance) importMnemonic(cmd *cobra.Command, vaultName string) error
 	return nil
 }
 
-// vaultHasSecrets reports whether the vault directory contains any secrets
-func (cli *Instance) vaultHasSecrets(vaultDir string) (bool, error) {
+// countVaultSecrets returns the number of secrets in the vault directory
+func (cli *Instance) countVaultSecrets(vaultDir string) (int, error) {
 	secretsDir := filepath.Join(vaultDir, "secrets.d")
 
 	exists, err := afero.DirExists(cli.fs, secretsDir)
 	if err != nil {
-		return false, fmt.Errorf("failed to check secrets directory %s: %w",
+		return 0, fmt.Errorf("failed to check secrets directory %s: %w",
 			secretsDir, err)
 	}
 
 	if !exists {
-		return false, nil
+		return 0, nil
 	}
 
 	entries, err := afero.ReadDir(cli.fs, secretsDir)
 	if err != nil {
-		return false, fmt.Errorf("failed to read secrets directory %s: %w",
+		return 0, fmt.Errorf("failed to read secrets directory %s: %w",
 			secretsDir, err)
 	}
 
-	return len(entries) > 0, nil
+	return len(entries), nil
 }
 
 // switchAwayFromVault selects another vault as current before removal
@@ -586,88 +574,107 @@ func (cli *Instance) switchAwayFromVault(
 	return nil
 }
 
-// RemoveVault removes a vault, holding the state directory lock while
-// removeVault runs
+// RemoveVault removes a vault and all its secrets, after asking the user
+// to confirm unless force is set.
 func (cli *Instance) RemoveVault(cmd *cobra.Command, name string, force bool) error {
 	err := vault.ValidateVaultName(name)
 	if err != nil {
 		return err
 	}
 
-	release, err := vault.LockStateDir(cli.fs, cli.stateDir)
+	var found vaultToRemove
+
+	release, err := cli.askThenLock(cmd, force, func() (string, error) {
+		var err error
+
+		found, err = cli.findVaultToRemove(name)
+
+		return found.question, err
+	})
 	if err != nil {
 		return err
 	}
 	defer release()
 
-	return cli.removeVault(cmd, name, force)
-}
-
-// removeVault removes a vault with safety checks
-func (cli *Instance) removeVault(cmd *cobra.Command, name string, force bool) error {
-	// Get list of all vaults
-	vaults, err := vault.ListVaults(cli.fs, cli.stateDir)
-	if err != nil {
-		return fmt.Errorf("failed to list vaults: %w", err)
-	}
-
-	// Check if vault exists
-	if !slices.Contains(vaults, name) {
-		return fmt.Errorf("vault '%s' %w", name, errVaultDoesNotExist)
-	}
-
-	// Don't allow removing the last vault
-	if len(vaults) == 1 {
-		return errCannotRemoveLastVault
-	}
-
-	// Check if this is the current vault
-	currentVault, err := vault.GetCurrentVault(cli.fs, cli.stateDir)
-	if err != nil {
-		return fmt.Errorf("failed to get current vault: %w", err)
-	}
-
-	isCurrentVault := currentVault.GetName() == name
-
-	// Load the vault to check for secrets
-	vlt := vault.NewVault(cli.fs, cli.stateDir, name)
-
-	vaultDir, err := vlt.GetDirectory()
-	if err != nil {
-		return fmt.Errorf("failed to get vault directory: %w", err)
-	}
-
-	// Check if vault has secrets
-	hasSecrets, err := cli.vaultHasSecrets(vaultDir)
-	if err != nil {
-		return err
-	}
-
-	// Require --force if vault has secrets
-	if hasSecrets && !force {
-		return fmt.Errorf("vault '%s' %w", name, errVaultContainsSecrets)
-	}
-
 	// If removing current vault, switch to another vault first
-	if isCurrentVault {
-		err = cli.switchAwayFromVault(cmd, vaults, name)
+	if found.isCurrent {
+		err = cli.switchAwayFromVault(cmd, found.vaults, name)
 		if err != nil {
 			return err
 		}
 	}
 
 	// Remove the vault directory
-	err = secret.RemoveDirAtomic(cli.fs, vaultDir)
+	err = secret.RemoveDirAtomic(cli.fs, found.dir)
 	if err != nil {
 		return fmt.Errorf("failed to remove vault directory: %w", err)
 	}
 
 	cmd.Printf("Removed vault '%s'\n", name)
 
-	if hasSecrets {
+	if found.secrets > 0 {
 		cmd.Printf("Warning: Vault contained secrets that have been " +
 			"permanently deleted\n")
 	}
 
 	return nil
 }
+
+// vaultToRemove is what removing a vault removes, as findVaultToRemove
+// found it.
+type vaultToRemove struct {
+	// dir is the vault's directory, which holds all its secrets.
+	dir     string
+	secrets int
+	// vaults lists every vault, this one included, and isCurrent is set
+	// when this one is the current vault.
+	vaults    []string
+	isCurrent bool
+	// question names what is removed, for the user to confirm.
+	question string
+}
+
+// findVaultToRemove checks that the vault exists and is not the last one,
+// and counts its secrets.
+func (cli *Instance) findVaultToRemove(name string) (vaultToRemove, error) {
+	vaults, err := vault.ListVaults(cli.fs, cli.stateDir)
+	if err != nil {
+		return vaultToRemove{}, fmt.Errorf("failed to list vaults: %w", err)
+	}
+
+	if !slices.Contains(vaults, name) {
+		return vaultToRemove{},
+			fmt.Errorf("vault '%s' %w", name, errVaultDoesNotExist)
+	}
+
+	if len(vaults) == 1 {
+		return vaultToRemove{}, errCannotRemoveLastVault
+	}
+
+	currentVault, err := vault.GetCurrentVault(cli.fs, cli.stateDir)
+	if err != nil {
+		return vaultToRemove{},
+			fmt.Errorf("failed to get current vault: %w", err)
+	}
+
+	vaultDir, err := vault.NewVault(cli.fs, cli.stateDir, name).GetDirectory()
+	if err != nil {
+		return vaultToRemove{},
+			fmt.Errorf("failed to get vault directory: %w", err)
+	}
+
+	secrets, err := cli.countVaultSecrets(vaultDir)
+	if err != nil {
+		return vaultToRemove{}, err
+	}
+
+	return vaultToRemove{
+		dir:       vaultDir,
+		secrets:   secrets,
+		vaults:    vaults,
+		isCurrent: currentVault.GetName() == name,
+		question: fmt.Sprintf(
+			"Permanently remove vault '%s' and its %d secret(s)?",
+			name, secrets),
+	}, nil
+}

internal/cli/version.go

@@ -89,7 +89,8 @@ func VersionCommands(cli *Instance) *cobra.Command {
 		Aliases: []string{"rm"},
 		Short:   "Remove a specific version of a secret",
 		Long: "Remove a specific version of a secret. Cannot remove the " +
-			"current version.",
+			"current version. Asks for confirmation first; when stdin " +
+			"is not a terminal, fails unless --force is given.",
 		Args: cobra.ExactArgs(2), //nolint:mnd // secret-name and version args
 		ValidArgsFunction: func(
 			cmd *cobra.Command, args []string, toComplete string,
@@ -102,10 +103,15 @@ func VersionCommands(cli *Instance) *cobra.Command {
 			return nil, cobra.ShellCompDirectiveNoFileComp
 		},
 		RunE: func(cmd *cobra.Command, args []string) error {
-			return cli.RemoveVersion(cmd, args[0], args[1])
+			force, _ := cmd.Flags().GetBool("force")
+
+			return cli.RemoveVersion(cmd, args[0], args[1], force)
 		},
 	}
 
+	removeCmd.Flags().BoolP("force", "f", false,
+		"Remove without asking for confirmation")
+
 	versionCmd.AddCommand(listCmd, promoteCmd, removeCmd)
 
 	return versionCmd
@@ -297,30 +303,62 @@ func (cli *Instance) PromoteVersion(
 	return nil
 }
 
-// RemoveVersion removes a specific version of a secret
+// RemoveVersion removes a specific version of a secret, after asking the
+// user to confirm unless force is set.
 func (cli *Instance) RemoveVersion(
-	cmd *cobra.Command, secretName string, version string,
+	cmd *cobra.Command, secretName string, version string, force bool,
 ) error {
 	err := vault.ValidateSecretName(secretName)
 	if err != nil {
 		return err
 	}
 
-	release, err := vault.LockStateDir(cli.fs, cli.stateDir)
+	var found versionToRemove
+
+	release, err := cli.askThenLock(cmd, force, func() (string, error) {
+		var err error
+
+		found, err = cli.findVersionToRemove(secretName, version)
+
+		return found.question, err
+	})
 	if err != nil {
 		return err
 	}
 	defer release()
 
-	// Get current vault
+	err = secret.RemoveDirAtomic(cli.fs, found.dir)
+	if err != nil {
+		return fmt.Errorf("failed to remove version: %w", err)
+	}
+
+	cmd.Printf("Removed version %s of secret '%s'\n", version, secretName)
+
+	return nil
+}
+
+// versionToRemove is what removing a version removes, as
+// findVersionToRemove found it.
+type versionToRemove struct {
+	// dir is the version's directory.
+	dir string
+	// question names what is removed, for the user to confirm.
+	question string
+}
+
+// findVersionToRemove checks that the version exists in the secret in the
+// current vault and is not its current version.
+func (cli *Instance) findVersionToRemove(
+	secretName, version string,
+) (versionToRemove, error) {
 	vlt, err := vault.GetCurrentVault(cli.fs, cli.stateDir)
 	if err != nil {
-		return err
+		return versionToRemove{}, err
 	}
 
 	vaultDir, err := vlt.GetDirectory()
 	if err != nil {
-		return err
+		return versionToRemove{}, err
 	}
 
 	// Get the encoded secret name
@@ -330,45 +368,44 @@ func (cli *Instance) RemoveVersion(
 	// Check if secret exists
 	exists, err := afero.DirExists(cli.fs, secretDir)
 	if err != nil {
-		return fmt.Errorf("failed to check if secret exists: %w", err)
+		return versionToRemove{},
+			fmt.Errorf("failed to check if secret exists: %w", err)
 	}
 
 	if !exists {
-		return fmt.Errorf("secret '%s' %w", secretName, errSecretNotFound)
+		return versionToRemove{},
+			fmt.Errorf("secret '%s' %w", secretName, errSecretNotFound)
 	}
 
 	// Check if version exists
 	exists, err = secret.VersionExists(cli.fs, secretDir, version)
 	if err != nil {
-		return fmt.Errorf("failed to check if version exists: %w", err)
+		return versionToRemove{},
+			fmt.Errorf("failed to check if version exists: %w", err)
 	}
 
 	if !exists {
-		return fmt.Errorf("version '%s' %w '%s'",
+		return versionToRemove{}, fmt.Errorf("version '%s' %w '%s'",
 			version, errVersionNotFound, secretName)
 	}
 
 	// Get current version
 	currentVersion, err := secret.GetCurrentVersion(cli.fs, secretDir)
 	if err != nil {
-		return fmt.Errorf("failed to get current version: %w", err)
+		return versionToRemove{},
+			fmt.Errorf("failed to get current version: %w", err)
 	}
 
 	// Don't allow removing the current version
 	if version == currentVersion {
-		return fmt.Errorf("cannot remove the current version '%s'; %w",
+		return versionToRemove{}, fmt.Errorf(
+			"cannot remove the current version '%s'; %w",
 			version, errCannotRemoveCurrentVersion)
 	}
 
-	// Remove the version directory
-	versionDir := filepath.Join(secretDir, "versions", version)
-
-	err = secret.RemoveDirAtomic(cli.fs, versionDir)
-	if err != nil {
-		return fmt.Errorf("failed to remove version: %w", err)
-	}
-
-	cmd.Printf("Removed version %s of secret '%s'\n", version, secretName)
-
-	return nil
+	return versionToRemove{
+		dir: filepath.Join(secretDir, "versions", version),
+		question: fmt.Sprintf("Permanently remove version %s of secret "+
+			"'%s' from vault '%s'?", version, secretName, vlt.GetName()),
+	}, nil
 }

internal/cli/version_test.go

@@ -73,7 +73,8 @@ func setupTestVault(t *testing.T, fs afero.Fs) {
 	t.Helper()
 
 	// Create vault
-	vlt, err := vault.CreateVault(fs, testStateDir, "default", testMnemonicBuffer(t))
+	vlt, err := vault.CreateVault(fs, testStateDir, "default",
+		testMnemonicBuffer(t), nil)
 	require.NoError(t, err)
 
 	// Derive and store long-term key from mnemonic
@@ -170,8 +171,7 @@ func TestListVersionsNonExistentSecret(t *testing.T) {
 
 	// Try to list versions of non-existent secret
 	err := cli.ListVersions(cmd, "nonexistent/secret")
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "not found")
+	require.ErrorIs(t, err, errSecretNotFound)
 }
 
 func TestPromoteVersionCommand(t *testing.T) {
@@ -265,8 +265,7 @@ func TestPromoteNonExistentVersion(t *testing.T) {
 
 	// Try to promote non-existent version
 	err = cli.PromoteVersion(cmd, "test/secret", "20991231.999")
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "not found")
+	require.ErrorIs(t, err, errVersionNotFound)
 }
 
 func TestGetSecretWithVersion(t *testing.T) {

internal/macse/macse_darwin.go

@@ -15,6 +15,7 @@ package macse
 import "C"
 
 import (
+	"errors"
 	"fmt"
 	"unsafe"
 )
@@ -39,10 +40,9 @@ const (
 
 // CreateKey creates a new P-256 non-exportable key in the Secure Enclave via sc_auth.
 // Returns the uncompressed public key bytes (65 bytes) and the identity hash
-// (for deletion).
+// (for deletion). If getting the public key fails, CreateKey deletes the key
+// again; a failure to delete is returned along with the first error.
 func CreateKey(label string) (publicKey []byte, hash string, err error) {
-	pubKeyBuf := make([]C.uint8_t, p256UncompressedKeySize)
-	pubKeyLen := C.int(p256UncompressedKeySize)
 	var hashBuf [hashBufferSize]C.char
 	var errBuf [errorBufferSize]C.char
 
@@ -50,7 +50,6 @@ func CreateKey(label string) (publicKey []byte, hash string, err error) {
 	defer C.free(unsafe.Pointer(cLabel)) //nolint:nlreturn // CGo free pattern
 
 	result := C.se_create_key(cLabel,
-		&pubKeyBuf[0], &pubKeyLen,
 		&hashBuf[0], C.int(hashBufferSize),
 		&errBuf[0], C.int(errorBufferSize))
 
@@ -58,9 +57,29 @@ func CreateKey(label string) (publicKey []byte, hash string, err error) {
 		return nil, "", fmt.Errorf("secure enclave: %s", C.GoString(&errBuf[0]))
 	}
 
