secret generate mnemonic, secret vault list and secret unlocker list print their output to stderr, so it cannot be piped or captured #138

New Issue

2026-10-13T00:30:12+02:00

clawbot commented

2026-10-13 00:30:12 +02:00

Severity: major. The only output of these commands goes to the wrong stream: secret generate mnemonic | tee file, $(secret generate mnemonic) and secret vault list --json | jq all receive nothing, so --json is unusable from a script.

What happens. The commands print through cobra's cmd.Println/cmd.Printf, which write to OutOrStderr(): stderr unless an output writer was set, and the binary sets none. secret list --json, secret info --json and secret get write to stdout.

Reproduction (SB_SECRET_STATE_DIR set to a fresh directory, vault made with secret init):

secret generate mnemonic | wc -c        # 0: the mnemonic went to stderr
secret vault list --json | wc -c         # 0: the JSON went to stderr
secret unlocker list --json | wc -c      # 0

The text form of both listings and secret version list's "No versions found" go to stderr too.

Where.

		secret/internal/cli/generate.go
		Line 106 in ef0ae90768
	
					cmd.Println(mnemonic)

(the comment above it says "Output mnemonic to stdout"),

		secret/internal/cli/vault.go
		Line 208 in ef0ae90768
	
						cmd.Println(string(jsonBytes))

and

		secret/internal/cli/vault.go
		Line 211 in ef0ae90768
	
						cmd.Println("Available vaults:")

,

		secret/internal/cli/unlockers.go
		Line 369 in ef0ae90768
	
					cli.cmd.Println(string(jsonBytes))

and

		secret/internal/cli/unlockers.go
		Line 383 in ef0ae90768
	
					cli.cmd.Printf("  %-40s %-12s %-20s %s\n", "UNLOCKER ID", "TYPE", "CREATED", "FLAGS")

.

Correct behaviour. README's Getting Started says secret generate mnemonic "prints a new BIP39 mnemonic", and the code comment says stdout. Listings and --json belong on stdout, as secret list --json and secret info --json already do. Status messages such as "Created vault" can stay on stderr.

Definition of done

The mnemonic, both listings in text and --json form, and "No versions found" go to stdout; the warning text of generate mnemonic stays on stderr.
A test runs the built binary, as TestGetCommandOutputsToStdout does, for generate mnemonic, vault list --json and unlocker list --json, and fails before the fix because stdout is empty.

Model: fable-5-1

Severity: major. The only output of these commands goes to the wrong stream: `secret generate mnemonic | tee file`, `$(secret generate mnemonic)` and `secret vault list --json | jq` all receive nothing, so `--json` is unusable from a script. **What happens.** The commands print through cobra's `cmd.Println`/`cmd.Printf`, which write to `OutOrStderr()`: stderr unless an output writer was set, and the binary sets none. `secret list --json`, `secret info --json` and `secret get` write to stdout. **Reproduction** (`SB_SECRET_STATE_DIR` set to a fresh directory, vault made with `secret init`): ``` secret generate mnemonic | wc -c # 0: the mnemonic went to stderr secret vault list --json | wc -c # 0: the JSON went to stderr secret unlocker list --json | wc -c # 0 ``` The text form of both listings and `secret version list`'s "No versions found" go to stderr too. **Where.** https://git.eeqj.de/sneak/secret/src/commit/ef0ae90768c8b18a829033b3ebd4cf98fcaeb3d1/internal/cli/generate.go#L106 (the comment above it says "Output mnemonic to stdout"), https://git.eeqj.de/sneak/secret/src/commit/ef0ae90768c8b18a829033b3ebd4cf98fcaeb3d1/internal/cli/vault.go#L208 and https://git.eeqj.de/sneak/secret/src/commit/ef0ae90768c8b18a829033b3ebd4cf98fcaeb3d1/internal/cli/vault.go#L211, https://git.eeqj.de/sneak/secret/src/commit/ef0ae90768c8b18a829033b3ebd4cf98fcaeb3d1/internal/cli/unlockers.go#L369 and https://git.eeqj.de/sneak/secret/src/commit/ef0ae90768c8b18a829033b3ebd4cf98fcaeb3d1/internal/cli/unlockers.go#L383. **Correct behaviour.** README's Getting Started says `secret generate mnemonic` "prints a new BIP39 mnemonic", and the code comment says stdout. Listings and `--json` belong on stdout, as `secret list --json` and `secret info --json` already do. Status messages such as "Created vault" can stay on stderr. **Definition of done** - The mnemonic, both listings in text and `--json` form, and "No versions found" go to stdout; the warning text of `generate mnemonic` stays on stderr. - A test runs the built binary, as `TestGetCommandOutputsToStdout` does, for `generate mnemonic`, `vault list --json` and `unlocker list --json`, and fails before the fix because stdout is empty. Model: fable-5-1

sneak was assigned by clawbot

2026-10-13 00:30:12 +02:00

clawbot referenced this issue

2026-10-13 01:17:13 +02:00

Finish 1.0 and tag it; after that, bugfixes only #131

Sign in to join this conversation.