Repository navigation
run: mask fetched values by default, --no-mask for the exceptions #170
Description
Why
nodkey run --mask (PR #169, #18) hides fetched values in the command's output, but only when you ask for it. The owner wants it the other way round (2026-11-11): mask is the default, and an option turns it off for the rare case where the mask does harm (for example, a value that is also a common word, so normal output gets ***).
What
nodkey runmasks by default.- A flag turns it off for one run:
--no-mask. A per-secret or per-config setting for the same is welcome if it is small. - Interactive commands keep working. With the mask on, the command no longer owns the terminal (its output goes through a pipe), so
isattyis false: editors,sshsessions, prompts and colour output can break. Pick one way and document it:- run the command in a pseudo-terminal when stdout is a terminal, or
- keep the old
execvepath when stdout is a terminal, and mask only when the output is a pipe or a file (and say so clearly), or - a better way you find.
- The changelog says this is a change of default, with the opt-out flag.
Done when
-
nodkey runwithout flags masks values in stdout and stderr (tests with canary values, as inrunmask_test.go). -
nodkey run --no-maskbehaves as before PR feat(run): --mask hides fetched values in the command's output #169 (execve, no child process); test. - An interactive command still works with the default (test: a command that checks
isattyon stdout, or a pty test), or the chosen rule for terminals is tested and documented. - Exit code and signals of the command reach the caller as before (tests).
- DESIGN.md, THREAT-MODEL.md (T15) and docs/setup.md updated; the changelog names the new default and
--no-mask. - Security review and code review, findings fixed.
Activity
feat(run): mask by default; --no-mask runs the command with execve
docs: mask is the default of nodkey run; --no-mask; the rule for term…
fix: security review of #170: deny test of the masked default, docs a…
feat(run): mask fetched values by default; --no-mask turns it off (#171)
groupsky commentedon Nov 11, 2026
Done in #171 (squash commit 6e42f97).
nodkey runwithout flags masks values in stdout and stderr:TestRunMasksByDefault(child process, canary value printed to both streams becomes***),TestRunMaskRule(default, pipe → masked).nodkey run --no-maskbehaves as before feat(run): --mask hides fetched values in the command's output #169:TestRunNoMaskExecs(the command has the same PID as nodkey, soexecve, no child). The execve-specific tests (TestRunKeepsSIGPIPE,TestRunInheritedSIGPIPE,TestRunCannotStart,TestRunNotDumpable) now run with--no-mask.--maskmasks there too. Tested byTestRunMaskRule(all 6 option/terminal cases) andTestIsTerminal(a real pseudo-terminal; a pipe, a file and /dev/null are not terminals). Documented in DESIGN.md section 5 step 7 and section 15, and docs/setup.md.TestRunMasksByDefaultandTestRunNoMaskExecs(exit 7 passes through),TestRunMaskedSignal(command dies of SIGTERM → nodkey dies of SIGTERM),TestRunMaskDenied(deny runs nothing), plus the existingmaskedCommandtests.--maskcovers it), and the ioctl check stays in two places.