Hold the encrypt and decrypt result in memory until it is written (closes #143 )

With --output, secret encrypt and secret decrypt emptied that file before reading any input, so a failed command left it empty, and encrypting a file onto itself gave the encryption of nothing. With --output they now hold the result in memory and open --output, with the same call as before, only once encryption or decryption has succeeded. A failed command leaves --output untouched, and --input can be the same file. Without --output the result still goes to stdout as it is produced. Model: opus-5-5
Refuse an existing vault before asking for the mnemonic (closes #151 )
2026-10-15 00:01:14 +00:00 · 2026-10-15 01:32:23 +02:00 · 2026-10-15 01:32:14 +02:00
16 changed files with 775 additions and 89 deletions
@@ -90,7 +90,8 @@ remove things pass `--force`.
 #### `secret init`

 Initializes the secret manager with a default vault. Prompts for a BIP39
-mnemonic phrase and creates the initial directory structure.
+mnemonic phrase and creates the initial directory structure. When the vault
+`default` already exists, it fails before asking for the mnemonic or passphrase.

 **Environment Variables:**

@@ -105,7 +106,8 @@ Lists all available vaults. The current vault is marked.

 #### `secret vault create <name>`

-Creates a new vault with the specified name.
+Creates a new vault with the specified name. When a vault of that name already
+exists, it fails before asking for the mnemonic or passphrase.

 **Vault Name Format:** only lowercase ASCII letters, digits, `.`, `-` and `_`
 are allowed, and a name must not be empty, `.` or `..`.
@@ -142,7 +144,13 @@ contain `//`, or have `..` as a path segment.

 #### `secret get <secret-name> [--version <version>]`

-Retrieves and outputs a secret value to stdout.
+Retrieves and outputs a secret value to stdout. A failed write of the value,
+such as to a file on a full disk, prints the error and exits 1, with two
+exceptions. If the program reading from a pipe has already exited, as in
+`secret get s | true`, the broken-pipe signal (SIGPIPE) ends `secret` with no
+message and the shell reports exit status 141. If the shell closed stdout before
+`secret` started (`secret get s >&-`), the value is written to `/dev/null` and
+`secret get` exits 0.

 - `--version, -v`: Get a specific version (default: current)

@@ -277,6 +285,10 @@ Selects an unlocker as the current default for operations.
 Imports a secret from a file and stores it in the current vault under the given
 name.

+#### `secret vault import [vault-name]`
+
+Imports a mnemonic phrase into the specified vault (defaults to "default").
+
 ### Encryption Operations

 #### `secret encrypt <secret-name> [--input=file] [--output=file]`
@@ -288,6 +300,9 @@ generates a new Age key.

 Decrypts data using an Age key stored as a secret.

+With `--output`, both hold the result in memory and write it to `--output` only
+once they have succeeded, so a failed command leaves `--output` untouched.
+
 ## Storage Architecture

 ### Directory Structure
@@ -382,7 +397,9 @@ line or in a CI job, they end up in shell history and CI logs. `secret` unsets
 each one as soon as it has read it, so that the programs it runs itself, such as
 `gpg`, do not inherit it, but that erases nothing: the environment the process
 started with, and its memory, still hold the value. The interactive prompt,
-which every command offers when the variable is not set, is the safer default.
+which every command except `secret vault import` offers when the variable is not
+set, is the safer default; `secret vault import` has no prompt and needs both
+variables.

 The prompt asks on the terminal the command runs in, not on stdin, so it also
 asks when stdin is a pipe, as in `echo value | secret add name --force` or
@@ -141,30 +141,6 @@ func TestVaultCreationLeavesNoSecretInEnvironment(t *testing.T) {
 	run("vault", "create", "work")
 }

-// TestNoVaultImportCommand is a regression test for
-// https://git.eeqj.de/sneak/secret/issues/139: `secret vault import`
-// refused every vault that `secret vault create` makes, because each has a
-// long-term key. The command is gone, so cobra answers it with the help of
-// `secret vault`, as it does any subcommand of `secret vault` it does not
-// know.
-func TestNoVaultImportCommand(t *testing.T) {
-	t.Setenv(secret.EnvStateDir, t.TempDir())
-
-	run := func(args ...string) string {
-		t.Setenv(secret.EnvMnemonic, testMnemonic)
-		t.Setenv(secret.EnvUnlockPassphrase, testPassphrase)
-
-		output, err := cli.ExecuteCommandInProcess(args, "", nil)
-		require.NoError(t, err, "%v", args)
-
-		return output
-	}
-
-	run("vault", "create", "work")
-
-	require.Equal(t, run("vault"), run("vault", "import", "work"))
-}
-
 // TestStopAtPassphrasePromptLeavesNothing is a regression test for the
 // review of https://git.eeqj.de/sneak/secret/pulls/82: `secret init` or
 // `secret vault create` stopped at the passphrase prompt left a vault with
@@ -246,12 +222,51 @@ func TestMnemonicNotReadNamesOnlyMnemonic(t *testing.T) {
 	output, err := cmd.CombinedOutput()
 	require.Error(t, err)

-	require.Equal(t, "Initialized secrets manager at: "+stateDir+"\n"+
-		"Error: failed to read mnemonic: there is no terminal to ask on. "+
-		"Please set the SB_SECRET_MNEMONIC environment variable or run "+
+	require.Equal(t, "Error: failed to read mnemonic: there is no terminal to "+
+		"ask on. Please set the SB_SECRET_MNEMONIC environment variable or run "+
 		"interactively\n", string(output))
 }

