lockenv

name	lockenv
description	Use this skill when the user wants to manage encrypted .env files, protect secrets in git repositories, or work with password-based secret vaults.

Lockenv Plugin

Simple, password-based encrypted vault for .env and infrastructure secrets. Like git-crypt or sops, but dramatically simpler.

Commands

Vault Management

• lockenv vault init — Initialize a new encrypted vault (.lockenv)
• lockenv vault status — Show vault status and statistics
• lockenv vault ls — List files in the vault
• lockenv vault diff — Show content differences between vault and local files
• lockenv vault rotate — Change the vault password (re-encrypts all files)

File Operations

• lockenv vault lock <files> — Encrypt and store files in the vault
• lockenv vault unlock [files] — Decrypt and restore files from the vault

Keyring

• lockenv keyring manage [subcommand] — Manage password storage in OS keyring (save/status/delete)

Usage Examples

Initialize a new vault:

lockenv vault init

Lock your .env file (encrypt and store):

lockenv vault lock .env
lockenv vault lock .env --remove  # Also delete the original
lockenv lock "config/*.env"        # Glob patterns work

Unlock all files or specific ones:

lockenv vault unlock
lockenv vault unlock .env

Handle conflicts when files differ between vault and local:

lockenv vault unlock --force        # Overwrite local with vault
lockenv vault unlock --keep-local    # Keep local versions
lockenv vault unlock --keep-both    # Keep both (vault saved as .from-vault)