Exact-folder availability
Keep a value global, or bind it to an exact canonical folder identity. Moving elsewhere removes the scoped export.
Secure shell secrets for macOS
Stop putting secrets in plaintext dotfiles.
EnvEnclave keeps environment values encrypted with Secure Enclave-backed keys, then releases only what an approved local zsh needs—when it needs it.
Encrypted at restExact-folder scopedAuthenticated on release
Open-source 0.1 pre-release · Public security review in progress
Secure Enclave-backed keys
Apple frameworks at runtime
Local Unix socket
No telemetry
A deliberate boundary
Protection before release. Clarity after it.
EnvEnclave is precise about what it controls: encrypted storage, terminal approval, and the moment a value is released.
Approved terminals only
Live peer credentials, process ancestry, and exact code requirements are checked before any release is prepared.
Fresh authentication by default
A nonempty release asks for device-owner authentication and names the approved terminal making the request.
How it works
Local by design. Explicit at every handoff.
- 01
Encrypt
Each value is wrapped with an AES-GCM key derived through Secure Enclave P-256 key agreement.
- 02
Scope
Choose Global or one or more exact folders. Policy metadata is authenticated with the encrypted record.
- 03
Verify
The local request path validates the helper, shell, terminal, user, ancestry, and current working directory.
- 04
Release
Approved values are delivered through a bounded literal protocol and assigned by zsh without eval.
Encrypted activity
See what happened without recording the secret.
Activity can show validated variable names, exact-folder or Global availability, and approved terminal identity. Protected values are never recorded.
- Encrypted and signed on disk
- Tamper-evident chain with verified retention
- App-append-only between authenticated replacements
Activity is not immutable, rollback-proof, or a complete forensic ledger.
Built in the open
Security claims should be reviewable.
EnvEnclave is pre-release software. Review the implementation, threat model, failure paths, and explicit non-goals before trusting it with anything important.