{
"name": "fnox",
"bin": "fnox",
"cmd": {
"full_cmd": [],
"usage": "[FLAGS] <SUBCOMMAND>",
"subcommands": {
"activate": {
"full_cmd": ["activate"],
"usage": "activate [--no-hook-env] [SHELL]",
"subcommands": {},
"args": [
{
"name": "SHELL",
"usage": "[SHELL]",
"help": "Shell to generate activation code for (bash, zsh, fish, nu, pwsh)",
"help_first_line": "Shell to generate activation code for (bash, zsh, fish, nu, pwsh)",
"required": false,
"double_dash": "Optional",
"hide": false
}
],
"flags": [
{
"name": "no-hook-env",
"usage": "--no-hook-env",
"help": "Don't automatically invoke hook-env (for testing)",
"help_first_line": "Don't automatically invoke hook-env (for testing)",
"short": [],
"long": ["no-hook-env"],
"hide": false,
"global": false
}
],
"mounts": [],
"hide": false,
"help": "Output shell activation code to enable automatic secret loading",
"name": "activate",
"aliases": [],
"hidden_aliases": [],
"examples": []
},
"check": {
"full_cmd": ["check"],
"usage": "check [-a --all]",
"subcommands": {},
"args": [],
"flags": [
{
"name": "all",
"usage": "-a --all",
"help": "Check all secrets including those with if_missing=warn or if_missing=ignore",
"help_first_line": "Check all secrets including those with if_missing=warn or if_missing=ignore",
"short": ["a"],
"long": ["all"],
"hide": false,
"global": false
}
],
"mounts": [],
"hide": false,
"help": "Check if all required secrets are defined and configured",
"name": "check",
"aliases": ["c"],
"hidden_aliases": [],
"examples": []
},
"ci-redact": {
"full_cmd": ["ci-redact"],
"usage": "ci-redact",
"subcommands": {},
"args": [],
"flags": [],
"mounts": [],
"hide": true,
"help": "Redact secrets in CI/CD output (GitHub Actions mask)",
"name": "ci-redact",
"aliases": [],
"hidden_aliases": [],
"examples": []
},
"completion": {
"full_cmd": ["completion"],
"usage": "completion <SHELL>",
"subcommands": {},
"args": [
{
"name": "SHELL",
"usage": "<SHELL>",
"help": "Shell type to generate completions for",
"help_first_line": "Shell type to generate completions for",
"required": true,
"double_dash": "Optional",
"hide": false
}
],
"flags": [],
"mounts": [],
"hide": false,
"help": "Generate shell completions",
"name": "completion",
"aliases": [],
"hidden_aliases": ["complete", "completions"],
"examples": []
},
"config-files": {
"full_cmd": ["config-files"],
"usage": "config-files",
"subcommands": {},
"args": [],
"flags": [],
"mounts": [],
"hide": false,
"help": "List all config files that would be loaded",
"name": "config-files",
"aliases": [],
"hidden_aliases": [],
"examples": []
},
"deactivate": {
"full_cmd": ["deactivate"],
"usage": "deactivate",
"subcommands": {},
"args": [],
"flags": [],
"mounts": [],
"hide": false,
"help": "Disable fnox shell integration in the current shell session",
"name": "deactivate",
"aliases": [],
"hidden_aliases": [],
"examples": []
},
"doctor": {
"full_cmd": ["doctor"],
"usage": "doctor",
"subcommands": {},
"args": [],
"flags": [],
"mounts": [],
"hide": false,
"help": "Show diagnostic information about the current fnox state",
"name": "doctor",
"aliases": ["dr"],
"hidden_aliases": [],
"examples": []
},
"edit": {
"full_cmd": ["edit"],
"usage": "edit",
"subcommands": {},
"args": [],
"flags": [],
"mounts": [],
"hide": false,
"help": "Edit the configuration file",
"name": "edit",
"aliases": [],
"hidden_aliases": [],
"examples": []
},
"exec": {
"full_cmd": ["exec"],
"usage": "exec [COMMAND]…",
"subcommands": {},
"args": [
{
"name": "COMMAND",
"usage": "[COMMAND]…",
"help": "Command to run",
"help_first_line": "Command to run",
"required": false,
"double_dash": "Automatic",
"var": true,
"hide": false
}
],
"flags": [],
"mounts": [],
"hide": false,
"help": "Execute a command with secrets as environment variables",
"name": "exec",
"aliases": ["x"],
"hidden_aliases": ["run"],
"examples": []
},
"export": {
"full_cmd": ["export"],
"usage": "export [FLAGS]",
"subcommands": {},
"args": [],
"flags": [
{
"name": "format",
"usage": "-f --format <FORMAT>",
"help": "Export format",
"help_first_line": "Export format",
"short": ["f"],
"long": ["format"],
"hide": false,
"global": false,
"arg": {
"name": "FORMAT",
"usage": "<FORMAT>",
"required": true,
"double_dash": "Optional",
"hide": false,
