secret list gives each secret's own creation and last-update times (closes #142)

secret list and secret list --json gave the time of the listing as every
secret's creation and last-update time, because Secret.LoadMetadata set
both to the current time. It now reads file modification times, so
listing still needs no passphrase: the last update is when the secret's
current file was written, and the creation is when its oldest version's
value.age was written. A move to another vault gives the copied files
the times of the originals.

GetSecretObject no longer loads the times, so secret get keeps its error
for a missing current file; secret list calls LoadMetadata itself.

Judgement call: the creation time comes from value.age, not from the
oldest version's directory, whose time changes when the next add
rewrites that version's metadata.age.

Model: opus-5-5

README.md

@@ -150,6 +150,13 @@ Retrieves and outputs a secret value to stdout.
 
 Lists all secrets in the current vault. Optional filter for substring matching.
 
+The `LAST UPDATED` column, and `updated_at` in the `--json` output, give the
+time the secret's `current` file was last written: every command that adds a
+version replaces it, and so does `secret version promote`. `created_at` gives
+the time the `value.age` of the secret's oldest version was written. Both are
+the files' modification times, so listing asks for no passphrase. Moving a
+secret to another vault keeps both times.
+
 #### `secret remove <secret-name> [--force]` / `secret rm` ⚠️ 🛑
 
 **DANGER**: Permanently removes a secret and ALL its versions. It first asks for
@@ -181,7 +188,9 @@ period.
 #### `secret version promote <secret-name> <version>`
 
 Promotes a specific version to current by rewriting the secret's `current` file
-to name it. Does not modify any timestamps, allowing for rollback scenarios.
+to name it. The versions' own times are left unchanged, allowing for rollback
+scenarios; `secret list` then gives the time of the promote as the secret's last
+update.
 
 #### `secret version remove <secret-name> <version> [--force]` / `secret version rm` ⚠️ 🛑
 
@@ -381,6 +390,11 @@ which every command except `secret vault import` offers when the variable is not
 set, is the safer default; `secret vault import` has no prompt and needs both
 variables.
 
+The prompt asks on the terminal the command runs in, not on stdin, so it also
+asks when stdin is a pipe, as in `echo value | secret add name --force` or
+`cat file | secret encrypt key`. With no controlling terminal, as under cron or
+in a CI job, the command fails and names the variable to set.
+
 ## Security Features
 
 ### Encryption

TODO.md

@@ -18,6 +18,27 @@ https://git.eeqj.de/sneak/secret/milestone/12
 
 # Completed Steps
 
+- 2026-10-14: `secret list` gives each secret's own creation and last-update
+  times (https://git.eeqj.de/sneak/secret/issues/142). It gave the time of the
+  listing for both, which `Secret.LoadMetadata` set to the current time.
+  `LoadMetadata` now reads file modification times, so listing still needs no
+  passphrase: the last update is when the secret's `current` file was written,
+  and the creation is when its oldest version's `value.age` was written. That
+  version's directory would be wrong, because the next add rewrites the
+  version's `metadata.age` in it. `GetSecretObject`, which `secret get` also
+  uses, no longer loads the times; `secret list` loads them itself. A move to
+  another vault gives each copied `value.age` and `current` the modification
+  time of the file it was copied from, so the moved secret keeps its times.
+- 2026-10-14: The passphrase and mnemonic prompts ask on the controlling
+  terminal (`/dev/tty`) instead of stdin, so `echo v | secret add s1 --force`,
+  `cat file | secret encrypt key` and `cat file.age | secret decrypt key` ask
+  for the passphrase at a terminal instead of failing
+  (https://git.eeqj.de/sneak/secret/issues/144). Only a process with no
+  controlling terminal gets the error that names the variable to set. On SIGINT
+  or SIGTERM, `Entry()` restores the settings of that terminal, not of stdin,
+  since that is where the prompt turns echo off. `secret init` and
+  `secret vault create` no longer write a newline to stderr after the mnemonic
+  is typed, since the prompt ends that line on the terminal.
 - 2026-10-14: `secret generate mnemonic`, `secret vault list` and
   `secret unlocker list` print their output to stdout, as `secret list` does, so
   it can be piped or captured (https://git.eeqj.de/sneak/secret/issues/138).

internal/cli/create_vault_test.go

@@ -8,6 +8,7 @@ import (
 	"os/exec"
 	"slices"
 	"strings"
+	"syscall"
 	"testing"
 
 	"github.com/awnumar/memguard"
@@ -197,10 +198,10 @@ func TestStopAtPassphrasePromptLeavesNothing(t *testing.T) {
 
