gabriel / muse public
task/passphrase-env-warn #1 / 1
AI Agent gabriel · 162 days ago · Apr 17, 2026 · Diff

security: warn when MUSE_BIP39_PASSPHRASE env var is used as passphrase source

MUSE_BIP39_PASSPHRASE is visible to the process owner (and root) in /proc/pid/environ — less dangerous than the removed --passphrase flag (world-readable in ps) but still a meaningful exposure.

When the env var is consumed as the passphrase source, logger.warning fires on muse.cli.commands.auth naming the env var and recommending --passphrase-fd as the safer pipe-based alternative.

Warning is suppressed when: - the env var is not set (nothing to warn about) - --passphrase-fd is provided (env var is not consumed)

8 tests in test_passphrase_env_warn.py: fires for keygen/recover/rotate, names env var and --passphrase-fd, suppressed correctly in both silent cases, derivation result unchanged.

sha256:032ab53dcd3de86bedc0612e466cdc5e645e79c24e149907d476f4e123a3d410 sha
sha256:5e946ca6a85d4bbd868aa9e0e9789b9714596c93ac80a468deb871d834212485 parent
+32 ~1 symbols
sha256:f2abf026f1d30d37f5fc5b6ebe8845fb7ccfb9dfe34df3d83b0d1130ae8f66c9 snapshot
+32
symbols added
~1
symbol modified
0
dead code introduced
Semantic Changes 33 symbols
~ tests/test_passphrase_env_warn.py .py 32 symbols added
+ TestEnvVarWarningFires class class TestEnvVarWarningFires L124–206
+ test_I1_warning_on_keygen_with_env_var method method test_I1_warning_on_keygen_with_env_var L125–139
+ test_I2_warning_on_recover_with_env_var method method test_I2_warning_on_recover_with_env_var L141–156
+ test_I3_warning_on_rotate_with_env_var method method test_I3_warning_on_rotate_with_env_var L158–173
+ test_I4_warning_names_the_env_var method method test_I4_warning_names_the_env_var L175–188
+ test_I5_warning_mentions_passphrase_fd method method test_I5_warning_mentions_passphrase_fd L190–206
+ TestEnvVarWarningFunctional class class TestEnvVarWarningFunctional L253–276
+ test_III1_derivation_correct_with_warning method method test_III1_derivation_correct_with_warning L254–276
+ TestEnvVarWarningSuppressed class class TestEnvVarWarningSuppressed L214–245
+ test_II1_no_warning_when_env_var_not_set method method test_II1_no_warning_when_env_var_not_set L215–229
+ test_II2_no_warning_when_fd_provided method method test_II2_no_warning_when_fd_provided L231–245
+ _HUB variable variable _HUB L49–49
+ _LOGGER variable variable _LOGGER L54–54
+ _MNEMONIC variable variable _MNEMONIC L50–53
+ _fp function function _fp L107–108
+ _keygen function function _keygen L87–88
+ _passphrase_warnings function function _passphrase_warnings L111–116
+ _pipe_passphrase function function _pipe_passphrase L80–84
+ _recover function function _recover L91–96
+ _rotate function function _rotate L99–104
+ fixed_mnemonic function function fixed_mnemonic L74–77
+ CliRunner import import CliRunner L43–43
+ annotations import import annotations L34–34
+ id_module import import id_module L45–45
+ json import import json L36–36
+ kp_module import import kp_module L44–44
+ logging import import logging L37–37
+ os import import os L38–38
+ pathlib import import pathlib L39–39
+ pytest import import pytest L41–41
+ isolated function function isolated L63–70
+ runner variable variable runner L47–47
~ muse/cli/commands/auth.py .py 1 symbol modified
~ _resolve_passphrase
← Older Oldest on task/passphrase-env-warn
All commits
Newer → Latest on task/passphrase-env-warn

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:032ab53dcd3de86bedc0612e466cdc5e645e79c24e149907d476f4e123a3d410 --body "your comment"