v0.5.6

sm v0.5.6

Group headers stopped repeating themselves.

One disclosure per group

Every group section used to carry its own labeled Manage group button, so
a list of ten groups showed the same ten buttons. Now each header carries
just two quiet icons — + to add a secret to the group and ⋯ for its
actions — the same shape as a secret row.

A group that spans global and project entries keeps a single control: the
menu lists Manage global group and Manage project group instead of
putting two buttons in the header.

Renaming and ungrouping are unchanged, and the guarded Undo still applies.

Install

brew upgrade --cask sm    # macOS

Linux CLI and desktop binaries are on the release.

v0.5.5

sm v0.5.5

The reveal control is now a proper row action.

A cleaner row

The eye button no longer sits inside the value text. It lives in a
right-aligned action group next to the overflow menu, so:

• it never shifts or crowds the masked hint;
• every eye in the list lines up in one column;
• the overflow menu keeps the same position on rows with and without a reveal
  control.

Revealing still shows the value for 20 seconds, audits the reveal, and works
from the keyboard. The button is now named for screen readers
("Reveal value for AWS_ACCESS_KEY_ID").

Install

brew upgrade --cask sm    # macOS

Linux CLI and desktop binaries are on the release.

v0.5.4

sm v0.5.4

A small UI fix and clearer security wording.

Reveal control alignment

The eye button for sensitive values now sits directly beside the last-four hint
and is vertically centered with it. It no longer floats at the far edge of the
row next to the chips.

Redaction boundaries

The README, security notes and guide now state explicitly that redaction covers
the MCP output before the harness receives it — not the harness's own
request/session logs, model context, child-written files or encoded values.

Install

brew upgrade --cask sm    # macOS

Linux CLI and desktop binaries are on the release.

v0.5.3

sm v0.5.3

Update visibility and a cleaner value-reveal control.

Update available

sm update          # checks GitHub Releases explicitly
sm update --json

The latest published release is read from the GitHub Releases API
(api.github.com/repos/karthikmprakash/agents-secret-manager/releases/latest).
The result is cached at ~/.config/sm/update.json, shown by sm status, and
surfaced as an Update available banner in the app. The top-bar download
icon checks on demand.

There is no background check and no telemetry. A check sends one request to
GitHub with normal metadata (IP and User-Agent: sm/<version>), never names,
values, or vault contents.

Reveal with the eye

Sensitive values now have an eye button on the row. It reveals the full value
for 20 seconds and then hides again; the menu item is gone. Plain config is
still shown directly and with sm env --show-config.

Also fixed

• Symlinked sm paths (for example ~/.local/bin/sm pointing at the Homebrew
  binary) count as configured instead of showing "different path".
• OpenCode JSONC status and direct config fallback from 0.5.2 remain in place.

Install

brew upgrade --cask sm    # macOS

Linux CLI and desktop binaries are on the release.

v0.5.2

sm v0.5.2

OpenCode wiring fallback, harness removal, and local value access.

OpenCode

Wiring no longer depends on an opencode binary being on the GUI PATH or on a
version-specific CLI syntax. sm prefers the CLI when available, then edits
opencode.json / opencode.jsonc directly. Status parsing now handles JSONC
comments, so an existing manual entry is recognized instead of looking
unwired.

Remove a harness

sm setup --remove --agent claude   # one harness
sm setup --remove --all            # every detected harness

The UI's Agents view has a Remove action on each row. Removal deletes
only the sm MCP entry and keeps the rest of the harness configuration. Files
that sm edits get a .sm-backup.

See values locally

• Plain config (sensitive = false) is shown in the UI and with
  sm env --show-config.
• Sensitive entries show a last-four hint in the UI. Reveal value shows the
  full value for 20 seconds.
• sm get NAME prints one value locally.
• Every reveal appends a reveal entry to the audit log.
• The MCP surface still has no value-returning tool.

Install

• macOS: brew tap karthikmprakash/tap && brew install --cask sm
  (now 0.5.2).
• Linux: sm-linux-amd64 and sm-desktop-linux-amd64.
• Verify downloads with SHA256SUMS or the adjacent .sha256 files.

v0.5.1

sm v0.5.1

Homebrew distribution for the macOS app, plus a universal macOS bundle that
contains both the app and the CLI.

macOS: Homebrew

brew tap karthikmprakash/tap
brew install --cask sm

This installs sm.app and the sm CLI. The app asks for a desktop passphrase
on first launch and unlocks with Touch ID afterwards. Homebrew clears the
quarantine attribute for this unsigned build.