"choices": {
"choices": ["env", "json", "yaml", "toml"]
}
},
"default": ["env"]
},
{
"name": "dry-run",
"usage": "-n --dry-run",
"help": "Show what would be exported without writing to file",
"help_first_line": "Show what would be exported without writing to file",
"short": ["n"],
"long": ["dry-run"],
"hide": false,
"global": false
},
{
"name": "output",
"usage": "-o --output <OUTPUT>",
"help": "Output file (default: stdout)",
"help_first_line": "Output file (default: stdout)",
"short": ["o"],
"long": ["output"],
"hide": false,
"global": false,
"arg": {
"name": "OUTPUT",
"usage": "<OUTPUT>",
"required": true,
"double_dash": "Optional",
"hide": false
}
}
],
"mounts": [],
"hide": false,
"help": "Export secrets in various formats",
"name": "export",
"aliases": ["ex"],
"hidden_aliases": [],
"examples": []
},
"get": {
"full_cmd": ["get"],
"usage": "get [--base64-decode] <KEY>",
"subcommands": {},
"args": [
{
"name": "KEY",
"usage": "<KEY>",
"help": "Secret key to retrieve",
"help_first_line": "Secret key to retrieve",
"required": true,
"double_dash": "Optional",
"hide": false
}
],
"flags": [
{
"name": "base64-decode",
"usage": "--base64-decode",
"help": "Base64 decode the secret",
"help_first_line": "Base64 decode the secret",
"short": [],
"long": ["base64-decode"],
"hide": false,
"global": false
}
],
"mounts": [],
"hide": false,
"help": "Get a secret value",
"name": "get",
"aliases": [],
"hidden_aliases": [],
"examples": []
},
"hook-env": {
"full_cmd": ["hook-env"],
"usage": "hook-env [-s --shell <SHELL>]",
"subcommands": {},
"args": [],
"flags": [
{
"name": "shell",
"usage": "-s --shell <SHELL>",
"help": "Shell type (bash, zsh, fish, nu, pwsh)",
"help_first_line": "Shell type (bash, zsh, fish, nu, pwsh)",
"short": ["s"],
"long": ["shell"],
"hide": false,
"global": false,
"arg": {
"name": "SHELL",
"usage": "<SHELL>",
"required": true,
"double_dash": "Optional",
"hide": false
}
}
],
"mounts": [],
"hide": true,
"help": "Internal command used by shell hooks to load secrets",
"name": "hook-env",
"aliases": [],
"hidden_aliases": [],
"examples": []
},
"import": {
"full_cmd": ["import"],
"usage": "import <FLAGS> [FORMAT]",
"subcommands": {},
"args": [
{
"name": "FORMAT",
"usage": "[FORMAT]",
"help": "Import source format",
"help_first_line": "Import source format",
"required": false,
"double_dash": "Optional",
"hide": false,
"default": ["env"],
"choices": {
"choices": ["env", "json", "yaml", "toml"]
}
}
],
"flags": [
{
"name": "force",
"usage": "-f --force",
"help": "Skip confirmation prompts",
"help_first_line": "Skip confirmation prompts",
"short": ["f"],
"long": ["force"],
"hide": false,
"global": false
},
{
"name": "global",
"usage": "-g --global",
"help": "Import to the global config file (~/.config/fnox/config.toml)",
"help_first_line": "Import to the global config file (~/.config/fnox/config.toml)",
"short": ["g"],
"long": ["global"],
"hide": false,
"global": false
},
{
"name": "input",
"usage": "-i --input <INPUT>",
"help": "Source file or path to import from (default: stdin)",
"help_first_line": "Source file or path to import from (default: stdin)",
"short": ["i"],
"long": ["input"],
"hide": false,
"global": false,
"arg": {
"name": "INPUT",
"usage": "<INPUT>",
"required": true,
"double_dash": "Optional",
"hide": false
}
},
{
"name": "dry-run",
"usage": "-n --dry-run",
"help": "Show what would be imported without making changes",
"help_first_line": "Show what would be imported without making changes",
"short": ["n"],
"long": ["dry-run"],
"hide": false,
"global": false
},
{
"name": "provider",
"usage": "-p --provider <PROVIDER>",
"help": "Provider to use for encrypting/storing imported secrets (required)",
"help_first_line": "Provider to use for encrypting/storing imported secrets (required)",
"short": ["p"],
"long": ["provider"],
"required": true,
"hide": false,
"global": false,
"arg": {
"name": "PROVIDER",
"usage": "<PROVIDER>",
"required": true,
"double_dash": "Optional",
"hide": false
}
},
{
"name": "filter",
"usage": "--filter <FILTER>",
"help": "Only import matching secrets (regex pattern)",
"help_first_line": "Only import matching secrets (regex pattern)",
"short": [],
"long": ["filter"],
"hide": false,
"global": false,
"arg": {
