$ uv tool install raaz
Resolved 1 package in 340ms
Installed 1 executable: raaz
$ raaz --help
Usage: raaz [OPTIONS] COMMAND [ARGS]...
init Initialize a raaz context (app/env/provider).
push Push the .env files for the current context.
pull Pull the .env files for the current context.
diff Compare local .env files against what's stored remotely.
matrix Compare one file's keys across every environment at once.
sync Copy secrets into a different app/env/provider - never deletes.
status doctor + diff in one glance - the one to reach for daily.
dotfiles Which local dotfiles match the pattern, and remove them.
rollback Restore local .env files from a pre-pull backup.
run Inject secrets as environment variables, no disk writes.
doctor Check a provider's credentials/config are set up correctly.
audit Local audit log - every push/pull/dotfiles remove/rollback/move.
share One-time-read secret link - no cloud credentials needed.
use Shortcut for `ctx use --env <env>`.
roar The Lion and Sun - in honor of the Iranian people.
ctx Manage your context for app, env and provider.
provider Manage providers (list, configure).
list List secrets, apps, envs, and providers.
shell Show the current context in your shell prompt.
$ raaz --version
raaz 0.1.0
$ raaz provider configure aws
Configuring 'aws' - press Enter to keep the current value.
AWS_ACCESS_KEY_ID []: AKIAIOSFODNN7EXAMPLE
AWS_SECRET_ACCESS_KEY:
AWS_DEFAULT_REGION []: us-east-1
Wrote ~/.raaz/providers/aws/provider.env
Run `raaz doctor` now to verify? [Y/n]: y
Checking provider 'aws'...
Checking connectivity (calling list())...
'aws' looks healthy.
$ echo "API_KEY=demo-api-key-789" > .env && echo "DATABASE_URL=postgres://localhost/demo" >> .env
$ raaz init myapp prod aws
Store .env files under .raaz/ instead of the project root? [y/N]: n
Raaz context initialized...
Added '.raaz/' to .gitignore, so context/backups/.env files under it never get committed.
+----------------------------------------+
| App | Env | Provider | .env Dir |
|-------+------+----------+--------------|
| myapp | prod | aws | project root |
+----------------------------------------+
$ raaz push
Pushing env for myapp/prod/aws...
Pushing .env...
Pushed myapp/prod/aws to aws
$ raaz push doesnotexist.env
Pushing env for myapp/prod/aws...
Nothing to push - no local files in . match pattern '^doesnotexist\.env$'.
$ rm .env
$ raaz pull .env
Pulling env for myapp/prod/aws...
Pulling .env...
Pulled 1 file(s) for myapp/prod/aws.
$ raaz dotfiles
+----------------------------------------+
| App | Env | Provider | .env Dir |
|-------+------+----------+--------------|
| myapp | prod | aws | project root |
+----------------------------------------+
Matching .env files in . (pattern: '^\.env|\.env$'):
- .env
Other dotfiles in . NOT matching the pattern:
- .gitignore
$ raaz list secrets
+--------------------------+
| Secrets (myapp/prod/aws) |
|--------------------------|
| myapp/prod/.env |
+--------------------------+
$ raaz list providers
+-----------------------+
| Provider | Installed |
|-----------+-----------|
| 1password | yes |
| aws | yes |
| azure | yes |
| bitwarden | yes |
| gcp | yes |
| local | yes |
| oci | yes |
| vault | yes |
+-----------------------+
$ raaz doctor
Checking provider 'aws'...
Checking connectivity (calling list())...
'aws' looks healthy.
$ echo "NEW_FEATURE_FLAG=true" >> .env
$ cat .env
API_KEY=demo-api-key-789
DATABASE_URL=postgres://localhost/demo
NEW_FEATURE_FLAG=true
$ raaz diff
+----------------+
| File | Status |
|------+---------|
| .env | changed |
+----------------+
$ raaz diff --verbose
+----------------+
| File | Status |
|------+---------|
| .env | changed |
+----------------+
--- .env ---
+ NEW_FEATURE_FLAG=true
$ raaz pull
Pulling env for myapp/prod/aws...
Backed up existing local files to .raaz/backups/20260912085327645079 - restore with `raaz rollback`
.env
$ cat .env
API_KEY=demo-api-key-789
DATABASE_URL=postgres://localhost/demo
$ raaz rollback --list
20260912085327645079 (.env)
$ raaz rollback
Restore files from snapshot 20260912085327645079? This overwrites your current local files. [y/N]: y
Restored: .env
$ cat .env
API_KEY=demo-api-key-789
DATABASE_URL=postgres://localhost/demo
NEW_FEATURE_FLAG=true
$ raaz push
Pushing env for myapp/prod/aws...
Pushing .env...
Pushed myapp/prod/aws to aws
$ raaz diff
In sync - local files match what's stored for myapp/prod/aws.