+// TestCreateExistingVaultAsksForNothing is a regression test for
+// https://git.eeqj.de/sneak/secret/issues/151: `secret init` and `secret
+// vault create` asked for the mnemonic and the unlocker passphrase before
+// refusing a vault that already exists, and `secret init` printed
+// "Initialized secrets manager at" first. Each runs here as the built binary,
+// in a new session, which has no terminal, and with neither
+// SB_SECRET_MNEMONIC nor SB_UNLOCK_PASSPHRASE set, so asking for either
+// fails. Each must fail saying only that the vault exists.
+func TestCreateExistingVaultAsksForNothing(t *testing.T) {
+	t.Parallel()
+
+	stateDir := t.TempDir()
+	_, err := vault.CreateVault(afero.NewOsFs(), stateDir, "default", nil, nil)
+	require.NoError(t, err)
+
+	// run runs the built binary with args, which must fail, and returns what
+	// it printed
+	run := func(args ...string) string {
+		//nolint:gosec // G204: test executes the freshly built secret binary
+		cmd := exec.CommandContext(t.Context(), secretBinaryPath(t), args...)
+		cmd.Env = []string{
+			secret.EnvStateDir + "=" + stateDir,
+			"PATH=" + os.Getenv("PATH"),
+			"HOME=" + os.Getenv("HOME"),
+		}
+		cmd.SysProcAttr = &syscall.SysProcAttr{Setsid: true}
+
+		output, err := cmd.CombinedOutput()
+		require.Error(t, err, "secret %v", args)
+
+		return string(output)
+	}
+
+	require.Equal(t,
+		"Error: failed to create default vault: vault default already exists\n",
+		run("init"))
+	require.Equal(t, "Error: vault default already exists\n",
+		run("vault", "create", "default"))
+}
+
 // TestStopDuringCreateLeavesWholeVaultOrNone is a regression test for
 // https://git.eeqj.de/sneak/secret/issues/105: `secret init` or `secret vault
 // create` killed after the passphrase prompt but before the unlocker was
@@ -1,6 +1,7 @@
 package cli

 import (
+	"bytes"
 	"errors"
 	"fmt"
 	"io"
@@ -188,17 +189,15 @@ func (cli *Instance) Encrypt(secretName, inputFile, outputFile string) error {
 		input = file
 	}

-	// Set up output writer
+	// Set up output writer. With --output the result is held in memory
+	// and written only once encryption has succeeded, so a failure leaves
+	// --output untouched and --input can be the same file.
 	output := cli.cmd.OutOrStdout()

-	if outputFile != "" {
-		file, err := cli.fs.Create(outputFile)
-		if err != nil {
-			return fmt.Errorf("failed to create output file: %w", err)
-		}
-		defer func() { _ = file.Close() }()
+	var result bytes.Buffer

-		output = file
+	if outputFile != "" {
+		output = &result
 	}

 	// Encrypt the data
@@ -217,7 +216,11 @@ func (cli *Instance) Encrypt(secretName, inputFile, outputFile string) error {
 		return fmt.Errorf("failed to finalize encryption: %w", err)
 	}

-	return nil
+	if outputFile == "" {
+		return nil
+	}
+
+	return cli.writeOutputFile(outputFile, result.Bytes())
 }

 // Decrypt decrypts data using an age secret key stored in a secret
@@ -278,17 +281,15 @@ func (cli *Instance) Decrypt(secretName, inputFile, outputFile string) error {
 		input = file
 	}

-	// Set up output writer
+	// Set up output writer. With --output the result is held in memory
+	// and written only once decryption has succeeded, so a failure leaves
+	// --output untouched and --input can be the same file.
 	output := cli.cmd.OutOrStdout()

-	if outputFile != "" {
-		file, err := cli.fs.Create(outputFile)
-		if err != nil {
-			return fmt.Errorf("failed to create output file: %w", err)
-		}
-		defer func() { _ = file.Close() }()
+	var result bytes.Buffer

-		output = file
+	if outputFile != "" {
+		output = &result
 	}

 	// Decrypt the data
@@ -302,6 +303,27 @@ func (cli *Instance) Decrypt(secretName, inputFile, outputFile string) error {
 		return fmt.Errorf("failed to decrypt data: %w", err)
 	}

+	if outputFile == "" {
+		return nil
+	}
+
+	return cli.writeOutputFile(outputFile, result.Bytes())
+}
+
+// writeOutputFile creates outputFile, or empties it if it exists, and
+// writes result into it.
+func (cli *Instance) writeOutputFile(outputFile string, result []byte) error {
+	file, err := cli.fs.Create(outputFile)
+	if err != nil {
+		return fmt.Errorf("failed to create output file: %w", err)
+	}
+	defer func() { _ = file.Close() }()
+
+	_, err = file.Write(result)
+	if err != nil {
+		return fmt.Errorf("failed to write output file: %w", err)
+	}
+
 	return nil
 }