"name": "FILTER",
"usage": "<FILTER>",
"required": true,
"double_dash": "Optional",
"hide": false
}
},
{
"name": "prefix",
"usage": "--prefix <PREFIX>",
"help": "Prefix to add to imported secret names",
"help_first_line": "Prefix to add to imported secret names",
"short": [],
"long": ["prefix"],
"hide": false,
"global": false,
"arg": {
"name": "PREFIX",
"usage": "<PREFIX>",
"required": true,
"double_dash": "Optional",
"hide": false
}
}
],
"mounts": [],
"hide": false,
"help": "Import secrets from various sources",
"name": "import",
"aliases": ["im"],
"hidden_aliases": [],
"examples": []
},
"init": {
"full_cmd": ["init"],
"usage": "init [FLAGS]",
"subcommands": {},
"args": [],
"flags": [
{
"name": "force",
"usage": "-f --force",
"help": "Overwrite existing configuration file",
"help_first_line": "Overwrite existing configuration file",
"short": ["f"],
"long": ["force"],
"hide": false,
"global": false
},
{
"name": "global",
"usage": "-g --global",
"help": "Initialize the global config file (~/.config/fnox/config.toml)",
"help_first_line": "Initialize the global config file (~/.config/fnox/config.toml)",
"short": ["g"],
"long": ["global"],
"hide": false,
"global": false
},
{
"name": "skip-wizard",
"usage": "--skip-wizard",
"help": "Skip the interactive wizard and create a minimal config",
"help_first_line": "Skip the interactive wizard and create a minimal config",
"short": [],
"long": ["skip-wizard"],
"hide": false,
"global": false
}
],
"mounts": [],
"hide": false,
"help": "Initialize a new fnox configuration file",
"name": "init",
"aliases": ["i"],
"hidden_aliases": [],
"examples": []
},
"lease": {
"full_cmd": ["lease"],
"usage": "lease <SUBCOMMAND>",
"subcommands": {
"cleanup": {
"full_cmd": ["lease", "cleanup"],
"usage": "lease cleanup",
"subcommands": {},
"args": [],
"flags": [],
"mounts": [],
"hide": false,
"help": "Revoke all expired leases that need manual cleanup",
"name": "cleanup",
"aliases": [],
"hidden_aliases": [],
"examples": []
},
"create": {
"full_cmd": ["lease", "create"],
"usage": "lease create [FLAGS] [BACKEND_NAME]",
"subcommands": {},
"args": [
{
"name": "BACKEND_NAME",
"usage": "[BACKEND_NAME]",
"help": "Lease backend name (from `[leases.<name>]` config). Creates all backends if omitted",
"help_first_line": "Lease backend name (from `[leases.<name>]` config). Creates all backends if omitted",
"required": false,
"double_dash": "Optional",
"hide": false
}
],
"flags": [
{
"name": "all",
"usage": "-a --all",
"help": "Create leases for all configured backends",
"help_first_line": "Create leases for all configured backends",
"short": ["a"],
"long": ["all"],
"hide": false,
"global": false
},
{
"name": "duration",
"usage": "-d --duration <DURATION>",
"help": "Lease duration (e.g., \"15m\", \"1h\", \"2h30m\"); overrides config duration",
"help_first_line": "Lease duration (e.g., \"15m\", \"1h\", \"2h30m\"); overrides config duration",
"short": ["d"],
"long": ["duration"],
"hide": false,
"global": false,
"arg": {
"name": "DURATION",
"usage": "<DURATION>",
"required": true,
"double_dash": "Optional",
"hide": false
}
},
{
"name": "format",
"usage": "-f --format <FORMAT>",
"help": "Output format",
"help_first_line": "Output format",
"short": ["f"],
"long": ["format"],
"hide": false,
"global": false,
"arg": {
"name": "FORMAT",
"usage": "<FORMAT>",
"required": true,
"double_dash": "Optional",
"hide": false,
"choices": {
"choices": ["shell", "json", "env"]
}
},
"default": ["shell"]
},
{
"name": "interactive",
"usage": "-i --interactive",
"help": "Prompt interactively for missing credentials",
"help_first_line": "Prompt interactively for missing credentials",
"short": ["i"],
"long": ["interactive"],
"hide": false,
"global": false
},
{
"name": "label",
"usage": "-l --label <LABEL>",
"help": "Label for the lease (e.g., session purpose)",
"help_first_line": "Label for the lease (e.g., session purpose)",
"short": ["l"],
"long": ["label"],
"hide": false,
"global": false,
"arg": {
"name": "LABEL",
"usage": "<LABEL>",
"required": true,
"double_dash": "Optional",
"hide": false
},
"default": ["fnox-lease"]
}
],
"mounts": [],
"hide": false,
"help": "Create a short-lived credential lease from a secret",
"name": "create",
"aliases": [],
"hidden_aliases": [],