+	h := C.GoString(&hashBuf[0])
+
+	pubKeyBuf := make([]C.uint8_t, p256UncompressedKeySize)
+	pubKeyLen := C.int(p256UncompressedKeySize)
+
+	result = C.se_copy_public_key(cLabel,
+		&pubKeyBuf[0], &pubKeyLen,
+		&errBuf[0], C.int(errorBufferSize))
+
+	if result != 0 {
+		err = fmt.Errorf("secure enclave: %s", C.GoString(&errBuf[0]))
+
+		deleteErr := DeleteKey(h)
+		if deleteErr != nil {
+			err = errors.Join(err,
+				fmt.Errorf("failed to delete key %s: %w", label, deleteErr))
+		}
+
+		return nil, "", err
+	}
+
 	//nolint:nlreturn // CGo result extraction
 	pk := C.GoBytes(unsafe.Pointer(&pubKeyBuf[0]), pubKeyLen)
-	h := C.GoString(&hashBuf[0])
 
 	return pk, h, nil
 }

internal/macse/secure_enclave.h

@@ -5,20 +5,30 @@
 
 #include <stdint.h>
 
-// se_create_key creates a new P-256 key in the Secure Enclave via sc_auth.
+// se_create_key creates a new P-256 key in the Secure Enclave via sc_auth and
+// finds its identity hash. If the hash cannot be found, the key exists but
+// se_create_key fails, with an error naming the label.
 // label: unique identifier for the CTK identity (UTF-8 C string)
-// pub_key_out: output buffer for the uncompressed public key (65 bytes for P-256)
-// pub_key_len: on input, size of pub_key_out; on output, actual size written
 // hash_out: output buffer for the identity hash (for deletion)
 // hash_out_len: size of hash_out buffer
 // error_out: output buffer for error message
 // error_out_len: size of error_out buffer
 // Returns 0 on success, -1 on failure.
 int se_create_key(const char *label,
-                  uint8_t *pub_key_out, int *pub_key_len,
                   char *hash_out, int hash_out_len,
                   char *error_out, int error_out_len);
 
+// se_copy_public_key copies the public key of a CTK identity.
+// label: label of the CTK identity
+// pub_key_out: output buffer for the uncompressed public key (65 bytes for P-256)
+// pub_key_len: on input, size of pub_key_out; on output, actual size written
+// error_out: output buffer for error message
+// error_out_len: size of error_out buffer
+// Returns 0 on success, -1 on failure.
+int se_copy_public_key(const char *label,
+                       uint8_t *pub_key_out, int *pub_key_len,
+                       char *error_out, int error_out_len);
+
 // se_encrypt encrypts data using the SE-backed public key (ECIES).
 // label: label of the CTK identity whose public key to use
 // plaintext: data to encrypt

internal/macse/secure_enclave.m

@@ -47,7 +47,6 @@ static SecKeyRef lookup_ctk_private_key(const char *label, char *error_out, int
 }
 
 int se_create_key(const char *label,
-                  uint8_t *pub_key_out, int *pub_key_len,
                   char *hash_out, int hash_out_len,
                   char *error_out, int error_out_len) {
     @autoreleasepool {
@@ -87,7 +86,56 @@ int se_create_key(const char *label,
             return -1;
         }
 
-        // Retrieve the public key from the created identity
+        // Get the identity hash, which deleting the key needs, by parsing
+        // sc_auth list output
+        hash_out[0] = '\0';
+        NSTask *listTask = [[NSTask alloc] init];
+        listTask.executableURL = [NSURL fileURLWithPath:@"/usr/sbin/sc_auth"];
+        listTask.arguments = @[@"list-ctk-identities"];
+
+        NSPipe *listPipe = [NSPipe pipe];
+        listTask.standardOutput = listPipe;
+        listTask.standardError = [NSPipe pipe];
+
+        if ([listTask launchAndReturnError:&nsError]) {
+            [listTask waitUntilExit];
+            NSData *listData = [listPipe.fileHandleForReading readDataToEndOfFile];
+            NSString *listStr = [[NSString alloc] initWithData:listData
+                                                      encoding:NSUTF8StringEncoding];
+
+            for (NSString *line in [listStr componentsSeparatedByString:@"\n"]) {
+                if ([line containsString:labelStr]) {
+                    NSMutableArray *tokens = [NSMutableArray array];
+                    for (NSString *part in [line componentsSeparatedByCharactersInSet:
+                                            [NSCharacterSet whitespaceCharacterSet]]) {
+                        if (part.length > 0) {
+                            [tokens addObject:part];
+                        }
+                    }
+                    if (tokens.count > 1) {
+                        snprintf(hash_out, hash_out_len, "%s", [tokens[1] UTF8String]);
+                    }
+                    break;
+                }
+            }
+        }
+
+        if (hash_out[0] == '\0') {
+            NSString *msg = [NSString stringWithFormat:
+                             @"created key '%s' but found no hash for it in sc_auth list-ctk-identities",
+                             label];
+            snprintf_error(error_out, error_out_len, msg);
+            return -1;
+        }
+
+        return 0;
+    }
+}
+
+int se_copy_public_key(const char *label,
+                       uint8_t *pub_key_out, int *pub_key_len,
+                       char *error_out, int error_out_len) {
+    @autoreleasepool {
         SecKeyRef privateKey = lookup_ctk_private_key(label, error_out, error_out_len);
         if (!privateKey) {
             return -1;
@@ -126,39 +174,6 @@ int se_create_key(const char *label,
         *pub_key_len = (int)length;
         CFRelease(pubKeyData);
 
-        // Get the identity hash by parsing sc_auth list output
-        hash_out[0] = '\0';
-        NSTask *listTask = [[NSTask alloc] init];
-        listTask.executableURL = [NSURL fileURLWithPath:@"/usr/sbin/sc_auth"];
-        listTask.arguments = @[@"list-ctk-identities"];
-
-        NSPipe *listPipe = [NSPipe pipe];
-        listTask.standardOutput = listPipe;
-        listTask.standardError = [NSPipe pipe];
-
-        if ([listTask launchAndReturnError:&nsError]) {
-            [listTask waitUntilExit];
-            NSData *listData = [listPipe.fileHandleForReading readDataToEndOfFile];
-            NSString *listStr = [[NSString alloc] initWithData:listData
-                                                      encoding:NSUTF8StringEncoding];
-
-            for (NSString *line in [listStr componentsSeparatedByString:@"\n"]) {
-                if ([line containsString:labelStr]) {
-                    NSMutableArray *tokens = [NSMutableArray array];
-                    for (NSString *part in [line componentsSeparatedByCharactersInSet:
-                                            [NSCharacterSet whitespaceCharacterSet]]) {
-                        if (part.length > 0) {
-                            [tokens addObject:part];
-                        }
-                    }
-                    if (tokens.count > 1) {
-                        snprintf(hash_out, hash_out_len, "%s", [tokens[1] UTF8String]);
-                    }
-                    break;
-                }
-            }
-        }
-
         return 0;
     }
 }

internal/secret/atomic.go

@@ -5,10 +5,15 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"strings"
 
 	"github.com/spf13/afero"
 )
 
+// tempNamePart is in the name of every temporary file WriteFileAtomic makes,
+// ".NAME.tmp-123", and every temporary directory TempDirFor makes, ".tmp-123".
+const tempNamePart = ".tmp-"
+
 // WriteFileAtomic replaces the file at path with data so that a reader, or
 // a crash at any moment, finds either the old content or the new, never a
 // partial file. The data goes into a temporary file that afero.TempFile
@@ -17,7 +22,7 @@ import (
 // temporary file is removed if any step fails.
 func WriteFileAtomic(fs afero.Fs, path string, data []byte) error {
 	tmp, err := afero.TempFile(fs, filepath.Dir(path),
-		"."+filepath.Base(path)+".tmp-*")
+		"."+filepath.Base(path)+tempNamePart+"*")
 	if err != nil {
 		return fmt.Errorf("failed to create temporary file for %s: %w", path, err)
 	}
@@ -54,7 +59,7 @@ func WriteFileAtomic(fs afero.Fs, path string, data []byte) error {
 // Its name leaves out target's, which may already be as long as a file name
 // can be.
 func TempDirFor(fs afero.Fs, target string) (string, error) {
-	dir, err := afero.TempDir(fs, filepath.Dir(filepath.Dir(target)), ".tmp-")
+	dir, err := afero.TempDir(fs, filepath.Dir(filepath.Dir(target)), tempNamePart)
 	if err != nil {
 		return "", fmt.Errorf(
 			"failed to create temporary directory for %s: %w", target, err)
@@ -63,6 +68,40 @@ func TempDirFor(fs afero.Fs, target string) (string, error) {
 	return dir, nil
 }
 
+// RemoveLeftovers deletes from dir the temporary files of WriteFileAtomic
+// and the temporary directories of TempDirFor that a command killed
+// part-way left there: each entry whose name starts with "." and holds
+// tempNamePart. The caller must hold the state directory lock, so that no
+// running command is still using one. A dir that does not exist holds none.
+func RemoveLeftovers(fs afero.Fs, dir string) error {
+	entries, err := afero.ReadDir(fs, dir)
+	if errors.Is(err, os.ErrNotExist) {
+		return nil
+	}
+
+	if err != nil {
+		return fmt.Errorf("failed to read %s: %w", dir, err)
+	}
+
+	for _, entry := range entries {
+		name := entry.Name()
+		if !strings.HasPrefix(name, ".") || !strings.Contains(name, tempNamePart) {
+			continue
+		}
+
+		path := filepath.Join(dir, name)
+
+		err = fs.RemoveAll(path)
+		if err != nil {
+			return fmt.Errorf("failed to remove %s: %w", path, err)
+		}
+
+		Debug("Removed what an interrupted command left", "path", path)
+	}
+
+	return nil
+}
+
 // WriteDir calls write to write the files of the new directory dir into a
 // temporary directory from TempDirFor, which is then renamed to dir, so that
 // neither a failure nor a crash leaves dir half-written; on a failure the

internal/secret/atomic_test.go

@@ -8,6 +8,7 @@ import (
 	"testing"
 
 	"filippo.io/age"
+	"git.eeqj.de/sneak/secret/internal/macse"
 	"git.eeqj.de/sneak/secret/internal/secret"
 	"git.eeqj.de/sneak/secret/internal/vault"
 	"github.com/awnumar/memguard"
@@ -235,7 +236,7 @@ func newVaultWithSecret(
 ) *vault.Vault {
 	t.Helper()
 
-	vlt, err := vault.CreateVault(fs, stateDir, name, testMnemonicBuffer(t))
+	vlt, err := vault.CreateVault(fs, stateDir, name, testMnemonicBuffer(t), nil)
 	require.NoError(t, err)
 
 	buffer := memguard.NewBufferFromBytes([]byte(value))
@@ -352,7 +353,7 @@ func TestLongestNames(t *testing.T) {
 	fs := afero.NewOsFs()
 	name := strings.Repeat("a", longestName)
 
-	vlt, err := vault.CreateVault(fs, t.TempDir(), name, testMnemonicBuffer(t))
+	vlt, err := vault.CreateVault(fs, t.TempDir(), name, testMnemonicBuffer(t), nil)
 	require.NoError(t, err)
 
 	value := memguard.NewBufferFromBytes([]byte("long"))
@@ -646,7 +647,7 @@ func TestPassphraseUnlockerGetsKeyFirst(t *testing.T) {
 
 	// No mnemonic, and no current unlocker to get the key from
 	base := afero.NewMemMapFs()
-	_, err := vault.CreateVault(base, testVaultStateDir, testVaultName, nil)
+	_, err := vault.CreateVault(base, testVaultStateDir, testVaultName, nil, nil)
 	require.NoError(t, err)
 
 	fs := hookFs{Fs: base, before: func(_, path string) error {
@@ -678,7 +679,7 @@ func TestPassphraseUnlockerIsWholeOrAbsent(t *testing.T) {
 
 			base, stateDir := tfs.open(t)
 			vlt, err := vault.CreateVault(base, stateDir, testVaultName,
-				testMnemonicBuffer(t))
+				testMnemonicBuffer(t), nil)
 			require.NoError(t, err)
 
 			vaultDir, err := vlt.GetDirectory()
@@ -727,7 +728,7 @@ func TestPassphraseUnlockerReplacementKeepsVaultOpen(t *testing.T) {
 
 			base, stateDir := tfs.open(t)
 			vlt, err := vault.CreateVault(base, stateDir, testVaultName,
-				testMnemonicBuffer(t))
+				testMnemonicBuffer(t), nil)
 			require.NoError(t, err)
 
 			ltIdentity, err := vlt.GetOrDeriveLongTermKey()
@@ -899,3 +900,42 @@ func TestWriteDirRefusesExistingDir(t *testing.T) {
 		})
 	}
 }
+
+// TestSecureEnclaveUnlockerFailureDeletesKey makes moving a new Secure
+// Enclave unlocker into place fail after its Secure Enclave key is created:
+// the key must be deleted again. Skipped when the add fails before that, as
+// it does everywhere but in a macOS build with cgo on a Mac with a Secure
+// Enclave.
+func TestSecureEnclaveUnlockerFailureDeletesKey(t *testing.T) {
+	t.Parallel()
+
+	mnemonic := testMnemonicBuffer(t)
+	base := afero.NewMemMapFs()
+	_, err := vault.CreateVault(base, testVaultStateDir, testVaultName, mnemonic, nil)
+	require.NoError(t, err)
+
+	// The unlocker's directory is named se-<label of its Secure Enclave key>
+	var seKeyLabel string
+
+	fs := hookFs{Fs: base, before: func(op, path string) error {
+		if op == opRename && filepath.Base(filepath.Dir(path)) == "unlockers.d" {
+			seKeyLabel = strings.TrimPrefix(filepath.Base(path), "se-")
+
+			return errInjected
+		}
+
+		return nil
+	}}
+
+	_, err = secret.CreateSecureEnclaveUnlocker(fs, testVaultStateDir, mnemonic,
+		nil)
+
+	if seKeyLabel == "" {
+		t.Skipf("the add failed before moving the unlocker into place: %v", err)
+	}
+
+	require.ErrorIs(t, err, errInjected)
+
+	_, err = macse.Encrypt(seKeyLabel, []byte("test"))
+	assert.Error(t, err, "Secure Enclave key left behind")
+}

internal/secret/crypto.go

@@ -7,6 +7,7 @@ import (
 	"io"
 	"os"
 	"syscall"
+	"unsafe"
 
 	"filippo.io/age"
 	"github.com/awnumar/memguard"
@@ -102,6 +103,23 @@ func DecryptWithIdentity(
 	return resultBuffer, nil
 }
 
+// IdentityToLockedBuffer returns the private key of id, in age's text form, in
+// a new locked buffer. The caller must destroy it.
+//
+// This is best effort. age gives the key only as a string in ordinary memory.
+// The bytes of that string are moved into the buffer, which overwrites them,
+// although Go otherwise never changes a string; nothing else holds this one.
+// The copies age makes while building the string are left in ordinary memory.
+// Avoiding those would mean encoding the key here, straight into the buffer.
+func IdentityToLockedBuffer(id *age.X25519Identity) *memguard.LockedBuffer {
+	key := id.String()
+
+	//nolint:gosec // G103: the string's own bytes, which NewBufferFromBytes wipes
+	keyBytes := unsafe.Slice(unsafe.StringData(key), len(key))
+
+	return memguard.NewBufferFromBytes(keyBytes)
+}
+
 // EncryptWithPassphrase encrypts data using a passphrase with age's
 // scrypt-based encryption. Both data and passphrase parameters should
 // be LockedBuffers for secure memory handling

internal/secret/crypto_test.go

@@ -0,0 +1,29 @@
+package secret_test
+
+import (
+	"testing"
+
+	"filippo.io/age"
+	"git.eeqj.de/sneak/secret/internal/secret"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestIdentityToLockedBuffer checks that the buffer holds the identity's
+// private key, and that the identity still gives that key afterwards: the
+// helper overwrites the string age returned, so age must not keep it.
+func TestIdentityToLockedBuffer(t *testing.T) {
+	t.Parallel()
+
+	identity, err := age.GenerateX25519Identity()
+	require.NoError(t, err)
+
+	buffer := secret.IdentityToLockedBuffer(identity)
+	defer buffer.Destroy()
+
+	parsed, err := age.ParseX25519Identity(buffer.String())
+	require.NoError(t, err)
+	assert.Equal(t, identity.Recipient().String(), parsed.Recipient().String())
+
+	assert.Equal(t, identity.String(), buffer.String())
+}

internal/secret/keychainunlocker.go

@@ -156,20 +156,9 @@ func (k *KeychainUnlocker) GetDirectory() string {
 	return k.Directory
 }
 