@@ -0,0 +1,134 @@
+//nolint:testpackage // sets the unexported fields of Instance
+package cli
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/spf13/afero"
+	"github.com/spf13/cobra"
+	"github.com/stretchr/testify/require"
+	"sneak.berlin/go/secret/internal/vault"
+)
+
+// plainText is the content of plain.txt in the directory newCryptoTest makes.
+const plainText = "document"
+
+// newCryptoTest returns an Instance whose current vault, in a new state
+// directory on the real filesystem, holds the age key secret "key", and a
+// new directory holding only plain.txt and plain.txt.age, its encryption
+// with that key.
+func newCryptoTest(t *testing.T) (*Instance, string) {
+	t.Helper()
+
+	fs := afero.NewOsFs()
+	stateDir := t.TempDir()
+
+	_, err := vault.CreateVault(fs, stateDir, "default", testMnemonicBuffer(t), nil)
+	require.NoError(t, err)
+
+	cli := NewCLIInstanceWithStateDir(fs, stateDir)
+	cli.Mnemonic = testMnemonicBuffer(t)
+	cli.cmd = &cobra.Command{}
+
+	dir := t.TempDir()
+	plain := filepath.Join(dir, "plain.txt")
+	require.NoError(t, afero.WriteFile(fs, plain, []byte(plainText), 0o600))
+	require.NoError(t, cli.Encrypt("key", plain, plain+".age"))
+
+	return cli, dir
+}
+
+// TestFailedCryptoLeavesOutputUnchanged is a regression test for
+// https://git.eeqj.de/sneak/secret/issues/143, where secret encrypt and
+// secret decrypt emptied the file named by --output before they failed.
+// A failed command must leave an existing file as it was and create none,
+// and give the same error as without --output.
+func TestFailedCryptoLeavesOutputUnchanged(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name string
+		run  func(cli *Instance, dir, output string) error
+	}{
+		// Reading a directory fails once encryption has begun
+		{"encrypt", func(cli *Instance, dir, output string) error {
+			return cli.Encrypt("key", dir, output)
+		}},
+		// plain.txt is not an age file
+		{"decrypt", func(cli *Instance, dir, output string) error {
+			return cli.Decrypt("key", filepath.Join(dir, "plain.txt"), output)
+		}},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			cli, dir := newCryptoTest(t)
+			existing := filepath.Join(dir, "existing.txt")
+			require.NoError(t, afero.WriteFile(cli.fs, existing, []byte("precious"), 0o600))
+
+			cli.cmd.SetOut(io.Discard)
+			toStdout := tt.run(cli, dir, "")
+			require.Error(t, toStdout)
+
+			require.EqualError(t, tt.run(cli, dir, existing), toStdout.Error())
+			require.EqualError(t, tt.run(cli, dir, filepath.Join(dir, "new.txt")),
+				toStdout.Error())
+
+			content, err := afero.ReadFile(cli.fs, existing)
+			require.NoError(t, err)
+			require.Equal(t, "precious", string(content))
+
+			exists, err := afero.Exists(cli.fs, filepath.Join(dir, "new.txt"))
+			require.NoError(t, err)
+			require.False(t, exists, "a failed %s created --output", tt.name)
+		})
+	}
+}
+
+// TestCryptoInPlace checks that secret encrypt and secret decrypt given
+// one file as both --input and --output replace it with the right result.
+// Before https://git.eeqj.de/sneak/secret/issues/143 they emptied the file
+// before reading it.
+func TestCryptoInPlace(t *testing.T) {
+	t.Parallel()
+
+	cli, dir := newCryptoTest(t)
+	file := filepath.Join(dir, "plain.txt")
+
+	require.NoError(t, cli.Encrypt("key", file, file))
+	require.NoError(t, cli.Decrypt("key", file, file))
+
+	content, err := afero.ReadFile(cli.fs, file)
+	require.NoError(t, err)
+	require.Equal(t, plainText, string(content))
+}
+
+// TestDecryptToDescriptorOfDeletedFile checks that secret decrypt given
+// /dev/fd/N as --output writes through that descriptor. A program may give
+// the command a temporary file it has already deleted as stdout, pass
+// /dev/stdout as --output and read the result back from that file.
+func TestDecryptToDescriptorOfDeletedFile(t *testing.T) {
+	t.Parallel()
+
+	cli, dir := newCryptoTest(t)
+
+	file, err := os.CreateTemp(t.TempDir(), "out")
+	require.NoError(t, err)
+
+	defer func() { _ = file.Close() }()
+
+	require.NoError(t, os.Remove(file.Name()))
+
+	output := fmt.Sprintf("/dev/fd/%d", file.Fd())
+	require.NoError(t, cli.Decrypt("key", filepath.Join(dir, "plain.txt.age"), output))
+
+	content, err := io.ReadAll(file)
+	require.NoError(t, err)
+	require.Equal(t, plainText, string(content))
+}
@@ -43,7 +43,7 @@ func newGenerateMnemonicCmd() *cobra.Command {
 		Short: "Generate a random BIP39 mnemonic phrase",
 		Long: `Generate a cryptographically secure random BIP39 ` +
 			`mnemonic phrase that can be used with 'secret init' ` +
-			`or 'secret vault create'.`,
+			`or 'secret import'.`,
 		RunE: func(cmd *cobra.Command, _ []string) error {
 			cli, err := NewCLIInstance()
 			if err != nil {
@@ -115,10 +115,8 @@ func (cli *Instance) GenerateMnemonic(cmd *cobra.Command) error {
 		"   • If you lose this phrase, your secrets cannot be recovered")
 	fmt.Fprintln(os.Stderr, "")
 	fmt.Fprintln(os.Stderr, "Use this mnemonic with:")
-	fmt.Fprintln(os.Stderr,
-		"   secret init                (to initialize a new secret manager)")
-	fmt.Fprintln(os.Stderr,
-		"   secret vault create <name> (to create another vault)")
+	fmt.Fprintln(os.Stderr, "   secret init    (to initialize a new secret manager)")
+	fmt.Fprintln(os.Stderr, "   secret import  (to import into an existing vault)")

 	return nil
 }
@@ -17,6 +17,9 @@ import (
 // errPassphraseMismatch is returned when passphrase confirmation fails
 var errPassphraseMismatch = errors.New("passphrases do not match")

+// defaultVaultName is the name of the vault `secret init` creates
+const defaultVaultName = "default"
+
 // NewInitCmd creates the init command
 func NewInitCmd() *cobra.Command {
 	return &cobra.Command{
@@ -92,8 +95,10 @@ func (cli *Instance) initialize(cmd *cobra.Command) error {
 		return fmt.Errorf("failed to create state directory: %w", err)
 	}

-	if cmd != nil {
-		cmd.Printf("Initialized secrets manager at: %s\n", stateDir)
+	// Refuse an existing default vault before asking for anything
+	err = vault.CheckNewVaultName(cli.fs, cli.stateDir, defaultVaultName)
+	if err != nil {
+		return fmt.Errorf("failed to create default vault: %w", err)
 	}

 	// Prompt for mnemonic
@@ -133,7 +138,7 @@ func (cli *Instance) initialize(cmd *cobra.Command) error {
 	// Create the default vault with its passphrase unlocker
 	secret.Debug("Creating default vault")

-	vlt, err := vault.CreateVault(cli.fs, cli.stateDir, "default",
+	vlt, err := vault.CreateVault(cli.fs, cli.stateDir, defaultVaultName,
 		mnemonic, passphraseBuffer)
 	if err != nil {
 		secret.Debug("Failed to create default vault", "error", err)
@@ -152,6 +157,7 @@ func (cli *Instance) initialize(cmd *cobra.Command) error {
 	}

 	if cmd != nil {
+		cmd.Printf("Initialized secrets manager at: %s\n", stateDir)
 		cmd.Printf("\nDefault vault created and configured\n")
 		cmd.Printf("Long-term public key: %s\n", ltIdentity.Recipient().String())
 		cmd.Printf("Unlocker ID: %s\n", unlocker.GetID())
@@ -7,10 +7,12 @@ import (
 	"github.com/awnumar/memguard"
 	"github.com/spf13/afero"
 	"github.com/stretchr/testify/require"
+	"sneak.berlin/go/secret/internal/vault"
 )

 // TestInvalidMnemonicError checks that every command that takes a mnemonic
-// returns errInvalidMnemonicPhrase for one that is not valid BIP39.
+// returns errInvalidMnemonicPhrase for one that is not valid BIP39. The vault
+// "other" has no long-term key, as vault import needs.
 func TestInvalidMnemonicError(t *testing.T) {
 	t.Parallel()

