fix(set): don't skip value prompt when -k combined with metadata flags

jdx · claude · jdx · commit 1f5d4f6e4111 · 2026-03-22T21:39:27.000Z
When -k was combined with metadata flags like -d without an explicit
value, has_metadata was true so the value prompt was skipped, silently
discarding the -k flag. Now -k prevents the metadata-only skip path.

Co-Authored-By: Claude Opus 4.6 (1M context) &lt;noreply@anthropic.com&gt;
diff --git a/src/commands/set.rs b/src/commands/set.rs
@@ -65,7 +65,7 @@ impl SetCommand {
         let secret_value = if let Some(ref v) = self.value {
             // Value provided as argument
             Some(v.clone())
-        } else if has_metadata {
+        } else if has_metadata && self.key_name.is_none() {
             // Only metadata is being set, no secret value needed
             None
         } else if !atty::is(atty::Stream::Stdin) {
diff --git a/test/set_key_name.bats b/test/set_key_name.bats
@@ -51,3 +51,16 @@ teardown() {
 	# key_name is silently ignored for encryption providers — it should not appear in config
 	assert_file_not_contains test-config.toml "custom-key-name"
 }
+
+@test "fnox set -k combined with -d still prompts for secret value" {
+	# When -k is combined with metadata flags like -d, the secret value should
+	# still be read (not skipped by the metadata-only path)
+	run bash -c 'echo "my-secret-value" | "$FNOX_BIN" --config test-config.toml set -p age -k custom-key-name -d "my description" MY_SECRET'
+	assert_success
+
+	# The config should reference the secret with description and encrypted value
+	assert_file_contains test-config.toml "MY_SECRET"
+	assert_file_contains test-config.toml "my description"
+	# The plaintext secret value should NOT appear (it should be encrypted)
+	assert_file_not_contains test-config.toml "my-secret-value"
+}