-// GetID implements Unlocker interface - generates ID from keychain item name
+// GetID implements Unlocker interface: the name of the unlocker's directory
 func (k *KeychainUnlocker) GetID() string {
-	// Generate ID in the format YYYY-MM-DD.HH.mm-hostname-keychain
-	// This matches the passphrase unlocker format
-	hostname, err := os.Hostname()
-	if err != nil {
-		hostname = "unknown"
-	}
-
-	// Use the creation timestamp from metadata
-	createdAt := k.Metadata.CreatedAt
-	timestamp := createdAt.Format("2006-01-02.15.04")
-
-	return fmt.Sprintf("%s-%s-keychain", timestamp, hostname)
+	return filepath.Base(k.Directory)
 }
 
 // Remove implements Unlocker interface - removes the keychain unlocker
@@ -396,8 +385,7 @@ func deriveLongTermPrivateKey(
 			"failed to derive long-term key from mnemonic: %w", err)
 	}
 
-	// Return the private key in a secure buffer
-	return memguard.NewBufferFromBytes([]byte(ltIdentity.String())), nil
+	return IdentityToLockedBuffer(ltIdentity), nil
 }
 
 // CreateKeychainUnlocker creates a new keychain unlocker and stores it in the
@@ -448,10 +436,7 @@ func CreateKeychainUnlocker(
 	defer agePrivKeyPassphrase.Destroy()
 
 	// Step 3: Encrypt age private key with the generated passphrase
-	// Create a secure buffer for the private key
-	agePrivKeyStr := ageIdentity.String()
-
-	agePrivKeyBuffer := memguard.NewBufferFromBytes([]byte(agePrivKeyStr))
+	agePrivKeyBuffer := IdentityToLockedBuffer(ageIdentity)
 	defer agePrivKeyBuffer.Destroy()
 
 	encryptedAgePrivKey, err := EncryptWithPassphrase(
@@ -494,6 +479,8 @@ func CreateKeychainUnlocker(
 
 // writeKeychainUnlocker writes a new keychain unlocker into unlockerDir and
 // stores its data in the keychain (steps 7 and 8 of CreateKeychainUnlocker).
+// The data is stored after the unlocker's files are written, and the keychain
+// item is deleted again if moving the unlocker into place then fails.
 func writeKeychainUnlocker(
 	fs afero.Fs, unlockerDir, keychainItemName, ageRecipient string,
 	encryptedAgePrivKey, encryptedLtPrivKey []byte,
@@ -514,8 +501,10 @@ func writeKeychainUnlocker(
 		return nil, fmt.Errorf("failed to marshal unlocker metadata: %w", err)
 	}
 
-	// Step 8: Write the unlocker's files and store the data in the keychain,
-	// the metadata last
+	// Step 8: Write the unlocker's files, the metadata last, then store the
+	// data in the keychain
+	stored := false
+
 	err = WriteDir(fs, unlockerDir, func(dir string) error {
 		err := WriteFileAtomic(fs, filepath.Join(dir, "pub.txt"), []byte(ageRecipient))
 		if err != nil {
@@ -532,19 +521,29 @@ func writeKeychainUnlocker(
 			return fmt.Errorf("failed to write encrypted long-term private key: %w", err)
 		}
 
-		err = storeInKeychain(keychainItemName, keychainDataBuffer)
-		if err != nil {
-			return fmt.Errorf("failed to store data in keychain: %w", err)
-		}
-
 		err = WriteFileAtomic(fs, filepath.Join(dir, "unlocker-metadata.json"),
 			metadataBytes)
 		if err != nil {
 			return fmt.Errorf("failed to write unlocker metadata: %w", err)
 		}
 
+		err = storeInKeychain(keychainItemName, keychainDataBuffer)
+		if err != nil {
+			return fmt.Errorf("failed to store data in keychain: %w", err)
+		}
+
+		stored = true
+
 		return nil
 	})
+	if err != nil && stored {
+		deleteErr := deleteFromKeychain(keychainItemName)
+		if deleteErr != nil {
+			err = errors.Join(err, fmt.Errorf(
+				"failed to delete keychain item %s: %w", keychainItemName, deleteErr))
+		}
+	}
+
 	if err != nil {
 		return nil, err
 	}

internal/secret/keychainunlocker_stub.go

@@ -4,6 +4,7 @@ package secret
 
 import (
 	"errors"
+	"path/filepath"
 
 	"filippo.io/age"
 	"github.com/awnumar/memguard"
@@ -60,9 +61,9 @@ func (k *KeychainUnlocker) GetDirectory() string {
 	return k.Directory
 }
 
-// GetID returns the unlocker ID
+// GetID returns the unlocker ID, the name of the unlocker's directory
 func (k *KeychainUnlocker) GetID() string {
-	return k.Metadata.CreatedAt.Format("2006-01-02.15.04") + "-keychain"
+	return filepath.Base(k.Directory)
 }
 
 // GetKeychainItemName returns an error on non-Darwin platforms

internal/secret/keychainunlocker_test.go

@@ -4,10 +4,13 @@ package secret
 
 import (
 	"encoding/hex"
+	"os"
+	"path/filepath"
 	"runtime"
 	"testing"
 
 	"github.com/awnumar/memguard"
+	"github.com/spf13/afero"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -69,9 +72,12 @@ func TestKeychainInvalidItemName(t *testing.T) {
 	testData := memguard.NewBufferFromBytes([]byte("test"))
 	defer testData.Destroy()
 
+	// Test an empty item name
+	err := storeInKeychain("", testData)
+	require.ErrorIs(t, err, errKeychainItemNameEmpty)
+
 	// Test invalid item names
 	invalidNames := []string{
-		"",                  // Empty name
 		"test space",        // Contains space
 		"test/slash",        // Contains slash
 		"test\\backslash",   // Contains backslash
@@ -93,9 +99,8 @@ func TestKeychainInvalidItemName(t *testing.T) {
 
 	for _, name := range invalidNames {
 		err := storeInKeychain(name, testData)
-		assert.Error(t, err, "Expected error for invalid name: %s", name)
-		assert.Contains(t, err.Error(), "invalid keychain item name",
-			"Error should mention invalid name for: %s", name)
+		require.ErrorIs(t, err, errInvalidKeychainItemName,
+			"Expected error for invalid name: %s", name)
 	}
 
 	// Test valid names (should not error on validation)
@@ -185,3 +190,27 @@ func TestDeleteNonExistentKeychainItem(t *testing.T) {
 	assert.NoError(t, err,
 		"Deleting non-existent keychain item should not return an error")
 }
+
+// TestWriteKeychainUnlockerFailureDeletesItem makes moving a new keychain
+// unlocker into place fail after its data is stored in the keychain: the
+// keychain item must be deleted again.
+func TestWriteKeychainUnlockerFailureDeletesItem(t *testing.T) {
+	testItemName := "test-secret-keychain-unlocker-cleanup"
+	_ = deleteFromKeychain(testItemName)
+
+	// Moving the unlocker into a read-only directory fails
+	unlockersDir := filepath.Join(t.TempDir(), "unlockers.d")
+	require.NoError(t, os.Mkdir(unlockersDir, 0o500))
+
+	testBuffer := memguard.NewBufferFromBytes([]byte("test-keychain-data"))
+	defer testBuffer.Destroy()
+
+	_, err := writeKeychainUnlocker(afero.NewOsFs(),
+		filepath.Join(unlockersDir, testItemName), testItemName, "age1test",
+		[]byte("test-priv"), []byte("test-longterm"), testBuffer)
+	require.ErrorIs(t, err, os.ErrPermission,
+		"moving the unlocker into place should fail")
+
+	_, err = retrieveFromKeychain(testItemName)
+	assert.Error(t, err, "keychain item left behind")
+}

internal/secret/passphraseunlocker.go

@@ -1,6 +1,7 @@
 package secret
 
 import (
+	"errors"
 	"fmt"
 	"log/slog"
 	"path/filepath"
@@ -10,6 +11,11 @@ import (
 	"github.com/spf13/afero"
 )
 
+// ErrPassphraseNotRead is wrapped in the error of a passphrase unlocker
+// that could not read its passphrase from the terminal, for example because
+// there is none. The unlocker itself was not tried.
+var ErrPassphraseNotRead = errors.New("failed to read passphrase")
+
 // PassphraseUnlocker represents a passphrase-protected unlocker
 type PassphraseUnlocker struct {
 	Directory  string
@@ -109,12 +115,9 @@ func (p *PassphraseUnlocker) GetDirectory() string {
 	return p.Directory
 }
 
-// GetID implements Unlocker interface - generates ID from creation timestamp
+// GetID implements Unlocker interface: the name of the unlocker's directory
 func (p *PassphraseUnlocker) GetID() string {
-	// Generate ID using creation timestamp: YYYY-MM-DD.HH.mm-passphrase
-	createdAt := p.Metadata.CreatedAt
-
-	return createdAt.Format("2006-01-02.15.04") + "-passphrase"
+	return filepath.Base(p.Directory)
 }
 
 // Remove implements Unlocker interface - removes the passphrase unlocker
@@ -152,7 +155,7 @@ func (p *PassphraseUnlocker) getPassphrase() (*memguard.LockedBuffer, error) {
 	if err != nil {
 		Debug("Failed to read passphrase", "error", err, "unlocker_id", p.GetID())
 
-		return nil, fmt.Errorf("failed to read passphrase: %w", err)
+		return nil, fmt.Errorf("%w: %w", ErrPassphraseNotRead, err)
 	}
 
 	return secureBuffer, nil

internal/secret/pgpunlock_test.go

@@ -297,11 +297,6 @@ func TestPGPUnlockerWithRealFS(t *testing.T) {
 	// Create a PGP unlocker for the remaining tests
 	unlocker := secret.NewPGPUnlocker(fs, unlockerDir, metadata)
 
-	// Test getting GPG key ID
-	t.Run("GetGPGKeyID", func(t *testing.T) {
-		testGetGPGKeyID(t, fs, unlocker, unlockerDir, metadata, fingerprint)
-	})
-
 	// Test getting identity from PGP unlocker
 	t.Run("GetIdentity", func(t *testing.T) {
 		testPGPUnlockerGetIdentity(t, fs, unlocker, unlockerDir, keyID)
@@ -330,7 +325,7 @@ func testCreatePGPUnlocker(
 	mnemonic := testMnemonicBuffer(t)
 
 	// Create a test vault directory structure
-	vlt, err := vault.CreateVault(fs, stateDir, vaultName, mnemonic)
+	vlt, err := vault.CreateVault(fs, stateDir, vaultName, mnemonic, nil)
 	if err != nil {
 		t.Fatalf("Failed to create vault: %v", err)
 	}
@@ -396,10 +391,10 @@ func testCreatePGPUnlocker(
 		t.Errorf("Expected PGP unlock key type 'pgp', got '%s'", pgpUnlocker.GetType())
 	}
 
-	// Check if the key ID includes the GPG fingerprint
-	if !strings.Contains(pgpUnlocker.GetID(), fingerprint) {
-		t.Errorf("PGP unlock key ID '%s' does not contain GPG fingerprint '%s'",
-			pgpUnlocker.GetID(), fingerprint)
+	// Check that the ID is the name of the unlocker's directory
+	if pgpUnlocker.GetID() != filepath.Base(pgpUnlocker.GetDirectory()) {
+		t.Errorf("PGP unlock key ID '%s' is not its directory name '%s'",
+			pgpUnlocker.GetID(), filepath.Base(pgpUnlocker.GetDirectory()))
 	}
 
 	checkPGPUnlockerFiles(t, fs, pgpUnlocker.GetDirectory())
@@ -504,51 +499,6 @@ func checkPGPUnlockerMetadata(
 	}
 }
 
-// testGetGPGKeyID writes PGP unlocker metadata holding the GPG fingerprint
-// into unlockerDir and checks that unlocker reads it back.
-func testGetGPGKeyID(
-	t *testing.T, fs afero.Fs, unlocker *secret.PGPUnlocker,
-	unlockerDir string, metadata secret.UnlockerMetadata, fingerprint string,
-) {
-	t.Helper()
-
-	// Create PGP metadata with GPG key ID
-	type PGPUnlockerMetadata struct {
-		secret.UnlockerMetadata
-
-		GPGKeyID string `json:"gpgKeyId"`
-	}
-
-	pgpMetadata := PGPUnlockerMetadata{
-		UnlockerMetadata: metadata,
-		GPGKeyID:         fingerprint,
-	}
-
-	// Write metadata file
-	metadataPath := filepath.Join(unlockerDir, unlockerMetadataFile)
-
-	metadataBytes, err := json.MarshalIndent(pgpMetadata, "", "  ")
-	if err != nil {
-		t.Fatalf("Failed to marshal metadata: %v", err)
-	}
-
-	err = afero.WriteFile(fs, metadataPath, metadataBytes, secret.FilePerms)
-	if err != nil {
-		t.Fatalf("Failed to write metadata: %v", err)
-	}
-
-	// Get GPG key ID
-	retrievedKeyID, err := unlocker.GetGPGKeyID()
-	if err != nil {
-		t.Fatalf("Failed to get GPG key ID: %v", err)
-	}
-
-	// Verify key ID (should be the fingerprint)
-	if retrievedKeyID != fingerprint {
-		t.Errorf("Expected GPG fingerprint '%s', got '%s'", fingerprint, retrievedKeyID)
-	}
-}
-
 // testPGPUnlockerGetIdentity writes an age identity encrypted to the GPG key
 // keyID into unlockerDir and checks that unlocker decrypts it.
 func testPGPUnlockerGetIdentity(

internal/secret/pgpunlocker.go

@@ -155,21 +155,9 @@ func (p *PGPUnlocker) GetDirectory() string {
 	return p.Directory
 }
 
-// GetID implements Unlocker interface - generates ID from GPG key ID.
-// If the metadata has no usable GPG key ID, it warns with the unlocker's
-// directory and returns "pgp-unknown", so listing the other unlockers
-// still works.
+// GetID implements Unlocker interface: the name of the unlocker's directory
 func (p *PGPUnlocker) GetID() string {
-	// Generate ID using GPG key ID: pgp-<keyid>
-	gpgKeyID, err := p.GetGPGKeyID()
-	if err != nil {
-		Warn("PGP unlocker metadata is corrupt or missing its GPG key ID",
-			"directory", p.Directory, "error", err)
-
-		return "pgp-unknown"
-	}
-
-	return "pgp-" + gpgKeyID
+	return filepath.Base(p.Directory)
 }
 
 // Remove implements Unlocker interface - removes the PGP unlocker
@@ -184,30 +172,6 @@ func (p *PGPUnlocker) Remove() error {
 	return nil
 }
 
-// GetGPGKeyID returns the GPG key ID from metadata
-func (p *PGPUnlocker) GetGPGKeyID() (string, error) {
-	// Load the metadata
-	metadataPath := filepath.Join(p.Directory, "unlocker-metadata.json")
-
-	metadataData, err := afero.ReadFile(p.fs, metadataPath)
-	if err != nil {
-		return "", fmt.Errorf("failed to read PGP metadata: %w", err)
-	}
-
-	var pgpMetadata PGPUnlockerMetadata
-
-	err = json.Unmarshal(metadataData, &pgpMetadata)
-	if err != nil {
-		return "", fmt.Errorf("failed to parse PGP metadata: %w", err)
-	}
-
-	if pgpMetadata.GPGKeyID == "" {
-		return "", fmt.Errorf("PGP metadata: %w", errGPGKeyIDEmpty)
-	}
-
-	return pgpMetadata.GPGKeyID, nil
-}
-
 // generatePGPUnlockerName generates a unique name for the PGP unlocker
 // based on hostname and time
 func generatePGPUnlockerName() (string, error) {
@@ -330,7 +294,7 @@ func encryptPGPUnlockerKeys(
 		return nil, nil, fmt.Errorf("failed to get long-term key: %w", err)
 	}
 
