gabriel / muse public
patch task/secure-passphrase-fd #1 / 1
AI Agent gabriel · 162 days ago · Apr 17, 2026 · Diff

security: replace --passphrase PHRASE with --passphrase-fd and getpass

Remove --passphrase PHRASE from auth keygen/recover/rotate — it was visible in ps aux and /proc/pid/cmdline to any local user on the system.

Safe delivery channels in priority order: 1. --passphrase-fd N — pipe fd; never appears in process table 2. MUSE_BIP39_PASSPHRASE env var — visible to owner in /proc/pid/environ 3. Interactive getpass prompt — TTY only, no echo 4. Empty string — standard BIP-39 behaviour

Add module-level _isatty() / _getpass() hooks for test monkeypatching. Add 11 tests in test_passphrase_secure.py covering fd, getpass, flag rejection, and priority order. Update test_bip39_passphrase.py and test_auth_rotate.py to use the new interface.

sha256:e3216d3355ffd8fca6eabb7732ca88dc7024cb7f79a6592f0a67099307afcfa7 sha
sha256:16d36a7fd82056419e2f4ffa62fcc0ebcf4fde11429f7a9d69a48a27ef014a45 parent
+43 ~16 −3 symbols
sha256:9837850fb8e1cec9e66ae38cd1d0d22f067eb5215e2a26e3018c354d777e6853 snapshot
+43
symbols added
~16
symbols modified
−3
symbols removed
0
dead code introduced
Semantic Changes 62 symbols
~ tests/test_passphrase_secure.py .py 34 symbols added
+ TestPassphraseFd class class TestPassphraseFd L115–176
+ test_I1_passphrase_fd_keygen_changes_fingerprint method method test_I1_passphrase_fd_keygen_changes_fingerprint L116–128
+ test_I2_passphrase_fd_recover_matches_keygen method method test_I2_passphrase_fd_recover_matches_keygen L130–142
+ test_I3_passphrase_fd_rotate method method test_I3_passphrase_fd_rotate L144–162
+ test_I4_trailing_newline_stripped method method test_I4_trailing_newline_stripped L164–176
+ TestPassphraseFlagRemoved class class TestPassphraseFlagRemoved L231–259
+ test_III1_passphrase_flag_rejected_keygen method method test_III1_passphrase_flag_rejected_keygen L232–237
+ test_III2_passphrase_flag_rejected_recover method method test_III2_passphrase_flag_rejected_recover L239–248
+ test_III3_passphrase_flag_rejected_rotate method method test_III3_passphrase_flag_rejected_rotate L250–259
+ TestPassphraseGetpass class class TestPassphraseGetpass L184–223
+ test_II1_getpass_called_when_tty method method test_II1_getpass_called_when_tty L185–202
+ test_II2_empty_getpass_gives_empty_passphrase method method test_II2_empty_getpass_gives_empty_passphrase L204–223
+ TestPassphrasePriority class class TestPassphrasePriority L267–303
+ test_IV1_fd_beats_env_var method method test_IV1_fd_beats_env_var L268–283
+ test_IV2_env_var_beats_getpass method method test_IV2_env_var_beats_getpass L285–303
+ _HUB variable variable _HUB L48–48
+ _MNEMONIC variable variable _MNEMONIC L49–52
+ _fp function function _fp L106–107
+ _keygen function function _keygen L86–87
+ _pipe_passphrase function function _pipe_passphrase L78–83
+ _recover function function _recover L90–95
+ _rotate function function _rotate L98–103
+ fixed_mnemonic function function fixed_mnemonic L72–75
+ CliRunner import import CliRunner L42–42
+ annotations import import annotations L33–33
+ id_module import import id_module L44–44
+ json import import json L35–35
+ kp_module import import kp_module L43–43
+ os import import os L36–36
+ patch import import patch L38–38
+ pathlib import import pathlib L37–37
+ pytest import import pytest L40–40
+ isolated function function isolated L61–68
+ runner variable variable runner L46–46
~ muse/cli/commands/auth.py .py 2 symbols added, 2 symbols modified
+ _getpass function function _getpass L108–110
+ _isatty function function _isatty L105–106
~ _resolve_passphrase
~ register
~ tests/test_auth_rotate.py .py 3 symbols added, 1 symbol removed, 2 symbols modified
− test_II2_passphrase_flag_changes_result method method test_II2_passphrase_flag_changes_result L191–206
+ test_II2_passphrase_fd_changes_result method method test_II2_passphrase_fd_changes_result L204–219
+ _pipe_passphrase function function _pipe_passphrase L79–84
+ os import import os L37–37
~ TestRotateFlags
~ test_II3_env_var_passphrase_works
~ tests/test_bip39_passphrase.py .py 4 symbols added, 2 symbols removed, 12 symbols modified
− test_II1_env_var_used_when_flag_absent method method test_II1_env_var_used_when_flag_absent L141–159
− test_II2_flag_takes_priority_over_env_var method method test_II2_flag_takes_priority_over_env_var L161–173
+ test_II1_env_var_used_when_fd_absent method method test_II1_env_var_used_when_fd_absent L158–176
+ test_II2_fd_takes_priority_over_env_var method method test_II2_fd_takes_priority_over_env_var L178–190
+ _pipe_passphrase function function _pipe_passphrase L84–89
+ os import import os L41–41
~ TestKeygenPassphrase
~ test_I1_passphrase_changes_fingerprint
~ test_I2_same_passphrase_deterministic
~ test_I3_different_passphrases_different_fingerprints
~ TestKeygenPassphraseEnvVar
~ TestPassphraseNeverStored
~ test_IV1_passphrase_not_in_identity_toml
~ test_IV2_passphrase_not_in_json_stdout
~ TestRecoverPassphrase
~ test_III1_recover_without_passphrase_differs_from_keygen_with_passphrase
~ test_III2_recover_with_same_passphrase_matches
~ test_III3_recover_via_env_var_matches
← Older Oldest on task/secure-passphrase-fd
All commits
Newer → Latest on task/secure-passphrase-fd

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:e3216d3355ffd8fca6eabb7732ca88dc7024cb7f79a6592f0a67099307afcfa7 --body "your comment"