The passphrase and mnemonic prompts read stdin and refused when it was not a terminal, so echo v | secret add s1 --force, cat file | secret encrypt key and cat file.age | secret decrypt key failed at a terminal. They now open /dev/tty, the terminal the command runs in, and write the prompt and read the answer there, whatever stdin and stderr are. A process with no controlling terminal still fails with the message that names the variable to set; its cause now reads "there is no terminal to ask on". secret init and secret vault create no longer write a newline to stderr after the mnemonic, as the prompt ends that line on the terminal.
What the diff does not make obvious:
Entry() saved and restored the terminal settings of stdin, for Ctrl-C at the prompt. The prompt now turns echo off on /dev/tty, so with stdin piped, Ctrl-C there left echo off. Entry() now saves and restores /dev/tty instead.
The new tests run the binary in a new session whose controlling terminal is a pseudo-terminal that is not its stdin. The two tests that pin the no-terminal message run it in a new session with no terminal, wherever the tests run.
The [y/N] removal confirmations still read stdin, as the README documents.
Disclosures:
Not covered by a test: echo after Ctrl-C at the prompt with stdin piped. Checked by hand under a pseudo-terminal: echo is back on with this change, and stays off without the Entry() part.
Model: opus-5-5
Fixes https://git.eeqj.de/sneak/secret/issues/144.
The passphrase and mnemonic prompts read stdin and refused when it was not a terminal, so `echo v | secret add s1 --force`, `cat file | secret encrypt key` and `cat file.age | secret decrypt key` failed at a terminal. They now open `/dev/tty`, the terminal the command runs in, and write the prompt and read the answer there, whatever stdin and stderr are. A process with no controlling terminal still fails with the message that names the variable to set; its cause now reads "there is no terminal to ask on". `secret init` and `secret vault create` no longer write a newline to stderr after the mnemonic, as the prompt ends that line on the terminal.
What the diff does not make obvious:
- `Entry()` saved and restored the terminal settings of stdin, for Ctrl-C at the prompt. The prompt now turns echo off on `/dev/tty`, so with stdin piped, Ctrl-C there left echo off. `Entry()` now saves and restores `/dev/tty` instead.
- The new tests run the binary in a new session whose controlling terminal is a pseudo-terminal that is not its stdin. The two tests that pin the no-terminal message run it in a new session with no terminal, wherever the tests run.
- The `[y/N]` removal confirmations still read stdin, as the README documents.
Disclosures:
- Not covered by a test: echo after Ctrl-C at the prompt with stdin piped. Checked by hand under a pseudo-terminal: echo is back on with this change, and stays off without the `Entry()` part.
Model: opus-5-5
README.md line 377: "With no terminal, as in a script or a CI job, the command fails and names the variable to set" is wrong for a script started from a terminal. That script runs in the terminal, so the command now asks there and waits instead of failing. Only a process with no controlling terminal (cron, a CI job, a service) gets the error. Acceptable: name only cases that really have no terminal, for example "With no controlling terminal, as under cron or in a CI job, ...".
internal/cli/init.go lines 60 and 65 still assume the mnemonic prompt uses stdin and stderr. The debug message says "Failed to read mnemonic from stdin", but the mnemonic is no longer read from stdin. Line 65 writes a newline to stderr "after hidden input", but the input is now typed on the terminal and readFromTerminal already ends that line there, so secret init 2>log leaves a stray blank line in the log. Acceptable: remove line 65 and remove "from stdin" from the message.
Model: opus-5-5
1. `README.md` line 377: "With no terminal, as in a script or a CI job, the command fails and names the variable to set" is wrong for a script started from a terminal. That script runs in the terminal, so the command now asks there and waits instead of failing. Only a process with no controlling terminal (cron, a CI job, a service) gets the error. Acceptable: name only cases that really have no terminal, for example "With no controlling terminal, as under cron or in a CI job, ...".
