seksh

What is seksh?

seksh is a fork of nushell that integrates with the SEKS Broker for secure secret management. It adds commands that let you use API keys, tokens, and credentials without ever exposing them to your shell session.

Key Features

🔐 Zero-Knowledge Secret Injection

Secrets go directly from the broker to external commands. Your shell session never sees the actual values— only secret names.

# List available secrets (names only)
> listseks
╭───┬──────────────────────────╮
│ 0 │ GITHUB_TOKEN             │
│ 1 │ OPENAI_API_KEY           │
│ 2 │ AWS_SECRET_ACCESS_KEY    │
╰───┴──────────────────────────╯

🌐 seksh-http

Make HTTP requests with secrets injected internally. The shell sees the request structure, but never the actual token values.

# Secret is injected by the broker, not visible in shell
> seksh-http GET "https://api.github.com/user" --auth GITHUB_TOKEN
{"login": "yourname", "id": 12345}

📦 seksh-git

Run git commands with credentials injected securely. Clone private repos, push commits— all without exposing tokens.

# Credentials injected at execution time
> seksh-git clone "https://github.com/org/private-repo"
Cloning into 'private-repo'...

🧹 Output Scrubbing

Defense-in-depth: if a secret accidentally appears in command output, it gets redacted before reaching your terminal. Catches raw, base64, and hex-encoded secrets.

# If a command accidentally leaks a secret:
> some-command
Token: [REDACTED]   # Was: ghp_xxxx...

How It Works

┌─────────────────────────────────────────────┐
│              Your Shell (seksh)             │
│   You see: "seksh-http --auth GITHUB_TOKEN" │
└─────────────────────────────────────────────┘
                      │
                      ▼
┌─────────────────────────────────────────────┐
│              SEKS Broker                    │
│   1. Receives request with secret NAME      │
│   2. Fetches actual secret value            │
│   3. Injects into HTTP headers              │
│   4. Makes request                          │
│   5. Scrubs response                        │
│   6. Returns safe output                    │
└─────────────────────────────────────────────┘
                      │
                      ▼
┌─────────────────────────────────────────────┐
│            External API                     │
│   Receives: Authorization: Bearer ghp_...   │
└─────────────────────────────────────────────┘

Installation

# Clone and build from source
git clone https://github.com/SEKSBot/seksh
cd seksh
git checkout seks-shell
cargo build --release

# Configure broker connection
export SEKS_BROKER_URL="https://your-broker.example.com"
export SEKS_AGENT_TOKEN="seks_agent_..."

# Run seksh
./target/release/nu

Why Not Just Use Environment Variables?

Environment variables are visible to:

• Any process you spawn
• Shell history
• Process listings (ps eww)
• Crash dumps and logs
• AI agents with shell access

With seksh, secrets stay in the broker. Your shell only knows secret names, never values.