Workspace workflow

Repo config stays commit-safe. Secrets live in the vault; each developer picks one local environment.

1. Init scan · vault · refs 2. Env use · clear · override 3. Run child gets secrets Parent clean refs only
Authsia resolves refs in the child process, not the parent shell.

Preview

Review env files before anything is written.

Apply

Store selected secrets and write refs.

Run

Resolve at the Authsia boundary.

Select one environment

List Default, workspace tags, and env bindings, then select one. Named envs use exact-tagged and All items; Default stays inactive until you use Default or clear.

Override one run

Does not change the saved workspace environment.

Resolution order

Searches upward for the nearest .authsia/workspace.json. Conflicts fail closed.

1 · One-run flags (--environment / --default-only / explicit env files) 2 · Active named env: exact-tagged over All · Default inactive 3 · Nearest applicable managed env-file directory 4 · Deepest Vault folder · same-tier ties conflict
Guarded shims reuse this order on every command after you change the active environment.

Metadata without interrupting for approval

workspace env use, workspace env list, workspace env validate, and secret-bearing workspace run planning stays metadata-only for configured CLI-enabled refs. At the secret boundary, direct-human runs batch every supported requested item into one approval before creating the normal terminal session. Secret values never appear in either view.