"examples": []
},
"list": {
"full_cmd": ["lease", "list"],
"usage": "lease list [--active] [--expired]",
"subcommands": {},
"args": [],
"flags": [
{
"name": "active",
"usage": "--active",
"help": "Show only active (non-expired, non-revoked) leases",
"help_first_line": "Show only active (non-expired, non-revoked) leases",
"short": [],
"long": ["active"],
"hide": false,
"global": false
},
{
"name": "expired",
"usage": "--expired",
"help": "Show only expired leases",
"help_first_line": "Show only expired leases",
"short": [],
"long": ["expired"],
"hide": false,
"global": false
}
],
"mounts": [],
"hide": false,
"help": "List tracked leases",
"name": "list",
"aliases": [],
"hidden_aliases": [],
"examples": []
},
"revoke": {
"full_cmd": ["lease", "revoke"],
"usage": "lease revoke <LEASE_ID>",
"subcommands": {},
"args": [
{
"name": "LEASE_ID",
"usage": "<LEASE_ID>",
"help": "Lease ID to revoke",
"help_first_line": "Lease ID to revoke",
"required": true,
"double_dash": "Optional",
"hide": false
}
],
"flags": [],
"mounts": [],
"hide": false,
"help": "Revoke a lease by ID",
"name": "revoke",
"aliases": [],
"hidden_aliases": [],
"examples": []
}
},
"args": [],
"flags": [],
"mounts": [],
"hide": false,
"help": "Manage ephemeral credential leases",
"name": "lease",
"aliases": [],
"hidden_aliases": [],
"examples": []
},
"list": {
"full_cmd": ["list"],
"usage": "list [FLAGS]",
"subcommands": {},
"args": [],
"flags": [
{
"name": "full",
"usage": "-f --full",
"help": "Show full provider keys without truncation",
"help_first_line": "Show full provider keys without truncation",
"short": ["f"],
"long": ["full"],
"hide": false,
"global": false
},
{
"name": "sources",
"usage": "-s --sources",
"help": "Show source file paths where secrets are defined",
"help_first_line": "Show source file paths where secrets are defined",
"short": ["s"],
"long": ["sources"],
"hide": false,
"global": false
},
{
"name": "values",
"usage": "-V --values",
"help": "Show secret values (if available)",
"help_first_line": "Show secret values (if available)",
"short": ["V"],
"long": ["values"],
"hide": false,
"global": false
},
{
"name": "complete",
"usage": "--complete",
"help": "Output secret keys for shell completion (one per line)",
"help_first_line": "Output secret keys for shell completion (one per line)",
"short": [],
"long": ["complete"],
"hide": true,
"global": false
}
],
"mounts": [],
"hide": false,
"help": "List all secrets",
"name": "list",
"aliases": ["ls", "secrets"],
"hidden_aliases": [],
"examples": []
},
"mcp": {
"full_cmd": ["mcp"],
"usage": "mcp",
"subcommands": {},
"args": [],
"flags": [],
"mounts": [],
"hide": false,
"help": "Start an MCP server for secret-gated AI agent access",
"name": "mcp",
"aliases": [],
"hidden_aliases": [],
"examples": []
},
"profiles": {
"full_cmd": ["profiles"],
"usage": "profiles",
"subcommands": {},
"args": [],
"flags": [
{
"name": "complete",
"usage": "--complete",
"help": "Output profile names for shell completion (one per line)",
"help_first_line": "Output profile names for shell completion (one per line)",
"short": [],
"long": ["complete"],
"hide": true,
"global": false
}
],
"mounts": [],
"hide": false,
"help": "List available profiles",
"name": "profiles",
"aliases": [],
"hidden_aliases": ["profile"],
"examples": []
},
"provider": {
"full_cmd": ["provider"],
"usage": "provider <SUBCOMMAND>",
"subcommands": {
"add": {
"full_cmd": ["provider", "add"],
"usage": "provider add [-g --global] [--vault <VAULT>] <PROVIDER> <PROVIDER_TYPE>",
"subcommands": {},
"args": [
{
"name": "PROVIDER",
"usage": "<PROVIDER>",
"help": "Provider name",
"help_first_line": "Provider name",
"required": true,
"double_dash": "Optional",
"hide": false
},
{
"name": "PROVIDER_TYPE",
"usage": "<PROVIDER_TYPE>",
"help": "Provider type",
"help_first_line": "Provider type",
"required": true,
"double_dash": "Optional",
"hide": false,
"choices": {
"choices": [
"1password",
"age",
"aws",
"aws-kms",
"aws-ps",
"azure-kms",
"azure-sm",
"gcp",
"gcp-kms",
"fido2",
"bitwarden",
"doppler",
"bitwarden-sm",
"infisical",
"keepass",
"keychain",
"password-store",
"passwordstate",
"plain",
"proton-pass",
"vault",
"yubikey"
]
}
}
],
"flags": [
{
"name": "global",
"usage": "-g --global",
