@sente-labs/cli 0.1.1 → 0.2.1

package/dist/client.js

@@ -45,7 +45,7 @@ class GatewayClient {
             headers: {
                 Authorization: `Bearer ${this.creds.token}`,
                 'Content-Type': 'application/json',
-                'User-Agent': 'sente-cli/0.1.1',
+                'User-Agent': 'sente-cli/0.2.1',
             },
         };
         if (opts.body !== undefined) {

package/dist/commands/secret.js

@@ -0,0 +1,245 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerSecretCommands = registerSecretCommands;
+const readline = __importStar(require("readline"));
+const client_1 = require("../client");
+const output_1 = require("../output");
+/**
+ * Read a secret value securely from the user. Two paths:
+ *   - TTY interactive: prompt with input masking (no echo). User pastes value.
+ *   - Non-TTY / --value-stdin: read entire stdin until EOF, strip trailing newline.
+ *
+ * We intentionally do NOT accept a `--value <plain>` flag because it leaks the
+ * value to shell history. `--value-stdin` is the only programmatic path.
+ */
+async function readSecretValue(useStdin) {
+    if (useStdin || !process.stdin.isTTY) {
+        return readAllStdin();
+    }
+    return promptHidden('Secret value (input hidden): ');
+}
+function readAllStdin() {
+    return new Promise((resolve, reject) => {
+        let data = '';
+        process.stdin.setEncoding('utf8');
+        process.stdin.on('data', (chunk) => (data += chunk));
+        process.stdin.on('end', () => resolve(data.replace(/\n+$/, '')));
+        process.stdin.on('error', reject);
+    });
+}
+/**
+ * readline-based hidden prompt. Echoes nothing while the user types so the
+ * secret never appears on-screen or in scrollback. Falls back to plain prompt
+ * if stdin isn't a TTY (shouldn't happen since the caller already gates this).
+ */
+function promptHidden(question) {
+    return new Promise((resolve) => {
+        const rl = readline.createInterface({
+            input: process.stdin,
+            output: process.stdout,
+            terminal: true,
+        });
+        // Mute the output stream during input so keystrokes don't echo.
+        const stdoutWrite = process.stdout.write.bind(process.stdout);
+        let muted = false;
+        rl._writeToOutput = (str) => {
+            if (muted) {
+                // After we mute, only let the newline at the end pass.
+                if (str.includes('\n'))
+                    stdoutWrite('\n');
+                return;
+            }
+            stdoutWrite(str);
+        };
+        rl.question(question, (answer) => {
+            rl.close();
+            resolve(answer);
+        });
+        muted = true;
+    });
+}
+function promptText(question, fallback) {
+    return new Promise((resolve) => {
+        const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+        const suffix = fallback ? ` [${fallback}]` : '';
+        rl.question(`${question}${suffix}: `, (answer) => {
+            rl.close();
+            resolve(answer.trim() || fallback || '');
+        });
+    });
+}
+function registerSecretCommands(program, globalOpts) {
+    const secret = program.command('secret').description('Secret commands');
+    secret
+        .command('create')
+        .description('Create a new secret in the current organization')
+        .requiredOption('--name <key>', 'secret key (referenced in steps as {{secret.name}})')
+        .option('--description <text>', 'human-readable description')
+        .option('--target-url <url>', 'restrict secret to matching URLs')
+        .option('--project <id>', 'link the new secret to this project (repeatable)', collect, [])
+        .option('--value-stdin', 'read the secret value from stdin (use for piping)')
+        .action(async (cmdOpts) => {
+        const opts = globalOpts();
+        try {
+            const value = await readSecretValue(!!cmdOpts.valueStdin);
+            if (!value) {
+                throw new Error('Secret value is required.');
+            }
+            // Description is required by the gateway. Prompt for one if missing.
+            let description = cmdOpts.description;
+            if (!description) {
+                if (process.stdin.isTTY && !cmdOpts.valueStdin && !(0, output_1.isJson)(opts)) {
+                    description = await promptText('Description (visible to the agent)');
+                }
+                if (!description) {
+                    // Use the key as a fallback so the create still works in
+                    // non-interactive contexts without a separate flag.
+                    description = cmdOpts.name;
+                }
+            }
