Prerequisites

• direnv
• op to manage secrets for op:// secrets

How it fits together

direnv watches each directory's .envrc and, once you've allowed it, auto-loads whatever it points at every time you cd in — for a repo set up with swarp, that's .env. swarp's job is to keep .env populated; direnv's job is to load it. Neither reads the other's config, they just agree on the filename.

• .env.template files hold op:// references and are committed to the repo.
• swarp secrets refresh resolves those references into a gitignored .env file, written next to each template — this is the file direnv loads. Only quoted references (KEY="op://...") are resolved; an unquoted reference is flagged with a warning instead.
• swarp direnv allow authorizes the .envrc. Until it's allowed, direnv won't load .env no matter how many times you refresh it — run allow first, once, so every later refresh takes effect automatically on your next cd.
• swarp run <command> runs a single command with the environment loaded (direnv exec .) without needing .envrc to be allowed at all. Use this in non-interactive shells such as CI or agents.