$ raaz use staging --force
+-------------------------------------------+
| App | Env | Provider | .env Dir |
|-------+---------+----------+--------------|
| myapp | staging | aws | project root |
+-------------------------------------------+
$ echo "API_KEY=test-api-key-456" > .env && echo "STAGING_DEBUG=true" >> .env
$ raaz push
Pushing env for myapp/staging/aws...
Pushing .env...
Pushed myapp/staging/aws to aws
$ raaz use prod --force
+----------------------------------------+
| App | Env | Provider | .env Dir |
|-------+------+----------+--------------|
| myapp | prod | aws | project root |
+----------------------------------------+
$ raaz pull
Pulling env for myapp/prod/aws...
Backed up existing local files to .raaz/backups/20260912085900112233 - restore with `raaz rollback`
.env
$ raaz diff --against staging --verbose
+----------------+
| File | Status |
|------+---------|
| .env | changed |
+----------------+
--- .env ---
~ API_KEY: test-api-key-456 -> demo-api-key-789
+ NEW_FEATURE_FLAG=true
- STAGING_DEBUG=true
$ raaz dotfiles example
+----------------------------------------+
| App | Env | Provider | .env Dir |
|-------+------+----------+--------------|
| myapp | prod | aws | project root |
+----------------------------------------+
Wrote 1 example file(s): .env.example
`raaz push` will keep these up to date automatically - use --no-examples to skip that for one push.
$ cat .env.example
API_KEY=
DATABASE_URL=
NEW_FEATURE_FLAG=
$ raaz matrix
myapp / .env
+-----------------------------------+
| KEY | prod | staging |
|------------------+------+---------|
| API_KEY | OK | OK |
| DATABASE_URL | OK | - |
| NEW_FEATURE_FLAG | OK | - |
| STAGING_DEBUG | - | OK |
+-----------------------------------+
OK = present - = missing entirely
$ raaz sync --to-provider aws --to-env preprod
+---------------+
| File | Action |
|------+--------|
| .env | new |
+---------------+
Write 1 file(s) to myapp/preprod/aws? [y/N]: y
Pushing env for myapp/preprod/aws...
Pushing .env...
Pushed myapp/preprod/aws to aws
Synced 1 file(s) from myapp/prod/aws to myapp/preprod/aws.
$ raaz status
+----------------------------------------+
| App | Env | Provider | .env Dir |
|-------+------+----------+--------------|
| myapp | prod | aws | project root |
+----------------------------------------+
Checking provider 'aws'...
Checking connectivity (calling list())...
'aws' looks healthy.
In sync - local files match what's stored remotely.
$ raaz run -- printenv API_KEY
Running with env for myapp/prod/aws: ['printenv', 'API_KEY']
demo-api-key-789
$ raaz run --verbose -- printenv API_KEY
+-----------------------------------------------------+
| File | Key | Value |
|------+------------------+---------------------------|
| .env | API_KEY | demo-api-key-789 |
| .env | DATABASE_URL | postgres://localhost/demo |
| .env | NEW_FEATURE_FLAG | true |
+-----------------------------------------------------+
Running with env for myapp/prod/aws: ['printenv', 'API_KEY']
demo-api-key-789
$ raaz share .env
.env: space to select key(s) to share, enter to confirm, esc to cancel.
[ ] API_KEY
[✓] DATABASE_URL
(space to tick one, a to tick/untick all, enter to confirm)
One-time share link (viewable exactly once):
https://a1b2c3d4.ngrok-free.app/s/8f2k9x3q#key=Tl2vQmX9pR7z...
(copied to your clipboard)
Waiting up to 600s for it to be opened... (Ctrl+C to cancel early)
Secret was viewed - link is now dead.
$ echo "TEMP_OVERRIDE=local-only" > .env.local
$ raaz dotfiles remove
Space to select file(s) to remove, enter to confirm, esc to cancel.
[✓] .env
[✓] .env.local
(space to tick one, a to tick/untick all, enter to confirm)
About to remove from .:
- .env
- .env.local
Remove 2 file(s)? [y/N]: y
Removed 2 file(s): .env, .env.local
$ raaz audit --limit 5
+----------------------------------------------------------------------------+
| Time | Action | App | Env | Provider | Outcome |
|----------------------+-----------------+-------+------+----------+---------|
| 2026-09-12T15:33:02Z | remove-dotfiles | myapp | prod | aws | success |
| 2026-09-12T15:32:40Z | push | myapp | prod | aws | success |
| 2026-09-12T15:32:22Z | rollback | myapp | prod | - | success |
| 2026-09-12T15:31:58Z | pull | myapp | prod | aws | success |
| 2026-09-12T15:30:15Z | push | myapp | prod | aws | success |
+----------------------------------------------------------------------------+
— install / --help / configure / dotfiles / diff / list / doctor / run / status / share never appear here — nothing changed
$ raaz audit --app myapp --env staging
+------------------------------------------------------------------------+
| Time | Action | App | Env | Provider | Outcome |
|----------------------+--------+-------+---------+----------+---------|
| 2026-09-13T08:40:11Z | push | myapp | staging | aws | success |
+------------------------------------------------------------------------+
$ raaz ctx clear
Context cleared.