+            const client = new client_1.GatewayClient();
+            const res = await client.request('/api/secrets', {
+                method: 'POST',
+                body: {
+                    key: cmdOpts.name,
+                    description,
+                    type: 'simple',
+                    value,
+                    targetUrl: cmdOpts.targetUrl,
+                    projectIds: cmdOpts.project.length > 0 ? cmdOpts.project : undefined,
+                },
+            });
+            (0, output_1.printSuccess)({ secret: redact(res.secret) }, () => {
+                const s = res.secret;
+                process.stdout.write(`Created secret: ${s.key} (${s.id})\n`);
+                if (s.targetUrl)
+                    process.stdout.write(`Target URL: ${s.targetUrl}\n`);
+                if (cmdOpts.project.length > 0) {
+                    process.stdout.write(`Linked to ${cmdOpts.project.length} project(s).\n`);
+                }
+                process.stdout.write(`Reference in steps as: {{secret.${s.key}}}\n`);
+            }, opts);
+        }
+        catch (err) {
+            process.exit((0, output_1.printError)(err, opts));
+        }
+    });
+    secret
+        .command('list')
+        .description('List secrets visible to the current user')
+        .action(async () => {
+        const opts = globalOpts();
+        try {
+            const client = new client_1.GatewayClient();
+            const res = await client.request('/api/secrets');
+            (0, output_1.printSuccess)({ secrets: res.secrets.map(redact) }, () => {
+                if (res.secrets.length === 0) {
+                    process.stdout.write('No secrets found.\n');
+                    return;
+                }
+                for (const s of res.secrets) {
+                    const projects = s.linkedProjects?.length
+                        ? ` -> ${s.linkedProjects.map((p) => p.name).join(', ')}`
+                        : '';
+                    process.stdout.write(`${s.id}  ${s.key.padEnd(28)}  ${s.type}${projects}\n`);
+                }
+            }, opts);
+        }
+        catch (err) {
+            process.exit((0, output_1.printError)(err, opts));
+        }
+    });
+    secret
+        .command('link')
+        .description('Link a secret to a project')
+        .argument('<secretId>', 'secret id')
+        .argument('<projectId>', 'project id')
+        .action(async (secretId, projectId) => {
+        const opts = globalOpts();
+        try {
+            const client = new client_1.GatewayClient();
+            await client.request(`/api/secrets/${secretId}/link/${projectId}`, { method: 'POST' });
+            (0, output_1.printSuccess)({ ok: true, secretId, projectId }, `Linked secret ${secretId} to project ${projectId}`, opts);
+        }
+        catch (err) {
+            process.exit((0, output_1.printError)(err, opts));
+        }
+    });
+    secret
+        .command('unlink')
+        .description('Unlink a secret from a project')
+        .argument('<secretId>', 'secret id')
+        .argument('<projectId>', 'project id')
+        .action(async (secretId, projectId) => {
+        const opts = globalOpts();
+        try {
+            const client = new client_1.GatewayClient();
+            await client.request(`/api/secrets/${secretId}/link/${projectId}`, { method: 'DELETE' });
+            (0, output_1.printSuccess)({ ok: true, secretId, projectId }, `Unlinked secret ${secretId} from project ${projectId}`, opts);
+        }
+        catch (err) {
+            process.exit((0, output_1.printError)(err, opts));
+        }
+    });
+    secret
+        .command('delete')
+        .description('Delete a secret (removes it from all linked projects)')
+        .argument('<secretId>', 'secret id')
+        .action(async (secretId) => {
+        const opts = globalOpts();
+        try {
+            const client = new client_1.GatewayClient();
+            await client.request(`/api/secrets/${secretId}`, { method: 'DELETE' });
+            (0, output_1.printSuccess)({ ok: true, secretId }, `Deleted secret ${secretId}`, opts);
+        }
+        catch (err) {
+            process.exit((0, output_1.printError)(err, opts));
+        }
+    });
+}
+/**
+ * Strip anything that could contain the raw value from server responses before
+ * we print or return them. The gateway never sends values (only metadata), but
+ * defending in depth costs nothing.
+ */
+function redact(s) {
+    const { ...safe } = s;
+    return safe;
+}
+function collect(value, previous) {
+    return previous.concat([value]);
+}
+//# sourceMappingURL=secret.js.map