"help": "Add to the global config file (~/.config/fnox/config.toml)",
"help_first_line": "Add to the global config file (~/.config/fnox/config.toml)",
"short": ["g"],
"long": ["global"],
"hide": false,
"global": false
},
{
"name": "vault",
"usage": "--vault <VAULT>",
"help": "Default Proton Pass vault name (only valid with provider type proton-pass)",
"help_first_line": "Default Proton Pass vault name (only valid with provider type proton-pass)",
"short": [],
"long": ["vault"],
"hide": false,
"global": false,
"arg": {
"name": "VAULT",
"usage": "<VAULT>",
"required": true,
"double_dash": "Optional",
"hide": false
}
}
],
"mounts": [],
"hide": false,
"help": "Add a new provider",
"name": "add",
"aliases": ["a", "set"],
"hidden_aliases": [],
"examples": []
},
"list": {
"full_cmd": ["provider", "list"],
"usage": "provider list",
"subcommands": {},
"args": [],
"flags": [
{
"name": "complete",
"usage": "--complete",
"help": "Output provider names for shell completion (one per line)",
"help_first_line": "Output provider names for shell completion (one per line)",
"short": [],
"long": ["complete"],
"hide": true,
"global": false
}
],
"mounts": [],
"hide": false,
"help": "List available providers",
"name": "list",
"aliases": ["ls"],
"hidden_aliases": [],
"examples": []
},
"remove": {
"full_cmd": ["provider", "remove"],
"usage": "provider remove [-g --global] <PROVIDER>",
"subcommands": {},
"args": [
{
"name": "PROVIDER",
"usage": "<PROVIDER>",
"help": "Provider name",
"help_first_line": "Provider name",
"required": true,
"double_dash": "Optional",
"hide": false
}
],
"flags": [
{
"name": "global",
"usage": "-g --global",
"help": "Remove from the global config file (~/.config/fnox/config.toml)",
"help_first_line": "Remove from the global config file (~/.config/fnox/config.toml)",
"short": ["g"],
"long": ["global"],
"hide": false,
"global": false
}
],
"mounts": [],
"hide": false,
"help": "Remove a provider",
"name": "remove",
"aliases": ["rm", "delete"],
"hidden_aliases": [],
"examples": []
},
"test": {
"full_cmd": ["provider", "test"],
"usage": "provider test [-a --all] [PROVIDER]",
"subcommands": {},
"args": [
{
"name": "PROVIDER",
"usage": "[PROVIDER]",
"help": "Provider name (optional when using --all)",
"help_first_line": "Provider name (optional when using --all)",
"required": false,
"double_dash": "Optional",
"hide": false
}
],
"flags": [
{
"name": "all",
"usage": "-a --all",
"help": "Test all configured providers",
"help_first_line": "Test all configured providers",
"short": ["a"],
"long": ["all"],
"hide": false,
"global": false
}
],
"mounts": [],
"hide": false,
"help": "Test a provider connection",
"name": "test",
"aliases": ["t"],
"hidden_aliases": [],
"examples": []
}
},
"args": [],
"flags": [],
"mounts": [],
"hide": false,
"help": "Manage providers (defaults to list)",
"name": "provider",
"aliases": [],
"hidden_aliases": [],
"examples": []
},
"reencrypt": {
"full_cmd": ["reencrypt"],
"usage": "reencrypt [FLAGS] [KEYS]…",
"subcommands": {},
"args": [
{
"name": "KEYS",
"usage": "[KEYS]…",
"help": "Only re-encrypt these specific secret keys",
"help_first_line": "Only re-encrypt these specific secret keys",
"required": false,
"double_dash": "Optional",
"var": true,
"hide": false
}
],
"flags": [
{
"name": "force",
"usage": "-f --force",
"help": "Skip confirmation prompt",
"help_first_line": "Skip confirmation prompt",
"short": ["f"],
"long": ["force"],
"hide": false,
"global": false
},
{
"name": "dry-run",
"usage": "-n --dry-run",
"help": "Show what would be done without making changes",
"help_first_line": "Show what would be done without making changes",
"short": ["n"],
"long": ["dry-run"],
"hide": false,
"global": false
},
{
"name": "provider",
"usage": "-p --provider <PROVIDER>",
"help": "Only re-encrypt secrets from this provider",
"help_first_line": "Only re-encrypt secrets from this provider",
"short": ["p"],
"long": ["provider"],
"hide": false,
"global": false,
"arg": {
"name": "PROVIDER",
"usage": "<PROVIDER>",
"required": true,
"double_dash": "Optional",
"hide": false
}
},
{
"name": "filter",
"usage": "--filter <FILTER>",
"help": "Only re-encrypt matching secrets (regex pattern)",
"help_first_line": "Only re-encrypt matching secrets (regex pattern)",
