skit-cli 0.3.0__tar.gz → 0.4.0__tar.gz

{skit_cli-0.3.0 → skit_cli-0.4.0}/PKG-INFO

@@ -1,7 +1,7 @@
 Metadata-Version: 2.4
 Name: skit-cli
-Version: 0.3.0
-Summary: Launcher and parameter manager for scripts, prompts, programs, and commands: one library, one run form, nothing to memorize.
+Version: 0.4.0
+Summary: A terminal script manager and launcher for humans and AI agents: put any script, prompt, or program in one library; skit turns its inputs and flags into a run form and remembers past parameters. Ships an Agent Skill so agents reuse the scripts they wrote.
 Keywords: script,launcher,uv,tui,pep723,script-manager,script-runner,automation,ai-agent,ai-prompt,agent-skills
 Author: Yi-Ting Chiu
 Author-email: Yi-Ting Chiu <mytim710@gmail.com>
@@ -48,7 +48,8 @@ Description-Content-Type: text/markdown
 
 **skit is a launcher and a home for your scripts.**
 
-skit stores your scripts in one place and makes them painless to launch.
+skit stores your scripts in one place and makes them painless to launch — Python, shell, and
+JS/TS go deepest, a dozen kinds in all.
 
 **AI writes the scripts. skit gives them a home.**
 
@@ -56,14 +57,14 @@ And it's a home you share with your agent: the library you drive from a menu, AI
 drive through a deterministic CLI — checking it before writing yet another one-off
 script, and (with your OK) saving the good ones back, so they outlive the chat.
 
-<video src="https://github.com/user-attachments/assets/d27121fe-5855-4270-91b0-b0ee9e5d11ee" controls></video>
+<video src="https://github.com/user-attachments/assets/8a1f27cd-f2f2-42db-977a-b4f8ea207340" controls></video>
 
 ## What it does
 
 - **One home for your scripts and prompts.** `skit add` collects scattered scripts and prompts into a searchable library — keep a copy in the library, or reference the original file. Run it bare and it asks what you're adding; hand it a file it can't classify and it asks which kind, instead of erroring out.
 - **Parameters without the pain.** Flags, `input()` calls, and the constants you tick become form fields (choices → pickers, booleans → checkboxes, paths → completion and a file browser, types enforced).
-- **Paths you don't have to type.** Path fields complete as you type — press `→` to accept the suggestion — and `Ctrl+T` → *File or folder…* opens a browsable picker, so you never hand-type a directory again.
-- **It remembers.** Last-used values come back automatically; save favorites as named presets. Parameters marked secret never touch disk. Tokens like `{cwd}` and `{today}` keep presets portable.
+- **Paths you don't have to type.** Every text field carries a `📁 browse` link that opens a file picker, and path fields complete as you type — press `→` to accept the suggestion. You never hand-type a directory again. (`Ctrl+T` → *File or folder…* is the keyboard route to the same picker.)
+- **It remembers.** Script defaults arrive prefilled and track the source when it changes; last-used values come back automatically, and `↺ default` (Ctrl+O) puts the script's own value back. Save favorites as named presets. Parameters marked secret never touch disk. Tokens like `{cwd}` and `{today}` keep presets portable.
 - **No environment mess.** Python scripts declare their dependencies inline (PEP 723) and run via uv in isolated environments; JS/TS scripts get a per-script `node_modules`, installed from their declared packages on first run. Nothing global either way. Other languages use the tools already on your machine — skit checks that declared external commands are on your `PATH` before running.
 - **Mouse or keyboard.** Plain `skit` opens the full TUI; every key hint on screen is also a clickable button.
 - **Automation-ready.** Every TUI action is also a CLI command with `--json` output and meaningful exit codes — for shell scripts, CI, and AI agents.

{skit_cli-0.3.0 → skit_cli-0.4.0}/README.md

@@ -13,7 +13,8 @@
 
 **skit is a launcher and a home for your scripts.**
 
-skit stores your scripts in one place and makes them painless to launch.
+skit stores your scripts in one place and makes them painless to launch — Python, shell, and
+JS/TS go deepest, a dozen kinds in all.
 
 **AI writes the scripts. skit gives them a home.**
 
@@ -21,14 +22,14 @@ And it's a home you share with your agent: the library you drive from a menu, AI
 drive through a deterministic CLI — checking it before writing yet another one-off
 script, and (with your OK) saving the good ones back, so they outlive the chat.
 
