Skip loading secrets when navigating inside a project

[factory-kirk]

I use Fnox's shell integration, but it makes exploring a project much slower than I'd like. For example, I created a new directory like:

$ cd /tmp
$ mkdir fnox
$ mkdir fnox/inner
$ cat > fnox/fnox.toml
...

Now when I cd into it, fnox loads that directory's secrets as expected:

$ set -x FNOX_SHELL_OUTPUT debug
fnox: hook-env running in Some("/private/tmp")
fnox: changes detected, loading secrets

$ cd fnox
fnox: hook-env running in Some("/private/tmp/fnox")
fnox: changes detected, loading secrets
fnox: loaded 1 secret(s):
  + FOO
fnox: hook-env running in Some("/private/tmp/fnox")
fnox: early exit - no changes detected

But when I cd into inner, it loads the secrets again, even though it's empty and doesn't have any fnox.toml file to parse:

$ cd inner
fnox: hook-env running in Some("/private/tmp/fnox/inner")
fnox: changes detected, loading secrets
fnox: hook-env running in Some("/private/tmp/fnox/inner")
fnox: early exit - no changes detected

Just changing the directory takes nearly a second:

$ time cd ..
fnox: hook-env running in Some("/private/tmp/fnox")
fnox: changes detected, loading secrets

________________________________________________________
Executed in  791.01 millis    fish           external
   usr time   57.19 millis    0.73 millis   56.46 millis
   sys time   39.57 millis    1.37 millis   38.21 millis

fnox: hook-env running in Some("/private/tmp/fnox")
fnox: early exit - no changes detected

It'd be nice if fnox tracked its state, maybe by remembering the hash of all the current fnox.toml files it most recently evaluated, and only updating its records when that hash changes. Then I could bounce through a project with a top-level fnox.toml without the overhead of re-fetching secrets.

BTW, the daemon hugely mitigates this. This would be wonderful for situations where someone can't/won't use the daemon, and might make it unnecessary for the most common use cases.

[jdx]

Thanks for the detailed report. The existing hook session already fingerprints the config-file hierarchy, but an older working-directory check forced a reload before that fingerprint could be compared.

I opened #766 with a possible fix that lets hook-env exit early when moving within the same config hierarchy while still reloading when the hierarchy changes. The focused shell-integration tests pass, but this was AI-assisted and I still need to human-review it, so I’m not certain yet that it will handle every real-world shell/provider interaction correctly.

AI-assisted — Tool: Codex; model: unavailable/unavailable; version: unavailable.