-	ltPrivKeyData := memguard.NewBufferFromBytes([]byte(ltIdentity.String()))
+	ltPrivKeyData := IdentityToLockedBuffer(ltIdentity)
 	defer ltPrivKeyData.Destroy()
 
 	encryptedLtPrivKey, err := EncryptToRecipient(
@@ -340,8 +304,7 @@ func encryptPGPUnlockerKeys(
 			"failed to encrypt long-term private key to age unlocker: %w", err)
 	}
 
-	// Use memguard to protect the private key in memory
-	agePrivateKeyBuffer := memguard.NewBufferFromBytes([]byte(ageIdentity.String()))
+	agePrivateKeyBuffer := IdentityToLockedBuffer(ageIdentity)
 	defer agePrivateKeyBuffer.Destroy()
 
 	encryptedAgePrivKey, err := GPGEncryptFunc(agePrivateKeyBuffer, gpgKeyID)

internal/secret/pgpunlocker_test.go

@@ -48,7 +48,7 @@ func TestCreatePGPUnlockerFailureWritesNothing(t *testing.T) {
 	installFakeGPG(t)
 
 	base := afero.NewMemMapFs()
-	vlt, err := vault.CreateVault(base, testVaultStateDir, testVaultName, nil)
+	vlt, err := vault.CreateVault(base, testVaultStateDir, testVaultName, nil, nil)
 	require.NoError(t, err)
 
 	fs := hookFs{Fs: base, before: func(_, path string) error {
@@ -87,7 +87,7 @@ func TestPGPUnlockerAddedTwiceKeepsFirst(t *testing.T) {
 
 	fs := afero.NewMemMapFs()
 	mnemonic := testMnemonicBuffer(t)
-	_, err := vault.CreateVault(fs, testVaultStateDir, testVaultName, mnemonic)
+	_, err := vault.CreateVault(fs, testVaultStateDir, testVaultName, mnemonic, nil)
 	require.NoError(t, err)
 
 	first, err := secret.CreatePGPUnlocker(

internal/secret/secret.go

@@ -1,26 +1,18 @@
 package secret
 
 import (
-	"encoding/json"
 	"errors"
-	"fmt"
 	"log/slog"
 	"path/filepath"
 	"strings"
 	"time"
 
 	"filippo.io/age"
-	"git.eeqj.de/sneak/secret/pkg/agehd"
 	"github.com/awnumar/memguard"
 	"github.com/spf13/afero"
 )
 
 var (
-	// errSecretNotFound carries only the message tail; callers compose
-	// "secret <name> not found" around it so the emitted text is
-	// unchanged.
-	errSecretNotFound             = errors.New("not found")
-	errUnlockerRequired           = errors.New("unlocker required to decrypt secret")
 	errGetEncryptedDataDeprecated = errors.New(
 		"GetEncryptedData is deprecated - use version-specific methods")
 	errGetCurrentVaultNotRegistered = errors.New(
@@ -81,73 +73,6 @@ func NewSecret(vault VaultInterface, name string) *Secret {
 	}
 }
 
-// GetValue retrieves and decrypts the current version's value, with the
-// vault's long-term key derived from mnemonic when it is not nil, else
-// obtained through unlocker
-func (s *Secret) GetValue(
-	unlocker Unlocker, mnemonic *memguard.LockedBuffer,
-) (*memguard.LockedBuffer, error) {
-	DebugWith("Getting secret value",
-		slog.String("secret_name", s.Name),
-		slog.String("vault_name", s.vault.GetName()),
-	)
-
-	// Check if secret exists
-	exists, err := s.Exists()
-	if err != nil {
-		Debug("Failed to check if secret exists during GetValue",
-			"error", err, "secret_name", s.Name)
-
-		return nil, fmt.Errorf("failed to check if secret exists: %w", err)
-	}
-
-	if !exists {
-		Debug("Secret not found during GetValue",
-			"secret_name", s.Name, "vault_name", s.vault.GetName())
-
-		return nil, fmt.Errorf("secret %s %w", s.Name, errSecretNotFound)
-	}
-
-	Debug("Secret exists, getting current version", "secret_name", s.Name)
-
-	// Get current version
-	currentVersion, err := GetCurrentVersion(s.vault.GetFilesystem(), s.Directory)
-	if err != nil {
-		Debug("Failed to get current version", "error", err, "secret_name", s.Name)
-
-		return nil, fmt.Errorf("failed to get current version: %w", err)
-	}
-
-	// Create version object
-	version := NewVersion(s.vault, s.Name, currentVersion)
-
-	if mnemonic != nil {
-		return s.getValueViaMnemonic(version, mnemonic.String())
-	}
-
-	Debug("Using unlocker for vault access", "secret_name", s.Name)
-
-	// Use the provided unlocker to get the vault's long-term private key
-	if unlocker == nil {
-		Debug("No unlocker provided for secret decryption", "secret_name", s.Name)
-
-		return nil, errUnlockerRequired
-	}
-
-	ltIdentity, err := s.getLongTermIdentityFromUnlocker(unlocker)
-	if err != nil {
-		return nil, err
-	}
-
-	DebugWith("Successfully obtained vault's long-term key",
-		slog.String("secret_name", s.Name),
-		slog.String("public_key", ltIdentity.Recipient().String()),
-	)
-
-	// Use the long-term key to decrypt the version
-	return version.GetValue(ltIdentity)
-}
-
 // LoadMetadata is deprecated - metadata is now per-version and encrypted
 func (s *Secret) LoadMetadata() error {
 	Debug("LoadMetadata called but is deprecated in versioned model",
@@ -215,124 +140,6 @@ func (s *Secret) Exists() (bool, error) {
 	return true, nil
 }
 
-// getValueViaMnemonic derives the vault's long-term key from the
-// mnemonic and decrypts the version value with it.
-func (s *Secret) getValueViaMnemonic(
-	version *Version, mnemonic string,
-) (*memguard.LockedBuffer, error) {
-	Debug("Using mnemonic for direct long-term key derivation",
-		"secret_name", s.Name)
-
-	// Get vault directory to read metadata
-	vaultDir, err := s.vault.GetDirectory()
-	if err != nil {
-		Debug("Failed to get vault directory", "error", err, "secret_name", s.Name)
-
-		return nil, fmt.Errorf("failed to get vault directory: %w", err)
-	}
-
-	// Load vault metadata to get the correct derivation index
-	metadataPath := filepath.Join(vaultDir, "vault-metadata.json")
-
-	metadataBytes, err := afero.ReadFile(s.vault.GetFilesystem(), metadataPath)
-	if err != nil {
-		Debug("Failed to read vault metadata", "error", err, "path", metadataPath)
-
-		return nil, fmt.Errorf("failed to read vault metadata: %w", err)
-	}
-
-	var metadata VaultMetadata
-
-	err = json.Unmarshal(metadataBytes, &metadata)
-	if err != nil {
-		Debug("Failed to parse vault metadata", "error", err, "secret_name", s.Name)
-
-		return nil, fmt.Errorf("failed to parse vault metadata: %w", err)
-	}
-
-	DebugWith("Using vault derivation index from metadata",
-		slog.String("secret_name", s.Name),
-		slog.String("vault_name", s.vault.GetName()),
-		slog.Uint64("derivation_index", uint64(metadata.DerivationIndex)),
-	)
-
-	// Use mnemonic with the vault's derivation index from metadata
-	ltIdentity, err := agehd.DeriveIdentity(mnemonic, metadata.DerivationIndex)
-	if err != nil {
-		Debug("Failed to derive long-term key from mnemonic for secret",
-			"error", err, "secret_name", s.Name)
-
-		return nil, fmt.Errorf(
-			"failed to derive long-term key from mnemonic: %w", err)
-	}
-
-	Debug("Successfully derived long-term key from mnemonic", "secret_name", s.Name)
-
-	// Use the long-term key to decrypt the version
-	return version.GetValue(ltIdentity)
-}
-
-// getLongTermIdentityFromUnlocker uses the unlocker to obtain and parse
-// the vault's long-term private key.
-func (s *Secret) getLongTermIdentityFromUnlocker(
-	unlocker Unlocker,
-) (*age.X25519Identity, error) {
-	DebugWith("Getting vault's long-term key using unlocker",
-		slog.String("secret_name", s.Name),
-		slog.String("unlocker_type", unlocker.GetType()),
-		slog.String("unlocker_id", unlocker.GetID()),
-	)
-
-	// Step 1: Use the unlocker to get the vault's long-term private key
-	unlockIdentity, err := unlocker.GetIdentity()
-	if err != nil {
-		Debug("Failed to get unlocker identity",
-			"error", err, "secret_name", s.Name,
-			"unlocker_type", unlocker.GetType())
-
-		return nil, fmt.Errorf("failed to get unlocker identity: %w", err)
-	}
-
-	// Read the encrypted long-term private key from the unlocker directory
-	encryptedLtPrivKeyPath := filepath.Join(unlocker.GetDirectory(), "longterm.age")
-	Debug("Reading encrypted long-term private key", "path", encryptedLtPrivKeyPath)
-
-	encryptedLtPrivKey, err := afero.ReadFile(
-		s.vault.GetFilesystem(), encryptedLtPrivKeyPath)
-	if err != nil {
-		Debug("Failed to read encrypted long-term private key",
-			"error", err, "path", encryptedLtPrivKeyPath)
-
-		return nil, fmt.Errorf(
-			"failed to read encrypted long-term private key: %w", err)
-	}
-
-	// Decrypt the encrypted long-term private key using the unlocker
-	Debug("Decrypting long-term private key using unlocker", "secret_name", s.Name)
-
-	ltPrivKeyBuffer, err := DecryptWithIdentity(encryptedLtPrivKey, unlockIdentity)
-	if err != nil {
-		Debug("Failed to decrypt long-term private key",
-			"error", err, "secret_name", s.Name)
-
-		return nil, fmt.Errorf("failed to decrypt long-term private key: %w", err)
-	}
-	defer ltPrivKeyBuffer.Destroy()
-
-	// Parse the long-term private key
-	Debug("Parsing long-term private key", "secret_name", s.Name)
-
-	ltIdentity, err := age.ParseX25519Identity(ltPrivKeyBuffer.String())
-	if err != nil {
-		Debug("Failed to parse long-term private key",
-			"error", err, "secret_name", s.Name)
-
-		return nil, fmt.Errorf("failed to parse long-term private key: %w", err)
-	}
-
-	return ltIdentity, nil
-}
-
 // GetCurrentVault gets the current vault from the file system
 // This function is a wrapper around the actual implementation in the vault package
 // and exists to break the import cycle.

internal/secret/secret_test.go

@@ -2,7 +2,6 @@
 package secret
 
 import (
-	"encoding/json"
 	"errors"
 	"os"
 	"path/filepath"
@@ -13,7 +12,6 @@ import (
 	"git.eeqj.de/sneak/secret/pkg/agehd"
 	"github.com/awnumar/memguard"
 	"github.com/spf13/afero"
-	"github.com/stretchr/testify/require"
 )
 
 // testMnemonicValue is the standard BIP39 test vector mnemonic.
@@ -321,46 +319,3 @@ func TestPerSecretKeyFunctionality(t *testing.T) {
 		t.Logf("Secret.Exists() works correctly")
 	})
 }
-
-// TestSecretGetValueWithMnemonicUsesVaultDerivationIndex checks that
-// GetValue, given the mnemonic, derives the long-term key at the derivation
-// index in the vault's metadata. At index 0 it could not decrypt the secret,
-// which was encrypted to the key at index 1.
-func TestSecretGetValueWithMnemonicUsesVaultDerivationIndex(t *testing.T) {
-	t.Parallel()
-
-	fs := afero.NewMemMapFs()
-	vaultDir := "/test-config/vaults.d/test-vault"
-
-	mnemonic := memguard.NewBufferFromBytes([]byte(testMnemonicValue))
-	defer mnemonic.Destroy()
-
-	vlt := &MockVault{
-		name:            "test-vault",
-		fs:              fs,
-		directory:       vaultDir,
-		derivationIndex: 1,
-		mnemonic:        mnemonic,
-	}
-
-	metadata, err := json.Marshal(VaultMetadata{DerivationIndex: vlt.derivationIndex})
-	require.NoError(t, err)
-	require.NoError(t, fs.MkdirAll(vaultDir, DirPerms))
-
-	err = afero.WriteFile(
-		fs, filepath.Join(vaultDir, "vault-metadata.json"), metadata, FilePerms)
-	require.NoError(t, err)
-
-	secretName, secretValue := "x", "value"
-
-	err = vlt.AddSecret(secretName,
-		memguard.NewBufferFromBytes([]byte(secretValue)), false)
-	require.NoError(t, err)
-
-	value, err := NewSecret(vlt, secretName).GetValue(nil, mnemonic)
-	require.NoError(t, err)
-
-	defer value.Destroy()
-
-	require.Equal(t, secretValue, value.String())
-}

internal/secret/seunlocker_darwin.go

@@ -4,6 +4,7 @@ package secret
 
 import (
 	"encoding/json"
+	"errors"
 	"fmt"
 	"log/slog"
 	"os"
@@ -129,17 +130,9 @@ func (s *SecureEnclaveUnlocker) GetDirectory() string {
 	return s.Directory
 }
 
-// GetID implements Unlocker interface.
+// GetID implements Unlocker interface: the name of the unlocker's directory.
 func (s *SecureEnclaveUnlocker) GetID() string {
-	hostname, err := os.Hostname()
-	if err != nil {
-		hostname = "unknown"
-	}
-
-	createdAt := s.Metadata.CreatedAt
-	timestamp := createdAt.Format("2006-01-02.15.04")
-
-	return fmt.Sprintf("%s-%s-%s", timestamp, hostname, seUnlockerType)
+	return filepath.Base(s.Directory)
 }
 
 // Remove implements Unlocker interface.
@@ -216,6 +209,8 @@ func generateSEKeyLabel(vaultName string) (string, error) {
 // using ECIES. No intermediate age keypair is used.
 // The long-term key comes from mnemonic when it is not nil, else from the
 // current unlocker, as getLongTermKeyForSE describes.
+// The SE key is created once the long-term key is in hand and the unlocker's
+// path is known, and is deleted again if a later step fails.
 func CreateSecureEnclaveUnlocker(
 	fs afero.Fs,
 	stateDir string,
@@ -237,17 +232,7 @@ func CreateSecureEnclaveUnlocker(
 		return nil, fmt.Errorf("failed to generate SE key label: %w", err)
 	}
 
-	// Step 1: Create P-256 key in the Secure Enclave via sc_auth
-	Debug("Creating Secure Enclave key", "label", seKeyLabel)
-
-	_, seKeyHash, err := macse.CreateKey(seKeyLabel)
-	if err != nil {
-		return nil, fmt.Errorf("failed to create SE key: %w", err)
-	}
-
-	Debug("Created SE key", "label", seKeyLabel, "hash", seKeyHash)
-
-	// Step 2: Get the vault's long-term private key
+	// Step 1: Get the vault's long-term private key
 	ltPrivKeyData, err := getLongTermKeyForSE(fs, vault, mnemonic, passphrase)
 	if err != nil {
 		return nil, fmt.Errorf(
@@ -257,16 +242,7 @@ func CreateSecureEnclaveUnlocker(
 	}
 	defer ltPrivKeyData.Destroy()
 
