Kryptic.Daemon

KO | EN

gitlite — search

#cli #web #editor #database #vue #open-source #typescript #reactjs #ruby #monitoring

(★ 9)

Desktop daemon, CLI, and tray for Kryptic. Sign in once, then local SDKs get secrets over a socket.

File Explorer

ZIP Download

- - bug.yml
  - config.yml
  - feature.yml
- - release-notes-from-changelog.py
- - ci.yml
  - release.yml
- PULL_REQUEST_TEMPLATE.md
- - ci.go
  - main.go
  - panel.go
  - rsrc_windows_amd64.syso
- - autostart_other.go
  - autostart_windows.go
  - icon.go
  - icon_linux.go
  - icon_other.go
  - icon_test.go
  - icon_windows.go
  - launcher_linux.go
  - launcher_other.go
  - main.go
  - panel.go
  - reexec.go
  - reexec_linux.go
  - reexec_other.go
  - reexec_test.go
  - rsrc_windows_amd64.syso
  - scan.go
  - status.go
- - about.go
  - logo.go
  - show_darwin.go
  - show_linux.go
  - show_windows.go
- - client.go
- - applog.go
  - applog_test.go
  - reveal.go
  - reveal_darwin.go
  - reveal_other.go
  - reveal_windows.go
- - lock.go
  - lock_unix.go
  - lock_windows.go
  - store.go
  - store_darwin.go
  - store_linux.go
  - store_test.go
  - store_windows.go
- - brand.go
  - scale.go
- - config.go
  - config_test.go
- - dialog.go
  - dialog_linux.go
  - dialog_other.go
  - dialog_windows.go
  - folder_windows.go
  - open_windows.go
  - progress_windows.go
- - ipc.go
  - ipc_unix.go
  - ipc_windows.go
  - peer_darwin.go
  - peer_linux.go
  - peer_unix.go
  - peer_unix_test.go
  - peer_windows.go
- - login.go
- - actions.go
  - actions_test.go
  - host.go
  - host_test.go
  - linuxpanel.py
  - panel_encode.go
  - session.go
  - snapshot.go
  - window_darwin.go
  - window_linux.go
  - window_other.go
  - window_windows.go
- - notify.go
  - notify_darwin.go
  - notify_linux.go
  - notify_stub.go
  - notify_windows.go
- - pidfile.go
  - priv_unix.go
  - priv_windows.go
  - signal_unix.go
  - signal_windows.go
  - stop.go
- - sign.go
  - sign_test.go
- - args.go
  - config.go
  - engine.go
  - export.go
  - export_test.go
  - folder.go
  - folder_test.go
  - gitleaks.toml
  - progress.go
  - scan_test.go
- - authfail.go
  - authfail_test.go
  - server.go
- - lock_unix.go
  - lock_unix_test.go
  - lock_windows.go
- - dot.go
  - ico.go
  - path.go
  - svg.go
  - svg_test.go
- - check.go
  - install_linux.go
  - install_other.go
  - installer.go
  - installer_other.go
  - installer_windows.go
  - update.go
  - update_test.go
- - button.go
  - winui.go
- - GenerateIcons.swift
- .gitignore
- build.sh
- Package.swift
- - build-apt-repo.sh
  - build-deb.sh
  - copyright
  - dev.kryptic.Kryptic.desktop
  - dev.kryptic.Kryptic.metainfo.xml
  - install.sh
  - kryptic-daemon.service
  - kryptic.png
  - kryptic.svg
- - dev.kryptic.daemon.plist
  - install.sh
- - embed-winres.sh
  - install.ps1
- release.sh
.gitignore
build-cross.sh
CHANGELOG.md
CODE_OF_CONDUCT.md
CONTRIBUTING.md
go.mod
go.sum
LICENSE
PROTOCOL.md
README.md
SECURITY.md
THIRD_PARTY_NOTICES

# Use via CDN

jsDelivr

jsDelivr serves any public GitHub repository as a CDN with zero setup. Pick a version and a file to get a ready-to-paste link and snippet.

Version

File

Link

Example

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

The Kryptic daemon and `kryptic` CLI in a single Go codebase (macOS, Linux, Windows).
It is the authentication boundary between a
developer's machine and the Kryptic platform: sign in once via the browser, then every
SDK on the machine gets its secrets through a local socket. Secrets live in daemon
memory only - never on disk.

## Install

Download a signed installer from [kryptic.dev/download](https://kryptic.dev/download).
That page detects your OS and architecture and serves the current build.

```bash
# Any Linux (detects arch, verifies checksums, installs the CLI + tray + user service)
curl -fsSL https://kryptic.dev/install.sh | sh
kryptic login
```

On macOS and Windows, run the installer from the download page, then `kryptic login`.

```
kryptic login                 # browser device flow, refresh token -> OS credential store
kryptic login --add           # sign in another account without leaving the current one
kryptic profile               # list saved accounts
kryptic profile switch EMAIL  # switch the active account
kryptic start                 # run the daemon (launchd/systemd/service manager keeps it alive)
kryptic stop                  # stop the running daemon
kryptic status                # daemon + session status
kryptic whoami                # signed-in user and organization
kryptic secrets list          # projects and environments you can pull
kryptic secrets get KEY --project proj_x --env development
kryptic flush                 # clear the daemon's secrets cache
kryptic logs                  # print the diagnostics log path (send this file to support)
kryptic logs --reveal         # open the diagnostics log in the file manager
kryptic scan [PATH] [--staged] [--export [FILE|DIR]]  # scan for leaked secrets (gitleaks ruleset, local only)
kryptic update                # replace this binary with the latest published build
kryptic update --check        # report whether a newer release exists
kryptic config                # show the Daemon BFF URL
kryptic config set-api URL    # point the active profile at a different Kryptic server
kryptic logout                # sign out of the active account (other profiles stay)
kryptic reset-device          # wipe the active profile's keys (next login needs a new admin grant)
kryptic reset-device --all    # wipe every profile on this install
kryptic panel                 # Open Kryptic (Windows/Linux; on macOS use the menu)
```

