Geslar CLI

Appearance

Quickstart ​

Requires a Premium, Family, Business, or Enterprise plan.

1. Sign in ​

sh
geslar signin

Opens a device-flow code. Go to the printed URL, sign in on your account (in a browser you already trust), and enter the code shown in your terminal. Type the code yourself — never follow a link that has it pre-filled; that defeats the phishing protection the code is there for. If you're prompted for your 2FA code again even though you're already signed in, that's expected — approving a new device grants persistent CLI access, so it asks for a fresh 2FA check, once per computer.

sh
geslar whoami

Confirms who you're signed in as, your plan, and your org context.

2. Unlock the vault (optional, for headless use) ​

read/run/inject need your master password to derive the vault's decryption key — every scripted/CI-style command needs this to happen without a TTY prompt. geslar unlock prompts once, in your interactive terminal, and stores a time-limited grant (OS-encrypted — DPAPI/Keychain/libsecret) that subsequent commands reuse:

sh
geslar unlock --ttl 30m

Without an active grant, read/run/inject fall back to prompting for the master password directly (if you're at a TTY) — nothing is stored in that case. With no grant AND no TTY (e.g. a cron job), they fail closed with exit code 6.

sh
geslar lock   # clears the grant immediately

3. Read a value ​

sh
geslar read geslar://personal/GitHub/password

Prints the value to stdout — that's the one deliberate value-emission channel; every other line the CLI prints is scrubbed of any secret it has seen. Write straight to a file instead of stdout:

sh
geslar read geslar://personal/GitHub/password -o github-token.txt   # mode 0600

4. Run a command with resolved secrets in its environment ​

sh
geslar run -e DB_PASSWORD=geslar://Work/Database/password -- ./start-server.sh

Or from a dotenv-style file (only geslar:// values get resolved — everything else passes through literally):

sh
geslar run --env-file .env.geslar -- npm start

Every reference is resolved before anything spawns — one bad reference means nothing runs at all (exit 4), not a half-started process with some secrets missing.

What's next ​