-<video src="https://github.com/user-attachments/assets/d27121fe-5855-4270-91b0-b0ee9e5d11ee" controls></video>
+<video src="https://github.com/user-attachments/assets/8a1f27cd-f2f2-42db-977a-b4f8ea207340" controls></video>
 
 ## What it does
 
 - **One home for your scripts and prompts.** `skit add` collects scattered scripts and prompts into a searchable library — keep a copy in the library, or reference the original file. Run it bare and it asks what you're adding; hand it a file it can't classify and it asks which kind, instead of erroring out.
 - **Parameters without the pain.** Flags, `input()` calls, and the constants you tick become form fields (choices → pickers, booleans → checkboxes, paths → completion and a file browser, types enforced).
-- **Paths you don't have to type.** Path fields complete as you type — press `→` to accept the suggestion — and `Ctrl+T` → *File or folder…* opens a browsable picker, so you never hand-type a directory again.
-- **It remembers.** Last-used values come back automatically; save favorites as named presets. Parameters marked secret never touch disk. Tokens like `{cwd}` and `{today}` keep presets portable.
+- **Paths you don't have to type.** Every text field carries a `📁 browse` link that opens a file picker, and path fields complete as you type — press `→` to accept the suggestion. You never hand-type a directory again. (`Ctrl+T` → *File or folder…* is the keyboard route to the same picker.)
+- **It remembers.** Script defaults arrive prefilled and track the source when it changes; last-used values come back automatically, and `↺ default` (Ctrl+O) puts the script's own value back. Save favorites as named presets. Parameters marked secret never touch disk. Tokens like `{cwd}` and `{today}` keep presets portable.
 - **No environment mess.** Python scripts declare their dependencies inline (PEP 723) and run via uv in isolated environments; JS/TS scripts get a per-script `node_modules`, installed from their declared packages on first run. Nothing global either way. Other languages use the tools already on your machine — skit checks that declared external commands are on your `PATH` before running.
 - **Mouse or keyboard.** Plain `skit` opens the full TUI; every key hint on screen is also a clickable button.
 - **Automation-ready.** Every TUI action is also a CLI command with `--json` output and meaningful exit codes — for shell scripts, CI, and AI agents.

{skit_cli-0.3.0 → skit_cli-0.4.0}/pyproject.toml

@@ -2,8 +2,8 @@
 # Distribution name only ("skit" is admin-prohibited on PyPI); the import package,
 # CLI command, and config dirs all stay "skit".
 name = "skit-cli"
-version = "0.3.0"
-description = "Launcher and parameter manager for scripts, prompts, programs, and commands: one library, one run form, nothing to memorize."
+version = "0.4.0"
+description = "A terminal script manager and launcher for humans and AI agents: put any script, prompt, or program in one library; skit turns its inputs and flags into a run form and remembers past parameters. Ships an Agent Skill so agents reuse the scripts they wrote."
 readme = "README.md"
 requires-python = ">=3.12"
 license = "MIT"

{skit_cli-0.3.0 → skit_cli-0.4.0}/src/skit/analysis.py

@@ -25,10 +25,10 @@ from dataclasses import dataclass, field, replace
 from typing import TYPE_CHECKING
 
 from .callmatch import match_calls
-from .params import ParamDecl
+from .params import ParamDecl, coerce_default
 
 if TYPE_CHECKING:
-    from collections.abc import Callable
+    from collections.abc import Callable, Mapping
 
 
 @dataclass
@@ -55,6 +55,11 @@ class Candidate:
     # envdefault only: the ${NAME} variable the value is read from at run time (== name; kept
     # explicit so an env-delivery caller never has to re-derive it). "" for const/input.
     env_name: str = ""
+    # envdefault only: an explicitly empty environment value still activates the
+    # source's fallback. Shell's colon operators (:- and :=) have this behavior;
+    # the non-colon operators and fish's set-query idiom do not. Kept as a semantic
+    # boolean so the language-neutral form layer never needs to know shell syntax.
+    empty_uses_default: bool = False
 
