jit v0.10.0 is out - hardening the vault, and teaching the agent to keep receipts.
jit is a CLI that finds the plaintext secrets scattered across your dev machine (.env files, shell exports, ~/.aws/credentials, CLI tokens), moves them into a local encrypted vault behind Touch ID, and keeps every tool working. This update hardens both halves of that story:
The vault:
🔑 jit vault rekey - rotate the master encryption key in place. Every stored secret is re-wrapped and verified before anything is written; the old key is destroyed only at the very end. Safe to interrupt at any instant, and one Touch ID approval covers the whole run.
⏪ jit vault history / restore - overwriting a secret used to destroy the old value permanently, turning a botched token rotation into real loss. Now the outgoing value is kept as an encrypted archived version, restorable behind a fresh Touch ID prompt. And rm still means gone — deleting a secret purges its history too.
🕵️ Tamper-evident storage - each encrypted file is cryptographically bound to its own name and timestamps. Swap two vault files, or edit a timestamp to "freshen" a stale credential, and decryption fails closed instead of quietly handing back the wrong secret.
📋 Clipboard hygiene — jit vault get --copy marks the value so clipboard managers don't index it, and auto-clears it after 45 seconds — without ever clobbering something you copied yourself.
The agent — now with a full paper trail:
🧾 Denied Touch ID prompts go on the record, not just approvals. A denied caller hits a cooldown before it can prompt you again. The session audit names which secret each unlock was actually used for. And jit agent log lets you read all of it, anytime — "why did that prompt appear?" now always has an answer.
Full details: https://github.com/jitpass/jit
Still early, still macOS-only, built in the open.
Feedback and issues welcome.
Top comments (0)