id          = "fnox"
name        = "fnox"
homepage    = "https://fnox.jdx.dev/"
description = "A secret management tool for developers."
executables      = ["fnox"]

[dotfiles]

# https://fnox.jdx.dev/reference/configuration — the global config is
# ~/.config/fnox/config.toml (customizable with FNOX_CONFIG_DIR). It can hold
# provider and secret values, so the complete file is treated as a credential.
paths = ["~/.config/fnox/"]
secret = ["~/.config/fnox/config.toml"]

[commands]
format = 1
label = "Run with secrets"
description = "Run a command with fnox secrets in its environment. Profiles, leases and other fnox subcommands are not covered."
quality = "ai-draft"
parser = { end_of_options = "--", interleave = "permute", long_equals = true, short_attached = false, short_bundles = false }

[[commands.subcommand]]
path = ["exec"]
label = "Run a command with secrets"

[[commands.subcommand.source]]
id = "docs"
kind = "manual"
url = "https://fnox.jdx.dev/cli/exec"
revision = "docs/cli/exec.md on main"
evidence = """
- Usage: `fnox exec [FLAGS] [COMMAND]...`
- [COMMAND]... -- Command to run, with its arguments
- --except <NAME> -- Do not resolve these secrets; repeatable
- --only <NAME> -- Resolve only these secrets, plus the secrets they depend on; repeatable
- --redact -- Replace secret values with [REDACTED] in piped or redirected output
- --no-redact -- Never redact output, even if the config or FNOX_EXEC_REDACT enables it
Put fnox options before `--`; everything after it is the command.
"""

[[commands.subcommand.field]]
id = "only"
label = "Only these secrets"
description = "Secret names or globs such as AWS_*."
type = "string"
option = ["--only"]
multiple = true
sources = ["docs"]

[[commands.subcommand.field]]
id = "except"
label = "Except these secrets"
type = "string"
option = ["--except"]
multiple = true
sources = ["docs"]

[[commands.subcommand.field]]
id = "redact"
label = "Redact secrets in output"
type = "boolean"
option = ["--redact"]
sources = ["docs"]

[[commands.subcommand.field]]
id = "command"
label = "Command"
description = "The command and its arguments, run after `--`."
type = "string"
position = 0
multiple = true
min = 1
sources = ["docs"]

[[commands.subcommand.task]]
id = "run"
label = "Run a command"
fields = ["command", "only", "redact"]
required = ["command"]

[[commands.subcommand.group]]
id = "basic"
label = "Basic"
fields = ["command", "only", "except", "redact"]