This release introduces selective profile inheritance, letting profiles compose their secrets, providers, and lease backends from other named profiles, alongside a batch of correctness fixes to secret resolution, sync caching, and the background daemon.

Added

Selective profile inheritance (#770) -- @jdx. Named profiles can now declare an ordered inherits list so their configuration is layered from ancestor profiles before the profile itself, with later entries winning on conflicts. Inheritance applies to secrets, providers, lease backends, and default_provider, and supports nested inheritance. Unknown inherited profiles and inheritance cycles are reported as actionable configuration errors, and inherited fnox.<profile>.toml files are discovered automatically.

[profiles.openai.secrets]
OPENAI_API_KEY = { provider = "age", value = "encrypted-key..." }

[profiles.database-local.secrets]
DATABASE_PASSWORD = { provider = "age", value = "encrypted-password..." }

[profiles.api-local]
inherits = ["openai", "database-local"]

fnox -P api-local exec -- ./api

Fixed

Sync refreshes from current sources, not stale caches (#774) -- @davdroman. fnox sync --local-file could resolve secrets from its previously generated local cache instead of the current source configuration, so changes to a tracked provider or value were ignored on refresh. Cached sync entries are now excluded when resolving refresh sources, stale entries (including inherited profiles and both local override filenames) are removed during full refreshes, and ordinary local overrides, providers, profile inheritance, and --no-defaults behavior are preserved.

fnox check batches Age secret resolution (#779) -- @davdroman. check previously resolved each secret separately, repeatedly unwrapping the same shared key for batch-encrypted Age values backed by a hardware or plugin identity, which could require one authorization per secret. Eligible Age-backed secrets are now resolved in batches per provider, unwrapping each shared batch key once, while preserving per-secret errors for invalid ciphertexts.

Background daemon detaches from the client working directory (#795) -- @jdx. Background daemons now start from / instead of inheriting the client's working directory, so the daemon keeps serving requests even after the directory that auto-started it is deleted. Per-request resolution is unchanged, since clients still send their cwd on each request.

Intentional default fallbacks stay quiet (#771) -- @jdx. When a secret uses if_missing: ignore and falls back from a failed provider to a default (including interpolated defaults), the fallback message is now logged at debug instead of warn. Interpolated default resolution also no longer re-runs the already-failed root provider, while still surfacing genuine interpolation cycle errors.

Performance

Skip redundant secret reloads on cd (#766) -- @jdx. fnox hook-env no longer forces a full secret reload on every working-directory change. Sessions now refresh only when the effective config hierarchy or relevant FNOX_* environment variables change, so navigating between directories within the same fnox.toml tree preserves the loaded environment.

Documentation

Docs and CLI help audited against actual behavior (#798) -- @jdx. Every docs page and CLI help string was checked against the code and corrected. Notable fixes include the secret resolution order in how-it-works (provider, then default, then environment), the Bitwarden auth hint (FNOX_BW_SESSION, not FNOX_BW_SESSION_TOKEN), FIDO2/YubiKey setup using a positional type instead of a nonexistent --type flag, http_timeout documented as a duration string, import examples that require --provider and --force, corrected keychain/Linux Secret Service requirements, and README additions for the fido2, yubikey, foks, and keeper-sm providers.

Full Changelog: v1.34.1...v1.35.0

💚 Sponsor fnox

fnox is built and maintained by @jdx, an open source developer at entire.io, the title sponsor of his open source work.

If fnox handles secrets or config for you or your team, please consider becoming an individual or company sponsor. Your support funds ongoing development and helps fnox secure, free, and independent.

A patch release focused on safety and correctness: unknown profiles now fail loudly instead of silently falling back to defaults, dotenv exports survive Docker Compose interpolation, interactive daemon cache misses regain access to your terminal, and macOS release binaries are now notarized.

Fixed

Unknown profiles are rejected (#741) -- @jdx. An active profile that has neither a [profiles.<name>] table nor a matching fnox.<name>.toml overlay now errors (listing the available profiles) instead of silently falling back to top-level secrets, which could leak defaults on a typo. Shell integration (hook-env) also refuses unknown profiles. Creating new profiles via set, import, and provider add still works.

Dotenv export preserves dollar signs (#746) -- @jdx. Secrets containing $ are now emitted in single quotes so Docker Compose no longer interpolates them, falling back to double quotes with $ escaping when needed. Dotenv import was aligned to match: it reassembles multiline single-quoted values, unescapes ', and treats $ in double quotes as a literal dollar sign.

Interactive daemon cache misses resolve in the foreground (#743) -- @jdx. When the daemon misses its cache for an interactive client, the missing keys are now resolved in the foreground so PIN, touch, browser, and auth-command prompts reach the invoking terminal; resolved values are then sent back to the daemon for reuse. Non-interactive callers continue to resolve daemon-side and never prompt.

age batch decryption prompts once (#755) -- @jdx. fnox sync now wraps a single random key with age per batch and encrypts each secret under it, so age (and hardware-backed plugins) only prompt once per sync instead of once per secret. Existing sync caches remain readable, and re-running fnox sync migrates them to the batched format.

