Your encrypted work, at the command line.

Work with SealTask projects, tasks, comments, notes, and attachments from the terminal. The CLI keeps protected readable content in the client and gives people clear output plus a versioned JSON contract for automation.

Version 0.2.1 is installed from tagged public source. It uses your authenticated SealTask user session and a live hosted or self-hosted deployment.

Install from source Install Agent Skill

Install sealtask v0.2.1

tagged source · Git · Rust 1.94.0

git clone --branch v0.2.1 --depth 1 \  https://github.com/sealtask/sealtask-oss.gitcd sealtask-osscargo install --path cli --lockedsealtask --help

Source install verified against the immutable public v0.2.1 tag.

No signed binary, crates.io package, or package-manager install is advertised for this beta.

One client, two interfaces

Friendly at a prompt. Predictable in a pipeline.

Human-readable table and text output is the default. Automation can opt into compact JSON and an explicit no-prompt policy without changing the underlying encrypted workspace workflow.

For people

table / text

A normal terminal session

interactive user profile

sealtask auth loginsealtask listssealtask tasks list --all

Authenticate, list accessible projects, and review assigned work.

For programs

JSON contract v1

A machine-readable session

explicit no-prompt policy

sealtask --json --non-interactive infosealtask --json --non-interactive tasks list --allsealtask --json --non-interactive schema tasks create

Inspect the contract, receive compact JSON, and fail instead of prompting.

What ships today

Useful now, with clear boundaries.

The public tag covers day-to-day encrypted work without presenting the early client workspace as a stable SDK.

Client-side protection

The CLI handles the key unwrap, encryption, and decryption required for protected workspace content instead of sending readable task data to the API.

The working surface

List and archive projects, then read and write tasks, comments, notes, and task attachments from one terminal client authenticated to your SealTask account.

Human or machine output

Use table and text output interactively, or request compact JSON plus non-interactive prompt behavior for scripts and coding-agent shell sessions.

Hosted or self-hosted

Point SEALTASK_API_URL at the hosted service or your separately licensed self-hosted deployment without changing command grammar.

Security boundary

The terminal is a SealTask client.

The CLI does more than wrap REST endpoints. It performs the client-side key and ciphertext work needed to turn protected workspace records into readable local output and encrypted writes.

Read the complete security model

  1. 01 · Your device

    Readable content and keys

    OPAQUE login starts in the client; key unwrap, encryption, and decryption happen locally.

  2. 02 · In transit

    Encrypted payloads over TLS

    Protected project, task, comment, note, and attachment content syncs as ciphertext.

  3. 03 · Service

    Ciphertext plus metadata

    Account, membership, IDs, relationships, task state and timing, counts, routing fields, and ciphertext size remain visible.

Metadata can itself be sensitive. This summary is not a substitute for the field-by-field security disclosure.

Scripts and coding agents

Automation-ready output. User-session authority.

Scripts and coding agents can call sealtask through an authenticated user profile. Pair --json with --non-interactive so output and prompt policy are both explicit.

  • Compact JSON documents and structured errors
  • Machine-readable command-schema discovery
  • Named profiles for isolated local sessions
  • Documented exit codes for shell branching

Official Agent Skill

Available now

Give your coding agent the SealTask playbook.

The first-party skill teaches supported coding agents to inspect the installed CLI contract, anchor project context at your repository root, choose machine-readable output, and handle mutations and recovery deliberately.

  1. 01

    Start at the project root

    Open the canonical repository or workspace root before installing the skill or setting project context. Choose project scope in the guided installer; choose a global install only when you intentionally want the skill in every workspace.

  2. 02

    Install the first-party skill

    Run the command shown here. The skill inspects the installed CLI contract before it chooses commands, flags, or machine-readable schemas.

  3. 03

    Authenticate directly with sealtask

    Sign in, enter MFA, and unlock through the CLI—not agent chat—then ask the agent to use the skill for work within that user session.

Guided Agent Skill install

interactive · choose project scope and agent(s)

npx skills add sealtask/sealtask-oss --skill sealtask

Complete the prompts, then confirm the installation with npx skills list.

