minitest-cli 0.38.2__tar.gz → 0.40.0__tar.gz

{minitest_cli-0.38.2 → minitest_cli-0.40.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: minitest-cli
-Version: 0.38.2
+Version: 0.40.0
 Summary: Minitest CLI – command-line interface for the Minitest testing platform
 Project-URL: Homepage, https://minitap.ai/
 Project-URL: Source, https://github.com/minitap-ai/minitest-cli
@@ -215,6 +215,7 @@ app defaults.
 | `minitest test-profile` | Test profiles (Test accounts in the webapp) |
 | `minitest tags`  | List, create, update and delete scenario tags |
 | `minitest app-skill` | App skills (Skills in the webapp): procedures Mini loads to arrange test state |
+| `minitest secret` | App secrets vault: passwords, OTP seeds, cards, API tokens referenced as `{{secret:NAME}}` (write-only values) |
 | `minitest screens` | Inspect the screens exploration mapped for an app |
 | `minitest build` | Native iOS/Android build management |
 | `minitest run`   | Start runs and inspect their scenario runs |
@@ -239,6 +240,32 @@ stderr and leave `--json` stdout unchanged. Switch to the new names.
 | `run cancel --srp`, `run recording --srp` | `--target-id` |
 | `--type` on `scenario create/update/list` | `--tag` |
 
+## Secrets
+
+Credentials live in the app's vault, never in scenario text. Write
+`{{secret:NAME}}` (card fields: `{{secret:NAME.number}}`, `.expiry`, `.cvc`,
+`.holder_name`, `.postal_code`) where Mini must type one; `$NAME` still works
+but `secret lint` warns. Values are write-only: no command prints one back.
+Workspaces without the feature get `Secrets are not enabled for this workspace yet` (exit 4).
+
+```bash
+printf '%s' "$ADMIN_PW" | minitest secret set ADMIN_PASSWORD --kind password --note "Admin login"
+echo '{"number":"4242424242424242","expiry":"12/34","cvc":"123"}' \
+  | minitest secret set STRIPE_CARD --kind card          # optional holder_name, postal_code
+minitest secret list [--missing]                         # names, kinds, usages, requests
+minitest secret describe ADMIN_PASSWORD                  # usages + reference to copy
+minitest secret lint --scenario <id>                     # exit 1 on leaks or missing secrets
+minitest secret extract <id> --as ADMIN_PASSWORD --kind password [--dry-run]
+minitest test-profile update <id> --password-secret ADMIN_PASSWORD
+```
+
+`set` reads stdin only and refuses a terminal (`--interactive` opens a hidden
+prompt). Inside a test run (`MINITAP_SECRETS_SOCKET` or `STORY_RUN_ID` set) it
+refuses: use `minitest secret request NAME --kind <kind> --reason "…"` instead.
+`extract` reads the leaked literal from the scenario on your machine, creates
+the secret with it, then rewrites every occurrence to `{{secret:NAME}}`. Older
+scenario versions and past run logs may still hold the literal: rotate it.
+
 ## App network settings
 
 Two per-app settings decide how test devices reach the network. Anyone on the

{minitest_cli-0.38.2 → minitest_cli-0.40.0}/README.md

@@ -182,6 +182,7 @@ app defaults.
 | `minitest test-profile` | Test profiles (Test accounts in the webapp) |
 | `minitest tags`  | List, create, update and delete scenario tags |
 | `minitest app-skill` | App skills (Skills in the webapp): procedures Mini loads to arrange test state |
+| `minitest secret` | App secrets vault: passwords, OTP seeds, cards, API tokens referenced as `{{secret:NAME}}` (write-only values) |
 | `minitest screens` | Inspect the screens exploration mapped for an app |
 | `minitest build` | Native iOS/Android build management |
 | `minitest run`   | Start runs and inspect their scenario runs |
@@ -206,6 +207,32 @@ stderr and leave `--json` stdout unchanged. Switch to the new names.
 | `run cancel --srp`, `run recording --srp` | `--target-id` |
 | `--type` on `scenario create/update/list` | `--tag` |
 
