jdx/fnox v1.35.2

v1.35.2: Shell hook retries incomplete secret loads, global config imports, Azure Key Vault provider test fix

on GitHub

Fixes for the shell hook and daemon when a provider is temporarily unavailable, correct handling of import in the global config, a fix for fnox provider test against Azure Key Vault, and shell completion scripts published with each release.

Fixed

• Shell hook retries incomplete secret loads (#839) -- @jdx. When the shell hook loaded a credential but a dependent secret failed to resolve (for example, op exiting unsuccessfully during shell startup), the partial result was recorded as an unchanged session and later prompts skipped resolution entirely, even after the provider came back; fnox exec would succeed while the shell stayed incomplete. The hook now records incomplete loads and retries on the next invocation, resuming the normal early exit once everything resolves. The daemon also no longer caches missing values, so a recovered secret is resolved and cached normally instead of leaving a stale miss behind. Note that secrets which are persistently unavailable (including optional ones) are now retried on every prompt, which can add latency and repeat warnings until they resolve; secrets excluded from shell injection (env = false) do not trigger retries. The daemon socket compatibility tag was bumped, so upgraded clients start a fresh daemon rather than reusing an old one that still caches misses.

• Daemon cache hits keep provider dependencies available (#838) -- @jdx. With the daemon enabled, a secret whose provider depends on another secret (such as a 1Password provider needing a cached OP_SERVICE_ACCOUNT_TOKEN) could fail to resolve when the credential was a cache hit but the dependent secret was not (e.g. daemon_cache = false). Cached values are now passed through when resolving misses so dependency ordering still works, and only provider-declared environment dependencies are exposed during resolution, so unrelated cached secrets are not leaked into the environment.

• Global config import entries are now loaded (#818) -- @JoacoEsteban. fnox get and other commands ignored the import field in ~/.config/fnox/config.toml, so secrets and providers from imported files were only available when passing --config explicitly. Imports are now expanded when the global config is loaded (imports form the base, with the global file merged on top), and fnox config-files lists the imported files as well. A missing global import is reported as an error.

• fnox provider test succeeds for Azure Key Vault vaults without the probe secret (#829) -- @any-victor. The azure-sm connection test reads a hard-coded fnox-test-secret, and a valid, accessible vault that did not contain it was reported as a failed connection. A 404 with the SecretNotFound service code is now treated as a successful probe, while 401/403 still report authentication failures and other 404s (including a missing vault) and transport errors still report API failures.

Added

• Shell completion scripts shipped with releases (#814) -- @jdx. Native Bash, Zsh, Fish, and PowerShell completion scripts are now generated from the release binary, uploaded as release assets alongside fnox.usage.kdl, and declared as completion resources in the signed packslip so installers such as mise can register completions automatically. The scripts call fnox itself and do not require a separate usage executable.

Changed

• Documentation overhaul (#817) -- @jdx. The docs site has been redesigned with task-based navigation, a new landing page, and light/dark themes. Guides for onboarding, providers, configuration, authentication, caching, and migration were rewritten and corrected (for example, the JSON migration example now extracts .secrets before import, and profile examples place if_missing on individual secrets), with new troubleshooting and Passwordstate guides and examples plus related links for every CLI command.

New Contributors

• @any-victor made their first contribution in #829
• @JoacoEsteban made their first contribution in #818

Full Changelog: v1.35.1...v1.35.2

💚 Sponsor fnox

fnox is built and maintained by @jdx, an open source developer at entire.io, the title sponsor of his open source work.

If fnox handles secrets or config for you or your team, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep fnox secure, free, and independent.