fnox Updates & Release Notes

In fnox 1.42.0, fnox export can export only the secrets you name, and the azure-token lease can authenticate with an Azure managed identity. This release also fixes the AWS SSO login prompt for templated profiles, stops fnox sync --local-file from deleting personal secrets, and updates the bundled TLS root certificates after the eMudhra CA compromise.

Added

Export only named secrets (#1002) by @jdx. fnox export now takes optional KEY arguments. When you pass keys, fnox resolves and exports only those secrets, so it doesn't need to authenticate to providers for the rest of the profile. It still resolves the secrets they depend on for interpolation, but doesn't export them. A named key is exported whatever its env setting, so you don't need --all. An unknown key fails with the same "did you mean" suggestions as fnox get. Format, --output, --dry-run and as_file work the same as before, and running fnox export without keys behaves as it did.

fnox export API_KEY
fnox export --format json DATABASE_URL API_KEY

Managed identity for the azure-token lease (#1003) by @jdx. The lease now accepts the same auth and managed_identity_client_id settings as azure-sm, azure-kms and azure-ac. CI jobs on Azure-hosted runners no longer need to install the Azure CLI and run az login --identity just for the lease. You have to turn managed identity on with auth = "managed-identity"; fnox never tries it on its own. Without it, fnox still uses service principal environment variables and then az/azd. In managed identity mode, fnox doesn't check for az on PATH. Setting managed_identity_client_id without auth = "managed-identity", or using an unknown auth value, is a config error.

[leases.azure-openai-access-token]
type = "azure-token"
scope = "https://ai.azure.com/.default"
env_var = "AI_ACCESS_TOKEN"
auth = "managed-identity"
managed_identity_client_id = "00000000-0000-0000-0000-000000000000" # omit for system-assigned

Fixed

AWS SSO login prompt with templated or secret-based profiles (#998) by @balintant. When profile was a template such as "{{ fnox.profile }}", the aws-kms, aws-ps and aws-sm providers offered to run aws sso login --profile '{{ fnox.profile }}', and that command failed. The prompt now uses the provider's resolved profile, for example aws sso login --profile production. A profile set with profile = { secret = "..." } also gets its resolved name now; before, fnox ran a bare aws sso login. An auth_command you configure still takes precedence.

fnox sync --local-file deleting personal secrets (#1004) by @jdx. When you ran the sync a second time, fnox mistook secrets defined only in fnox.local.toml for cached copies of shared secrets and deleted their source references. Synced entries for these secrets now record local_source = true in their sync block. fnox keeps and refreshes those entries on every sync. Cached copies of shared fnox.toml secrets are still removed when the shared secret is deleted. Existing files work without changes. If this bug already removed one of your secrets, add it back to fnox.local.toml once and it will be kept from then on.

Revoked eMudhra intermediate certificates (#1005) by @jdx. The private keys of eight eMudhra intermediate CA certificates were compromised. fnox now uses rustls-webpki 0.103.16 and webpki-root-certs/webpki-roots 1.0.10, which stop trusting those certificates for HTTPS connections.

Full Changelog: v1.41.0...v1.42.0

💚 Sponsor fnox

fnox is built and maintained by @jdx, an open source developer at entire.io, the title sponsor of his open source work.

If fnox handles secrets or config for you or your team, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep fnox secure, free, and independent.

fnox 1.41.0 adds a gopass provider and lets secret defaults and provider fields use the active profile through Tera templates. fnox exec no longer decrypts env = false secrets that nothing uses, and the AWS SSO login prompt now logs in to the profile your provider is configured with.

Added

• gopass provider (#980) by @jdx. Teams that already keep secrets in gopass can now read them through fnox. fnox reads values with gopass cat, writes them with gopass insert -f (fnox set --provider gopass), and tests the connection with gopass ls --flat. The optional mount setting is added to the front of every secret path. fnox removes one trailing newline from each value and leaves other whitespace alone. Errors tell you whether gopass is missing, the GPG key is locked or unavailable, or the secret path doesn't exist. You can also add the provider with fnox provider add <name> gopass.

  [providers]
  gopass = { type = "gopass", mount = "company" } # mount is optional
  [secrets]
  # read with: gopass cat company/apps/myapp/database_url
  DATABASE_URL = { provider = "gopass", value = "apps/myapp/database_url" }
  

• Profile-aware templates in config (#993) by @jdx. A secret default and literal string provider fields are now rendered as Tera templates if they contain {{, {% or {#. Two variables are available: fnox.profile (the selected profile with the highest priority, or default if none is selected) and fnox.profiles (all selected profiles, lowest priority first). This means you can write values that follow the profile, such as AWS profiles or SST stages, once instead of repeating them for every profile. FNOX_PROFILE is still not exported to child processes.

