jat-secret

A fleet of machines and a fleet of agents both need the same API keys, tokens, and connection strings — without those secrets ending up in a repo, a dotfile, or an agent's transcript. jat-secret is one command for every credential: it resolves from a local store first, falls back to an encrypted remote vault, and back-fills 1Password — so a secret that exists anywhere in the fleet is one command away on every box.

Resolution chain

First tier with the key wins. A value that resolves is a value you can find — discovery walks all three and labels each by the tier that serves it.

Encrypted, zero-knowledge vault

The remote vault stores values AES-256-GCM encrypted with a key that never leaves your machines — the server holds ciphertext it can't read. --set writes locally and pushes to the vault in one step, and it fails open: if the vault is unreachable the value is still saved locally and a loud warning names the retry, so a network blip never eats a just-typed credential. The key stays on your machines, the server holds only ciphertext — no third party ever has a readable copy of your credentials.

One naming convention

Secrets are <service>-<kind> — deepseek-api-key, github-token, stripe-secret. Guess the wrong shape and an unambiguous alias resolves it for you and says so on stderr, while the value still lands on stdout clean. The name you'd guess is the name that works.

Usage