Tracking files
The manifest
Tracked files are listed in envkit.toml inside your store.
[[file]]
path = ".zshrc" # relative to ~
kind = "shell" # shell | dotenv | plain
secrets = ["GITHUB_TOKEN"] # declared secret keys (optional)
noscan = false # skip the undeclared-secret scan (optional)
envkit add writes these entries for you; you can also edit the file by hand.
envkit add .zshrc --os # store under this OS's layer
envkit add .gitconfig --shared # share across every OS
envkit add .npmrc --secret NPM_TOKEN # declare a secret as you add it
envkit add --from paths.txt # newline-delimited list
Without --os or --shared, envkit picks based on the file: known shell files go
to the OS layer, everything else is shared.
Kinds
The kind decides how envkit handles secrets inside the file.
| Kind | For | Secret handling |
|---|---|---|
shell | .zshrc, .bashrc | placeholder plus a generated secrets.<shell> the file sources |
dotenv | .env-style files | KEY= placeholder, value in the keychain |
plain | everything else | no secret extraction |
Two directions, never a sync
| Command | Direction |
|---|---|
envkit backup | ~ → store |
envkit load | store → ~ |
There is deliberately no sync. A tool that guesses which side should win is a
tool that eventually guesses wrong with your only copy.
Stopping
envkit rm .zshrc # stop tracking; the local file is left alone