penv run

Run a command with your secrets loaded into it.

Usage

penv run [--env <env>] [--no-mask] [--no-preload] [--sealed] [command...]

Every command also takes the global options.

Argument	Required	What it is
`[command...]`	no	The command to run. Completed as an executable and its arguments. Takes more than one.

Flag	What it does	Environment variable
`--env <env>`	The environment to read.	`PENV_ENV`
`--no-mask`	Show secrets in the command's output instead of hiding them. Human only: an agent session cannot pass it.
`--no-preload`	Do not load penv's masking into the command's runtime (Node, Bun, Deno, Python). Human only: an agent session cannot pass it.
`--sealed`	Give keys with @hosts to the command as placeholders; penv puts the values into requests to those hosts. Always on for an AI agent.

Code	Name	What it means
`0`	`ok`	The command did what it says.
`1`	`error`	Unclassified failure. The message on stderr names the cause.
`3`	`validation`	The schema or the values did not pass.
`5`	`no_credential`	No credential is available and none can be obtained.
`6`	`environment_refused`	This identity may not read that environment.