Security

Hardened secret injection boundaries (#763) -- @jdx. Secret names must now be valid environment identifiers (^[A-Za-z_][A-Za-z0-9_]*$), enforced when loading, validating, running set, and import, with shell emitters quoting names defensively across Bash, Zsh, Fish, and PowerShell. exec and MCP exec now strip ambient FNOX_AGE_KEY and FNOX_AGE_KEY_FILE before spawning child processes while still injecting explicitly configured secrets.

Changed

macOS release binaries are now notarized (#764) -- @jdx. The signed macOS binary is submitted to Apple's notary service and built with a hardened runtime, so downloads (which carry the quarantine bit) no longer hit the Gatekeeper "cannot be verified" dialog.

Documentation

Generated CLI configuration docs now HTML-encode angle brackets so placeholders like <path> render correctly instead of being parsed as Vue elements (#739) -- @jdx.

Sync docs now call out the golden path and hardware-backed decryption (#748) -- @jdx.

Full Changelog: v1.34.0...v1.34.1

💚 Sponsor fnox

fnox is maintained by @jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools including mise, aube, hk, and more. Keeping fnox secure, maintained, and free is funded by sponsors.

If fnox is handling secrets or config for you or your team, please consider sponsoring at jdx.dev. Sponsorships are what let fnox stay independent and the project keep moving.

This release adds a read-only Keeper Secrets Manager provider and delivers a batch of fixes to file-backed secrets, FIDO2 prompting, and shell integration.

Added

Keeper Secrets Manager provider (#720) -- @jdx. A new read-only keeper-sm provider backed by Keeper's official Rust SDK. Secret values use Keeper notation such as RECORD_UID/field/password. Authentication works from a JSON config file (KSM_CONFIG / FNOX_KEEPER_CONFIG, or the default ~/.keeper/ksm-config.json), with optional one-time-token bootstrap via KSM_TOKEN / FNOX_KEEPER_TOKEN (which must persist to a file-backed config). Batch reads redeem the token once and fetch concurrently, and Keeper environment variables are scrubbed from the proxy's ambient credentials.

DB_PASSWORD = { provider = "keeper-sm", value = "RECORD_UID/field/password" }

fnox set --from-file <path> (#730) -- @jdx. Reads a secret value verbatim from a UTF-8 file without trimming, preserving trailing newlines. This fixes SSH private keys and similar as_file secrets losing their required final newline, which happened because fnox set trims stdin values and shell command substitution strips trailing newlines. The existing echo "x" | fnox set KEY behavior is unchanged; --from-file cannot be combined with a positional value.

fnox set SSH_KEY --from-file ~/.ssh/id_ed25519

Fixed

as_file secrets are cleaned up on shell exit (#724) -- @jdx. Decrypted temp files created for as_file secrets previously lingered because cleanup only ran on a later hook-env refresh. fnox deactivate now removes session-recorded temp files, and a new zsh zshexit hook cleans them up when you close the terminal. Cleanup is scoped to paths under the session's hook temp dir (surviving TMPDIR changes), and nested zsh sessions no longer delete files owned by their parent.

FIDO2 prompts only once per batch (#732) -- @jdx. Resolving multiple FIDO2-protected secrets no longer triggers repeated and delayed PIN/touch prompts. The provider now acquires the hardware HMAC secret once and decrypts all values with it, and device discovery runs before the PIN prompt so missing or multiple-device errors surface without an unusable prompt. Per-secret results and errors are preserved without negatively caching transient hardware failures.

Auth output kept off hook-env stdout (#713) -- @halms. fnox hook-env stdout is evaluated as shell code, so an expired session that triggered reauthentication could cause login progress output to be executed as commands. Auth-command stdout is now routed to stderr while remaining live for interactive logins.

MCP tool list works with strict clients (#727) -- @jdx. tools/list now includes the ttlMs: 0 and cacheScope: "private" cache hints required by the MCP 2026-07-28 schema, so strict clients such as Claude Code can fetch fnox tools again. The existing no-cache behavior is preserved.

Documentation

Documented ${SECRET_NAME} interpolation in default values (#733) -- @arthurfiorette. Explains resolution order across providers, interpolated defaults, literal defaults, and environment variables, plus errors for undefined references and dependency cycles.

New Contributors

@arthurfiorette made their first contribution in #733

Full Changelog: v1.33.1...v1.34.0

💚 Sponsor fnox

fnox is maintained by @jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools including mise, aube, hk, and more. Keeping fnox secure, maintained, and free is funded by sponsors.

