Manage Config Vault

Use scripts/vaultctl.py for deterministic vault operations. Require Python 3.11+, cryptography, and Git for remote workflows. If cryptography is missing, install scripts/requirements.txt into the active Python environment.

Safety rules

• Receive the Vault password once and pass it through stdin to configure --password-stdin. Never put it in an argument, commit, log, or final response.
• Treat decrypted output as secret. Use a restricted temporary directory, avoid echoing values, and remove plaintext after use.
• Search metadata first. Add --content only when metadata is insufficient; add --show-matches only when the plaintext line is actually needed.
• Publish AI writes on an ai/... or codex/... branch. Do not push directly to the default branch unless the user explicitly requests it.
• Validate with validate --decrypt before publishing.
• Require explicit user intent before deleting an item or applying --force to a real home directory.
• Keep Git authentication separate from the vault key. Use a repository-scoped credential.

Resolve saved defaults first

Run this before asking the user for a repository or key: