Overview
EnvChainChangelog for EnvChain.
Release history for all platforms.
- v1.2.0Latest2 November 2026darwin-aarch64darwin-x86_64
[1.2.0] - 2026-11-02
Added
- Project sidebar replaces the title-bar project dropdown. Projects are grouped by path prefix, searchable with Cmd+K, and collapsible per group. The whole sidebar collapses to an icon rail with Cmd+B, and does so automatically in narrow windows. Rename a project in place with a double-click or F2.
- Environment chips on every item and an environment filter, so the same variable name in dev and prod is no longer ambiguous. Type filters are a segmented control, and imports and export live in one menu.
- Doppler integration: token-based discovery of projects and configs, one-click import of every Doppler project with config-to-environment mapping, two-way sync that auto-resolves one-sided edits, read-only or read-write links, service-token support, rate-limit handling, and optional background refresh while unlocked.
release.sh --arch arm64|x86_64|allbuilds, signs and publishes the Apple Silicon and Intel releases.project.list_bindingsdaemon method reports the folders bound to a project and whether each still exists.- Headless UI renders:
node scripts/render-ui.mjs.
Changed
- EnvChain has its own accent colour, flat sidebar and sentence-case headings. The About window is compact.
- The app and the daemon now share one
settings.json(~/Library/Application Support/envchain/). The newest existing settings file from an earlier install is migrated automatically and left in place. - A fresh Touch ID unlock counts as authentication for
cacheandsessionprojects within their window, so unlocking and then reading a secret is one prompt.every_accessprojects always prompt. - Auth policy and cache TTL are now enforced per project:
every_accessalways prompts,cacheexpires after its TTL,sessionlasts until lock. Tightening a policy evicts cached access immediately.
Fixed
- Intel Macs were offered the Apple Silicon update. The updater now sends the architecture.
envchain get,set,import-env,export-envanddeletefailed with "missing vault_id". The daemon now accepts camelCase and snake_case parameters.- The fish shell hook could run commands embedded in a secret value. Quoting is fixed for bash, zsh and fish. The hook also clears the previous project's secrets when the daemon is unreachable or locked, and no longer stalls each
cdwhen the daemon is down. envchain runreported success when the child was killed by a signal, and could hang on backgrounded children. It now exits 128+signal, and a second Ctrl-C exits immediately.- The bash hook installer no longer breaks
~/.profilesetups, and exported.envfiles are created with owner-only permissions. - The JS and Python SDKs now default to the active vault, no longer time out long-running commands, decode multibyte output correctly, and report signals. A missing daemon socket raises
DaemonUnavailableError. - Daemon: a lock-ordering deadlock between broadcast and disconnect, leaked connections on a malformed hello, unbounded frame and output buffering, children outliving their client, a stale pid file blocking startup, and a sleep detector that never fired on macOS.
- Vault creation can no longer regenerate the master key and orphan an existing vault. Cleartext virtual env files are removed on expiry and after a crash, and a real
.envis never overwritten. - Renaming or deleting a project now moves or removes its folder bindings. Rename is a single transaction that merges into an existing project, concurrent bind and unbind no longer lose updates, and fast project switching no longer shows the previous project's items.
.envimport and export: the default environment export no longer includes other environments, repeated keys no longer create duplicates, imports are transactional and honourreplace, andKEY="v" # noteno longer keeps its quotes.- Plain variables no longer vanish while locked, migrations are crash-safe, a licence left running offline now expires correctly, and event listeners no longer leak.
- Provider sync: Azure and GCP could never authenticate, Azure rejected names containing
_, AWS JSON secrets did not round-trip, deletions were not propagated in two-way sync, and the sync panel hid per-key failures.
Performance
- Shell hooks resolve the bound project from a cached, canonicalised binding list instead of re-reading it on every
cd. - The project list is a single query, and opening the vault no longer hashes every migration on every request.
- v1.1.128 October 2026darwin-aarch64
Changelog
All notable changes to this project will be documented in this file.
The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.
[1.1.1] - 2026-10-28
Changed
- New app icon, built as a layered macOS icon so it follows light, dark, tinted and clear appearances. Raster fallbacks are padded to the standard macOS icon size.