package/dist/commands/secret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret.js","sourceRoot":"","sources":["../../src/commands/secret.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8FA,wDAsJC;AApPD,mDAAqC;AAErC,sCAA0C;AAC1C,sCAAyE;AAwBzE;;;;;;;GAOG;AACH,KAAK,UAAU,eAAe,CAAC,QAAiB;IAC9C,IAAI,QAAQ,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACrC,OAAO,YAAY,EAAE,CAAC;IACxB,CAAC;IACD,OAAO,YAAY,CAAC,+BAA+B,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC;QACrD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QACjE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,QAAgB;IACpC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC;YAClC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QACH,gEAAgE;QAChE,MAAM,WAAW,GAAI,OAAO,CAAC,MAAM,CAAC,KAAa,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACvE,IAAI,KAAK,GAAG,KAAK,CAAC;QACjB,EAAU,CAAC,cAAc,GAAG,CAAC,GAAW,EAAE,EAAE;YAC3C,IAAI,KAAK,EAAE,CAAC;gBACV,uDAAuD;gBACvD,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAAE,WAAW,CAAC,IAAI,CAAC,CAAC;gBAC1C,OAAO;YACT,CAAC;YACD,WAAW,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC,CAAC;QACF,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE;YAC/B,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;QACH,KAAK,GAAG,IAAI,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,QAAgB,EAAE,QAAiB;IACrD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACtF,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,EAAE,CAAC,QAAQ,CAAC,GAAG,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE;YAC/C,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,QAAQ,IAAI,EAAE,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAgB,sBAAsB,CAAC,OAAgB,EAAE,UAA4B;IACnF,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC;IAExE,MAAM;SACH,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,iDAAiD,CAAC;SAC9D,cAAc,CAAC,cAAc,EAAE,qDAAqD,CAAC;SACrF,MAAM,CAAC,sBAAsB,EAAE,4BAA4B,CAAC;SAC5D,MAAM,CAAC,oBAAoB,EAAE,kCAAkC,CAAC;SAChE,MAAM,CAAC,gBAAgB,EAAE,kDAAkD,EAAE,OAAO,EAAE,EAAc,CAAC;SACrG,MAAM,CAAC,eAAe,EAAE,mDAAmD,CAAC;SAC5E,MAAM,CAAC,KAAK,EAAE,OAMd,EAAE,EAAE;QACH,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YAC1D,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;YAC/C,CAAC;YACD,qEAAqE;YACrE,IAAI,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;YACtC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,IAAA,eAAM,EAAC,IAAI,CAAC,EAAE,CAAC;oBAChE,WAAW,GAAG,MAAM,UAAU,CAAC,oCAAoC,CAAC,CAAC;gBACvE,CAAC;gBACD,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,yDAAyD;oBACzD,oDAAoD;oBACpD,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;gBAC7B,CAAC;YACH,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,sBAAa,EAAE,CAAC;YACnC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAiB,cAAc,EAAE;gBAC/D,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE;oBACJ,GAAG,EAAE,OAAO,CAAC,IAAI;oBACjB,WAAW;oBACX,IAAI,EAAE,QAAQ;oBACd,KAAK;oBACL,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;iBACrE;aACF,CAAC,CAAC;YACH,IAAA,qBAAY,EACV,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAC9B,GAAG,EAAE;gBACH,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC;gBACrB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;gBAC7D,IAAI,CAAC,CAAC,SAAS;oBAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC;gBACtE,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,OAAO,CAAC,OAAO,CAAC,MAAM,gBAAgB,CAAC,CAAC;gBAC5E,CAAC;gBACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;YACvE,CAAC,EACD,IAAI,CACL,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,MAAM;SACH,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,0CAA0C,CAAC;SACvD,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,sBAAa,EAAE,CAAC;YACnC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAe,cAAc,CAAC,CAAC;YAC/D,IAAA,qBAAY,EACV,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EACpC,GAAG,EAAE;gBACH,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;oBAC5C,OAAO;gBACT,CAAC;gBACD,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;oBAC5B,MAAM,QAAQ,GAAG,CAAC,CAAC,cAAc,EAAE,MAAM;wBACvC,CAAC,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;wBACzD,CAAC,CAAC,EAAE,CAAC;oBACP,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,QAAQ,IAAI,CAAC,CAAC;gBAC/E,CAAC;YACH,CAAC,EACD,IAAI,CACL,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,MAAM;SACH,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,4BAA4B,CAAC;SACzC,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC;SACnC,QAAQ,CAAC,aAAa,EAAE,YAAY,CAAC;SACrC,MAAM,CAAC,KAAK,EAAE,QAAgB,EAAE,SAAiB,EAAE,EAAE;QACpD,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,sBAAa,EAAE,CAAC;YACnC,MAAM,MAAM,CAAC,OAAO,CAAC,gBAAgB,QAAQ,SAAS,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YACvF,IAAA,qBAAY,EACV,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,EACjC,iBAAiB,QAAQ,eAAe,SAAS,EAAE,EACnD,IAAI,CACL,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,MAAM;SACH,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,gCAAgC,CAAC;SAC7C,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC;SACnC,QAAQ,CAAC,aAAa,EAAE,YAAY,CAAC;SACrC,MAAM,CAAC,KAAK,EAAE,QAAgB,EAAE,SAAiB,EAAE,EAAE;QACpD,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,sBAAa,EAAE,CAAC;YACnC,MAAM,MAAM,CAAC,OAAO,CAAC,gBAAgB,QAAQ,SAAS,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;YACzF,IAAA,qBAAY,EACV,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,EACjC,mBAAmB,QAAQ,iBAAiB,SAAS,EAAE,EACvD,IAAI,CACL,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,MAAM;SACH,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,uDAAuD,CAAC;SACpE,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC;SACnC,MAAM,CAAC,KAAK,EAAE,QAAgB,EAAE,EAAE;QACjC,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,sBAAa,EAAE,CAAC;YACnC,MAAM,MAAM,CAAC,OAAO,CAAC,gBAAgB,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;YACvE,IAAA,qBAAY,EAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,kBAAkB,QAAQ,EAAE,EAAE,IAAI,CAAC,CAAC;QAC3E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;;;GAIG;AACH,SAAS,MAAM,CAAC,CAAgB;IAC9B,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC;IACtB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,OAAO,CAAC,KAAa,EAAE,QAAkB;IAChD,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AAClC,CAAC"}