+## Secrets
+
+Credentials live in the app's vault, never in scenario text. Write
+`{{secret:NAME}}` (card fields: `{{secret:NAME.number}}`, `.expiry`, `.cvc`,
+`.holder_name`, `.postal_code`) where Mini must type one; `$NAME` still works
+but `secret lint` warns. Values are write-only: no command prints one back.
+Workspaces without the feature get `Secrets are not enabled for this workspace yet` (exit 4).
+
+```bash
+printf '%s' "$ADMIN_PW" | minitest secret set ADMIN_PASSWORD --kind password --note "Admin login"
+echo '{"number":"4242424242424242","expiry":"12/34","cvc":"123"}' \
+  | minitest secret set STRIPE_CARD --kind card          # optional holder_name, postal_code
+minitest secret list [--missing]                         # names, kinds, usages, requests
+minitest secret describe ADMIN_PASSWORD                  # usages + reference to copy
+minitest secret lint --scenario <id>                     # exit 1 on leaks or missing secrets
+minitest secret extract <id> --as ADMIN_PASSWORD --kind password [--dry-run]
+minitest test-profile update <id> --password-secret ADMIN_PASSWORD
+```
+
+`set` reads stdin only and refuses a terminal (`--interactive` opens a hidden
+prompt). Inside a test run (`MINITAP_SECRETS_SOCKET` or `STORY_RUN_ID` set) it
+refuses: use `minitest secret request NAME --kind <kind> --reason "…"` instead.
+`extract` reads the leaked literal from the scenario on your machine, creates
+the secret with it, then rewrites every occurrence to `{{secret:NAME}}`. Older
+scenario versions and past run logs may still hold the literal: rotate it.
+
 ## App network settings
 
 Two per-app settings decide how test devices reach the network. Anyone on the

{minitest_cli-0.38.2 → minitest_cli-0.40.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "minitest-cli"
-version = "0.38.2"
+version = "0.40.0"
 description = "Minitest CLI – command-line interface for the Minitest testing platform"
 readme = "README.md"
 license = "MIT"

{minitest_cli-0.38.2 → minitest_cli-0.40.0}/src/minitest_cli/commands/app_skill_write.py

@@ -95,7 +95,8 @@ def register(app: typer.Typer) -> None:
         instructions: Instructions = None,
         instructions_file: InstructionsFile = None,
     ) -> None:
-        """Create a skill. Reference secrets as $NAME and set them with `secret set`."""
+        """Create a skill. Reference secrets as $NAME (or {{secret:NAME}} once Secrets are enabled:
+        see `minitest secret`) and set them with `secret set`."""
         settings, json_mode, app_id = command_context()
         body = _patch(description, platforms, False, instructions, instructions_file)
         if "description" not in body or "instructions" not in body:

{minitest_cli-0.38.2 → minitest_cli-0.40.0}/src/minitest_cli/commands/run.py

@@ -32,6 +32,7 @@ from minitest_cli.commands.run_targets import (
 )
 from minitest_cli.commands.run_feedback import feedback
 from minitest_cli.commands.run_list import list_runs
+from minitest_cli.commands.run_logs import register_logs_command
 from minitest_cli.commands.run_recording import register_recording_commands
 from minitest_cli.commands.run_tagged import print_batch_started, start_tagged
 from minitest_cli.commands.verdicts import verdicts
@@ -173,3 +174,4 @@ app.command(name="from-commit")(from_commit)
 app.command(name="verdicts")(verdicts)
 app.command(name="feedback")(feedback)
 register_recording_commands(app)
+register_logs_command(app)