  [providers.aws]
  type = "aws-ps"
  region = "eu-central-1"
  profile = "{{ fnox.profile }}"
  [secrets]
  SST_STAGE = { default = "{{ fnox.profile }}" }
  

  Templates are rendered before ${NAME} interpolation. A default is only rendered when it's actually used, and only the ${NAME} references left after rendering must exist. So a branch of an {% if %} that isn't taken requires nothing.

  An undefined variable or a syntax error fails with a message that names the field. To keep a marker as literal text, wrap it in {% raw %}...{% endraw %}.

  These fields are not templated: value, description, list fields such as age recipients, and credential_command, which keeps its own template context.

  Check existing configs: a default or provider field that already contains {{, {% or {# as plain text will now be treated as a template. Wrap it in {% raw %} to keep the old value.

• More detailed --help (#990) by @jdx. Every public command now shows a description, examples and links to the relevant guides when you run fnox --help. This is the same content as the CLI reference at fnox.jdx.dev/cli. Flags and behavior are unchanged.

Fixed

• fnox exec no longer resolves unused env = false secrets (#984) by @andersonkrs. Previously, fnox exec resolved every secret in the profile and then removed the env = false ones from the child's environment. With a PIN-protected age identity, each extra decrypt asked for the PIN again. fnox exec now selects secrets the same way as fnox env --json. It resolves only the secrets it injects plus what they depend on: ${NAME} references in defaults, provider secret references such as token = { secret = ... }, and the inputs of selected leases. If a command lease is selected, it still resolves the whole profile. The aws-sts lease's list of inputs now also includes the environment variables for web identity, container credentials and EC2 instance metadata, so those can still be supplied as env = false secrets. The child's environment is the same as before.

• AWS SSO login prompt uses the provider's profile (#991) by @balintant. When authentication fails for an aws-ps, aws-sm or aws-kms provider that sets profile, the default prompt now runs aws sso login --profile instead of a bare aws sso login. Before, the bare command logged in to the default profile and failed if your AWS config had none. The profile is only added when it's a literal value and no auth_command is set. On Windows, it's only added when the name uses ASCII letters, digits, -, _ and ..

Documentation

The guides, landing page, README, provider pages, lease pages and configuration and environment variable references were reorganized and rewritten (#987, #988, #990) by @jdx. This fixes some wrong statements, for example: an earlier import takes precedence over a later one, and imports are not recursive. The sync docs now cover TPM PIN protection and hardware-backed service tokens (#986) by @andersonkrs.

New Contributors

• @balintant made their first contribution in #991

Full Changelog: v1.40.0...v1.41.0

💚 Sponsor fnox

fnox is built and maintained by @jdx, an open source developer at entire.io, the title sponsor of his open source work.

If fnox handles secrets or config for you or your team, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep fnox secure, free, and independent.

fnox 1.40.0 adds custom providers written as Lua plugins, a read-only Kubernetes Secrets provider, 1Password Environments, file-backed plain providers and Bitwarden folder scoping. The daemon now runs on Windows. This release also fixes Azure service principal authentication, repeated hardware PIN prompts for age identities, and fnox set dropping piped values.

Added

Custom providers as Lua plugins (#968)

by @jdx. You can now write a secrets backend that fnox doesn't support as a Lua 5.4 plugin and share it as a git repository. Declare the plugin under [plugins], then use it with type = "lua":

[plugins]
corp = "acme/fnox-plugin-corp#v1.2.0" # git URL or owner/repo, optional #ref
[providers.corp]
type = "lua"
plugin = "corp" # or a path such as ./plugins/corp.lua
[secrets]
DATABASE_URL = { provider = "corp", value = "prod/database-url" }

A plugin is a provider.lua that returns hooks. get is required. get_batch, put, encrypt and test are optional, and the hooks you define decide whether fnox set and fnox import can write to the provider. A provider's options table (string values, which can be secret references) is passed to the plugin as ctx.options. Plugins can use the fnox.http, fnox.json, fnox.cmd, fnox.log and fnox.base64 modules. fnox.auth_error(msg) triggers the provider's auth_command flow.

