Release v2.0.0 — Global secrets · woosal1337/vaulted

Vaulted 2.0.0 — Global secrets

Set a credential once, reach it from any project — without giving up safe-by-default injection.

vaulted set KEY -g stores a secret in a vault-level global namespace, reachable from any directory — no vaulted.toml needed. get/list/rm/rotate/envs take the same -g/--global flag.
One vaulted rotate --global rotates every global: no more duplicating the same API key into N projects and rotating N places.
Globals live in a reserved project with its own wrapped AES-256-GCM key, reusing the existing crypto, rotation, and audit machinery unchanged (additive schema migration v2; existing vaults upgrade in place on first open).

vaulted run injects zero globals by default. A project opts in via its vaulted.toml:
```
[globals]
inject = "all"          # or: keys = ["OPENAI_API_KEY"]
```
A project secret always shadows a global of the same name; shadowed globals are never decrypted and never claimed in the audit trail. vaulted list shows a SOURCE column with explicit global (shadowed) rows whenever globals apply.
--with-global KEY force-injects one global (loud error if it can't be injected); --no-globals suppresses all for one run.
The reserved namespace is not addressable as a project: both the CLI and MCP reject id = "global" / projectId: "global", so neither a checked-in vaulted.toml nor a prompt-injected agent can bypass the opt-in.

list-secrets accepts global: true (names only, as always — the read path stays structurally decrypt-free).
run-with-secrets honors the project's [globals] opt-in and deliberately has no agent-facing globals argument.

The global namespace appears as a pinned, marked entry in the sidebar; browse, reveal, and edit globals like any project.

Install (macOS arm64 / Linux):

curl -fsSL https://raw.githubusercontent.com/woosal1337/vaulted/main/scripts/install.sh | sh