@sente-labs/cli 0.2.0 → 0.2.1

package/dist/client.js

@@ -45,7 +45,7 @@ class GatewayClient {
             headers: {
                 Authorization: `Bearer ${this.creds.token}`,
                 'Content-Type': 'application/json',
-                'User-Agent': 'sente-cli/0.2.0',
+                'User-Agent': 'sente-cli/0.2.1',
             },
         };
         if (opts.body !== undefined) {

package/dist/index.js

@@ -12,7 +12,7 @@ const program = new commander_1.Command();
 program
     .name('sente')
     .description('Sente CLI -- manage QA tests from the command line and Claude Code')
-    .version('0.2.0')
+    .version('0.2.1')
     .option('--json', 'Emit machine-readable JSON instead of human output');
 /**
  * Global options aren't auto-propagated to subcommands by Commander, so we

package/dist/skill/SKILL.md

@@ -80,7 +80,7 @@ The agent that runs your tests enforces this style. Steps that follow it pass mo
 
 ### Hard rules
 
-- **Secrets** use literal placeholder syntax: `{{secret.name_here}}`. Never embed values. List existing secrets with `sente secret list --json` (when available).
+- **Secrets** use literal placeholder syntax: `{{secret.name_here}}`. Never embed values. List existing secrets with `sente secret list --json`. If the secret doesn't exist, create it with `sente secret create --name <key>` (prompts for value with no echo) or pipe via `echo "$VAL" | sente secret create --name <key> --value-stdin`. Link to the current project with `--project $(jq -r .projectId .sente/config.json)`.
 - **Never invent dropdown values**, product names, or emails. If you don't know, ask the user.
 - **Combine related micro-actions into one step** (form fill + submit = one step).
 - **At most 20 steps per task.** If a flow needs more, split into multiple tasks with a precondition note in the second one's instruction.
@@ -105,12 +105,16 @@ The top-level `--instruction` is consulted by the agent when step text is ambigu
 | `sente task results <id> --failed-step --json` | Focused failure payload for diagnosis |
 | `sente task results <id> --json` | Full step-by-step results |
 | `sente sync --json` | Re-pull tasks into `.sente/tasks.json` |
+| `sente secret list --json` | List secrets (metadata only; values are never returned) |
+| `sente secret create --name <key> --project <projectId> [--target-url <url>]` | Create a secret. Hidden prompt for value, or `--value-stdin` for piping |
+| `sente secret link <secretId> <projectId>` / `unlink ...` | Link/unlink an existing secret to a project |
+| `sente secret delete <secretId>` | Delete a secret (removes from all linked projects) |
 
 Use `--json` for every CLI call — outputs are stable JSON shaped for programmatic consumption.
 
 ## Error handling
 
 - `STEP_VALIDATION_FAILED` (HTTP 400): the `errors[]` array tells you exactly what to fix. Apply the fix to the steps file and retry.
-- `UNKNOWN_SECRET`: the referenced secret doesn't exist in this organization. Ask the user to create it via the web UI, or use a different secret.
+- `UNKNOWN_SECRET`: the referenced secret doesn't exist in this organization. Either ask the user to create it (so they paste the value into a hidden prompt: `sente secret create --name <key> --project $(jq -r .projectId .sente/config.json)`), or rewrite the step to use a different existing secret. Never invent secret values yourself.
 - `INVALID_PAT`: the stored PAT is bad. Ask the user to re-run `sente login` after issuing a new token.
 - `NETWORK_ERROR`: the gateway is unreachable. Surface the host to the user.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sente-labs/cli",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Sente CLI -- author and manage QA tests from your terminal and Claude Code. Tests run against your staging URL after each deploy.",
   "bin": {
     "sente": "dist/index.js"