secret : trousseau OS (keyring) + injection @secret au start/run (issue #36) - valeurs jamais affichees ni journalisees, mock testable, fallback clair sans trousseau

src/cli.rs

@@ -108,6 +108,9 @@ pub enum Command {
     /// Manage command aliases (cc -> claude-code)
     #[command(subcommand)]
     Alias(AliasCmd),
+    /// Manage secrets in the OS keyring (never in plaintext config)
+    #[command(subcommand)]
+    Secret(SecretCmd),
     /// Start an agent (foreground by default, or detached with --background)
     Start(StartArgs),
     /// Stop a background agent (SIGTERM, then SIGKILL after the timeout)
@@ -369,6 +372,32 @@ pub struct StartArgs {
     pub notify: bool,
 }
 
+/// Secret management subcommands.
+#[derive(Subcommand, Debug, Clone)]
+pub enum SecretCmd {
+    /// Store a secret for an agent
+    Set {
+        /// Secret name (the environment variable name)
+        name: String,
+        /// Agent it belongs to
+        #[arg(long, value_name = "AGENT")]
+        agent: String,
+        /// Secret value (prefer --value over shell history; never logged)
+        #[arg(long, value_name = "VALUE")]
+        value: String,
+    },
+    /// Remove a secret
+    Unset {
+        /// Secret name
+        name: String,
+        /// Agent it belongs to
+        #[arg(long, value_name = "AGENT")]
+        agent: String,
+    },
+    /// List stored secret names (values are never shown)
+    List,
+}
+
 /// Alias management subcommands.
 #[derive(Subcommand, Debug, Clone)]
 pub enum AliasCmd {