Bug: getLongTermPrivateKey hardcodes derivation index 0 for mnemonic path #3

New Issue

2026-02-08T21:01:39+01:00

clawbot commented

2026-02-08 21:01:39 +01:00

Bug

In internal/secret/keychainunlocker.go, the getLongTermPrivateKey() function hardcodes derivation index 0 when deriving the long-term key from a mnemonic:

ltIdentity, err := agehd.DeriveIdentity(envMnemonic, 0)

This ignores the vault's actual DerivationIndex stored in vault-metadata.json. For any vault with a derivation index other than 0 (i.e., the second or subsequent vault created from the same mnemonic), this will derive the wrong long-term key, causing:

Keychain unlocker creation to encrypt the wrong key
Silent data corruption where the unlocker stores a key that doesn't match the vault

Expected Behavior

The function should read the vault's metadata to get the correct DerivationIndex and use it for key derivation.

Affected Code

internal/secret/keychainunlocker.go line ~330 in getLongTermPrivateKey()

## Bug In `internal/secret/keychainunlocker.go`, the `getLongTermPrivateKey()` function hardcodes derivation index `0` when deriving the long-term key from a mnemonic: ```go ltIdentity, err := agehd.DeriveIdentity(envMnemonic, 0) ``` This ignores the vault's actual `DerivationIndex` stored in `vault-metadata.json`. For any vault with a derivation index other than 0 (i.e., the second or subsequent vault created from the same mnemonic), this will derive the **wrong long-term key**, causing: - Keychain unlocker creation to encrypt the wrong key - Silent data corruption where the unlocker stores a key that doesn't match the vault ## Expected Behavior The function should read the vault's metadata to get the correct `DerivationIndex` and use it for key derivation. ## Affected Code `internal/secret/keychainunlocker.go` line ~330 in `getLongTermPrivateKey()`

clawbot referenced a pull request that will close this issue

2026-02-08 21:05:58 +01:00

Fix getLongTermPrivateKey derivation index hardcoded to 0 (closes #3) #8

sneak closed this issue

2026-02-20 08:58:22 +01:00

sneak referenced this issue from a commit

2026-02-20 08:58:22 +01:00

Merge pull request 'Fix getLongTermPrivateKey derivation index hardcoded to 0 (closes #3)' (#8) from clawbot/secret:fix/issue-3 into main

Sign in to join this conversation.