ww is a Doppler‑like secret manager built on ScyllaDB. It runs a background daemon that talks to Scylla and exposes project secrets over a local Unix socket. The companion CLI can inject environment variables into commands, download them in multiple formats, or update individual keys.

• 🔑 Store project secrets in ScyllaDB (map<text,text> column)
• 📡 Local daemon with Unix socket protocol
• 🛠 CLI with familiar commands: run, secrets, set-env, client
• 🌐 Path‑to‑project bindings (~/.config/ww/config.toml)
• 📄 Export secrets as .env, JSON, or YAML
• 🔒 Socket permissions default to 0600

ww serve --node 127.0.0.1:9042 --user cassandra --pass cassandra

cd /path/to/repo
ww client setup my_project

ww set-env --name API_KEY --val abc123

ww node app.js

USAGE:
    ww <COMMAND>

COMMANDS:
    serve       Start the daemon server
    run         Run a command with env vars injected
    secrets     Download or read secrets
    set-env     Upsert a single secret
    client      Manage global client config

• Show current project resolution:

  ww client which

• Download secrets to .env file:

  ww secrets download --format env --output .env

• Fetch a single secret:

  ww secrets get --name API_KEY --plain

• Run any command, injecting resolved project secrets:

  ww npm run dev

Location: ~/.config/ww/config.toml

default_project = "demo_project"

[[paths]]
dir = "/abs/path/to/repo"
project = "my_project"

Resolution order:

1. --project flag (explicit)
2. WW_PROJECT environment variable
3. Path binding from config
4. default_project

The daemon speaks a simple line protocol over a Unix socket:

• QUERY_PROJECTS:<project>\n → KEY=VALUE\n...
• ENSURE_PROJECT:<project>\n → OK\n or ERROR:...
• SET_ENV:<project>:<key>=<value>\n → OK\n or ERROR:...

Socket path defaults to /tmp/ww.sock.

• Socket is 0600 (owner read/write only)
• Assumes local single‑user trust; no encryption/auth on socket
• Use --plain only when piping into secure sinks

cargo build --release

cargo test

cargo install --path .

Licensed under MIT.