Development updates
Short notes on how enveigh is coming together, newest first.
The sidebar no longer draws a Team block across the Secrets rows; Team controls appear only when you are signed in to enveigh Cloud. After Start a new vault…, agent connections work right away instead of after the next lock and unlock. If you came from 0.2.12, the 0.2.13 entry below has the recovery steps.
Release0.2.12 was live for about two hours before it was pulled. Updating from 0.2.11 ran a one-time move of the vault's Keychain items into the protected Keychain. The move copied each item, read the copy back, then deleted the old item. On macOS, a delete that names an item without saying which Keychain also matches the protected copy when the app is entitled to it, so each delete removed both. Every value and the vault key were gone; only the “move finished” marker survived. The move had been tested on a real Keychain, but with different item names for old and new, which hid exactly this. New installs were not affected.
0.2.13 fixes the move (legacy queries now stay in the file Keychain, and every copy is checked again after its old item is deleted and rewritten if needed), and the test now uses the same names production does. If you are on 0.2.11, update normally.
If you installed 0.2.12 over an existing vault, the old Keychain items cannot be brought back by any update. 0.2.13 gets you going: choose Reset and unlock; the app opens to Vault unavailable. Restore a backup… if you have an .enveighbackup. Otherwise Start a new vault… sets the old files aside and opens an empty vault; then import your projects' .env and .dev.vars files and add remaining keys from your providers. Agent connections and settings stay. I am sorry. The clipboard capture feature below ships in 0.2.13.
Agents increasingly work inside your browser: Claude in Chrome, browser extensions, a dashboard tab open next to the terminal. You copy a new API key, and the next step used to be pasting it to the agent, which puts it in the transcript. Now the agent asks enveigh instead.
check_clipboard tells the agent only what enveigh can see locally: that the clipboard holds something credential-shaped, what kind it looks like (a Stripe key), the name enveigh would give it, the first four characters, and a fingerprint. The agent asks you: is this the one you mean, and which environment does it go in? On your yes it calls capture_clipboard; enveigh reads the clipboard itself, refuses if it changed since the check, and asks you once with the same masked preview, on the Mac or on your paired iPhone. The value goes clipboard → vault and never passes through the model. Keys enveigh itself copied with Reveal are recognised and not offered back.
The agent skill and the server instructions now tell agents never to ask for a paste when the key is already on the clipboard. The CLI learns the same move: enveigh capture STRIPE_SECRET_KEY --env web, or enveigh capture --check to see what is there. On Linux the service reads the clipboard of your desktop session; without one, the TUI's Capture clipboard still works.
Restart your agent clients after updating so they load the two new tools.
ReleaseThis update fixes security problems found in a review. Update now.
A shipped build could open the vault without Touch ID or your password when another program started it in a specific way. The unlock step now always needs your authentication, and agent-access notifications always show.
Another program running as your user could also change the agent approval setting without asking you. enveigh now keeps that setting encrypted with your vault. Choosing a setting with fewer approvals needs Touch ID or your password; a stricter one needs nothing. If the saved setting is missing or damaged, enveigh asks you to approve every request.
What changes for you: if you used Unlocked = allowed, enveigh moves you to Touch ID once per environment. To go back, choose it in Settings and confirm with Touch ID. Your vault, environments and agent connections stay as they are.
SecurityThis build fixes security problems. Update with sudo pacman -Syu or install the new package from the Linux page.
A program that could read the service's session file could approve its own pending request, and a TUI opened while the service was already unlocked acted without approval prompts. Approving now needs proof that you are present: the TUI asks for the GPG unlock step first, and until you complete it, it gets the same prompts as any other caller. Denying a request still needs no extra step.
A program could also change the agent approval setting by editing settings.json. The service now keeps that setting encrypted with your GPG key and ignores the file. Choosing fewer approvals needs the TUI after you unlock there. If you used Allow while unlocked, you move to Once per environment; choose it again in Settings in the TUI.
If GPG has cached your passphrase, the unlock step can finish without a prompt. Your GPG cache policy controls this.
LinuxArch and Omarchy users can add enveigh's pacman repository once and get every release through sudo pacman -Syu, on x86_64 and ARM64. Every package and the repository database are signed with a dedicated key (0CC6 120F 14A3 DE01 4FC8 C3AD 7B34 D87A 7988 4ACB), and the repository requires those signatures: before release, pacman was shown to refuse an untrusted key, a modified database, a modified package, and a genuine package signed by another key. Setup takes six commands; they are on the Linux page. An AUR package is ready for when AUR registration reopens.
