secret : trousseau OS (keyring) + injection @secret au start/run (issue #36) - valeurs jamais affichees ni journalisees, mock testable, fallback clair sans trousseau

src/commands/mod.rs

@@ -17,6 +17,7 @@ pub mod open_cmd;
 pub mod projects_cmd;
 pub mod run_cmd;
 pub mod search_cmd;
+pub mod secret_cmd;
 pub mod self_uninstall;
 pub mod sessions_cmd;
 pub mod stats_cmd;
@@ -65,6 +66,7 @@ pub fn execute_command(app: &App, cmd: &Command) -> Result<i32> {
             interval,
         } => watch_cmd::run(app, agent, *restart, *notify, *interval),
         Command::Alias(sub) => alias_cmd::run(app, sub),
+        Command::Secret(sub) => secret_cmd::run(app, sub),
         Command::Start(a) => run_cmd::start(app, a),
         Command::Stop {
             agent,
@@ -202,6 +204,11 @@ pub fn resolve_exec(
     args.extend(extra_args.iter().cloned());
     let mut env = agent.env.clone();
     env.extend(extra_env.clone());
+    let warnings =
+        crate::secrets::resolve_env_secrets(&crate::secrets::store(), &agent.name, &mut env);
+    for w in warnings {
+        app.log.warn(&w);
+    }
     let (program, args) = route_cmd_script(program, args);
     Ok(ResolvedExec { program, args, env })
 }