Refuse an existing vault before asking for the mnemonic #177

Merged
clawbot merged 1 commits from fix/151-refuse-existing-vault-before-prompt into next 2026-10-15 01:32:24 +02:00
Collaborator

Fixes #151.

secret init and secret vault create asked for the mnemonic and the unlocker passphrase before finding that the vault already existed, and secret init printed "Initialized secrets manager at" before refusing it.

The checks vault.CreateVault made before writing anything, a valid name and no vault of that name, are now the function vault.CheckNewVaultName. Both commands call it right after taking the state directory lock, before the first prompt. CreateVault still calls it, so it still refuses an existing vault on its own. secret init prints the "Initialized" line together with the rest of its success output.

TestCreateExistingVaultAsksForNothing runs the built binary for both commands on an existing vault, in a new session with no terminal and neither SB_SECRET_MNEMONIC nor SB_UNLOCK_PASSPHRASE set. Before the fix the error was about reading the mnemonic; now it says the vault exists.

TestInitWritesNoBlankLineAfterMnemonic keeps its expected stderr unchanged: the "Initialized" line now comes directly before the empty line and "Default vault created", which used to have the prompts in between.

Judgement call: the same check validates the name, so secret vault create with an invalid name also fails before the prompts.
Judgement call: internal/cli/init.go names the default vault through a new constant, defaultVaultName, since the name is now used twice there and AGENTS.md asks for repeated strings to be constants.

Model: opus-5-5

Fixes https://git.eeqj.de/sneak/secret/issues/151. `secret init` and `secret vault create` asked for the mnemonic and the unlocker passphrase before finding that the vault already existed, and `secret init` printed "Initialized secrets manager at" before refusing it. The checks `vault.CreateVault` made before writing anything, a valid name and no vault of that name, are now the function `vault.CheckNewVaultName`. Both commands call it right after taking the state directory lock, before the first prompt. `CreateVault` still calls it, so it still refuses an existing vault on its own. `secret init` prints the "Initialized" line together with the rest of its success output. `TestCreateExistingVaultAsksForNothing` runs the built binary for both commands on an existing vault, in a new session with no terminal and neither `SB_SECRET_MNEMONIC` nor `SB_UNLOCK_PASSPHRASE` set. Before the fix the error was about reading the mnemonic; now it says the vault exists. `TestInitWritesNoBlankLineAfterMnemonic` keeps its expected stderr unchanged: the "Initialized" line now comes directly before the empty line and "Default vault created", which used to have the prompts in between. Judgement call: the same check validates the name, so `secret vault create` with an invalid name also fails before the prompts. Judgement call: `internal/cli/init.go` names the default vault through a new constant, `defaultVaultName`, since the name is now used twice there and `AGENTS.md` asks for repeated strings to be constants. Model: opus-5-5
clawbot added the needs-review label 2026-10-15 00:23:17 +02:00
clawbot self-assigned this 2026-10-15 00:23:17 +02:00
clawbot added 1 commit 2026-10-15 00:33:49 +02:00
`secret init` and `secret vault create` asked for the mnemonic and the
unlocker passphrase, and `secret init` printed "Initialized secrets
manager at", before refusing a vault that already exists. The check
`vault.CreateVault` made before writing is now `vault.CheckNewVaultName`,
which both commands call while holding the state directory lock, before
the first prompt; `CreateVault` still calls it. `secret init` prints the
"Initialized" line only once the vault is created, so
`TestMnemonicNotReadNamesOnlyMnemonic` no longer expects it.

Judgement call: the same check validates the name, so `secret vault
create` with an invalid name also fails before the prompts.

Model: opus-5-5
clawbot force-pushed fix/151-refuse-existing-vault-before-prompt from dd08f6f51e to f91dba85cd 2026-10-15 00:33:49 +02:00 Compare
Author
Collaborator

Review passed.

Model: opus-5-5

Review passed. Model: opus-5-5
clawbot merged commit 13c7721bad into next 2026-10-15 01:32:24 +02:00
clawbot deleted branch fix/151-refuse-existing-vault-before-prompt 2026-10-15 01:32:25 +02:00
Sign in to join this conversation.
No Reviewers
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: sneak/secret#177