Enum Command 

pub(crate) enum Command {
    Init {
        no_keybinding: bool,
        wipe_reset_destroy_all_data: bool,
        org: Option<String>,
        ssh_key: Option<String>,
        password: bool,
        auth_policy: String,
    },
    Status,
    Unlock {
        profile: Option<String>,
    },
    Lock {
        profile: Option<String>,
    },
    Profile(ProfileCmd),
    Ssh(SshCmd),
    Secret(SecretCmd),
    Audit(AuditCmd),
    Launch(LaunchCmd),
    Wm(WmCmd),
    Clipboard(ClipboardCmd),
    Input(InputCmd),
    Snippet(SnippetCmd),
    SetupKeybinding {
        launcher_key: String,
    },
    RemoveKeybinding,
    KeybindingStatus,
    Env {
        profile: Option<String>,
        prefix: Option<String>,
        command: Vec<String>,
    },
    Export {
        profile: Option<String>,
        format: ExportFormat,
        prefix: Option<String>,
    },
    Workspace(WorkspaceCmd),
}

Variants

Init

Initialize Open Sesame: create config, start daemons, set master password.

Fields

no_keybinding: bool

Skip keybinding setup.

wipe_reset_destroy_all_data: bool

Destroy ALL Open Sesame data and reset to clean state. Requires typing “destroy all data” to confirm.

org: Option<String>

Organization domain for namespace scoping (e.g., “braincraft.io”).

ssh_key: Option<String>

Enroll an SSH key for vault unlock. Accepts a fingerprint (SHA256:…), a public key file path (~/.ssh/id_ed25519.pub), or no value to interactively select from the SSH agent. Without –password, creates an SSH-key-only vault. With –password, creates a dual-factor vault.

password: bool

Enroll a password for vault unlock. Required with –ssh-key for dual-factor init. Without –ssh-key, this is the default behavior.

auth_policy: String

Auth policy for multi-factor vaults: “any” (either factor unlocks), “all” (every factor required), or policy expression. Default: “any” for dual-factor, ignored for single-factor.

Status

Show daemon status, active profiles, and lock state.

Unlock

Unlock a vault with its password.

Fields

profile: Option<String>

Target profiles (CSV: “default,work” or “org:vault,org:vault”). Falls back to SESAME_PROFILES env var, then “default”.

Lock

Lock a vault (zeroize cached key material).

Fields

profile: Option<String>

Target profile. Omit to lock all vaults.

Profile(ProfileCmd)

Profile management.

Ssh(SshCmd)

SSH agent key management for passwordless vault unlock.

Secret(SecretCmd)

Secret management (profile-scoped).

Audit(AuditCmd)

Audit log operations.

Launch(LaunchCmd)

Application launcher.

Wm(WmCmd)

Window manager operations.

Clipboard(ClipboardCmd)

Clipboard operations.

Input(InputCmd)

Input remapper operations.

Snippet(SnippetCmd)

Snippet operations.

SetupKeybinding

Setup COSMIC keybindings for window switcher and launcher overlay.

Configures Alt+Tab (switch), Alt+Shift+Tab (switch backward), and a launcher key (default: alt+space) in COSMIC’s shortcuts.ron.

Usage: sesame setup-keybinding [KEY_COMBO]

Fields

launcher_key: String

Launcher key combo (default: “alt+space”). Examples: “super+space”, “alt+space”.

RemoveKeybinding

Remove sesame keybindings from COSMIC configuration.

KeybindingStatus

Show current sesame keybinding status in COSMIC.

Env

Run a command with profile-scoped secrets as environment variables.

Each secret key is transformed to an env var: uppercase, hyphens become underscores. Example: secret “api-key” becomes env var “API_KEY”.

Usage: sesame env -p work – aws s3 ls

Fields

profile: Option<String>

Profiles to source secrets from (CSV: “default,work” or “org:vault”). Falls back to SESAME_PROFILES env var, then “default”.

prefix: Option<String>

Prefix for env var names (e.g., –prefix MYAPP: “api-key” becomes “MYAPP_API_KEY”).

command: Vec<String>

Command and arguments to execute.

Export

Print profile secrets as shell/dotenv/json for eval or piping.

Formats: shell (default) — export KEY=“value” (eval in bash/zsh/direnv) dotenv — KEY=value (Docker, docker-compose, node) json — {“KEY”:“value”,…} (jq, CI/CD, programmatic)

Usage: eval “$(sesame export -p work)” sesame export -p work –format dotenv > .env.secrets sesame export -p work –format json | jq .

Fields

profile: Option<String>

Profiles to source secrets from (CSV: “default,work” or “org:vault”). Falls back to SESAME_PROFILES env var, then “default”.

format: ExportFormat

Output format: shell, dotenv, json.

prefix: Option<String>

Prefix for env var names (e.g., –prefix MYAPP: “api-key” becomes “MYAPP_API_KEY”).

Workspace(WorkspaceCmd)

Workspace management (directory-scoped project environments).

Trait Implementations

impl FromArgMatches for Command

fn from_arg_matches(__clap_arg_matches: &ArgMatches) -> Result<Self, Error>

Instantiate Self from [ArgMatches], parsing the arguments as needed.

fn from_arg_matches_mut( __clap_arg_matches: &mut ArgMatches, ) -> Result<Self, Error>

Instantiate Self from [ArgMatches], parsing the arguments as needed.

fn update_from_arg_matches( &mut self, __clap_arg_matches: &ArgMatches, ) -> Result<(), Error>

Assign values from ArgMatches to self.

fn update_from_arg_matches_mut<'b>( &mut self, __clap_arg_matches: &mut ArgMatches, ) -> Result<(), Error>

Assign values from ArgMatches to self.

impl Subcommand for Command

fn augment_subcommands<'b>(__clap_app: Command) -> Command

Append to [Command] so it can instantiate Self via [FromArgMatches::from_arg_matches_mut]

fn augment_subcommands_for_update<'b>(__clap_app: Command) -> Command

Append to [Command] so it can instantiate self via [FromArgMatches::update_from_arg_matches_mut]

fn has_subcommand(__clap_name: &str) -> bool

Test whether Self can parse a specific subcommand