enver

README

enver

One YAML store. Many environments. Your tool's own config stays untouched.

Inject environment variables from named, layered YAML profiles into any child command — without mutating the target tool's own configuration. Built for running Claude Code against different API keys / base URLs / model sets, but works for any command: enver is a provider-agnostic exec shim that speaks plain YAML and plain env vars.

$ enver show dev
# profile: dev → base-anthropic → opus-models
ANTHROPIC_API_KEY=sk-a…(len=27)  # from base-anthropic (global)
ANTHROPIC_BASE_URL=https://api.anthropic.com  # from base-anthropic (global)
ANTHROPIC_MODEL=claude-opus-5  # from opus-models (global)
ANTHROPIC_SMALL_FAST_MODEL=claude-haiku-4-5-20251001  # from dev (local)

$ enver x dev -- claude          # all of it injected into this child only

$ enver export offline           # fencing drops keys instead of redefining them
export ANTHROPIC_BASE_URL='https://api.anthropic.com'

One global store at ~/.config/enver/config.yaml, one optional project file at ./.enver.yaml, zero mutation of ~/.claude/ or anything else under your tools' control.

Install

Homebrew (macOS & Linux):

brew tap neiromaster/enver
brew trust neiromaster/enver     # required for third-party taps
brew install enver               # wires shell completions; strips Gatekeeper quarantine on macOS

Go (anywhere with a Go toolchain):

go install github.com/neiromaster/enver/cmd/enver@latest

npm:

npm install -g @enver-go/enver

Script (no package manager, macOS/Linux):

curl -fsSL https://raw.githubusercontent.com/neiromaster/enver/main/scripts/install.sh | bash
# pin a version:
curl -fsSL https://raw.githubusercontent.com/neiromaster/enver/main/scripts/install.sh | bash -s -- v0.9.1

Windows (PowerShell 5.0+):

irm https://raw.githubusercontent.com/neiromaster/enver/main/scripts/install.ps1 | iex
# pin a version:
$env:ENVER_VERSION = "v0.9.1"; irm https://raw.githubusercontent.com/neiromaster/enver/main/scripts/install.ps1 | iex

Piping a script to your shell runs it without review — read it first. The installer verifies the download against the release's SHA-256 checksums, then installs to ~/.local/bin (macOS/Linux) or %LOCALAPPDATA%\enver\bin (Windows); ENVER_INSTALL_DIR overrides. Uninstall: delete the enver binary (plus the PATH entry the Windows script may have added).

Update:

enver update              # via the owning package manager, or self-replace
enver update --check      # exit 0 up to date, 1 update available, 2 error

enver update delegates to npm / brew / go install when enver was installed that way; a directly-installed binary is replaced from GitHub releases. The new binary takes effect on the next launch. Version lookups use the GitHub API (60 requests/hour unauthenticated; set GITHUB_TOKEN to raise the limit).

Build from source (make build → ./bin/enver) or grab pre-compiled linux/darwin/windows × amd64/arm64 archives with completions from the releases page.

Why enver

dotenvx / dotenv load .env files local to the working directory; direnv layers by directory but through a shell hook and per-dir files; claude-specific switchers mutate ~/.claude/settings.json. enver keeps one store, inherits like code, and hands the result to a single child process.

Feature	Doc
Two-layer configs: global store ⊕ project file, per-key overlay, no walk-up	config.md
Multi-parent extends: mixins composed left-to-right, transitive inheritance	config.md
unset fences: keys enver must never set; shell values pass through untouched	config.md
Provenance: every value annotated # from <profile> (<layer>) in show	cli.md
Secrets encrypted at rest (argon2id + AES-256-GCM), transparent decrypt	secrets.md
.env round-trip with comments, raw $VAR references, diff-marked import	dotenv.md

How it works

1. Load the global config, overlay the local ./.enver.yaml.
2. Resolve the selected profile walking extends with cycle detection — root first, child overrides parent.
3. For enver x: child env = current environment ⊕ profile env, then exec with stdio connected and the exit code propagated.

Full manual

• docs/config.md — layers, merge rules, extends, suppressing variables
• docs/profiles.md — add, edit, remove/rename/ duplicate/default, validate
• docs/cli.md — command and flag reference, masking, removed forms
• docs/dotenv.md — .env import/export
• docs/secrets.md — encryption, key management, threat model
• docs/contributing.md — local checks, hooks, conventions

MIT — see LICENSE.