 
 @dataclass
@@ -92,6 +97,20 @@ class Report:
     rebind: list[tuple[ParamDecl, Candidate]] = field(default_factory=list)
     new: list[Candidate] = field(default_factory=list)
     syntax_error: bool = False
+    # The SOURCE's current default for every ok-matched const/envdefault spec, keyed by
+    # name. The stored block default is a cache written at manage time; the script is the
+    # truth, and a user who edits `X = "hello"` to `X = "bonjour"` must see (and prefill,
+    # and reset to) "bonjour" — the stale cache used to be silently re-injected OVER that
+    # edit. A value change is deliberately NOT drift: tracking the source is the expected
+    # behavior, not a warning. Two exclusions, both in _records_default/_type_matches: a
+    # SECRET's literal never travels (C3), and a type-mismatched default never overlays a
+    # spec (a const carries a drift warning and keeps its old prefill until resync; an env
+    # param stays ok but its default must still fit the declared type).
+    current_defaults: dict[str, str | int | float | bool] = field(default_factory=dict)
+    # Managed envdefault names for which an empty environment value still selects
+    # the source fallback. Like current_defaults, this is live source semantics that
+    # is projected onto the run form without changing the frozen [tool.skit] block.
+    empty_uses_default: set[str] = field(default_factory=set)
 
     @property
     def has_drift(self) -> bool:
@@ -107,6 +126,18 @@ class Report:
         return self.ok + [spec for spec, _ in self.changed] + [spec for spec, _ in self.rebind]
 
 
+def effective_default(
+    spec: ParamDecl, current: Mapping[str, str | int | float | bool]
+) -> str | int | float | bool | None:
+    """The default a READ surface should show for a managed spec: the source's current
+    literal when reconcile published one (Report.current_defaults), else the stored
+    block value. THE one place that rule lives — `skit params`, `params --json` and the
+    Entry-settings pane all show the same record, and the comments on each of them
+    promise they cannot disagree; two hand-rolled copies of a fallback is exactly how
+    that promise rots."""
+    return current.get(spec.name, spec.default)
+
+
 def drift_lines(report: Report, name: str) -> list[str]:
     """The display lines for a drift report (shared by CLI/TUI). The only copy exit point in this
     module: plain-text old/new comparison; rich markup/color is wrapped by the caller."""
@@ -231,8 +262,8 @@ def edit_specs(
     # insertion order, so this only changes anything when specs already has duplicate names).
     order: list[str] = list(by_name)  # keep original order; new ones appended at the end
 
-    # 1) resync: prune missing and update changed types per the current script (keeping custom
-    #    secret/prompt/default).
+    # 1) resync: prune missing and update changed types/defaults per the current script
+    #    (keeping custom secret/prompt).
     if resync:
         _apply_resync(text, specs, by_name, order, warnings, analyze=analyze)
 
@@ -275,20 +306,39 @@ def _apply_resync(
         warnings.append("resync-skipped")
         return
     missing_names = {s.name for s in report.missing}
-    changed_types = {spec.name: cand.type for spec, cand in report.changed}
+    changed_pairs = {spec.name: cand for spec, cand in report.changed}
     rebind_targets = {spec.name: cand for spec, cand in report.rebind}
     for name in list(order):
         if name in missing_names:
             warnings.append(f"resync-dropped:{name}")
             del by_name[name]
             order.remove(name)
-        elif name in changed_types:
-            # changed_types[name] is a Candidate.type (a plain str); ParamDecl.type is the
-            # closed ParamType literal, so re-anchor the type through dataclasses.replace
-            # (whose kwargs are untyped) rather than a direct attribute write. by_name[name]
-            # is already a private shallow copy (see the replace() at the top of edit_specs),
-            # so swapping in a fresh copy is the same visible effect as mutating in place.
-            by_name[name] = replace(by_name[name], type=changed_types[name])
+        elif name in changed_pairs:
+            # cand.type is a plain str while ParamDecl.type is the closed ParamType
+            # literal, so re-anchor through dataclasses.replace (whose kwargs are
+            # untyped) rather than a direct attribute write. by_name[name] is already a
+            # private shallow copy (see the replace() at the top of edit_specs), so
+            # swapping in a fresh copy is the same visible effect as mutating in place.
+            # The default rides along with the type: once the spec is retyped to the
+            # source's current shape, keeping the old-typed default would leave stale
+            # junk (an int 3 on a now-str constant) in the refreshed record. It rides
+            # through the SAME secret gate the ok lane uses (_recordable_default): a
+            # secret's literal must not be written into the block, from where
+            # to_block_dict would publish it to `params --json` / `show --json`. A
+            # retyped secret therefore comes out with no default at all — honest, and
+            # the only leak-free answer once its old default no longer fits the type.
+            cand = changed_pairs[name]
+            by_name[name] = replace(
+                by_name[name],
+                type=cand.type,
+                default=_recordable_default(by_name[name], cand),
+            )
+        elif name in report.current_defaults:
+            # An ok-matched const/envdefault whose SOURCE default moved on: resync's job
+            # is to make the stored record match the script again, and the cached default
+            # is part of that record (the run form already tracks the source either way —
+            # see Report.current_defaults).
+            by_name[name] = replace(by_name[name], default=report.current_defaults[name])
         elif name in rebind_targets:
             # The prompt no longer uniquely resolves; re-anchor to whichever call site position
             # currently supplied it, so the *next* run's plain reconcile() (no --resync) sees an
@@ -338,6 +388,12 @@ def _apply_tweaks(
             by_name[name].env_source = ""  # an env source only means anything on a secret
         else:
             warnings.append(f"not-managed:{name}")
+    # Apply the final-state rule after both lists: `--secret X --no-secret X` ends
+    # public and must keep its public default, while every explicit final transition
+    # to secret removes the cached literal before the block/JSON surfaces can expose it.
+    for name in secret:
+        if name in by_name and by_name[name].secret:
+            by_name[name].default = None
     for name, prompt in prompts.items():
         if name in by_name:
             by_name[name].prompt = prompt
@@ -345,6 +401,40 @@ def _apply_tweaks(
             warnings.append(f"not-managed:{name}")
 
