jingui-secret

name	jingui-secret
description	Handle environment variables and secrets via Jingui. Use when commands need API keys or credentials.

Jingui Secret Management

Setup

If jingui is not in PATH, download it from GitHub Releases and set the server:

curl -fsSL https://github.com/Leechael/jingui/releases/latest/download/jingui-linux-amd64 -o /usr/local/bin/jingui
chmod +x /usr/local/bin/jingui

The server URL must be configured. Check for JINGUI_SERVER_URL in the environment, or ask the user to provide it:

export JINGUI_SERVER_URL=https://jingui.example.com

After setup, run jingui status --server $JINGUI_SERVER_URL and show the output to the user. This prints the instance's FID (fingerprint ID) and public key — the user needs these to register the instance and grant vault access on the server side.

Running Commands with Secrets

When a bash command needs secrets, wrap it with jingui run:

jingui run --env-file=".env.agent" -- [cmd]

Handling Credentials

Before running a command that requires credentials (API keys, tokens, passwords):

1. Check if the tool/CLI supports configuration via environment variables. Prefer env var injection over interactive prompts or passing secrets as command-line arguments.
2. Look up which env var the tool expects (e.g. OPENAI_API_KEY, AWS_SECRET_ACCESS_KEY, DATABASE_URL).
3. Add the corresponding jingui:// URI to .env.agent:

   OPENAI_API_KEY=jingui://ai-keys/openai/api_key
   

4. Wrap the command with jingui run so the secret is injected at runtime.

If the required secret is not yet configured on the server, tell the user to add it using the jingui://<vault>/<item>/<field_name> format. Do NOT ask the user to paste the secret value directly.

Rules

• Do NOT read .env.agent file contents directly — treat it as opaque.
• Plain values (non-secret) can be added to .env.agent as-is. Lines without jingui:// URIs pass through unchanged.
• op:// URIs are also supported as an alias for jingui://.
• Never echo, cat, or log secret values. Jingui redacts them from stdout/stderr, but avoid it regardless.
• Never pass secrets as command-line arguments (visible in ps output). Always use env var injection.