cmd/incredigo 4.3% -> 34.5%. Extract newRootCmd() as a testability seam so tests
drive the real wired CLI (persistent flags + every subcommand) via SetArgs.
main_test.go: a runCLI harness that captures os.Stdout/os.Stderr around Execute,
plus a fake gopass on PATH + fixture HOME so no command touches the user's real
store or host dotfiles (discovery isolated to --source file). Covers the safety-
critical contracts: rotate --execute refused without INCREDIGO_ALLOW_EXECUTE=1;
backup gate aborts BEFORE any driver runs when the snapshot fails; empty
passphrase rejected with no sealed content left behind; export refuses to
overwrite; unknown sealer rejected. Plus scan/status/worklist happy paths,
migrate --dedupe, and an export -> import round-trip proving byte-exact restore
with no plaintext in the sealed bundle.
discover: add ClearPaths() to reset the file scanner's process-global --path
targets between CLI invocations (a test-binary need; the one-shot CLI never hits
the stale-target accumulation).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
GitHub PATs and Stripe secret keys have no scriptable rotation API (GitHub's
create-token API was removed in 2020; Stripe has no create-key endpoint), so
they belong in the guided change-password layer, not as Rotators. But they
arrive from the env/file scanner as generic Source="env" tokens with no host,
so the worklist showed them as "manual — no web page".
Recognise them by their well-known PUBLIC value prefixes (ghp_/gho_/ghs_/
github_pat_/…, sk_live_/sk_test_/rk_live_/…) at scan time and record a
non-secret Meta["service"] hint — a fixed service NAME, never the secret bytes.
discover.ServiceForSecret does the detection; env.go attaches it for generic
tokens, file.go before Store wipes the buffer. links.HostFor consults the hint
and maps github→github.com / stripe→stripe.com, so the curated change-password
URLs (already in the table) now light up for these credentials.
Leak-safe (service name is derived from a public prefix, not the secret) and
verified by the existing assertNoLeak checks. go build/vet clean; full suite
179 tests pass.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
leetcrypt