Setup is now just enveigh. The first run picks your GPG key (or creates one), starts the service and turns on start at login, then unlocks through pinentry. Later runs go straight to your vault.
Unlocking is the one permission step. Changes you make in the TUI no longer ask you to type yes and then approve your own request a second time; destructive actions ask once for y, and successful changes show a notice instead of stopping at "Press Enter". Agents, the CLI and other programs still need approval. Agent connections and environments now follow the Mac app's lists: choose a client, pick its environment, done.
An MCP entry that enveigh didn't create, such as one added with claude mcp add, has no scoped token, so enveigh correctly refuses it. The TUI used to mark that client as blocked. Now choosing it in Agent connections replaces the entry with a scoped token, removes project-scoped Claude Code entries that would override it, and the refusal message tells the agent exactly where you fix it on your platform.
enveigh now runs on Linux: Ubuntu 24.04+, Arch and Omarchy, on x86_64 and ARM64. The terminal edition keeps the Mac app's model (environments, scoped agent connections, redacted run_with_env, audit, encrypted backups) with values stored by pass and GPG, approvals in a keyboard-first TUI, and task sessions that keep long builds running after GPG's cache expires. Downloads on the Linux page.
Agent clients put their own permission layer in front of every MCP tool. Claude Code's auto mode runs a classifier over each call, and it sometimes blocks enveigh's write tools with add_secret_to_environment (mcp) denied by auto mode, even though enveigh already confirms every change with Touch ID. Codex and Gemini CLI ask their own question too.
Settings → Agents → Manage now has Pre-approve enveigh tools for each of those clients. Turn it on and enveigh writes the client's own setting for you: the mcp__enveigh allow rule in Claude Code, which resolves before the classifier runs; default_tools_approval_mode = "auto" in Codex; trust in Gemini CLI. Disconnect the client and the setting goes away with it.
The raw-value tools are the exception on purpose. get_secret and render_env now carry the requiresUserInteraction annotation, so Claude Code prompts for them in every permission mode, and Codex keeps a per-tool prompt. Every tool also carries the standard MCP hints (read-only, destructive, idempotent, open-world) for clients that use them.
Manual vault backups for moving to another Mac: choose a passphrase, a recovery key, or no encryption, review a backup before restoring, and undo the last restore. The interface is quieter, with compact agent connections and focused access controls, plus clearer import results, export previews, rotation details, and access history.
Releaserun_with_env kills a command after 10 minutes so a hung process can't wedge the tool call forever. Good guardrail, wrong fit for a real build or test suite that simply needs longer; those were getting terminated mid-run. The tool now takes a per-call timeout_seconds (up to 6 hours), the tool description tells agents to pass it up front for anything long, and the timeout message tells them exactly how to retry. The 10-minute default and the ENVEIGH_MCP_TIMEOUT_SECONDS override are unchanged, and a hung command still can't hold a call open forever.
The site, docs, downloads, and the auto-update feed all moved to enveigh.com. Old khuur.dev links redirect permanently, and updates keep flowing for every existing install: 0.2.7 ships through the old feed address, points the updater at the new one, and the old address keeps redirecting for installs that haven't updated yet. Nothing to do on your end; your copy migrates itself on its next update check.
ReleaseKick off a long unattended agent task and, depending on your approval policy, it can park itself on a Touch ID prompt the moment it needs a key. The new trusted session is the fix: an "it's me until I lock my screen" window. Start it from the menu-bar icon, confirm once with Touch ID, and the broker serves agent requests without prompting for as long as your presence can be assumed.
The session ends the instant it can't be: screen lock, screensaver, sleep, fast user switch, or locking the vault, and you can end it from the menu bar at any time. It never survives a relaunch and it is never a stored preference, so arming it always costs exactly one fresh Touch ID. While it's active every access is still audited and notified per request, the start and end land in the audit trail themselves, and destructive operations (deleting an environment) still always prompt.
ReleaseKeys don't have to live inside an environment, and when you want to group one it's a right-click away. Every secret now has an Add to Environment menu that lists your environments with a checkmark toggle (add or remove the binding) plus New Environment…, so a standalone key becomes part of a .env, or gets shared across several, without opening the environment's detail pane. Multi-select a batch and the selection bar files them all at once.
Agents can do the same through the new add_secret_to_environment tool (and enveigh add on the CLI). It's Touch-ID confirmed and read-only to the agent, so no value is ever seen. Grouping is collision-safe and idempotent: if the env-var name a secret would take is already used by a different secret, enveigh files it under a suffixed name instead of silently repointing the existing binding, and adding a key that's already in the environment does nothing.
