Keep work and home identities apart

Use this when you want one Barry for work and another for home, each with its own bags, its own command, and its own secrets, while the bags and bounds both need live in one shared place. The recipe uses bonanza, the identity from Build a Barry, as the work identity and creates a second identity, home, beside it. Work packs the public Linear bag. Home packs the public Calendar bag.

Before you begin

You installed Barry, and bonanza starts a session.
You set up the vault once with sudo barry setup --system. The vault runs as its own macOS user, so a process running as you cannot read it.
You have an email address for each identity’s vault account.
You have a Linear API key, and a Google OAuth 2.0 client ID, client secret, and refresh token for Google Calendar.

Create the home identity

Create the second identity with a vault account of its own:

barry identity create home --email home@example.com

Barry writes identity.yaml into a new barry-home directory under the current directory and prints its path. It installs a home command, and it names the identity’s vault after the identity, so home reads only from the home vault.

Give bonanza a vault of its own the same way, if it lacks one:

bonanza vault provision --email work@example.com
bonanza vault assign bonanza --email work@example.com

Two identities share a vault only when you assign both to the same name, so keep the names different.

Every identity that barry identity create makes starts with inherits: base in its identity.yaml. The base identity packs the foundational bags and ships the optional bounds, such as readonly and no-secrets, so both identities get them without declaring them twice.

To share more than the base gives, create a third identity that holds the shared bags and bounds. Then set inherits: to its name in both files. A child starts from its parent’s definition: bags, traits, bounds, and secret declarations combine, and the parent’s vault never carries over, so a shared parent cannot hand one identity’s vault to the other.

Pack each identity’s bags

Install the two bags on the machine once, then pack each onto its own identity:

barry install https://github.com/perintyler/linear-bag
barry install https://github.com/perintyler/calendar-bag
bonanza pack linear

Then pack Calendar with the home identity’s command:

home pack calendar

Store each identity’s secrets

Add the Linear key to the work vault:

bonanza vault add LINEAR_API_KEY

Barry reads the value from a masked prompt, so it never lands in your shell history. Reference it from bonanza’s identity.yaml:

vault: bonanza
secrets:
  LINEAR_API_KEY:
    in: vault
    item: LINEAR_API_KEY
    field: password

Do the same for home with home vault add, once for each of GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET, and GOOGLE_REFRESH_TOKEN, and reference all three under secrets: in home’s identity.yaml. The file already names its vault, because identity create --email wrote vault: home into it.

Verify

Check each identity’s secrets:

bonanza identity check

Run home identity check for the home identity. Each report covers its own vault connection and secrets, and a missing secret shows up by name. Then run bonanza vault list and home vault list: each lists only the items in its own vault, so the Google items appear only under home.

If it fails

identity check reports a missing secret. Confirm the vault item name matches item: in identity.yaml, and that vault: names this identity’s own vault. See A secret is not loading.
vault assign asks for an email. The first assignment of a vault name needs the account email, because the email salts the vault’s key.
The home command is not found. Open a new shell, so it picks up the command that identity create installed.