Kikobeats / onesecret

95%

push

github

feat!: keep the age key out of process.env (#23)

* feat!: keep the age key out of process.env

When onesecret loads, it takes SOPS_AGE_KEY, SOPS_AGE_KEY_FILE and
SOPS_AGE_KEY_CMD out of process.env and holds them in memory, shared
by every copy of onesecret in the process. Nothing the app starts
afterwards sees the key, so callers no longer filter the environment
of each child process themselves.

BREAKING CHANGE: withoutAgeKey is removed, since process.env no
longer holds the key. Code that reads SOPS_AGE_KEY itself finds it
unset once onesecret is loaded; set it to an empty string to drop
the held key.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* test: drop a key held from the shell before isolating tests

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

1418 of 1496 branches covered (94.79%)

Branch coverage included in aggregate %.

42 of 42 new or added lines in 2 files covered. (100.0%)

3798 of 4018 relevant lines covered (94.52%)

656.03 hits per line