internal/

Package agent implements a small ssh-agent-style background daemon that caches decrypted private keys in memory for a bounded TTL, so a headless process (like the MCP server Claude Code spawns) can unseal a vault secret without a passphrase prompt or ENVAULT_PASSPHRASE — as long as a human has unlocked that key from a real terminal within the TTL window.

Package crypto implements AES-256-GCM envelope encryption and X25519 key exchange for Envault secret sealing and unsealing.

Package git wraps go-git to push, pull, and inspect the vault repository.

Package hook installs and manages integration hooks for Envault: the Git pre-commit hook (git.go), the Claude Code PreToolUse hook (claude.go), and the PreToolUse request handler that blocks sensitive commands (preuse.go).

Package keychain seals and retrieves the user's X25519 private key using the OS-native secret store (Keychain on macOS, Secret Service on Linux).

Package mcp implements a minimal Model Context Protocol server: JSON-RPC 2.0 framed as one message per line over stdio.

Package scan implements the secret detection engine used by the envault pre-commit hook and the `envault scan` CLI command.

Package vault manages the on-disk vault layout, secret records, and recipient lists stored inside the Git repository.