If fnox is handling secrets or config for you or for your team, please consider sponsoring at jdx.dev. Sponsorships are what let fnox stay independent and the project keep moving.

A small patch release centered on a fix to fnox set so updates no longer clobber a secret's custom remote key name. The rest is routine dependency and CI maintenance.

Fixed

fnox set preserves an existing remote key name (#712) -- @jdx. When updating a remote-backed secret, fnox set previously resolved the remote key only from --key-name or the environment variable name, overwriting any custom value in your config and writing to the wrong backend object. Now it reuses the existing provider key when one is configured for the same provider, while --key-name still takes highest precedence and the environment key is used as a fallback when creating a secret or switching providers. Inherited parent-config secrets no longer steer a child override.

As part of this fix, the HashiCorp Vault provider's put_secret was reworked to update individual fields via kv patch (preserving sibling fields), pass values through piped stdin so @ and - are treated literally, and correctly handle missing paths, concurrent writers, and soft-deleted KV v2 metadata.

Full Changelog: v1.33.0...v1.33.1

💚 Sponsor fnox

fnox is maintained by @jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools including mise, aube, hk, and more. Keeping fnox secure, maintained, and free is funded by sponsors.

If fnox is handling secrets or config for you or your team, please consider sponsoring at jdx.dev. Sponsorships are what let fnox stay independent and the project keep moving.

A small release that adds custom field support to the Bitwarden provider, plus a documentation cleanup for personal age-based sync. The rest of the release is routine dependency and CI maintenance.

Added

Bitwarden custom field support (#690) -- @jdx. In addition to the standard username, password, notes, uri, and totp fields, any other field name in a item/field reference is now resolved as a custom field. With the default bw backend, fnox fetches the full item JSON and extracts the matching field (case-sensitive); with the rbw backend it uses the --field flag.

API_KEY = { provider = "bitwarden", value = "Database/API Key" }

Fixed

Bitwarden custom field names containing slashes (#693) -- @jdx. References now split only on the first /, so custom field names such as Database/API/Key resolve correctly. This also removes the previous "too many slashes" error for references with more than one /.

Documentation

Clarified personal age provider setup for sync (#692) -- @jdx. The sync guide now uses a dedicated sync-age provider with the --local-file flag, corrects the invalid fnox set --provider age setup step, explains how provider definitions replace by name rather than deep-merging, and distinguishes a personal sync cache from team-encrypted secrets in git.

Full Changelog: v1.32.0...v1.33.0

💚 Sponsor fnox

fnox is maintained by @jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools including mise, aube, hk, and more. Keeping fnox secure, maintained, and free is funded by sponsors.

If fnox is handling secrets or config for you or your team, please consider sponsoring at jdx.dev. Sponsorships are what let fnox stay independent and the project keep moving.

A feature-packed release adding a destination-scoped credential proxy, a process-replacement mode for exec, a new Azure App Configuration provider, and IAM role assumption for the AWS providers, plus a fix to how global config layers under explicit --config paths.

Highlights

New ways to keep real secrets out of workloads: a credential proxy that brokers HTTPS requests without exposing secret values, and an exec --replace mode for clean environment-only execution.

Broader cloud coverage: a read-only Azure App Configuration provider and cross-account IAM role assumption in the AWS providers.

Added

Credential proxy (#667) -- @jdx

A new [proxy] configuration and fnox proxy command let agent-style workloads call external APIs without ever receiving real secret values in their environment. fnox runs an ephemeral loopback TLS interception proxy that substitutes credentials into allowed request headers only for destinations that match your rules, and redacts reflected secret values from responses.

fnox proxy rules # inspect the effective policy

fnox proxy run -- ./agent # run a command through the local proxy

Rules match on domain, HTTP method, path globs, and headers, with strict (block-by-default) or permissive egress. The child environment is scrubbed of profile secrets and ambient provider credentials, redirects and ambient upstream proxies are blocked, and overlay configs replace [proxy] wholesale so layered rules cannot silently broaden authority. This is an intentionally narrow first pass: OS sandboxing is not yet included (same-user processes can bypass proxy env vars), interception is HTTPS on port 443 over HTTP/1.1, credential substitution is header-only, and responses over 10 MiB are rejected.

fnox exec --replace process replacement mode (#654) -- @davdroman

On Unix-like systems, fnox exec --replace runs your command via process replacement so it keeps the same PID and receives signals directly, instead of fnox staying resident as a parent.

fnox exec --replace -- ./app

Because replacement prevents post-command cleanup, file-based secrets and credential leases are rejected up front. Ambient FNOX_AGE_KEY and FNOX_AGE_KEY_FILE values are omitted while explicitly selected secrets with those names are still passed through, and inherited ignored SIGINT/SIGTERM dispositions are preserved.

