@todoforai/vault

Zero-config TODOforAI vault CLI. Installs the tfa-vault command. Speaks vault-manager's KV v2 HTTP API.

npm i -g @todoforai/vault    # installs the `tfa-vault` command

Why

vault (HashiCorp CLI) works against vault-manager, but requires VAULT_ADDR, VAULT_TOKEN, vault login, ~/.vault-token, … — ceremony designed for a HashiCorp Vault server, not ours.

tfa-vault is the native TODOforAI client: reuses the same credentials every other tfa-* tool uses (bridge-injected env vars or ~/.config/todoforai/credentials.json), derives the vault URL from the backend URL, and is zero-config in any shell the bridge spawned.

tfa-vault put openai api_key=sk-xxx
tfa-vault get -f api_key openai
tfa-vault list

No VAULT_ADDR. No VAULT_TOKEN. No vault login. No ~/.vault-token. If todoforai-bridge login worked, this works.

Commands

| Command | Description | |---|---| | tfa-vault put <path> k=v [k=v …] | Write (replaces existing fields at path) | | tfa-vault patch <path> k=v [k=v …] | Merge fields (preserves others) | | tfa-vault get <path> | Print all fields | | tfa-vault get -f <field> <path> | Print one field, raw (for $(…)) | | tfa-vault list [prefix] | List children under prefix | | tfa-vault rm <path> | Delete | | tfa-vault health | Ping vault-manager | | tfa-vault whoami | Show resolved auth context |

-j/--json on any read command for machine-readable output.

Value sources

• Inline: tfa-vault put openai api_key=sk-xxx
• From file: tfa-vault put openai api_key=@/path/to/key.txt (path must start with /, ./, ../ or ~/)
• From stdin: echo -n "sk-xxx" | tfa-vault put openai api_key=-
• Literal @…: tfa-vault put deps pkg=@todoforai/vault (no leading slash → treated as literal value, no escaping needed)

Auth resolution

First match wins:

1. --api-key / --api-url / --vault-url flags
2. TODOFORAI_API_KEY / TODOFORAI_API_URL env vars (bridge-injected into every PTY)
3. ~/.config/todoforai/credentials.json (written by todoforai-bridge login)

URL derivation

| Backend URL | Vault URL | |---|---| | https://api.todofor.ai | https://vault.todofor.ai | | http://localhost:4000 | http://localhost:8800 |

Override with --vault-url if needed.

Use in scripts

export OPENAI_API_KEY=$(tfa-vault get -f api_key openai)
export DB_PASS=$(tfa-vault get -f pass db/prod/primary)
python my_script.py

tfa-vault get -f <field> writes the value to stdout with no trailing newline — safe for $(…).

Exit codes: 0 on success, 2 for "not found" (so scripts can distinguish missing-secret from network errors), 1 for everything else.