envcs

A Node.js CLI that encrypts .env* files and stores encrypted snapshots in a dedicated git branch: env.

Key model

• envcs uses one git branch for storage: env
• envcs has its own branch names (default: main) that are independent from your normal git branch
• config is a single file: config.json on env branch
• encrypted content-addressed objects: blobs/objects/<prefix>/<objectId>.json
• manifests (tree snapshots): blobs/manifests/<manifestId>.json
• envcs branch refs (heads): blobs/refs/<envcs-branch>.json
• legacy compatibility state remains at: blobs/<envcs-branch>/state.json

Commands

• envcs init [--force]

  • Detect .env* files and interactive select
  • Create/replace config.json

• envcs branch

  • Show active envcs branch and list available envcs branches

• envcs branch <name>

  • Create (if needed) and switch active envcs branch

• envcs status [--envcs-branch name]

  • Show snapshot state, conflict risk, and tracked-file local changes

• envcs save [message] [--message "..."] [--envcs-branch name] [--force]

  • Encrypt tracked files and save snapshot into local env branch
  • Alias: envcs push

• envcs publish [--remote origin]

  • Push local env branch to remote

• envcs fetch [--remote origin]

  • Fetch remote env branch into local env

• envcs apply [--envcs-branch name] [--force]

  • Decrypt from local env branch snapshot to working files
  • Alias: envcs pull

Notes

• Storage writes happen in an isolated temporary clone, then env ref is updated.
• This prevents accidentally committing project folders like backend/frontend to env branch.
• --force on push bypasses ancestry conflict guard.
• --force on pull overwrites locally modified tracked files.
• Passphrase caching: envcs save/apply/status will reuse a previously provided passphrase saved in your user config directory (via env-paths).
• Disable caching: use --no-store on save/apply/status (also works with aliases push/pull).