fnox set ignores existing key name when using remote provider

[twelvelabs]

Given the following fnox.toml:

[providers]
gcp = { type = "gcp-sm", project = "my-gcp-project" }

[secrets]
MY_SECRET = { provider = "gcp", value = "custom-secret-name" }

Running fnox set MY_SECRET something results in updating the config to:

# ...

[secrets]
MY_SECRET = { provider = "gcp", value = "MY_SECRET" }

And creating MY_SECRET in Google Secret Manager (rather than the expected custom-secret-name):

$ gcloud secrets list --project my-gcp-project

NAME       CREATED              REPLICATION_POLICY  LOCATIONS
MY_SECRET  2026-08-12T20:22:28  automatic           -

I see that fnox set --key-name=custom-secret-name MY_SECRET something works as expected, but I would expect that the config value would be respected if the --key-name flag was not provided.

If I'm understanding things correctly, it looks like this is where the key name is resolved:

fnox/src/commands/set.rs

Lines 168 to 179 in f978acc

	if self.dry_run {
	// In dry-run mode, skip actual remote storage
	let key_name = self.key_name.as_deref().unwrap_or(&self.key);
	(None, Some(key_name.to_string()))
	} else {
	// Use the already-resolved provider to store the secret
	let key_name = self.key_name.as_deref().unwrap_or(&self.key);
	let stored_key = provider.put_secret(key_name, value).await?;
	// Store just the key name (without prefix) in config
	(None, Some(stored_key))
	}

Shouldn't it load secret_config before that and use secret_config.value before falling back to self.key?

[jdx]

Confirmed—thanks for the detailed report. fnox set was reusing the existing provider but not its configured remote key, so it fell back to the environment variable name and then persisted that fallback.

I opened #712 to preserve the existing key when the selected provider matches. --key-name still takes precedence, and switching providers still falls back to the environment key unless a new key name is given. The PR also fixes the GCP integration test so it asserts and cleans up the configured remote key.

AI-assisted — Tool: Codex; model: openai/gpt-5; version: unavailable.