Muth encrypts environment secrets into muth.lock via X25519 or SSH keys. Secrets are decrypted in-memory during child process execution without shell hooks or writing plaintext to disk.
System Architecture
filippo.io/age for X25519 and SSH id_ed25519 recipient stanzas. Interoperable with standard age CLI tools.muth run -- <cmd> decrypts payload in RAM and injects values directly into child process cmd.Env. Zero shell mutations.muth grant <pubkey> appends recipient stanzas to muth.lock without re-encrypting underlying secret payloads.Workflow Example
$ muth set OPENAI_API_KEY=sk-proj-xyz123
[ok] Secret 'OPENAI_API_KEY' encrypted into muth.lock!
$ muth run -- revoq run
==> Executing child process with in-memory secrets...