feat: edit a shared secret everywhere, repo links, agent dry runs

docs/cli-reference.md

@@ -51,6 +51,8 @@ capy edit [name] [options]
 
 JSON support: yes (`--json`)
 
+Dry run: yes (`--dry-run`)
+
 ## `capy branch`
 
 List secret branches
@@ -120,6 +122,8 @@ capy deploy [target] [options]
 
 JSON support: yes (`--json`)
 
+Dry run: yes (`--dry-run`)
+
 ### `capy deploy revoke`
 
 Revoke a deploy token
@@ -298,6 +302,8 @@ capy agents [options]
 
 JSON support: yes (`--json`)
 
+Dry run: yes (`--dry-run`)
+
 ## `capy invite`
 
 Invite a teammate to this organization
@@ -509,9 +515,34 @@ capy secrets [options]
 | `--json` | emit machine-readable JSON instead of the human UI |  |
 | `--project <name>` | only rows with a location in this project |  |
 | `--branch <name>` | only rows with a location on this branch |  |
+| `--name <NAME>` | only rows with exactly this secret name |  |
 
 JSON support: yes (`--json`)
 
+Dry run: yes (`--dry-run`)
+
+### `capy secrets set`
+
+Set one secret to a new value (read from stdin) in several locations and open keep.lock PRs. Never prompts.
+
+```
+capy secrets set <name> [options]
+```
+
+| Option | Description | Default |
+|---|---|---|
+| `--json` | emit machine-readable JSON instead of the human UI |  |
+| `--row <row_id>` | change this row of that name (repeatable; ids from `capy secrets --name NAME --json`) | `[]` |
+| `--all-rows` | change every row of that name |  |
+| `--exclude <project:branch>` | leave this location out (repeatable) | `[]` |
+| `--no-pr-for <owner/name>` | do not open a PR in this repo (repeatable) | `[]` |
+| `--no-pr` | do not open any PR |  |
+| `--confirm <plan_id>` | run the plan that --dry-run printed (required for a real run) |  |
+
+JSON support: yes (`--json`)
+
+Dry run: yes (`--dry-run`)
+
 ## `capy grant-branch`
 
 Grant a member wildcard access to a protected branch
@@ -582,9 +613,6 @@ capy add <vars...> [options]
 
 | Option | Description | Default |
 |---|---|---|
-| `--reason <text>` | short note shown on the intake page |  |
-| `--help-url <NAME=URL>` | per-variable "where to find this" link, e.g. STRIPE_SECRET_KEY=https://dashboard.stripe.com/apikeys (repeatable) | `[]` |
-| `--no-open` | do not auto-open the browser; print the URL only |  |
 | `--no-push` | write to .env only; do not push to Capy |  |
 | `-f, --force` | overwrite existing values without prompting |  |
 | `--non-tty` | never prompt; resolve from flags or fail fast (agents/CI) |  |
@@ -595,6 +623,8 @@ capy add <vars...> [options]
 
 JSON support: yes (`--json`)
 
+Dry run: yes (`--dry-run`)
+
 ## `capy remove`
 
 Delete one or more secret values from the active branch (encrypts + syncs)
@@ -614,6 +644,8 @@ capy remove <vars...> [options]
 
 JSON support: yes (`--json`)
 
+Dry run: yes (`--dry-run`)
+
 ## `capy connect`
 
 Link an existing .env variable to a third-party provider
@@ -643,6 +675,8 @@ capy connect [provider] [options]
 
 JSON support: yes (`--json`)
 
+Dry run: yes (`--dry-run`)
+
 ## `capy rotate`
 
 Rotate a managed credential previously set up via `capy connect`
@@ -760,6 +794,20 @@ Every refusal carries a stable `code` — branch on it, never on message text.
 - `STDIN_TOO_LARGE`
 - `ADD_STDIN_ONE_NAME`
 - `ADD_VAR_EXISTS`
+- `WEB_MODE_REMOVED`
+- `KEEP_LOCK_REPO_MISMATCH`
+- `SECRET_AMBIGUOUS`
+- `PLAN_CHANGED`
+- `PROJECT_KIND_UNSUPPORTED`
+- `PLAN_CONFIRM_REQUIRED`
+- `SECRET_NOT_FOUND`
+- `SECRETS_NOTHING_SELECTED`
+- `SECRETS_PARTIAL`
+- `REPO_LINKS_UNSUPPORTED`
+- `DRY_RUN_UNSUPPORTED`
+- `GITHUB_TIMEOUT`
+- `RATE_LIMITED`
+- `GITHUB_RATE_LIMITED`
 
 ## Conventions
 

package.json

@@ -51,6 +51,7 @@
     "build:binary": "node scripts/build-binary.mjs"
   },
   "dependencies": {
+    "@inquirer/core": "^10.3.2",
     "commander": "^11.0.0",
     "dotenv": "^16.3.0",
     "inquirer": "^12.9.6",

scripts/check-screens.mjs

@@ -19,6 +19,11 @@ const ALLOWED_DEPS = [
   'commander',
   'dotenv',
   'inquirer',
+  // Not a screens dependency, and not a new package: the searchable
+  // pickers build on inquirer's own prompt core. It was already installed
+  // as an inquirer dependency at the same version; declaring it only makes
+  // the direct import explicit.
+  '@inquirer/core',
   'open',
   'proper-lockfile',
   // Not a screens dependency: `capy transport` and `capy pair` (CAP-684)