@kitsy/cnos-docs 1.9.1 → 1.9.2

package/docs/cli/secret.mdx

@@ -7,8 +7,12 @@ description: Set, get, list, and delete secrets through configured vaults.
 
 ```bash
 cnos secret set app.token super-secret --vault default
+cnos secret set app.token --vault default
+printf "super-secret" | cnos secret set app.token --vault default --stdin
 cnos secret get app.token --vault default --reveal
 cnos secret list
 cnos secret list --reveal
 cnos secret delete app.token
 ```
+
+If you omit `[value]`, CNOS prompts for a masked value interactively so the secret does not have to appear in shell history. In non-interactive environments, pass the value explicitly or use `--stdin`.

package/docs/cli/vault.mdx

@@ -16,3 +16,5 @@ cnos vault remove default
 For local vaults, `cnos vault create <name>` initializes the encrypted keystore immediately. CNOS prompts for a passphrase if one is not already available through `CNOS_SECRET_PASSPHRASE_<VAULT>`, `CNOS_SECRET_PASSPHRASE`, or the OS keychain.
 
 `cnos vault auth <name>` re-authenticates an existing vault and fails on wrong credentials. Successful auth writes a derived session key under `~/.cnos/secrets/sessions`, so later CNOS commands can reuse it across shells until you run `cnos vault logout <name>` or `cnos vault logout --all`. With `--store-keychain`, CNOS also stores the derived key in the OS keychain.
+
+After local vault auth, `cnos secret set <path> --vault <name>` can prompt for a masked secret value interactively when you omit `[value]`.

package/docs/getting-started/your-first-project.mdx

@@ -31,9 +31,11 @@ Create a local vault and authenticate it:
 ```bash
 cnos vault create default
 cnos vault auth default
-cnos secret set app.token super-secret --vault default
+cnos secret set app.token --vault default
 ```
 
+CNOS prompts for the secret with masked input when you omit the value, which keeps it out of shell history. For non-interactive scripts, pass the secret over `--stdin`.
+
 If the project later becomes a monorepo, do not create a second `.cnos`. Convert the existing repo and add children:
 
 ```bash

package/docs/guides/secrets.mdx

@@ -10,11 +10,17 @@ Local vault:
 ```bash
 cnos vault create default
 cnos vault auth default
-cnos secret set app.token super-secret --vault default
+cnos secret set app.token --vault default
 ```
 
 `cnos vault create default` initializes the local encrypted vault immediately. If CNOS cannot resolve a passphrase from env or keychain, it prompts interactively. `cnos vault auth default` is only for re-authenticating an existing vault and rejects wrong passphrases.
 
+When `[value]` is omitted, `cnos secret set` prompts for a masked secret value so it does not have to appear in shell history. For non-interactive pipelines, use `--stdin` instead:
+
+```bash
+printf "super-secret" | cnos secret set app.token --vault default --stdin
+```
+
 Environment-backed vault:
 
 ```bash

package/manifest.yml

@@ -1,7 +1,7 @@
 product: cnos
 title: CNOS Documentation
 tagline: Configuration orchestration for apps, monorepos, and deployment pipelines
-version: "1.8.4"
+version: "1.9.2"
 
 sidebar:
   - group: Getting Started

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kitsy/cnos-docs",
-  "version": "1.9.1",
+  "version": "1.9.2",
   "description": "Source-of-truth CNOS documentation content for Astro Starlight and other static docs consumers.",
   "type": "module",
   "exports": {