@staff0rd/assist 0.492.0 → 0.494.0

package/README.md

@@ -182,11 +182,13 @@ Backlog item ids are written and displayed in an `a`-prefixed form (e.g. item 55
 - `assist run add` - Add a new run configuration to assist.yml and create a Claude command file
 - `assist run link <path> --prefix <prefix>` - Link run configurations from another project's assist.yml
 - `assist run remove <name>` - Remove a run configuration and delete its Claude command file
-- `assist config get <key>` - Get a config value
-- `assist config list` - List all config values
+- `assist config get <key>` - Get a config value. Secret values (`database.url`, `roam.*` tokens, `sql.connections[].password`, `seq.connections[].apiToken`) print as `<hidden>`; `--reveal` prints the raw value undecorated for command substitution. An unset key still reports `Key "<key>" is not set`
+- `assist config list` - List all config values, with secret values shown as `<hidden>` (no reveal option)
 - `assist config set <key> <value>` - Set a config value. `--global` writes to `~/.assist.yml`; `-g --repo [name]` writes a per-repo override there
 - `assist config unset <key>` - Remove a config value so the key falls back to the global value or schema default (`-g` targets `~/.assist.yml`; `-g --repo [name]` removes it from a per-repo override there)
 
+The Config tab of the sessions web dashboard never receives secret values: `GET /api/config` replaces each one with a set-or-unset marker, so a configured secret renders as `set (hidden)` and an unset one as `not set`, both keeping their project/global/default chip. Secret fields edit write-only - type a value to replace it, leave the field blank to keep whatever is stored.
+
 ### Verify and lint
 
 - `assist verify` - Run all verify:\* commands in parallel (from assist.yml run configs and package.json scripts)
@@ -366,6 +368,7 @@ Requires `assist` installed on the Windows host.
 - `sessions.topBar` — defaults to **true**: a sticky top bar inside the terminal panel carrying the session's ids, backlog chip and story name, the phase caption, elapsed time, the Continue/Auto-run/Dismiss switches and the session actions. Set it false to keep all of that on the card instead.
 - `sessions.floatWaiting` — defaults to **true**: sessions that have been `waiting` on input for longer than the threshold float above the other cards, longest waiting first. Set it false to keep the star-only ordering; starred sessions still sort above everything.
 - `sessions.floatWaitingAfterMs` — defaults to **5000**: how long a session must have been `waiting` on input before `sessions.floatWaiting` floats it.
+- `sessions.maxLive` — defaults to **24**: the ceiling on concurrent live sessions one daemon holds. Spawning past it is refused (`session ceiling of N reached`) and a daemon birth respawns at most this many persisted sessions, deferring the rest to stopped cards. The daemon serves every repo, so set it globally: `assist config set sessions.maxLive 32 -g`.
 
 ## Parallel work
 

package/allowed.cli-reads

@@ -30,6 +30,7 @@ assist backup schedule status
 assist cli-hook
 assist complexity
 assist config get
+assist config list
 assist coverage
 assist daemon status
 assist dotnet

package/dist/allowed.cli-reads

@@ -30,6 +30,7 @@ assist backup schedule status
 assist cli-hook
 assist complexity
 assist config get
+assist config list
 assist coverage
 assist daemon status
 assist dotnet