|
| 1 | +# 02 — Env Command (`authy env`) |
| 2 | + |
| 3 | +## Summary |
| 4 | + |
| 5 | +New `authy env` command that outputs scoped secrets as shell-sourceable environment variable declarations. The bridge between Authy's encrypted vault and the `export FOO=bar` world that every tool and agent already understands. |
| 6 | + |
| 7 | +## Motivation |
| 8 | + |
| 9 | +Today, `authy run --scope X -- cmd` spawns a child process with env vars injected. This works for launching a single process, but doesn't help when: |
| 10 | + |
| 11 | +1. A shell session needs multiple tools to see the same secrets |
| 12 | +2. A `SessionStart` hook needs to write env vars to `CLAUDE_ENV_FILE` |
| 13 | +3. A CI pipeline step needs to source secrets into the current shell |
| 14 | +4. A container entrypoint needs to set up the environment before exec |
| 15 | + |
| 16 | +`authy env` produces the text output that feeds these use cases. It's the composable building block — the output can be `eval`'d, appended to files, piped, or redirected. |
| 17 | + |
| 18 | +## Current Behavior |
| 19 | + |
| 20 | +No `authy env` command exists. The closest is `authy run`, which spawns a subprocess. |
| 21 | + |
| 22 | +## Proposed Behavior |
| 23 | + |
| 24 | +### Basic usage |
| 25 | + |
| 26 | +```bash |
| 27 | +$ authy env --scope deploy |
| 28 | +export DB_URL='postgresql://user:pass@host/db' |
| 29 | +export GITHUB_TOKEN='ghp_xxxxxxxxxxxx' |
| 30 | +``` |
| 31 | + |
| 32 | +Output is `export KEY='VALUE'` format, one per line. Directly sourceable by bash/zsh. |
| 33 | + |
| 34 | +### Source it |
| 35 | + |
| 36 | +```bash |
| 37 | +eval "$(authy env --scope deploy)" |
| 38 | +# DB_URL and GITHUB_TOKEN are now in the current shell |
| 39 | +``` |
| 40 | + |
| 41 | +### Write to a file |
| 42 | + |
| 43 | +```bash |
| 44 | +authy env --scope deploy >> "$CLAUDE_ENV_FILE" |
| 45 | +``` |
| 46 | + |
| 47 | +### Flags |
| 48 | + |
| 49 | +``` |
| 50 | +authy env --scope <SCOPE> [--uppercase] [--replace-dash <CHAR>] [--prefix <PREFIX>] [--format <FORMAT>] [--no-export] |
| 51 | +``` |
| 52 | + |
| 53 | +| Flag | Default | Description | |
| 54 | +|------|---------|-------------| |
| 55 | +| `--scope <SCOPE>` | required | Policy scope to filter secrets | |
| 56 | +| `--uppercase` | off | Convert secret names to UPPERCASE | |
| 57 | +| `--replace-dash <CHAR>` | none | Replace `-` in names with given character | |
| 58 | +| `--prefix <PREFIX>` | none | Prepend prefix to each variable name | |
| 59 | +| `--format <FORMAT>` | `shell` | Output format (see below) | |
| 60 | +| `--no-export` | off | Omit `export` keyword (just `KEY='VALUE'`) | |
| 61 | + |
| 62 | +These flags mirror `authy run` for consistency. |
| 63 | + |
| 64 | +### Output formats |
| 65 | + |
| 66 | +**`--format shell`** (default) |
| 67 | + |
| 68 | +```bash |
| 69 | +export DB_URL='postgresql://user:pass@host/db' |
| 70 | +export GITHUB_TOKEN='ghp_xxxxxxxxxxxx' |
| 71 | +``` |
| 72 | + |
| 73 | +**`--format dotenv`** |
| 74 | + |
| 75 | +``` |
| 76 | +DB_URL=postgresql://user:pass@host/db |
| 77 | +GITHUB_TOKEN=ghp_xxxxxxxxxxxx |
| 78 | +``` |
| 79 | + |
| 80 | +Standard `.env` format (no `export`, no quoting unless value contains special chars). Values with spaces, `#`, or newlines are double-quoted. |
| 81 | + |
