Skip to content

v0.18.0 - --ask-password: Hidden Interactive SSH Prompt (2026-07-11)

What Changed?

This release adds --ask-password to fetch, upload, and sync, tracked as #56. It prompts interactively for the SSH password with input hidden, so it never touches the command line or shell history — unlike --ssh-password VALUE, which the shell records to history the moment it's typed, regardless of anything fnb does afterward. --ssh-password is kept for scripted/CI use; the two flags are mutually exclusive. This release also updates 24 dependencies to their latest compatible versions.

What's New

Main Feature: --ask-password

What it does: hide_input=True only hides what you type after a prompt appears — it can't retroactively hide a value already typed as part of a --ssh-password VALUE command line, since the shell captures the full line to its history file before fnb ever runs. --ask-password sidesteps this entirely: when given, fnb prompts SSH password: and reads the input with echo disabled (via typer.prompt(hide_input=True)), so the password is never part of the command line at all.

--ssh-password and --ask-password are mutually exclusive — passing both is an error, not a silent override.

How to use it:

fnb fetch logs --ask-password
# SSH password: [hidden input]

fnb upload reports --ask-password --create-dirs
fnb sync logs --ask-password

For anything beyond occasional interactive use, SSH keys, .env, macOS Keychain, or a GPG-encrypted file (see the Security Guide) remain the recommended long-term setup — --ask-password fills the gap for one-off connections where that setup isn't worth it.

Installation

Quick Start

# Get the release
git checkout v0.18.0

# Setup
uv sync --all-groups

# Run CLI
uv run fnb --help

What's Different from the Last Version?

✅ Added

  • --ask-password/-a flag on fetch, upload, and sync
  • Security Guide section explaining why --ssh-password can't be made history-safe via hide_input alone, and documenting --ask-password as the alternative

🔧 Changed

  • --ssh-password and --ask-password are mutually exclusive; combining them exits with an error before any rsync/SSH work happens
  • 24 dependencies updated to their latest compatible versions (uv lock --upgrade), including typer 0.24.1 → 0.26.8, pydantic 2.12.5 → 2.13.4, rich 14.3.3 → 15.0.0, pytest 9.0.2 → 9.1.1

🐛 Fixed

  • None in this release

Is It Safe to Upgrade?

Backward Compatible: Yes.

  • --ssh-password still works exactly as before; --ask-password is purely additive
  • No configuration changes required
  • Dependency updates were verified against the full test suite (194 tests, unchanged pass rate)

Tests Passed

  • ✅ 194 unit and integration tests passed
  • ✅ 90% code coverage
  • ✅ All pre-commit hooks pass (mypy, ruff, trailing whitespace, etc.)
  • ✅ uv run --group docs zensical build — no new warnings from the doc changes
  • ✅ Full test suite re-verified after the dependency update, no regressions

Release Details

  • Date: 2026-07-11
  • Version: v0.18.0
  • Commits: 3 commits since v0.17.0, closing out issue #56
  • 136e871: feat(cli): add --ask-password for a hidden interactive SSH password prompt
  • a146381: docs: document --ask-password and steer users away from --ssh-password
  • 025f0ff: chore(deps): update dependencies to latest compatible versions

Next Steps

  • Monitor whether --ssh-password sees continued use now that --ask-password exists, before considering a deprecation path
  • Phase 6 (Optional) items from #41/#42 remain out of scope: Windows Credential Manager, Linux Secret Service, multiple GPG keys, password rotation, gpg-agent passphrase caching UX