DEV Community: Vagebond

Your keys are in plain files. Move them into the vault.

Vagebond — Sat, 31 Oct 2026 13:29:01 +0000

In the last post we showed that ignore rules and deny rules leave gaps. An agent that can read your home folder can read what lies there.

This is the follow-up. Find those files. Then move them.

Step 1: look for yourself

Start with a few plain commands. No tool needed.

ls ~/.ssh
cat ~/.aws/credentials
find ~ -name ".env" -not -path "*/node_modules/*" 2>/dev/null
grep -rl "BEGIN OPENSSH PRIVATE KEY" ~ 2>/dev/null

Every line that prints something is a secret in a plain file. Any process that runs as you can read it. That includes an agent.

Step 2: run the import scan

Kluis has an import scan. It finds keys, passwords, seed phrases and KeePass databases in your files.

You see the list. You choose what goes into the vault.

Step 3: move them into the vault

Each secret becomes an entry. Every entry is an age file, so the format is open. Nothing is locked into Kluis.

Keys are kept in the Secure Enclave and never leave the Mac. Every read of a secret asks for Touch ID. For long work, a timed session starts after one Touch ID. An audit log records the reads.

Once an entry is in the vault, you can delete the plain copy yourself.

Step 4: give a secret to one command

kluis run gives a secret to one command. When the command ends, the secret is gone.

An agent can use a secret without reading it, limited by a policy. The key goes to the command, never back to the agent.

What Kluis is not

Kluis is a password vault for the Mac. It needs macOS 14 or later on Apple silicon. There is no account and no server. It is free.

Try it

Download the disk image, drag Kluis to Applications and open it. Setup takes one minute, with no account.

Then run the scan and see what lies in your home folder.

https://baken.vagebond.nl/r/HfNztE2d

Your agent reads .env. It can't read a vault.

Vagebond — Sat, 31 Oct 2026 13:27:06 +0000

You give an AI agent a shell in your project. The project has a .env file. The agent can read it.

Most advice offers two fixes: an ignore file and deny rules. Both help. Both leave gaps. Here is where, with commands you can try.

The ignore file

An ignore file only works for the tools that read it. It can hide a file from search. It does not stop a shell command.

cat .env

If the agent can run commands, it can print the file.

Deny rules

Claude Code lets you deny tools in .claude/settings.json:

{
  "permissions": {
    "deny": ["Read(./.env)", "Read(./.env.*)", "Bash(cat:*)"]
  }
}

Now try these:

head .env
grep KEY .env
sed -n p .env
python3 -c "print(open('.env').read())"

Each rule names one path or one command. The list of other ways to read a file is long.

The environment

Many keys never sit in the repo. You export them in your shell profile:

export OPENAI_API_KEY=sk-...

The agent starts from that shell. Every child process inherits the variable.

printenv
echo $OPENAI_API_KEY

No ignore file or deny rule covers that.

Settings that help

Keep .env out of the folder you open the agent in.
Deny Read on secret paths, as above.
Keep Bash on ask, not allow.
Don't export keys in ~/.zshrc. Start the agent from a clean shell.

These shrink the gap. They don't close it. As long as the secret is in a file or in the environment, the agent can reach it.

One fix: give the key to the command

Kluis is a password vault for the Mac, for the terminal and the desktop. Your secrets live in the vault, not in plain files.

kluis run gives a secret to one command. The secret is gone when that command ends.

The agent asks kluis run to start a command with a secret.
Touch ID confirms the read.
The command gets the secret. The agent gets the output.

The key goes to the command, never back to the agent. The agent can use a secret without reading it. A policy limits what it can use. Every read goes into an audit log.

To move what is already lying around, an import scan finds keys and passwords in your files.

What Kluis is not

Kluis does not sandbox your agent. A secret you leave in a plain file stays readable. Kluis helps once the secret is in the vault.

It requires macOS 14 or later on Apple silicon. It is free. No account, no server.

The docs and the download are on the Kluis site:

https://baken.vagebond.nl/r/TbrWtFJg

Touch ID for sudo over ssh. Without a PAM module.

Vagebond — Sat, 31 Oct 2026 01:04:08 +0000

On your Mac, sudo can ask for Touch ID. Over ssh, it cannot. This post walks through the gap, the usual fix and another way.