[1.1.0] - 2026-05-15
Added
External secret-store providers
- New
envchain-providerscrate with adapters for eight external secret stores: HashiCorp Vault (KV v1/v2, token + AppRole, namespace-aware), AWS Secrets Manager (IAM static credentials or default credential chain, JSON-object secret expansion), Azure Key Vault (OAuth2 client credentials with token caching and 429/Retry-After handling), GCP Secret Manager (service account JSON or Application Default Credentials with RS256 JWT exchange), 1Password (Connect server withopCLI fallback), Doppler (workspace > project > config), Infisical (project + environment slug), and Bitwarden Secrets Manager (machine-account access token exchange). - One provider per vault: linking a vault to a provider opens a scope picker for the provider's native project/path layer (Doppler project, Vault mount + path, 1Password vault, Infisical workspace, AWS path prefix, Azure vault URL, GCP project + prefix, Bitwarden project).
- Live-proxy resolution: secrets resolved on-demand at injection time without local copies.
- Two-way sync (pull, push, both) with diff computation, per-key continue-on-error semantics, and a per-key failure report.
Environment-aware sync
- Provider environments map to EnvChain environment tags via
EnvironmentMapping. Doppler configs and Infisical environment slugs are first-class native environments; 1Password (tags), Bitwarden, AWS, GCP, Azure, and Vault use documented naming conventions to derive environments. - A single provider link can hydrate many environment-tagged variables in one vault, and mappings are reusable across vaults.
- Provider environments are auto-mapped to same-named EnvChain environment tags by default when a link is created; the mapping remains fully editable.
- Each link records an EnvChain project tag (
envchain_project_tag) that determines which local project pulled secrets are filed under. This is kept distinct from the external provider's own project identifier and never conflated.
Read-only links
- A vault-to-provider link can be marked read-only, restricting it to PULL (cloud -> local) only. PUSH and BOTH sync directions are rejected, and user-initiated item mutations in that vault are blocked locally. The flag is switchable after link creation.
Conflict resolution
- Bidirectional sync detects per-key, per-environment conflicts using constant-time secret comparison (no value logging).
- Per-conflict prompt-driven resolution with Local / Remote / Custom strategies, keyboard navigation (arrow keys, L/R/C shortcuts, Enter), masked value reveals, and an "N of M" live progress counter.
Credential storage
- Provider auth credentials are storable in either the OS keychain (macOS Security Framework; Windows / Linux backends scaffolded) or the encrypted SQLCipher database, user-selectable per provider link.
- All in-memory secret material uses
zeroize::Zeroizingwrappers;ProviderCredentialsandSecretValuederiveZeroizeOnDrop. - Threat-model and per-provider storage-recommendation document at
docs/providers/credential-storage.md.
Tauri bridge
- 13 new Tauri commands:
providers_list_kinds,provider_authenticate,provider_save_creds,provider_load_creds,provider_delete_creds,provider_list_scopes,provider_list_environments,provider_link_vault,provider_get_link,provider_unlink_vault,provider_resolve_secret,provider_plan_sync,provider_apply_sync. All commands gated behind the existing master-unlock + license guards. - Strongly-typed TypeScript bindings and Zod schemas under
src/lib/providers/. - Four new SQLite migrations:
V002__provider_credentials.sql,V003__vault_provider_links.sql,V004__provider_link_read_only.sql, andV005__provider_link_envchain_project_tag.sql.
Frontend
- Four new React components under
src/components/providers/: provider picker modal, four-step credentials and scope wizard, sync panel, and conflict resolution modal. - Two new Zustand stores:
useProviderLinkStore(wizard state, link flow) anduseSyncStore(plan, resolutions, conflict cursor). - Three new oklch design tokens (
--color-conflict,--color-conflict-subtle,--color-conflict-fg) with light and dark variants. - UI specification document at
docs/providers/ui-spec.md. - Accessibility:
aria-checkedon provider tiles,role="radiogroup", focus management on dialog open/close,aria-live="polite"on conflict progress, full keyboard navigation in the conflict modal.