-	// Step 3: Encrypt the long-term key directly with the SE (ECIES)
-	encryptedLtKey, err := macse.Encrypt(seKeyLabel, ltPrivKeyData.Bytes())
-	if err != nil {
-		return nil, fmt.Errorf(
-			"failed to encrypt long-term key with SE: %w",
-			err,
-		)
-	}
-
-	// Step 4: Prepare the unlocker directory's path and metadata
+	// Step 2: Prepare the unlocker directory's path
 	vaultDir, err := vault.GetDirectory()
 	if err != nil {
 		return nil, fmt.Errorf("failed to get vault directory: %w", err)
@@ -275,6 +251,49 @@ func CreateSecureEnclaveUnlocker(
 	unlockerDirName := "se-" + filepath.Base(seKeyLabel)
 	unlockerDir := filepath.Join(vaultDir, "unlockers.d", unlockerDirName)
 
+	// Step 3: Create P-256 key in the Secure Enclave via sc_auth
+	Debug("Creating Secure Enclave key", "label", seKeyLabel)
+
+	_, seKeyHash, err := macse.CreateKey(seKeyLabel)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create SE key: %w", err)
+	}
+
+	Debug("Created SE key", "label", seKeyLabel, "hash", seKeyHash)
+
+	// Steps 4 and 5: Write the unlocker, or delete the SE key if that fails
+	unlocker, err := writeSEUnlocker(fs, unlockerDir, seKeyLabel, seKeyHash,
+		ltPrivKeyData)
+	if err != nil {
+		deleteErr := macse.DeleteKey(seKeyHash)
+		if deleteErr != nil {
+			err = errors.Join(err, fmt.Errorf(
+				"failed to delete SE key %s: %w", seKeyLabel, deleteErr))
+		}
+
+		return nil, err
+	}
+
+	return unlocker, nil
+}
+
+// writeSEUnlocker encrypts the long-term key with the SE key and writes the
+// new unlocker into unlockerDir (steps 4 and 5 of
+// CreateSecureEnclaveUnlocker).
+func writeSEUnlocker(
+	fs afero.Fs, unlockerDir, seKeyLabel, seKeyHash string,
+	ltPrivKeyData *memguard.LockedBuffer,
+) (*SecureEnclaveUnlocker, error) {
+	// Step 4: Encrypt the long-term key directly with the SE (ECIES), and
+	// prepare the metadata
+	encryptedLtKey, err := macse.Encrypt(seKeyLabel, ltPrivKeyData.Bytes())
+	if err != nil {
+		return nil, fmt.Errorf(
+			"failed to encrypt long-term key with SE: %w",
+			err,
+		)
+	}
+
 	seMetadata := SecureEnclaveUnlockerMetadata{
 		UnlockerMetadata: UnlockerMetadata{
 			Type:      seUnlockerType,

internal/secret/seunlocker_stub.go

@@ -4,6 +4,7 @@ package secret
 
 import (
 	"errors"
+	"path/filepath"
 
 	"filippo.io/age"
 	"github.com/awnumar/memguard"
@@ -67,9 +68,9 @@ func (s *SecureEnclaveUnlocker) GetDirectory() string {
 	return s.Directory
 }
 
-// GetID returns the unlocker ID.
+// GetID returns the unlocker ID, the name of the unlocker's directory.
 func (s *SecureEnclaveUnlocker) GetID() string {
-	return s.Metadata.CreatedAt.Format("2006-01-02.15.04") + "-" + seUnlockerType
+	return filepath.Base(s.Directory)
 }
 
 // Remove returns an error on non-Darwin platforms.

internal/secret/seunlocker_stub_test.go

@@ -35,9 +35,8 @@ func TestNewSecureEnclaveUnlocker(t *testing.T) {
 	// Test GetDirectory returns the directory we passed in
 	assert.Equal(t, dir, unlocker.GetDirectory())
 
-	// Test GetID returns a formatted string with the creation timestamp
-	expectedID := "2026-01-15.10.30-secure-enclave"
-	assert.Equal(t, expectedID, unlocker.GetID())
+	// Test GetID returns the name of the unlocker's directory
+	assert.Equal(t, "test-se-unlocker", unlocker.GetID())
 }
 
 func TestSecureEnclaveUnlockerGetIdentityReturnsError(t *testing.T) {

internal/secret/seunlocker_test.go

@@ -4,6 +4,8 @@
 package secret
 
 import (
+	"os"
+	"path/filepath"
 	"testing"
 	"time"
 
@@ -61,11 +63,9 @@ func TestSecureEnclaveUnlockerGetIDFormat(t *testing.T) {
 	}
 
 	unlocker := NewSecureEnclaveUnlocker(fs, "/tmp/test", metadata)
-	id := unlocker.GetID()
 
-	// ID should contain the timestamp and "secure-enclave" type
-	assert.Contains(t, id, "2026-03-10.14.30")
-	assert.Contains(t, id, seUnlockerType)
+	// The ID is the name of the unlocker's directory
+	assert.Equal(t, "test", unlocker.GetID())
 }
 
 func TestGenerateSEKeyLabel(t *testing.T) {
@@ -108,6 +108,10 @@ func TestSecureEnclaveUnlockerGetIdentityMissingFile(t *testing.T) {
 	// GetIdentity should fail because the encrypted longterm key file is missing
 	identity, err := unlocker.GetIdentity()
 	assert.Nil(t, identity)
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "failed to read SE-encrypted long-term key")
+
+	var cause *os.PathError
+
+	require.ErrorAs(t, err, &cause)
+	require.ErrorIs(t, err, os.ErrNotExist)
+	assert.Equal(t, filepath.Join(dir, seLongtermFilename), cause.Path)
 }

internal/secret/unlocker.go

@@ -10,6 +10,6 @@ type Unlocker interface {
 	GetType() string
 	GetMetadata() UnlockerMetadata
 	GetDirectory() string
-	GetID() string // Generate ID based on unlocker type and data
+	GetID() string // The name of the unlocker's directory, unique in its vault
 	Remove() error // Remove the unlocker and any associated resources
 }

internal/secret/version.go

@@ -175,9 +175,7 @@ func (sv *Version) Save(value *memguard.LockedBuffer) error {
 		return fmt.Errorf("failed to generate version keypair: %w", err)
 	}
 
-	// Store private key in memguard buffer immediately
-	versionPrivateKeyBuffer := memguard.NewBufferFromBytes(
-		[]byte(versionIdentity.String()))
+	versionPrivateKeyBuffer := IdentityToLockedBuffer(versionIdentity)
 	defer versionPrivateKeyBuffer.Destroy()
 
 	DebugWith("Generated version keypair",
@@ -559,13 +557,18 @@ func VersionExists(fs afero.Fs, secretDir string, version string) (bool, error)
 }
 
 // GetCurrentVersion returns the version that the "current" file points to
-// The file contains just the version name (e.g., "20231215.001")
+// The file contains just the version name (e.g., "20231215.001"). If it
+// cannot be read, the error says how to make a version current again: the
+// versions themselves are not in the file.
 func GetCurrentVersion(fs afero.Fs, secretDir string) (string, error) {
 	currentPath := filepath.Join(secretDir, "current")
 
 	fileData, err := afero.ReadFile(fs, currentPath)
 	if err != nil {
-		return "", fmt.Errorf("failed to read current version file: %w", err)
+		return "", fmt.Errorf("failed to read current version file: %w; "+
+			"this file only names the current version: 'secret version list' "+
+			"lists the secret's versions, and 'secret version promote' makes "+
+			"one of them current", err)
 	}
 
 	version := strings.TrimSpace(string(fileData))

internal/secret/version_internal_test.go

@@ -0,0 +1,31 @@
+package secret
+
+import (
+	"fmt"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/spf13/afero"
+	"github.com/stretchr/testify/require"
+)
+
+func TestGenerateVersionNameMaxSerial(t *testing.T) {
+	t.Parallel()
+
+	fs := afero.NewMemMapFs()
+	secretDir := "/test/secret"
+	versionsDir := filepath.Join(secretDir, "versions")
+
+	// Create 999 versions
+	today := time.Now().Format("20060102")
+	for i := 1; i <= 999; i++ {
+		versionName := fmt.Sprintf("%s.%03d", today, i)
+		err := fs.MkdirAll(filepath.Join(versionsDir, versionName), 0o755)
+		require.NoError(t, err)
+	}
+
+	// Try to create one more - should fail
+	_, err := GenerateVersionName(fs, secretDir)
+	require.ErrorIs(t, err, errMaxVersionsPerDay)
+}

internal/secret/version_test.go

@@ -36,7 +36,6 @@ package secret_test
 
 import (
 	"errors"
-	"fmt"
 	"path/filepath"
 	"testing"
 	"time"
@@ -127,27 +126,6 @@ func TestGenerateVersionName(t *testing.T) {
 	assert.NotEqual(t, version1, version2)
 }
 
-func TestGenerateVersionNameMaxSerial(t *testing.T) {
-	t.Parallel()
-
-	fs := afero.NewMemMapFs()
-	secretDir := testSecretDir
-	versionsDir := filepath.Join(secretDir, "versions")
-
-	// Create 999 versions
-	today := time.Now().Format("20060102")
-	for i := 1; i <= 999; i++ {
-		versionName := fmt.Sprintf("%s.%03d", today, i)
-		err := fs.MkdirAll(filepath.Join(versionsDir, versionName), 0o755)
-		require.NoError(t, err)
-	}
-
-	// Try to create one more - should fail
-	_, err := secret.GenerateVersionName(fs, secretDir)
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "exceeded maximum versions per day")
-}
-
 func TestNewVersion(t *testing.T) {
 	t.Parallel()
 

internal/vault/errors.go

@@ -31,6 +31,11 @@ var (
 	// Composed as "vault <name> already exists".
 	ErrVaultExists = errors.New("already exists")
 
+	// ErrUnlockerWithoutMnemonic indicates that CreateVault was given a
+	// passphrase for an unlocker but no mnemonic to derive the long-term key
+	// it unlocks. Composed as "vault <name> needs a mnemonic for an unlocker".
+	ErrUnlockerWithoutMnemonic = errors.New("needs a mnemonic for an unlocker")
+
 	// ErrNilValueBuffer indicates a nil value buffer was supplied.
 	ErrNilValueBuffer = errors.New("value buffer is nil")
 

internal/vault/errors_test.go

@@ -0,0 +1,138 @@
+package vault_test
+
+import (
+	"path/filepath"
+	"testing"
+
+	"git.eeqj.de/sneak/secret/internal/secret"
+	"git.eeqj.de/sneak/secret/internal/vault"
+	"github.com/awnumar/memguard"
+	"github.com/spf13/afero"
+	"github.com/stretchr/testify/require"
+)
+
+const (
+	// otherMnemonic is a valid BIP39 mnemonic other than testMnemonic.
+	otherMnemonic = "legal winner thank year wave sausage worth useful " +
+		"legal winner thank yellow"
+
+	// missingName names no vault, secret or unlocker.
+	missingName = "missing"
+)
+
+// newErrorTestVault creates the vault testVaultName, with the secret
+// testSecretName in it, on a new in-memory filesystem.
+func newErrorTestVault(t *testing.T) *vault.Vault {
+	t.Helper()
+
+	vlt, err := vault.CreateVault(afero.NewMemMapFs(), testStateDir,
+		testVaultName, testMnemonicBuffer(t), nil)
+	require.NoError(t, err)
+
+	value := memguard.NewBufferFromBytes([]byte("value"))
+	t.Cleanup(value.Destroy)
+
+	require.NoError(t, vlt.AddSecret(testSecretName, value, false))
+
+	return vlt
+}
+
+// TestVaultErrors checks that each failure returns its exported error,
+// wrapped or not, so that errors.Is tells it apart from the others.
+func TestVaultErrors(t *testing.T) {
+	t.Parallel()
+
+	vaultDir := filepath.Join(testStateDir, "vaults.d", testVaultName)
+
+	tests := []struct {
+		name string
+		run  func(vlt *vault.Vault) error
+		want error
+	}{
+		{"create an existing vault", func(vlt *vault.Vault) error {
+			_, err := vault.CreateVault(vlt.GetFilesystem(), testStateDir,
+				testVaultName, nil, nil)
+
+			return err
+		}, vault.ErrVaultExists},
+		{"select a missing vault", func(vlt *vault.Vault) error {
+			return vault.SelectVault(vlt.GetFilesystem(), testStateDir, missingName)
+		}, vault.ErrVaultNotFound},
+		{"add a nil value", func(vlt *vault.Vault) error {
+			return vlt.AddSecret(missingName, nil, false)
+		}, vault.ErrNilValueBuffer},
+		{"get a missing secret", func(vlt *vault.Vault) error {
+			_, err := vlt.GetSecret(missingName)
+
+			return err
+		}, vault.ErrSecretNotFound},
+		{"copy onto an existing secret", func(vlt *vault.Vault) error {
+			return vlt.CopySecretAllVersions(vlt, testSecretName, testSecretName, false)
+		}, vault.ErrSecretExists},
+		{"copy a secret without versions", func(vlt *vault.Vault) error {
+			const versionless = "versionless"
+
+			err := vlt.GetFilesystem().MkdirAll(
+				filepath.Join(vaultDir, "secrets.d", versionless), secret.DirPerms)
+			if err != nil {
+				return err
+			}
+
+			return vlt.CopySecretAllVersions(vlt, versionless, "copy", false)
+		}, vault.ErrNoVersions},
+		{"remove a missing unlocker", func(vlt *vault.Vault) error {
+			return vlt.RemoveUnlocker(missingName)
+		}, vault.ErrUnlockerNotFound},
+		{"select a missing unlocker", func(vlt *vault.Vault) error {
+			return vlt.SelectUnlocker(missingName)
+		}, vault.ErrUnlockerNotFound},
+		{"unlocker of an unknown type", func(vlt *vault.Vault) error {
+			fs := vlt.GetFilesystem()
+
+			err := afero.WriteFile(fs,
+				filepath.Join(vaultDir, "unlockers.d", "odd", "unlocker-metadata.json"),
+				[]byte(`{"type":"odd"}`), secret.FilePerms)
+			if err != nil {
+				return err
+			}
+
+			err = afero.WriteFile(fs, filepath.Join(vaultDir, "current-unlocker"),
+				[]byte("odd"), secret.FilePerms)
+			if err != nil {
+				return err
+			}
+
+			_, err = vlt.GetCurrentUnlocker()
+
+			return err
+		}, vault.ErrUnsupportedUnlockerType},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			require.ErrorIs(t, tt.run(newErrorTestVault(t)), tt.want)
+		})
+	}
+}
+
+// TestGetSecretWithWrongMnemonic checks that getting a secret that exists,
+// from a vault the given mnemonic does not open, fails with
+// ErrMnemonicMismatch through GetSecret's wrapping, and not with
+// ErrSecretNotFound.
+func TestGetSecretWithWrongMnemonic(t *testing.T) {
+	t.Parallel()
+
+	created := newErrorTestVault(t)
+
+	mnemonic := memguard.NewBufferFromBytes([]byte(otherMnemonic))
+	t.Cleanup(mnemonic.Destroy)
+
+	vlt := vault.NewVault(created.GetFilesystem(), testStateDir, testVaultName)
+	vlt.SetMnemonic(mnemonic)
+
+	_, err := vlt.GetSecret(testSecretName)
+	require.ErrorIs(t, err, vault.ErrMnemonicMismatch)
+	require.NotErrorIs(t, err, vault.ErrSecretNotFound)
+}

internal/vault/integration_test.go

@@ -2,6 +2,7 @@ package vault_test
 
 import (
 	"bytes"
+	"errors"
 	"os"
 	"path/filepath"
 	"slices"
@@ -99,7 +100,7 @@ func testCurrentVaultFileHandling(t *testing.T, fs afero.Fs, tempDir string) {
 