minitest_cli-0.40.0/src/minitest_cli/commands/run_logs.py

@@ -0,0 +1,127 @@
+"""`minitest run logs`: download the log files a scenario run's target captured."""
+
+import gzip
+import shutil
+from pathlib import Path
+from typing import Annotated
+
+import typer
+
+from minitest_cli.api.client import ApiClient
+from minitest_cli.commands.run_helpers import (
+    EXIT_NOT_FOUND,
+    base_path,
+    ensure_uuid,
+    handle_response_error,
+    resolve_app,
+    run_api_call,
+)
+from minitest_cli.commands.run_recording_helpers import download, select_platform_run
+from minitest_cli.models.lane_logs import LaneLogFile, LaneLogs
+from minitest_cli.models.story_run import PlatformRun, StoryRunResponse
+from minitest_cli.utils.output import print_error, print_info, print_json, print_table
+
+_FILE_LABELS = {
+    "device_log": "Device log",
+    "crash_report": "Crash report",
+    "browser_console": "Browser console",
+    "network_har": "Network (HAR)",
+}
+
+
+def logs(
+    run_id: Annotated[str, typer.Argument(help="Scenario-run ID.")],
+    platform: Annotated[str | None, typer.Option(help="Target platform (ios/android/web).")] = None,
+    target_id: Annotated[
+        str | None, typer.Option("--target-id", help="Exact target (srpId) when ambiguous.")
+    ] = None,
+    out: Annotated[Path | None, typer.Option(help="Output directory.")] = None,
+) -> None:
+    """Download a run's log files: device log, crash report, browser console, network (HAR).
+
+    Files are written decompressed. Crashes found in the device log are listed with
+    their time on the recording.
+    """
+    settings, app_id, json_mode = resolve_app()
+    ensure_uuid(run_id, kind="run id")
+
+    async def _fetch() -> tuple[PlatformRun, LaneLogs]:
+        async with ApiClient(settings) as client:
+            resp = await client.get(f"{base_path(app_id)}/{run_id}")
+            handle_response_error(resp, resource="Run")
+            target = select_platform_run(
+                StoryRunResponse.model_validate(resp.json()), platform, target_id
+            )
+            resp = await client.get(
+                f"{base_path(app_id)}/{run_id}/lane-logs", params={"srp_id": target.srp_id}
+            )
+            if resp.status_code == 404:
+                print_error("No logs for this run: logs aren't enabled for your workspace.")
+                raise typer.Exit(code=EXIT_NOT_FOUND)
+            handle_response_error(resp, resource="Run")
+            return target, LaneLogs.model_validate(resp.json())
+
+    target, lane_logs = run_api_call(_fetch())
+    _exit_without_files(lane_logs, target)
+    out_dir = out or Path("minitest-logs") / f"{run_id}-{target.platform}"
+    written = [(file, run_api_call(_save(file, out_dir))) for file in lane_logs.files]
+
+    if json_mode:
+        print_json(
+            {
+                "files": [
+                    {"kind": f.kind, "path": str(path), "bytes": path.stat().st_size}
+                    for f, path in written
+                ],
+                "crashes": [c.model_dump(by_alias=True) for c in lane_logs.crashes],
+            }
+        )
+        return
+    rows = [[_FILE_LABELS.get(f.kind, f.kind), _size(path), str(path)] for f, path in written]
+    print_table(["File", "Size", "Path"], rows, title=str(out_dir))
+    for crash in lane_logs.crashes:
+        print_info(f"App crash {_clock(crash.offset_ms)} into the run: {crash.summary}")
+
+
+def _exit_without_files(lane_logs: LaneLogs, target: PlatformRun) -> None:
+    if lane_logs.files:
+        return
+    if lane_logs.status == "pending":
+        print_error(f"The {target.platform} target is still running; logs arrive when it ends.")
+        raise typer.Exit(code=1)
+    if lane_logs.unavailable_reason == "browser_unsupported":
+        print_error("No logs for this browser: only Chrome and Edge record the console and HAR.")
+    elif target.platform == "ios":
+        print_error("No logs were captured for the ios target (physical iPhones aren't captured).")
+    else:
+        print_error(f"No logs were captured for the {target.platform} target.")
+    raise typer.Exit(code=EXIT_NOT_FOUND)
+
+
+async def _save(file: LaneLogFile, out_dir: Path) -> Path:
+    dest = out_dir / file.file_name
+    if not file.compressed:
+        await download(file.url, dest)
+        return dest
+    packed = dest.with_name(f"{dest.name}.gz")
+    await download(file.url, packed)
+    with gzip.open(packed, "rb") as source, dest.open("wb") as target:
+        shutil.copyfileobj(source, target)
+    packed.unlink()
+    return dest
+
+
+def _size(path: Path) -> str:
+    size = path.stat().st_size
+    if size >= 1024**2:
+        return f"{size / 1024**2:.1f} MB"
+    return f"{size / 1024:.0f} KB" if size >= 1024 else f"{size} B"
+
+
+def _clock(offset_ms: int) -> str:
+    minutes, seconds = divmod(offset_ms / 1000, 60)
+    return f"{int(minutes)}:{seconds:04.1f}"
+
+
+def register_logs_command(app: typer.Typer) -> None:
+    app.command(name="logs")(logs)