 // TestMnemonicNotReadNamesOnlyMnemonic is a regression test for
 // https://git.eeqj.de/sneak/secret/issues/115: `secret init` without
-// SB_SECRET_MNEMONIC and with a stdin that is not a terminal said "failed to
+// SB_SECRET_MNEMONIC and with no terminal said "failed to read mnemonic:
-// read mnemonic: failed to read passphrase: ...". The error must wrap
+// failed to read passphrase: ...". The error must wrap
 // secret.ErrMnemonicNotRead and name the mnemonic only. The message is
-// pinned on the built binary, whose stdin is surely not a terminal.
+// pinned on the built binary, run in a new session, which has no terminal.
 func TestMnemonicNotReadNamesOnlyMnemonic(t *testing.T) {
 	t.Parallel()
 
@@ -216,14 +217,15 @@ func TestMnemonicNotReadNamesOnlyMnemonic(t *testing.T) {
 		"PATH=" + os.Getenv("PATH"),
 		"HOME=" + os.Getenv("HOME"),
 	}
+	cmd.SysProcAttr = &syscall.SysProcAttr{Setsid: true}
 
 	output, err := cmd.CombinedOutput()
 	require.Error(t, err)
 
 	require.Equal(t, "Initialized secrets manager at: "+stateDir+"\n"+
-		"Error: failed to read mnemonic: stdin is not a terminal (piped input "+
+		"Error: failed to read mnemonic: there is no terminal to ask on. "+
-		"or script). Please set the SB_SECRET_MNEMONIC environment variable "+
+		"Please set the SB_SECRET_MNEMONIC environment variable or run "+
-		"or run interactively\n", string(output))
+		"interactively\n", string(output))
 }
 
 // TestStopDuringCreateLeavesWholeVaultOrNone is a regression test for

internal/cli/init.go

@@ -5,7 +5,6 @@ import (
 	"fmt"
 	"log"
 	"log/slog"
-	"os"
 	"strings"
 
 	"github.com/awnumar/memguard"
@@ -57,13 +56,11 @@ func (cli *Instance) promptMnemonic() (*memguard.LockedBuffer, func(), error) {
 	// Read mnemonic securely without echo
 	mnemonicBuffer, err := secret.ReadMnemonic("Enter your BIP39 mnemonic phrase: ")
 	if err != nil {
-		secret.Debug("Failed to read mnemonic from stdin", "error", err)
+		secret.Debug("Failed to read mnemonic", "error", err)
 
 		return nil, nil, err
 	}
 
-	fmt.Fprintln(os.Stderr) // Add newline after hidden input
-
 	return mnemonicBuffer, mnemonicBuffer.Destroy, nil
 }
 

