secretslisted

# Using a charter vault The rule this exists to keep: **use a secret, never reveal it.** A value that reaches the transcript is disclosed — to the model's context, to whatever logs the session, and to anyone the transcript is later shared with. Deleting the message afterwards does not undo any of that. Full model, including what the vault does *not* protect against: `charter docs show secrets`. ## Find out what exists ```bash charter vault list # vaults: name, provider, persona, status — no values charter secret list <vault> # the KEYS in one vault — no values ``` ## Store one — the value never goes on the command line ```bash printf '%s' "<value>" | charter secret set <vault> <key> --stdin charter secret set <vault> <key> --from-file <path> # multi-line or verbatim: kubeconfig, PEM ``` An argument list is not private: it is visible in `ps`, in shell history, and in this transcript. Ask the user to supply the value by stdin or file, or to set it themselves. ## Use one — pick an injection path **As an environment variable:** ```bash charter secret exec <vault> --env NAME=<key> -- <command...> ``` **As a file** (kubeconfig, certificate, key): ```bash charter secret exec <vault> --file KUBECONFIG=<key> -- kubectl get pods charter secret cp <vault> <key> <dest> # persist at 0600; <dest> must be a real file ``` `<dest>` must be a **real file that does not exist yet**. A device, a FIFO, a directory or a symlink is refused, and so is an exi