"short": [],
"long": ["filter"],
"hide": false,
"global": false,
"arg": {
"name": "FILTER",
"usage": "<FILTER>",
"required": true,
"double_dash": "Optional",
"hide": false
}
}
],
"mounts": [],
"hide": false,
"help": "Re-encrypt secrets with current provider configuration",
"name": "reencrypt",
"aliases": [],
"hidden_aliases": [],
"examples": []
},
"remove": {
"full_cmd": ["remove"],
"usage": "remove [-g --global] [-n --dry-run] <KEY>",
"subcommands": {},
"args": [
{
"name": "KEY",
"usage": "<KEY>",
"help": "Secret key to remove",
"help_first_line": "Secret key to remove",
"required": true,
"double_dash": "Optional",
"hide": false
}
],
"flags": [
{
"name": "global",
"usage": "-g --global",
"help": "Remove from the global config file (~/.config/fnox/config.toml)",
"help_first_line": "Remove from the global config file (~/.config/fnox/config.toml)",
"short": ["g"],
"long": ["global"],
"hide": false,
"global": false
},
{
"name": "dry-run",
"usage": "-n --dry-run",
"help": "Show what would be removed without making changes",
"help_first_line": "Show what would be removed without making changes",
"short": ["n"],
"long": ["dry-run"],
"hide": false,
"global": false
}
],
"mounts": [],
"hide": false,
"help": "Remove a secret",
"name": "remove",
"aliases": ["rm", "delete"],
"hidden_aliases": [],
"examples": []
},
"scan": {
"full_cmd": ["scan"],
"usage": "scan [FLAGS]",
"subcommands": {},
"args": [],
"flags": [
{
"name": "dir",
"usage": "-d --dir <DIR>",
"help": "Directory to scan (default: current directory)",
"help_first_line": "Directory to scan (default: current directory)",
"short": ["d"],
"long": ["dir"],
"hide": false,
"global": false,
"arg": {
"name": "DIR",
"usage": "<DIR>",
"required": true,
"double_dash": "Optional",
"hide": false
},
"default": ["."]
},
{
"name": "ignore",
"usage": "-i --ignore… <IGNORE>",
"help": "Skip files matching this pattern (can be used multiple times)",
"help_first_line": "Skip files matching this pattern (can be used multiple times)",
"short": ["i"],
"long": ["ignore"],
"var": true,
"hide": false,
"global": false,
"arg": {
"name": "IGNORE",
"usage": "<IGNORE>",
"required": true,
"double_dash": "Optional",
"hide": false
}
},
{
"name": "quiet",
"usage": "-q --quiet",
"help": "Show only files with potential secrets",
"help_first_line": "Show only files with potential secrets",
"short": ["q"],
"long": ["quiet"],
"hide": false,
"global": false
}
],
"mounts": [],
"hide": false,
"help": "Scan repository for potential secrets",
"name": "scan",
"aliases": [],
"hidden_aliases": [],
"examples": []
},
"schema": {
"full_cmd": ["schema"],
"usage": "schema",
"subcommands": {},
"args": [],
"flags": [],
"mounts": [],
"hide": true,
"help": "Generate JSON Schema for fnox configuration",
"name": "schema",
"aliases": [],
"hidden_aliases": [],
"examples": []
},
"set": {
"full_cmd": ["set"],
"usage": "set [FLAGS] <KEY> [VALUE]",
"subcommands": {},
"args": [
{
"name": "KEY",
"usage": "<KEY>",
"help": "Secret key (environment variable name)",
"help_first_line": "Secret key (environment variable name)",
"required": true,
"double_dash": "Optional",
"hide": false
},
{
"name": "VALUE",
"usage": "[VALUE]",
"help": "Secret value to store",
"help_long": "Secret value to store.\n\nIf omitted: reads from stdin when piped (`echo \"x\" | fnox set KEY`), or prompts interactively with hidden input.\n\nPassing secrets as arguments exposes them in shell history and `ps` output. For sensitive values, prefer stdin or the interactive prompt.",
"help_first_line": "Secret value to store",
"required": false,
"double_dash": "Optional",
"hide": false
}
],
"flags": [
{
"name": "description",
"usage": "-d --description <DESCRIPTION>",
"help": "Description of the secret",
"help_first_line": "Description of the secret",
"short": ["d"],
"long": ["description"],
"hide": false,
"global": false,
"arg": {
"name": "DESCRIPTION",
"usage": "<DESCRIPTION>",
"required": true,
"double_dash": "Optional",
"hide": false
}
},
{
"name": "global",
"usage": "-g --global",
"help": "Save to the global config file (~/.config/fnox/config.toml)",
"help_first_line": "Save to the global config file (~/.config/fnox/config.toml)",
"short": ["g"],
"long": ["global"],