internal/cli/list_times_test.go

@@ -0,0 +1,161 @@
+package cli_test
+
+import (
+	"bytes"
+	"encoding/json"
+	"testing"
+	"time"
+
+	"github.com/awnumar/memguard"
+	"github.com/spf13/afero"
+	"github.com/spf13/cobra"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"sneak.berlin/go/secret/internal/cli"
+	"sneak.berlin/go/secret/internal/secret"
+	"sneak.berlin/go/secret/internal/vault"
+)
+
+const (
+	// listClockStep is how long TestListShowsWhenSecretWasWritten waits
+	// between its steps, so that a time read in one step cannot be the
+	// time read in the next.
+	listClockStep = 200 * time.Millisecond
+
+	// fileTimeSlack allows for the clock the kernel stamps files with,
+	// which advances only every few milliseconds: a file's modification
+	// time can be slightly earlier than a time.Now() read before the file
+	// was written.
+	fileTimeSlack = 100 * time.Millisecond
+)
+
+// TestListShowsWhenSecretWasWritten is a regression test for
+// https://git.eeqj.de/sneak/secret/issues/142, where `secret list` gave
+// the time of the listing as every secret's creation and last-update time.
+// Two listings with a clock step between must be the same, and give the
+// time of the add; after a forced add, the creation time is unchanged and
+// the last update is the time of that add. It runs on a real filesystem,
+// where writing a file into a directory also changes the directory's time.
+func TestListShowsWhenSecretWasWritten(t *testing.T) {
+	t.Parallel()
+
+	fs := afero.NewOsFs()
+	stateDir := t.TempDir()
+
+	vlt, err := vault.CreateVault(fs, stateDir, "default", testMnemonicBuffer(t), nil)
+	require.NoError(t, err)
+
+	vlt.Mnemonic = testMnemonicBuffer(t)
+	c := cli.NewCLIInstanceWithStateDir(fs, stateDir)
+
+	beforeAdd := time.Now()
+	err = vlt.AddSecret("x", memguard.NewBufferFromBytes([]byte("one")), false)
+	require.NoError(t, err)
+
+	afterAdd := time.Now()
+
+	firstListing := listSecrets(t, c, true)
+
+	time.Sleep(listClockStep)
+	require.Equal(t, firstListing, listSecrets(t, c, true))
+
+	added := listedTimes(t, firstListing)
+	assert.WithinRange(t, added.CreatedAt, beforeAdd.Add(-fileTimeSlack), afterAdd)
+	assert.WithinRange(t, added.UpdatedAt, beforeAdd.Add(-fileTimeSlack), afterAdd)
+
+	time.Sleep(listClockStep)
+
+	beforeUpdate := time.Now()
+	err = vlt.AddSecret("x", memguard.NewBufferFromBytes([]byte("two")), true)
+	require.NoError(t, err)
+
+	afterUpdate := time.Now()
+
+	updated := listedTimes(t, listSecrets(t, c, true))
+	assert.True(t, added.CreatedAt.Equal(updated.CreatedAt),
+		"created %s, then %s", added.CreatedAt, updated.CreatedAt)
+	assert.WithinRange(t, updated.UpdatedAt,
+		beforeUpdate.Add(-fileTimeSlack), afterUpdate)
+
+	// The table's LAST UPDATED column gives the same time, to the minute
+	assert.Contains(t, listSecrets(t, c, false),
+		updated.UpdatedAt.Format("2006-01-02 15:04"))
+}
+
+// TestMovedSecretKeepsItsTimes checks that a secret moved to another vault
+// is listed there with the times it was listed with before the move, and
+// not with the time of the move.
+func TestMovedSecretKeepsItsTimes(t *testing.T) {
+	t.Parallel()
+
+	fs := afero.NewOsFs()
+	stateDir := t.TempDir()
+
+	_, err := vault.CreateVault(fs, stateDir, "other", testMnemonicBuffer(t), nil)
+	require.NoError(t, err)
+
+	// "default" is created last, so it is the current vault
+	vlt, err := vault.CreateVault(fs, stateDir, "default", testMnemonicBuffer(t), nil)
+	require.NoError(t, err)
+
+	vlt.Mnemonic = testMnemonicBuffer(t)
+
+	// Two versions written apart, so that the creation and the last update
+	// are different times
+	err = vlt.AddSecret("x", memguard.NewBufferFromBytes([]byte("one")), false)
+	require.NoError(t, err)
+
+	time.Sleep(listClockStep)
+
+	err = vlt.AddSecret("x", memguard.NewBufferFromBytes([]byte("two")), true)
+	require.NoError(t, err)
+
+	c := cli.NewCLIInstanceWithStateDir(fs, stateDir)
+	c.Mnemonic = testMnemonicBuffer(t)
+	beforeMove := listedTimes(t, listSecrets(t, c, true))
+
+	time.Sleep(listClockStep)
+	require.NoError(t, c.MoveSecret(&cobra.Command{}, "default:x", "other", false))
+	require.NoError(t, vault.SelectVault(fs, stateDir, "other"))
+
+	afterMove := listedTimes(t, listSecrets(t, c, true))
+	assert.True(t, beforeMove.CreatedAt.Equal(afterMove.CreatedAt),
+		"created %s, then %s", beforeMove.CreatedAt, afterMove.CreatedAt)
+	assert.True(t, beforeMove.UpdatedAt.Equal(afterMove.UpdatedAt),
+		"updated %s, then %s", beforeMove.UpdatedAt, afterMove.UpdatedAt)
+}
+
+// listSecrets returns the output of `secret list`, or of
+// `secret list --json` when jsonOutput is set.
+func listSecrets(t *testing.T, c *cli.Instance, jsonOutput bool) string {
+	t.Helper()
+
+	var out bytes.Buffer
+
+	cmd := &cobra.Command{}
+	cmd.SetOut(&out)
+	require.NoError(t, c.ListSecrets(cmd, jsonOutput, false, ""))
+
+	return out.String()
+}
+
+// listedTimes returns the times that the output of `secret list --json`
+// gives for the one secret in the vault.
+func listedTimes(t *testing.T, listing string) secret.Metadata {
+	t.Helper()
+
+	var parsed struct {
+		Secrets []map[string]string `json:"secrets"`
+	}
+
+	require.NoError(t, json.Unmarshal([]byte(listing), &parsed))
+	require.Len(t, parsed.Secrets, 1)
+
+	createdAt, err := time.Parse(time.RFC3339Nano, parsed.Secrets[0]["created_at"])
+	require.NoError(t, err)
+
+	updatedAt, err := time.Parse(time.RFC3339Nano, parsed.Secrets[0]["updated_at"])
+	require.NoError(t, err)
+
+	return secret.Metadata{CreatedAt: createdAt, UpdatedAt: updatedAt}
+}