Touch ID for sudo, locally

Since macOS 14, one line in one file is enough. The file survives system updates.

sudo cp /etc/pam.d/sudo_local.template /etc/pam.d/sudo_local
sudo nano /etc/pam.d/sudo_local

Uncomment this line:

auth       sufficient     pam_tid.so

Now sudo in Terminal asks for your fingerprint.

Why it stops at ssh

pam_tid.so runs on your Mac. When you run sudo on a server, PAM runs on the server. The server has no Touch ID sensor. So it asks for a password.

The usual fix: a PAM module on every server

The common route is an ssh key that needs Touch ID, plus pam_ssh_agent_auth on the server. sudo then checks your forwarded agent instead of a password.

On each server, install the module:

sudo apt install libpam-ssh-agent-auth

In /etc/pam.d/sudo, above the other auth lines:

auth sufficient pam_ssh_agent_auth.so file=/etc/security/authorized_keys

In sudoers, through sudo visudo:

Defaults env_keep += "SSH_AUTH_SOCK"

Then connect with agent forwarding:

ssh -A you@server

This works. It also means a PAM change on every server. The list of keys has to stay in sync. And the server can use your agent socket for as long as you are connected.

Another way: type the password

Kluis is a password vault for the Mac, for the terminal and the desktop. The kluis command types sudo passwords over ssh.

The server keeps its normal sudo and its normal password. You install nothing there.

The password is not on the screen, not in the shell history, not in a file. Every read of a secret asks for Touch ID. Keys are kept in the Secure Enclave and never leave the Mac.

A few things help with many servers:

Timed sessions after one Touch ID.
Rotate a sudo password on the server from the vault.
An audit log of reads.

What Kluis is not

Kluis does not put Touch ID on the server. The server still asks for a password. Kluis types it for you.

If you want sudo without any password, backed by a key, the PAM route is the right one.

Try it

Kluis is free. It needs macOS 14 or later on Apple silicon. No account, no server.

Download the disk image, drag Kluis to Applications and open it. The site links to the docs for the kluis commands.

Kluis is here:

https://baken.vagebond.nl/r/ryHBvrA9

From Inertia::render() to a page type

Vagebond — Sat, 31 Oct 2026 00:38:22 +0000

You type your Inertia props by hand. Then a controller changes, and the types drift.

Inertia Typegen generates TypeScript types and route helpers for Inertia pages. It reads them from Scramble's OpenAPI document. You write no types by hand.

This post walks from the PHP input to the TypeScript output.

Install

composer require vagebond/inertia-typegen
composer require --dev dedoc/scramble

Scramble is a development dependency. Inertia Typegen requires PHP 8.3+, Laravel 12 or 13, and Scramble 0.13.49+. It also needs inertia-laravel 2 or 3, Node 22.18+ and Vite 6+.

The PHP input

Here is a controller with an enum and a paginated resource collection.

enum PostStatus: string
{
    case Draft = 'draft';
    case Published = 'published';
}

class PostController
{
    public function index()
    {
        return Inertia::render('Posts/Index', [
            'posts' => PostResource::collection(Post::paginate()),
            'status' => PostStatus::Draft,
        ]);
    }
}

The page type

Each Inertia::render() call becomes a page type. The output below is simplified for this post.

type PostStatus = 'draft' | 'published'

type PostsIndexProps = SharedData & {
  // the paginator keeps its real shape
  posts: PostCollection
  status: PostStatus
}

Three things happen here.

PHP enums become a union of their values.
JSON resources, collections and paginators keep their real shape.
Shared data from the Inertia middleware becomes one type that each page type includes.

Form data

Form request rules become the type of the form data.

class StorePostRequest extends FormRequest
{
    public function rules(): array
    {
        return [
            'title' => ['required', 'string'],
            'status' => ['required', Rule::enum(PostStatus::class)],
        ];
    }
}

type StorePostData = {
  title: string
  status: PostStatus
}

You change a rule in PHP. The form type follows.

Route helpers

You also get typed route helpers for each named route.

Keeping files fresh

The Vite dev server regenerates files after a PHP change. A CI check fails when committed files are stale. You commit the generated files, so a production build needs no PHP.

No HTTP endpoint is added by default. Plugins with hooks can change the document, routes and output.

The limit

The release status is 0.x. Minor releases can contain breaking changes until 1.0. So pin the minor version and check each upgrade.

Inertia Typegen is MIT licensed. The docs cover setup, route helpers and plugins:

https://baken.vagebond.nl/r/dpRMA9Ze