New commands: fnox plugin install, update, link, ls and uninstall, plus fnox provider add NAME lua --plugin ....

fnox installs a declared plugin the first time a provider uses it (git clone). Plugins go in $FNOX_DATA_DIR/plugins, which defaults to $XDG_DATA_HOME/fnox or ~/.local/share/fnox. Set FNOX_PLUGINS_DIR to use a different location. If a project declares a different source or ref than the installed one, fnox won't load the plugin until you run fnox plugin update <name>.

Plugins run with your user's permissions. Only install plugins from sources you trust, and pin a ref. See docs/providers/lua.md for details.

Kubernetes Secrets provider (#953)

by @jdx. A read-only kubernetes provider reads existing Secrets through the Kubernetes API. It only makes named GET requests and never lists, watches or writes Secrets. A reference can be secret, secret/key or namespace/secret/key. The optional context, namespace, kubeconfig and prefix settings control where it looks, and the FNOX_K8S_CONTEXT environment variable can also select the context. Daemon caching is always disabled for this provider, even with daemon_cache = true.

[providers.kubernetes]
type = "kubernetes"
context = "production"
namespace = "payments"
[secrets]
DATABASE_URL = { provider = "kubernetes", value = "database/url" }

1Password Environments (#955)

by @jdx. The 1password provider can read variables from a 1Password Environment using environment://<environment-id>/<VARIABLE> references. You can mix these with vault item references in the same config. fnox reads each Environment once per provider instance, and a variable missing from the Environment is an error. This needs the beta op CLI with the op environment command.

Read values from a plaintext file with the plain provider (#954)

by @joshbode. The new file and format settings make each secret's value a key to look up in that file. format can be env, shell, json, yaml or toml, and you must set it whenever file is set. A relative path resolves against the config file that declares the provider. The file is read-only, and a missing key counts as a missing secret, so default and if_missing still apply.

[providers.dotenv]
type = "plain"
file = "secrets.env"
format = "env"
[secrets]
API_TOKEN = { provider = "dotenv", value = "SERVICE_TOKEN" }

Bitwarden folder scoping (#965)

by @andersonkrs. The new optional folder setting limits lookups to one Bitwarden folder. For nested folders, use the full path, such as folder = "MyApp/Production". This lets items with the same name exist in different folders. It works with both bw and rbw.

Azure managed identity (#964)

by @jdx. azure-sm, azure-kms and azure-ac accept auth = "managed-identity", with an optional managed_identity_client_id for a user-assigned identity. fnox never tries managed identity on its own; you have to set auth.

Daemon on Windows (#974)

by @jdx. On Windows, the daemon now uses a per-user named pipe where other platforms use a Unix socket, so Windows gets cached secrets too. Only the current user can access the pipe, and both the client and the daemon check the user on the other end. The wire protocol and the fnox-client API are unchanged.

Fixed

Azure service principal environment variables (#964)

by @jdx. Azure providers authenticate as a service principal again when AZURE_TENANT_ID, AZURE_CLIENT_ID and AZURE_CLIENT_SECRET are all set. Without them, fnox falls back to the az/azd login. For sovereign clouds, set AZURE_AUTHORITY_HOST. These variables can also be fnox secrets resolved by fnox exec.

Hardware PIN prompts for age identities (#978)

by @andersonkrs and @jdx. With PIN-protected age identities (age-plugin-tpm --pin, age-plugin-yubikey), a value used by several providers made one command ask for the PIN up to three times. Now a successful decrypt is reused for the rest of the request, so you get one prompt per fnox get, exec or export, or per daemon request. Nothing is kept between requests, and a failed decrypt can be retried.

fnox set with piped stdin and metadata flags (#976)

by @jdx. echo val | fnox set A -d "desc" (or with --default or --if-missing) said it worked but saved no value. fnox now stores the piped value along with the metadata. If stdin is empty, only the metadata is updated, as before.

Changed

fnox import parsing (#954)

by @joshbode. fnox import now accepts the {secrets, metadata} document that fnox export --format json|yaml|toml produces. The env parser now follows Docker Compose dotenv rules for inline comments. For example, PORT=8080 # default now imports as 8080, where it used to keep the comment as part of the value. # without whitespace before it, as in ID=val#ue, and # inside quotes are still part of the value.

New Contributors

• @joshbode made their first contribution in #954
• @andersonkrs made their first contribution in #965

Full Changelog: v1.39.0...v1.40.0

💚 Sponsor fnox

fnox is built and maintained by @jdx, an open source developer at entire.io, the title sponsor of his open source work.

