# poenv

> Local, encrypted vault for app configs and secrets. Switches a repo's .env file between environments with one command (`poenv use staging`). Agent-safe: agents can switch envs and run commands with secrets injected, but never see values.

Install (macOS/Linux): curl -fsSL https://poenv.pogi.codes/install.sh | sh -s -- --yes
Install (Windows): irm https://poenv.pogi.codes/install.ps1 | iex
Then: poenv doctor --json, and follow its `fix` fields. Exit 5 = ask the user: they must run `poenv init` themselves the first time (it shows a recovery phrase you must not see), and `poenv unlock` whenever poenv is locked. Never ask for the password.

Agent commands (all support --json): poenv status, poenv ls, poenv use ENV, poenv add KEY, poenv run ENV -- CMD, poenv init, poenv doctor [--fix].
Human-only (exit 4 for agents; ask the user): poenv get, history, rollback, backup, restore, recover, and switching to protected envs like prod.
Never read the env file or dump the environment inside `poenv run`: both expose values. Never pass secret values as arguments. Never hand-edit the "# >>> poenv >>>" block.

## Docs

- [Agent skill](https://github.com/pogicodes/poenv/blob/main/skills/poenv/SKILL.md): install with `npx skills add pogicodes/poenv`
- [Agent install guide](https://github.com/pogicodes/poenv/blob/main/INSTALL.md): step-by-step, with what to do on each exit code
- [README](https://github.com/pogicodes/poenv/blob/main/README.md): overview, install, demos
- [Commands](https://github.com/pogicodes/poenv/blob/main/docs/commands.md): every command, --json and exit codes
- [Env file](https://github.com/pogicodes/poenv/blob/main/docs/env-file.md): managed block, frameworks, formats
- [Security model](https://github.com/pogicodes/poenv/blob/main/docs/security.md): what agents can and can't reach
- [Spec](https://github.com/pogicodes/poenv/blob/main/SPEC.md): full design