 	// Create a test vault
 	vlt, err := vault.CreateVault(fs, stateDir, testVaultName,
-		testMnemonicBuffer(t))
+		testMnemonicBuffer(t), nil)
 	if err != nil {
 		t.Fatalf("Failed to create vault: %v", err)
 	}
@@ -147,7 +148,7 @@ func testDeepPathSecrets(t *testing.T, fs afero.Fs, tempDir string) {
 	// Create a test vault - CreateVault writes the public key derived from
 	// the mnemonic
 	vlt, err := vault.CreateVault(fs, stateDir, testVaultName,
-		testMnemonicBuffer(t))
+		testMnemonicBuffer(t), nil)
 	if err != nil {
 		t.Fatalf("Failed to create vault: %v", err)
 	}
@@ -223,7 +224,7 @@ func testKeyCaching(t *testing.T, fs afero.Fs, tempDir string) {
 	// Create a test vault - CreateVault writes the public key derived from
 	// the mnemonic
 	vlt, err := vault.CreateVault(fs, stateDir, testVaultName,
-		testMnemonicBuffer(t))
+		testMnemonicBuffer(t), nil)
 	if err != nil {
 		t.Fatalf("Failed to create vault: %v", err)
 	}
@@ -324,7 +325,7 @@ func testVaultNameValidation(t *testing.T, fs afero.Fs, tempDir string) {
 	}
 
 	for _, name := range validNames {
-		_, err := vault.CreateVault(fs, stateDir, name, testMnemonicBuffer(t))
+		_, err := vault.CreateVault(fs, stateDir, name, testMnemonicBuffer(t), nil)
 		if err != nil {
 			t.Errorf("Failed to create vault with valid name %q: %v", name, err)
 		}
@@ -340,10 +341,10 @@ func testVaultNameValidation(t *testing.T, fs afero.Fs, tempDir string) {
 	}
 
 	for _, name := range invalidNames {
-		_, err := vault.CreateVault(fs, stateDir, name, testMnemonicBuffer(t))
-		if err == nil {
-			t.Errorf("Expected error creating vault with invalid name %q, "+
-				"but got none", name)
+		_, err := vault.CreateVault(fs, stateDir, name, testMnemonicBuffer(t), nil)
+		if !errors.Is(err, vault.ErrInvalidVaultName) {
+			t.Errorf("Expected ErrInvalidVaultName creating vault with "+
+				"invalid name %q, got %v", name, err)
 		}
 	}
 }
@@ -361,7 +362,7 @@ func testMultipleVaults(t *testing.T, fs afero.Fs, tempDir string) {
 	// Create three vaults
 	vaultNames := []string{"vault1", "vault2", "vault3"}
 	for _, name := range vaultNames {
-		_, err := vault.CreateVault(fs, stateDir, name, testMnemonicBuffer(t))
+		_, err := vault.CreateVault(fs, stateDir, name, testMnemonicBuffer(t), nil)
 		if err != nil {
 			t.Fatalf("Failed to create vault %s: %v", name, err)
 		}
@@ -411,12 +412,12 @@ func testVaultIsolation(t *testing.T, fs afero.Fs, tempDir string) {
 
 	// Create two vaults - CreateVault writes the public key derived from
 	// the mnemonic
-	vault1, err := vault.CreateVault(fs, stateDir, "vault1", testMnemonicBuffer(t))
+	vault1, err := vault.CreateVault(fs, stateDir, "vault1", testMnemonicBuffer(t), nil)
 	if err != nil {
 		t.Fatalf("Failed to create vault1: %v", err)
 	}
 
-	vault2, err := vault.CreateVault(fs, stateDir, "vault2", testMnemonicBuffer(t))
+	vault2, err := vault.CreateVault(fs, stateDir, "vault2", testMnemonicBuffer(t), nil)
 	if err != nil {
 		t.Fatalf("Failed to create vault2: %v", err)
 	}

internal/vault/integration_version_test.go

@@ -49,7 +49,7 @@ func TestVersionIntegrationWorkflow(t *testing.T) {
 	fs := afero.NewMemMapFs()
 
 	// Create vault without a long-term key, which is set up below
-	vault, err := CreateVault(fs, testStateDir, "test", nil)
+	vault, err := CreateVault(fs, testStateDir, "test", nil, nil)
 	require.NoError(t, err)
 
 	// Derive and store long-term key from mnemonic
@@ -320,10 +320,10 @@ func testVersionSerialLimits(
 	err = fs.MkdirAll(filepath.Join(secretDir, versionName), 0o755)
 	require.NoError(t, err)
 
-	// Should fail to create 1000th version
+	// Should fail to create 1000th version. The error is unexported in
+	// package secret, whose own test checks that it is the one returned.
 	_, err = secret.GenerateVersionName(fs, filepath.Dir(secretDir))
 	require.Error(t, err)
-	assert.Contains(t, err.Error(), "exceeded maximum versions per day")
 }
 
 func testVersionErrorCases(t *testing.T, vault *Vault, secretName string) {
@@ -331,20 +331,18 @@ func testVersionErrorCases(t *testing.T, vault *Vault, secretName string) {
 
 	// Try to get non-existent version
 	_, err := vault.GetSecretVersion(secretName, "99991231.999")
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "not found")
+	require.ErrorIs(t, err, ErrVersionNotFound)
 
 	// Try to get version of non-existent secret
 	_, err = vault.GetSecretVersion("nonexistent/secret", "")
-	require.Error(t, err)
+	require.ErrorIs(t, err, ErrSecretNotFound)
 
 	// Try to add secret without force when it exists
 	failBuffer := memguard.NewBufferFromBytes([]byte("should-fail"))
 	defer failBuffer.Destroy()
 
 	err = vault.AddSecret(secretName, failBuffer, false)
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "already exists")
+	require.ErrorIs(t, err, ErrSecretExists)
 }
 
 // TestVersionConcurrency tests concurrent version operations

internal/vault/lock.go

@@ -1,6 +1,7 @@
 package vault
 
 import (
+	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -14,6 +15,11 @@ import (
 // lockFileName is the file in the state directory that LockStateDir locks.
 const lockFileName = "lock"
 
+// finishedMark is what the lock file holds once the command that last held
+// the lock has released it. A command killed while holding it leaves the
+// file empty.
+const finishedMark = "finished\n"
+
 // memFsLock stands in for the lock file on the in-memory filesystem, which
 // has no file locks. Every in-memory filesystem in the process shares it.
 //
@@ -25,6 +31,12 @@ var memFsLock sync.Mutex
 // it. While one command holds it, the next one waits here. Reads take no
 // lock: each file or directory a command changes is replaced in a single
 // rename, so a reader finds it as it was before or after, never half-made.
+// Once it holds the lock, it empties the lock file, and the function it
+// returns writes finishedMark there just before releasing the lock, so a
+// command killed while holding the lock leaves the mark missing. Finding it
+// missing, LockStateDir first deletes the temporary files and directories
+// such a command may have left, since no command still using them can be
+// running. After a command that finished, it searches nothing.
 //
 // On the real filesystem the lock is flock(2) on the file "lock" in
 // stateDir, which the kernel releases when the process dies, so a killed
@@ -32,16 +44,97 @@ var memFsLock sync.Mutex
 // use has no file locks, so a process-wide mutex stands in for flock there.
 // Any other filesystem is refused rather than left unlocked.
 func LockStateDir(fs afero.Fs, stateDir string) (func(), error) {
+	var release func()
+
 	switch fs.(type) {
 	case *afero.OsFs:
-		return flockStateDir(stateDir)
+		var err error
+
+		release, err = flockStateDir(stateDir)
+		if err != nil {
+			return nil, err
+		}
 	case *afero.MemMapFs:
 		memFsLock.Lock()
 
-		return memFsLock.Unlock, nil
+		release = memFsLock.Unlock
 	default:
 		return nil, fmt.Errorf("%w %T", ErrNoLockForFilesystem, fs)
 	}
+
+	// The lock file is written in place, never replaced: a command waiting
+	// for flock on the old file would then take a lock nobody else checks.
+	lockPath := filepath.Join(stateDir, lockFileName)
+
+	mark, err := afero.ReadFile(fs, lockPath)
+	if err != nil || string(mark) != finishedMark {
+		removeLeftovers(fs, stateDir)
+	}
+
+	err = afero.WriteFile(fs, lockPath, nil, secret.FilePerms)
+	if err != nil {
+		release()
+
+		return nil, fmt.Errorf("failed to empty lock file %s: %w", lockPath, err)
+	}
+
+	return func() {
+		// If this fails, the next command searches when it need not.
+		_ = afero.WriteFile(fs, lockPath, []byte(finishedMark), secret.FilePerms)
+
+		release()
+	}, nil
+}
+
+// removeLeftovers deletes the temporary files and directories that commands
+// killed part-way left in each directory where secret.WriteFileAtomic and
+// secret.TempDirFor make them: the state directory, each vault, each secret
+// and each version. Unlocker directories are written whole by
+// secret.WriteDir and never changed after, so they hold none. A failure is
+// only warned about, and the command goes on.
+func removeLeftovers(fs afero.Fs, stateDir string) {
+	dirs := []string{stateDir}
+
+	for _, vaultDir := range subdirs(fs, filepath.Join(stateDir, "vaults.d")) {
+		dirs = append(dirs, vaultDir)
+
+		for _, secretDir := range subdirs(fs, filepath.Join(vaultDir, "secrets.d")) {
+			dirs = append(dirs, secretDir)
+			dirs = append(dirs, subdirs(fs, filepath.Join(secretDir, "versions"))...)
+		}
+	}
+
+	for _, dir := range dirs {
+		err := secret.RemoveLeftovers(fs, dir)
+		if err != nil {
+			secret.Warn("Failed to remove what an interrupted command left",
+				"error", err)
+		}
+	}
+}
+
+// subdirs returns the directories in dir: none if dir does not exist, and
+// none, with a warning, if it cannot be read.
+func subdirs(fs afero.Fs, dir string) []string {
+	entries, err := afero.ReadDir(fs, dir)
+	if err != nil {
+		if !errors.Is(err, os.ErrNotExist) {
+			secret.Warn("Failed to look for what an interrupted command left",
+				"directory", dir, "error", err)
+		}
+
+		return nil
+	}
+
+	var dirs []string
+
+	for _, entry := range entries {
+		if entry.IsDir() {
+			dirs = append(dirs, filepath.Join(dir, entry.Name()))
+		}
+	}
+
+	return dirs
 }
 
 // flockStateDir takes flock(2) on the lock file in stateDir, creating the

internal/vault/lock_test.go

@@ -1,9 +1,11 @@
 package vault_test
 
 import (
+	"path/filepath"
 	"testing"
 	"time"
 
+	"git.eeqj.de/sneak/secret/internal/secret"
 	"git.eeqj.de/sneak/secret/internal/vault"
 	"github.com/spf13/afero"
 	"github.com/stretchr/testify/assert"
@@ -121,6 +123,51 @@ func TestLockStateDirFreeAfterPanic(t *testing.T) {
 	}
 }
 
+// TestLockStateDirRemovesLeftoversOnlyAfterKill checks that taking the lock
+// deletes a temporary directory a killed command left only when the last
+// holder of the lock did not release it. A holder killed while it holds the
+// lock leaves the lock file as it is at that moment.
+func TestLockStateDirRemovesLeftoversOnlyAfterKill(t *testing.T) {
+	t.Parallel()
+
+	for _, lfs := range lockFilesystems(t) {
+		t.Run(lfs.name, func(t *testing.T) {
+			t.Parallel()
+
+			lockFile := filepath.Join(lfs.stateDir, "lock")
+			leftover := filepath.Join(lfs.stateDir, ".tmp-1")
+
+			release, err := vault.LockStateDir(lfs.fs, lfs.stateDir)
+			require.NoError(t, err)
+
+			whileHeld, err := afero.ReadFile(lfs.fs, lockFile)
+			require.NoError(t, err)
+			release()
+
+			require.NoError(t, lfs.fs.MkdirAll(leftover, secret.DirPerms))
+
+			release, err = vault.LockStateDir(lfs.fs, lfs.stateDir)
+			require.NoError(t, err)
+			release()
+
+			exists, err := afero.DirExists(lfs.fs, leftover)
+			require.NoError(t, err)
+			assert.True(t, exists, "searched after a holder that finished")
+
+			require.NoError(t, afero.WriteFile(lfs.fs, lockFile, whileHeld,
+				secret.FilePerms))
+
+			release, err = vault.LockStateDir(lfs.fs, lfs.stateDir)
+			require.NoError(t, err)
+			release()
+
+			exists, err = afero.DirExists(lfs.fs, leftover)
+			require.NoError(t, err)
+			assert.False(t, exists, "not searched after a holder that was killed")
+		})
+	}
+}
+
 // TestLockStateDirRefusesOtherFilesystems checks that a filesystem with no
 // lock implementation is refused instead of being used unlocked.
 func TestLockStateDirRefusesOtherFilesystems(t *testing.T) {

internal/vault/management.go

@@ -8,6 +8,7 @@ import (
 	"strings"
 	"time"
 
+	"filippo.io/age"
 	"git.eeqj.de/sneak/secret/internal/secret"
 	"git.eeqj.de/sneak/secret/pkg/agehd"
 	"github.com/awnumar/memguard"
@@ -152,16 +153,17 @@ func ListVaults(fs afero.Fs, stateDir string) ([]string, error) {
 }
 
 // processMnemonicForVault handles mnemonic processing for vault creation.
-// It returns the derivation index, public key hash, and family hash.
+// It returns the long-term key, nil when there is no mnemonic, and the
+// derivation index, public key hash, and family hash.
 func processMnemonicForVault(
 	fs afero.Fs, stateDir, vaultDir, vaultName string,
 	mnemonicBuffer *memguard.LockedBuffer,
-) (uint32, string, string, error) {
+) (*age.X25519Identity, uint32, string, string, error) {
 	if mnemonicBuffer == nil {
 		secret.Debug("No mnemonic given, vault created without long-term key",
 			"vault", vaultName)
 		// Use 0 for derivation index when no mnemonic is provided
-		return 0, "", "", nil
+		return nil, 0, "", "", nil
 	}
 
 	mnemonic := mnemonicBuffer.String()
@@ -171,13 +173,14 @@ func processMnemonicForVault(
 	// Get the next available derivation index for this mnemonic
 	derivationIndex, err := GetNextDerivationIndex(fs, stateDir, mnemonic)
 	if err != nil {
-		return 0, "", "", fmt.Errorf("failed to get next derivation index: %w", err)
+		return nil, 0, "", "",
+			fmt.Errorf("failed to get next derivation index: %w", err)
 	}
 
 	// Derive the long-term key using the actual derivation index
 	ltIdentity, err := agehd.DeriveIdentity(mnemonic, derivationIndex)
 	if err != nil {
-		return 0, "", "", fmt.Errorf("failed to derive long-term key: %w", err)
+		return nil, 0, "", "", fmt.Errorf("failed to derive long-term key: %w", err)
 	}
 
 	// Write the public key
@@ -187,7 +190,8 @@ func processMnemonicForVault(
 
 	err = secret.WriteFileAtomic(fs, ltPubKeyPath, []byte(ltPubKey))
 	if err != nil {
-		return 0, "", "", fmt.Errorf("failed to write long-term public key: %w", err)
+		return nil, 0, "", "",
+			fmt.Errorf("failed to write long-term public key: %w", err)
 	}
 
 	secret.Debug("Wrote long-term public key", "path", ltPubKeyPath)
@@ -199,24 +203,33 @@ func processMnemonicForVault(
 	// This is used to identify which vaults belong to the same mnemonic family
 	identity0, err := agehd.DeriveIdentity(mnemonic, 0)
 	if err != nil {
-		return 0, "", "", fmt.Errorf("failed to derive identity for index 0: %w", err)
+		return nil, 0, "", "",
+			fmt.Errorf("failed to derive identity for index 0: %w", err)
 	}
 
 	familyHash := ComputeDoubleSHA256([]byte(identity0.Recipient().String()))
 