internal/cli/passphrase_prompt_test.go

@@ -0,0 +1,204 @@
+package cli_test
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"io"
+	"os"
+	"os/exec"
+	"strings"
+	"syscall"
+	"testing"
+
+	"filippo.io/age"
+	"github.com/awnumar/memguard"
+	"github.com/creack/pty"
+	"github.com/spf13/afero"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"sneak.berlin/go/secret/internal/secret"
+	"sneak.berlin/go/secret/internal/vault"
+)
+
+// TestPassphraseAskedAtTerminalWithPipedStdin is a regression test for
+// https://git.eeqj.de/sneak/secret/issues/144: run at a terminal with stdin
+// a pipe, as in `echo v2 | secret add s1 --force`, a command that needed
+// the passphrase failed instead of asking for it. Each command here must ask
+// on the terminal and succeed once the passphrase is typed there.
+func TestPassphraseAskedAtTerminalWithPipedStdin(t *testing.T) {
+	t.Parallel()
+
+	stateDir := t.TempDir()
+
+	passphrase := memguard.NewBufferFromBytes([]byte(testPassphrase))
+	defer passphrase.Destroy()
+
+	vlt, err := vault.CreateVault(afero.NewOsFs(), stateDir, "default",
+		testMnemonicBuffer(t), passphrase)
+	require.NoError(t, err)
+
+	value := memguard.NewBufferFromBytes([]byte("v1"))
+	defer value.Destroy()
+
+	require.NoError(t, vlt.AddSecret("s1", value, false))
+
+	identity, err := age.GenerateX25519Identity()
+	require.NoError(t, err)
+
+	key := secret.IdentityToLockedBuffer(identity)
+	defer key.Destroy()
+
+	require.NoError(t, vlt.AddSecret("mykey", key, false))
+
+	runAtTerminal(t, stateDir, "v2\n", "add", "s1", "--force")
+
+	vlt.UnlockPassphrase = passphrase
+
+	added, err := vlt.GetSecret("s1")
+	require.NoError(t, err)
+
+	defer added.Destroy()
+
+	assert.Equal(t, "v2", added.String())
+
+	encrypted := runAtTerminal(t, stateDir, "a document\n", "encrypt", "mykey")
+	decrypted := runAtTerminal(t, stateDir, encrypted, "decrypt", "mykey")
+	assert.Equal(t, "a document\n", decrypted)
+}
+
+// TestInitWritesNoBlankLineAfterMnemonic runs `secret init 2>log` at a
+// terminal: the terminal is its controlling terminal and none of stdin,
+// stdout and stderr. The mnemonic is typed on the terminal and the prompt
+// ends its line there, so stderr must not get a newline for it as well, a
+// blank line in the log. pty.Open is described above
+// TestRemoveIgnoresTerminalOnStdout.
+func TestInitWritesNoBlankLineAfterMnemonic(t *testing.T) {
+	t.Parallel()
+
+	ctx, cancel := context.WithTimeout(t.Context(), commandWait)
+	defer cancel()
+
+	stateDir := t.TempDir()
+
+	//nolint:gosec // G204: test executes the freshly built secret binary
+	cmd := exec.CommandContext(ctx, secretBinaryPath(t), "init")
+	cmd.Env = []string{
+		secret.EnvStateDir + "=" + stateDir,
+		secret.EnvUnlockPassphrase + "=" + testPassphrase,
+		"PATH=" + os.Getenv("PATH"),
+		"HOME=" + os.Getenv("HOME"),
+	}
+
+	ptmx, tty, err := pty.Open()
+	require.NoError(t, err)
+
+	defer func() { _ = ptmx.Close() }()
+
+	deadline, _ := ctx.Deadline()
+	require.NoError(t, ptmx.SetReadDeadline(deadline))
+
+	var stderr strings.Builder
+
+	cmd.Stderr = &stderr
+	cmd.ExtraFiles = []*os.File{tty}
+	// Ctty is a descriptor in the new process: 3, the first of ExtraFiles.
+	cmd.SysProcAttr = &syscall.SysProcAttr{Setsid: true, Setctty: true, Ctty: 3}
+
+	require.NoError(t, cmd.Start())
+
+	_ = tty.Close()
+
+	var (
+		shown []byte
+		char  byte
+	)
+
+	terminal := bufio.NewReader(ptmx)
+	for !bytes.HasSuffix(shown, []byte("Enter your BIP39 mnemonic phrase: ")) {
+		char, err = terminal.ReadByte()
+		require.NoError(t, err, "secret init did not ask on the terminal: %s",
+			shown)
+
+		shown = append(shown, char)
+	}
+
+	_, err = ptmx.WriteString(testMnemonic + "\n")
+	require.NoError(t, err)
+
+	// The read ends once the command has exited and so closed the terminal.
+	rest, _ := io.ReadAll(terminal)
+
+	err = cmd.Wait()
+	require.NoError(t, err, "secret init: %s%s%s", shown, rest, stderr.String())
+
+	assert.True(t, strings.HasPrefix(stderr.String(),
+		"Initialized secrets manager at: "+stateDir+"\n\n"+
+			"Default vault created and configured\n"),
+		"stderr: %q", stderr.String())
+}
+
+// runAtTerminal runs the secret binary with args and input on stdin, in a
+// new session whose controlling terminal is a new terminal, which is also
+// its stderr: a command typed at a terminal with its input piped. pty.Open
+// is described above TestRemoveIgnoresTerminalOnStdout. runAtTerminal waits
+// for the passphrase prompt on the terminal, types the passphrase there,
+// and returns what the command wrote to stdout once it has succeeded.
+func runAtTerminal(t *testing.T, stateDir, input string, args ...string) string {
+	t.Helper()
+
+	ctx, cancel := context.WithTimeout(t.Context(), commandWait)
+	defer cancel()
+
+	//nolint:gosec // G204: test executes the freshly built secret binary
+	cmd := exec.CommandContext(ctx, secretBinaryPath(t), args...)
+	cmd.Env = []string{
+		secret.EnvStateDir + "=" + stateDir,
+		"PATH=" + os.Getenv("PATH"),
+		"HOME=" + os.Getenv("HOME"),
+	}
+
+	ptmx, tty, err := pty.Open()
+	require.NoError(t, err)
+
+	defer func() { _ = ptmx.Close() }()
+
+	deadline, _ := ctx.Deadline()
+	require.NoError(t, ptmx.SetReadDeadline(deadline))
+
+	var stdout strings.Builder
+
+	cmd.Stdin = strings.NewReader(input)
+	cmd.Stdout = &stdout
+	cmd.Stderr = tty
+	// Ctty is a descriptor in the new process: 2, its stderr.
+	cmd.SysProcAttr = &syscall.SysProcAttr{Setsid: true, Setctty: true, Ctty: 2}
+
+	require.NoError(t, cmd.Start())
+
+	_ = tty.Close()
+
+	var (
+		shown []byte
+		char  byte
+	)
+
+	terminal := bufio.NewReader(ptmx)
+	for !bytes.HasSuffix(shown, []byte("Enter unlock passphrase: ")) {
+		char, err = terminal.ReadByte()
+		require.NoError(t, err, "secret %v did not ask on the terminal: %s",
+			args, shown)
+
+		shown = append(shown, char)
+	}
+
+	_, err = ptmx.WriteString(testPassphrase + "\n")
+	require.NoError(t, err)
+
+	// The read ends once the command has exited and so closed the terminal.
+	rest, _ := io.ReadAll(terminal)
+
+	require.NoError(t, cmd.Wait(), "secret %v: %s%s", args, shown, rest)
+
+	return stdout.String()
+}