If fnox handles secrets or config for you or your team, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep fnox secure, free, and independent.

Added

fnox 1.39.0 lets other tools, starting with mise, get the same environment that fnox exec would give a command. They can run fnox env --json, or use the new fnox-client crate to read it straight from a running daemon's cache.

fnox env --json (#936) by @jdx. Prints a versioned JSON document describing the environment for a command. It has set (variables), files (as_file contents for the caller to write, so fnox leaves no files behind), remove (variables to unset), missing and leases. Callers apply remove, then set, then files.

fnox env --json --keys DATABASE_URL,GCP_SA_JSON
fnox env --json --describe # list keys and where they can be injected, without resolving anything
--for exec (the default) covers env = true and env = "exec" secrets plus leases. --for shell covers only env = true secrets and runs no leases.
--keys (repeatable, comma-separated) resolves only the listed keys and the secrets they depend on. env = false secrets are never printed.
Errors are also printed as JSON on stdout (config, invalid_keys, resolution) and exit with status 1.
--describe never contacts the daemon, creates leases or prompts. With --keys, it checks the keys up front. Its output includes daemon_enabled.
Resolution works like fnox exec, using the same daemon cache. The full contract is in docs/reference/env-json.md. --json is required for now.

fnox-client crate (#937) by @jdx. A lightweight Rust library (no tokio, fnox-core or provider SDKs) that lets other programs get the fnox env --json document from a running fnox daemon in one Unix-socket round trip. The client is read-only: it never starts the daemon, stores values or triggers provider calls. On a cache miss, the caller should run fnox env --json itself so prompts and hardware-key touches still work. On Windows, the crate builds but always reports that no daemon is available. fnox-client is published alongside fnox with the same version number. To support it, the daemon protocol moves to v6, and the daemon now refuses requests from projects whose config (or FNOX_DAEMON) does not enable it.

Changed

Daemon socket path changed (#937). After you upgrade, the first daemon-enabled command starts a new daemon with an empty cache. The old daemon keeps running until its idle timeout, and fnox daemon clear still reaches it. You don't need to do anything else.

fnox exec now builds its environment the same way as fnox env --json (#936). It behaves the same as before, with one exception: it now removes every out-of-scope profile secret from the child's environment, even ones that weren't resolved.

Full Changelog: v1.38.1...v1.39.0

💚 Sponsor fnox

fnox is built and maintained by @jdx, an open source developer at entire.io, the title sponsor of his open source work.

If fnox handles secrets or config for you or your team, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep fnox secure, free, and independent.

fnox 1.38.1 publishes Windows release binaries again. The v1.37.0 and v1.38.0 releases did not include them.

Fixed

Windows x64 and ARM64 release archives (#934) by @jdx. The Windows release builds for v1.37.0 and v1.38.0 failed while building the bundled OpenSSL, so neither release shipped Windows binaries. The release workflow now builds OpenSSL with the runner's native Perl, and Windows users can download prebuilt binaries again from this release onward. fnox itself has no code changes since v1.38.0.

Full Changelog: v1.38.0...v1.38.1

💚 Sponsor fnox

fnox is built and maintained by @jdx, an open source developer at entire.io, the title sponsor of his open source work.

If fnox handles secrets or config for you or your team, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep fnox secure, free, and independent.

https://entire.io/gh/jdx/fnox/trails/37

🚀 Features

(config) support project .config files by @jdx in #925

(keepass) prompt for database password when unset by @jdx in #912

(provider) add read-only Enpass vault provider by @jdx in #928

📚 Documentation

restrict AI replies on Discussions and Issues and note the instant ban by @jdx in #923

🛡️ Security

(deps) update rust crates by @renovate[bot] in #918

🔍 Other Changes

(entire) store checkpoints in a private repository by @jdx in 9876031

(entire) commit codex session hooks by @jdx in eb8f990

(entire) commit claude session hooks by @jdx in 77df3e4

(entire) restore lower-cost trail findings by @jdx in c7b83a8

(entire) format trail runner configs with prettier by @jdx in #920

limit each contributor to one open draft PR by @jdx in #921

📦️ Dependency Updates

update rust crate usage-rs to v6.12.0 by @renovate[bot] in #914

update jdx/renovate-config action to v1.0.1 by @renovate[bot] in #917

update dependency @anthropic-ai/claude-code to v2.1.278 by @renovate[bot] in #919

fnox 1.36.0 makes the per-prompt shell hook much faster, batches fnox reencrypt by provider, fixes the YubiKey provider, which timed out on every challenge, and ships a fnox agent skill with each release.