@@ -22,13 +24,20 @@ func TestInvalidMnemonicError(t *testing.T) {
 		{"secret vault create work", func(c *Instance) error {
 			return c.CreateVault(c.cmd, "work")
 		}},
+		{"secret vault import other", func(c *Instance) error {
+			return c.VaultImport(c.cmd, "other")
+		}},
 	}

 	for _, tt := range tests {
 		t.Run(tt.command, func(t *testing.T) {
 			t.Parallel()

-			instance, _ := newTestInstance(afero.NewMemMapFs())
+			fs := afero.NewMemMapFs()
+			_, err := vault.CreateVault(fs, listTestStateDir, "other", nil, nil)
+			require.NoError(t, err)
+
+			instance, _ := newTestInstance(fs)
 			instance.Mnemonic = memguard.NewBufferFromBytes([]byte("not a mnemonic"))
 			t.Cleanup(instance.Mnemonic.Destroy)

@@ -140,6 +140,16 @@ func TestSecretManagerIntegration(t *testing.T) {
 	//   - currentvault symlink updated to point to work
 	test03CreateVault(t, tempDir, runSecret)

+	// Test 4: Import mnemonic into work vault
+	// Command: secret vault import work
+	// Purpose: Import mnemonic with passphrase unlocker
+	// Expected filesystem:
+	//   - work vault has pub.age file
+	//   - work vault has unlockers.d/passphrase directory
+	//   - Unlocker metadata and encrypted keys present
+	// NOTE: Skipped because vault creation now includes mnemonic import
+	// test04ImportMnemonic(t, tempDir, testMnemonic, testPassphrase, runSecretWithEnv)
+
 	// Test 5: Add secrets with versioning
 	// Command: echo "password123" | secret add database/password
 	// Purpose: Add a secret and verify versioned storage
@@ -525,6 +535,65 @@ func test03CreateVault(t *testing.T, tempDir string, runSecret func(...string) (
 	assert.Contains(t, output, "work", "should list work vault")
 }

+//nolint:unused // TODO: re-enable when vault import is implemented
+func test04ImportMnemonic(t *testing.T, tempDir, testMnemonic, testPassphrase string, runSecretWithEnv func(map[string]string, ...string) (string, error)) {
+	t.Helper()
+
+	// Import mnemonic into work vault
+	output, err := runSecretWithEnv(map[string]string{
+		secret.EnvMnemonic:         testMnemonic,
+		secret.EnvUnlockPassphrase: testPassphrase,
+	}, "vault", "import", "work")
+
+	require.NoError(t, err, "vault import should succeed")
+	assert.Contains(t, output, "Successfully imported mnemonic into vault 'work'", "should confirm import")
+
+	// Verify work vault now has long-term key
+	workVaultDir := filepath.Join(tempDir, "vaults.d", "work")
+	pubKeyFile := filepath.Join(workVaultDir, "pub.age")
+	verifyFileExists(t, pubKeyFile)
+
+	// Verify passphrase unlocker was created
+	currentUnlocker := readFile(t, filepath.Join(workVaultDir, "current-unlocker"))
+	passphraseUnlockerDir := filepath.Join(workVaultDir, "unlockers.d", string(currentUnlocker))
+	verifyFileExists(t, passphraseUnlockerDir)
+
+	// Check unlocker files
+	unlockerMetadata := filepath.Join(passphraseUnlockerDir, "unlocker-metadata.json")
+	verifyFileExists(t, unlockerMetadata)
+
+	encryptedLTPrivKey := filepath.Join(passphraseUnlockerDir, "priv.age")
+	verifyFileExists(t, encryptedLTPrivKey)
+
+	encryptedLTPubKey := filepath.Join(passphraseUnlockerDir, "pub.age")
+	verifyFileExists(t, encryptedLTPubKey)
+
+	longtermKeyFile := filepath.Join(passphraseUnlockerDir, "longterm.age")
+	verifyFileExists(t, longtermKeyFile)
+
+	// Verify vault metadata was created with derivation index
+	vaultMetadata := filepath.Join(workVaultDir, "vault-metadata.json")
+	verifyFileExists(t, vaultMetadata)
+
+	metadataBytes := readFile(t, vaultMetadata)
+
+	var metadata map[string]any
+
+	err = json.Unmarshal(metadataBytes, &metadata)
+	require.NoError(t, err, "vault metadata should be valid JSON")
+
+	// Work vault should have a different derivation index than default (0)
+	derivIndex, ok := metadata["derivationIndex"].(float64)
+	require.True(t, ok, "derivationIndex should be a number")
+	assert.NotEqual(t, float64(0), derivIndex, "work vault should have non-zero derivation index")
+
+	// Verify public key hash is stored
+	assert.Contains(t, metadata, "publicKeyHash", "should contain public key hash")
+	pubKeyHash, ok := metadata["publicKeyHash"].(string)
+	require.True(t, ok, "publicKeyHash should be a string")
+	assert.NotEmpty(t, pubKeyHash, "public key hash should not be empty")
+}
+
 func test05AddSecret(t *testing.T, tempDir, testMnemonic string, runSecret func(...string) (string, error), runSecretWithEnv func(map[string]string, ...string) (string, error), runSecretWithStdin func(string, map[string]string, ...string) (string, error)) {
 	t.Helper()

@@ -1870,6 +1939,14 @@ func test23ErrorHandling(t *testing.T, tempDir, secretPath, testMnemonic string,
 	_, err = runSecret("vault", "select", "nonexistent")
 	require.ErrorIs(t, err, vault.ErrVaultNotFound, "select non-existent vault should fail")

+	// Import to non-existent vault with test passphrase
+	testPassphrase := "test-passphrase-123" // Define testPassphrase locally
+	_, err = runSecretWithEnv(map[string]string{
+		secret.EnvMnemonic:         testMnemonic,
+		secret.EnvUnlockPassphrase: testPassphrase,
+	}, "vault", "import", "nonexistent")
+	require.ErrorIs(t, err, vault.ErrVaultNotFound, "import to non-existent vault should fail")
+
 	// Get specific version that doesn't exist
 	_, err = runSecretWithEnv(map[string]string{
 		secret.EnvMnemonic: testMnemonic,
@@ -282,10 +282,11 @@ func stateDirModTimes(t *testing.T, fs afero.Fs) map[string]int64 {