Testing and CI
- 62 Rust unit tests (httpmock fixtures for all eight providers plus sync-engine coverage) and 28 integration tests gated behind
ENVCHAIN_INTEGRATION=1. - New GitHub Actions workflow
.github/workflows/provider-integration.ymlboots Vault, LocalStack, and Infisical via docker-compose, runs the integration suite, and uploads logs on failure. Markedcontinue-on-error: truefor the first iteration. crates/providers/tests/docker-compose.ymland shared test helpers undercrates/providers/tests/common/.- 299 vitest tests covering the new components, stores, and helpers (test files under
src/tests/providers/).
Changed
- Workspace, package, and Tauri configuration versions bumped from 1.0.0 to 1.1.0 (
envchain-licenseremains independently versioned at 0.1.0). ConflictResolutionModaluses the Tauri-nativeask()dialog from@tauri-apps/plugin-dialoginstead ofwindow.confirmfor the unresolved-close prompt.
---
[Unreleased]
Added
- Bootstrap repository structure with Tauri 2.10.x + Rust + React 19/Vite/TS
- CI workflows for macOS builds, signing, notarization, and release publishing
- Workspace structure with app, core, daemon, cli, and license crates
- Frontend stubs for main, settings, onboarding, and license windows
- Placeholder icons and entitlements configuration
TODO
- Core encryption and database implementation (rust-core-agent)
- Frontend UI and window implementation (frontend-agent)
- Daemon service for background sync (infra-agent)
- CLI command-line interface (cli-agent)
- License verification integration (license-agent)
- JavaScript and Python SDKs (sdk-agent)
---
> Add notes for each release in the [Unreleased] section above. > When releasing, move [Unreleased] changes to a new [X.Y.Z] section with today's date.
- v1.1.02 June 2026darwin-aarch64
Changelog
All notable changes to this project will be documented in this file.
The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.
[1.1.0] - 2026-05-15
Added
External secret-store providers
- New
envchain-providerscrate with adapters for eight external secret stores: HashiCorp Vault (KV v1/v2, token + AppRole, namespace-aware), AWS Secrets Manager (IAM static credentials or default credential chain, JSON-object secret expansion), Azure Key Vault (OAuth2 client credentials with token caching and 429/Retry-After handling), GCP Secret Manager (service account JSON or Application Default Credentials with RS256 JWT exchange), 1Password (Connect server withopCLI fallback), Doppler (workspace > project > config), Infisical (project + environment slug), and Bitwarden Secrets Manager (machine-account access token exchange). - One provider per vault: linking a vault to a provider opens a scope picker for the provider's native project/path layer (Doppler project, Vault mount + path, 1Password vault, Infisical workspace, AWS path prefix, Azure vault URL, GCP project + prefix, Bitwarden project).
- Live-proxy resolution: secrets resolved on-demand at injection time without local copies.
- Two-way sync (pull, push, both) with diff computation, per-key continue-on-error semantics, and a per-key failure report.
Environment-aware sync
- Provider environments map to EnvChain environment tags via
EnvironmentMapping. Doppler configs and Infisical environment slugs are first-class native environments; 1Password (tags), Bitwarden, AWS, GCP, Azure, and Vault use documented naming conventions to derive environments. - A single provider link can hydrate many environment-tagged variables in one vault, and mappings are reusable across vaults.
- Provider environments are auto-mapped to same-named EnvChain environment tags by default when a link is created; the mapping remains fully editable.
- Each link records an EnvChain project tag (
envchain_project_tag) that determines which local project pulled secrets are filed under. This is kept distinct from the external provider's own project identifier and never conflated.
Read-only links
- A vault-to-provider link can be marked read-only, restricting it to PULL (cloud -> local) only. PUSH and BOTH sync directions are rejected, and user-initiated item mutations in that vault are blocked locally. The flag is switchable after link creation.
Conflict resolution
- Bidirectional sync detects per-key, per-environment conflicts using constant-time secret comparison (no value logging).
- Per-conflict prompt-driven resolution with Local / Remote / Custom strategies, keyboard navigation (arrow keys, L/R/C shortcuts, Enter), masked value reveals, and an "N of M" live progress counter.
Credential storage
- Provider auth credentials are storable in either the OS keychain (macOS Security Framework; Windows / Linux backends scaffolded) or the encrypted SQLCipher database, user-selectable per provider link.