Added

fnox agent skill (#910) by @jdx. A new fnox skill teaches coding agents how to set up providers and profiles, inject secrets into commands, and diagnose authentication or resolution failures without printing secret values. The release Packslip now includes the skill, so you can install it with mise (you need a mise version with Packslip skill support):

mise use packslip:github.com/jdx/fnox
mise skills sync --dir .agents/skills

The generated skill links only work on your machine, so keep them out of version control.

Fixed

fnox reencrypt batches encryption by provider (#880) by @davdroman. reencrypt used to encrypt each secret on its own, even when the provider supports batching. For age secrets protected by Touch ID, this meant one unlock per value on an uncached exec. fnox now makes one batch encryption call per provider. You can also use this to merge secrets that were encrypted separately, such as new values added with fnox set:

fnox reencrypt --provider age

Secrets you don't select stay unchanged, source files and profiles are kept as they were, and if a provider batch fails, fnox saves none of that batch's changes.

YubiKey provider no longer times out (#905) by @mufasa71. The yubikey provider always failed with "Timed out waiting for YubiKey response" and the key never blinked for touch. The cause was a wrong checksum on the HMAC-SHA1 challenge, which made the key drop the request. The checksum now matches Yubico's implementations, and fnox set/fnox get work with touch-required slots.

Performance

Faster per-prompt shell hook (#907) by @jdx. When nothing has changed, fnox hook-env -s <shell> (run before every prompt by fnox activate) now exits before the full CLI starts up. This roughly halves wall time (3.7 ms to 1.9 ms in benchmarks) and cuts CPU time by about 4x. Config changes still trigger a full reload. Setting FNOX_SHELL_OUTPUT=debug or RUST_LOG makes the hook take the normal path, so it still explains why it exited.

Faster startup for Linux GNU release binaries (#908) by @jdx. The official Linux GNU release binaries are now linked as non-PIE executables, which saves about 1 ms on every command. Together with #907, an unchanged shell hook drops from about 3.7 ms to 0.78 ms. The tradeoff: ASLR (address randomization) no longer covers fnox's own code and data, though the heap, stack and shared libraries are still randomized. musl, macOS and Windows builds, cargo install, and other source builds are unchanged.

New Contributors

@mufasa71 made their first contribution in #905

Full Changelog: v1.35.3...v1.36.0

💚 Sponsor fnox

fnox is built and maintained by @jdx, an open source developer at entire.io, the title sponsor of his open source work.

If fnox handles secrets or config for you or for your team, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep fnox secure, free, and independent.

Fixes for the shell hook and daemon when a provider is temporarily unavailable, correct handling of import in the global config, a fix for fnox provider test against Azure Key Vault, and shell completion scripts published with each release.

Fixed

Shell hook retries incomplete secret loads (#839) -- @jdx. When the shell hook loaded a credential but a dependent secret failed to resolve (for example, op exiting unsuccessfully during shell startup), the partial result was recorded as an unchanged session and later prompts skipped resolution entirely, even after the provider came back; fnox exec would succeed while the shell stayed incomplete. The hook now records incomplete loads and retries on the next invocation, resuming the normal early exit once everything resolves. The daemon also no longer caches missing values, so a recovered secret is resolved and cached normally instead of leaving a stale miss behind. Note that secrets which are persistently unavailable (including optional ones) are now retried on every prompt, which can add latency and repeat warnings until they resolve; secrets excluded from shell injection (env = false) do not trigger retries. The daemon socket compatibility tag was bumped, so upgraded clients start a fresh daemon rather than reusing an old one that still caches misses.

Daemon cache hits keep provider dependencies available (#838) -- @jdx. With the daemon enabled, a secret whose provider depends on another secret (such as a 1Password provider needing a cached OP_SERVICE_ACCOUNT_TOKEN) could fail to resolve when the credential was a cache hit but the dependent secret was not (e.g. daemon_cache = false). Cached values are now passed through when resolving misses so dependency ordering still works, and only provider-declared environment dependencies are exposed during resolution, so unrelated cached secrets are not leaked into the environment.

