Sync secrets into a directory's .env file
oneguard_env_syncFetches the linked secret from OneGuard and writes it to the project's .env file. Returns only variable names, never values, and re-pulls updated secrets on repeat calls.
Instructions
THE MAIN TOOL. Fetches the secret linked to a directory and writes it into that directory's .env file, then remembers the link for next time. Call it with only project_dir when the directory is already linked (it re-pulls the latest values). If it is not linked yet, this returns the list of vaults (or secrets) to choose from — show those to the user, let THEM pick, then call again with vault and secret. Returns only the variable NAMES that were written; values go to disk and are never shown.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | Env file path relative to project_dir. Defaults to ".env". | |
| vault | No | Vault id or 8-character prefix. Omit if the directory is already linked. | |
| relink | No | Ignore the existing link and set a new one. Use when the user wants to point this directory at a different secret. | |
| secret | No | Secret id or 8-character prefix. Omit if the directory is already linked. | |
| project_dir | Yes | Absolute path to the developer's project directory. This is where the .oneguard link file and the .env file live. Must be absolute — ask the user if you do not know it. |