With SB_UNLOCK_PASSPHRASE set, secret unlocker add passphrase gives the new unlocker the old passphrase without asking #154

New Issue

2026-10-13T00:31:09+02:00

clawbot commented

2026-10-13 00:31:09 +02:00

Severity: minor. The README calls the variable the "unlock passphrase" and says the prompt "is the safer default"; a user who sets it to unlock the vault and expects to be asked for the new passphrase gets a replacement unlocker with the old one, and nothing says so.

SB_UNLOCK_PASSPHRASE=pw1 secret unlocker add passphrase
# Created passphrase unlocker: passphrase-...
# Automatically selected as current unlocker
SB_UNLOCK_PASSPHRASE=newpw secret get s1     # fails: no identity matched
SB_UNLOCK_PASSPHRASE=pw1 secret get s1       # works

With the variable unset the command asks for the new passphrase twice and then for the current one, which is right.

Where.

		secret/internal/cli/unlockers.go
		Line 467 in ef0ae90768
	
					passphraseBuffer := cli.UnlockPassphrase

.

Correct behaviour is a product decision; the README says only "adding one replaces the one the vault has". Recommended: use the variable to unlock and still ask for the new passphrase when stdin is a terminal; when it is not, say in the output that the new unlocker takes the passphrase from the variable.

Definition of done

Either the new passphrase is asked for when a terminal is present, or the command's output and the README say that the variable becomes the new passphrase.
A test runs unlocker add passphrase with the variable set and fails before the fix.

Model: fable-5-1

Severity: minor. The README calls the variable the "unlock passphrase" and says the prompt "is the safer default"; a user who sets it to unlock the vault and expects to be asked for the new passphrase gets a replacement unlocker with the old one, and nothing says so. ``` SB_UNLOCK_PASSPHRASE=pw1 secret unlocker add passphrase # Created passphrase unlocker: passphrase-... # Automatically selected as current unlocker SB_UNLOCK_PASSPHRASE=newpw secret get s1 # fails: no identity matched SB_UNLOCK_PASSPHRASE=pw1 secret get s1 # works ``` With the variable unset the command asks for the new passphrase twice and then for the current one, which is right. **Where.** https://git.eeqj.de/sneak/secret/src/commit/ef0ae90768c8b18a829033b3ebd4cf98fcaeb3d1/internal/cli/unlockers.go#L467. **Correct behaviour** is a product decision; the README says only "adding one replaces the one the vault has". Recommended: use the variable to unlock and still ask for the new passphrase when stdin is a terminal; when it is not, say in the output that the new unlocker takes the passphrase from the variable. **Definition of done** - Either the new passphrase is asked for when a terminal is present, or the command's output and the README say that the variable becomes the new passphrase. - A test runs `unlocker add passphrase` with the variable set and fails before the fix. Model: fable-5-1

sneak was assigned by clawbot

2026-10-13 00:31:09 +02:00

clawbot referenced this issue

2026-10-13 01:17:13 +02:00

Finish 1.0 and tag it; after that, bugfixes only #131

clawbot referenced this issue

2026-10-14 19:42:56 +02:00

Commands that prompt for a mnemonic or passphrase hold the state directory lock while waiting, so other changing commands wait silently #152

clawbot commented

2026-10-14 19:42:57 +02:00

Reassigned to clawbot: sneak ruled that nothing is a release candidate while a known bug is open (sneak/project-management#32).

Plan: the issue's recommendation: SB_UNLOCK_PASSPHRASE unlocks the vault, and when a terminal is present the new passphrase is still asked for; with no terminal, the output says the new unlocker takes its passphrase from SB_UNLOCK_PASSPHRASE, and the README says the same. Built after #144, which decides what "a terminal is present" means.

Model: opus-5-5

Reassigned to clawbot: sneak ruled that nothing is a release candidate while a known bug is open (https://git.eeqj.de/sneak/project-management/issues/32). Plan: the issue's recommendation: `SB_UNLOCK_PASSPHRASE` unlocks the vault, and when a terminal is present the new passphrase is still asked for; with no terminal, the output says the new unlocker takes its passphrase from `SB_UNLOCK_PASSPHRASE`, and the README says the same. Built after https://git.eeqj.de/sneak/secret/issues/144, which decides what "a terminal is present" means. Model: opus-5-5

sneak was unassigned by clawbot

2026-10-14 19:42:57 +02:00

clawbot self-assigned this 2026-10-14 19:42:57 +02:00

clawbot added this to the 1.0.0 milestone 2026-10-14 19:42:57 +02:00

clawbot referenced this issue from a commit

2026-10-14 23:51:21 +02:00

Ask for the new passphrase in unlocker add when the variable is set (closes #154)

clawbot referenced a pull request that will close this issue

2026-10-15 00:13:57 +02:00

Ask for the new passphrase in unlocker add when the variable is set (closes #154) #175

clawbot referenced this issue from a commit

2026-10-15 00:15:20 +02:00