AI-Native Workflow

Hush keeps secrets encrypted at rest in the current v3 repository model and gives AI assistants safe commands for the normal workflow.

Quick start

Copy this prompt into your AI assistant:

Set up Hush for this project using the current v3 repository model.
Use `hush bootstrap`, `hush config`, `hush set`, and `hush run`.
If the repo is still legacy v2, use `hush migrate --from v2` instead.
Do not teach `hush.yaml`, `hush init`, or `hush encrypt` as the current setup.

Current security model

The canonical repository state lives here:

.hush/manifest.encrypted
.hush/files/**.encrypted

• .hush/manifest.encrypted stores repository metadata, identities, bundles, targets, and imports
• .hush/files/**.encrypted stores the actual secret entries plus readers
• hush run -- <command> decrypts only for the active process or materialized target

That gives AI assistants a safe interface without relying on “just don’t read .env files” instructions.

Commands for AI agents

hush bootstrap

Create the current v3 repository shell:

hush bootstrap

hush config

Inspect and update current repository state:

hush config show
hush config active-identity
hush config show files

hush set

Add or update a secret safely:

hush set DATABASE_URL
hush set API_KEY --gui

hush inspect

Show configured secret names with masked values:

hush inspect

hush has

Check whether a key exists:

hush has DATABASE_URL -q

hush run

Run with secrets in memory:

hush run -- npm run dev
hush run --target production -- npm run build

hush doctor

Diagnose root discovery, key resolution, and store configuration. Use when bootstrap fails or key resolution is unclear:

hush doctor
hush doctor --new-repo

Legacy bridge only

If a repo still uses legacy v2 files, use the migration bridge once:

hush migrate --from v2
hush migrate --from v2 --cleanup

That is the supported path from hush.yaml repos to the current .hush/ model.

Common AI workflows

”Set up Hush in this repo”

1. Run hush bootstrap
2. Run hush config show
3. Run hush set DATABASE_URL
4. Run hush run -- npm start

”Check whether a secret exists"

hush has STRIPE_SECRET_KEY -q && echo "Ready" || echo "Missing"

"Show me the current config"

hush config show
hush config active-identity

"This repo is still legacy”

hush migrate --from v2

Project instructions for AI tools

Use project instructions like this:

# Secrets Management (Hush v3)

Current model:
- `.hush/manifest.encrypted`
- `.hush/files/**.encrypted`

Use these commands:
- `hush bootstrap`
- `hush config show`
- `hush config active-identity`
- `hush inspect`
- `hush has <KEY>`
- `hush set <KEY>`
- `hush run -- <command>`

Legacy bridge only:
- `hush migrate --from v2`
- `hush migrate --from v2 --cleanup`

Do not teach or recreate `hush.yaml`, `hush init`, or `hush encrypt` as the current repository model.

Why this matters

Hush gives AI assistants a stable, encrypted repository surface and a small set of safe commands. The assistant can help inspect state and manage changes without switching the project back to the older v2 file model.