internal/cli/root.go

@@ -15,16 +15,29 @@ import (
 // but exit with the code.
 func Entry() int {
 	// On SIGINT or SIGTERM memguard runs this function, wipes every buffer
-	// and exits with status 1. The passphrase prompt turns terminal echo
+	// and exits with status 1. The passphrase prompt turns echo off on the
-	// off until the read finishes, so a signal there would leave echo off.
+	// controlling terminal until the read finishes, so a signal there would
-	// Only a process in the terminal's foreground process group may reset
+	// leave echo off. Only a process in the terminal's foreground process
-	// it: one in the background that tries is stopped instead of exiting.
+	// group may reset it: one in the background that tries is stopped
-	terminalState, terminalErr := term.GetState(unix.Stdin)
+	// instead of exiting.
+	terminal, terminalErr := os.Open(secret.TerminalPath)
+
+	var terminalState *term.State
+
+	if terminalErr == nil {
+		defer func() { _ = terminal.Close() }()
+
+		terminalState, terminalErr = term.GetState(int(terminal.Fd()))
+	}
 
 	memguard.CatchSignal(func(os.Signal) {
-		foreground, err := unix.IoctlGetInt(unix.Stdin, unix.TIOCGPGRP)
+		if terminalErr != nil {
-		if terminalErr == nil && err == nil && foreground == unix.Getpgrp() {
+			return
-			_ = term.Restore(unix.Stdin, terminalState)
+		}
+
+		foreground, err := unix.IoctlGetInt(int(terminal.Fd()), unix.TIOCGPGRP)
+		if err == nil && foreground == unix.Getpgrp() {
+			_ = term.Restore(int(terminal.Fd()), terminalState)
 		}
 	}, os.Interrupt, unix.SIGTERM)
 