 // setupEveryCommand makes what each command in
 // TestChangingCommandsWaitForLock needs: the current vault "work" with two
-// versions of "test/secret", the vault "other", and the file testInput.
-// There is no vault "default", which init creates. If withUnlocker is set,
-// it also gives "work" a passphrase unlocker, which is slow. It returns the
-// older version and the unlocker's ID.
+// versions of "test/secret", the vault "other" without a long-term key, for
+// vault import, and the file testInput. There is no vault "default", which
+// init creates. If withUnlocker is set, it also gives "work" a passphrase
+// unlocker, which is slow. It returns the older version and the unlocker's
+// ID.
 func setupEveryCommand(
 	t *testing.T, fs afero.Fs, withUnlocker bool,
 ) (string, string) {
@@ -293,9 +294,13 @@ func setupEveryCommand(

 	mnemonic := testMnemonicBuffer(t)

-	_, err := vault.CreateVault(fs, testStateDir, "other", mnemonic, nil)
+	other, err := vault.CreateVault(fs, testStateDir, "other", mnemonic, nil)
 	require.NoError(t, err)

+	otherDir, err := other.GetDirectory()
+	require.NoError(t, err)
+	require.NoError(t, fs.Remove(filepath.Join(otherDir, "pub.age")))
+
 	vlt, err := vault.CreateVault(fs, testStateDir, "work", mnemonic, nil)
 	require.NoError(t, err)

@@ -450,6 +455,9 @@ func TestChangingCommandsWaitForLock(t *testing.T) {
 		{"vault select", false, func(cli *Instance, _, _ string) error {
 			return cli.SelectVault(cli.cmd, "other")
 		}},
+		{"vault import", false, func(cli *Instance, _, _ string) error {
+			return cli.VaultImport(cli.cmd, "other")
+		}},
 		{"vault rm --force", false, func(cli *Instance, _, _ string) error {
 			return cli.RemoveVault(cli.cmd, "other", true)
 		}},
@@ -306,7 +306,8 @@ func TestInvalidVersionLeavesVaultsUnchanged(t *testing.T) {

 // TestInvalidVaultNameLeavesStateUnchanged is a regression test for
 // https://git.eeqj.de/sneak/secret/issues/68, where
-// `secret vault select ..` made the state directory itself the current
+// `secret vault import ..` wrote a long-term key and an unlocker into the
+// state directory itself, and `secret vault select ..` made it the current
 // vault. Each command that takes a vault name must reject an invalid one
 // before building a path from it. The instance is given the mnemonic and
 // the passphrase, and moves and removals use --force, so that only the name
@@ -330,6 +331,9 @@ func TestInvalidVaultNameLeavesStateUnchanged(t *testing.T) {
 		{"vault create %q", func(c *cli.Instance, name string) error {
 			return c.CreateVault(cmd, name)
 		}},
+		{"vault import %q", func(c *cli.Instance, name string) error {
+			return c.VaultImport(cmd, name)
+		}},
 		{"vault select %q", func(c *cli.Instance, name string) error {
 			return c.SelectVault(cmd, name)
 		}},
@@ -443,7 +443,10 @@ func (cli *Instance) GetSecret(cmd *cobra.Command, secretName string) error {
 	defer value.Destroy()

 	// Write the value straight from locked memory, with no trailing newline
-	_, _ = cmd.OutOrStdout().Write(value.Bytes())
+	_, err = cmd.OutOrStdout().Write(value.Bytes())
+	if err != nil {
+		return fmt.Errorf("failed to write secret value: %w", err)
+	}

 	return nil
 }
@@ -478,7 +481,10 @@ func (cli *Instance) GetSecretWithVersion(
 	secret.Debug("Got secret value", "valueLength", value.Size())

 	// Write the value straight from locked memory, with no trailing newline
-	_, _ = cmd.OutOrStdout().Write(value.Bytes())
+	_, err = cmd.OutOrStdout().Write(value.Bytes())
+	if err != nil {
+		return fmt.Errorf("failed to write secret value: %w", err)
+	}

 	secret.Debug("Printed value to stdout")

@@ -371,3 +371,19 @@ func TestRemoveSecretAbortsWhenVersionsUnreadable(t *testing.T) {
 	require.NoError(t, err)
 	assert.True(t, exists, "the secret must not be removed")
 }
+
+// TestVaultImportAbortsWhenPubKeyUnreadable asserts that a mnemonic import
+// stops when whether the vault already has a long-term key cannot be
+// determined.
+func TestVaultImportAbortsWhenPubKeyUnreadable(t *testing.T) {
+	t.Parallel()
+
+	base := newListTestVault(t, 1)
+	instance, cmd := newTestInstance(&statFailFs{
+		Fs: base, path: filepath.Join(testVaultDir(listTestVaultName), "pub.age"),
+	})
+
+	err := instance.importMnemonic(cmd, listTestVaultName)
+
+	require.ErrorIs(t, err, errStatFailed)
+}
@@ -8,6 +8,7 @@ import (
 	"path/filepath"
 	"slices"
 	"strings"
+	"time"

 	"github.com/awnumar/memguard"
 	"github.com/spf13/afero"
@@ -15,12 +16,19 @@ import (
 	"sneak.berlin/go/secret/internal/bip39"
 	"sneak.berlin/go/secret/internal/secret"
 	"sneak.berlin/go/secret/internal/vault"
+	"sneak.berlin/go/secret/pkg/agehd"
 )

 // Sentinel errors for vault operations
 var (
 	errMnemonicEmpty         = errors.New("mnemonic cannot be empty")
 	errInvalidMnemonicPhrase = errors.New("invalid BIP39 mnemonic phrase")
+	errVaultHasLongTermKey   = errors.New(
+		"already has a long-term key configured")
+	errMnemonicEnvNotSet = errors.New(
+		"SB_SECRET_MNEMONIC environment variable not set")
+	errPassphraseEnvNotSet = errors.New(
+		"SB_UNLOCK_PASSPHRASE environment variable not set")
 	errCannotRemoveLastVault = errors.New("cannot remove the last vault")
 )