minitest_cli-0.40.0/src/minitest_cli/commands/secret.py

@@ -0,0 +1,168 @@
+"""``minitest secret``: the app's Secrets vault. Values are write-only and never printed."""
+
+from typing import Annotated, Any
+
+import typer
+
+from minitest_cli.commands import secret_extract, secret_lint, secret_manage
+from minitest_cli.commands.secret_helpers import (
+    CARD_FIELDS,
+    EXIT_NOT_FOUND,
+    JsonOption,
+    KindOption,
+    call,
+    command_context,
+    format_usage,
+    reference,
+    refuse_agent_context,
+    secrets_path,
+    validate_name,
+)
+from minitest_cli.commands.secret_value import read_secret_body
+from minitest_cli.utils.output import (
+    print_error,
+    print_info,
+    print_json,
+    print_success,
+    print_table,
+)
+
+app = typer.Typer(
+    name="secret",
+    help=(
+        "Manage the app's secrets (passwords, OTP seeds, cards, API tokens). Reference them in "
+        "scenarios and skills as {{secret:NAME}} (card fields: {{secret:NAME.number}}); the "
+        "legacy $NAME still works but lint warns. Values are write-only and never printed."
+    ),
+    no_args_is_help=True,
+)
+
+NameArg = Annotated[str, typer.Argument(help="UPPER_SNAKE secret name, e.g. ADMIN_PASSWORD.")]
+
+
+def fetch_vault(settings: Any, app_id: str) -> dict[str, Any]:
+    return call(settings, "GET", secrets_path(app_id), collection=True) or {}
+
+
+def _request_rows(requests: list[dict[str, Any]]) -> list[list[str]]:
+    return [
+        [
+            r.get("name", ""),
+            r.get("kind", ""),
+            r.get("storyName") or r.get("storyId") or "",
+            r.get("requestedBy", ""),
+            r.get("reason", ""),
+        ]
+        for r in requests
+    ]
+
+
+@app.command(name="list")
+def list_secrets(
+    missing: Annotated[
+        bool, typer.Option("--missing", help="Only show requested secrets that do not exist yet.")
+    ] = False,
+    json_flag: JsonOption = False,
+) -> None:
+    """List secrets (name, kind, note, version, usages) and open secret requests."""
+    settings, json_mode, app_id = command_context(json_flag)
+    vault = fetch_vault(settings, app_id)
+    secrets: list[dict[str, Any]] = vault.get("secrets") or []
+    requests: list[dict[str, Any]] = vault.get("requests") or []
+    if json_mode:
+        print_json(
+            {"requests": requests} if missing else {"secrets": secrets, "requests": requests}
+        )
+        return
+    if not missing:
+        if secrets:
+            rows = [
+                [
+                    s.get("name", ""),
+                    s.get("kind", ""),
+                    str(s.get("version", "")),
+                    str(len(s.get("usages") or [])),
+                    s.get("note") or "",
+                ]
+                for s in secrets
+            ]
+            print_table(["Name", "Kind", "Version", "Usages", "Note"], rows, title="Secrets")
+        else:
+            print_info("No secrets yet. Add one with: minitest secret set NAME --kind <kind>")
+    if requests:
+        headers = ["Name", "Kind", "Scenario", "Requested By", "Reason"]
+        print_table(headers, _request_rows(requests), title="Requested (missing) secrets")
+    elif missing:
+        print_info("No missing secrets.")
+
+
+@app.command(name="describe")
+def describe_secret(name: NameArg, json_flag: JsonOption = False) -> None:
+    """Show a secret's kind, note, usages and the reference to copy (never its value)."""
+    settings, json_mode, app_id = command_context(json_flag)
+    vault = fetch_vault(settings, app_id)
+    found = next((s for s in vault.get("secrets") or [] if s.get("name") == name), None)
+    requests = [r for r in vault.get("requests") or [] if r.get("name") == name]
+    if found is None and not requests:
+        print_error(f"No secret named {name}.")
+        raise typer.Exit(code=EXIT_NOT_FOUND)
+    fields = list(CARD_FIELDS) if found and found.get("kind") == "card" else []
+    refs = [reference(name, f) for f in fields] or [reference(name)]
+    if json_mode:
+        print_json({"secret": found, "references": refs, "requests": requests})
+        return
+    if found is None:
+        print(f"{name}: requested, not set yet")  # noqa: T201
+        print_table(["Name", "Kind", "Scenario", "Requested By", "Reason"], _request_rows(requests))
+        print_info(f"Set it with: minitest secret set {name} --kind {requests[0].get('kind')}")
+        return
+    for label, value in (
+        ("Name", name),
+        ("Kind", found.get("kind")),
+        ("Note", found.get("note") or "-"),
+        ("Version", found.get("version")),
+        ("Updated", f"{found.get('updatedAt', '-')} by {found.get('updatedBy') or '-'}"),
+        ("Reference", ", ".join(refs)),
+    ):
+        print(f"{label}: {value}")  # noqa: T201
+    usages = found.get("usages") or []
+    print(f"Usages: {len(usages)}")  # noqa: T201
+    for usage in usages:
+        print(f"  - {format_usage(usage)}")  # noqa: T201
+
+
+@app.command(name="set")
+def set_secret(
+    name: NameArg,
+    kind: KindOption,
+    note: Annotated[str | None, typer.Option("--note", help="What this secret is for.")] = None,
+    interactive: Annotated[bool, typer.Option("--interactive", hidden=True)] = False,
+    json_flag: JsonOption = False,
+) -> None:
+    """Create or replace a secret. The value is read from stdin only.
+
+    password/totp/token/text: the raw value, e.g. ``printf '%s' "$V" | minitest secret set X
+    --kind token``. card: a JSON object, e.g. ``echo '{"number":"4242…","expiry":"12/34",
+    "cvc":"123"}' | minitest secret set CARD --kind card`` (optional holder_name, postal_code).
+    """
+    refuse_agent_context()
+    validate_name(name)
+    settings, json_mode, app_id = command_context(json_flag)
+    body: dict[str, Any] = {
+        "kind": kind.value,
+        **read_secret_body(name, kind, interactive=interactive),
+    }
+    if note is not None:
+        body["note"] = note
+    saved = call(settings, "PUT", f"{secrets_path(app_id)}/{name}", json=body) or {}
+    if json_mode:
+        print_json(saved)
+        return
+    print_success(
+        f"Secret {name} saved (v{saved.get('version', '?')}). Reference: {reference(name)}"
+    )
+
+
+secret_manage.register(app)
+secret_lint.register(app)
+secret_extract.register(app)

