Bug: getLongTermPrivateKey hardcodes derivation index 0 for mnemonic path #3

New Issue

clawbot · 2026-02-08T21:01:39+01:00

clawbot commented

2026-02-08 21:01:39 +01:00

Bug

In internal/secret/keychainunlocker.go, the getLongTermPrivateKey() function hardcodes derivation index 0 when deriving the long-term key from a mnemonic:

ltIdentity, err := agehd.DeriveIdentity(envMnemonic, 0)

This ignores the vault's actual DerivationIndex stored in vault-metadata.json. For any vault with a derivation index other than 0 (i.e., the second or subsequent vault created from the same mnemonic), this will derive the wrong long-term key, causing:

Keychain unlocker creation to encrypt the wrong key
Silent data corruption where the unlocker stores a key that doesn't match the vault

Expected Behavior

The function should read the vault's metadata to get the correct DerivationIndex and use it for key derivation.

Affected Code

internal/secret/keychainunlocker.go line ~330 in getLongTermPrivateKey()

## Bug In `internal/secret/keychainunlocker.go`, the `getLongTermPrivateKey()` function hardcodes derivation index `0` when deriving the long-term key from a mnemonic: ```go ltIdentity, err := agehd.DeriveIdentity(envMnemonic, 0) ``` This ignores the vault's actual `DerivationIndex` stored in `vault-metadata.json`. For any vault with a derivation index other than 0 (i.e., the second or subsequent vault created from the same mnemonic), this will derive the **wrong long-term key**, causing: - Keychain unlocker creation to encrypt the wrong key - Silent data corruption where the unlocker stores a key that doesn't match the vault ## Expected Behavior The function should read the vault's metadata to get the correct `DerivationIndex` and use it for key derivation. ## Affected Code `internal/secret/keychainunlocker.go` line ~330 in `getLongTermPrivateKey()`

clawbot referenced a pull request that will close this issue

2026-02-08 21:05:58 +01:00

Fix getLongTermPrivateKey derivation index hardcoded to 0 (closes #3) #8

Sign in to join this conversation.

No Label

No Milestone

No project

No Assignees

1 Participants

Notifications

Due Date

The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: sneak/secret#3