Ghostable CLI 3.x | Ghostable Menu Ghostable CLI 3.x What Ghostable does ------------------- Ghostable stores encrypted environment values and the signed records needed to manage them inside your project repository. The CLI creates environments, encrypts and decrypts values, validates configuration, reviews code for environment drift and hard-coded secrets, and prepares values for local processes or deployment providers. There is no Ghostable login and no hosted Ghostable vault in the v3 architecture. Your repository carries the encrypted project state; each authorized device keeps its private identity outside the repository. How it works ------------ 1. **Initialize a repository.** `ghostable setup` creates a project manifest, the first device identity, environment keys, policy, and signed activity state. 2. **Commit encrypted state.** The `.ghostable/` directory is designed to travel through Git and code review. Plaintext `.env` files are not. 3. **Grant access by device.** New team members create their own device identities and request a role for one or more environments. 4. **Work locally.** Pull to a file only when necessary, or inject values directly into a command with `env run`. 5. **Review every change.** Signed value history, validation, hygiene reports, and secret scanning make environment changes visible without disclosing secret contents. A typical workflow ------------------ A normal development loop is intentionally small: Project workflow Copy ``` $ ghostable status $ ghostable env diff --env default --file .env $ ghostable env push --env default --file .env --reason "Update local configuration" $ ghostable validate --env default $ ghostable review $ git add .ghostable && git commit -m "Update encrypted environment" ``` Commands prompt for missing choices in an interactive terminal. Scripts, CI jobs, and coding agents should pass explicit flags and prefer `--json` output. CLI and Desktop --------------- The CLI is Ghostable's versioned engine and the source of truth for project behavior. Ghostable Desktop is a paid macOS interface that runs the CLI underneath, so encryption, repository formats, access rules, and command behavior remain consistent between both products. Use these versioned 3.x docs for the shared engine. Use the [Desktop documentation](https://ghostable.dev/docs/desktop) for installation, application diagnostics, and interface-specific guidance. Where to begin -------------- - Install the CLI using the [installation guide](https://ghostable.dev/docs/3.x/installation). - Use [New Projects](https://ghostable.dev/docs/3.x/getting-started/new-projects) when no Ghostable state exists yet. - Use [Existing Projects](https://ghostable.dev/docs/3.x/getting-started/existing-projects) to adopt a repository that already has one or more `.env` files. - Read [Team Onboarding](https://ghostable.dev/docs/3.x/getting-started/team-onboarding) before adding a second developer. - Review the [Security](https://ghostable.dev/docs/3.x/reference/security) page before using Ghostable for production credentials. On this page [ ![Ghostable](https://ghostable.dev/images/logo-dark.svg) ![Ghostable](https://ghostable.dev/images/logo-light.svg) ](https://ghostable.dev) CLI 3.x [ CLI 3.x ](https://ghostable.dev/docs/3.x) [ Desktop ](https://ghostable.dev/docs/desktop) CLI 3.x introduction Documentation local first no login encrypted repository plaintext hosted service Installation Documentation brew homebrew npm npx linux windows PATH version update Start a new project Getting Started setup seed dotenv owner initialize Adopt an existing project Getting Started existing env import authoritative source adopt Onboard a team member Getting Started join request approve roles offboarding pull request Repository and storage Core Concepts .ghostable git conflict merge worktree private identity metadata Environments Core Concepts protected production preview staging push sync pull replace run mask-output Variables and promotions Core Concepts var promote copy context annotation key Access and devices Core Concepts identity reader writer grantor owner revoke rotate leave delete Daily development workflow Workflows pull diff validate review clean daily Review and secret scanning Workflows scan sarif github suppress secrets drift Hygiene and rotation Workflows rotation stale unused suppression environment key Automation credentials Automation & CI GHOSTABLE\_CI\_TOKEN ci deploy credential powershell revoke replace Continuous integration Automation & CI GitHub Actions fork pull request JSON stdout stderr exit codes mask-output Deployments Automation & CI Forge Vapor Cloud provider CLI dry-run preserve remote keys temporary files Validation Reference schema required nullable regex min max different\_from Command reference Reference --help --json NO\_COLOR flags aliases exit code automation Configuration Reference ghostable.yaml activity mode auditEnvironments scan ignores deployTarget dotenv syntax Security Reference cryptography XChaCha20 Poly1305 HKDF user presence threat model Backups & Offline Reference recovery offline restore clone key identity Agent integration Reference AGENTS.md capabilities allowlist coding agent Troubleshooting Reference no project found revoked identity stale policy user presence invalid CI token provider CLI git conflict diagnostics Ghostable Desktop overview Desktop Installation Desktop Projects and setup Desktop Interface tour Desktop Environments and variables Desktop Local environment files Desktop Validation and review Desktop Activity Desktop Access and automation Desktop Project settings Desktop Application settings Desktop Licensing and updates Desktop Security and storage Desktop Troubleshooting Desktop No results found