@@ -34,6 +42,7 @@ func newVaultCmd() *cobra.Command {
 	cmd.AddCommand(newVaultListCmd())
 	cmd.AddCommand(newVaultCreateCmd())
 	cmd.AddCommand(newVaultSelectCmd())
+	cmd.AddCommand(newVaultImportCmd())
 	cmd.AddCommand(newVaultRemoveCmd())

 	return cmd
@@ -102,6 +111,38 @@ func newVaultSelectCmd() *cobra.Command {
 	}
 }

+func newVaultImportCmd() *cobra.Command {
+	cli, err := NewCLIInstance()
+	if err != nil {
+		log.Fatalf("failed to initialize CLI: %v", err)
+	}
+
+	return &cobra.Command{
+		Use:   "import <vault-name>",
+		Short: "Import a mnemonic into a vault",
+		Long: `Import a BIP39 mnemonic phrase into the specified vault ` +
+			`(default if not specified).`,
+		Args:              cobra.MaximumNArgs(1),
+		ValidArgsFunction: getVaultNamesCompletionFunc(cli.fs, cli.stateDir),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			vaultName := "default"
+			if len(args) > 0 {
+				vaultName = args[0]
+			}
+
+			cli, err := NewCLIInstance()
+			if err != nil {
+				return fmt.Errorf("failed to initialize CLI: %w", err)
+			}
+
+			destroySecrets := cli.readSecretEnv()
+			defer destroySecrets()
+
+			return cli.VaultImport(cmd, vaultName)
+		},
+	}
+}
+
 func newVaultRemoveCmd() *cobra.Command {
 	cli, err := NewCLIInstance()
 	if err != nil {
@@ -226,6 +267,12 @@ func (cli *Instance) CreateVault(cmd *cobra.Command, name string) error {
 	}
 	defer release()

+	// Refuse an invalid name or an existing vault before asking for anything
+	err = vault.CheckNewVaultName(cli.fs, cli.stateDir, name)
+	if err != nil {
+		return err
+	}
+
 	mnemonic, cleanupMnemonic, err := cli.promptMnemonic()
 	if err != nil {
 		return err
@@ -295,6 +342,196 @@ func (cli *Instance) SelectVault(cmd *cobra.Command, name string) error {
 	return nil
 }

+// vaultImportPreflight verifies the vault exists without a long-term key
+// and returns the vault directory, public key path, and validated mnemonic
+func (cli *Instance) vaultImportPreflight(
+	vlt *vault.Vault, vaultName string,
+) (string, string, string, error) {
+	// Check if vault exists
+	vaultDir, err := vlt.GetDirectory()
+	if err != nil {
+		return "", "", "", err
+	}
+
+	exists, err := afero.DirExists(cli.fs, vaultDir)
+	if err != nil {
+		return "", "", "", fmt.Errorf("failed to check if vault exists: %w", err)
+	}
+
+	if !exists {
+		return "", "", "", fmt.Errorf("vault '%s' %w",
+			vaultName, vault.ErrVaultNotFound)
+	}
+
+	// Check if vault already has a public key
+	pubKeyPath := vaultDir + "/pub.age"
+
+	exists, err = afero.Exists(cli.fs, pubKeyPath)
+	if err != nil {
+		return "", "", "", fmt.Errorf("failed to check %s: %w", pubKeyPath, err)
+	}
+
+	if exists {
+		return "", "", "", fmt.Errorf("vault '%s' %w",
+			vaultName, errVaultHasLongTermKey)
+	}
+
+	// Get mnemonic from environment
+	if cli.Mnemonic == nil {
+		return "", "", "", errMnemonicEnvNotSet
+	}
+
+	mnemonic := cli.Mnemonic.String()
+
+	// Validate the mnemonic
+	mnemonicWords := strings.Fields(mnemonic)
+	secret.Debug("Validating BIP39 mnemonic", "word_count", len(mnemonicWords))
+
+	if !bip39.IsMnemonicValid(mnemonic) {
+		return "", "", "", errInvalidMnemonicPhrase
+	}
+
+	return vaultDir, pubKeyPath, mnemonic, nil
+}
+
+// updateVaultImportMetadata stores the derivation info in vault metadata
+func updateVaultImportMetadata(
+	fs afero.Fs, vaultDir string, derivationIndex uint32,
+	publicKeyHash, familyHash string,
+) error {
+	// Load existing metadata
+	existingMetadata, err := vault.LoadVaultMetadata(fs, vaultDir)
+	if err != nil {
+		// If metadata doesn't exist, create new
+		existingMetadata = &vault.Metadata{
+			CreatedAt: time.Now(),
+		}
+	}
+
+	// Update metadata with new derivation info
+	existingMetadata.DerivationIndex = derivationIndex
+	existingMetadata.PublicKeyHash = publicKeyHash
+	existingMetadata.MnemonicFamilyHash = familyHash
+
+	err = vault.SaveVaultMetadata(fs, vaultDir, existingMetadata)
+	if err != nil {
+		secret.Debug("Failed to save vault metadata", "error", err)
+
+		return fmt.Errorf("failed to save vault metadata: %w", err)
+	}
+
+	secret.Debug("Saved vault metadata with derivation index and public key hash")
+
+	return nil
+}
+
+// VaultImport imports a mnemonic into a specific vault, holding the state
+// directory lock while importMnemonic runs
+func (cli *Instance) VaultImport(cmd *cobra.Command, vaultName string) error {
+	err := vault.ValidateVaultName(vaultName)
+	if err != nil {
+		return err
+	}
+
+	release, err := vault.LockStateDir(cli.fs, cli.stateDir)
+	if err != nil {
+		return err
+	}
+	defer release()
+
+	return cli.importMnemonic(cmd, vaultName)
+}
+
+// importMnemonic gives the vault a long-term key derived from the mnemonic
+// and a passphrase unlocker
+func (cli *Instance) importMnemonic(cmd *cobra.Command, vaultName string) error {
+	secret.Debug("Importing mnemonic into vault",
+		"vault_name", vaultName, "state_dir", cli.stateDir)
+
+	// Get the specific vault by name
+	vlt := vault.NewVault(cli.fs, cli.stateDir, vaultName)
+
+	vaultDir, pubKeyPath, mnemonic, err := cli.vaultImportPreflight(vlt, vaultName)
+	if err != nil {
+		return err
+	}
+
+	// Get the next available derivation index for this mnemonic
+	derivationIndex, err := vault.GetNextDerivationIndex(cli.fs, cli.stateDir, mnemonic)
+	if err != nil {
+		secret.Debug("Failed to get next derivation index", "error", err)
+
+		return fmt.Errorf("failed to get next derivation index: %w", err)
+	}
+
+	secret.Debug("Using derivation index", "index", derivationIndex)
+
+	// Derive long-term key from mnemonic with the appropriate index
+	secret.Debug("Deriving long-term key from mnemonic", "index", derivationIndex)
+
+	ltIdentity, err := agehd.DeriveIdentity(mnemonic, derivationIndex)
+	if err != nil {
+		return fmt.Errorf("failed to derive long-term key: %w", err)
+	}
+
+	// Store long-term public key in vault
+	ltPublicKey := ltIdentity.Recipient().String()
+	secret.Debug("Storing long-term public key",
+		"pubkey", ltPublicKey, "vault_dir", vaultDir)
+
+	err = secret.WriteFileAtomic(cli.fs, pubKeyPath, []byte(ltPublicKey))
+	if err != nil {
+		return fmt.Errorf("failed to store long-term public key: %w", err)
+	}
+
+	// Calculate public key hash from the actual derivation index being used
+	// This is used to verify that the derived key matches what was stored
+	publicKeyHash := vault.ComputeDoubleSHA256([]byte(ltIdentity.Recipient().String()))
+
+	// Calculate family hash from index 0 (same for all vaults with this
+	// mnemonic). This is used to identify which vaults belong to the same
+	// mnemonic family.
+	identity0, err := agehd.DeriveIdentity(mnemonic, 0)
+	if err != nil {
+		return fmt.Errorf("failed to derive identity for index 0: %w", err)
+	}
+
+	familyHash := vault.ComputeDoubleSHA256([]byte(identity0.Recipient().String()))
+
+	err = updateVaultImportMetadata(
+		cli.fs, vaultDir, derivationIndex, publicKeyHash, familyHash)
+	if err != nil {
+		return err
+	}
+
+	// Get passphrase from environment variable
+	passphraseBuffer := cli.UnlockPassphrase
+	if passphraseBuffer == nil {
+		return errPassphraseEnvNotSet
+	}
+
+	secret.Debug("Using unlock passphrase from environment variable")
+
+	// Unlock the vault with the derived long-term key
+	vlt.Unlock(ltIdentity)
+
+	// Create passphrase-protected unlocker
+	secret.Debug("Creating passphrase-protected unlocker")
+
+	passphraseUnlocker, err := vlt.CreatePassphraseUnlocker(passphraseBuffer)
+	if err != nil {
+		secret.Debug("Failed to create unlocker", "error", err)
+
+		return fmt.Errorf("failed to create unlocker: %w", err)
+	}
+
+	cmd.Printf("Successfully imported mnemonic into vault '%s'\n", vaultName)
+	cmd.Printf("Long-term public key: %s\n", ltPublicKey)
+	cmd.Printf("Unlocker ID: %s\n", passphraseUnlocker.GetID())
+
+	return nil
+}
+
 // countVaultSecrets returns the number of secrets in the vault directory
 func (cli *Instance) countVaultSecrets(vaultDir string) (int, error) {
 	secretsDir := filepath.Join(vaultDir, "secrets.d")
@@ -8,6 +8,7 @@
 // - TestPromoteNonExistentVersion: Tests error handling for invalid promotion
 // - TestGetSecretWithVersion: Tests `secret get --version` flag functionality
 // - TestGetSecretWritesBinaryValue: Tests `secret get` output of binary values
+// - TestGetSecretReturnsWriteError: Tests `secret get` when stdout fails
 // - TestVersionCommandStructure: Tests command structure and help text
 // - TestListVersionsEmptyOutput: Tests edge case with no versions
 //
@@ -20,6 +21,7 @@ package cli