"hide": false,
"global": false
},
{
"name": "key-name",
"usage": "-k --key-name <KEY_NAME>",
"help": "Key name in the provider (if different from env var name)",
"help_first_line": "Key name in the provider (if different from env var name)",
"short": ["k"],
"long": ["key-name"],
"hide": false,
"global": false,
"arg": {
"name": "KEY_NAME",
"usage": "<KEY_NAME>",
"required": true,
"double_dash": "Optional",
"hide": false
}
},
{
"name": "dry-run",
"usage": "-n --dry-run",
"help": "Show what would be done without making changes",
"help_first_line": "Show what would be done without making changes",
"short": ["n"],
"long": ["dry-run"],
"hide": false,
"global": false
},
{
"name": "provider",
"usage": "-p --provider <PROVIDER>",
"help": "Provider to fetch from",
"help_first_line": "Provider to fetch from",
"short": ["p"],
"long": ["provider"],
"hide": false,
"global": false,
"arg": {
"name": "PROVIDER",
"usage": "<PROVIDER>",
"required": true,
"double_dash": "Optional",
"hide": false
}
},
{
"name": "base64-encode",
"usage": "--base64-encode",
"help": "Base64 encode the secret",
"help_first_line": "Base64 encode the secret",
"short": [],
"long": ["base64-encode"],
"hide": false,
"global": false
},
{
"name": "default",
"usage": "--default <DEFAULT>",
"help": "Default value to use if secret is not found",
"help_first_line": "Default value to use if secret is not found",
"short": [],
"long": ["default"],
"hide": false,
"global": false,
"arg": {
"name": "DEFAULT",
"usage": "<DEFAULT>",
"required": true,
"double_dash": "Optional",
"hide": false
}
},
{
"name": "if-missing",
"usage": "--if-missing <IF_MISSING>",
"help": "What to do if the secret is missing (error, warn, ignore)",
"help_first_line": "What to do if the secret is missing (error, warn, ignore)",
"short": [],
"long": ["if-missing"],
"hide": false,
"global": false,
"arg": {
"name": "IF_MISSING",
"usage": "<IF_MISSING>",
"required": true,
"double_dash": "Optional",
"hide": false,
"choices": {
"choices": ["error", "warn", "ignore"]
}
}
}
],
"mounts": [],
"hide": false,
"help": "Set a secret value",
"name": "set",
"aliases": ["s"],
"hidden_aliases": [],
"examples": []
},
"sync": {
"full_cmd": ["sync"],
"usage": "sync [FLAGS] [KEYS]…",
"subcommands": {},
"args": [
{
"name": "KEYS",
"usage": "[KEYS]…",
"help": "Only sync these specific secret keys",
"help_first_line": "Only sync these specific secret keys",
"required": false,
"double_dash": "Optional",
"var": true,
"hide": false
}
],
"flags": [
{
"name": "force",
"usage": "-f --force",
"help": "Skip confirmation prompt",
"help_first_line": "Skip confirmation prompt",
"short": ["f"],
"long": ["force"],
"hide": false,
"global": false
},
{
"name": "global",
"usage": "-g --global",
"help": "Write to global config (~/.config/fnox/config.toml)",
"help_first_line": "Write to global config (~/.config/fnox/config.toml)",
"short": ["g"],
"long": ["global"],
"hide": false,
"global": false
},
{
"name": "dry-run",
"usage": "-n --dry-run",
"help": "Show what would be done without making changes",
"help_first_line": "Show what would be done without making changes",
"short": ["n"],
"long": ["dry-run"],
"hide": false,
"global": false
},
{
"name": "provider",
"usage": "-p --provider <PROVIDER>",
"help": "Target encryption provider (defaults to default_provider)",
"help_first_line": "Target encryption provider (defaults to default_provider)",
"short": ["p"],
"long": ["provider"],
"hide": false,
"global": false,
"arg": {
"name": "PROVIDER",
"usage": "<PROVIDER>",
"required": true,
"double_dash": "Optional",
"hide": false
}
},
{
"name": "source",
"usage": "-s --source <SOURCE>",
"help": "Only sync secrets from this source provider",
"help_first_line": "Only sync secrets from this source provider",
"short": ["s"],
"long": ["source"],
"hide": false,
"global": false,
"arg": {
"name": "SOURCE",
"usage": "<SOURCE>",
"required": true,
"double_dash": "Optional",
"hide": false
}
},
{
"name": "filter",
"usage": "--filter <FILTER>",
"help": "Only sync matching secrets (regex pattern)",
"help_first_line": "Only sync matching secrets (regex pattern)",
"short": [],
"long": ["filter"],
"hide": false,
"global": false,
"arg": {
"name": "FILTER",
"usage": "<FILTER>",
"required": true,
