skarbiec vaults

Invocation#

skarbiec vaults

Purpose#

Inventory recognizable Skarbiec vault files in the product's conventional host locations without decrypting their values.

Required inputs and options#

• No positional input or command-specific option. HOME determines the conventional directories searched.

Output and state effects#

• Prints host, searched directories, vault rows containing path, owner, and non-sensitive counts, ordered by item count then path, and unreadable: every directory that could not be listed and every *.vault.json whose metadata or content could not be read, did not parse, or holds no JSON object, each with its path and cause. A dangling vault symlink retains its metadata error rather than disappearing. Only a confirmed non-file candidate is skipped. It changes no file.

Refusals#

• Refuses when HOME is unset or empty: 'HOME is not set, so the directories vaults are written to are unknown'. A missing directory is not searched and is not an error; any other failure is an unreadable row, never an omitted vault. skarbiec doctor names the same unreadable candidates beside the vault it chose.

Real fleet qualification#

Real inventory qualification: node tests/vault/inventory.mjs requires SKARBIEC, SKARBIEC_TEST_SOURCE_REVISION and SKARBIEC_TEST_VAULT_FILE from an actual encrypted vault. It binds the candidate binary and checkout revision, copies only the encrypted document into an isolated HOME under target/real-tests/vault-inventory, and checks empty/readable inventory, dangling-target metadata failure, directory-list failure, malformed content and recovery. OS error numbers come from the actual filesystem failures. Original fixture bytes stay unchanged; isolated copies are removed and report.json retains command statuses, diagnostics and source hashes.