First-party Secrets commands + panel over Secret Service

[duketopceo]

Proposal: first-party Secrets commands + panel over Secret Service

Omarchy currently has no first-party way to browse or manage the system keyring. Tools that store credentials via Secret Service (VS Code/Cursor keytar, GitHub CLI, Seahorse, omaseal) each write items that are invisible to one another and invisible to the user. I'd like to upstream a small, self-contained secrets group so Omarchy itself can read/write the shared org.freedesktop.Secret namespace.

What's in the patch (ready as a PR against quattro):

• Five bin/omarchy-secrets-* commands (python-gobject over D-Bus): get, set (stdin-only value, updates every item matching a service/account pair), list (JSONL metadata — never secret values), delete (removes every matching item, then re-verifies), clipclear (hidden; clears the clipboard only while it still holds the addressed secret).
• A shell/plugins/secrets panel (omarchy.secrets): virtualized list, vault dropdown with per-service counts, name/recent sort, / filter, ext/other app provenance badges for credentials owned by other applications, keyboard-first (j/k, Enter copies, x confirms-delete, v/s/r/a), add form that writes the secret to the child's stdin — the value never lands in a QML property.
• Setup → Security → Secrets menu entry.
• Source-assertion shell tests plus a behavioral suite that drives the commands against a stubbed gi/Secret Service.

Interop contract: search uses a DONT_MATCH_NAME generic schema on service/account attributes, so items written by omaseal, keytar, seahorse, browsers, etc. are all discovered; omarchy-created items are stamped app=omarchy so provenance is visible and foreign items get an ext badge and a "Managed by X" disclosure on delete.

Security posture: secrets never pass through argv or QML state; copy is get | wl-copy --sensitive (two-stage so a failed lookup can't clobber the clipboard); the 30s auto-clear is a detached systemd-run --user --on-active=30 timer that survives panel dismissal and re-verifies the clipboard contents before clearing.

Tested live on aarch64 (Asahi): full set → get → list → copy → conditional clear → delete round-trip, duplicate-item coherence, and the panel in the running shell. Nothing here is arch-specific — pure python-gobject + wl-clipboard, so x86 gets it for free.

Happy to adjust naming, placement (Setup → Security felt natural), or scope. If there's interest I'll open the PR immediately — the branch is ready at duketopceo/omarchy-mac:feat/secrets-panel.