Global config import entries are now loaded (#818) -- @JoacoEsteban. fnox get and other commands ignored the import field in ~/.config/fnox/config.toml, so secrets and providers from imported files were only available when passing --config explicitly. Imports are now expanded when the global config is loaded (imports form the base, with the global file merged on top), and fnox config-files lists the imported files as well. A missing global import is reported as an error.

fnox provider test succeeds for Azure Key Vault vaults without the probe secret (#829) -- @any-victor. The azure-sm connection test reads a hard-coded fnox-test-secret, and a valid, accessible vault that did not contain it was reported as a failed connection. A 404 with the SecretNotFound service code is now treated as a successful probe, while 401/403 still report authentication failures and other 404s (including a missing vault) and transport errors still report API failures.

Added

Shell completion scripts shipped with releases (#814) -- @jdx. Native Bash, Zsh, Fish, and PowerShell completion scripts are now generated from the release binary, uploaded as release assets alongside fnox.usage.kdl, and declared as completion resources in the signed packslip so installers such as mise can register completions automatically. The scripts call fnox itself and do not require a separate usage executable.

Changed

Documentation overhaul (#817) -- @jdx. The docs site has been redesigned with task-based navigation, a new landing page, and light/dark themes. Guides for onboarding, providers, configuration, authentication, caching, and migration were rewritten and corrected (for example, the JSON migration example now extracts .secrets before import, and profile examples place if_missing on individual secrets), with new troubleshooting and Passwordstate guides and examples plus related links for every CLI command.

New Contributors

@any-victor made their first contribution in #829

@JoacoEsteban made their first contribution in #818

Full Changelog: v1.35.1...v1.35.2

💚 Sponsor fnox

fnox is built and maintained by @jdx, an open source developer at entire.io, the title sponsor of his open source work.

If fnox handles secrets or config for you or for your team, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep fnox secure, free, and independent.

A small release with no changes to fnox's runtime behavior. The one user-facing improvement is that release downloads can now be verified against a signed provenance manifest; the rest is documentation and internal tooling.

Changed

• Signed packslip published with each release (#807) -- @jdx. Every release now ships a keyless-signed packslip.sigstore.json beside the archives, listing each artifact's sha256/sha512, the bundled executable, host shared-library requirements, and build-provenance attestations, all tied to the github.com/jdx/fnox OIDC identity. Installers can verify a download against that identity rather than a signing key the project would have to hold and rotate. A fnox.usage.kdl CLI spec is also published so consumers can generate completions, man pages, and docs without executing fnox locally.

Full Changelog: v1.35.0...v1.35.1

💚 Sponsor fnox

fnox is built and maintained by @jdx, an open source developer at entire.io, the title sponsor of his open source work.

If fnox handles secrets or config for you or for your team, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps keep fnox secure, free, and independent.

This release introduces selective profile inheritance, letting profiles compose their secrets, providers, and lease backends from other named profiles, alongside a batch of correctness fixes to secret resolution, sync caching, and the background daemon.

Added

Selective profile inheritance (#770) -- @jdx. Named profiles can now declare an ordered inherits list so their configuration is layered from ancestor profiles before the profile itself, with later entries winning on conflicts. Inheritance applies to secrets, providers, lease backends, and default_provider, and supports nested inheritance. Unknown inherited profiles and inheritance cycles are reported as actionable configuration errors, and inherited fnox.<profile>.toml files are discovered automatically.

[profiles.openai.secrets]
OPENAI_API_KEY = { provider = "age", value = "encrypted-key..." }

[profiles.database-local.secrets]
DATABASE_PASSWORD = { provider = "age", value = "encrypted-password..." }

[profiles.api-local]
inherits = ["openai", "database-local"]

fnox -P api-local exec -- ./api

Fixed

Sync refreshes from current sources, not stale caches (#774) -- @davdroman. fnox sync --local-file could resolve secrets from its previously generated local cache instead of the current source configuration, so changes to a tracked provider or value were ignored on refresh. Cached sync entries are now excluded when resolving refresh sources, stale entries (including inherited profiles and both local override filenames) are removed during full refreshes, and ordinary local overrides, providers, profile inheritance, and --no-defaults behavior are preserved.

fnox check batches Age secret resolution (#779) -- @davdroman. check previously resolved each secret separately, repeatedly unwrapping the same shared key for batch-encrypted Age values backed by a hardware or plugin identity, which could require one authorization per secret. Eligible Age-backed secrets are now resolved in batches per provider, unwrapping each shared batch key once, while preserving per-secret errors for invalid ciphertexts.

Background daemon detaches from the client working directory (#795) -- @jdx. Background daemons now start from / instead of inheriting the client's working directory, so the daemon keeps serving requests even after the directory that auto-started it is deleted. Per-request resolution is unchanged, since clients still send their cwd on each request.

