secretslisted

# secrets Copies real credentials into the current repo's `.env` by matching key names against `~/.claude/.secrets.env` and the offlocal MCP's own env file, then proves each value against a live API before writing it. **You never read either source file.** The script matches names and moves values. The only thing that reaches your context is the key name, a short non-private prefix, a length, and a validation status. ## Run it ``` node ~/.claude/skills/secrets/fill-env.cjs ``` From the repo root. Flags: `--dir <repo>`, `--dry-run`, `--force` (also replace values that already look real), `--source <path>` (extra store, takes precedence). Exits non-zero if any candidate was rejected. Backs up to `.env.bak` before writing. ## What it does 1. Creates `.env` from `.env.example` if absent. 2. Picks the keys still on their example value (or matching a placeholder pattern). 3. Resolves each from the stores, first match wins, with an alias table for keys spelled differently in a store. 4. Derives the Clerk publishable key from the secret key when only the secret is stored. 5. **Validates before writing**: a live API probe where one exists, a format check otherwise. A rejected value never lands in `.env`. 6. Prints a table and lists the keys no store has. Step 5 is the point. `offlocal doctor` reports a credential as "set" when the value is literally `twilio_placeholder`; only a real request tells you it is junk. ## What a probe cannot tell you A probe proves the key *