internal/cli/secrets.go

@@ -541,8 +541,12 @@ func printSecretsJSON(
 			"name": secretName,
 		}
 
-		// Try to get metadata using GetSecretObject
+		// A secret whose times cannot be read is listed without them
 		secretObj, err := vlt.GetSecretObject(secretName)
+		if err == nil {
+			err = secretObj.LoadMetadata()
+		}
+
 		if err == nil {
 			metadata := secretObj.GetMetadata()
 			secretInfo["created_at"] = metadata.CreatedAt
@@ -618,6 +622,10 @@ func printSecretsTable(
 		lastUpdated := "unknown"
 
 		secretObj, err := vlt.GetSecretObject(secretName)
+		if err == nil {
+			err = secretObj.LoadMetadata()
+		}
+
 		if err == nil {
 			metadata := secretObj.GetMetadata()
 			lastUpdated = metadata.UpdatedAt.Format("2006-01-02 15:04")

internal/cli/unlock_failure_test.go

@@ -18,6 +18,7 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"syscall"
 	"testing"
 
 	"filippo.io/age"
@@ -288,7 +289,7 @@ func TestMissingCurrentUnlockerNamesMnemonic(t *testing.T) {
 }
 
 // TestPassphraseNotReadNamesNoMnemonic runs `secret get x` on the built
-// binary without SB_UNLOCK_PASSPHRASE and with a stdin that is not a
+// binary without SB_UNLOCK_PASSPHRASE and in a new session, which has no
 // terminal, so the passphrase cannot be read. The unlocker was not tried,
 // and adding one would need a passphrase read the same way, so the error
 // is the cause alone, without the advice to use the mnemonic.
@@ -319,15 +320,16 @@ func TestPassphraseNotReadNamesNoMnemonic(t *testing.T) {
 		"PATH=" + os.Getenv("PATH"),
 		"HOME=" + os.Getenv("HOME"),
 	}
+	cmd.SysProcAttr = &syscall.SysProcAttr{Setsid: true}
 
 	output, err := cmd.CombinedOutput()
 	require.Error(t, err)
 
 	assert.Equal(t, "Error: failed to unlock vault: "+
 		"failed to get long-term key: failed to get unlocker identity: "+
-		"failed to read passphrase: stdin is not a terminal (piped input or "+
+		"failed to read passphrase: there is no terminal to ask on. Please "+
-		"script). Please set the SB_UNLOCK_PASSPHRASE environment variable or "+
+		"set the SB_UNLOCK_PASSPHRASE environment variable or run "+
-		"run interactively\n", string(output))
+		"interactively\n", string(output))
 }
 
 // TestCryptoUnlockFailureNamesMnemonic checks that `secret encrypt` and

internal/cli/version.go

@@ -65,7 +65,9 @@ func VersionCommands(cli *Instance) *cobra.Command {
 		Use:   "promote <secret-name> <version>",
 		Short: "Promote a specific version to current",
 		Long: "Updates the current symlink to point to the specified " +
-			"version without modifying timestamps",
+			"version. The versions' own times are left unchanged; secret " +
+			"list then gives the time of the promote as the secret's last " +
+			"update.",
 		Args: cobra.ExactArgs(2), //nolint:mnd // secret-name and version args
 		ValidArgsFunction: func(
 			cmd *cobra.Command, args []string, toComplete string,

internal/secret/constants.go

@@ -17,6 +17,10 @@ const (
 	// EnvGPGKeyID is the environment variable for providing the GPG key ID
 	EnvGPGKeyID = "SB_GPG_KEY_ID"
 
+	// TerminalPath opens the controlling terminal of the process that opens
+	// it, where the passphrase and mnemonic prompts ask.
+	TerminalPath = "/dev/tty"
+
 	// UnlockerTimeFormat is the layout of the time, in UTC, in the name of a
 	// new unlocker's directory. It runs to the nanosecond, so that every new
 	// unlocker, even one added right after another, gets a directory of its

internal/secret/crypto.go

@@ -6,7 +6,6 @@ import (
 	"fmt"
 	"io"
 	"os"
-	"syscall"
 	"unsafe"
 
 	"filippo.io/age"
@@ -16,11 +15,8 @@ import (
 
 var (
 	errNilPassphraseBuffer = errors.New("passphrase buffer is nil")
-	errStdinNotTerminal    = errors.New(
+	errNoTerminal          = errors.New("there is no terminal to ask on")
-		"stdin is not a terminal (piped input or script)")
+	errNothingEntered      = errors.New("nothing was entered")
-	errStderrNotTerminal = errors.New(
-		"stderr is not a terminal (running in non-interactive mode)")
-	errNothingEntered = errors.New("nothing was entered")
 )
 
 // ErrMnemonicNotRead is wrapped in every error of ReadMnemonic: there is no
@@ -193,38 +189,33 @@ func ReadMnemonic(prompt string) (*memguard.LockedBuffer, error) {
 	return readFromTerminal(prompt, ErrMnemonicNotRead, EnvMnemonic)
 }
 
