@tangle-network/sandbox-cli 0.21.65 → 0.21.67

package/README.md

@@ -133,7 +133,7 @@ Credential lookup precedence:
 1. `--api-key` flag
 2. `TANGLE_API_KEY_FILE` managed credential file
 3. `TANGLE_API_KEY` environment variable
-4. `~/.tangle/credentials` (populated by `tangle auth login`)
+4. `~/.tangle/credentials.json` (populated by `tangle auth login`)
 
 The sidecar publishes refreshed delegated credentials through `TANGLE_API_KEY_FILE`.
 The CLI reads this file for each request, including requests from an existing client.

package/SKILL.md

@@ -257,17 +257,22 @@ tangle hub github-app mint-installation-token --repo-url https://github.com/owne
 
 ## Secrets
 
-Secrets are scoped to your account (or team). Use `--reveal` to see values.
+Secrets are scoped to your account (or team). Values never round-trip: `create`, `list`, `delete` only. At create time a bare `--secret NAME` is box delivery; proxy custody is `--proxy-secret`.
 
 ```bash
 tangle secret create DATABASE_URL "postgres://..."
 tangle secret create API_KEY    # prompts interactively
 tangle secret list
-tangle secret show DATABASE_URL --reveal
-tangle secret update DATABASE_URL "new-value"
 tangle secret delete DATABASE_URL
 ```
 
+Canonical proxy custody at create time — the value never enters the box:
+
+```bash
+tangle sandbox create --proxy-secret '{"envName":"PROVIDER_KEY","secretRef":{"kind":"secret-ref","key":"PROVIDER_KEY"},"presentation":{"type":"bearer"},"hosts":["api.example.org"]}'
+tangle sandbox create --proxy-secret @bindings.json   # repeatable; array or single binding
+```
+
 ## Snapshots
 
 ```bash
@@ -431,7 +436,6 @@ tangle preview rm <id> <preview-id>
 
 ## Common Mistakes
 
-- **Forgetting `--reveal` on `secret show`:** values are hidden by default for safety.
 - **Using API-key env and `TANGLE_HUB_CAPABILITY_TOKEN` together for hub:** set exactly one env auth source, or use `--api-key` to override both.
 - **Calling hub tools without `--approve` on first use:** use `--approve` or set policy to `allow` first.
 - **Missing `--json` when piping output:** many commands need explicit `--json` for machine-readable output.