good-door hides .env secrets from a coding agent's shell

An AI coding agent inherits every file its user can read. A fresh Python CLI called good-door tries to narrow that list to one command at a time.

The repository dreamers-laboratory/good-door carries a tool named elbab. Its README argues that attackers rarely break encryption. They read what the user left in plaintext: ~/.aws/credentials, an SSH key with no passphrase, a .env in a backup, or a token in an agent transcript. The tool encrypts those files. It only decrypts them for the duration of one command.

What it hides and where the key lives

The project stores the master key in an operating system vault rather than another file on disk. On macOS that is the Keychain, or the Secure Enclave with the right plugin. On Linux it is a TPM when one is present, or the GNOME or KDE secret service. On Windows it is DPAPI. The project says any machine with a YubiKey can hold the key on hardware. An identity file on disk is the fallback.

A command wraps the one that needs the secret. elbab run decrypts the relevant file, passes it to the child process, and removes it when the child exits. The author argues this keeps the secret off the shell history. It also keeps it off the file system between calls, and out of any backup the user syncs later.

The agent-shell check is the main claim

The project checks five environment variables on every run. If CLAUDECODE, AI_AGENT, CODEX_THREAD_ID, CODEX_SHELL or CODEX_SANDBOX is set, the tool masks the secret in its own command output. The agent then reads a stand-in string instead of the real token. The transcript the agent writes to disk carries that stand-in.

The author says this is the specific failure the tool is built for. A coding agent prints its tool output to its own log, and that log travels with the session. A token printed once has, by the time a human notices, been in many places.

Where it does not help

The README is explicit about the limit. "Anything running as you can call elbab," it says. The tool protects copies, in backups, sync, transcripts and other accounts. It does not protect a compromised account. A script running as the same user can still ask the tool to decrypt the file. The author presents the tool as a way to cut the number of places a copy of a secret lands. It is not a sandbox around an agent.

The project is MIT. It needs Python 3.9 or newer and age 1.2 or newer. It carries 204 stars five days after the first commit. It is one person's code, with no releases and no outside contributors on the page at the time of writing.

A team running Claude Code, Codex or a custom agent on an engineer's laptop has a small decision to make. A single elbab run would wrap the command that reaches a cloud API or a private registry. If the README is accurate, that wrap takes the live credential out of the transcript. The cost is the wrap, every time, for every command that needs a secret.

Source

good-door on GitHub by dreamers-laboratory.