## How it works

- **Auth**: device flow against the Daemon BFF - the CLI prints a code, the browser
  approves it, the rotating refresh token and device keys are stored in the
  platform credential store: macOS Keychain (`/usr/bin/security`), Windows
  Credential Manager (advapi32), or libsecret on Linux (`secret-tool`), with a
  0600 file fallback when no store is available. Access tokens (15 min) stay in
  memory. One install can hold several accounts (personal and work). Switching
  the active profile does not sign the others out. `kryptic logout` keeps the
  active profile's device keys so the next login on that account does not need
  a new admin grant. `kryptic reset-device` and uninstall wipe keys. Run
  `kryptic reset-device --all` before deleting the macOS app so leftover keys
  cannot reuse trust. The menu-bar and tray icon shows a green, amber, or gray
  status dot: connected, connecting / awaiting approval, or signed out.
- **Scanning**: `kryptic scan` runs the gitleaks default ruleset (222 rules) fully
  locally - nothing leaves the machine. A 0-100% progress bar is shown on a TTY
  (hooks and CI stay quiet). Findings are redacted and a non-zero exit code
  makes it a local git hook or CI gate (`exec kryptic scan --staged` in
  `.git/hooks/pre-commit`). Staged files never leave the laptop. `kryptic scan
  --export` writes a Markdown report (`kryptic-scan-report.md` in the current
  directory when no path is given). **Scan…** in the Windows/Linux tray and the
  macOS menu bar picks a folder, shows determinate progress, and writes that
  report at the folder you chose. It works signed out, with no network.

- **Serving**: a unix socket in a per-user 0700 directory
  (`~/Library/Application Support/kryptic/kryptic-daemon.sock` on macOS,
  `$XDG_RUNTIME_DIR/kryptic-daemon.sock` on Linux with a
  `~/.config/kryptic` fallback; 0600, override with
  `KRYPTIC_SOCKET_PATH`) speaking [PROTOCOL.md](PROTOCOL.md) v1. Every connection
  is authenticated by the caller's OS credentials (`LOCAL_PEERCRED`/`SO_PEERCRED`
  on macOS/Linux, the pipe security descriptor on Windows), so only a process
  running as the same user can pull secrets. Bundles are cached in memory for 5
  minutes.
- **Self-update**: `kryptic update` verifies the downloaded binary against the
  release `checksums.txt`. The menu-bar and tray apps also have **Check for
  Updates**. macOS and Windows download the signed installer and open it.
  Linux replaces the CLI and tray in place (a password prompt if they live
  under `/usr`), so App Center is not involved. Reinstall from
  [kryptic.dev/download](https://kryptic.dev/download) if you prefer.
- **API**: each profile talks to its own Daemon BFF (hosted default
  `https://daemon.kryptic.dev`). Set this profile's URL with
  `kryptic config set-api URL` or **Server URI**. Add another host with
  `kryptic login --add --api URL`. `KRYPTIC_API` overrides every profile for
  that process. Changing one profile's URL signs that profile out only.
- **Diagnostics**: `kryptic logs` prints `…/kryptic/logs/kryptic.krypticlog`.
  That file records app function (start, token refresh, HTTP status, updates).
  It never contains secrets, tokens, or names. It rotates at 2 MiB with one
  backup. **Reveal Diagnostics Log** in the menu bar / tray opens it so a user
  can send it to support.

## Build

```bash
go build -o kryptic ./cmd/kryptic     # ~8 MB static binary, stdlib only
```

`build-cross.sh` cross-compiles the CLI for macOS/Linux/Windows and the
`kryptic-tray` app for Linux and Windows into `dist/`. The tray app is the
Windows/Linux counterpart of the macOS menu-bar app: the same menu (status,
sign in/out, Operations, Settings, Help & Support, About, quit), running the
daemon in-process - one binary, no bundling. On Windows the daemon serves the
named pipe `\\.\pipe\kryptic-daemon`.

`packaging/linux/build-deb.sh` wraps those Linux binaries in a `.deb` with a
`.desktop` file, icon, AppStream metainfo, and a systemd user unit. The `.deb`
and apt-repo jobs in `.github/workflows/release.yml` are disabled until the
Snap Store listing is in App Center and the GitHub Pages deploy path is ready.
`packaging/linux/install.sh` does the user-local install into `~/.local`
without root.

`macos/build.sh` packages the menu-bar app with this binary bundled inside.
`macos/build.sh --debug` builds it pointed at the IDE Daemon BFF
(`http://localhost:5237`) so sign-in opens the local management client.
Compose publishes that BFF on `http://localhost:5211`. `KRYPTIC_API`
overrides either default (`kryptic config set-api` writes it into the
daemon config).

`macos/` contains the earlier SwiftUI menu-bar implementation, kept as reference until
the Go daemon reaches installer/notarization parity.

License: GPL-3.0. Third-party notices: THIRD_PARTY_NOTICES.

Kryptic.Daemon

File Explorer

# Use via CDN

Was this content helpful?

Recent Feedback

Download README