 import (
 	"bytes"
+	"os"
 	"path/filepath"
 	"strings"
 	"testing"
@@ -360,6 +362,45 @@ func TestGetSecretWritesBinaryValue(t *testing.T) {
 	assert.Equal(t, value, buf.Bytes())
 }

+// TestGetSecretReturnsWriteError checks that `secret get`, with and without
+// a version, returns the error of a failed write of the value.
+func TestGetSecretReturnsWriteError(t *testing.T) {
+	t.Parallel()
+
+	fs := afero.NewMemMapFs()
+	cli := NewCLIInstanceWithStateDir(fs, testStateDir)
+	cli.Mnemonic = testMnemonicBuffer(t)
+
+	setupTestVault(t, fs)
+
+	vlt, err := vault.GetCurrentVault(fs, testStateDir)
+	require.NoError(t, err)
+
+	addTestSecret(t, vlt, []byte("value"), false)
+
+	vaultDir, err := vlt.GetDirectory()
+	require.NoError(t, err)
+
+	versions, err := secret.ListVersions(fs,
+		filepath.Join(vaultDir, "secrets.d", "test%secret"))
+	require.NoError(t, err)
+	require.Len(t, versions, 1)
+
+	// Stdout is a file closed before the value is written to it
+	out, err := os.Create(filepath.Join(t.TempDir(), "stdout"))
+	require.NoError(t, err)
+	require.NoError(t, out.Close())
+
+	cmd := newRootCmd()
+	cmd.SetOut(out)
+
+	err = cli.GetSecret(cmd, "test/secret")
+	require.ErrorIs(t, err, os.ErrClosed)
+
+	err = cli.GetSecretWithVersion(cmd, "test/secret", versions[0])
+	require.ErrorIs(t, err, os.ErrClosed)
+}
+
 //nolint:paralleltest // reads process environment to determine the state dir
 func TestVersionCommandStructure(t *testing.T) {
 	// Test that version commands are properly structured
@@ -212,16 +212,40 @@ func processMnemonicForVault(
 	return ltIdentity, derivationIndex, publicKeyHash, familyHash, nil
 }