Azure App Configuration provider (azure-ac) (#659) -- @jmoreno11

A read-only provider for Azure App Configuration, the non-secret half of Azure's config surface (endpoints, feature toggles, tuning values) that complements the existing azure-sm Key Vault provider. Supports optional label (which maps naturally onto profiles) and prefix, using the same DeveloperToolsCredential auth as azure-sm with no new dependencies. Configure it with your App Configuration endpoint and an optional label:

[profiles.prod.providers]
appconfig = { type = "azure-ac", endpoint = "<your-appconfig-endpoint>", label = "prod" }

IAM role assumption in the AWS providers (#671) -- @halms

aws-sm, aws-ps, and aws-kms now accept an optional role_arn. When set, fnox calls sts:AssumeRole using the credentials from profile (or the default chain) and uses the result for every request — enabling the common "log in with this SSO profile, read secrets as that role" cross-account setup. aws-kms also gains the profile field that the other two already had, and malformed role ARNs are rejected before any AWS call.

[providers.sm]
type = "aws-sm"
region = "eu-west-1"
profile = "sso-dev"
role_arn = "arn:aws:iam::123456789012:role/secrets-reader"

Fixed

Global config now layers under explicit --config paths (#651) -- @jdx

Previously, pointing -c/--config at anything other than a bare default filename silently skipped the global config and ignored that file's own import = [...], while fnox config-files listed files that were never actually loaded. An explicit path now loads that file, its imports, and the global config underneath it, and fnox config-files reflects the path loading actually takes. Note: fnox -c custom.toml sync -p <provider> can now pull globally-declared secrets into the custom file, consistent with discovered configs. For full isolation, point FNOX_CONFIG_DIR at a directory with no config.toml.

New Contributors

@jmoreno11 made their first contribution in #659

@davdroman made their first contribution in #654

@halms made their first contribution in #671

Full Changelog: v1.31.1...v1.32.0

💚 Sponsor fnox

fnox is maintained by @jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools including mise, aube, hk, and more. Keeping fnox secure, maintained, and free is funded by sponsors.

If fnox is handling secrets or config for you or your team, please consider sponsoring at jdx.dev. Sponsorships are what let fnox stay independent and the project keep moving.

A small maintenance release. There are no new features or bug fixes in v1.31.1 — it consists entirely of dependency updates and internal tooling changes.

Changed

Routine dependency bumps across the runtime and build stack, including tokio, rustls, clap, regex, toml_edit, keepass, google-cloud-secretmanager-v1, apple-native-keyring-store, and others, by @renovate.

Cargo now uses MSRV-aware dependency resolution (incompatible-rust-versions = "fallback") so updates prefer versions compatible with fnox's declared minimum Rust version, keeping the project buildable for distro and nixpkgs packagers (#627) -- @jdx.

Full Changelog: v1.31.0...v1.31.1

💚 Sponsor fnox

fnox is maintained by @jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools including mise, aube, hk, and more. Keeping fnox secure, maintained, and free is funded by sponsors.

If fnox is handling secrets or config for you or for your team, please consider sponsoring at jdx.dev. Sponsorships are what let fnox stay independent and the project keep moving.

A small release headlined by composable multi-profile support, plus a friendlier Proton Pass error when your session is locked.

Added

Compose multiple active profiles (#605) -- @gaojunran

You can now activate more than one profile at a time as an ordered overlay stack. The top-level config is the base, and each profile is layered on top in order, with later profiles overriding earlier ones on key conflicts.

# Repeatable flags
fnox -P aws -P prod exec -- ./app
# Comma-separated
fnox -P aws,prod exec -- ./app
# Environment variable
FNOX_PROFILE=aws,prod fnox exec -- ./app

The effective config resolves as top-level config + profiles.aws + profiles.prod, and fnox.<profile>.toml files are loaded for each active profile in order. Write commands (set, remove, import, sync, provider add/remove) target the last active profile by default, and the full profile stack is factored into the daemon's request protocol, socket path, and cache key. Library users get a new with_profiles() builder.

Fixed

Proton Pass suggests unlocking a locked session (#612) -- @TyceHerrman

pass-cli reports locked sessions as "Session is locked. Please unlock your session and try again.", but fnox previously fell through to a generic configuration/authentication hint. Locked sessions are now recognized and fnox points you at pass-cli session unlock instead of offering the configured login command. All other Proton Pass error mappings (login, key storage, agent reason, missing fields, missing secrets, generic CLI errors) are unchanged.

New Contributors

@gaojunran made their first contribution in #605

@syhol made their first contribution in #614

Full Changelog: v1.30.0...v1.31.0

💚 Sponsor fnox

fnox is maintained by @jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools including mise, aube, hk, and more. Keeping fnox secure, maintained, and free is funded by sponsors.

If fnox is handling secrets or config for you or your team, please consider sponsoring at jdx.dev. Sponsorships are what let fnox stay independent and the project keep moving.