2. `internal/cli/init.go` lines 60 and 65 still assume the mnemonic prompt uses stdin and stderr. The debug message says "Failed to read mnemonic from stdin", but the mnemonic is no longer read from stdin. Line 65 writes a newline to stderr "after hidden input", but the input is now typed on the terminal and `readFromTerminal` already ends that line there, so `secret init 2>log` leaves a stray blank line in the log. Acceptable: remove line 65 and remove "from stdin" from the message.
Model: opus-5-5
README.md now says "With no controlling terminal, as under cron or in a CI job".
internal/cli/init.go no longer writes the newline to stderr after the mnemonic, and the debug message drops "from stdin". New test TestInitWritesNoBlankLineAfterMnemonic runs secret init with stderr captured and fails without the fix. TODO.md and the PR body mention it.
Model: opus-5-5
Rework:
1. `README.md` now says "With no controlling terminal, as under cron or in a CI job".
2. `internal/cli/init.go` no longer writes the newline to stderr after the mnemonic, and the debug message drops "from stdin". New test `TestInitWritesNoBlankLineAfterMnemonic` runs `secret init` with stderr captured and fails without the fix. `TODO.md` and the PR body mention it.
Model: opus-5-5
The passphrase and mnemonic prompts open /dev/tty and ask there, so
`echo v | secret add s1 --force`, `secret encrypt` and `secret decrypt`
with piped input ask at a terminal instead of failing. Only a process
with no controlling terminal still gets the error naming the variable to
set. `secret init` and `secret vault create` no longer write a newline
to stderr after the mnemonic.
On SIGINT or SIGTERM, Entry() restores the settings of /dev/tty instead
of stdin, since that is where the prompt turns echo off.
The two tests that pin the no-terminal message run the binary in a new
session, so it has no terminal wherever the tests run.
Unverified by a test: the echo restore after Ctrl-C, checked by hand.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Fixes #144.
The passphrase and mnemonic prompts read stdin and refused when it was not a terminal, so
echo v | secret add s1 --force,cat file | secret encrypt keyandcat file.age | secret decrypt keyfailed at a terminal. They now open/dev/tty, the terminal the command runs in, and write the prompt and read the answer there, whatever stdin and stderr are. A process with no controlling terminal still fails with the message that names the variable to set; its cause now reads "there is no terminal to ask on".secret initandsecret vault createno longer write a newline to stderr after the mnemonic, as the prompt ends that line on the terminal.What the diff does not make obvious:
Entry()saved and restored the terminal settings of stdin, for Ctrl-C at the prompt. The prompt now turns echo off on/dev/tty, so with stdin piped, Ctrl-C there left echo off.Entry()now saves and restores/dev/ttyinstead.[y/N]removal confirmations still read stdin, as the README documents.Disclosures:
Entry()part.Model: opus-5-5
README.mdline 377: "With no terminal, as in a script or a CI job, the command fails and names the variable to set" is wrong for a script started from a terminal. That script runs in the terminal, so the command now asks there and waits instead of failing. Only a process with no controlling terminal (cron, a CI job, a service) gets the error. Acceptable: name only cases that really have no terminal, for example "With no controlling terminal, as under cron or in a CI job, ...".internal/cli/init.golines 60 and 65 still assume the mnemonic prompt uses stdin and stderr. The debug message says "Failed to read mnemonic from stdin", but the mnemonic is no longer read from stdin. Line 65 writes a newline to stderr "after hidden input", but the input is now typed on the terminal andreadFromTerminalalready ends that line there, sosecret init 2>logleaves a stray blank line in the log. Acceptable: remove line 65 and remove "from stdin" from the message.Model: opus-5-5
d01a277448tod0e2fb8b20Rework:
README.mdnow says "With no controlling terminal, as under cron or in a CI job".internal/cli/init.gono longer writes the newline to stderr after the mnemonic, and the debug message drops "from stdin". New testTestInitWritesNoBlankLineAfterMnemonicrunssecret initwith stderr captured and fails without the fix.TODO.mdand the PR body mention it.Model: opus-5-5
d0e2fb8b20to45d0fe584a45d0fe584ato44d8edbb95Review passed.
Model: opus-5-5