{"id":47042109,"title":"Show HN: Envref – separating secrets from config in .env files","points":1,"user":"xcke","time":1771287729,"time_ago":"10 hours ago","type":"link","content":"

I wanted to test how far Claude Code (Opus 4.6) could go building a real CLI tool autonomously — not just scaffolding, but the full thing: CLI, backends, parser, tests, fuzz tests, docs, and a documentation site.

The result is envref, a tool that replaces secret values in .env files with ref:// URIs pointing to where the secret actually lives:

# .env — safe to commit\nAPP_NAME=my-app\nDATABASE_URL=ref://secrets/database_url\nAPI_KEY=ref://secrets/api_key

Config stays inline. Secrets stay in your OS keychain (or another backend). envref resolve merges them back together at runtime.

It plugs into direnv, so resolution happens automatically when you cd into a project. The resolve pipeline is optimized for <50ms with 100 variables to keep cd snappy.

Seven backend types: OS keychain (macOS/Linux/Windows — zero setup), a local encrypted vault (age + SQLite, for headless/CI), 1Password, AWS SSM, HashiCorp Vault, OCI Vault,\nand a plugin protocol for anything else.

It also does layered .env merging with profiles, variable interpolation, schema validation, a doctor command that scans for common .env issues, and `envref run` to inject\nresolved vars into a subprocess.

The experiment: Single Go binary, built across 77 autonomous agent iterations — ~192M tokens, $170 in API cost, 8 hours 41 minutes of compute time. I defined the goal, set up\nan agent loop with a backlog, and let it run. Happy to answer questions about that process.

The tool itself may be useful, but treat it as beta.

GitHub: https://github.com/xcke/envref\nSite: https://xcke.github.io/envref","url":"https://xcke.github.io/envref/","domain":"xcke.github.io","comments":[],"comments_count":0}