Skip to main content
Watchfire
SecretsWorks

.env files

Blocked by the sandbox on purpose — describe them in the instructions file instead.

What is .env files?

.env files are blocked at the sandbox layer on purpose. The agent gets a written description of what's available; the values stay in the environment, outside the transcript.

.env files + Watchfire

  • .env files are blocked at the sandbox layer — the agent literally cannot read them.
  • This is intentional: it stops credentials from leaking into transcripts the agent might paste back into chat output.
  • Describe what's in .env via .watchfire/secrets/instructions.md; the agent gets the description, the runtime gets the values, the transcript stays clean.

Related docs

Other secrets integrations

Works

OS keyring (macOS Keychain, libsecret)

Where Watchfire stores its own outbound adapter credentials.

Read more
Works

1Password / Bitwarden / pass

Use your shell's secret tooling — Watchfire reads from the environment.

Read more

See all integrations

Ready to go

Get started with Watchfire

Install in seconds. Define tasks. Let agents ship code for you.

Download for macOS

Available for macOS, Linux, and Windows

install
# Install via Homebrew (macOS)
$brew tap watchfire-io/tap
$brew install --cask watchfire-io/tap/watchfire
# Set up your project and go
$watchfire init
$watchfire task add "Build the login page"
$watchfire start --all

Includes GUI, CLI, and daemon. Also available via Homebrew.

View on GitHubRead the Docs