$ show jdx/fnox
fnox is a production-grade secrets management CLI written in Rust. It resolves secrets from over 20 providers (encryption keys, cloud secret stores, password managers, hardware tokens) and injects them into subprocess environments, shell sessions, or a local TUI. The system uses a hierarchical, profile-based configuration model where secrets can be sourced from encrypted local files (age), cloud services (AWS, Azure, GCP, Vault), or third-party password managers (1Password, Bitwarden, Doppler, Proton Pass) with support for short-lived credential leases. It also provides a daemon for caching resolved secrets, an MCP server for AI agent integration, an HTTPS proxy that auto-injects credentials, and a secret scanning command for CI/CD pipelines.
The LLM identified 4 files worth highlighting for reuse:
SpannedValue<T> is a generic wrapper that captures the TOML byte span location of a parsed value. It enables precise error messages pointing to the exact source location, making it reusable for any TOML-based configuration system that needs high-quality diagnostics. The implementation is self-contained and depends only on standard traits (AsRef, Deref, Serialize, Deserialize).
Implements Jaro-Winkler distance-based 'did you mean?' suggestions for mistyped identifiers. It can be extracted and used in any CLI or library that needs to suggest valid alternatives from a list. Accepts an iterator of valid names and returns ranked matches with similarity scores.
Provides a reusable interactive yes/no prompt with configurable timeout, default answer, and message. Wraps the demand library but abstracts platform-specific TTY handling. Can be extracted for any CLI that needs to confirm sensitive operations with a timeout guarantee.
Abstracts OS-level credential stores (macOS Keychain, Windows Credential Manager, Linux Secret Service) behind a uniform async interface. Uses spawn_blocking to avoid runtime deadlocks with blocking keyring APIs. The pattern of wrapping synchronous system APIs with blocking pool spawn is reusable for any Rust async application dealing with platform-specific secure storage.