JB Dev Env

Build secure, reproducible dev envs without putting secrets in git or app code.

Default model

Use Varlock first:

• Commit .env.schema: required vars, types, sensitivity, AI-safe config context.
• Keep app code Varlock-agnostic. Wrap commands with varlock run -- ....
• Detect the package manager/toolchain and use its native style: dev dependency for JS package repos; npx/bunx/pnpm dlx/uvx/direct CLI only when that fits the repo better.
• Use SOPS/age only for committed encrypted secret blobs / multi-recipient GitOps secrets.
• Never print secret values. Validate with redacted/presence checks, not echoing resolved secrets.

Repo modes: