UnENVerse Find a guide: importing, command line, nodes

All releases

UnENVerse 0.58.0 (2026-10-22)

Import from Git stores through your own tools: unv import-vault sops, pass and gopass. sops decrypt, gpg --decrypt and gopass show run with a cleared environment, a deadline, an output cap and scrubbed error text; a SOPS file becomes an entry of dotted key-path variables, a pass or gopass secret ke…

Added

  • Import from Git stores through your own tools: unv import-vault sops, pass and gopass. sops decrypt, gpg --decrypt and gopass show run with a cleared environment, a deadline, an output cap and scrubbed error text; a SOPS file becomes an entry of dotted key-path variables, a pass or gopass secret keeps its first line as the password and its whole body as the description, and SOPS metadata is archived as non-operational provenance.
  • unv import-service imports from OpenBao (KV v2, paged, with every live version as history), Infisical (expanded values and a recorded reference graph), Bitwarden Secrets Manager (through your own bws) and, in a build with --features aws, AWS Secrets Manager and Parameter Store. The credential comes from the environment or a vault entry, the whole result is built before anything is written, and policies, auth methods and dynamic engines are archived or reported, not imported.
  • Nodes: a validate command that contains {file} checks a temporary file and replaces the target only if it passes; a check (a command or an http:// URL that must answer 2xx) runs after reload and a failure puts the previous file back and reloads it; each apply reports the steps it completed. Approval tokens have a second version (kind, operation, policy revision, its own signing domain), and a target with accept_rule_approval = true takes a short-lived rule approval signed by the hub's automation key (unv node automation-key). A rule approval never satisfies require_approval.
  • After a Git-store import the source stays authoritative: editing a secret field of such an entry is refused with a message naming the source (the desktop app, the command line and the server share the rule), unv migrate sync refreshes the vault one way, unv migrate drift reports what changed at the source without importing it, and unv migrate cutover and uncutover hand authority to the vault and back, refusing to go back once a credential has changed.
  • unv rotate plan|run|status rotates a Cloudflare API token: a new token with the same policies is created and verified, stored in the entry as the next generation, and the old one is deleted last (--revoke-now). A response lost after a create is found again by the token's name; a lost in-place roll (--allow-roll) is never retried. The rotation engine behind it is issuer-independent and is tested against every combination of step failures (ADR-0164). --issuer postgres rotates between two database roles: the new password is sent as a SCRAM-SHA-256 verifier, never as plaintext, and the old role is cleared last.
  • Plugins (unv plugin ls|install|enable|disable|rm|test): external programs that speak unv-plugin-rpc/1 over stdin and stdout, run with a cleared environment, deadlines, output caps and scrubbed stderr, and are refused if their program changed since install. unv plugin test runs a conformance suite (handshake, no side effects in plan, idempotent execute, reconcile, shutdown deadline, no secrets on stderr); examples/plugins/ntfy-notifier passes it and faulty copies fail the matching check (ADR-0165).
  • A command palette (Ctrl+Shift+P) for navigation and the top actions; Info findings in the health scan fold behind a count; the price badge on a card is quiet (hidden for free, dimmed otherwise until the card is hovered).
  • Windows: the vault folder, database, salt, recovery files and scratch directories get an owner-only access list, unv doctor checks it, and the device approval key lives in the machine-local profile (an old roaming key is adopted, never deleted). A rename over a file another program holds open is retried briefly. unv doctor warns when the vault is on a network filesystem. macOS builds with vendored SQLCipher and is tested in an informational CI job (ADR-0166).
  • Vault identity: every vault has an id and every copy an instance, an epoch and a role. A restored vault starts as standby (it reads and verifies but does not push, run schedules or rotate); unv vault status shows it and unv vault activate makes it live. Hubs send (vault id, epoch) to nodes, and a node refuses a hub with a lower epoch or for another vault. Upgrade nodes before the hub. unv doctor warns about a vault inside a cloud-sync folder (ADR-0167).

Contract

  • unv vault status|activate are new. unv describe carries contract_version (the old contract key stays). A committed snapshot of every command, positional and flag name and every exit code fails a test when one is removed or renamed. The scripting contract is written down in the book with recipes that a test runs (book/src/contract.md).

Fixed

  • The catalogue signing key was replaced (the old private half was lost); builds from this one pin the new public key, older builds keep using the catalogue built into the binary. The signed provider catalogue is fetched from https://unenverse.darthdemono.com/catalogue/catalogue.json; the old github.io/EnvVault address answers 404.
  • A node's validate or reload command that printed more than a pipe buffer held (about 64 KB) blocked on its own output and was reported as a timeout. Both pipes are now drained while it runs.

·