- All in-memory secret material uses
zeroize::Zeroizingwrappers;ProviderCredentialsandSecretValuederiveZeroizeOnDrop. - Threat-model and per-provider storage-recommendation document at
docs/providers/credential-storage.md.
Tauri bridge
- 13 new Tauri commands:
providers_list_kinds,provider_authenticate,provider_save_creds,provider_load_creds,provider_delete_creds,provider_list_scopes,provider_list_environments,provider_link_vault,provider_get_link,provider_unlink_vault,provider_resolve_secret,provider_plan_sync,provider_apply_sync. All commands gated behind the existing master-unlock + license guards. - Strongly-typed TypeScript bindings and Zod schemas under
src/lib/providers/. - Four new SQLite migrations:
V002__provider_credentials.sql,V003__vault_provider_links.sql,V004__provider_link_read_only.sql, andV005__provider_link_envchain_project_tag.sql.
Frontend
- Four new React components under
src/components/providers/: provider picker modal, four-step credentials and scope wizard, sync panel, and conflict resolution modal. - Two new Zustand stores:
useProviderLinkStore(wizard state, link flow) anduseSyncStore(plan, resolutions, conflict cursor). - Three new oklch design tokens (
--color-conflict,--color-conflict-subtle,--color-conflict-fg) with light and dark variants. - UI specification document at
docs/providers/ui-spec.md. - Accessibility:
aria-checkedon provider tiles,role="radiogroup", focus management on dialog open/close,aria-live="polite"on conflict progress, full keyboard navigation in the conflict modal.
Testing and CI
- 62 Rust unit tests (httpmock fixtures for all eight providers plus sync-engine coverage) and 28 integration tests gated behind
ENVCHAIN_INTEGRATION=1. - New GitHub Actions workflow
.github/workflows/provider-integration.ymlboots Vault, LocalStack, and Infisical via docker-compose, runs the integration suite, and uploads logs on failure. Markedcontinue-on-error: truefor the first iteration. crates/providers/tests/docker-compose.ymland shared test helpers undercrates/providers/tests/common/.- 299 vitest tests covering the new components, stores, and helpers (test files under
src/tests/providers/).
Changed
- Workspace, package, and Tauri configuration versions bumped from 1.0.0 to 1.1.0 (
envchain-licenseremains independently versioned at 0.1.0). ConflictResolutionModaluses the Tauri-nativeask()dialog from@tauri-apps/plugin-dialoginstead ofwindow.confirmfor the unresolved-close prompt.
---
[Unreleased]
Added
- Bootstrap repository structure with Tauri 2.10.x + Rust + React 19/Vite/TS
- CI workflows for macOS builds, signing, notarization, and release publishing
- Workspace structure with app, core, daemon, cli, and license crates
- Frontend stubs for main, settings, onboarding, and license windows
- Placeholder icons and entitlements configuration
TODO
- Core encryption and database implementation (rust-core-agent)
- Frontend UI and window implementation (frontend-agent)
- Daemon service for background sync (infra-agent)
- CLI command-line interface (cli-agent)
- License verification integration (license-agent)
- JavaScript and Python SDKs (sdk-agent)
---
> Add notes for each release in the [Unreleased] section above. > When releasing, move [Unreleased] changes to a new [X.Y.Z] section with today's date.
- New
- v1.0.014 May 2026darwin-aarch64
Changelog
All notable changes to this project will be documented in this file.
The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.
[Unreleased]
Added
- Bootstrap repository structure with Tauri 2.10.x + Rust + React 19/Vite/TS
- CI workflows for macOS builds, signing, notarization, and release publishing
- Workspace structure with app, core, daemon, cli, and license crates
- Frontend stubs for main, settings, onboarding, and license windows
- Placeholder icons and entitlements configuration
TODO
- Core encryption and database implementation (rust-core-agent)
- Frontend UI and window implementation (frontend-agent)
- Daemon service for background sync (infra-agent)
- CLI command-line interface (cli-agent)
- License verification integration (license-agent)
- JavaScript and Python SDKs (sdk-agent)
---
> Add notes for each release in the [Unreleased] section above. > When releasing, move [Unreleased] changes to a new [X.Y.Z] section with today's date.