[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"project-105454":3},{"id":4,"name":5,"fullName":6,"owner":7,"repo":5,"description":8,"homepage":8,"htmlUrl":8,"language":9,"languages":8,"totalLinesOfCode":8,"stars":10,"forks":11,"watchers":12,"openIssues":13,"contributorsCount":14,"subscribersCount":14,"size":14,"stars1d":15,"stars7d":15,"stars30d":15,"stars90d":14,"forks30d":14,"starsTrendScore":16,"compositeScore":17,"rankGlobal":8,"rankLanguage":8,"license":8,"archived":18,"fork":18,"defaultBranch":19,"hasWiki":20,"hasPages":18,"topics":21,"createdAt":8,"pushedAt":8,"updatedAt":22,"readmeContent":23,"aiSummary":8,"trendingCount":14,"starSnapshotCount":14,"syncStatus":24,"lastSyncTime":25,"discoverSource":26},105454,"deadbolt","anomalyco\u002Fdeadbolt","anomalyco",null,"Rust",232,11,57,7,0,158,474,83.12,false,"dev",true,[],"2026-11-01 00:17:07","# deadbolt\n\nA decentralized password manager, in Rust. Your devices sync directly with each other over [iroh](https:\u002F\u002Fwww.iroh.computer); a new device joins only by pairing from one you already have. No accounts, no servers of our own.\n\nStatus: design. No code yet.\n\n## Install\n\n```sh\ncurl -fsSL https:\u002F\u002Fdeadbolt.pw\u002Finstall | sh\n```\n\n```sh\nbrew install anomalyco\u002Ftap\u002Fdeadbolt          # the CLI\nbrew install --cask anomalyco\u002Ftap\u002Fdeadbolt   # Deadbolt.app for macOS, with its CLI\n```\n\nThen run `deadbolt` from a terminal for the CLI, or `deadbolt app` (or Deadbolt from Applications, Spotlight or your launcher) for the desktop app. Bare `deadbolt` started outside a terminal opens the app too; set `DEADBOLT_NO_UI=1` in scripts that must never get a window. On Linux, `deadbolt desktop install` adds Deadbolt to the app launcher; the app's program, `deadbolt-ui`, goes beside `deadbolt` or in `\u003Cprefix>\u002Flib\u002Fdeadbolt\u002F`.\n\nOr download from [GitHub releases](https:\u002F\u002Fgithub.com\u002Fanomalyco\u002Fdeadbolt\u002Freleases) (CLI tarballs for macOS and Linux, x64 and arm64; the macOS app; the browser extension). The install script installs the current release from the Anomaly release service and verifies its SHA-256; set `DEADBOLT_CHANNEL=dev` for the latest build of `dev`, `DEADBOLT_VERSION` to pin a stable version, and `DEADBOLT_INSTALL` to change the directory (default `~\u002F.local\u002Fbin`). `deadbolt update` updates the install it runs from (Deadbolt.app or a standalone `deadbolt`) from its channel; Homebrew installs update with `brew upgrade`. Releases: [`docs\u002Freleasing.md`](docs\u002Freleasing.md).\n\n## Secrets for commands\n\nPut secrets in a command's environment or a file instead of printing them. A reference is `deadbolt:\u002F\u002F[vault\u002F]item\u002Ffield`, the item by its title or short id:\n\n```sh\ndeadbolt run --env GH_TOKEN=deadbolt:\u002F\u002Fpersonal\u002FGitHub\u002Ftoken -- gh release create v1\ndeadbolt run --env-file .env.tpl -- bun run dev       # KEY=deadbolt:\u002F\u002F… lines\ndeadbolt inject -i config.tpl -o config.json          # {{ deadbolt:\u002F\u002F… }}, written 0600\ndeadbolt read deadbolt:\u002F\u002Fpersonal\u002FGitHub\u002Fpassword     # prints one value\n```\n\n`run` conceals the values in the command's output (so the command's output is a pipe, not your terminal: `--no-mask` keeps the terminal), passes stdin and signals through and exits with the