# 使用 Homebrew 安装 varlock

查看 varlock 的安装路径、可执行文件、元数据以及面向 AI 代理工作流的安全说明。

## 安装

```sh
sudo av install brew:varlock
```

其他安装命令:

### macOS

- Homebrew (100%):

```sh
brew install varlock
```

  证据: local Homebrew formula metadata

## 软件包事实

- **软件包键:** brew:varlock
- **软件包管理器:** Homebrew
- **版本:** 1.16.0
- **来源摘要:** Add declarative schema to .env files using @env-spec decorator comments
- **主页:** <https://varlock.dev>
- **最后更新:** 2026-08-01T21:49:42Z
- **已生成:** 2026-08-03T19:37:03+00:00

## 可执行文件

- varlock (别名)

## 安装行为

- Bottle: 不可用

## 版本和新鲜度

- 页面生成时间: 2026-08-03
- 管理器版本: 1.16.0
## 项目历史与用法

Varlock is a young configuration and secrets tool for `.env`-based workflows. Its project tagline frames the tool around AI-safe `.env` files: schemas are safe for agents and collaborators to read, while actual secrets are resolved separately.

### 项目历史

The project is built on `@env-spec`, a DSL that extends normal `.env` syntax with JSDoc-style decorator comments and function-call values. The initial `@env-spec` RFC was proposed on May 13, 2025 by maintainers Phil Millman and Theo Ephraim, describing the goal of richer validation, type coercion, sensitive-value handling, and dynamic loading while keeping the familiar `.env` format.

### 采用历史

Varlock targets the pain point left by `.env.example`: example files are safe to commit but often drift from real runtime requirements. Varlock instead promotes a committed `.env.schema` as a single source of truth, with local or environment-specific `.env.*` files supplying values.

### 使用方式

Typical usage starts with `varlock init`, which scans existing `.env` files and creates a root `.env.schema`. Users then run `varlock load` to validate and inspect resolved environment variables or `varlock run -- <command>` to execute a process with resolved values. The tool also ships as a standalone binary, Docker image, editor support, and plugins for secret backends such as 1Password, AWS, Azure, Google Secret Manager, HashiCorp Vault, and others.

### 为什么软件包爱好者会关心

For package users, Varlock is notable as an attempt to standardize metadata around environment variables without forcing a new YAML, JSON, or TypeScript schema file. It is especially tuned for modern AI-assisted development, where agents need configuration context but should not be handed plaintext secrets.

### 时间线

- 2025-05-13: Initial `@env-spec` RFC proposed.
- 2026: Repository documents Varlock as a CLI, Docker image, VS Code extension ecosystem, and plugin host for multiple secret backends.

### Related projects

- DMNO is cited by the maintainers as the predecessor whose lessons informed Varlock.
- `@env-spec` is the underlying specification and parser family used by Varlock.

### 来源

- Initial @env-spec RFC: https://github.com/dmno-dev/varlock/discussions/17
- Official @env-spec overview: https://varlock.dev/env-spec/overview/
- Official GitHub repository: https://github.com/dmno-dev/varlock
- Official installation guide: https://varlock.dev/getting-started/installation/


## 安全说明

没有找到 varlock 的匹配本地密钥处理 manifest。Nucleus 软件包元数据仍在此发布，以便未来覆盖拥有稳定的软件包 URL。



## Configuration and credential file locations

These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.


## Configuration files

- Unix: .env.schema

## Credential files

- Unix: .env.local, .env.*

## Combined YAML source

View the package source record on GitHub. [combined/varlock.yml](https://github.com/mxcl/pkgdb/blob/main/combined/varlock.yml)


## 来源

- pkg.so package database
- Geiger risk classifier
- curated configuration and credential file locations
- curated package history
- pkgdb category and tag curation
- cross-ecosystem install command graph