v0.4.0 — a secret the agent never reads

A password or a token is stored once, by name, and typed by name — so it never enters the agent's context, its transcript, or the shell history.

use-computer secret set gh-token       # the value comes from stdin, never from argv
use-computer type --secret gh-token
use-computer set-value --id 0/2/1 --secret gh-token

One invariant holds it together: a secret leaves the store into the keyboard, and never into stdout.

• There is no secret get, and its absence is the design — a command that printed a secret is one an agent would call.
• The result line trades the text for the name: type 40 chars (secret gh-token).
• An action carrying a secret is never verified, because the after-screenshot would be a photograph of the credential. The line says not verified (secret) rather than going quiet.
• A missing secret names the command that stores it and tells the agent not to ask for the value in the conversation.
• In a batch, secret replaces text or value, so the file names the credential without containing it.

The bundled skill teaches the mechanism rather than the flag: an agent shown only --secret will helpfully offer to store the password it was just handed.

Encrypted at rest

Values are Fernet tokens. The key lives in the XDG data directory while the ciphertext sits in the config one — a key beside the data is theatre, since whatever copies one copies the other. USE_COMPUTER_SECRET_KEY_FILE moves it. Names and timestamps stay readable so secret list needs no key.

This stops the way credentials actually leak — a ~/.config that gets synced, committed to a dotfiles repository, or pasted into a bug report. It does not stop a process running as you, which can read the key or simply run type --secret. Both halves are in the documentation, because "encrypted" is a word a reader completes with their own threat model.

cryptography is a core dependency rather than an extra: a store that is sometimes encrypted is not a property anyone can plan around.

Also in this release

The Windows work tagged as 0.3.5 and never published: the window in front is recognised there, a window id no longer drifts as activate reshuffles the Z-order, a batch piped in from a Windows shell survives its byte order mark, and an elevated window says that is why it refuses.