secrets update --type with piped stdin silently ignores the value (reports success, value unchanged)

[nadavox]

Describe the bug

phase secrets update KEY --type secret with a piped stdin value prints ✅ Successfully updated the secret. and exits 0 — but the secret's value is not changed. The same pipe without --type works correctly.

The docs state for secrets update: "If the new value is not provided as an argument, it will be read from stdin", so piped rotation scripts reasonably trust the exit code. In our case this silently dropped a freshly rotated API token (the old token had already been revoked), leaving a dead credential in Phase.

Root cause appears to be in src/cmd/secrets_update.go (runSecretsUpdate):

var newValue string
if toggleOverride {
    // No value needed for toggle or change in secret type
} else if secretType != "" && randomType == "" && !override {
}   // <-- empty branch: --type set => stdin is never read, newValue stays ""

When --type is set (without --random/--override), the value-reading branch is skipped entirely, so a piped value is discarded and Update is called with an empty Value — interpreted as "no value change".

To Reproduce

$ printf 'v1\n' | phase secrets create MYKEY --app myapp --env Development --type secret
$ phase secrets get MYKEY --app myapp --env Development   # value: v1 ✅

$ printf 'v2\n' | phase secrets update MYKEY --app myapp --env Development --type secret
✅ Successfully updated the secret.                        # exit 0

$ phase secrets get MYKEY --app myapp --env Development   # value: still v1 ❌

$ printf 'v3\n' | phase secrets update MYKEY --app myapp --env Development
$ phase secrets get MYKEY --app myapp --env Development   # value: v3 ✅ (no --type)

Expected behavior

Either the piped value is stored when --type is combined with stdin input, or the command fails loudly / warns that the piped value is being ignored. A success message with exit 0 while silently discarding the piped value is the worst of both.

Screenshots

n/a — terminal transcript above.

Type of CLI installation:

• Pip
• MacOS
• Windows
• Linux
• Docker

Platform you are having the issue on:

macOS (Apple Silicon), CLI v2.2.0 (Homebrew), self-hosted Phase console.

Additional context

Our workaround: omit --type on update and verify every write with a read-back (secrets get) before trusting it. Happy to provide more detail; the reproduction is deterministic.