Open Sesame

An Alt+Tab replacement, application launcher, and secret manager for Linux.

Install

`open-sesame`

Headless core: encrypted vaults, profiles, app launcher, snippets. Runs on desktops, servers, containers, VMs.

`open-sesame-desktop`

Desktop layer: window switcher, clipboard, keyboard capture. Requires COSMIC/Wayland. Depends on open-sesame.

Add the APT repository:

curl -fsSL https://scopecreep-zip.github.io/open-sesame/gpg.key | sudo gpg --dearmor -o /usr/share/keyrings/open-sesame.gpg

echo "deb [signed-by=/usr/share/keyrings/open-sesame.gpg] https://scopecreep-zip.github.io/open-sesame noble main" | sudo tee /etc/apt/sources.list.d/open-sesame.list

Desktop (full suite):

sudo apt update && sudo apt install -y open-sesame open-sesame-desktop

Headless only (servers, containers):

sudo apt update && sudo apt install -y open-sesame

Initialize:

sesame init

What You Get

Alt+Tab — Window switcher with letter hints (MRU forward/backward)
Alt+Space — Launcher overlay with fuzzy search and focus-or-launch
Encrypted vaults — Per-profile secrets with password and SSH agent unlock
Environment injection — sesame env -p work -- aws s3 ls
Clipboard history — Per-profile with sensitivity detection
Workspaces — Canonical paths, git-aware cloning, shell injection

Documentation

User Guide — Installation, configuration, keybindings, theming
API Documentation — Library reference for developers
GitHub — Source code, issues, releases

Verify Packages

All .deb packages include SLSA Build Provenance attestations:

gh attestation verify "open-sesame-linux-$(uname -m).deb" --owner ScopeCreep-zip

gh attestation verify "open-sesame-desktop-linux-$(uname -m).deb" --owner ScopeCreep-zip