envseal: baixar versions anteriors

New: opt-in environment isolation for run
envseal run now accepts an optional --clear flag. When set, the child process starts with a completely clean environment before any vault secrets are injected.
# Run with only the secrets from the vault (no inherited host env vars)
envseal run --clear -- npm start
# Works with the existing global-vault flags
envseal run --clear --with-global -- ./deploy.sh
This is useful when you want strict isolation — e.g. CI jobs, containers, or scripts that must not see ambient host variables.
No breaking changes. Existing vaults and workflows continue to work unchanged.
Full Changelog: v6.2.0...v6.2.1
Full Changelog: v6.2.0...v6.2.1

Mix global and local secrets at runtime. No breaking changes — drop-in upgrade from v6.1.0.
New: global vault override
Four new flags on run, load, and export let you combine the system-wide global vault with a project's local vault:
────────────────────┬─────────────────────────────────────────────────────────────────────────────────────
Flag │Effect
────────────────────┼─────────────────────────────────────────────────────────────────────────────────────
--override KEY1,KEY2│Pull only the named keys from the global vault.
────────────────────┼─────────────────────────────────────────────────────────────────────────────────────
--with-global │Overlay all keys from the global vault (global wins on collision).
────────────────────┼─────────────────────────────────────────────────────────────────────────────────────
--global-group GROUP│Which group inside the global vault to use. Defaults to the directory's linked group.
────────────────────┼─────────────────────────────────────────────────────────────────────────────────────
--global-tag TAG │Optional tag inside that global group. Defaults to base.
────────────────────┴─────────────────────────────────────────────────────────────────────────────────────
--override and --with-global are mutually exclusive. If neither is given, only the local vault is used, unchanged from before.
# Pull a single key from the global vault
envseal run --override DATABASE_URL -- npm start
# Overlay everything from the global vault
envseal run --with-global -- npm start
# Target a specific global group and tag
envseal run --with-global --global-group shared-aws --global-tag prod -- ./deploy.sh
Personal tokens no longer need to be copied into every project's .envseal. Keep them once in the global vault and pull them in on demand.
Install
# Linux & macOS
curl -sSfL https://raw.githubusercontent.com/viswajith275/EnvSeal-CLI/master/scripts/install.sh | bash
# Windows
winget install --id viswajith275.envseal -e
Verify with envseal --version (expects 6.2.0). No migration needed.
Full changelog: v6.1.0...v6.2.0
Full Changelog: v6.1.0...v6.2.0

EnvSeal v6.1.0 is a focused quality-of-life release that adds interactive editing of vault secrets via your preferred editor.
Highlights
New envseal edit command
Open the secrets for a group (and optional tag) in your default editor ($EDITOR / $VISUAL, falling back to nano on Unix or notepad on Windows).
- Decrypts the selected secrets into a temporary file
- Lets you add, change, or delete keys using familiar .env syntax
- Securely overwrites (zeroes) the temp file on exit
- Writes only the net changes back into the encrypted vault
# Edit base secrets for the current/linked group
envseal edit
# Edit a specific tag
envseal edit --tag staging
# Edit a specific group
envseal edit --group myapp
This is especially useful for bulk updates or when you prefer a GUI/native editor over repeated set / rm commands.
Other Changes
- Version bump to 6.1.0
- Minor documentation improvements for the new edit workflow
- Integration test updates
This is a non-breaking, additive release. Existing vaults and workflows continue to work unchanged.
Full Changelog: v6.0.0...v6.1.0

