@shrubs/seal
v0.0.0
Published
Seal CLI — securely seal and unseal local secrets, injected at runtime from OS-native credential stores and password managers.
Maintainers
Readme
@shrubs/seal
Securely store and inject local secrets — without committing
.envfiles.
seal is a small CLI that replaces ad-hoc .env files with secrets stored in OS-native credential stores (macOS Keychain, libsecret on Linux, Windows Credential Manager) or external password managers (1Password, Bitwarden, or custom adapters).
This npm package is a thin launcher that resolves and executes the right pre-compiled native binary for your platform. The binary bundles its own runtime — Node is only used to dispatch.
Install
npm install -g @shrubs/seal
seal --helpSupported platforms: macOS (arm64, x64), Linux (x64, arm64), Windows (x64).
If you're on an unsupported platform, or your package manager skipped optionalDependencies (--no-optional, --omit=optional, certain lockfile bugs), grab the binary directly from the GitHub Releases page.
Documentation
See the main repository for usage, design notes, and the security model.
Scope
seal is intentionally a local-development tool. It is not a replacement for production secret managers (AWS Secrets Manager, Vault, etc.), team secret sharing (use 1Password / Vault shared vaults), or CI/CD secrets (use your CI provider's encrypted secrets).
License
MIT