Intentional default fallbacks stay quiet (#771) -- @jdx. When a secret uses if_missing: ignore and falls back from a failed provider to a default (including interpolated defaults), the fallback message is now logged at debug instead of warn. Interpolated default resolution also no longer re-runs the already-failed root provider, while still surfacing genuine interpolation cycle errors.

Performance

Skip redundant secret reloads on cd (#766) -- @jdx. fnox hook-env no longer forces a full secret reload on every working-directory change. Sessions now refresh only when the effective config hierarchy or relevant FNOX_* environment variables change, so navigating between directories within the same fnox.toml tree preserves the loaded environment.

Documentation

Docs and CLI help audited against actual behavior (#798) -- @jdx. Every docs page and CLI help string was checked against the code and corrected. Notable fixes include the secret resolution order in how-it-works (provider, then default, then environment), the Bitwarden auth hint (FNOX_BW_SESSION, not FNOX_BW_SESSION_TOKEN), FIDO2/YubiKey setup using a positional type instead of a nonexistent --type flag, http_timeout documented as a duration string, import examples that require --provider and --force, corrected keychain/Linux Secret Service requirements, and README additions for the fido2, yubikey, foks, and keeper-sm providers.

Full Changelog: v1.34.1...v1.35.0

💚 Sponsor fnox

fnox is built and maintained by @jdx, an open source developer at entire.io, the title sponsor of his open source work.

If fnox handles secrets or config for you or your team, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps fnox secure, free, and independent.

A patch release focused on safety and correctness: unknown profiles now fail loudly instead of silently falling back to defaults, dotenv exports survive Docker Compose interpolation, interactive daemon cache misses regain access to your terminal, and macOS release binaries are now notarized.

Fixed

Unknown profiles are rejected (#741) -- @jdx. An active profile that has neither a [profiles.<name>] table nor a matching fnox.<name>.toml overlay now errors (listing the available profiles) instead of silently falling back to top-level secrets, which could leak defaults on a typo. Shell integration (hook-env) also refuses unknown profiles. Creating new profiles via set, import, and provider add still works.

Dotenv export preserves dollar signs (#746) -- @jdx. Secrets containing $ are now emitted in single quotes so Docker Compose no longer interpolates them, falling back to double quotes with $ escaping when needed. Dotenv import was aligned to match: it reassembles multiline single-quoted values, unescapes ', and treats $ in double quotes as a literal dollar sign.

Interactive daemon cache misses resolve in the foreground (#743) -- @jdx. When the daemon misses its cache for an interactive client, the missing keys are now resolved in the foreground so PIN, touch, browser, and auth-command prompts reach the invoking terminal; resolved values are then sent back to the daemon for reuse. Non-interactive callers continue to resolve daemon-side and never prompt.

age batch decryption prompts once (#755) -- @jdx. fnox sync now wraps a single random key with age per batch and encrypts each secret under it, so age (and hardware-backed plugins) only prompt once per sync instead of once per secret. Existing sync caches remain readable, and re-running fnox sync migrates them to the batched format.

Security

Hardened secret injection boundaries (#763) -- @jdx. Secret names must now be valid environment identifiers (^[A-Za-z_][A-Za-z0-9_]*$), enforced when loading, validating, running set, and import, with shell emitters quoting names defensively across Bash, Zsh, Fish, and PowerShell. exec and MCP exec now strip ambient FNOX_AGE_KEY and FNOX_AGE_KEY_FILE before spawning child processes while still injecting explicitly configured secrets.

Changed

macOS release binaries are now notarized (#764) -- @jdx. The signed macOS binary is submitted to Apple's notary service and built with a hardened runtime, so downloads (which carry the quarantine bit) no longer hit the Gatekeeper "cannot be verified" dialog.

Documentation

Generated CLI configuration docs now HTML-encode angle brackets so placeholders like <path> render correctly instead of being parsed as Vue elements (#739) -- @jdx.

Sync docs now call out the golden path and hardware-backed decryption (#748) -- @jdx.

Full Changelog: v1.34.0...v1.34.1

💚 Sponsor fnox

fnox is maintained by @jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools including mise, aube, hk, and more. Keeping fnox secure, maintained, and free is funded by sponsors.

If fnox is handling secrets or config for you or your team, please consider sponsoring at jdx.dev. Sponsorships are what let fnox stay independent and the project keep moving.