+// CheckNewVaultName returns an error when name cannot be the name of a new
+// vault: one wrapping ErrInvalidVaultName when it is not a valid vault name,
+// and one wrapping ErrVaultExists when that vault already exists. Creating an
+// existing vault again would replace its keys, and its secrets could no
+// longer be decrypted. CreateVault checks this before writing anything; the
+// commands that create a vault also check it before they ask for the
+// mnemonic or passphrase, holding the state directory lock.
+func CheckNewVaultName(fs afero.Fs, stateDir string, name string) error {
+	err := ValidateVaultName(name)
+	if err != nil {
+		return err
+	}
+
+	exists, err := afero.DirExists(fs, filepath.Join(stateDir, "vaults.d", name))
+	if err != nil {
+		return fmt.Errorf("failed to check if vault exists: %w", err)
+	}
+
+	if exists {
+		return fmt.Errorf("vault %s %w", name, ErrVaultExists)
+	}
+
+	return nil
+}
+
 // CreateVault creates a new vault and selects it as the current vault. When
 // mnemonic is not nil, the vault's long-term key is derived from it, and the
 // returned vault has it as its Mnemonic; when it is nil, the vault has no
-// long-term key. When passphrase is not nil, the vault gets a passphrase
-// unlocker protected by it, as its current unlocker; that needs a mnemonic.
-// It refuses a vault that already exists before writing anything: creating
-// it again would replace its keys, and its secrets could no longer be
-// decrypted. The commands that call it hold the state directory
-// lock, so no other command can create the vault between the check and the
-// writes.
+// long-term key until one is imported. When passphrase is not nil, the vault
+// gets a passphrase unlocker protected by it, as its current unlocker; that
+// needs a mnemonic. It refuses an invalid name or a vault that already exists,
+// as CheckNewVaultName does, before writing anything. The commands that call
+// it hold the state directory lock, so no other command can create the vault
+// between the check and the writes.
 //
 // The vault is written whole into a temporary directory, which is renamed
 // into vaults.d only once complete, and only then selected: a crash at any
@@ -233,30 +257,17 @@ func CreateVault(
 ) (*Vault, error) {
 	secret.Debug("Creating new vault", "name", name, "state_dir", stateDir)

-	err := ValidateVaultName(name)
+	err := CheckNewVaultName(fs, stateDir, name)
 	if err != nil {
-		secret.Debug("Invalid vault name provided", "vault_name", name)
-
 		return nil, err
 	}

-	secret.Debug("Vault name validation passed", "vault_name", name)
-
-	vaultDir := filepath.Join(stateDir, "vaults.d", name)
-
-	exists, err := afero.DirExists(fs, vaultDir)
-	if err != nil {
-		return nil, fmt.Errorf("failed to check if vault exists: %w", err)
-	}
-
-	if exists {
-		return nil, fmt.Errorf("vault %s %w", name, ErrVaultExists)
-	}
-
 	if passphrase != nil && mnemonic == nil {
 		return nil, fmt.Errorf("vault %s %w", name, ErrUnlockerWithoutMnemonic)
 	}

+	vaultDir := filepath.Join(stateDir, "vaults.d", name)
+
 	secret.Debug("Creating vault directory structure", "vault_dir", vaultDir)

 	err = secret.WriteDir(fs, vaultDir, func(dir string) error {
@@ -296,6 +296,91 @@ func TestSampleHashCalculation(t *testing.T) {
 	}
 }

+func TestWorkflowMismatch(t *testing.T) {
+	t.Parallel()
+
+	// Create a temporary directory for testing
+	tempDir := t.TempDir()
+	fs := afero.NewOsFs()
+
+	// Test Case 1: Create vault WITH mnemonic (like init command)
+	_, err := vault.CreateVault(fs, tempDir, "default", testMnemonicBuffer(t), nil)
+	if err != nil {
+		t.Fatalf("Failed to create vault with mnemonic: %v", err)
+	}
+
+	// Load metadata for vault1
+	vault1Dir := filepath.Join(tempDir, "vaults.d", "default")
+
+	metadata1, err := vault.LoadVaultMetadata(fs, vault1Dir)
+	if err != nil {
+		t.Fatalf("Failed to load vault1 metadata: %v", err)
+	}
+
+	t.Logf("Vault1 (with mnemonic) - DerivationIndex: %d, PublicKeyHash: %s",
+		metadata1.DerivationIndex, metadata1.PublicKeyHash)
+
+	// Test Case 2: Create vault WITHOUT mnemonic, then import (work vault)
+	_, err = vault.CreateVault(fs, tempDir, "work", nil, nil)
+	if err != nil {
+		t.Fatalf("Failed to create vault without mnemonic: %v", err)
+	}
+
+	vault2Dir := filepath.Join(tempDir, "vaults.d", "work")
+
+	// Simulate the vault import process: get the next available derivation
+	// index for this mnemonic
+	derivationIndex, err := vault.GetNextDerivationIndex(fs, tempDir, testMnemonic)
+	if err != nil {
+		t.Fatalf("Failed to get next derivation index: %v", err)
+	}
+
+	t.Logf("Next derivation index for import: %d", derivationIndex)
+
+	// Calculate public key hash from index 0 (same as in VaultImport)
+	identity0, err := agehd.DeriveIdentity(testMnemonic, 0)
+	if err != nil {
+		t.Fatalf("Failed to derive identity for index 0: %v", err)
+	}
+
+	publicKeyHash := vault.ComputeDoubleSHA256(
+		[]byte(identity0.Recipient().String()))
+
+	// Load existing metadata and update it (same as in VaultImport)
+	existingMetadata, err := vault.LoadVaultMetadata(fs, vault2Dir)
+	if err != nil {
+		t.Fatalf("Failed to load existing metadata: %v", err)
+	}
+
+	// Update metadata with new derivation info
+	existingMetadata.DerivationIndex = derivationIndex
+	existingMetadata.PublicKeyHash = publicKeyHash
+
+	err = vault.SaveVaultMetadata(fs, vault2Dir, existingMetadata)
+	if err != nil {
+		t.Fatalf("Failed to save vault metadata: %v", err)
+	}
+
+	// Load updated metadata for vault2
+	metadata2, err := vault.LoadVaultMetadata(fs, vault2Dir)
+	if err != nil {
+		t.Fatalf("Failed to load vault2 metadata: %v", err)
+	}
+
+	t.Logf("Vault2 (imported mnemonic) - DerivationIndex: %d, PublicKeyHash: %s",
+		metadata2.DerivationIndex, metadata2.PublicKeyHash)
+
+	// Verify that both vaults have the same public key hash
+	if metadata1.PublicKeyHash != metadata2.PublicKeyHash {
+		t.Errorf("Public key hashes don't match!")
+		t.Logf("Vault1 hash: %s", metadata1.PublicKeyHash)
+		t.Logf("Vault2 hash: %s", metadata2.PublicKeyHash)
+	} else {
+		t.Logf("SUCCESS: Both vaults have the same public key hash: %s",
+			metadata1.PublicKeyHash)
+	}
+}
+
 func TestReverseEngineerHash(t *testing.T) {
 	t.Parallel()