CLI

The DepVault CLI (depvault) is a .NET 10 Native AOT binary — a single self-contained executable with no runtime dependencies.

Installation

Quick Install

Linux / macOS:

curl -fsSL https://get.depvault.com | bash

Windows (PowerShell):

irm https://get.depvault.com | iex

The installer detects your platform, downloads the latest release, and adds it to PATH. Installed to ~/.depvault/bin/ by default. Set DEPVAULT_INSTALL_DIR to customize.

Manual Download

Pre-built binaries on the GitHub Releases  page:

Build from Source

Requires .NET 10 SDK .

git clone https://github.com/suxrobGM/depvault.git
cd depvault/apps/cli
dotnet publish -c Release -r <rid>

Replace <rid> with linux-x64, linux-arm64, osx-x64, osx-arm64, or win-x64.

Interactive Mode (REPL)

Run depvault with no arguments to enter an interactive session:

depvault

The REPL displays a banner with your authentication status, vault lock state, and active project. Type commands directly (with or without a leading /) and press Enter. Press Tab to autocomplete command and subcommand names. The screen refreshes between commands to show updated status.

Built-in REPL commands:

The vault auto-locks after 30 minutes of idle time.

Configuration

The CLI stores configuration in ~/.depvault/:

• config.json — Server URL, active project, default output format.
• credentials.json — JWT tokens from interactive login. Created by depvault login, removed by depvault logout. Never commit this file.
• vault-session.json — An opt-in remembered unlock: the encrypted KEK, its salt, and expiry. Removed by lock/logout. Never commit this file.

depvault config set server https://depvault.example.com
depvault config set output json

Authentication Modes

When DEPVAULT_TOKEN is set, the CLI uses it for all requests and blocks interactive login. See Authentication for details.

Vault Unlock

The vault must be unlocked before pulling or pushing encrypted data. Unlocking derives your Key Encryption Key (KEK) from your vault password and caches it in memory.

depvault unlock

In non-interactive mode, set the DEPVAULT_PASSWORD environment variable to unlock automatically.

Lock the vault to clear the cached KEK and all DEK caches:

depvault lock

If you skip unlock, the CLI prompts for your vault password on the first command that requires decryption and caches it for subsequent commands.

Remembering the unlock

The cached KEK normally lives only in the current process, so each invocation re-prompts. After a successful unlock the CLI offers to keep the vault unlocked on this machine; opt in to skip the prompt on later pull/push/scan commands.

depvault unlock --remember --ttl 24h

The password is never stored — only the derived KEK, encrypted at rest (Windows DPAPI; an owner-only key on macOS/Linux). It auto-expires at its TTL and is cleared by lock, logout, or a remote password change.

Project Auto-Detection

The CLI automatically detects the active project by reading the remote origin URL from .git/config and matching the repository name against your DepVault projects. This works from any subdirectory within the repository.

Command Tree