minitest_cli-0.40.0/src/minitest_cli/commands/secret_extract.py

@@ -0,0 +1,149 @@
+"""``secret extract``: move a literal credential out of a scenario into the vault.
+
+The server never reads a value out of a scenario, so the CLI does it: it fetches the
+scenario (which the caller can already read), lints it, takes the leaked literal locally,
+creates the secret with it, then PATCHes the scenario with every occurrence replaced by
+``{{secret:NAME}}``. The literal is never printed, only its position and length.
+"""
+
+import re
+from typing import Annotated, Any, NoReturn
+
+import typer
+
+from minitest_cli.api.client import ApiClient
+from minitest_cli.commands.secret_helpers import (
+    JsonOption,
+    SecretKind,
+    command_context,
+    reference,
+    refuse_agent_context,
+    request,
+    secrets_path,
+    validate_name,
+)
+from minitest_cli.commands.secret_lint import fetch_story, lint_text, position, story_sources
+from minitest_cli.commands.user_story_criteria import extract_criteria_items
+from minitest_cli.commands.user_story_helpers import base_path, handle_response_error, run_api_call
+from minitest_cli.utils.output import err_console, print_error, print_json, print_success
+from minitest_cli.utils.output import print_info, print_warning
+
+_LABELLED = re.compile(
+    r"^\s*(?:password|passwd|pwd|pass|passcode|pin|otp|code|token|secret|api[ _-]?key)"
+    r"(?:\s*[:=]\s*|\s+is\s+|\s+)(?P<value>\S.*?)\s*$",
+    re.IGNORECASE | re.DOTALL,
+)
+MIN_LITERAL_LENGTH = 4
+
+
+def literal_of(text: str, leak: dict[str, Any]) -> str:
+    """The leaked literal; a ``password: xxx`` heuristic span keeps only the value."""
+    raw = text[int(leak["start"]) : int(leak["end"])].strip().strip("\"'`")
+    match = _LABELLED.match(raw)
+    return match.group("value").strip("\"'`") if match else raw
+
+
+def _fail(message: str) -> NoReturn:
+    print_error(message)
+    raise typer.Exit(code=1)
+
+
+def _candidates(results: list[tuple[str, str, dict[str, Any]]]) -> list[tuple[str, str, str]]:
+    seen: dict[str, tuple[str, str, str]] = {}
+    for label, text, result in results:
+        for leak in result.get("leaks") or []:
+            literal = literal_of(text, leak) if not leak.get("secret") else ""
+            if len(literal) >= MIN_LITERAL_LENGTH and literal not in seen:
+                seen[literal] = (label, position(text, int(leak["start"])), literal)
+    return list(seen.values())
+
+
+def _patch_body(story: dict[str, Any], literal: str, ref: str) -> tuple[dict[str, Any], int]:
+    body: dict[str, Any] = {}
+    count = (story.get("description") or "").count(literal)
+    if count:
+        body["description"] = story["description"].replace(literal, ref)
+    items = extract_criteria_items(story)
+    hits = sum(item["content"].count(literal) for item in items)
+    if hits:
+        body["acceptanceCriteria"] = [
+            {**item, "content": item["content"].replace(literal, ref)} for item in items
+        ]
+    return body, count + hits
+
+
+def register(app: typer.Typer) -> None:
+
+    @app.command(name="extract")
+    def extract(
+        scenario_id: Annotated[str, typer.Argument(help="Scenario ID holding the literal.")],
+        name: Annotated[str, typer.Option("--as", help="Name of the secret to create.")],
+        kind: Annotated[SecretKind, typer.Option("--kind", help="password, totp, token or text.")],
+        note: Annotated[str | None, typer.Option("--note", help="What it is for.")] = None,
+        leak: Annotated[
