Everyday workflows

GitVaulty commands use the logical plaintext path even when only the .gitvaulty ciphertext is stored in the repository.

Create or import

Create a file that does not exist yet:

npx gitvaulty create config/secrets.yaml

Import an existing local file:

npx gitvaulty import .env

Use create only for new files and import for existing plaintext. Import keeps the source available in the current clone and adds it to Git's clone-local exclude file.

Edit without a repository plaintext file

npx gitvaulty edit config/secrets.yaml

The file opens in $VISUAL, $EDITOR, or the platform default editor. A verified ciphertext update replaces the old encrypted file only after the editor closes successfully. The VS Code and JetBrains integrations provide a native editor experience with their documented security boundaries.

Run a command with selected files

Expose only the files a process needs:

npx gitvaulty run -f .env -- npm start

Use --all when a command truly needs every file you can access. GitVaulty removes unchanged files created by that invocation when the process exits.

Materialize for local tooling

Some development tools require persistent paths. Materialize explicitly, inspect the state, and clean up when finished:

npx gitvaulty materialize .env config/secrets.yaml
npx gitvaulty status
npx gitvaulty clean

clean removes only plaintext copies that still match their ciphertext, so it does not silently discard local changes. Use diff to review plaintext differences before editing or encrypting them.

Stream exact bytes

For pipelines that can read standard input, avoid creating a file:

npx gitvaulty cat config/secrets.json | jq .

cat refuses to print plaintext directly to an interactive terminal unless --force is explicit.