File Sync

Sync a repo’s secret files (.env, appsettings.Development.json, keys, credentials, …) with DepVault, git-style. Each file is identified by its path relative to the repo root and stored as one end-to-end-encrypted blob with full version history.

depvault init      # link this repo to a project (once per repo)
depvault status    # what differs from DepVault
depvault push      # upload your changes
depvault pull      # download everyone else's

Link a repo: depvault init

depvault init [--project <id>]

Pick an existing project (the one matching your git remote is offered first) or create one. This writes .depvault.json at the repo root:

{
  "project": "b3f1a2c4-5678-9def-0123-456789abcdef",
  "name": "my-web-app",
  "ignore": ["references/**", "/apps/api/appsettings.Development.json"]
}

Commit it. It holds no secrets, and teammates who clone the repo are linked automatically. The folder containing .depvault.json is the root every file path is relative to. If you run a file command in an unlinked folder, the CLI offers to link it first.

Ignore patterns

ignore keeps files from being offered or synced. Patterns work like .gitignore:

depvault untrack adds entries for you.

Which files are synced

Tracked files — anything already in DepVault — are always synced.

New files are offered automatically when they look like secrets and are git-ignored:

• .env, .env.*, *.env, .envrc, .dev.vars
• appsettings*.json, secrets.json / .yaml / .yml, credentials.json
• google-services.json, GoogleService-Info.plist, *service-account*.json, firebase-adminsdk*.json
• local.properties, key.properties, keystore.properties, .npmrc, .pypirc, .netrc
• *.pem, *.key, *.p8, *.p12, *.pfx, *.jks, *.keystore, *.tfvars

Templates (.example, .sample, .template, .dist, .defaults, .bak, .orig) and committed files are never offered — they’re already in git. The git-ignore check runs per git repo, so submodules use their own .gitignore.

Any other file can be tracked by naming it:

depvault push config/firebase.json

Limits: 10 MB per file. Executables (.exe, .sh, .bat, .cmd, .ps1) are rejected.

depvault status

depvault status [paths...]

Project my-web-app · /home/me/my-web-app

  modified   apps/api/.env
  new        apps/bot/.env
  renamed    certs/dev.pem → certs/local.pem
  incoming   apps/web/.env.local
  conflict   deploy/.env

  3 to push · 1 to pull · 1 conflict(s) · 4 in sync

Comparison is three-way — your file, the server, and what this machine last synced — using keyed content hashes, so status downloads nothing.

depvault push

depvault push [paths...] [-m <message>] [--yes] [--force]

Uploads all local changes (new, modified, renamed, deleted) in one atomic request. Each version records you as the author plus the optional -m message. Renames keep history.

Interactively you get a checklist with everything preselected — press Enter to push. Deletions are listed separately and confirmed on their own (default No).

--yes never deletes a file you didn’t name, so a wiped working tree (e.g. git clean -X) can’t empty the vault:

depvault push --yes -m "rotate bot token"   # pushes edits, skips deletions
depvault push --yes apps/bot/.env           # also deletes it if it's gone locally

If someone else changed a file since your last sync, the server rejects the whole batch (HTTP 409) and nothing is saved. Run depvault pull, then push again.

depvault pull

depvault pull [paths...] [--force]

Applies server edits, moves, and deletions. Files are decrypted locally and written byte-for-byte to their repo paths with owner-only permissions (0600 on macOS/Linux).

pull never overwrites local changes. Conflicts are skipped and the command exits with code 1; --force takes the server copy.

depvault pull                    # everything
depvault pull apps/api           # one folder
depvault pull --force deploy/.env

With DEPVAULT_TOKEN set, pull runs in CI mode instead — see CI/CD Integration.

Resolving conflicts

A conflict means the file changed both locally and on the server. Pick a side:

depvault pull --force deploy/.env   # keep the server copy
depvault push --force deploy/.env   # keep yours

To merge, copy your edits aside, pull with --force, re-apply them, and push. The web app’s file history also shows every version side by side.

depvault untrack

depvault untrack <paths...> [--yes]

Deletes the files and their history from DepVault, keeps your local copies, and adds the paths to ignore in .depvault.json so they aren’t offered again. Use it for files that aren’t secrets.

depvault untrack apps/web/appsettings.json

depvault purge

depvault purge [paths...] [--dry-run] [--force]

Deletes local copies of synced files — for example before handing back a laptop. Server copies are untouched; depvault pull restores them. Files with unpushed changes are kept unless you pass --force.

depvault project

depvault project [--output json]

Shows the folder’s linked project and lists the projects you can access. To switch, run depvault init --project <id>.