Paste a key and it almost always comes with an invisible trailing return. enveigh used to store the value verbatim, so what it handed back to your shell, or wrote into a .env, carried a stray newline, and the service quietly rejected it as a wrong password. Now every saved value is trimmed of leading and trailing whitespace and line breaks, on both new keys and rotations, whether it arrives through the New-secret sheet, an agent's capture_secret, the clipboard watcher, or a project import.
Multi-line secrets stay intact: only the edges are trimmed, so a PEM private key keeps its internal newlines. Keys saved before this update keep whatever they had: re-paste or re-rotate one once to clean it.
ReleaseWhen a key lands on your clipboard and no enveigh window is on screen, the offer now comes to you: the Dock icon badges (with a single attention bounce), the menu-bar icon flips to a "key spotted" glyph, and the top menu item becomes "Copied key: add NAME to enveigh…". One click opens the pre-filled New-secret sheet, recreating the window if it was closed. Everything clears together the moment you save or ignore.
Also fixed: copying a value out of enveigh (reveal → copy, the recovery key, a rendered .env) no longer triggers the watcher's own "put the key in enveigh?" offer: every in-app copy is marked so the app never nags about its own output. And the agent-side capture rule is now sized to fit Codex's instruction window, so paste-catching guidance reaches GPT models in full, not just Claude.
ReleaseTwo fixes that make the "agent catches a pasted key" promise hold everywhere. First: the helper binaries your agent configs point at now refresh on every app launch. Previously they only updated during installs, so app updates could leave agents talking through a stale proxy that predated capture_secret. Second: the MCP server now ships session instructions that Claude Code, Claude Desktop, and Cursor surface to the model directly. The "vault a pasted credential immediately, then stop using it" rule no longer depends on the agent skill being installed.
One note: agent sessions keep the server they started with, so sessions opened before this update pick up the new behavior on their next restart.
Releaseimport_project: an agent (or enveigh import .) can now ask enveigh to scan a project folder's .env files and vault what's missing. The scan runs inside the app, you approve with Touch ID, and only key names ever flow back to the agent. It's idempotent: keys already in the folder's environment are skipped, new ones bind into that same environment.
Clipboard capture grew up too: the notification now asks "Put the key in enveigh?" (naming the provider when the key's shape gives it away), and clicking it, or the in-app banner, opens the New-secret sheet pre-filled with the name, value, and company instead of silently inserting a row. The Expires field is now a preset menu (never / 1 hour / 1 day / 1 week / 30 / 90 days) with a date picker for everything else, and sk-or-… keys are recognized as OpenRouter.
"Scan for leaks" used to take over the whole window, with no obvious way back. It now slides out as a right-hand panel, same as the Run console, so your secret list stays in view, the window grows to make room, and the ✕ drawers it away. An in-flight scan keeps running if you close the panel; the results are waiting when you reopen it.
ReleaseWe put the whole codebase through a correctness and memory-safety review and shipped everything it found. The headline fixes: a data race in the secret scanner's regex cache, a crash on malformed backup files (a hostile iteration count could trap instead of erroring), and an audit log that now appends in constant time, one encrypted line per event, instead of re-encrypting the whole file on every reveal.
Behavior changes worth knowing: agent run_with_env commands now time out (10 minutes by default, ENVEIGH_MCP_TIMEOUT_SECONDS to change), and the environment scrubber now exempts SSH_AUTH_SOCK, so git-over-SSH inside wrapped builds keeps working. There's also a new docs page answering the most common question: will this break my build? (No.)
enveigh is now strictly monochrome and defers entirely to your macOS appearance: Light or Dark, no custom color scheme to fight your desktop. The only hue left is red, reserved for danger (an exposed or overdue key). The brand mark and app icon went black-and-white to match.
Why bother? A secrets tool should feel calm and trustworthy, not loud. Removing color removed a whole class of fiddly theming and let the content carry the weight.
DesignThe command runner is now a right-hand panel that slides into the main window (⌘R), instead of a separate floating window. Pick an environment, type a command, and it runs with the secrets injected as env vars, with every value redacted from the output and nothing written to disk.
It auto-selects the environment you're viewing and drops your cursor straight in the command field. The whole idea: the secure path is the fast path.
FeatureAgents reach the vault over a token-gated UNIX-domain socket that only exists while the vault is unlocked: no always-on network service, no port to scan. Each client gets a scoped token, and scope is enforced on the broker side so a client can't reach outside the environment you granted it.
Release builds run under the Hardened Runtime and drop get-task-allow, so another process can't attach and scrape decrypted values from memory. Updates ship signed via Sparkle.