 
+def _record_default(report: Report, spec: ParamDecl, cand: Candidate) -> None:
+    """Publish the source's current literal as this spec's default — the one rule both
+    matched lanes share. It travels only when it MAY (see _recordable_default) and when
+    the DECLARED type can actually hold it.
+
+    Fitness is coercibility, not type equality: the analyzers type a literal by its
+    shape, so a `str` param defaulting to `8080` reads back as an int candidate and must
+    still refresh (its value is text either way). What must not pass is a default the
+    declared type cannot represent — an env param stays ok through a type change (the
+    value arrives by environment regardless), so `PORT=${PORT:-$FALLBACK}` on an int
+    param would otherwise prefill text that fails the form's own validation and hand
+    resync that text to write onto an int spec."""
+    default = _recordable_default(spec, cand)
+    if default is None:
+        return
+    try:
+        coerce_default(str(default), spec.type)
+    except ValueError:
+        return
+    report.current_defaults[spec.name] = default
+
+
+def _recordable_default(spec: ParamDecl, cand: Candidate) -> str | int | float | bool | None:
+    """The source literal this match may publish as the spec's current default, or None
+    when it may not.
+
+    A SECRET is the one hard exclusion (C3): its literal is exactly the thing that must
+    not travel. current_defaults feeds `params --json`, `show --json` and the settings
+    pane — machine-facing surfaces with no masking of their own — so a hardcoded
+    `TOKEN = "sk-live-…"` would leave the script's own text for the first time. The
+    secret's stored block default (if any) still describes it, masked, exactly as before."""
+    return None if spec.secret else cand.default
+
+
 def _type_matches(spec: ParamDecl, cand: Candidate) -> bool:
     """Whether a stored const type still matches what the source derives. A declared
     ``path`` over a derived ``str`` is a user refinement — a string constant is exactly
@@ -402,6 +492,9 @@ def reconcile(  # noqa: PLR0912 — one branch per binding and drift category; a
             else:
                 covered_envs.add(spec.name)
                 report.ok.append(spec)  # default-text/type changes stay ok (env delivery)
+                _record_default(report, spec, cand)
+                if cand.empty_uses_default:
+                    report.empty_uses_default.add(spec.name)
             continue
         cand = consts.get(spec.name)
         if cand is None:
@@ -412,6 +505,7 @@ def reconcile(  # noqa: PLR0912 — one branch per binding and drift category; a
         else:
             covered_consts.add(spec.name)
             report.ok.append(spec)
+            _record_default(report, spec, cand)
 
