Commands fail when currentvault names no vault (closes #156)

An empty currentvault, or one naming a vault that does not exist, made
`secret list` report an empty vault with exit 0 and `secret add` fail on a
missing directory. ResolveVaultSymlink now refuses an empty or invalid
name, or one with no directory under vaults.d, with an error that wraps
ErrVaultNotFound, names the file and says to run
`secret vault select <name>`. Every command that uses the current vault
gets it; `secret vault list` and `secret info` still run.

newSizeTestVault wrote a full path into currentvault, which resolved only
because the last path element was taken as the name; it now relies on
CreateVault selecting the vault.

Model: opus-5-5

README.md

@@ -67,10 +67,6 @@ and unlocker set. This allows for complete isolation between different contexts
 
 ## Commands Reference
 
-Every time `secret` prints, in a table or in `--json` output, is in UTC,
-whatever `TZ` or the system's time zone is set to. The date in a version's name
-is the UTC date too.
-
 ### Confirmation Before Removal
 
 `secret rm`, `secret version rm`, `secret vault remove` and

internal/cli/list_times_test.go

@@ -3,9 +3,6 @@ package cli_test
 import (
 	"bytes"
 	"encoding/json"
-	"os"
-	"os/exec"
-	"path/filepath"
 	"testing"
 	"time"
 
@@ -128,57 +125,6 @@ func TestMovedSecretKeepsItsTimes(t *testing.T) {
 		"updated %s, then %s", beforeMove.UpdatedAt, afterMove.UpdatedAt)
 }
 
-// TestListedTimesAreUTC is a regression test for
-// https://git.eeqj.de/sneak/secret/issues/169, where times were printed
-// in the local time zone. It runs `secret list` on the built binary with
-// TZ set to New York, where the secret's last update, 03:04:05 UTC on 2
-// January, is 22:04:05 the day before.
-func TestListedTimesAreUTC(t *testing.T) {
-	t.Parallel()
-
-	stateDir := t.TempDir()
-
-	vlt, err := vault.CreateVault(
-		afero.NewOsFs(), stateDir, "default", testMnemonicBuffer(t), nil)
-	require.NoError(t, err)
-
-	vlt.Mnemonic = testMnemonicBuffer(t)
-	err = vlt.AddSecret("x", memguard.NewBufferFromBytes([]byte("one")), false)
-	require.NoError(t, err)
-
-	updated := time.Date(2026, time.January, 2, 3, 4, 5, 0, time.UTC)
-	current := filepath.Join(stateDir, "vaults.d", "default", "secrets.d", "x",
-		"current")
-	require.NoError(t, os.Chtimes(current, updated, updated))
-
-	tests := []struct {
-		flags []string
-		want  string
-	}{
-		{flags: nil, want: "2026-01-02 03:04"},
-		{
-			flags: []string{"--json"},
-			want:  `"updated_at": "2026-01-02T03:04:05Z"`,
-		},
-	}
-
-	for _, tt := range tests {
-		args := append([]string{"list"}, tt.flags...)
-
-		//nolint:gosec // G204: test executes the freshly built secret binary
-		cmd := exec.CommandContext(t.Context(), secretBinaryPath(t), args...)
-		cmd.Env = []string{
-			secret.EnvStateDir + "=" + stateDir,
-			"TZ=America/New_York",
-			"PATH=" + os.Getenv("PATH"),
-		}
-
-		output, err := cmd.CombinedOutput()
-		require.NoError(t, err, "%v: %s", args, output)
-		assert.Contains(t, string(output), tt.want, "%v", args)
-	}
-}
-
 // listSecrets returns the output of `secret list`, or of
 // `secret list --json` when jsonOutput is set.
 func listSecrets(t *testing.T, c *cli.Instance, jsonOutput bool) string {

internal/cli/root.go

@@ -2,7 +2,6 @@ package cli
 
 import (
 	"os"
-	"time"
 
 	"github.com/awnumar/memguard"
 	"github.com/spf13/cobra"
@@ -15,10 +14,6 @@ import (
 // every memguard buffer before it returns, so the caller must do nothing
 // but exit with the code.
 func Entry() int {
-	// Every time secret prints or writes is in UTC, whatever TZ or the
-	// system's time zone is set to.
-	time.Local = time.UTC //nolint:gosmopolitan // this makes local time UTC
-
 	raiseLockedMemoryLimit()
 
 	// On SIGINT or SIGTERM memguard runs this function, wipes every buffer