"double_dash": "Optional",
"hide": false
}
},
{
"name": "local-file",
"usage": "--local-file",
"help": "Write sync overrides to the local override file next to the config file",
"help_first_line": "Write sync overrides to the local override file next to the config file",
"short": [],
"long": ["local-file"],
"hide": false,
"global": false
}
],
"mounts": [],
"hide": false,
"help": "Sync secrets from remote providers to a local encryption provider",
"name": "sync",
"aliases": [],
"hidden_aliases": [],
"examples": []
},
"tui": {
"full_cmd": ["tui"],
"usage": "tui",
"subcommands": {},
"args": [],
"flags": [],
"mounts": [],
"hide": false,
"help": "Interactive TUI dashboard for managing secrets",
"name": "tui",
"aliases": [],
"hidden_aliases": [],
"examples": []
},
"usage": {
"full_cmd": ["usage"],
"usage": "usage",
"subcommands": {},
"args": [],
"flags": [],
"mounts": [],
"hide": true,
"help": "Generate usage specification",
"name": "usage",
"aliases": [],
"hidden_aliases": [],
"examples": []
},
"version": {
"full_cmd": ["version"],
"usage": "version",
"subcommands": {},
"args": [],
"flags": [],
"mounts": [],
"hide": false,
"help": "Show version information",
"name": "version",
"aliases": ["v"],
"hidden_aliases": [],
"examples": []
}
},
"args": [],
"flags": [
{
"name": "config",
"usage": "-c --config <CONFIG>",
"help": "Path to the configuration file (default: fnox.toml, searches parent directories)",
"help_first_line": "Path to the configuration file (default: fnox.toml, searches parent directories)",
"short": ["c"],
"long": ["config"],
"hide": false,
"global": true,
"arg": {
"name": "CONFIG",
"usage": "<CONFIG>",
"required": true,
"double_dash": "Optional",
"hide": false
},
"default": ["fnox.toml"]
},
{
"name": "profile",
"usage": "-P --profile <PROFILE>",
"help": "Profile to use (default: default, or FNOX_PROFILE env var)",
"help_first_line": "Profile to use (default: default, or FNOX_PROFILE env var)",
"short": ["P"],
"long": ["profile"],
"hide": false,
"global": true,
"arg": {
"name": "PROFILE",
"usage": "<PROFILE>",
"required": true,
"double_dash": "Optional",
"hide": false
}
},
{
"name": "verbose",
"usage": "-v --verbose",
"help": "Enable verbose logging",
"help_first_line": "Enable verbose logging",
"short": ["v"],
"long": ["verbose"],
"hide": false,
"global": true
},
{
"name": "age-key-file",
"usage": "--age-key-file <AGE_KEY_FILE>",
"help": "Path to age key file for decryption (deprecated: use provider config instead)",
"help_first_line": "Path to age key file for decryption (deprecated: use provider config instead)",
"short": [],
"long": ["age-key-file"],
"hide": true,
"global": true,
"arg": {
"name": "AGE_KEY_FILE",
"usage": "<AGE_KEY_FILE>",
"required": true,
"double_dash": "Optional",
"hide": false
}
},
{
"name": "if-missing",
"usage": "--if-missing <IF_MISSING>",
"help": "What to do if a secret is missing (error, warn, ignore)",
"help_first_line": "What to do if a secret is missing (error, warn, ignore)",
"short": [],
"long": ["if-missing"],
"hide": false,
"global": true,
"arg": {
"name": "IF_MISSING",
"usage": "<IF_MISSING>",
"required": true,
"double_dash": "Optional",
"hide": false
}
},
{
"name": "no-color",
"usage": "--no-color",
"help": "Disable colored output",
"help_first_line": "Disable colored output",
"short": [],
"long": ["no-color"],
"hide": false,
"global": true
},
{
"name": "no-defaults",
"usage": "--no-defaults",
"help": "Do not merge top-level secrets into the selected profile",
"help_first_line": "Do not merge top-level secrets into the selected profile",
"short": [],
"long": ["no-defaults"],
"hide": false,
"global": true
}
],
"mounts": [],
"hide": false,
"name": "fnox",
"aliases": [],
"hidden_aliases": [],
"examples": []
},
"config": {
"props": {}
},
"version": "1.21.0",
"usage": "Usage: fnox [OPTIONS] <COMMAND>",
"complete": {
"key": {
"name": "key",
"run": "fnox list --complete 2>/dev/null || true"
},
"name": {
"name": "name",
"run": "fnox provider list --complete 2>/dev/null || true"
},
"profile": {
"name": "profile",
"run": "fnox profiles --complete 2>/dev/null || true"
},
"config_file": {
"name": "config_file",
"type_": "file"
}
},
"about": "A flexible secret management tool by @jdx",
"min_usage_version": "1.3"
}