     for cand in analysis.candidates:
         if (

{skit_cli-0.3.0 → skit_cli-0.4.0}/src/skit/argstate.py

@@ -4,11 +4,12 @@
 - File shape: [values] (last-used), extra_args, [presets.<name>] (named presets).
 - **C3 is enforced structurally here**: every write entry point requires secret_names, and any key
   in that list is stripped before it hits disk, so a secret value can never appear in a state file
-  (there are tests for this). This holds for *new* writes; it says nothing about a value that was
-  written while the parameter was still public. purge_secret() retroactively scrubs that plaintext
-  once a parameter transitions to secret, and save_last() also drops any now-secret key left over
-  from before, even on calls that carry no new value for it — so nothing written while a parameter
-  was public can outlive it becoming secret.
+  (there are tests for this). This includes the complete values snapshot nested under last_run,
+  which powers `preset save --from-last`. This holds for *new* writes; it says nothing about a value
+  that was written while the parameter was still public. purge_secret() retroactively scrubs that
+  plaintext once a parameter transitions to secret, and save_last() also drops any now-secret key
+  left over from before, even on calls that carry no new value for it — so nothing written while a
+  parameter was public can outlive it becoming secret.
 - Value resolution (this run's input > preset > last-used > definition default) lives in
   flows.prefill; this module only stores and strips.
 """
@@ -150,6 +151,16 @@ def purge_secret(slug: str, names: Iterable[str]) -> set[str]:
             new_presets[name] = cleaned
     doc["presets"] = new_presets
 
+    # The exact last-run snapshot is another value-bearing surface. A parameter that
+    # becomes secret after it ran publicly must be scrubbed here too, or --from-last
+    # could copy the old plaintext back into a preset.
+    last_run = dict(doc.get("last_run", {}))
+    if "values" in last_run:
+        last_values = dict(last_run.get("values", {}))
+        removed |= banned & last_values.keys()
+        last_run["values"] = _strip_secrets(last_values, banned)
+        doc["last_run"] = last_run
+
     _save_doc(slug, doc)
     return removed
 
@@ -177,12 +188,25 @@ def save_last_runner(name: str) -> None:
     atomic_write_toml(state_dir() / "prompt.toml", {"last_runner": name})
 
 
-def record_run(slug: str, exit_code: int, *, at: str) -> None:
+def record_run(
+    slug: str,
+    exit_code: int,
+    *,
+    at: str,
+    values: dict[str, str] | None = None,
+    secret_names: Iterable[str] = (),
+) -> None:
     """Remember when the entry last ran and how it exited (Library sort order, detail pane,
     and the r-rerun context key all read this). Stored as a table — a bare `last_exit = 0`
     top-level key would be dropped by _save_doc's empty-section pruning (0 is falsy)."""
     doc = _load_doc(slug)
-    doc["last_run"] = {"at": at, "exit": exit_code}
+    last_run: dict[str, Any] = {"at": at, "exit": exit_code}
+    if values is not None:
+        # Unlike last-used [values], this is the exact accepted invocation: values
+        # equal to defaults and delivered empty strings stay so --from-last can pin
+        # what actually ran instead of reconstructing it from a later source version.
+        last_run["values"] = _strip_secrets(values, secret_names)
+    doc["last_run"] = last_run
     _save_doc(slug, doc)
 
 

{skit_cli-0.3.0 → skit_cli-0.4.0}/src/skit/cli.py

@@ -2334,6 +2334,10 @@ def _field_to_dict(f: flows.FormField) -> dict[str, object]:
         "flag": f.flag,
         "action": f.action,
         "env_source": f.env_source,
+        # True = clearing this field (or --set NAME=) delivers an EMPTY STRING; false =
+        # an empty value means "unset — the script's own default applies". Additive key
+        # so an agent can tell the two apart before assembling a run.
+        "delivers_empty": f.delivers_empty,
     }
 
