jit

What it is

jit (github.com/jitpass/jit) is a macOS Apple-Silicon-only, still-in-development tool that pulls plaintext secrets into a Touch ID-gated local vault, leaves decoys on disk, and injects real values into one authorized process at a time. The summary covers the three injection mechanisms; what follows is the operational detail — the trust model, the install-verification constraint, and the working commands — that the summary omits.

How it works

The FIFO mechanism is the one worth understanding: the mount is a POSIX FIFO created via mkfifo(2) at mode 0600. A reader calling open(".env") blocks in the kernel until the background service opens the path O_WRONLY, writes decrypted bytes from memory into the kernel pipe buffer, closes, and loops. What gets written is decided per read — decoys for an ambient reader, real values only inside a run you authorized. Nothing touches disk; no kernel extension, filesystem driver, or FUSE.

Critically: caller identity explains and audits, it never decides. Process names are forgeable and a fast-closing FIFO reader can evade identification entirely. The human answering the biometric prompt is the actual gate — the process name only tells you what to answer.

What to do

Preferred install (sets the quarantine bit so Gatekeeper checks notarization):

brew install jitpass/tap/jitpass

Verify signing: jit doctor reports the jit line as signed CZC6BH93GJ. Core workflow:

jit scan                 # read-only; changes nothing, prints no real value
jit vault init           # master key stored in login keychain
jit migrate --dry-run    # preview the machine-wide fix plan
jit migrate              # apply: shows plan, [y/N], one Touch ID
jit run -- npm run dev   # inject real values into that process only
jit wrap gh              # once, for CLIs carrying their own login token

The tarball path is explicitly weaker — curl sets no quarantine bit, so Gatekeeper never consults the notarization ticket (same for go install). If you use it, actually run the checks:

shasum -a 256 jit
codesign -dv --verify --verbose=2 ./jit   # expect Developer ID, TeamIdentifier=CZC6BH93GJ

If switching from tarball to Homebrew, remove the old copy (sudo rm /usr/local/bin/jit) or two jits upgrade separately on PATH.

Caveats

Stated limits, up front: it does not make an already-compromised account safe, and it does not protect a secret once it is in the memory of the process that asked for it. Apple Silicon only (Intel requires build-from-source). Still in development.

flowchart TD
    R[Process opens .env FIFO] --> D{Inside an authorized jit run?}
    D -->|Yes| Real[Real decrypted value from memory]
    D -->|No, ambient reader| Decoy[Decoy bytes]
    Real --> G[Human answered Touch ID prompt = the gate]
    G -.identity only explains, never decides.-> Real