A focused release that hardens fnox's secret exposure model with an exec-only env mode, expands Proton Pass authentication for CI and agent use, and cleans up fnox export defaults.

Added

Exec-only env mode and top-level env default (#604) -- @jdx

The per-secret env field gains a new "exec" state, and a new top-level env sets the default for all secrets. This lets you keep secrets out of the interactive shell -- where AI coding agents and other inherited processes would see them -- while still injecting them into fnox exec subprocesses.

env
shell integration / fnox export
fnox exec
fnox get
true (default)
yes
yes
yes
"exec" (new)
no
yes
yes
false
no
no
yes

One line flips a project to default-deny:

env = "exec" # nothing enters the interactive shell

[secrets]
DATABASE_URL = { provider = "age", value = "..." } # exec-only (inherited)
PS1_TOKEN = { provider = "age", value = "...", env = true } # explicit opt-in back

Per-secret env overrides the top-level default, and the default rides normal config merge order so fnox.local.toml can tighten or loosen it per machine. Existing configs parse with identical semantics.

fnox doctor also warns when a shell-hiding top-level env is combined with an ambient FNOX_AGE_KEY in the environment, since that would undermine the whole posture. This eliminates ambient exposure but is not a hard boundary -- anything that can run commands in your shell can still call fnox get/fnox exec itself.

Proton Pass PAT and agent auth (#598) -- @TyceHerrman

The proton-pass provider now supports headless authentication via personal access tokens and audited agent access, so CI and scripted jobs no longer need an interactive pass-cli login --interactive.

export PROTON_PASS_PERSONAL_ACCESS_TOKEN="pst_token::key"
pass-cli login

New provider config field:

[providers.protonpass]
type = "proton-pass"
vault = "Personal"
agent_reason = "fnox secret retrieval" # for audited agent access

fnox now passes through the full set of PROTON_PASS_* variables (PAT, agent reason, session dir, key provider, encryption key, Linux keyring) plus matching FNOX_PROTON_PASS_* aliases, and includes them in the daemon config fingerprint so cached values invalidate when auth env changes. Error messages point at the right knob when a session, key, or agent reason is missing.

Fixed

Daemon respects daemon_cache = false for default-provider secrets (#599) -- @TyceHerrman

The daemon's cache check only consulted a secret's explicit provider, so secrets that resolved through default_provider skipped the effective provider's daemon_cache setting. Cache decisions now use the effective provider in all paths (explicit provider, default_provider, and auto-selection), so opting out of daemon caching actually opts you out.

fnox export no longer leaks env = false secrets (#604) -- @jdx

fnox export previously resolved with include_env_false=true and never filtered on env, so secrets marked "only accessible via fnox get" were still included in export output -- and picked up by tools like mise-env-fnox that consume fnox export --format json. Export now follows the same shell semantics as hook-env. Pass --all for the full dump when you want it explicitly.

Changed

fnox export omits the metadata header by default (#603) -- @jdx

The env and shell export formats no longer emit the # Exported from profile: ... / # Total secrets: ... comment block by default -- output is now clean assignment lines only, easier to source or feed into other tooling. Pass --header to restore the previous behavior:

fnox export --format env --header

JSON, YAML, and TOML output are unchanged.

Redesigned logo (#595) -- @jdx

New fox-in-keyhole mark matching the fnox.jdx.dev site theme.

Full Changelog: v1.29.0...v1.30.0

💚 Sponsor fnox

fnox is maintained by @jdx, an open source developer for entire.io, the title sponsor of the jdx.dev open source tools including mise, aube, hk, and more. Keeping fnox secure, maintained, and free is funded by sponsors.

If fnox is handling secrets or config for you or your team, please consider sponsoring at jdx.dev. Sponsorships are what let fnox stay independent and the project keep moving.

Added

Age plugin recipients and identities (#569) -- @nightvisi0n

The age provider now supports age plugins, so hardware-backed and specialty recipients work end to end. That includes age-plugin-yubikey (YubiKey/PIV), age-plugin-se (Apple Secure Enclave), age-plugin-tpm, and friends.

Previously a plugin recipient like age1yubikey1... failed at config load with Failed to parse recipient ... incorrect HRP because the provider only understood native X25519 and SSH recipients. It now parses age::plugin::Recipient values, spawns the matching age-plugin-* binary for encryption, and attaches UiCallbacks to identity files so AGE-PLUGIN-* identities get PIN/touch prompts on decrypt.

Nix flake (#583) -- @o-az

fnox is now packaged as a Nix flake. Consume it from another flake:

inputs.fnox.url = "github:jdx/fnox";

...then reference inputs.fnox.packages.${system}.default

Or run it directly without installing:

nix run github:jdx/fnox

The flake also exposes a devShells.default with cargo, clippy, and rustfmt.

