Command line

Command line

brew install --cask roypadina/tap/vaultbar links vaultbar into your PATH. Built from source, call the app's own binary with the same arguments: /Applications/VaultBar.app/Contents/MacOS/VaultBar status.

vaultbar status [--json]
vaultbar path [<vault>]
vaultbar lock [<vault>] [--wait <seconds>]
vaultbar lock --all [--wait <seconds>]
vaultbar unlock [<vault>] [--readonly] [--wait <seconds>]
vaultbar open [<vault>]
vaultbar help

No <vault> means the default vault.

Command	What it does
status	One line per vault (Work: unlocked at /Users/you/Vaults/mnt/Work (read-only)), or JSON with --json
path	Prints the mount point of an unlocked vault (exit 1 if it is locked)
lock	Locks a vault (--all: every vault). Asks before forcing a busy one, like the menu
unlock	Opens VaultBar's password popup for the vault; --readonly for a read-only mount. Prints the path once unlocked with --wait
open	Opens the vault in Finder, unlocking it first if needed

lock, unlock and open send the matching vaultbar:// link (see Usage → URL scheme), which also starts VaultBar if it isn't running. --wait <seconds> polls once a second until the vault is unlocked or locked.

No password, ever. unlock takes no password from arguments, the environment or stdin: a person types it into the popup. That keeps scripts, shell history and AI agents with shell access from becoming a way to unlock.

Exit codes

Code	Meaning
0	done
1	locked / not mounted (path), or VaultBar couldn't be reached
2	no such vault (or no default vault set)
3	--wait timed out
64	usage error: unknown command or option

An unknown argument always prints the usage and exits 64; it never starts a second menu bar copy.

JSON

{
  "vaults" : [
    { "default" : true, "hidden" : false, "name" : "Personal", "unlocked" : false },
    { "default" : false, "hidden" : true, "mountPoint" : "/Users/you/Vaults/mnt/Work",
      "name" : "Work", "readOnly" : true, "unlocked" : true }
  ]
}

mountPoint and readOnly appear only for unlocked vaults.

Examples

# Give a job a stable, read-only path, then lock again
vaultbar unlock Work --readonly --wait 120 && my-job --root "$(vaultbar path Work)"; vaultbar lock Work

# Lock everything from a script
vaultbar lock --all --wait 30