Set per-repo environment variables once for Code sessions. Adopt a .env, paste KEY=value lines with capture and redact, keep values Keychain-masked, and inject them into agent spawns and terminals. Continuum briefs the agent with CONTINUUM_MANAGED_ENV_KEYS—and refuses dangerous keys that would hijack the runtime.
Env bindings attach to a canonical repo root—not to a random shell profile. Every Code session and terminal spawned in that project gets the same injection set.
Switch repos, switch secrets. No global bleed into unrelated worktrees. Fits the same workbench as Code.
Adopt .env reads the project files you already maintain. Or paste a block of KEY=value lines—Continuum captures keys, redacts values in the UI, and stores secrets for injection.
After save, the UI shows masks, not the secret again. That’s intentional: less shoulder-surfing, less accidental screenshot leak.
Managed keys inject into agent spawns and embedded terminals for that repo. The agent also receives CONTINUUM_MANAGED_ENV_KEYS—a briefing of which names exist—so it can use secrets without you pasting them into the thread.
Values still never need to appear in the transcript. That’s the point: the host has them; the conversation shouldn’t.
Continuum refuses dangerous keys—runtime hijacks like PATH, loader overrides, and other process-control variables that shouldn’t be wholesale replaced from a project paste.
App secrets and API keys are welcome. Shell takeover is not. Full posture lives next to security: host-local storage, Keychain masks, no cloud copy of your .env.
Short answers here, long answers in the docs.
No. Secrets stay on the host that runs the agent. The phone steers the session; it doesn’t download your DATABASE_URL.
No. Managed env is host storage + Keychain, not a git write. Keep ignoring .env in the repo as you already do.
A list of key names Continuum injected for this spawn—so the agent knows which secrets exist without printing their values into the thread.
Provider authentication still goes through Continuum’s provider accounts and Keychain partitions. Managed env is for app/runtime secrets in the repo, not a back door that bypasses multi-account isolation.
Open a repo’s Env pane and adopt the .env you already trust.