penv CLI

Broker project secrets without printing them.

The CLI creates vaults, imports dotenv files, exports approved keys, and grants scoped access for automation. Secret reads still go through device-owner approval.

Download app + CLIQuickstart

Quickstart

Install once, then list vaults.

bash scripts/install-cli.sh

penv list

The installer builds penv and copies it to ~/.local/bin/penv by default. If that directory is not on PATH, the installer prints the exact shell export to add.

Core commands

Common vault workflows.

Create a vaultCreates or updates a vault for one project path and prints its vault id.
penv vault "Personal Coding" /Users/you/Code/project
Store one secretReads the value from stdin so it is not passed as a shell argument.
printf '%s' "$OPENAI_API_KEY" | penv set <vault-id> OPENAI_API_KEY --stdin --scope ai
Import dotenvImports standard KEY=value lines into an existing vault.
penv import <vault-id> .env
Export safelyWrites directly to a file and prints a redacted receipt, not secret values.
penv export <vault-id> --to-file .env OPENAI_API_KEY

Scoped approvals

Give automation narrow, temporary access.

penv approve read --ttl 10m --vault <vault-id> --keys OPENAI_API_KEY --to-file .env --requester agent:codex --command export

penv export <vault-id> --to-file .env --requester agent:codex OPENAI_API_KEY

Approval grants can be scoped by vault, key set, destination, requester, command, and TTL. Use penv approvals to inspect active grants and penv revoke to clear them.

Safety model

File export is the safe automation path.

penv export refuses implicit stdout output. For agents and scripts, prefer --to-file <path> so Personal Env writes the target dotenv file directly and prints only a redacted receipt.

penv export <vault-id> --stdout --allow-secret-stdout OPENAI_API_KEY

Stdout is available only as an explicit human escape hatch because it exposes secret material to the receiving process.