| 82 | +**`--format json`** |
| 83 | + |
| 84 | +```json |
| 85 | +{ |
| 86 | + "DB_URL": "postgresql://user:pass@host/db", |
| 87 | + "GITHUB_TOKEN": "ghp_xxxxxxxxxxxx" |
| 88 | +} |
| 89 | +``` |
| 90 | + |
| 91 | +Flat key-value JSON object. |
| 92 | + |
| 93 | +### Name transformation |
| 94 | + |
| 95 | +Transformation order: (1) replace-dash, (2) prefix, (3) uppercase. |
| 96 | + |
| 97 | +```bash |
| 98 | +$ authy env --scope deploy --uppercase --replace-dash _ --prefix AUTHY_ |
| 99 | +export AUTHY_DB_URL='postgresql://user:pass@host/db' |
| 100 | +export AUTHY_GITHUB_TOKEN='ghp_xxxxxxxxxxxx' |
| 101 | +``` |
| 102 | + |
| 103 | +This matches the existing `authy run` transformation behavior. |
| 104 | + |
| 105 | +### Authentication |
| 106 | + |
| 107 | +Supports all auth methods: passphrase, keyfile, session token. When using a session token, the token's scope is used and `--scope` is optional (defaults to token scope). |
| 108 | + |
| 109 | +## Edge Cases |
| 110 | + |
| 111 | +- Empty scope (no secrets match policy): output nothing, exit 0 |
| 112 | +- Secret value contains single quotes: escape as `'\''` in shell format |
| 113 | +- Secret value contains newlines: use `$'...\n...'` quoting in shell format; `"..."` with `\n` in dotenv |
| 114 | +- `--scope` required unless using session token (which has implicit scope) |
| 115 | +- `--format json` ignores `--no-export` (not applicable) |
| 116 | + |
| 117 | +## Relationship to `authy run` |
| 118 | + |
| 119 | +`authy env` and `authy run` share the same policy evaluation and name transformation logic. Internally, `authy run` could be refactored to use the same secret-resolution code as `authy env`, then pass the result to `Command::envs()`. |
| 120 | + |
| 121 | +## Use Cases |
| 122 | + |
| 123 | +**Claude Code SessionStart hook:** |
| 124 | +```bash |
| 125 | +#!/bin/bash |
| 126 | +if [ -n "$CLAUDE_ENV_FILE" ]; then |
| 127 | + authy env --scope claude-code --uppercase --replace-dash _ >> "$CLAUDE_ENV_FILE" |
| 128 | +fi |
| 129 | +``` |
| 130 | + |
| 131 | +**Docker container entrypoint:** |
| 132 | +```bash |
| 133 | +#!/bin/bash |
| 134 | +eval "$(authy env --scope $AGENT_SCOPE --uppercase --replace-dash _)" |
| 135 | +exec "$@" |
| 136 | +``` |
| 137 | + |
| 138 | +**CI pipeline step:** |
| 139 | +```bash |
| 140 | +eval "$(authy env --scope ci-deploy --uppercase --replace-dash _)" |
| 141 | +./deploy.sh |
| 142 | +``` |
| 143 | + |
| 144 | +**Pipe to another tool:** |
| 145 | +```bash |
| 146 | +authy env --scope dev --format json | jq '.DB_URL' |
| 147 | +``` |
| 148 | + |
| 149 | +## Acceptance Criteria |
| 150 | + |
| 151 | +- [ ] `authy env --scope <scope>` outputs shell-sourceable `export` statements |
| 152 | +- [ ] `--format shell`, `--format dotenv`, `--format json` all work |
| 153 | +- [ ] `--uppercase`, `--replace-dash`, `--prefix` transform names correctly |
| 154 | +- [ ] `--no-export` omits `export` keyword in shell format |
| 155 | +- [ ] Values with special characters are properly escaped per format |
| 156 | +- [ ] Empty result (no matching secrets) outputs nothing, exits 0 |
| 157 | +- [ ] Works with all auth methods (passphrase, keyfile, token) |
| 158 | +- [ ] Audit log records the access (operation: `env_export`, lists scope) |
0 commit comments