Exit Codes

envpkt CLI commands use exit codes to communicate credential health status.

Exit Code Table

| Code | Status | Description | | ---- | -------- | ------------------------------------------------------------------- | | 0 | Healthy | All secrets pass audit — no issues detected | | 1 | Degraded | Some secrets have warnings (expiring soon, stale, missing metadata) | | 2 | Critical | Expired or missing secrets detected |

Commands Using Exit Codes

envpkt audit

Returns health-based exit codes by default. With --strict, any non-healthy secret causes exit code 1 or 2.

envpkt exec

Inherits audit exit codes. With --strict, aborts execution on any non-healthy secret.

envpkt env check

With --strict, returns non-zero on any drift between TOML and environment.

envpkt headers

Not health-based. 0 when headers print. 1 when no secret names the server, a bound value is missing, empty or fails to decrypt, or a binding is invalid. 2 when no server is named, the config fails to load or resolve, or no age key is found at all.

envpkt fleet

Returns the worst health status across all agents in the fleet.

CI Usage

Exit codes integrate directly with CI pipeline failure detection:

# Fail pipeline on degraded or critical
envpkt audit --strict

# Fail only on critical
envpkt audit
if [ $? -eq 2 ]; then
  echo "Critical credential issues — aborting deployment"
  exit 1
fi