Geslar CLI

Appearance

Known limitations (v0.1.0) ​

  1. An app that loads .env itself gets a reference, not a value. geslar run --env-file/-e resolves geslar:// references only into the child process's environment — it doesn't rewrite files on disk. If your app has its own dotenv-loading library, point it at the resolved environment via geslar run -- your-app (same pattern as op run), not at a .env file containing raw geslar:// references.
  2. No offline mode. v1 requires network access for every command that touches the vault (no local cache). Fully local-only access is a later phase, not yet scoped.
  3. Unattended CI needs a human in the loop today. There's no service-account/machine-identity story yet — every geslar signin is a real device-flow approval by a real person. CI-without-a-human is planned for a later milestone.
  4. A spawned child's environment variables are readable by other processes owned by the same OS user — this is standard OS behavior (the same is true of op run and any tool that sets child env vars), not something geslar run can change. If that's not an acceptable boundary for your threat model, isolate the process (container, dedicated CI runner user, etc.).
  5. Opt-in, guarantee-lowering flags (--return-stdout-tail, --allow-secret-read) are planned but not implemented in v0.1.0. When they land, they'll require explicit opt-in and get a distinct audit log entry — normal read/run never captures or echoes a resolved value except through the one designated channel (read's stdout, or -o <file>).
  6. The KDF is PBKDF2-SHA256 at 600,000 iterations (current OWASP minimum). Migrating to Argon2id is a decision that spans the whole platform (browser extension, console, mobile, CLI) together, not something the CLI can change unilaterally — tracked as a future platform-wide item.
  7. Alpine / musl-libc / busybox: neither install path works out of the box today. See Install for the verified specifics (busybox env rejects the CLI's shebang flag; the standalone binary is glibc-only and doesn't run under musl even with gcompat). Run geslar from a non-Alpine base if you're containerized.