Commands · monkeys

command	what it does
remember	Add a secret to the vault, or a value to `.monkeys`.
forget	Remove a secret from the vault.
drop	Remove a key from `.monkeys` and forget its secret.
rename	Rename a profile or a namespace, in the vault and in `.monkeys`.
run	Run a command with the secrets it needs, and nothing else.
pack	Seal a profile's secrets into one encrypted file.
unpack	Open an encrypted file into your own vault.
eat	Move the `.env` files here into the vault and `.monkeys`.
poo	Write a `.env` that carries keys and no secrets.
fill	Give a profile the secrets another one already has.
list	Show every key the vault holds, by profile.
preview	Show a secret masked, never in full.
doctor	Show what a profile has and lacks.
export	Write a vault lookup for your shell's startup file.

forget and drop ask before the vault loses anything, since nothing else holds a secret, so both want a terminal.

Every command takes a leading @profile, one the file declares; @namespace.profile reaches a profile from anywhere, and a bare @ means no profile. Where several keys or profiles go, they are joined with commas, DATABASE_URL,STRIPE_SECRET_KEY and @test,production, so one word is one list. Giving no key means every key for preview and export, or the project's keys inside a project. run asks to be told, since the keys are how it knows what to check for and what to leave out.

Output is coloured only when it is going to a terminal, and never for export, whose output a shell reads. NO_COLOR turns colour off, CLICOLOR_FORCE turns it on for a pipe, and an empty value for either counts as unset.

run, export and pack each check every key before doing anything, so a key you never remembered stops them with nothing done. A command cannot start with half of its secrets, a startup file cannot ask for a secret that is not there, and a bundle cannot carry half of a profile.