 
@@ -3132,7 +3136,10 @@ def run(
         argstate.save_preset(
             entry.slug,
             save_preset,
-            {k: v for k, v in values.items() if v},
+            # A preset is the exact snapshot of this run — a cleared field included, so
+            # it pins "stays cleared" over whatever last-used remembers (secrets are
+            # stripped structurally by argstate).
+            values,
             secret_names=plan.secret_names,
         )
         # stderr, like every run-adjacent skit line ("Reusing your last arguments",
@@ -3536,15 +3543,34 @@ def preset_save(
             EXIT_USAGE,
         )
     if from_last:
-        last = argstate.load_state(entry.slug)["values"]
+        state = argstate.load_state(entry.slug)
+        if not state["last_run"] and not state["values"]:
+            raise _fail(
+                gettext("%(name)s has no remembered values yet — run it once first.")
+                % {"name": entry.meta.name},
+                1,
+            )
         keys = {f.key for f in plan.fields}
-        values = {k: v for k, v in last.items() if k in keys}
-        if not values:
+        last_snapshot = state["last_run"].get("values")
+        if isinstance(last_snapshot, dict):
+            # The exact accepted invocation, filtered only for fields removed since
+            # that run. Never overlay today's defaults: a changed/new definition did
+            # not participate in the historical run this command promises to save.
+            values = {k: str(v) for k, v in last_snapshot.items() if k in keys}
+        elif state["last_run"]:
+            # Legacy state with a run stamp but no exact snapshot cannot be rebuilt:
+            # remembered values deliberately omitted accepted defaults. Asking for a
+            # fresh run is honest; current defaults would fabricate history.
             raise _fail(
                 gettext("%(name)s has no remembered values yet — run it once first.")
                 % {"name": entry.meta.name},
                 1,
             )
+        else:
+            # Older state from before run stamps existed may still have explicit
+            # last-used values. Preserve that narrow compatibility lane without
+            # inventing missing defaults or newly-added fields.
+            values = {k: v for k, v in state["values"].items() if k in keys}
     elif _is_interactive():
         values = promptform.collect(plan, flows.prefill(plan, entry.slug), console=console)
     else:
@@ -3558,7 +3584,14 @@ def preset_save(
             % {"names": ", ".join(escape(n) for n in sorted(secret_overlap))}
             + _DIM_CLOSE
         )
-    argstate.save_preset(entry.slug, preset_name, values, secret_names=plan.secret_names)
+    argstate.save_preset(
+        entry.slug,
+        preset_name,
+        # The exact snapshot, cleared fields included — one rule for every preset
+        # writer (the run form's Ctrl+S and `run --save-preset` store the same way).
+        values,
+        secret_names=plan.secret_names,
+    )
     console.print(
         f"[green]{gettext('Preset "%(preset)s" saved for %(name)s.') % {'preset': escape(preset_name), 'name': escape(entry.meta.name)}}[/green]"
     )
@@ -3787,6 +3820,7 @@ def _show_params(entry: store.Entry, as_json: bool) -> None:
     # vanished analyzable script must not invent either signal (test_cli_mut_part06 pins it).
     self_locating, reader_driven = False, False
     ref_mode = entry.meta.mode == "reference"
+    current_defaults: dict[str, str | int | float | bool] = {}
     if entry_spec is not None and entry_spec.analyzer is not None:  # noqa: SIM102
         # Keep the text gate nested instead of pragma-suppressing a three-way BooleanOperation:
         # changing ``and text`` to ``or text`` is equivalent under the registry invariant, but a
@@ -3797,6 +3831,9 @@ def _show_params(entry: store.Entry, as_json: bool) -> None:
             # only the WRITE ops differ, and the advice below switches voice on that).
             report = entry_spec.analyzer.reconcile(text, specs)
             an = entry_spec.analyzer.analyze(text)
+            # The Default column shows the SOURCE's current value, exactly like the run
+            # form's prefill — two surfaces reading one record must not disagree.
+            current_defaults = report.current_defaults
             # A MODELED reader form (flows.reader_fields — the one trap predicate every
             # surface shares) is the entry's real interface: plan_for_entry prefers managed
             # params, so a --manage advice here would sell REPLACING that form. Self-parsing
@@ -3822,6 +3859,10 @@ def _show_params(entry: store.Entry, as_json: bool) -> None:
     if as_json:
         payload = {
             "params": [s.to_block_dict() for s in specs],
+            # The SOURCE's current default per managed name (additive key). "params"
+            # stays the verbatim stored record — an agent that wants the value a run
+            # would actually prefill reads it here, same truth as the human table.
+            "current_defaults": current_defaults,
             "unmanaged": unmanaged,
             "placeholders": entry.meta.params or [],
             "declared": [d.to_meta_dict() for d in declared],
@@ -3887,10 +3928,11 @@ def _show_params(entry: store.Entry, as_json: bool) -> None:
                 last_shown = gettext("•••") if s.name in last else "—"
             else:
                 last_shown = last.get(s.name, "—")
+            shown_default = analysis.effective_default(s, current_defaults)
             default_shown = (
                 gettext("•••")
-                if s.secret and s.default is not None
-                else ("—" if s.default is None else str(s.default))
+                if s.secret and shown_default is not None
+                else ("—" if shown_default is None else str(shown_default))
             )
             table.add_row(
                 escape(s.name),