One error value per failure: internal/cli duplicates vault errors, some failures have none, two bip85 errors are unreachable #113

New Issue

2026-10-04T22:08:12+02:00

clawbot commented

2026-10-04 22:08:12 +02:00

Found by #49 (#49 (comment)), which was test-only and left these alone.

Problem

internal/cli declares its own errSecretNotFound, errVaultDoesNotExist, errVersionNotFound and errSecretExistsNoForce for the failures vault.ErrSecretNotFound, ErrVaultNotFound, ErrVersionNotFound and ErrSecretExists already name. Which one a caller gets depends on the command: secret get --version X returns vault.ErrVersionNotFound, secret version promote/rm return the copy, so errors.Is(err, vault.ErrVersionNotFound) is false for them. The same split hits secret mv, secret vault import, secret vault remove and secret version list.
secret.ReadPassphrase returns only unexported errors for "no terminal"; secret.ResolveGPGKeyFingerprint has no error for a key the keyring does not hold; storeInKeychain returns a plain fmt.Errorf with the same text as errNilDataBuffer.
bip85.ErrPasswordTooShort and bip85.ErrEncodedTooShort can never be returned (the length checks before them make them unreachable).

Definition of done

Each failure has exactly one error value, returned by every command that hits it: the internal/cli copies are removed in favour of the vault sentinels, wrapped with %w where context is added.
ReadPassphrase no-terminal failures wrap secret.ErrPassphraseNotRead; an unknown PGP key gets a sentinel; storeInKeychain returns errNilDataBuffer.
The two unreachable bip85 errors and their checks are removed, or the checks made reachable if they guard a real case.
The tests that #49 left comparing text for these cases now use errors.Is.
User-visible messages stay the same unless a message was wrong; TODO.md updated.

Model: opus-5-5

Found by https://git.eeqj.de/sneak/secret/issues/49 (https://git.eeqj.de/sneak/secret/issues/49#issuecomment-125483), which was test-only and left these alone. ## Problem - `internal/cli` declares its own `errSecretNotFound`, `errVaultDoesNotExist`, `errVersionNotFound` and `errSecretExistsNoForce` for the failures `vault.ErrSecretNotFound`, `ErrVaultNotFound`, `ErrVersionNotFound` and `ErrSecretExists` already name. Which one a caller gets depends on the command: `secret get --version X` returns `vault.ErrVersionNotFound`, `secret version promote`/`rm` return the copy, so `errors.Is(err, vault.ErrVersionNotFound)` is false for them. The same split hits `secret mv`, `secret vault import`, `secret vault remove` and `secret version list`. - `secret.ReadPassphrase` returns only unexported errors for "no terminal"; `secret.ResolveGPGKeyFingerprint` has no error for a key the keyring does not hold; `storeInKeychain` returns a plain `fmt.Errorf` with the same text as `errNilDataBuffer`. - `bip85.ErrPasswordTooShort` and `bip85.ErrEncodedTooShort` can never be returned (the length checks before them make them unreachable). ## Definition of done - Each failure has exactly one error value, returned by every command that hits it: the `internal/cli` copies are removed in favour of the `vault` sentinels, wrapped with `%w` where context is added. - `ReadPassphrase` no-terminal failures wrap `secret.ErrPassphraseNotRead`; an unknown PGP key gets a sentinel; `storeInKeychain` returns `errNilDataBuffer`. - The two unreachable `bip85` errors and their checks are removed, or the checks made reachable if they guard a real case. - The tests that https://git.eeqj.de/sneak/secret/issues/49 left comparing text for these cases now use `errors.Is`. - User-visible messages stay the same unless a message was wrong; `TODO.md` updated. Model: opus-5-5

clawbot referenced this issue from a commit

2026-10-04 23:39:29 +02:00

Give each failure one error value (closes #113)

clawbot referenced a pull request that will close this issue

2026-10-04 23:41:48 +02:00

Give each failure one error value (closes #113) #114

clawbot commented

2026-10-04 23:41:54 +02:00

Built in #114. The two bip85 checks guarded no real case, so they were removed, not made reachable. Messages that change are listed in the PR.

Model: opus-5-5

Built in https://git.eeqj.de/sneak/secret/pulls/114. The two `bip85` checks guarded no real case, so they were removed, not made reachable. Messages that change are listed in the PR. Model: opus-5-5

clawbot referenced this issue from a commit

2026-10-05 00:11:09 +02:00

Give each failure one error value (closes #113)

clawbot referenced this issue

2026-10-05 00:30:30 +02:00

Give each failure one error value (closes #113) #114

clawbot referenced this issue from a commit

2026-10-05 00:55:41 +02:00

Give each failure one error value (closes #113)

clawbot closed this issue

2026-10-05 01:08:02 +02:00

clawbot referenced this issue from a commit