package/dist/index.js

@@ -7,11 +7,12 @@ const whoami_1 = require("./commands/whoami");
 const project_1 = require("./commands/project");
 const task_1 = require("./commands/task");
 const init_1 = require("./commands/init");
+const secret_1 = require("./commands/secret");
 const program = new commander_1.Command();
 program
     .name('sente')
     .description('Sente CLI -- manage QA tests from the command line and Claude Code')
-    .version('0.1.1')
+    .version('0.2.1')
     .option('--json', 'Emit machine-readable JSON instead of human output');
 /**
  * Global options aren't auto-propagated to subcommands by Commander, so we
@@ -26,6 +27,7 @@ const globalOpts = () => program.opts();
 (0, project_1.registerProjectCommands)(program, globalOpts);
 (0, project_1.registerSyncCommand)(program, globalOpts);
 (0, task_1.registerTaskCommands)(program, globalOpts);
+(0, secret_1.registerSecretCommands)(program, globalOpts);
 program.parseAsync(process.argv).catch((err) => {
     // Defensive: command actions handle their own errors. This only catches
     // setup-time errors (e.g. unknown subcommand).

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AACA,yCAAoC;AACpC,4CAAwD;AACxD,8CAA0D;AAC1D,gDAAkF;AAClF,0CAAuD;AACvD,0CAAmF;AAGnF,MAAM,OAAO,GAAG,IAAI,mBAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,OAAO,CAAC;KACb,WAAW,CAAC,oEAAoE,CAAC;KACjF,OAAO,CAAC,OAAO,CAAC;KAChB,MAAM,CAAC,QAAQ,EAAE,oDAAoD,CAAC,CAAC;AAE1E;;;;GAIG;AACH,MAAM,UAAU,GAAG,GAAe,EAAE,CAAC,OAAO,CAAC,IAAI,EAAc,CAAC;AAEhE,IAAA,4BAAoB,EAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAC1C,IAAA,8BAAqB,EAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAC3C,IAAA,0BAAmB,EAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AACzC,IAAA,kCAA2B,EAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AACjD,IAAA,iCAAuB,EAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAC7C,IAAA,6BAAmB,EAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AACzC,IAAA,2BAAoB,EAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAE1C,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IAC7C,wEAAwE;IACxE,+CAA+C;IAC/C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,GAAG,EAAE,OAAO,IAAI,GAAG,IAAI,CAAC,CAAC;IACxD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AACA,yCAAoC;AACpC,4CAAwD;AACxD,8CAA0D;AAC1D,gDAAkF;AAClF,0CAAuD;AACvD,0CAAmF;AACnF,8CAA2D;AAG3D,MAAM,OAAO,GAAG,IAAI,mBAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,OAAO,CAAC;KACb,WAAW,CAAC,oEAAoE,CAAC;KACjF,OAAO,CAAC,OAAO,CAAC;KAChB,MAAM,CAAC,QAAQ,EAAE,oDAAoD,CAAC,CAAC;AAE1E;;;;GAIG;AACH,MAAM,UAAU,GAAG,GAAe,EAAE,CAAC,OAAO,CAAC,IAAI,EAAc,CAAC;AAEhE,IAAA,4BAAoB,EAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAC1C,IAAA,8BAAqB,EAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAC3C,IAAA,0BAAmB,EAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AACzC,IAAA,kCAA2B,EAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AACjD,IAAA,iCAAuB,EAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAC7C,IAAA,6BAAmB,EAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AACzC,IAAA,2BAAoB,EAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAC1C,IAAA,+BAAsB,EAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAE5C,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IAC7C,wEAAwE;IACxE,+CAA+C;IAC/C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,GAAG,EAAE,OAAO,IAAI,GAAG,IAAI,CAAC,CAAC;IACxD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/skill/SKILL.md

