Skip to main content
openclis-vault is the narrow credential helper for OpenCLIs and the Monolex estate. Other tools call this stable binary as a subprocess instead of each requesting keyring access under a changing code identity. The keyring stores a 32-byte encryption key; the credentials file stores only AES-256-GCM nonce and ciphertext. Its surface is intentionally small: four operational commands, one embedded-docs family, and help/version identity aliases. Published contract: openclis-vault 0.1.6, OpenCLIs build 2026-06-30-070903. The executing binary, registry, and public CDN metadata agree on this release.

​
Quick Start

Use stdin for writes. Passing a token as an argument would expose it through shell history and process inspection.

​
Complete Command Reference

Service names accept ASCII letters, digits, hyphen, and underscore only. Empty names, separators, .., NUL, and other characters are rejected to block path traversal and keyring-name injection. The logical keyring name is com.openclis.vault.<service>.

​
Parser behavior

  • read --help, store --help, and delete --help are safe command-specific usage branches. list --help instead executes list because list has no such branch.
  • read|store|delete -- <service> bypasses help-token interpretation. The service still has to pass the normal name validator.
  • An unknown root prints the full guide and exits 1.
  • read and list treat an expired 30-day token as absent; the encrypted bytes are not automatically erased.

​
Storage Architecture

On macOS, Keychain is the hard boundary. In production Linux or Windows, lib-secure-storage uses the platform keyring when available and can fall back to a local-user protected key file for headless, WSL, SSH, or scheduled-task contexts where the keyring session is unavailable. Set MONOLEX_DISABLE_FILE_STORAGE_FALLBACK when that fallback must be prohibited. Losing the keyring/key file makes the old ciphertext undecryptable by design. Copying only the ciphertext is therefore not a valid credential backup. An unreadable ciphertext blob is treated as empty on the read path. A later write quarantines a corrupt blob and starts a fresh encrypted record. This preserves bytes for forensics, but it also means “not in vault” is not proof that no stale or corrupt file exists.

​
Stable cdhash Contract

On macOS, the signed helper’s code identity participates in Keychain approval. Replacing or re-signing this binary can require a platform-specific re-grant for com.openclis.vault.* entries. Vault releases require a deliberate, versioned rollout; routine updates to other tools must not casually replace the helper.
The stable-helper guarantee is different from package version agreement. Verify the installed binary’s version and signature before changing it, then prove that expected service names remain readable without printing their values.

​
Published Payload Matrix

The build does not publish macOS Intel or Windows ARM64 artifacts. The installed macOS payload is Developer ID signed; signature validity and payload version are separate from credential readability.

​
Safe Patterns

Avoid command tracing (set -x) around reads and stores. list proves only that an unexpired token was readable at that moment; only the consuming tool’s authenticated status/doctor command proves remote validity.

​
Relationships