-// readFromTerminal reads input from the terminal without echoing it. Every
+// readFromTerminal asks on the controlling terminal and reads the answer
-// error it returns wraps notRead; without a terminal, the error says to set
+// there without echoing it, whatever stdin is: in
-// envVar instead.
+// `echo value | secret add name --force`, stdin is a pipe. Every error it
+// returns wraps notRead; without a terminal, the error says to set envVar
+// instead.
 func readFromTerminal(
 	prompt string, notRead error, envVar string,
 ) (*memguard.LockedBuffer, error) {
-	// Check if stdin is a terminal
+	terminal, err := os.OpenFile(TerminalPath, os.O_RDWR, 0)
-	if !term.IsTerminal(syscall.Stdin) {
+	if err != nil {
-		// Not a terminal - never read secrets from piped input
+		Debug("Failed to open the controlling terminal", "error", err)
-		// for security reasons
+
 		return nil, fmt.Errorf(
 			"%w: %w. Please set the %s environment variable or run interactively",
-			notRead, errStdinNotTerminal, envVar)
+			notRead, errNoTerminal, envVar)
 	}
+	defer func() { _ = terminal.Close() }()
 
-	// stdin is a terminal, check if stderr is also a terminal for
+	_, _ = fmt.Fprint(terminal, prompt)
-	// interactive prompting
-	if !term.IsTerminal(syscall.Stderr) {
-		return nil, fmt.Errorf("%w: %w. Please set the %s environment variable",
-			notRead, errStderrNotTerminal, envVar)
-	}
 
-	// Both stdin and stderr are terminals - use secure password reading
+	input, err := term.ReadPassword(int(terminal.Fd()))
-	fmt.Fprint(os.Stderr, prompt) // Write prompt to stderr, not stdout
-
-	input, err := term.ReadPassword(syscall.Stdin)
 	if err != nil {
 		return nil, fmt.Errorf("%w: %w", notRead, err)
 	}
 
-	// Print newline to stderr since ReadPassword doesn't echo
+	// The newline typed after the input, which ReadPassword did not echo
-	fmt.Fprintln(os.Stderr)
+	_, _ = fmt.Fprintln(terminal)
 
 	if len(input) == 0 {
 		return nil, fmt.Errorf("%w: %w", notRead, errNothingEntered)

internal/secret/secret.go

@@ -2,10 +2,11 @@ package secret
 
 import (
 	"errors"
+	"fmt"
 	"log/slog"
+	"os"
 	"path/filepath"
 	"strings"
-	"time"
 
 	"filippo.io/age"
 	"github.com/awnumar/memguard"
@@ -66,31 +67,53 @@ func NewSecret(vault VaultInterface, name string) *Secret {
 		Name:      name,
 		Directory: secretDir,
 		vault:     vault,
-		Metadata: Metadata{
-			CreatedAt: time.Now(),
-			UpdatedAt: time.Now(),
-		},
 	}
 }
 
-// LoadMetadata is deprecated - metadata is now per-version and encrypted
+// LoadMetadata sets the secret's times from the modification times of its
+// files, which can be read without unlocking the vault. UpdatedAt is when
+// the secret's current file was last written, by an add or a promote.
+// CreatedAt is when its oldest version's value.age was written. That file
+// is never rewritten; the version's directory is no use, as its time
+// changes when the next add rewrites the version's metadata.age.
 func (s *Secret) LoadMetadata() error {
-	Debug("LoadMetadata called but is deprecated in versioned model",
+	fs := s.vault.GetFilesystem()
-		"secret_name", s.Name)
+
-	// For backward compatibility, we'll populate with basic info
+	current, err := fs.Stat(filepath.Join(s.Directory, "current"))
-	now := time.Now()
+	if err != nil {
+		return fmt.Errorf("failed to read when secret %s was updated: %w",
+			s.Name, err)
+	}
+
+	versions, err := ListVersions(fs, s.Directory)
+	if err != nil {
+		return err
+	}
+
+	if len(versions) == 0 {
+		return fmt.Errorf("secret %s has no versions: %w", s.Name, os.ErrNotExist)
+	}
+
+	// ListVersions lists the newest version first
+	oldest := versions[len(versions)-1]
+
+	value, err := fs.Stat(
+		filepath.Join(s.Directory, "versions", oldest, "value.age"))
+	if err != nil {
+		return fmt.Errorf("failed to read when secret %s was created: %w",
+			s.Name, err)
+	}
+
 	s.Metadata = Metadata{
-		CreatedAt: now,
+		CreatedAt: value.ModTime(),
-		UpdatedAt: now,
+		UpdatedAt: current.ModTime(),
 	}
 
 	return nil
 }
 
-// GetMetadata returns the secret metadata (deprecated)
+// GetMetadata returns the times LoadMetadata read
 func (s *Secret) GetMetadata() Metadata {
-	Debug("GetMetadata called but is deprecated in versioned model", "secret_name", s.Name)
-
 	return s.Metadata
 }
 

internal/vault/secrets.go

@@ -427,7 +427,8 @@ func (v *Vault) UnlockVault() (*age.X25519Identity, error) {
 	return longTermIdentity, nil
 }
 
