jitenv

Overview

jitenv holds your secrets in an encrypted on-disk config and injects them only into the process tree of the file you actually want to run — never into the parent shell. A per-user agent keeps the master key in memory; a shell hook intercepts mapped commands and re-execs them through jitenv run.

jitenv unlock
./scripts/deploy.sh        # mapped — env vars appear inside the script
echo "$DATABASE_URL"       # empty in your shell — it never saw the value

Features

• Per-file env injection via shell hooks (bash + zsh + PowerShell 7).
• Encrypted at rest with XChaCha20-Poly1305 + Argon2id; even the source, bag, and key names are sealed on disk.
• Long-lived per-user agent; secrets stay out of the parent shell.
• Pluggable source backends: local (encrypted bags), aws (AWS Secrets Manager), and vault (HashiCorp Vault KV v1/v2).
• Exact-path, glob, and directory-scoped cwd_glob mappings, with whole-bag expansion.
• TUI for managing config without hand-editing TOML — with a built-in file browser for picking mapping targets.
• Linux, macOS, and Windows support.

Highlights

• jitenv clone — clone a private HTTPS repo, capture its PAT once, store it encrypted, and wire a cwd_glob mapping so git inside the tree sees the token via GIT_ASKPASS — never written to .git/config or ~/.netrc.
• cwd_glob mappings — scope secrets to a directory. Inside a matched tree, a per-shell wrapper injects env vars into the listed commands (e.g. npm, git) at exec time.
• jitenv sync — push/pull the encrypted config to a pluggable remote (SSH, file) with last-writer-wins and a divergence fence. The remote only ever sees one opaque AEAD blob — never plaintext.

Download

Stable release: v0.14.1. Pre-built, cosign-signed binaries are published on every tag by goreleaser.

Pre-built binaries

Available on the GitHub Releases page for:

• linux/amd64 & linux/arm64 — .tar.gz, .deb, .rpm
• darwin/amd64 & darwin/arm64 — .tar.gz (Developer ID code-signed + notarized)
• windows/amd64 & windows/arm64 — .zip

macOS — Homebrew

brew install Galvill/jitenv/jitenv

A Homebrew cask that downloads the notarized tarball for your arch. It ships from a separate post-publish workflow (Apple's notarization latency never blocks the Linux/Windows artifacts), so it typically lands within ~30 minutes of a new release.

Windows — Chocolatey

choco install jitenv

Fetches the official windows_amd64 release zip, SHA256-verifies it, and shims both jitenv.exe and jitenv-tui.exe onto %PATH%. PowerShell 7+ is required for the hook.

Windows — Scoop

scoop bucket add jitenv https://github.com/Galvill/scoop-jitenv
scoop install jitenv

Adds a dedicated Scoop bucket and shims jitenv.exe, jitenv-hook.exe, and jitenv-tui.exe onto %PATH%. PowerShell 7+ is required for the hook.

Windows — winget

winget install Galvill.jitenv

Installs Galvill.jitenv from the winget-pkgs community repository. PowerShell 7+ is required for the hook.

Activate the shell hook (once)

jitenv hook install
exec $SHELL

Install with go install

go install github.com/gv/jitenv/cmd/jitenv@latest

Build from source

git clone https://github.com/Galvill/jitenv
cd jitenv
make install

Requires Go 1.22 or later. make install places the binary in $PREFIX/bin (default ~/.local/bin).

Contact

• Repository: github.com/Galvill/jitenv
• Issues & bug reports: github.com/Galvill/jitenv/issues
• Maintainer: @Galvill