command's code. AI agents (OpenCode, Claude Code and the like) are refused until you allow them, item by item. Allowing an AI to use a value lets it learn the value (it chooses the command, and masking only stops accidents), so allow only what you would hand it. Printing a value, with `read` or `inject` to stdout, needs Touch ID every time:\n\n```sh\ndeadbolt agents allow-secrets GitHub --fields token --purpose run --expires 8h\ndeadbolt agents grants                     # deadbolt agents revoke \u003Cid>\ndeadbolt activity                          # every resolve, never a value\n```\n\n## Docs\n\n- [`docs\u002Fdesign.md`](docs\u002Fdesign.md) — **the current v1 design** (two keys, signed membership, per-device encrypted logs, QR pairing).\n- [`docs\u002Fapp.md`](docs\u002Fapp.md) — the desktop app (Rune, in `crates\u002Fapp`): plan, keyboard, motion, and the first slice.\n- [`docs\u002Fproposals\u002Fsend.md`](docs\u002Fproposals\u002Fsend.md) — Deadbolt Send: one-time links to files, secrets and vault items, served live peer to peer and opened in any browser.\n- [`docs\u002Fautofill.md`](docs\u002Fautofill.md) — browser autofill: the native messaging host, its message set, domain rules and threat model.\n- [`docs\u002Fagent-control.md`](docs\u002Fagent-control.md) — design: how AI agents may use Deadbolt (tiers, Touch ID approvals, caller identity), what is built of it: `deadbolt run`, `inject` and `read` with grants for AI agents, and standing grants for sign-ins: `deadbolt agents` pairs a browser relay such as Browse and allows it to sign AI agents in to chosen sites unattended, without the AI ever seeing a value.\n- `docs\u002Fresearch\u002F` — prior art\n  - [`01-inkandswitch.md`](docs\u002Fresearch\u002F01-inkandswitch.md) — Keyhive, BeeKEM, Beelay\u002FSubduction, Automerge\n  - [`02-rust-sync-stacks.md`](docs\u002Fresearch\u002F02-rust-sync-stacks.md) — iroh, p2panda, Willow, Loro\u002FAutomerge\u002Fyrs\n  - [`03-mailbox-pairing-keys.md`](docs\u002Fresearch\u002F03-mailbox-pairing-keys.md) — mailboxes (Nostr, S3, folders), pairing, how other password managers handle keys and recovery\n- `docs\u002Fhistory\u002F` — how we got here: the v0 proposal, the no-infrastructure (Nostr mailbox) revision, and two adversarial critiques of them. Superseded by `docs\u002Fdesign.md`; kept for the reasoning. These docs reference the research files by bare filename.\n\n## Site\n\n`site\u002F` is the website: a landing page (`\u002F`) and an animated architecture walkthrough (`\u002Farchitecture\u002F`), in the style of opentunnel.xyz (Vite, React, Motion, WebGL2 prints; fonts are Anton and IBM Plex Mono, OFL, licences in `site\u002Fpublic\u002Ffonts\u002F`). `cd site && bun install && bun run dev` serves it on http:\u002F\u002F127.0.0.1:5197. `bun run deploy` builds it and deploys `site\u002Fdist` to deadbolt.pw with Wrangler; `site\u002Fpublic\u002Finstall` is the install script served at `\u002Finstall`. `\u002Fr` is Deadbolt Send's receive page; building the site first compiles its WebAssembly (`site\u002Fscripts\u002Fwasm.sh`, which needs the `wasm32-unknown-unknown` target and `wasm-bindgen-cli`, see `docs\u002Fproposals\u002Fsend.md`). The original static mock is kept at [`site\u002Fmock.html`](site\u002Fmock.html).\n\n![deadbolt](site\u002Fscreenshots\u002Fabove-the-fold.png)\n",2,"2026-10-31 04:26:50","CREATED_QUERY"]