Access and secrets

Access is set per folder, so one project can hold work that only some people see.

Who sees what

Thing	By default	Changed with
An open change	You, and agents acting for you	on access <change> <who>
A path in the project	Everyone with access to the project	on access <path> <who>, by owners
.env and .env.*	Only you	[mine] in onset.toml

<who> is me, @person, @group, team (everyone with access to the project) or everyone (public projects only). on access <path or change> with no names shows who can see it.

Private folders

on access billing/ @sam

A private path is left out of everyone else's workspaces, diffs, logs and API answers, and out of the Git view for everyone. Project owners see every path.

• It lands like anything else, and version numbers are the same for everyone.
• A version that changed only paths you can't see shows as "a private change".
• A land that writes into a path you can't see is refused.
• Agents see what the person they act for sees.

Sealed folders

on access vault/ @sam @billing --sealed

A sealed folder is a private folder whose files are encrypted on its readers' machines. The host stores them and can't read them.

• Each machine has its own key. on key shows its fingerprint.
• The host can't merge sealed files. Two changes to one come back as a conflict, and on sync merges it on your machine.
• Naming fewer people makes a new key for what's written from then on.
• on access vault/ @sam without --sealed unseals it from the next land.

Your .env files

.env and .env.* files are yours, except .env.example, .env.sample and .env.template. They're saved and follow you to every new workspace of the project. They never land, nobody else sees them, and they never appear in the Git view.

Change the list in onset.toml:

[mine]
paths = [".env", ".env.*", "!.env.example", "!.env.sample", "!.env.template"]

The secret check

Before a land, added lines are checked for things that look like real keys and tokens. A match stops the land with exit code 8 and names the file and line. Once you remove the secret, it's also scrubbed from the change's earlier saves.

--allow-secrets lands anyway, and the override is recorded.

Share a change

on access rtnbkcvx @sam          # Sam can see the change
on access rtnbkcvx @sam --edit   # Sam can also work on it

Groups

on group billing @sam @priya     # set a group's people
on access billing/ @billing      # give the group a folder

Tokens

An agent's token acts for a person and can be limited to some projects, or to reading. The host enforces the limits. See Agents.