Managing Variables

Human editor workflow

Use show when a human wants to edit the whole file, then hide immediately afterward. Agents and automation should use the targeted locked-file commands below instead.

# Unlock (config.vars → config.unlocked.vars)
vars show

# Edit config.unlocked.vars in your editor

# Lock (config.unlocked.vars → config.vars)
vars hide

show

vars show [file]

Decrypts a config.vars file and renames it to config.unlocked.vars. The encrypted values are replaced with their plaintext. Edit the file directly, then run hide.

Before decrypting, vars checks for common problems:

• Warns if .varskey is missing
• Warns if the pre-commit hook isn't installed

Flags

vars show -f staging.vars

hide

vars hide

Encrypts ALL unlocked .unlocked.vars files. Scans for any *.unlocked.vars file in the current project and encrypts each one, renaming it back to .vars. You don't need to specify a file.

Encryption is all-or-nothing per file. If any value fails, that file stays untouched.

If schemas changed since the last gen run, hide regenerates the TypeScript types automatically.

Flags

vars hide -f staging.vars

Locked-file edits

add, set, remove, and apply modify a locked config.vars directly. Secret inputs are encrypted before replacement, and these commands never create config.unlocked.vars. If a human has already opened the file with vars show, locked mutations stop and ask you to run vars hide first rather than writing new plaintext. If matching generated TypeScript output exists, vars regenerates it before completing; a regeneration failure restores both files.

Qualified names keep public and secret values together by integration:

vars add stripe.PUBLISHABLE_KEY --public --value "pk_test_..."
vars add stripe.SECRET_KEY --value-file /run/secrets/stripe-key \
  --pin-file /run/secrets/vars-pin

This creates or updates a group containing both repository-readable and encrypted values.