[Bug]: Secret decryption fails with correct passphrase

[pandey03muskan]

Component

forge-cli (commands, TUI wizard, runtime)

Description

I am encountering an issue while setting a secret using the Forge CLI. Even though I am providing the correct passphrase (the same one used to run the agent successfully), the command fails with a decryption error.

Command Used : -
forge secret set

Steps to reproduce

1. Run the agent using passphrase (works fine)

2. Run:
   forge secret set

3. Enter the same passphrase

4. Observe the error

Expected behavior

The secret should be set successfully since the passphrase is correct and already used to run the agent.

Actual behavior

The command fails with a decryption error indicating a wrong passphrase.

Operating system

Windows 11

Go version

Forge v0.8.0

forge.yaml (if relevant)

Logs / error output

Error: setting secret: decrypting secrets file: decryption failed (wrong passphrase?): cipher: message authentication failed

[initializ-mk]

@pandey03muskan this is a good first issue to fix. Do you want to take a stab at it?

[pandey03muskan]

Yes, I’d like to take this up. I’ll start looking into it and share updates soon.

[initializ-mk]

Root cause identified and fixed in PR #41.

The issue was in parseSecretsPath() in forge-cli/cmd/secret.go. It scanned forge.yaml line-by-line for any path: key — but every standard forge.yaml has skills: path: SKILL.md, which matched first. This caused forge secret set/get/list/delete to try AES-256-GCM decrypting SKILL.md as if it were the encrypted secrets file, resulting in decryption failed (wrong passphrase?).

forge run was unaffected because Runner.buildSecretProvider() hardcodes the secrets file path and never calls parseSecretsPath().

Fix: parseSecretsPath() now tracks the secrets: top-level YAML block and only matches path: keys within that block.