Fixed

Defaults are used when a provider is inactive (#572) -- @jdx

If a secret declared a default and the active profile did not have the referenced provider configured, resolution would fail instead of falling back. Single-secret and batch resolution now share the same fallback path, so fnox get and fnox exec return the default (including interpolated ${...} defaults that reference other secrets resolved in the same batch) when the provider is missing, batch fetch fails, or non-interactive auth aborts. A provider value still wins when the provider succeeds; cycles between fallback defaults are rejected explicitly.

Config paths resolve relative to the config file that declares them (#582) -- @jdx

Filesystem paths in provider configuration are now interpreted against the config file that defines them, not the current working directory. This matters especially for nested/imported configs, where a parent fnox.toml could point at keys/age.key and a child config in a subdirectory would silently miss it.

Affected fields:

age.key_file

keepass.database, keepass.keyfile

password-store.store_dir

foks.home

imports, and paths reported by fnox config-files

Rules:

Paths in config files resolve relative to the declaring file, and ~ expands to the user home.

Absolute paths are used unchanged.

CLI path arguments still resolve against the current working directory.

Environment-variable paths keep their existing behavior.

fnox daemon clear clears every running daemon (#581) -- @jdx

fnox daemon clear previously only talked to the daemon socket for the current profile, so caches on daemons started under other profiles were left stale. It now scans the daemon runtime directory, sends Clear to every live profile-scoped daemon, and ignores stale sockets during the sweep. When no live daemon responds, you still get the familiar "daemon not running" error.

Changed

Faster batch reads from GCP Secret Manager (#580) -- @nils-degroot

google-secret-manager previously used the default batch implementation, which created a fresh client per secret. The provider now implements get_secrets_batch directly: a single client is reused across the batch and up to 10 secrets are fetched concurrently, which noticeably reduces latency for configs with many GCP secrets. Missing payloads and non-UTF-8 values are handled more explicitly, and client-creation errors surface provider-specific auth guidance.

New Contributors

@nightvisi0n made their first contribution in #569

@o-az made their first contribution in #583

@nils-degroot made their first contribution in #580

Full Changelog: v1.28.0...v1.29.0

💚 Sponsor fnox

fnox is maintained by @jdx under en.dev — a small independent studio building developer tooling like mise, aube, hk, and more. Keeping fnox secure, maintained, and free is funded by sponsors.

If fnox is handling secrets or config for you or your team, please consider sponsoring at en.dev. Sponsorships are what let fnox stay independent and the project keep moving.

A small feature release that adds a global --non-interactive mode for fnox exec and other resolve paths, so CI and scripted runs can rely on cached credentials and fail fast instead of hanging on auth prompts or device flows.

Added

Global --non-interactive / FNOX_NON_INTERACTIVE (#565) -- @jdx

A new top-level flag (and matching env var) disables prompts and browser-based auth flows for the entire invocation. It is propagated through the daemon protocol, so daemon-backed resolution behaves the same way as direct resolution -- including when fnox auto-starts daemon serve to handle the request.

fnox --non-interactive exec -- ./run-tests.sh
# or
FNOX_NON_INTERACTIVE=1 fnox exec -- ./run-tests.sh

In non-interactive mode:

should_prompt_auth no longer prompts, regardless of TTY or prompt_auth config.

The github-oauth lease backend still happily reuses cached and refreshable tokens, but fails immediately with a clear interactive auth required for GitHub OAuth device authorization error instead of printing a user code and polling. The error hint points you at running fnox lease create <lease-name> from an interactive terminal first.

This is intended for CI jobs, cron tasks, and other scripted runs where a hung prompt is worse than a fast failure.

Fixed

CI now installs Vault as the qualified hashicorp/tap/vault formula on macOS so Homebrew treats it as an explicitly chosen tap formula under current tap-trust rules (#567) -- @jdx

Full Changelog: v1.27.1...v1.28.0

💚 Sponsor fnox

fnox is maintained by @jdx under en.dev — a small independent studio building developer tooling like mise, aube, hk, and more. Keeping fnox secure, maintained, and free is funded by sponsors.

If fnox is handling secrets or config for you or your team, please consider sponsoring at en.dev. Sponsorships are what let fnox stay independent and the project keep moving.

This release adds three pieces aimed at making fnox faster, safer, and easier to compose: an opt-in per-user daemon for cached secret resolution, a new fnox scan command for finding plaintext secrets before they leak, and ${VAR} interpolation for secret defaults. It also includes a small documentation pass and CI housekeeping.

Added

Per-user secret resolver daemon (#550) -- @jdx

fnox now has an opt-in daemon that keeps resolved secrets in memory for your user session and serves repeated read-oriented resolutions over a same-user Unix socket. It is intended for configs backed by remote providers such as 1Password, Bitwarden, AWS Secrets Manager, or Vault where repeated fnox get, fnox exec, shell hooks, TUI refreshes, or MCP calls can otherwise feel slow.

