env-manager

name	env-manager
description	Manage encrypted .env file vaults across projects and environments using env-file-manager

env-manager skill

When to use

Use this skill when the user needs to:

• Encrypt and store environment variables with AES-256-GCM encryption
• Share encrypted vaults between team members via S3 or local paths
• Pull decrypted variables to a local .env file
• Diff two environments to see which variables differ
• Manage multiple projects each with development, staging, and production environments

Prerequisites

• Node.js 20+
• pnpm
• Optional: AWS credentials for S3 sync

Installation

npm install -g env-file-manager

Quick Start

# Start the dashboard server
env-mgr start

# Create a project (will prompt for a passphrase)
env-mgr project add my-app

# Set a variable (will prompt for passphrase and value)
env-mgr set my-app development DATABASE_URL

# Pull all variables to a .env file
env-mgr pull my-app development

# Push vault to S3
env-mgr push my-app production

Usage Patterns

Setting multiple variables

Run env-mgr set for each variable. The vault session is cached in memory for 15 minutes so you only need to enter the passphrase once per session:

env-mgr set my-app development DATABASE_URL
env-mgr set my-app development REDIS_URL
env-mgr set my-app development SECRET_KEY

Pulling to a custom path

By default, env-mgr pull writes to the project path configured at creation. Override with --output:

env-mgr pull my-app production --output ./config/.env.production

Dry run before pulling

Preview which variables would be written without touching the .env file:

env-mgr pull my-app production --dry-run

Diffing environments

The diff command compares variable key sets and ciphertexts. It does not decrypt values:

env-mgr diff my-app development production

Setting up S3 sync

Configure S3 once and all projects will use it for push/pull:

env-mgr config set s3-bucket my-team-vaults
env-mgr config set s3-region us-east-1

Syncing locally instead of S3

env-mgr push my-app production --destination local --path /mnt/shared/vaults
env-mgr pull my-app production --source local --path /mnt/shared/vaults

CLI Reference

Command	Description
env-mgr start	Start the dashboard server
env-mgr project add <name>	Create a new project
env-mgr project list	List all projects
env-mgr project remove <name>	Remove a project
env-mgr env add <project> <env>	Add an environment to a project
env-mgr set <project> <env> <KEY>	Set (encrypt and store) a variable
env-mgr get <project> <env> <KEY>	Decrypt and print one variable value
env-mgr pull <project> <env>	Write all variables to .env file
env-mgr pull <project> <env> --dry-run	Preview pull without writing
env-mgr pull <project> <env> --output <path>	Write to a specific path
env-mgr push <project> <env>	Push vault to sync destination
env-mgr push <project> <env> --destination local --path <path>	Push to local path
env-mgr diff <project> <env1> <env2>	Diff two environments
env-mgr config set <key> <value>	Set a config value
env-mgr config show	Show configuration
env-mgr --help	Show help
env-mgr --version	Show version

Environment Variables

Variable	Description	Default
ENVMGR_PORT	Dashboard port	7433
ENVMGR_HOST	Bind address	127.0.0.1
ENVMGR_DATA_DIR	Vault, config, and database directory	~/.env-file-manager
ENVMGR_S3_BUCKET	S3 bucket name	(from config)
ENVMGR_S3_PREFIX	S3 key prefix	vaults/
ENVMGR_S3_ENDPOINT	S3-compatible endpoint URL	(AWS default)
ENVMGR_S3_REGION	AWS region	us-east-1
ENVMGR_AWS_ACCESS_KEY_ID	AWS access key	(from env or ~/.aws)
ENVMGR_AWS_SECRET_ACCESS_KEY	AWS secret key	(from env or ~/.aws)
ENVMGR_LOG_LEVEL	Log level: debug, info, warn, error	info

Troubleshooting

"wrong passphrase" / auth tag error - The passphrase entered does not match the one used to create the vault. There is no recovery path. Ensure the passphrase is correct.

Diff shows all variables as "changed" - This can happen after re-encrypting a vault (the ciphertexts differ even if values are the same). This is expected behavior - AES-256-GCM uses random IVs, so re-encryption always produces new ciphertexts.

S3 push fails with AccessDenied - Check that ENVMGR_AWS_ACCESS_KEY_ID and ENVMGR_AWS_SECRET_ACCESS_KEY are set, or that ~/.aws/credentials is configured. The IAM policy must allow s3:PutObject and s3:GetObject on the bucket.

.env file written with wrong path - Set the project path: env-mgr config set project.my-app.path /Users/you/projects/my-app.

Session expired during bulk set - Re-enter the passphrase. Sessions last 15 minutes. Use env-mgr set sequentially - each set call checks the in-memory session token.