Repeated Touch ID prompts with age-plugin-se during sync and shell activation

[skoch13]

Summary

Using an age-plugin-se Secure Enclave identity with the age sync provider causes repeated Touch ID dialogs. I get more than nine prompts from a single sync, and the prompts also occur when opening a new terminal tab.

The dialog says:

age-plugin-se needs to authenticate to continue.
Touch ID to allow this.

Redacted configuration

Global provider config (~/.config/fnox/config.toml):

[providers.sync-age]
type = "age"
recipients = [
  "age1se1...REDACTED",
]
key_file = "~/.config/fnox/age-se.txt"

Main config (~/.config/fnox/fnox.toml) has nine secrets backed by 1Password

[providers.op]
type = "1password"
vault = "Env"

[secrets]
SECRET_1 = { provider = "op", value = "REDACTED" }
# ... SECRET_2 through SECRET_9 ...

After sync, fnox.local.toml contains those nine entries with generated sync = { provider = "sync-age", value = "..." } ciphertexts. I have omitted the identity contents and ciphertexts.

The Secure Enclave identity was generated with:

age-plugin-se keygen --access-control=any-biometry -o ~/.config/fnox/age-se.txt

Exact commands / triggers

Manual sync is run through this alias:

fns

It expands exactly to:

fnox sync --provider sync-age --local-file --force --config ~/.config/fnox/fnox.toml

This produces more than nine Touch ID prompts.

It also happens when opening a new terminal tab. My Fish startup contains:

fnox activate fish | source

So the new-tab trigger appears to be fnox activate fish, not only fnox sync.

Expected behavior

A sync or shell activation should not produce an apparently unbounded cascade of biometric prompts. Ideally authentication would happen once per operation (or otherwise a small, bounded and documented number of times). Opening a terminal tab should not require individually authenticating repeatedly for every synced secret.

Environment

• fnox 1.34.0
• age-plugin-se v0.2.1
• fish 4.8.1
• mise 2026.8.12
• macOS 26.6.2 (25G83), Apple Silicon
• age-plugin-se access control: any-biometry

[jdx]

Thanks for the detailed report. This happens because each synced secret currently has its own age ciphertext, so age-plugin-se is invoked separately for every value during both sync and batch resolution.

The fix is in PR #755: sync will wrap one shared batch key with age, encrypt each cached secret independently under that key, and unwrap the shared key only once during shell activation. Existing ciphertext remains readable. After upgrading to a release containing the fix, re-run your existing fnox sync --provider sync-age --local-file --force --config ~/.config/fnox/fnox.toml command once to migrate the cached entries to the batched format.

AI-assisted — Tool: Codex; model: unavailable/unavailable; version: unavailable.