Commands

Every command that touches items works on one vault file, asks for one master password, and does one thing to the items inside it. plugin and completions are the exceptions: they report on the installation itself and need neither a vault nor a password.

The commands

Making and reading a vault

• init — create a new vault
• ls — list items
• find — search items by text, kind and tags
• show — show an item without its secret fields

Items

• add — add a note, a credential or a file
• get — copy a secret to the clipboard
• edit — change a title, contents or tags
• rm — remove an item
• extract — write a stored file back to disk
• tags — list the tags in use

Moving data in and out

• export — write the contents out as plain JSON
• import — add the contents of an export
• merge — fold another vault file into this one

Between machines

• push — send this vault to the remote
• pull — fetch the remote copy and fold it in
• sync — pull, then push

The vault itself

• change-password — replace the master password
• plugin — inspect the installed transports
• completions — print a shell completion script

Choosing the vault

sefy has no default location: pass --vault <FILE> or set SEFY_VAULT. A vault at a predictable path like ~/.sefy/vault would undo the point of a file that looks like nothing.

export SEFY_VAULT=~/backups/notes.bak

Variable	Meaning
SEFY_VAULT	Path of the vault to work on, when --vault is not given.

The master password

The password is asked for on the terminal, without echo. For scripts, --password-env <VAR> reads it from an environment variable instead.

A password cannot be passed as an argument: it would land in the shell history and in every process listing. Password variables are never fixed names either — you name them yourself and point sefy at them with --password-env, --item-password-env or --new-password-env.

Without a terminal, sefy refuses to prompt rather than hanging.

References

Wherever a command takes a <REFERENCE>, it accepts:

1. an id — sefy get 7;
2. an exact title, case-insensitive — sefy get bank;
3. text to search for, matched against titles, note bodies and credential fields — sefy get grocer.

An exact title always beats a substring. If more than one item still matches, sefy lists the candidates rather than guessing:

$ sefy get mail
error: 2 items match "mail":
     3  mail — personal                 credential
     7  mail — work                     credential
narrow the text, or use an id

Exit status

0 on success, 1 on any error. Errors go to stderr; a wrong password and a file that is not a vault produce the same message, because an authenticated blob genuinely cannot tell the two apart.