Enable it with a top-level config block:

[daemon]
enabled = true
idle_timeout = "8h"

New lifecycle commands are available under fnox daemon:

fnox daemon start
fnox daemon status
fnox daemon clear
fnox daemon stop

Implementation details worth knowing:

• Daemon-backed resolution is used by read-oriented commands such as get, exec, export, hook-env, list --values, check, tui, mcp, and ci-redact.
• Mutation and admin flows still resolve directly, including set, remove, sync, reencrypt, edit, provider, and lease create.
• The cache is memory-only and is invalidated when relevant config files, profile settings, provider references, post-processing options, or provider environment variables change.
• fnox check can connect through the daemon, but still bypasses cached values so it validates current provider state.
• Use --no-daemon, FNOX_DAEMON=off, or daemon_cache = false on a provider or secret when you need direct resolution.
• The daemon is Unix-first: it uses a Unix domain socket, strict runtime-directory permissions, and same-user peer verification rather than TCP.

fnox scan secret detection (#548) -- @jdx

fnox scan [DIR] is now implemented as a read-only repository scanner for common plaintext secrets. It walks the target tree with gitignore-aware traversal, skips common VCS/build/vendor directories and large or binary files, and reports high-signal patterns with redacted evidence.

Supported output modes include human-readable output, JSON, and quiet file-list output:

fnox scan
fnox scan --format json
fnox scan --quiet src
fnox scan --ignore 'fixtures/**'

The scanner reports line and column, detector name, severity, and a redacted snippet. Findings return a scan-specific non-zero error so the command can be used in automation.

Secret default interpolation (#549) -- @jdx

Secret default strings can now reference other secrets with ${SECRET_NAME} syntax. This makes fallback-only configs easier to compose without duplicating literals, for example when building a local connection URL from sibling defaults.

Provider-backed values still win over defaults, and interpolation only runs when the default value is actually used. Batch resolution now includes default references in dependency ordering, so composed defaults are resolved order-independently. fnox also reports config errors for undefined references, empty ${} placeholders, and interpolation cycles.

Documentation

Sponsor links (#543) -- @jdx

Documentation now links to the full sponsor list.

Contribution guidance (#545) -- @jdx

The contribution docs now clarify what kinds of changes are a good fit for the project.

Other Changes

Shared CodeRabbit config (#546) -- @jdx

CI now uses the shared repository review configuration.

Full Changelog: v1.26.0...v1.27.0

💚 Sponsor fnox

fnox is maintained by @jdx under en.dev — a small independent studio building developer tooling like mise, aube, hk, and more. Keeping fnox secure, maintained, and free is funded by sponsors.

If fnox is handling secrets or config for you or your team, please consider sponsoring at en.dev. Sponsorships are what let fnox stay independent and the project keep moving.

A small patch release that makes fnox export actually produce dotenv files, adds a separate shell format for sourceable output, and unbreaks the Windows build introduced by the v1.27.0 daemon.

Fixed

fnox export --format env now emits real dotenv (#554) -- @jdx

The env format was documented as .env/KEY=value but was actually emitting shell export KEY='value' lines, which broke consumers that expect bare assignments. It now produces proper dotenv output:

$ fnox export --format env
NORMAL_SECRET=normal-value
SPECIAL_SECRET="secret$value`tick`"
QUOTED_SECRET="quoted \"value\" with \\ backslash"

Simple values are left unquoted; values containing whitespace or special characters are double-quoted with \n, \r, \t, ", and \ escaped. $ and backticks are deliberately left literal so the file round-trips through dotenv parsers.

fnox import was updated to match: double-quoted .env values now have \n, \t, ", and \ unescaped on the way in, so an export/import round-trip preserves multi-line and quoted secrets.

Windows builds fixed (#555) -- @jdx

The v1.27.0 daemon imported std::os::fd::AsRawFd and tokio::net::Unix{Listener,Stream} at module scope, which broke cargo check on Windows even though the daemon runtime is Unix-only. Those imports and the connection handler are now gated behind #[cfg(unix)], and a cargo check job on windows-latest was added to CI so this can't regress silently.

Added

fnox export --format shell (#554) -- @jdx

A new shell format emits sourceable POSIX export KEY=value statements with proper shell quoting -- this is the behavior the old env format had, now under its correct name:

fnox export --format shell > secrets.sh
source secrets.sh

Documentation

Added Doppler to the cloud secret manager list in the README (#552) -- @bowenc

Breaking Changes

fnox export --format env output changed from export KEY='value' to KEY=value. If you were sourcing that output in a shell, switch to fnox export --format shell to get the old behavior.

New Contributors

@bowenc made their first contribution in #552

Full Changelog: v1.27.0...v1.27.1

💚 Sponsor fnox

fnox is maintained by @jdx under en.dev — a small independent studio building developer tooling like mise, aube, hk, and more. Keeping fnox secure, maintained, and free is funded by sponsors.

