chainenv

Chainenv

Use this skill when the user wants to work with the installed chainenv CLI. This skill is for operating the product, not for changing its source code.

Prerequisites

• chainenv must be installed and available on PATH.
• Start with chainenv diag to confirm backend availability on the current machine.
• For 1Password flows, the op CLI must be installed. Authentication can come from an active op session or from OP_SERVICE_ACCOUNT_TOKEN.
• If config-driven behavior matters, read references/auth.md for .chainenv.toml layout and token-loading behavior.

When To Use It

Use this skill for:

• backend diagnostics
• reading stored secrets with get or get-env
• generating shell exports for bash, zsh, fish, or plain output
• writing or updating secrets with set and update
• copying secrets between keychain and 1Password
• explaining how .chainenv.toml affects provider selection and default fallbacks

Read references/commands.md when you need exact command forms. Read references/usage.md when you need workflow guidance or troubleshooting.

Operating Guidance

1. Confirm the CLI is installed and run chainenv diag.
2. Prefer read-only commands first: ls, list, get, or get-env.
3. Check whether config should drive provider selection or default fallbacks.
4. Use write commands only after the target key and backend are explicit.
5. Prefer keychain for day-to-day reads when 1Password latency is a concern.

Command Selection

• Use chainenv ls to list all stored accounts in the selected backend.
• Use chainenv list to list keys declared in config.
• Use chainenv get <KEY> for one secret.
• Use chainenv get-env ... --shell <shell> for multi-key shell exports.
• Use chainenv get-env --shell <shell> with no keys only when config files define the keys to load.
• Use chainenv set to create a secret and register it in config.
• Use chainenv update to change an existing secret.
• Use chainenv copy or chainenv cp to move secrets between backends.

Prefer --shell fish|bash|zsh for new examples. The legacy --fish, --bash, and --zsh flags still work when matching older user setups.

Failure Guidance

• If chainenv diag shows the keychain backend unavailable, the host may not support the selected backend or the keyring service is missing.
• If 1Password commands fail, check for op on PATH, signed-in state, and whether OP_SERVICE_ACCOUNT_TOKEN is set or can be loaded from config.
• If get-env without explicit keys prints No config found or No keys found, switch to explicit key arguments or fix the config file.
• default values in config are plaintext fallbacks, not encrypted secrets.
• Prefer live chainenv --help and subcommand help over stale documentation when they differ.