Automating installation

Name the target agent, pass --yes to npx, and pass it again to the skills CLI so neither prompt layer can block a script. This project-scoped Codex example is ready to run; substitute another documented agent ID when needed.

Install for Codex without prompts

project-scoped · deterministic example

npx --yes skills add sealtask/sealtask-oss \  --skill sealtask --agent codex --yes

Installer privacy option

The third-party skills installer records the skill name, skill files, and an install timestamp by default; its documentation says it does not collect personal or device information. This no-prompt Codex example uses the documented opt-out:

Install without installer telemetry

project-scoped · telemetry disabled

DISABLE_TELEMETRY=1 npx --yes skills add sealtask/sealtask-oss \  --skill sealtask --agent codex --yes
Read the installer’s telemetry documentation

Open-source proof

Inspect the client. Keep the scope precise.

The CLI and public client workspace are open source. SealTask’s hosted service and licensed self-hosted Docker distribution are separate products, not open-source server editions.

Tagged source

Inspect the exact v0.2.1 source used by this quickstart.

GPL-3.0-only license

Read the license that covers the CLI and public client workspace.

Security policy

Report vulnerabilities through the public security process.

Contribution flow

The repository is a read-only mirror; contributions begin as proposals.

Quickstart

Pin the source. Then sign in.

  1. 01

    Prepare Git and Rust 1.94.0

    The repository pins the toolchain used by the public tag.

  2. 02

    Clone and install v0.2.1

    The locked source build avoids implying an unpublished registry package.

  3. 03

    Authenticate and choose output

    Use normal terminal output yourself or JSON plus non-interactive mode in automation.

Build the v0.2.1 source beta

public Git tag

git clone --branch v0.2.1 --depth 1 \  https://github.com/sealtask/sealtask-oss.gitcd sealtask-osscargo install --path cli --lockedsealtask --help

The resulting binary is named sealtask.

Inspect the tag Read install FAQ

CLI FAQ

Before you build.

Is the SealTask CLI ready for production automation?

The CLI is a public beta at version 0.2.1. Its command and JSON contracts are documented and tested, but the workspace is still in active development and public APIs may change. Pin the v0.2.1 source tag and review the tagged source and public README before upgrading automation.

Do I need a SealTask account?

Yes for workspace operations. The CLI authenticates to a live hosted or self-hosted SealTask deployment and works with the projects your account can access. Help and command-schema discovery can run without reading credentials or workspace data.

Is all of SealTask open source?

No. The sealtask CLI, shared Rust client crates, and browser cryptography engine are published under GPL-3.0-only in the SealTask OSS repository. The hosted service and licensed self-hosted Docker distribution are separate products and are not presented as open-source distributions.

Where does encryption happen?

The CLI performs the client-side key handling and encryption needed to read and write protected workspace content. Readable project, task, comment, note, and attachment content is encrypted before sync. Account, membership, object relationships, task state and timing, counts, ciphertext size, and other operational metadata remain visible to the service and can be sensitive.

Can scripts and coding agents use it?

Yes, by invoking the CLI through an authenticated SealTask user profile. Use --json with --non-interactive for predictable machine output and prompt behavior. Version 0.2.1, which exposes JSON contract v1, does not provide first-class agent identities, scoped agent grants, or an MCP server.

Is the official SealTask Agent Skill available now?

Yes. Install it from your repository or workspace root, review the source, and let the skill inspect the installed CLI before it acts. The skill is an instruction package, not credentials, a SealTask permission grant, an agent identity, or an MCP server.

Can the CLI connect to a self-hosted deployment?

Yes. Set SEALTASK_API_URL to the HTTPS origin of your deployment. The self-hosted server is a separately licensed Docker distribution; the open-source CLI does not turn it into an open-source server edition.

How do I install it?

Build the current v0.2.1 beta from the tagged public source with Git and Rust 1.94.0. SealTask does not yet advertise a crates.io package, signed binary release, or package-manager installation, so the quickstart intentionally uses cargo install --path cli --locked.

Terminal, web, or iOS

One encrypted workspace. Your choice of client.

Create a free SealTask account for the workspace, then build the CLI from the public tag when the terminal is where your work happens.

Start free View the source