Native Git Integration
- 3-way cryptographic merge driver (envseal merge): Safely merges encrypted .envseal vaults during Git conflicts without ever exposing plaintext secrets.
- Configurable merge strategies: Support for standard strategies via git config envseal.merge.strategy [fail|ours|theirs], or one-off overrides with git -c envseal.merge.strategy=ours merge.
- On-the-fly diff driver (envseal diff / textconv): git diff, git log, etc. now show plaintext diffs in memory only—no sensitive data written to disk.
- envseal git-setup command (renamed from earlier setup): Configures local Git merge/diff drivers and automatically updates .gitignore to exclude lock files. Also cleans up orphaned .merge_file_*.lock temporary files.
Password Management
- New envseal passwd command: Change the vault master password. Rotates the Key Encryption Key (KEK), re-encrypts the Master DEK in-place, and leaves secret entries and existing zero-trust tokens untouched.
Reliability, UX & Platform Improvements
- IDE $GIT_ASKPASS support: Background Git operations triggered by editors (VS Code, Cursor, JetBrains, etc.) now correctly surface password prompts in the IDE’s native UI.
- Timeout-bound coalescing locks (.envseal.prompt.lock): Prevents “thundering herd” password prompt storms when multiple concurrent IDE workers access the vault.
- Headless Linux / WSL2 degradation: Graceful fallback when D-Bus/keyring is unavailable—warns on stderr and continues with in-memory decryption instead of crashing.
- Improved group resolution: Recursive search for group fetching.
- Bug fixes & quality: Crucial bug fixes (including rotation and architectural issues), code formatting, updated integration tests, binary size/speed improvements, install-script and workflow updates.
- Windows: Re-added support via WinGet (work in progress in this release cycle).
- Extensive README updates covering Git merge strategies, conflict handling, and overall documentation polish.
Full Changelog
v5.0.0...v5.1.0
This is a focused quality and developer-experience release that makes EnvSeal far more practical for real team Git workflows while adding the missing password-change capability.

EnvSeal v5.0.0
Zero-trust secrets for local development and production CI/CD.
EnvSeal just grew up. What started as “a better way to stop committing .env files” is now a full cryptographic secrets engine with least-privilege tokens, instant revocation, and a design that assumes your CI runner is already compromised.
No more sharing the master password with the pipeline. No more hoping expiration will save you. No more plaintext secrets sitting in process lists.
Highlights
- Zero-trust bearer tokens — Mint short-lived, least-privilege tokens that can decrypt specific secrets (or an entire tag) without ever seeing the master password, KEK, or signing key.
- DEK rotation — One command (envseal rotate) regenerates the Data Encryption Key for a scope and instantly invalidates every existing token for that scope.
- Cryptographic hierarchy — Master password → Argon2id → KEK → Master DEK → HKDF Scope DEKs → per-variable Entry Keys. Secrets are never encrypted directly under the password. Every vault mutation is Ed25519-signed.
- Anti-snooping token ingestion — Tokens are accepted only via file, environment variable, or stdin. No CLI flag that ends up in ps aux.
- Faster sessions — The OS keyring now caches derived cryptographic material instead of the raw password. Subsequent commands drop from ~500 ms to ~2 ms.
- Cleaner storage — MessagePack with deterministic ordering and raw binary payloads. Atomic writes via the standard filesystem.
New Commands
──────────────┬──────────────────────────────────────────────────────────────────────────────────────────────────
Command │What it does
──────────────┼──────────────────────────────────────────────────────────────────────────────────────────────────
envseal token │Mint a zero-trust bearer token with optional name, description, expiration, and key-level scoping.
──────────────┼──────────────────────────────────────────────────────────────────────────────────────────────────
envseal rotate│Rotate the DEK for a group or tag and revoke all tokens that depended on the old key.
──────────────┴──────────────────────────────────────────────────────────────────────────────────────────────────
Existing commands (run, get, export, load, etc.) now accept --token-file so the same workflows work with tokens.
Security Notes You Should Actually Read
Token expiration (--exp) is a convenience, not a security boundary. Clocks drift. Tokens get copied. “It expires in an hour” is not a revocation strategy.
If a token is compromised (or even just suspected):
1. Rotate the DEK for the affected scope (envseal rotate --tag prod).
2. Rotate the actual credentials that token could reach (database passwords, API keys, etc.).
Do both. Always.
Platform Support
- Linux (x86_64 / ARM64)
- macOS (Apple Silicon only — Intel Macs are no longer supported)
- Windows
Installation
curl -sSfL https://raw.githubusercontent.com/viswajith275/EnvSeal-CLI/master/scripts/install.sh | bash