Changelog

All notable changes to Vaulted are documented here.

The format is based on Keep a Changelog, and the project adheres to Semantic Versioning.

Removes the account sync introduced in 2.1.0. Vaulted is a fully local tool again: no accounts, no server, no op log — secrets live only in the encrypted vault on your machine. The release is tagged as v3.0.0 on GitHub.

Removed

• Multi-device account sync

  The sync server, the op-log protocol, and the account commands (signup, login, logout, recover, account, remote, devices, sync) are gone, along with the TUI sync pane and the --no-sync flags they motivated. Schema migration v5 drops the sync tables; secrets, audit history, and every retained project-key version survive, so a vault that synced under 2.1.0 keeps working — locally.

Added opt-in, end-to-end-encrypted multi-device account sync. Removed again in 3.0.0.

Adds global secrets: a vault-level namespace for credentials shared across projects, with safe-by-default injection. Ships as schema migration v2 (additive; existing vaults upgrade in place on first open). The release is tagged as v2.0.0 on GitHub.

Added

• Global secrets (--global)

  Set a credential once with vaulted set KEY -g and reach it from any directory — no vaulted.toml required. get, list, rm, and rotate take the same flag, so a cross-project key like an OpenAI token lives in one place and rotates with one command. Globals are stored in a reserved project with its own wrapped AES key, reusing the existing crypto, rotation, and audit machinery unchanged.

• Opt-in run injection

  vaulted run injects no globals by default. A project opts in through its vaulted.toml — [globals] inject = "all" or a keys allowlist — and a project secret always shadows a global of the same name. --with-global KEY and --no-globals override the policy per run, and vaulted list gains a SOURCE column whenever globals apply.

• MCP and TUI support

  list-secrets accepts global: true (names only, as always), and run-with-secrets honors the project's [globals] opt-in — deliberately with no tool argument, so an agent cannot request globals a project has not opted into. The TUI shows the global namespace as a pinned entry in the sidebar.

Adds an interactive terminal UI. The release is tagged as v1.1.0 on GitHub.

Added

• vaulted tui

  A full-screen terminal UI to browse projects and environments and to add, edit, and delete secrets, driven by both keyboard and mouse. Values stay masked until revealed, each reveal is written to the audit log like vaulted list --reveal, and the alternate screen buffer keeps plaintext out of terminal scrollback. Built on Ink.

Initial open-source release. Vaulted is a Bun and TypeScript monorepo with a Rust injection primitive, a local-first .env and secrets manager that keeps ciphertext on your machine and exposes an MCP surface to coding agents without leaking values. The full release is tagged as v1.0.0 on GitHub.

Added

• @vaulted/crypto

  The full key hierarchy. Argon2id master-key derivation (64 MiB, 3 iterations, 4 lanes via hash-wasm), AES-256-GCM value encryption with a pinned frame format, RSA-OAEP-2048 wrapped per-project keys, service-account token generation with HKDF-SHA256 key derivation, and a typed error taxonomy with known-ciphertext fixtures.

• @vaulted/store

  SQLite vault on bun:sqlite. STRICT tables, WAL mode, 0600 file mode, PRAGMA user_version migrations, projects, environments, nested folders, soft-deleted secrets, service accounts, atomic project-key rotation, and an append-only audit log written in the same transaction as every mutation.

• packages/runner

  Hardened Rust cdylib for secret injection. RLIMIT_CORE = 0, environment cleared to a 10-variable allowlist plus secrets, Zeroizing secret buffers, PID-reuse-safe SIGTERM and SIGINT forwarding, pre-spawn validation, no disk writes, panic-safe FFI boundary, and a captured mode (10 MiB per stream, stdin on /dev/null) plus a signal_child export for timeout enforcement.

• @vaulted/redact

  Streaming output sanitizer. In-package Aho-Corasick matcher over plain, base64 (padded and unpadded), and URL-encoded forms of each secret value, [REDACTED:KEY_NAME] replacement, longest-match-wins overlap resolution, and chunk-boundary-safe streaming.

• apps/cli (vaulted)

  14 commands. init, unlock, lock, set, get, list, rm, import, export, run, projects, envs, rotate, and mcp. Per-directory vaulted.toml project pinning, password resolution across env var, OS keychain (Bun.secrets), 0600 file fallback, and hidden prompt, dotenv import and export with collision strategies, and pipeable stdout-only get.

• MCP stdio server

  vaulted mcp with five tools. status, list-projects, list-secrets, and get-current-project are read-only and value-free by construction. run-with-secrets carries a destructive annotation, runs on a worker thread with a configurable timeout, and returns output redacted then truncated at 50,000 chars per stream. Client setup documented for Claude Code, Cursor, Codex, Zed, OpenCode, and Claude Desktop.

• Single-execution-path invariant

  Both vaulted run and MCP run-with-secrets go through the Rust runner via one FFI bridge, enforced by a source-scan test that rejects any JS-level process API in the CLI sources.

• Audit coverage

  Secret reveals, exports, runs, and MCP access, with run and export entries written before plaintext leaves the vault.

• CI

  Ubuntu and macOS. oxlint, tsc --noEmit, bun test for all TypeScript packages and CLI e2e, cargo fmt, cargo clippy -D warnings, and cargo test for the runner.

• Release pipeline

  Tagged builds for darwin-arm64, darwin-x64, linux-x64, and linux-arm64, each tarball carrying the standalone binary plus the runner prebuild, a smoke test of every staged binary, SHA256SUMS, and a checksum-verifying scripts/install.sh.

• Documentation

  README, architecture, security, and MCP docs, plus per-package contracts in CONTRACTS.md.