You already solved this command once.

One entry covers every server, cluster, and client

kubectl logs -f {pod} -n {namespace} --tail={lines:number=200}

Write the variable parts as blanks and cmdvault asks for them when you copy. Seven types: text, number, choice, path, url, boolean, and secret. A choice becomes a menu, a number gets a number pad on a phone. Use the same name twice in one command and you fill it once — docker run -p {port}:{port} {image} is a two-field form.

The parser is deliberately narrow about what counts as a blank. ${PORT} is a shell variable, {{.Names}} is a Go template, and {{port}} is an escaped literal. None of them are fields, and the fill form leaves all three alone.

Secret values are never written to the vault file

PGPASSWORD={dbpass:secret} pg_restore -h {host} -d {database}

Mark a blank secret and its value builds the command and is then dropped. It is not saved to the vault, not kept in the remembered-values list, not recorded in a usage event, and never appears in an export.

Two honest limits on that. Copying still puts the finished command on your system clipboard, where other applications can read it and where some operating systems sync it between devices. And a placeholder's default value is part of the command text, so it is stored and does appear in exports whatever the placeholder is marked.

The command, and everything you knew about it

What it does  Load a .dump into an existing database
Prerequisites  Target database must exist and be empty
Example usage  the real invocation, not a synopsis
Notes  anything that bit you the first time

Every entry carries a description, prerequisites, a real example, notes, a shell, and a platform — all searchable alongside the command text. Description and example are weighted differently by the search, which is why they are separate fields rather than one long box.

A destructive marker that admits what it is

Marked destructive  Deletes named volumes too. Any database
 running in Docker loses its data.

You tick a box in the editor and write a note in your own words. From then on the note sits above the command every time you open it. There is no detector, no pattern list, and no rescan on save, so there is exactly one source for that flag: you.

Which cuts both ways, and the app says so where the marker appears. An unmarked command has not been checked and found harmless. It has not been checked at all. Nothing in cmdvault reads command text and forms an opinion about it.

Find it however you happen to remember it

k8s  →  finds everything tagged kubernetes
docekr  →  finds docker, through the fuzzy fallback
--force-with-lease  →  matched whole, not split at the dashes
Clients / Northwind  →  nested projects, still in global search

Four stages: recall by weighted token match unioned with trigram substring match, a structural filter, a fuzzy rescore, then a blended score. Recall is OR rather than AND, so "see running containers" doesn't require the word "see" to appear anywhere. When recall comes up empty the search falls back to a bounded scan and lets the fuzzy cutoff do the filtering, which is how a typo like docekr still lands.

The tokenizer keeps - _ . : / @ inside tokens, so docker-compose and node_modules survive whole. Ranking decays on a fourteen-day half-life, and it decays when read as well as when written — a score that only decays when you touch it leaves stale entries sitting at the top.

Your vault is a file, and import can't damage it

~/.cmdvault/vault.json
Import: 14 added, 5 skipped — nothing modified, nothing replaced

Import only ever adds. It cannot modify, replace, or delete a command already in your vault, and there is no flag that makes it. An incoming entry is skipped if its UUID is already present, or if its command text hashes to something already in the same project. Re-import last week's export and you get nothing new; if you edited one of those commands since, your edit stands.

Import runs in two steps. The file is summarized first — projects, tags, counts, with nothing written — and that summary becomes the filter list, so you can take a colleague's whole vault and pull in only their Kubernetes commands. Export mirrors it: project and tag checkboxes, a live "N of M commands" count, and toggles for sub-projects, ALL-versus-ANY tag matching, favorites only, and whether usage statistics travel with it.

The same vault on your phone, without a server

Share on this network  →  https://192.168.1.24:7718
Then enter this PIN  →  418 302

Flip the switch in the header and a second listener starts on your local network over TLS, using a certificate the machine generates for itself. Your phone opens the address, accepts the certificate warning once, enters the six-digit PIN, and is looking at the same vault. Ten wrong guesses locks pairing until you reset it.

Off means no listener exists, not a listener refusing connections. Turning sharing off stops it and ends every paired session, so switching it back on doesn't silently re-admit a device you disconnected. The certificate is self-signed, which defeats passive listening on the network and does not defeat someone already positioned to intercept traffic between your two devices.