feat: add secure secret sources to alien dev

[alongubkin]

alien dev --secret KEY=VALUE puts secret values in process arguments and often shell history. This adds --secret-file KEY=PATH[:targets] and --secret-env KEY=SOURCE_ENV[:targets], so the CLI receives only a source reference while preserving per-resource scoping.

Secret-source errors identify the destination key and source without rendering the loaded value. CliEnvVar debug output now redacts all secret values, including values supplied through the existing flag. Secret files discard one conventional trailing \n or \r\n.

Closes ALIEN-913.

Validation:

• cargo test -p alien-cli --lib secret_ (5 passed)
• git diff --check
• cargo clippy -p alien-cli --lib --all-features was inspected but not used as a clean gate because the current workspace emits extensive pre-existing warnings from generated models and dependency crates.

[enclave-ai]

Enclave skipped this draft pull request. It will run automatically when you mark the PR as Ready for review.

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge; the previously reported issues are fixed and no new actionable defects remain.

Summary

The PR adds safer secret sources for local development while preserving resource scoping and preventing loaded values from appearing in debug output.

• Adds --secret-file and --secret-env to alien dev.
• Removes one conventional trailing line ending from file-backed secrets.
• Redacts secret values in CliEnvVar debug output.
• Provides focused parser and redaction tests.
• Documents the safer workflow in the public and CLI READMEs.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
    A["alien dev"] --> B{"Secret option"}
    B -->|"--secret-file KEY=PATH:targets"| C["Read file"]
    B -->|"--secret-env KEY=SOURCE_ENV:targets"| D["Read inherited environment"]
    C --> E["Remove one trailing line ending"]
    D --> F["Loaded secret value"]
    E --> F
    F --> G["CliEnvVar<br/>is_secret = true"]
    G --> H["Apply optional resource targets"]
    G --> I["Debug output: [REDACTED]"]

Loading

_{Reviews (2) · Last reviewed commit: "fix: validate secure secret source synta..."}

[alongubkin]

@greptileai review