Direct downloads

# macOS app + CLI (universal)
curl -LO https://github.com/karthikmprakash/agents-secret-manager/releases/latest/download/sm-macos-app.zip
unzip -q sm-macos-app.zip -d sm-macos
open sm-macos/sm.app

# Linux CLI and desktop app
curl -LO https://github.com/karthikmprakash/agents-secret-manager/releases/latest/download/sm-linux-amd64
curl -LO https://github.com/karthikmprakash/agents-secret-manager/releases/latest/download/sm-desktop-linux-amd64
curl -LO https://github.com/karthikmprakash/agents-secret-manager/releases/latest/download/SHA256SUMS
shasum -a 256 -c SHA256SUMS --ignore-missing
chmod +x sm-linux-amd64 sm-desktop-linux-amd64
mkdir -p ~/.local/bin
mv sm-linux-amd64 ~/.local/bin/sm
./sm-desktop-linux-amd64

The Linux desktop app needs GTK 3 and WebKitGTK 4.0 (Ubuntu 22.04) or 4.1
(24.04+). The app lock gates the desktop UI only; the CLI and MCP stay
available.

v0.5.0

sm v0.5.0

Local, encrypted secrets for AI coding agents, now with desktop apps and an
app lock.

Desktop apps

• macOS (sm-macos-app.zip): a WKWebView shell that unlocks with Touch ID
  or the desktop passphrase, and locks on launch, sleep, screen lock or ⌘L.
• Linux (sm-desktop-linux-amd64): a GTK + WebKitGTK shell that unlocks
  with the passphrase, offers fingerprint unlock when fprintd-verify is
  installed, and locks after 15 minutes idle or with Ctrl+Shift+L.

The lock is an app-level gate. The vault identity still lives in the Keychain
or Secret Service, and the CLI/MCP are intentionally not gated by it. Manage it
with sm lock status|set|verify|clear; the verifier is a salted Argon2id hash
at ~/.config/sm/desktop.lock (mode 0600).

Install

• macOS: unzip sm-macos-app.zip and open sm.app. The CLI is also in
  sm-darwin-arm64 / sm-darwin-amd64.
• Linux CLI: sm-linux-amd64. Linux desktop: run
  sm-desktop-linux-amd64 beside the sm binary (or set SM_BIN). It needs
  GTK 3 and WebKitGTK 4.0 (Ubuntu 22.04) or 4.1 (24.04+).
• Verify every download with the adjacent .sha256 or SHA256SUMS.

Also in this release

• Landing page compatibility strip now uses the harness logos.
• Refreshed light/dark screenshots of the current branded app.
• Archify runtime architecture diagram and a fuller user guide.

macOS note

The downloads are not notarized. If macOS blocks the CLI, run
xattr -d com.apple.quarantine ~/.local/bin/sm; for the app, right-click
Open once or remove the same attribute.

v0.4.0

sm v0.4.0

Local, encrypted secrets for AI coding agents — one vault, every harness, no
secret values in model context.

Highlights

• Editable import review with local conflict checks, stable IDs, and no
  silent replacement of differing values.
• Broader deterministic parsing: JSON/YAML, labeled blocks, curl headers,
  bare values, inline emails, AWS/Modal, and Cloudflare R2 exports.
• Group management with rename/ungroup, guarded Undo, and sm service.
• Passphrase-encrypted local recovery in the CLI and UI: export, verify, and
  restore into an empty destination vault.
• Redesigned CLI: sm status dashboard, sm agents, grouped help,
  shell completion, --group / --config aliases, and better output.
• New documentation: developer-focused README, detailed user guide, UI
  screenshot, and an Archify-generated architecture diagram.

Install

Download sm-darwin-arm64 or sm-darwin-amd64, verify the adjacent
.sha256, then:

chmod +x sm-darwin-arm64
mkdir -p ~/.local/bin
mv sm-darwin-arm64 ~/.local/bin/sm
sm onboard

There is no notarized installer or Homebrew formula yet. Full details and the
threat model are in the README.

v0.3.0

What's Changed

• Bump actions/setup-go from 5 to 7 by @dependabot[bot] in #1
• Bump actions/checkout from 4 to 7 by @dependabot[bot] in #2

New Contributors

• @dependabot[bot] made their first contribution in #1

Full Changelog: https://github.com/karthikmprakash/agents-secret-manager/commits/v0.3.0