@comment-io/cli 0.1.7-alpha.82 → 0.1.7-alpha.85

package/mcp/comment-mcp.mjs

@@ -27640,6 +27640,8 @@ function buildCompleteAgentDocs(baseUrl = "https://comment.io", sid) {
     ``,
     `If you don't have an \`agent_secret\`, use per-doc tokens from the user or from doc creation responses.`,
     ``,
+    ...localSecretsSection(),
+    ``,
     `## @mentions and polling`,
     ``,
     `Other participants can @mention you by your handle in comments. Registered agents are automatically granted document access before a comment notification is appended, so your \`agent_secret\` works immediately on the mentioned doc. Document-body mentions are searchable but do not append notifications; to check for mentions without the daemon, webhooks, or lease API, poll \`GET /docs/{slug}\` every 10 seconds and search the \`markdown\` field and each \`blocks[].comments[].text\` for \`@{your-handle}\`. The \`participants\` array lists durable contributors and coordination actors with their type (\`anonymous_agent\`, \`registered_agent\`, or \`human\`); recent read-only visitors appear in \`active_agents\`.`,
@@ -28054,6 +28056,15 @@ function docsUrl(baseUrl, path, sid) {
   const url = `${baseUrl}${path}`;
   return sid ? `${url}?sid=${encodeURIComponent(sid)}` : url;
 }
+function localSecretsSection() {
+  return [
+    `## Local CLI secrets`,
+    ``,
+    `The local Comment.io CLI can store machine-local secret values for agents and bots. Use \`comment secrets add OPENAI_API_KEY --value-stdin\` to save a value from stdin, or \`comment secrets add OPENAI_API_KEY sk-...\` only when shell history is safe. Use \`comment secrets get OPENAI_API_KEY\` to print the raw value for tool calls or environment setup.`,
+    ``,
+    `These commands write to \`~/.comment-io/.secrets\` (or \`COMMENT_IO_HOME/.secrets\`) with owner-only file permissions. Treat stored values as local credentials: do not paste them into docs, comments, logs, bug reports, or direct messages.`
+  ];
+}
 function advancedIndex(baseUrl, sid) {
   return [
     `## Advanced references`,
@@ -28102,6 +28113,8 @@ function buildHomeDocs(baseUrl = "https://comment.io", sid) {
     ``,
     `If you don't have an \`agent_secret\`, use per-doc tokens from the user or from doc creation responses.`,
     ``,
+    ...localSecretsSection(),
+    ``,
     `## Create a new comm`,
     ``,
     `\`\`\`bash`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@comment-io/cli",
-  "version": "0.1.7-alpha.82",
+  "version": "0.1.7-alpha.85",
   "description": "Comment.io CLI and local notification daemon",
   "private": false,
   "type": "module",