@airctrl/cli

Inject AIRCTRL secrets into any process as environment variables, decrypting client-side (zero-knowledge — the server never sees plaintext). Same idea as op run / doppler run, built on @airctrl/sdk.

Install

npm install -g @airctrl/cli
# or run without installing:
npx @airctrl/cli --help

Quick start (test it live)

1. Get a Personal Access Token (PAT). In the AIRCTRL app: Settings → Developer → Create token. Copy the sk-actrl-pat-… — it's shown once.
2. You need two different things (this is the zero-knowledge part):
   • API base URL — your AIRCTRL API (http://localhost:54330 for local dev, or your dev/prod URL).
   • Vault passphrase — the passphrase you set to unlock your vault. It decrypts your secrets on your machine. It is not the PAT: the PAT authenticates you to the API; the passphrase decrypts the ciphertext locally.
3. Point it at a project that has records and run any command with the secrets injected as env vars:

AC_API_BASE_URL="http://localhost:54330" \
AC_TOKEN="sk-actrl-pat-…" \
AC_VAULT_PASSWORD="your-vault-passphrase" \
npx @airctrl/cli run --project <projectId> -- printenv

You'll see airctrl: injected N secret(s): …, and each record appears as an UPPER_SNAKE env var in the child process. Swap printenv for node server.js, python app.py, etc. — the secrets never touch disk and the server never sees plaintext.

Commands

airctrl login                                 store API URL + PAT (~/.airctrl/config.json)
airctrl get <recordId>                        decrypt one record, print to stdout
airctrl run [--project <id>] -- <cmd> [args]  inject the project's records as env vars, then run <cmd>

Example

airctrl login
airctrl run --project <projectId> -- node server.js

Non-interactive overrides

For CI / scripts, skip the prompts with env vars:

• AC_TOKEN — personal access token
• AC_API_BASE_URL — API base URL
• AC_VAULT_PASSWORD — vault passphrase

© AIRCTRL — all rights reserved (license TBD) · airctrl.dev