Loading Secrets

Loading Secrets

One canonical place per machine. Load by NAME. Never see, echo, or move the values.

The Law (Brent's standing rules — do not renegotiate)

1. Never accept a secret via chat. If a key is missing, name the variable and ask Brent to add it to the sheet. File-on-target-machine handoff only.
2. Never echo, print, log, or commit a secret value. Report the variable NAME and the file PATH, never the value.
3. Never write to the credentials sheet. It is Brent-authored only. Agents read.
4. Never copy secrets to another file or machine. Load into process env at point of use.

Canonical locations

On the VPS, load from the .env of the service that owns the key — Hermes keys from ~/.hermes/, Claw Catcher keys from ~/claw-catcher/.env. Do not copy vars between service files.

The sheet is NOT a clean dotenv file. It is markdown with env-style lines inside. Never source it. Extract single lines only.

Load by name (the only approved read)

# Load one secret into the current process env. Value never touches stdout.
get_secret() {
  local name="$1"
  local line
  line=$(grep -m1 "^${name}=" ~/Desktop/GitSync/kloop.env) || { echo "MISSING: $name (ask Brent to add it to the sheet)"; return 1; }
  export "$line"
  echo "loaded: $name"
}
get_secret BLOTATO_API_KEY   # → "loaded: BLOTATO_API_KEY"

Load and use in the SAME shell invocation. Env does not persist between tool calls — define get_secret, load, and run the command that needs $VAR in one Bash call.

To see what exists without seeing values:

grep -o '^[A-Za-z_][A-Za-z0-9_]*=' ~/Desktop/GitSync/kloop.env | sed 's/=$//'

When a key is missing

Say exactly: "The sheet has no VAR_NAME. Add it to ~/Desktop/GitSync/kloop.env (the sheet) and tell me." Then stop that thread. Do not accept the value in chat, do not hunt other files, do not guess.

Red flags — STOP

• About to cat/head/Read the credentials sheet → you will see values. Grep the one line into export instead.
• About to paste a key into a command, file, or message → load into env and reference $VAR.
• Using a path from memory that you haven't listed this session → ls it first; this table's paths were wrong in memory once already ("GitSync Copy" never existed).
• "It's faster if Brent just pastes the key" → forbidden; the sheet is the handoff.

Common mistakes