-	return derivationIndex, publicKeyHash, familyHash, nil
+	return ltIdentity, derivationIndex, publicKeyHash, familyHash, nil
 }
 
 // CreateVault creates a new vault and selects it as the current vault. When
 // mnemonic is not nil, the vault's long-term key is derived from it, and the
 // returned vault has it as its Mnemonic; when it is nil, the vault has no
-// long-term key until one is imported. It refuses a vault that already
-// exists before writing anything: creating it again would replace its keys,
-// and its secrets could no longer be decrypted. The commands that call it
-// hold the state directory lock, so no other command can create the vault
-// between the check and the writes.
+// long-term key until one is imported. When passphrase is not nil, the vault
+// gets a passphrase unlocker protected by it, as its current unlocker; that
+// needs a mnemonic. It refuses a vault that already exists before writing
+// anything: creating it again would replace its keys, and its secrets could
+// no longer be decrypted. The commands that call it hold the state directory
+// lock, so no other command can create the vault between the check and the
+// writes.
+//
+// The vault is written whole into a temporary directory, which is renamed
+// into vaults.d only once complete, and only then selected: a crash at any
+// point leaves either no vault or a complete one. The next command that
+// takes the lock deletes what the crash left under a temporary name.
 func CreateVault(
-	fs afero.Fs, stateDir string, name string, mnemonic *memguard.LockedBuffer,
+	fs afero.Fs, stateDir string, name string,
+	mnemonic, passphrase *memguard.LockedBuffer,
 ) (*Vault, error) {
 	secret.Debug("Creating new vault", "name", name, "state_dir", stateDir)
 
@@ -240,51 +253,19 @@ func CreateVault(
 		return nil, fmt.Errorf("vault %s %w", name, ErrVaultExists)
 	}
 
-	// Create vault directory structure
+	if passphrase != nil && mnemonic == nil {
+		return nil, fmt.Errorf("vault %s %w", name, ErrUnlockerWithoutMnemonic)
+	}
+
 	secret.Debug("Creating vault directory structure", "vault_dir", vaultDir)
 
-	// Create main vault directory
-	err = fs.MkdirAll(vaultDir, secret.DirPerms)
-	if err != nil {
-		return nil, fmt.Errorf("failed to create vault directory: %w", err)
-	}
-
-	// Create secrets directory
-	secretsDir := filepath.Join(vaultDir, "secrets.d")
-
-	err = fs.MkdirAll(secretsDir, secret.DirPerms)
-	if err != nil {
-		return nil, fmt.Errorf("failed to create secrets directory: %w", err)
-	}
-
-	// Create unlockers directory
-	unlockersDir := filepath.Join(vaultDir, "unlockers.d")
-
-	err = fs.MkdirAll(unlockersDir, secret.DirPerms)
-	if err != nil {
-		return nil, fmt.Errorf("failed to create unlockers directory: %w", err)
-	}
-
-	// Process mnemonic if available
-	derivationIndex, publicKeyHash, familyHash, err := processMnemonicForVault(
-		fs, stateDir, vaultDir, name, mnemonic)
+	err = secret.WriteDir(fs, vaultDir, func(dir string) error {
+		return writeVaultFiles(fs, stateDir, dir, name, mnemonic, passphrase)
+	})
 	if err != nil {
 		return nil, err
 	}
 
-	// Save vault metadata
-	metadata := &Metadata{
-		CreatedAt:          time.Now(),
-		DerivationIndex:    derivationIndex,
-		PublicKeyHash:      publicKeyHash,
-		MnemonicFamilyHash: familyHash,
-	}
-
-	err = SaveVaultMetadata(fs, vaultDir, metadata)
-	if err != nil {
-		return nil, fmt.Errorf("failed to save vault metadata: %w", err)
-	}
-
 	// Select the newly created vault as current
 	secret.Debug("Selecting newly created vault as current", "name", name)
 
@@ -302,6 +283,47 @@ func CreateVault(
 	return vlt, nil
 }
 
+// writeVaultFiles writes the files of the new vault name into vaultDir: its
+// secrets and unlockers directories, its long-term public key and metadata,
+// and, when passphrase is not nil, a passphrase unlocker as its current one.
+func writeVaultFiles(
+	fs afero.Fs, stateDir, vaultDir, name string,
+	mnemonic, passphrase *memguard.LockedBuffer,
+) error {
+	for _, subdir := range []string{"secrets.d", "unlockers.d"} {
+		err := fs.MkdirAll(filepath.Join(vaultDir, subdir), secret.DirPerms)
+		if err != nil {
+			return fmt.Errorf("failed to create %s directory: %w", subdir, err)
+		}
+	}
+
+	ltIdentity, derivationIndex, publicKeyHash, familyHash, err :=
+		processMnemonicForVault(fs, stateDir, vaultDir, name, mnemonic)
+	if err != nil {
+		return err
+	}
+
+	metadata := &Metadata{
+		CreatedAt:          time.Now(),
+		DerivationIndex:    derivationIndex,
+		PublicKeyHash:      publicKeyHash,
+		MnemonicFamilyHash: familyHash,
+	}
+
+	err = SaveVaultMetadata(fs, vaultDir, metadata)
+	if err != nil {
+		return fmt.Errorf("failed to save vault metadata: %w", err)
+	}
+
+	if passphrase == nil {
+		return nil
+	}
+
+	_, err = writePassphraseUnlocker(fs, vaultDir, ltIdentity, passphrase)
+
+	return err
+}
+
 // SelectVault selects the given vault as the current vault
 func SelectVault(fs afero.Fs, stateDir string, name string) error {
 	secret.Debug("Selecting vault", "vault_name", name, "state_dir", stateDir)

internal/vault/metadata_test.go

@@ -304,7 +304,7 @@ func TestWorkflowMismatch(t *testing.T) {
 	fs := afero.NewOsFs()
 
 	// Test Case 1: Create vault WITH mnemonic (like init command)
-	_, err := vault.CreateVault(fs, tempDir, "default", testMnemonicBuffer(t))
+	_, err := vault.CreateVault(fs, tempDir, "default", testMnemonicBuffer(t), nil)
 	if err != nil {
 		t.Fatalf("Failed to create vault with mnemonic: %v", err)
 	}
@@ -321,7 +321,7 @@ func TestWorkflowMismatch(t *testing.T) {
 		metadata1.DerivationIndex, metadata1.PublicKeyHash)
 
 	// Test Case 2: Create vault WITHOUT mnemonic, then import (work vault)
-	_, err = vault.CreateVault(fs, tempDir, "work", nil)
+	_, err = vault.CreateVault(fs, tempDir, "work", nil, nil)
 	if err != nil {
 		t.Fatalf("Failed to create vault without mnemonic: %v", err)
 	}

internal/vault/path_traversal_test.go

@@ -18,7 +18,7 @@ func TestGetSecretVersionRejectsPathTraversal(t *testing.T) {
 	fs := afero.NewMemMapFs()
 
 	vlt, err := vault.CreateVault(fs, testStateDir, testVaultName,
-		testMnemonicBuffer(t))
+		testMnemonicBuffer(t), nil)
 	require.NoError(t, err)
 
 	// Add a legitimate secret so the vault is set up
@@ -41,10 +41,8 @@ func TestGetSecretVersionRejectsPathTraversal(t *testing.T) {
 			t.Parallel()
 
 			_, err := vlt.GetSecretVersion(name, "")
-			require.Error(t, err,
+			require.ErrorIs(t, err, vault.ErrInvalidSecretName,
 				"GetSecretVersion should reject malicious name: %s", name)
-			require.Contains(t, err.Error(), "invalid secret name",
-				"error should indicate invalid name for: %s", name)
 		})
 	}
 }
@@ -57,12 +55,11 @@ func TestGetSecretRejectsPathTraversal(t *testing.T) {
 	fs := afero.NewMemMapFs()
 
 	vlt, err := vault.CreateVault(fs, testStateDir, testVaultName,
-		testMnemonicBuffer(t))
+		testMnemonicBuffer(t), nil)
 	require.NoError(t, err)
 
 	_, err = vlt.GetSecret("../../../etc/passwd")
-	require.Error(t, err)
-	require.Contains(t, err.Error(), "invalid secret name")
+	require.ErrorIs(t, err, vault.ErrInvalidSecretName)
 }
 
 // TestGetSecretObjectRejectsPathTraversal verifies GetSecretObject
@@ -73,7 +70,7 @@ func TestGetSecretObjectRejectsPathTraversal(t *testing.T) {
 	fs := afero.NewMemMapFs()
 
 	vlt, err := vault.CreateVault(fs, testStateDir, testVaultName,
-		testMnemonicBuffer(t))
+		testMnemonicBuffer(t), nil)
 	require.NoError(t, err)
 
 	maliciousNames := []string{
@@ -87,8 +84,8 @@ func TestGetSecretObjectRejectsPathTraversal(t *testing.T) {
 			t.Parallel()
 
 			_, err := vlt.GetSecretObject(name)
-			require.Error(t, err, "GetSecretObject should reject: %s", name)
-			require.Contains(t, err.Error(), "invalid secret name")
+			require.ErrorIs(t, err, vault.ErrInvalidSecretName,
+				"GetSecretObject should reject: %s", name)
 		})
 	}
 }

internal/vault/secrets_version_test.go

@@ -66,7 +66,7 @@ func createTestVaultWithKey(t *testing.T, fs afero.Fs) *Vault {
 	t.Helper()
 
 	// Create vault without a long-term key, which is set up below
-	vault, err := CreateVault(fs, testStateDir, "test", nil)
+	vault, err := CreateVault(fs, testStateDir, "test", nil, nil)
 	require.NoError(t, err)
 
 	// Derive and store long-term key from mnemonic
@@ -143,8 +143,7 @@ func TestVaultAddSecretMultipleVersions(t *testing.T) {
 	defer failBuffer.Destroy()
 
 	err := vault.AddSecret(testSecretPath, failBuffer, false)
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "already exists")
+	require.ErrorIs(t, err, ErrSecretExists)
 
 	// Add with force - should create new version
 	addTestSecretToVault(t, vault, testSecretPath, []byte("version-2"), true)
@@ -309,8 +308,7 @@ func TestVaultGetNonExistentVersion(t *testing.T) {
 
 	// Try to get non-existent version
 	_, err := vault.GetSecretVersion(testSecretPath, "20991231.999")
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "not found")
+	require.ErrorIs(t, err, ErrVersionNotFound)
 }
 
 func TestUpdateVersionMetadata(t *testing.T) {

internal/vault/unlockers.go

@@ -188,8 +188,9 @@ func (v *Vault) findUnlockerByID(
 	return nil, skippedDirPath, nil
 }
 
-// ListUnlockers returns a list of available unlockers for this vault
-func (v *Vault) ListUnlockers() ([]UnlockerMetadata, error) {
+// ListUnlockers returns the metadata of each unlocker of this vault, keyed
+// by the unlocker's ID, the name of its directory in unlockers.d
+func (v *Vault) ListUnlockers() (map[string]UnlockerMetadata, error) {
 	vaultDir, err := v.GetDirectory()
 	if err != nil {
 		return nil, err
@@ -204,7 +205,7 @@ func (v *Vault) ListUnlockers() ([]UnlockerMetadata, error) {
 	}
 
 	if !exists {
-		return []UnlockerMetadata{}, nil
+		return map[string]UnlockerMetadata{}, nil
 	}
 
 	// List directories in unlockers.d
@@ -213,7 +214,7 @@ func (v *Vault) ListUnlockers() ([]UnlockerMetadata, error) {
 		return nil, fmt.Errorf("failed to read unlockers directory: %w", err)
 	}
 
-	var unlockers []UnlockerMetadata
+	unlockers := map[string]UnlockerMetadata{}
 
 	for _, file := range files {
 		if !file.IsDir() {
@@ -222,7 +223,7 @@ func (v *Vault) ListUnlockers() ([]UnlockerMetadata, error) {
 
 		metadata, ok := v.readUnlockerMetadataOrWarn(unlockersDir, file.Name())
 		if ok {
-			unlockers = append(unlockers, metadata)
+			unlockers[file.Name()] = metadata
 		}
 	}
 
@@ -274,6 +275,24 @@ func (v *Vault) readUnlockerMetadataOrWarn(
 	return metadata, true
 }
 
+// HasUnlocker reports whether RemoveUnlocker finds something to remove by
+// the ID unlockerID: an unlocker with that ID, or an unlocker directory of
+// that name that ListUnlockers skips.
+func (v *Vault) HasUnlocker(unlockerID string) (bool, error) {
+	vaultDir, err := v.GetDirectory()
+	if err != nil {
+		return false, err
+	}
+
+	_, unlockerDir, err := v.findUnlockerByID(
+		filepath.Join(vaultDir, "unlockers.d"), unlockerID)
+	if err != nil {
+		return false, err
+	}
+
+	return unlockerDir != "", nil
+}
+
 // RemoveUnlocker removes an unlocker from this vault. An unlocker
 // directory that ListUnlockers skips is removed by its directory name; its
 // type is unknown, so only the directory is removed.
@@ -372,8 +391,31 @@ func (v *Vault) CreatePassphraseUnlocker(
 		return nil, err
 	}
 
+	unlocker, err := writePassphraseUnlocker(v.fs, vaultDir, ltIdentity, passphrase)
+	if err != nil {
+		return nil, err
+	}
+
+	for _, oldDir := range oldDirs {
+		err = secret.RemoveDirAtomic(v.fs, oldDir)
+		if err != nil {
+			return nil, fmt.Errorf(
+				"created and selected the new passphrase unlocker: %w", err)
+		}
+	}
+
+	return unlocker, nil
+}
+
+// writePassphraseUnlocker writes a new passphrase unlocker of the long-term
+// key ltIdentity into the vault directory vaultDir, in a directory of its own,
+// and makes it the vault's current unlocker.
+func writePassphraseUnlocker(
+	fs afero.Fs, vaultDir string, ltIdentity *age.X25519Identity,
+	passphrase *memguard.LockedBuffer,
+) (*secret.PassphraseUnlocker, error) {
 	createdAt := time.Now()
-	unlockerDir := filepath.Join(unlockersDir, unlockerTypePassphrase+"-"+
+	unlockerDir := filepath.Join(vaultDir, "unlockers.d", unlockerTypePassphrase+"-"+
 		createdAt.UTC().Format(secret.UnlockerTimeFormat))
 
 	// Generate new age keypair for unlocker
@@ -383,7 +425,7 @@ func (v *Vault) CreatePassphraseUnlocker(
 	}
 
 	// Encrypt long-term private key to this unlocker
-	ltPrivKeyBuffer := memguard.NewBufferFromBytes([]byte(ltIdentity.String()))
+	ltPrivKeyBuffer := secret.IdentityToLockedBuffer(ltIdentity)
 	defer ltPrivKeyBuffer.Destroy()
 
 	encryptedLtPrivKey, err := secret.EncryptToRecipient(ltPrivKeyBuffer,
@@ -404,33 +446,24 @@ func (v *Vault) CreatePassphraseUnlocker(
 	}
 
 	// Write the unlocker's files, the metadata last
-	err = secret.WriteDir(v.fs, unlockerDir, func(dir string) error {
-		return v.writeUnlockerFiles(dir, unlockerIdentity, passphrase,
+	err = secret.WriteDir(fs, unlockerDir, func(dir string) error {
+		return writeUnlockerFiles(fs, dir, unlockerIdentity, passphrase,
 			encryptedLtPrivKey, metadataBytes)
 	})
 	if err != nil {
 		return nil, err
 	}
 
-	// Select the new unlocker by its directory, not by its ID: an old
-	// passphrase unlocker created in the same minute has the same ID.
+	// Make the new unlocker the current one
 	currentUnlockerPath := filepath.Join(vaultDir, "current-unlocker")
 
