# why

Browse needs commands to manage project secrets and attach them to
Functions. The seven component PRs were merged into
`agent/browse-v4-7-context-names`; this PR brings those changes onto
current `main` at `fbcdf61`.

# what changed

- Add `browse cloud secrets` commands to list, get, create, update, and
delete secrets, including client-side encryption for create/update and
password input support.
- Add `browse functions secrets` commands to attach, detach, and list
secrets for a function.
- Include API helpers, command contract tests, dependencies, and the
seven Browse changesets.

Cherry-picked in order from #2946, #2949, #2967, #2990, #3006, #3007,
and #3009. All seven applied without conflicts. The secrets
implementation is unchanged from the original branch. This branch
retains main's Browse 0.10.0 release and excludes the old parent
branch's context-name and eval changes.

# test plan

Validated locally on macOS with Node 24.18.0 and pnpm 11.23.0:

- `pnpm install --frozen-lockfile` — passed.
- `pnpm exec turbo run build --filter=browse` — all four tasks passed
(protocol, extension, SDK, CLI).
- `pnpm --filter browse lint` — formatting, ESLint, and TypeScript
passed.
- `pnpm --filter browse test:cli` — 36 files / 471 tests passed, using
an isolated daemon directory and umask 022.
- `pnpm exec node --import tsx scripts/release/check-changesets.ts` and
`git diff --check` — passed.

Validation covers the built CLI and local contract fixtures; no
production secrets were created or modified.

---------

Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>