Skip to main content
vaultd is a long-running local process that holds the operator session, unwraps the profile root key in memory for zero-knowledge profiles, and injects secrets into subprocesses on demand. The daemon is the strongest trust tier in abadge. The CLI talks to the daemon over a 0600-permissioned Unix socket at ~/.abadge/vaultd.sock.

​
abadge daemon start

Start the daemon if it isn’t already running.
What happens:
  1. If a healthy daemon is already running, report that and exit successfully (idempotent).
  2. Otherwise spawn the daemon as a detached background process.
  3. Bind the socket with 0600 permissions.
  4. Write the PID file.
  5. Wait for the socket to accept a status ping before returning.
The daemon does not unlock any profile on start. Run abadge profile unlock to load a profile root key into daemon memory.

​
abadge daemon status

Print the daemon’s runtime state.
Output:
locked reflects whether a profile root key is loaded; authenticated reflects whether an operator session is held in daemon memory (authType / authExpiresAt are shown only when authenticated). If the daemon is not running, the command prints Daemon is not running. and exits non-zero.

​
abadge daemon stop

Stop the daemon and remove the socket.
What happens:
  1. Signal the daemon process to terminate (using the PID file).
  2. The daemon zeros out the in-memory operator session and any unlocked root key.
  3. Any mounted secret files are released and deleted.
  4. The PID file and socket are removed.
If the daemon was already stopped, the command reports that and exits successfully. If the daemon is wedged, fall back to kill $(cat ~/.abadge/vaultd.pid).

​
Auto-lock

The daemon tracks idle time. After 15 minutes of inactivity (the default auto-lock window; each RPC resets the timer), the in-memory root key is zeroed and abadge profile status reports locked. The operator session stays loaded.

​
File permissions