Automic VaultAutomic Vault

brew

使用 Homebrew 安装 varlock

查看 varlock 的安装路径、可执行文件、元数据以及面向 AI 代理工作流的安全说明。

安装命令安全说明

安装

其他安装命令

macOS

Homebrew已验证 · 100%
brew install varlock

local Homebrew formula metadata

概览

软件包摘要

Add declarative schema to .env files using @env-spec decorator comments

命令和别名

  • varlock

历史

项目历史与用法

Varlock is a young configuration and secrets tool for `.env`-based workflows. Its project tagline frames the tool around AI-safe `.env` files: schemas are safe for agents and collaborators to read, while actual secrets are resolved separately.

项目历史

The project is built on `@env-spec`, a DSL that extends normal `.env` syntax with JSDoc-style decorator comments and function-call values. The initial `@env-spec` RFC was proposed on May 13, 2025 by maintainers Phil Millman and Theo Ephraim, describing the goal of richer validation, type coercion, sensitive-value handling, and dynamic loading while keeping the familiar `.env` format.

采用历史

Varlock targets the pain point left by `.env.example`: example files are safe to commit but often drift from real runtime requirements. Varlock instead promotes a committed `.env.schema` as a single source of truth, with local or environment-specific `.env.*` files supplying values.

使用方式

Typical usage starts with `varlock init`, which scans existing `.env` files and creates a root `.env.schema`. Users then run `varlock load` to validate and inspect resolved environment variables or `varlock run -- <command>` to execute a process with resolved values. The tool also ships as a standalone binary, Docker image, editor support, and plugins for secret backends such as 1Password, AWS, Azure, Google Secret Manager, HashiCorp Vault, and others.

为什么软件包爱好者会关心

For package users, Varlock is notable as an attempt to standardize metadata around environment variables without forcing a new YAML, JSON, or TypeScript schema file. It is especially tuned for modern AI-assisted development, where agents need configuration context but should not be handed plaintext secrets.

时间线

  • 2025-05-13: Initial `@env-spec` RFC proposed.
  • 2026: Repository documents Varlock as a CLI, Docker image, VS Code extension ecosystem, and plugin host for multiple secret backends.

Related projects

  • DMNO is cited by the maintainers as the predecessor whose lessons informed Varlock.
  • `@env-spec` is the underlying specification and parser family used by Varlock.

来源

  • Initial @env-spec RFC: https://github.com/dmno-dev/varlock/discussions/17
  • Official @env-spec overview: https://varlock.dev/env-spec/overview/
  • Official GitHub repository: https://github.com/dmno-dev/varlock
  • Official installation guide: https://varlock.dev/getting-started/installation/

安全态势

尚未找到受保护工具覆盖

没有找到 varlock 的匹配本地密钥处理 manifest。Nucleus 软件包元数据仍在此发布，以便未来覆盖拥有稳定的软件包 URL。

安装行为

  • formula 元数据中未记录 Homebrew post-install 钩子。
  • Homebrew bottle 元数据适用于 6 个平台目标。
  • 安装时包含 1 个运行时依赖。

建议审查

在无人值守的代理使用前，请检查该工具是否读取明文凭据、写入远程状态、发布制品或调用插件。

local files

Configuration and credential file locations

These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.

Configuration files

Config paths the tool may read or write during local use.

Unix
.env.schema

Credential files

Credential-bearing paths to review before unattended agent runs.

Unix
.env.local.env.*

可执行文件

已安装的可执行文件

命令类型暴露范围备注
varlockcli全局可执行文件

新鲜度

版本和新鲜度

这些信号区分页生成时间、软件包管理器活动和上游发布比较。只有存在证据 URL 和可比较版本时，才会提示版本落后。

页面生成时间2026-07-25
管理器版本1.13.0
管理器更新时间2026-07-22
本地数据OK
上游not checked
检测到的最新版本未检测到

https://varlock.dev

  • 信息Release/tag comparison is only available for GitHub repositories.https://varlock.devnone 置信度

安装元数据

软件包元数据

软件包键brew:varlock
版本1.13.0
软件包管理器Homebrew
软件包管理器页面https://formulae.brew.sh/formula/varlock
主页https://varlock.dev
仓库https://github.com/dmno-dev/varlock
上游文档https://varlock.dev/getting-started/introduction
许可证MIT
源码归档https://registry.npmjs.org/varlock/-/varlock-1.13.0.tgz
最后更新2026-07-22T21:21:52Z
Pulseupdated
依赖node
Bottle可用 (于 arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux)
Homebrew post-install未定义
服务未声明

注册表事实

源数据库详情

Source DatabaseHomebrew formula API
Taphomebrew/core
Full Namevarlock
Version Scheme0
Revision0
Bottle Stable Root URLhttps://ghcr.io/v2/homebrew/core
Deprecatedno
Disabledno
Keg Onlyno
URL Keys
  • stable

软件包图谱

链接来自本地软件包关系图、补充数据、依赖边、生态匹配和软件包 hub 归属。

相关工具

  • nodeRuntime dependency declared by Homebrew.
  • varlockSame normalized package name appears in another local ecosystem. Shared terms: cli, env, files, management, secrets.

相同工作流

  • dopplerShares av.db curated category or tags: cli, configuration, environment-variables, secrets-management, security.
  • envioShares av.db curated category or tags: cli, configuration, environment-variables, secrets-management, security.
  • infisicalShares av.db curated category or tags: cli, environment-variables, secrets-management, security.
  • secretspecShares av.db curated category or tags: cli, configuration, secrets-management, security.
  • betterleaksShares av.db curated category or tags: cli, security, validation.
  • certigoShares av.db curated category or tags: cli, security, validation.
  • varlockSame normalized package name in another local ecosystem.

来源线索

由仓库数据生成

此页面由 av-web 从 scripts/generate-pkg-sqlite.py 生成的私有软件包 SQLite 工件提供。

使用的来源

  • Geiger risk classifier
  • Nucleus package database
  • av.db category and tag curation
  • cross-ecosystem install command graph
  • curated configuration and credential file locations
  • curated package history
  • package relationship graph
  • package version freshness
  • package-page enrichment