If fnox is handling secrets or config for you or your team, please consider sponsoring at en.dev. Sponsorships are what let fnox stay independent and the project keep moving.

A feature release centered on more flexible authentication: the age provider can now bootstrap its identity from another provider (for example, the OS keychain), and the Vault provider and lease backend can obtain tokens from a user-defined shell command. Also includes a real put_secret_value for GCP Secret Manager and two fixes that make fnox export and hook-env better citizens in shell pipelines.

Added

Provider-backed age identities (#515) -- @k35o

The age provider now accepts an identity reference that resolves through any other configured provider. This makes the keychain-bootstrap pattern from v1.25.1 actually work end-to-end:

[providers]
keychain = { type = "keychain", service = "fnox" }
age = { type = "age", recipients = ["age1..."], identity = { provider = "keychain", value = "age-key" } }

Implementation details worth knowing:

Identities are resolved lazily during decryption, so fnox set and other encryption-only paths don't require access to the backing identity provider.

Resolution order is FNOX_AGE_KEY -> identity provider ref -> key_file -> deprecated CLI setting -> default ~/.config/fnox/age.txt.

Cycle detection catches both direct self-references (age -> age) and mutual cycles between two age providers, producing a clear Circular dependency detected in provider configuration: age-a -> age-b -> age-a error.

Nested age identities are supported: a bootstrap age provider can decrypt the identity used by a second age provider.

Identity providers that require interactive auth are rejected in non-interactive mode with a hint to use fnox exec.

credential_command for Vault provider and lease backend (#526) -- @jdx

Vault and OpenBao users can now resolve tokens through a configured shell command when no static token is provided, removing the need to share or pre-stage a VAULT_TOKEN:

[providers.vault_team_a]
type = "vault"
address = "$VAULT_ADDR"
namespace = "team-a"
path = "secret/team-a"
credential_command = "vault login -method=oidc -token-only"

The same field is available on the Vault lease backend:

[leases.vault-db]
type = "vault"
address = "$VAULT_ADDR"
credential_command = "vault login -method=oidc -token-only"
secret_path = "database/creds/readonly"
method = "post"

Commands run through the platform shell (sh -c / cmd /C), so pipes and redirects work.

The string is rendered as a Tera template with address, path/secret_path, and namespace available as variables, and fnox injects VAULT_ADDR and VAULT_NAMESPACE into the environment.

Output is cached for ~5 minutes per process so resolving many secrets from the same provider doesn't repeat the login.

401/403 responses from Vault invalidate the cache so a stale token is refetched on the next call.

Static config/env tokens still take precedence; credential_command is only consulted when no token is configured.

FNOX_VAULT_NAMESPACE is now recognized alongside VAULT_NAMESPACE.

put_secret_value for GCP Secret Manager (#530) -- @nils-degroot

The GCP Secret Manager provider's write path was previously a stub that returned put_secret not yet implemented. fnox set --provider gcp now actually writes: it adds a new secret version, and on 404 NOT_FOUND it creates the secret with automatic replication and retries the write. PERMISSION_DENIED responses surface as ProviderAuthFailed with the relevant IAM permission name (secretmanager.versions.add / secretmanager.secrets.create).

Fixed

FIDO2 keep-alive messages no longer corrupt fnox export (#506, resolves #465) -- @baprx

ctap-hid-fido2's "touch your key" prompts were being written to stdout, which broke eval "$(fnox export)" and similar shell-sourcing workflows. fnox now configures the FIDO2 client with with_keep_alive_msg_to_stderr(true) for both secret retrieval and setup, so stdout stays clean for the exported assignments.

hook-env respects $COLUMNS when stderr is not a TTY (#523) -- @davidolrik

Shell hooks capture stderr, so console::Term::size() could return a useless width when rendering the env-change summary. fnox now uses the TTY width when available, then $COLUMNS, and falls back to 80 columns — restoring the previous default and producing readable truncation in shell hooks.

Documentation

AWS Secrets Manager IAM requirements (#513) -- @gaffneyc

The docs now make clear that BatchGetSecretValue (introduced for batched lookups) must be granted alongside ListSecrets with a wildcard resource — neither action accepts a resource ARN scope.

New Contributors

@nils-degroot made their first contribution in #530

@k35o made their first contribution in #515

@gaffneyc made their first contribution in #513

@baprx made their first contribution in #506

Full Changelog: v1.25.1...v1.26.0

💚 Sponsor fnox

fnox is maintained by @jdx under en.dev — a small independent studio building developer tooling like mise, aube, hk, and more. Keeping fnox secure, maintained, and free is funded by sponsors.

If fnox is handling secrets or config for you or your team, please consider sponsoring at en.dev. Sponsorships are what let fnox stay independent and the project keep moving.