Feature
Secrets that stay on your machine
{{secret:NAME}} references resolve locally at apply time, never in the registry.
A package refers to a secret with a {{secret:NAME}} placeholder. Workloom resolves it on your machine when it writes the file, and the value never enters the registry or the render-plan state. A literal secret in an asset is denied by the trust gate (trust.inline_secret).
`wl secret set` stores a value in the OS keychain when one is available, otherwise in an encrypted vault. Values resolve in order from a WORKLOOM_SECRET_<NAME> environment variable, the OS keychain, then the vault (~/.workloom/secrets.vault, AES-256-GCM with a scrypt-derived key from a passphrase you type or set as WORKLOOM_VAULT_PASSPHRASE). `wl secret set` reads the value from stdin or WORKLOOM_SECRET_VALUE, never from the command line, and `wl secret get` masks it unless you pass --reveal.
More features
All features →- 01
Home workspace package manager
Install, list, upgrade and remove AI config packages in your home directory.
- 02
Plugins and reversible settings
Settings edits you can undo, and plugins installed only from your allowlist.
- 03
Provider-aware rendering
One package renders into each provider’s native files, the same way every time.