@@ -80,7 +80,7 @@ The agent that runs your tests enforces this style. Steps that follow it pass mo
 
 ### Hard rules
 
-- **Secrets** use literal placeholder syntax: `{{secret.name_here}}`. Never embed values. List existing secrets with `sente secret list --json` (when available).
+- **Secrets** use literal placeholder syntax: `{{secret.name_here}}`. Never embed values. List existing secrets with `sente secret list --json`. If the secret doesn't exist, create it with `sente secret create --name <key>` (prompts for value with no echo) or pipe via `echo "$VAL" | sente secret create --name <key> --value-stdin`. Link to the current project with `--project $(jq -r .projectId .sente/config.json)`.
 - **Never invent dropdown values**, product names, or emails. If you don't know, ask the user.
 - **Combine related micro-actions into one step** (form fill + submit = one step).
 - **At most 20 steps per task.** If a flow needs more, split into multiple tasks with a precondition note in the second one's instruction.
@@ -105,12 +105,16 @@ The top-level `--instruction` is consulted by the agent when step text is ambigu
 | `sente task results <id> --failed-step --json` | Focused failure payload for diagnosis |
 | `sente task results <id> --json` | Full step-by-step results |
 | `sente sync --json` | Re-pull tasks into `.sente/tasks.json` |
+| `sente secret list --json` | List secrets (metadata only; values are never returned) |
+| `sente secret create --name <key> --project <projectId> [--target-url <url>]` | Create a secret. Hidden prompt for value, or `--value-stdin` for piping |
+| `sente secret link <secretId> <projectId>` / `unlink ...` | Link/unlink an existing secret to a project |
+| `sente secret delete <secretId>` | Delete a secret (removes from all linked projects) |
 
 Use `--json` for every CLI call — outputs are stable JSON shaped for programmatic consumption.
 
 ## Error handling
 
 - `STEP_VALIDATION_FAILED` (HTTP 400): the `errors[]` array tells you exactly what to fix. Apply the fix to the steps file and retry.
-- `UNKNOWN_SECRET`: the referenced secret doesn't exist in this organization. Ask the user to create it via the web UI, or use a different secret.
+- `UNKNOWN_SECRET`: the referenced secret doesn't exist in this organization. Either ask the user to create it (so they paste the value into a hidden prompt: `sente secret create --name <key> --project $(jq -r .projectId .sente/config.json)`), or rewrite the step to use a different existing secret. Never invent secret values yourself.
 - `INVALID_PAT`: the stored PAT is bad. Ask the user to re-run `sente login` after issuing a new token.
 - `NETWORK_ERROR`: the gateway is unreachable. Surface the host to the user.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sente-labs/cli",
-  "version": "0.1.1",
+  "version": "0.2.1",
   "description": "Sente CLI -- author and manage QA tests from your terminal and Claude Code. Tests run against your staging URL after each deploy.",
   "bin": {
     "sente": "dist/index.js"