+            int | None, typer.Option("--leak", help="Which leak to extract (1-based), if several.")
+        ] = None,
+        dry_run: Annotated[bool, typer.Option("--dry-run", help="Show the plan only.")] = False,
+        json_flag: JsonOption = False,
+    ) -> None:
+        """Create a secret from a literal leaked in a scenario and replace it by its reference."""
+        refuse_agent_context()
+        validate_name(name)
+        if kind is SecretKind.card:
+            _fail("A card has several fields: create it with `secret set --kind card` instead.")
+        settings, json_mode, app_id = command_context(json_flag)
+        ref = reference(name)
+        story_path = f"{base_path(app_id)}/{scenario_id}"
+
+        async def _run() -> dict[str, Any]:
+            async with ApiClient(settings) as client:
+                vault = await request(client, "GET", secrets_path(app_id), collection=True) or {}
+                if any(s.get("name") == name for s in vault.get("secrets") or []):
+                    _fail(f"A secret named {name} already exists; pick another --as name.")
+                story = await fetch_story(client, app_id, scenario_id)
+                results = [
+                    (lb, tx, await lint_text(client, app_id, tx)) for lb, tx in story_sources(story)
+                ]
+                found = _candidates(results)
+                if not found:
+                    _fail("No literal secret found in this scenario (see `minitest secret lint`).")
+                if (leak is None and len(found) > 1) or (
+                    leak is not None and not 0 < leak <= len(found)
+                ):
+                    print_error(f"{len(found)} literals found; choose one with --leak N:")
+                    for i, (label, at, literal) in enumerate(found, start=1):
+                        err_console.print(f"  {i}. {label} at {at} ({len(literal)} characters)")
+                    raise typer.Exit(code=1)
+                label, at, literal = found[(leak or 1) - 1]
+                body, count = _patch_body(story, literal, ref)
+                plan = {"secret": name, "source": label, "at": at, "replacements": count}
+                if dry_run:
+                    return {**plan, "dryRun": True}
+                secret_body: dict[str, Any] = {"kind": kind.value, "value": literal}
+                if note is not None:
+                    secret_body["note"] = note
+                await request(client, "PUT", f"{secrets_path(app_id)}/{name}", json=secret_body)
+                resp = await client.patch(story_path, json=body)
+                if resp.status_code >= 400:
+                    print_error(f"Secret {name} was created but the scenario was not updated.")
+                handle_response_error(resp)
+                return plan
+
+        plan = run_api_call(_run())
+        if json_mode:
+            print_json(plan)
+            return
+        where = f"{plan['source']} at {plan['at']}"
+        if plan.get("dryRun"):
+            print_info(
+                f"Would create {name} from the literal in {where} and replace "
+                f"{plan['replacements']} occurrence(s) with {ref}."
+            )
+            return
+        print_success(
+            f"Secret {name} created; {plan['replacements']} occurrence(s) now read {ref}."
+        )
+        print_warning(
+            "Older scenario versions and past run logs may still hold the literal: "
+            "rotate the credential if it is sensitive."
+        )