-	err = secret.WriteFileAtomic(v.fs, currentUnlockerPath,
+	err = secret.WriteFileAtomic(fs, currentUnlockerPath,
 		[]byte(filepath.Base(unlockerDir)))
 	if err != nil {
 		return nil, fmt.Errorf("failed to select new unlocker: %w", err)
 	}
 
-	for _, oldDir := range oldDirs {
-		err = secret.RemoveDirAtomic(v.fs, oldDir)
-		if err != nil {
-			return nil, fmt.Errorf(
-				"created and selected the new passphrase unlocker: %w", err)
-		}
-	}
-
-	return secret.NewPassphraseUnlocker(v.fs, unlockerDir, metadata), nil
+	return secret.NewPassphraseUnlocker(fs, unlockerDir, metadata), nil
 }
 
 // passphraseUnlockerDirs returns the directories in unlockersDir that hold
@@ -496,7 +529,8 @@ func (v *Vault) readUnlockerMetadata(unlockerDir string) (UnlockerMetadata, erro
 // writeUnlockerFiles writes the files of a passphrase unlocker into
 // unlockerDir: its public key, its passphrase-encrypted private key, the
 // long-term private key encrypted to it, and its metadata, last.
-func (v *Vault) writeUnlockerFiles(
+func writeUnlockerFiles(
+	fs afero.Fs,
 	unlockerDir string,
 	unlockerIdentity *age.X25519Identity,
 	passphrase *memguard.LockedBuffer,
@@ -505,16 +539,14 @@ func (v *Vault) writeUnlockerFiles(
 	// Write public key
 	pubKeyPath := filepath.Join(unlockerDir, "pub.age")
 
-	err := secret.WriteFileAtomic(v.fs, pubKeyPath,
+	err := secret.WriteFileAtomic(fs, pubKeyPath,
 		[]byte(unlockerIdentity.Recipient().String()))
 	if err != nil {
 		return fmt.Errorf("failed to write unlocker public key: %w", err)
 	}
 
 	// Encrypt private key with passphrase
-	privKeyStr := unlockerIdentity.String()
-
-	privKeyBuffer := memguard.NewBufferFromBytes([]byte(privKeyStr))
+	privKeyBuffer := secret.IdentityToLockedBuffer(unlockerIdentity)
 	defer privKeyBuffer.Destroy()
 
 	encryptedPrivKey, err := secret.EncryptWithPassphrase(privKeyBuffer, passphrase)
@@ -525,18 +557,18 @@ func (v *Vault) writeUnlockerFiles(
 	// Write encrypted private key
 	privKeyPath := filepath.Join(unlockerDir, "priv.age")
 
-	err = secret.WriteFileAtomic(v.fs, privKeyPath, encryptedPrivKey)
+	err = secret.WriteFileAtomic(fs, privKeyPath, encryptedPrivKey)
 	if err != nil {
 		return fmt.Errorf("failed to write encrypted unlocker private key: %w", err)
 	}
 
-	err = secret.WriteFileAtomic(v.fs,
+	err = secret.WriteFileAtomic(fs,
 		filepath.Join(unlockerDir, "longterm.age"), encryptedLtPrivKey)
 	if err != nil {
 		return fmt.Errorf("failed to write encrypted long-term private key: %w", err)
 	}
 
-	err = secret.WriteFileAtomic(v.fs,
+	err = secret.WriteFileAtomic(fs,
 		filepath.Join(unlockerDir, "unlocker-metadata.json"), metadataBytes)
 	if err != nil {
 		return fmt.Errorf("failed to write unlocker metadata: %w", err)

internal/vault/vault.go

@@ -1,6 +1,7 @@
 package vault
 
 import (
+	"errors"
 	"fmt"
 	"log/slog"
 	"path/filepath"
@@ -98,7 +99,8 @@ func (v *Vault) GetOrDeriveLongTermKey() (*age.X25519Identity, error) {
 	if err != nil {
 		secret.Debug("Failed to get current unlocker", "error", err, "vault_name", v.Name)
 
-		return nil, fmt.Errorf("failed to get current unlocker: %w", err)
+		return nil, v.withMnemonicAdvice(
+			fmt.Errorf("failed to get current unlocker: %w", err))
 	}
 
 	secret.DebugWith("Retrieved current unlocker for vault unlock",
@@ -112,7 +114,7 @@ func (v *Vault) GetOrDeriveLongTermKey() (*age.X25519Identity, error) {
 	// Other unlockers return their own identity, used to decrypt longterm.age.
 	ltIdentity, err := v.unlockLongTermKey(unlocker)
 	if err != nil {
-		return nil, err
+		return nil, v.withMnemonicAdvice(err)
 	}
 
 	secret.DebugWith("Successfully obtained long-term identity via unlocker",
@@ -295,3 +297,36 @@ func (v *Vault) unlockLongTermKey(
 
 	return ltIdentity, nil
 }
+
+// withMnemonicAdvice returns err, a failure to get the long-term key through
+// the current unlocker, with advice added: that the mnemonic still opens the
+// vault, and how to give it a new unlocker. The advice is added only when the
+// vault metadata records the key that the mnemonic derives; a vault created
+// without a mnemonic records none, and without its metadata the key cannot
+// be derived. It is not added when the passphrase could not be read: the
+// unlocker was not tried, and adding one would need a passphrase read the
+// same way.
+func (v *Vault) withMnemonicAdvice(err error) error {
+	if errors.Is(err, secret.ErrPassphraseNotRead) {
+		return err
+	}
+
+	vaultDir, _ := v.GetDirectory()
+
+	metadata, metadataErr := LoadVaultMetadata(v.fs, vaultDir)
+	if metadataErr != nil || metadata.PublicKeyHash == "" {
+		return err
+	}
+
+	// 'secret unlocker add' acts on the current vault only.
+	steps := "'secret unlocker add passphrase'"
+
+	current, currentErr := GetCurrentVault(v.fs, v.stateDir)
+	if currentErr != nil || current.Name != v.Name {
+		steps = fmt.Sprintf("'secret vault select %s', then %s", v.Name, steps)
+	}
+
+	return fmt.Errorf("%w; the vault '%s' still opens with its mnemonic: run "+
+		"%s with %s set to the mnemonic to give it a new unlocker",
+		err, v.Name, steps, secret.EnvMnemonic)
+}

internal/vault/vault_error_test.go

@@ -1,6 +1,7 @@
 package vault_test
 
 import (
+	"os"
 	"path/filepath"
 	"testing"
 
@@ -36,8 +37,13 @@ func TestAddSecretFailsWithMissingPublicKey(t *testing.T) {
 	defer value.Destroy()
 
 	err := vlt.AddSecret(testSecretName, value, false)
-	require.Error(t, err, "AddSecret should fail when public key is missing")
-	assert.Contains(t, err.Error(), "failed to read long-term public key")
+
+	var cause *os.PathError
+
+	require.ErrorAs(t, err, &cause)
+	require.ErrorIs(t, err, os.ErrNotExist,
+		"AddSecret should fail when public key is missing")
+	assert.Equal(t, filepath.Join(vaultDir, "pub.age"), cause.Path)
 
 	// Verify that the secret directory was NOT created
 	secretDir := filepath.Join(vaultDir, "secrets.d", testSecretName)

internal/vault/vault_test.go

@@ -2,6 +2,7 @@ package vault_test
 
 import (
 	"bytes"
+	"errors"
 	"path/filepath"
 	"slices"
 	"testing"
@@ -72,7 +73,7 @@ func testCreateVault(t *testing.T, fs afero.Fs) {
 	t.Helper()
 
 	vlt, err := vault.CreateVault(fs, testStateDir, testVaultName,
-		testMnemonicBuffer(t))
+		testMnemonicBuffer(t), nil)
 	if err != nil {
 		t.Fatalf("Failed to create vault: %v", err)
 	}
@@ -298,7 +299,7 @@ func TestListUnlockers_SkipsMissingMetadata(t *testing.T) {
 
 	// Create vault
 	vlt, err := vault.CreateVault(fs, testStateDir, testVaultName,
-		testMnemonicBuffer(t))
+		testMnemonicBuffer(t), nil)
 	if err != nil {
 		t.Fatalf("Failed to create vault: %v", err)
 	}
@@ -344,3 +345,29 @@ func TestListUnlockers_SkipsMissingMetadata(t *testing.T) {
 		}
 	}
 }
+
+// TestCreateVaultUnlockerNeedsMnemonic checks that CreateVault, given a
+// passphrase for an unlocker but no mnemonic to derive the long-term key from,
+// fails without writing anything.
+func TestCreateVaultUnlockerNeedsMnemonic(t *testing.T) {
+	t.Parallel()
+
+	fs := afero.NewMemMapFs()
+
+	passphrase := memguard.NewBufferFromBytes([]byte(testPassphrase))
+	defer passphrase.Destroy()
+
+	_, err := vault.CreateVault(fs, testStateDir, testVaultName, nil, passphrase)
+	if !errors.Is(err, vault.ErrUnlockerWithoutMnemonic) {
+		t.Fatalf("Expected ErrUnlockerWithoutMnemonic, got %v", err)
+	}
+
+	exists, err := afero.Exists(fs, testStateDir)
+	if err != nil {
+		t.Fatalf("Failed to check for the state directory: %v", err)
+	}
+
+	if exists {
+		t.Errorf("CreateVault wrote the state directory")
+	}
+}

pkg/agehd/agehd_test.go

@@ -38,7 +38,6 @@ const (
 	testMessageLargePattern  = "A"
 
 	// Error messages for validation
-	errorMsgNeed32Bytes = "need 32-byte scalar, got"
 	errorMsgInvalidXPRV = "invalid-xprv"
 
 	// Test constants for various scenarios
@@ -330,24 +329,17 @@ func TestClampFunction(t *testing.T) {
 	}
 }
 
-// requireIdentityError asserts that identity derivation failed with an
-// error containing errorMsg and returned no identity.
+// requireIdentityError asserts that identity derivation failed with
+// errInvalidScalarSize and returned no identity.
 func requireIdentityError(
 	t *testing.T,
 	identity *age.X25519Identity,
 	err error,
-	errorMsg string,
 ) {
 	t.Helper()
 
-	if err == nil {
-		t.Errorf("expected error but got none")
-	} else if !strings.Contains(err.Error(), errorMsg) {
-		t.Errorf(
-			"expected error containing %q, got %q",
-			errorMsg,
-			err.Error(),
-		)
+	if !errors.Is(err, errInvalidScalarSize) {
+		t.Errorf("expected errInvalidScalarSize, got %v", err)
 	}
 
 	if identity != nil {
@@ -363,31 +355,26 @@ func TestIdentityFromEntropyEdgeCases(t *testing.T) {
 		name        string
 		entropy     []byte
 		expectError bool
-		errorMsg    string
 	}{
 		{
 			name:        "nil entropy",
 			entropy:     nil,
 			expectError: true,
-			errorMsg:    errorMsgNeed32Bytes + " 0",
 		},
 		{
 			name:        "empty entropy",
 			entropy:     []byte{},
 			expectError: true,
-			errorMsg:    errorMsgNeed32Bytes + " 0",
 		},
 		{
 			name:        "too short entropy",
 			entropy:     make([]byte, 31),
 			expectError: true,
-			errorMsg:    errorMsgNeed32Bytes + " 31",
 		},
 		{
 			name:        "too long entropy",
 			entropy:     make([]byte, 33),
 			expectError: true,
-			errorMsg:    errorMsgNeed32Bytes + " 33",
 		},
 		{
 			name:        "valid 32-byte entropy",
@@ -419,7 +406,7 @@ func TestIdentityFromEntropyEdgeCases(t *testing.T) {
 			identity, err := IdentityFromEntropy(tt.entropy)
 
 			if tt.expectError {
-				requireIdentityError(t, identity, err, tt.errorMsg)
+				requireIdentityError(t, identity, err)
 
 				return
 			}

pkg/bip85/bip85_test.go

@@ -4,6 +4,7 @@ package bip85_test
 import (
 	"bytes"
 	"encoding/hex"
+	"errors"
 	"fmt"
 	"strings"
 	"testing"
@@ -1013,14 +1014,13 @@ func TestHexDerivation(t *testing.T) {
 func TestInvalidParameters(t *testing.T) {
 	t.Parallel()
 
-	logTestVector(t, "Invalid Parameters")
-
 	masterKey := mustParseTestMasterKey(t)
 
 	// Test cases for parameter validation
 	testCases := []struct {
 		name     string
 		testFunc func() error
+		want     error
 	}{
 		{
 			name: "BIP39 invalid word count",
@@ -1030,6 +1030,7 @@ func TestInvalidParameters(t *testing.T) {
 
 				return err
 			},
+			want: bip85.ErrInvalidWordCount,
 		},
 		{
 			name: "Base64 password too short",
@@ -1039,6 +1040,7 @@ func TestInvalidParameters(t *testing.T) {
 
 				return err
 			},
+			want: bip85.ErrInvalidBase64PwdLen,
 		},
 		{
 			name: "Base64 password too long",
@@ -1048,6 +1050,7 @@ func TestInvalidParameters(t *testing.T) {
 
 				return err
 			},
+			want: bip85.ErrInvalidBase64PwdLen,
 		},
 		{
 			name: "Base85 password too short",
@@ -1057,6 +1060,7 @@ func TestInvalidParameters(t *testing.T) {
 
 				return err
 			},
+			want: bip85.ErrInvalidBase85PwdLen,
 		},
 		{
 			name: "Base85 password too long",
@@ -1066,6 +1070,7 @@ func TestInvalidParameters(t *testing.T) {
 
 				return err
 			},
+			want: bip85.ErrInvalidBase85PwdLen,
 		},
 		{
 			name: "Hex data too small",
@@ -1075,6 +1080,7 @@ func TestInvalidParameters(t *testing.T) {
 
 				return err
 			},
+			want: bip85.ErrInvalidNumBytes,
 		},
 		{
 			name: "Hex data too large",
@@ -1084,23 +1090,43 @@ func TestInvalidParameters(t *testing.T) {
 
 				return err
 			},
+			want: bip85.ErrInvalidNumBytes,
 		},
 	}
 
 	// Run all validation test cases
 	for _, tc := range testCases {
-		t.Logf("Testing: %s", tc.name)
-
 		err := tc.testFunc()
-		if err == nil {
-			t.Errorf("Expected error for %s, but got nil", tc.name)
-		} else {
-			t.Logf("Got expected error: %v", err)
-			t.Logf("RESULT: PASS")
+		if !errors.Is(err, tc.want) {
+			t.Errorf("Expected %v for %s, got %v", tc.want, tc.name, err)
 		}
 	}
 }
 
+// TestDeriveBIP85EntropyErrors checks that DeriveBIP85Entropy returns
+// ErrNotPrivateKey for a public master key, and ErrInvalidPathComponent,
+// wrapped, for a path component that is not a number.
+func TestDeriveBIP85EntropyErrors(t *testing.T) {
+	t.Parallel()
+
+	masterKey := mustParseTestMasterKey(t)
+
+	publicKey, err := masterKey.Neuter()
+	if err != nil {
+		t.Fatalf("Failed to get the public key of the master key: %v", err)
+	}
+
+	_, err = bip85.DeriveBIP85Entropy(publicKey, testCase1Path)
+	if !errors.Is(err, bip85.ErrNotPrivateKey) {
+		t.Errorf("Expected ErrNotPrivateKey, got %v", err)
+	}
+
+	_, err = bip85.DeriveBIP85Entropy(masterKey, bip85.BIP85_MASTER_PATH+"/x'")
+	if !errors.Is(err, bip85.ErrInvalidPathComponent) {
+		t.Errorf("Expected ErrInvalidPathComponent, got %v", err)
+	}
+}
+
 // TestAdditionalDeriveHex tests additional hex derivation scenarios
 func TestAdditionalDeriveHex(t *testing.T) {
 	t.Parallel()