-// GetSecretObject retrieves a Secret object with metadata loaded from this vault
+// GetSecretObject retrieves a Secret object from this vault. Its times are
+// zero until its LoadMetadata reads them.
 func (v *Vault) GetSecretObject(name string) (*secret.Secret, error) {
 	err := ValidateSecretName(name)
 	if err != nil {
@@ -454,16 +455,7 @@ func (v *Vault) GetSecretObject(name string) (*secret.Secret, error) {
 		return nil, fmt.Errorf("secret %s %w", name, ErrSecretNotFound)
 	}
 
-	// Create a Secret object
+	return secret.NewSecret(v, name), nil
-	secretObj := secret.NewSecret(v, name)
-
-	// Load the metadata from disk
-	err = secretObj.LoadMetadata()
-	if err != nil {
-		return nil, err
-	}
-
-	return secretObj, nil
 }
 
 // CopySecretVersion copies a single version from source into destSecretDir
@@ -581,8 +573,8 @@ func (v *Vault) CopySecretAllVersions(
 	}
 
 	// Copy each version and the current pointer, then move the copy into place
-	err = v.copyVersions(srcVault, srcIdentity,
+	err = v.copyVersions(srcVault, srcIdentity, srcSecretName, srcSecretDir,
-		srcSecretName, destSecretName, destSecretDir, versions, currentVersion)
+		destSecretName, destSecretDir, versions, currentVersion)
 	if err != nil {
 		return err
 	}
@@ -801,10 +793,13 @@ func (v *Vault) createAndSaveVersion(
 // pointer into a temporary directory, then moves that directory to
 // destSecretDir, replacing a secret already there. Nothing in this vault
 // changes until the copy is complete, so an interrupted copy leaves only a
-// temporary directory behind.
+// temporary directory behind. Each copied value.age and current file gets
+// the modification time of the file it was copied from, so `secret list`,
+// which reads a secret's times from them, lists the copy with the times of
+// the source.
 func (v *Vault) copyVersions(
 	srcVault *Vault, srcIdentity *age.X25519Identity,
-	srcSecretName, destSecretName, destSecretDir string,
+	srcSecretName, srcSecretDir, destSecretName, destSecretDir string,
 	versions []string, currentVersion string,
 ) error {
 	buildDir, err := secret.TempDirFor(v.fs, destSecretDir)
@@ -823,6 +818,14 @@ func (v *Vault) copyVersions(
 		if err != nil {
 			return fmt.Errorf("failed to copy version %s: %w", versionName, err)
 		}
+
+		valuePath := filepath.Join("versions", versionName, "value.age")
+
+		err = copyModTime(srcVault.fs, filepath.Join(srcSecretDir, valuePath),
+			v.fs, filepath.Join(buildDir, valuePath))
+		if err != nil {
+			return err
+		}
 	}
 
 	err = secret.SetCurrentVersion(v.fs, buildDir, currentVersion)
@@ -830,6 +833,12 @@ func (v *Vault) copyVersions(
 		return fmt.Errorf("failed to set current version: %w", err)
 	}
 
+	err = copyModTime(srcVault.fs, filepath.Join(srcSecretDir, "current"),
+		v.fs, filepath.Join(buildDir, "current"))
+	if err != nil {
+		return err
+	}
+
 	// With --force, the secret being replaced goes only now that its
 	// replacement is complete
 	exists, err := afero.DirExists(v.fs, destSecretDir)
@@ -854,6 +863,26 @@ func (v *Vault) copyVersions(
 	return nil
 }
 
+// copyModTime gives destPath in destFs the modification time of srcPath in
+// srcFs.
+func copyModTime(
+	srcFs afero.Fs, srcPath string, destFs afero.Fs, destPath string,
+) error {
+	info, err := srcFs.Stat(srcPath)
+	if err != nil {
+		return fmt.Errorf("failed to read modification time of %s: %w",
+			srcPath, err)
+	}
+
+	err = destFs.Chtimes(destPath, info.ModTime(), info.ModTime())
+	if err != nil {
+		return fmt.Errorf("failed to set modification time of %s: %w",
+			destPath, err)
+	}
+
+	return nil
+}
+
 // checkCopyDestination refuses to copy over an existing secret unless force
 // is set. A secret being replaced is removed by copyVersions, once its
 // replacement is complete.