This release adds a read-only Keeper Secrets Manager provider and delivers a batch of fixes to file-backed secrets, FIDO2 prompting, and shell integration.

Added

Keeper Secrets Manager provider (#720) -- @jdx. A new read-only keeper-sm provider backed by Keeper's official Rust SDK. Secret values use Keeper notation such as RECORD_UID/field/password. Authentication works from a JSON config file (KSM_CONFIG / FNOX_KEEPER_CONFIG, or the default ~/.keeper/ksm-config.json), with optional one-time-token bootstrap via KSM_TOKEN / FNOX_KEEPER_TOKEN (which must persist to a file-backed config). Batch reads redeem the token once and fetch concurrently, and Keeper environment variables are scrubbed from the proxy's ambient credentials.

DB_PASSWORD = { provider = "keeper-sm", value = "RECORD_UID/field/password" }

fnox set --from-file <path> (#730) -- @jdx. Reads a secret value verbatim from a UTF-8 file without trimming, preserving trailing newlines. This fixes SSH private keys and similar as_file secrets losing their required final newline, which happened because fnox set trims stdin values and shell command substitution strips trailing newlines. The existing echo "x" | fnox set KEY behavior is unchanged; --from-file cannot be combined with a positional value.

fnox set SSH_KEY --from-file ~/.ssh/id_ed25519

Fixed

as_file secrets are cleaned up on shell exit (#724) -- @jdx. Decrypted temp files created for as_file secrets previously lingered because cleanup only ran on a later hook-env refresh. fnox deactivate now removes session-recorded temp files, and a new zsh zshexit hook cleans them up when you close the terminal. Cleanup is scoped to paths under the session's hook temp dir (surviving TMPDIR changes), and nested zsh sessions no longer delete files owned by their parent.

FIDO2 prompts only once per batch (#732) -- @jdx. Resolving multiple FIDO2-protected secrets no longer triggers repeated and delayed PIN/touch prompts. The provider now acquires the hardware HMAC secret once and decrypts all values with it, and device discovery runs before the PIN prompt so missing or multiple-device errors surface without an unusable prompt. Per-secret results and errors are preserved without negatively caching transient hardware failures.

Auth output kept off hook-env stdout (#713) -- @halms. fnox hook-env stdout is evaluated as shell code, so an expired session that triggered reauthentication could cause login progress output to be executed as commands. Auth-command stdout is now routed to stderr while remaining live for interactive logins.

MCP tool list works with strict clients (#727) -- @jdx. tools/list now includes the ttlMs: 0 and cacheScope: "private" cache hints required by the MCP 2026-07-28 schema, so strict clients such as Claude Code can fetch fnox tools again. The existing no-cache behavior is preserved.

Documentation

Documented ${SECRET_NAME} interpolation in default values (#733) -- @arthurfiorette. Explains resolution order across providers, interpolated defaults, literal defaults, and environment variables, plus errors for undefined references and dependency cycles.

New Contributors

@arthurfiorette made their first contribution in #733

Full Changelog: v1.33.1...v1.34.0

💚 Sponsor fnox

fnox is maintained by @jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools including mise, aube, hk, and more. Keeping fnox secure, maintained, and free is funded by sponsors.

If fnox is handling secrets or config for you or for your team, please consider sponsoring at jdx.dev. Sponsorships are what let fnox stay independent and the project keep moving.

A small patch release centered on a fix to fnox set so updates no longer clobber a secret's custom remote key name. The rest is routine dependency and CI maintenance.

Fixed

fnox set preserves an existing remote key name (#712) -- @jdx. When updating a remote-backed secret, fnox set previously resolved the remote key only from --key-name or the environment variable name, overwriting any custom value in your config and writing to the wrong backend object. Now it reuses the existing provider key when one is configured for the same provider, while --key-name still takes highest precedence and the environment key is used as a fallback when creating a secret or switching providers. Inherited parent-config secrets no longer steer a child override.

As part of this fix, the HashiCorp Vault provider's put_secret was reworked to update individual fields via kv patch (preserving sibling fields), pass values through piped stdin so @ and - are treated literally, and correctly handle missing paths, concurrent writers, and soft-deleted KV v2 metadata.

Full Changelog: v1.33.0...v1.33.1

💚 Sponsor fnox

fnox is maintained by @jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools including mise, aube, hk, and more. Keeping fnox secure, maintained, and free is funded by sponsors.

If fnox is handling secrets or config for you or your team, please consider sponsoring at jdx.dev. Sponsorships are what let fnox stay independent and the project keep moving.