Secret Shuttle Demo

Scene 00 / 09 Magic path

magic path

One verb. One approval. Done.

provision --infer reads .env.example + your framework configs (Vercel, Supabase, GitHub Actions), writes a plan, and mints one batch approval. You click Approve once in the hub. provision --continue ships every secret to every destination — and audit hands you the receipt.

First time per provider, log in once in the Secret Shuttle browser. After that, one approval ships everything for providers with a recipe (see the coverage matrix). Providers that can't be revealed (e.g. OpenAI/Anthropic keys) are human-paste — you supply a key you created.

Watch for → The agent never sees a value. One human click covers the whole batch. The session checkbox lets the next matching push skip the popup for 15 minutes.

The 30-second loop

This is the day-to-day path. The nine scenes that follow are the advanced low-level mechanics — browser marks, blind-mode reveal-capture, inject-submit — the escape hatch for non-templated providers. Most provisioning never leaves this scene.

stuck

"…I need the secret. Can you paste it?"

The dev finished a Stripe integration in their agent. Time to ship. They ask Claude Code to deploy to prod — and immediately hit the secret wall.

Pasting a webhook signing secret into a chat is how secrets land in scrollback, git history, and ~/.zsh_history. Nobody wants that, but the path of least resistance is exactly that.

Watch for → Claude refuses to handle the secret itself, then bounces the work back to the human. No good options.

Gap to spot

Does the dev know why pasting is bad? A "why this matters" one-liner could land Secret Shuttle in 5 seconds vs 5 minutes of search.

curious

A bridge — refs, not values.

The dev points Claude at the Secret Shuttle skill URL. Claude reads it, summarises the model: a local daemon holds the vault, the agent works through refs like ss://stripe/prod/…, and only the human sees raw values during approval.

Watch for → The dev tells the agent. The agent doesn't proactively suggest it (yet).

Gap to spot

How does the dev actually hear about Secret Shuttle? Skill registries? Cursor / Codex marketplaces? A "Claude recommended it" path is the dream — but only if every agent ships with awareness of it.

setting up

One command, then passphrase.

Claude runs npx secret-shuttle init — one command that installs the daemon, starts it, and opens the passphrase window. The CLI never reads the passphrase. A local web window opens — the human types it directly into the daemon's UI.

Watch for → First-time unlock = "create passphrase" mode. Same window, different verb.

Gap to spot

Is the difference between "create" and "enter" obvious enough in the unlock window? Today the only signal is one line of copy.

wiring agent

Teach the agent the protocol.

init already wrote the Secret Shuttle skill for detected agents. From here, the agent knows the order — status first, prefer template run, never log raw values, surface manual_recovery_required to the human.

Watch for → Add more agents anytime: secret-shuttle agent install codex — also cursor, copilot — marker-managed so it doesn't clobber the rest of the file.

Gap to spot

Does Claude actually re-read its skills mid-session, or does it need a new session to pick the file up? The demo should be honest if it's the latter.

first win

Generate & push — two clicks.

The dev asks for an INTERNAL_CRON_SECRET in prod, on Vercel. Claude runs status, secrets set, then template run vercel-env-add. Two approval cards in sequence — generate, then publish.

Watch for → Each approval is scoped to a single action. No grant is wider than what the human just OK'd.

Gap to spot

Two approval clicks for one user intent — is that friction worth it for the audit trail, or could there be a single "this whole intent" composite approval?

marking targets

Browser opens. Marks get placed.

For the Stripe webhook handoff, Claude runs browser start. A daemon-owned Chrome window opens. Claude navigates to the webhook settings, then marks the reveal button and the secret field by opaque label.

Watch for → The daemon stores only structural metadata for each mark — no selectors, no DOM text, nothing the agent can fingerprint.

Gap to spot

The mark pick choreography (run command, then click in the browser) is delicate. Worth a per-agent runbook so agents don't fumble the dance.

blind mode 🔒

Reveal. Capture. Verify gone.

Claude calls reveal-capture. The daemon takes the wheel — blind mode engages, the daemon clicks reveal, captures the bytes from the marked scope, hides them, and proves the value is absent from every surface the daemon can observe in the DOM before resuming.

Watch for → The approval card shows the reveal label, capture mode, hide handle, and an explicit auto-resume disclosure (red).

Gap to spot

How does the dev visually know blind mode is on? Today it's CLI status. A daemon-painted overlay in Chrome itself would be reassuring.

handoff

Inject. Submit. Hand back.

Same browser, now on Vercel. Claude marks the value field + Save button, then calls inject-submit with a success marker. The daemon writes the secret, clicks save, waits for the marker, proves the secret is gone from the DOM surfaces it can observe, and only then hands observation back.

Watch for → The agent never sees the value. The argv never carries it. The success text is what the human approved.

Gap to spot

Marked field + marked submit + success text is a lot of ceremony. For the four templated providers, template run is much less work — should it be the default the skill steers agents toward?

done

All green. No one saw it.

Status reports a clean state. The Stripe webhook signing secret is in Vercel production env. The dev never saw the raw value. The agent never saw it. No argv, no env, no log line, no chat transcript ever carried the bytes.

Watch for → The closing summary references the secret by ss:// ref and fingerprint — that's the agent's vocabulary from now on.

Gap to spot

Where does the dev go next? Rotation? More providers? A "what now" CTA in the CLI itself would close the loop — right now the demo ends, the product is silent.

←→

scene 00 — claude code · one approval ships every secret

~/projects/myapp — claude

>set up all my prod secrets — stripe webhook, supabase service-role key, an internal cron secret

⏺provision--infer
⎿  Wrote secret-shuttle.yml — 3 secrets · vercel:production, supabase:<ref>
  approval_required · batch b_8f3a… · 1 approval · opening hub →

Approve in the window your browser just opened. One card covers the whole batch — you click Approve, the agent never sees a value.

⏺provision--continue --batch b_8f3a… --approval-id ag_2c1…

⎿ ✓ batch_status: completed · 3 pushed → vercel:production, supabase:<ref>

⏺audit--since 1m --json

⎿ { batches: [ b_8f3a… → 3 steps ok ] } — proof, by ss:// ref + fingerprint

Done. Three secrets live in prod. Nobody pasted anything; I never saw a value.

Secret Shuttle Approval

Secret Shuttle

Push 3 secrets from batch b_8f3a… → vercel:production, supabase:<ref>

Environmentproduction

Destinationsvercel · supabase

Agentag_2c1…

✓ Also approve any matching shape for the next 15 min

scene 01 — claude code · ~/projects/myapp

~/projects/myapp — claude

>let's deploy this to prod. you'll need to set the STRIPE_WEBHOOK_SECRET and a couple of vercel env vars

I can wire up the Vercel deployment, but I shouldn't put production secrets into my context.

Once Vercel is deployed, I'll list the env var keys you need to set. You'll have to paste the actual values into the Vercel dashboard (or share them with me only if you accept that they'll appear in this conversation).

>…there's gotta be a better way

scene 02 — claude code · reading the skill

~/projects/myapp — claude

>wait — I heard about secret-shuttle. set it up so I don't have to babysit secrets in chat

⏺WebFetch(raw.githubusercontent.com/.../SKILL.md)

⎿ Fetched 3,481 bytes — "agent operating manual"

Got it. Quick model:
  • Local daemon owns a vault, unlocked by a passphrase
    you (not me) type into a local web window.
  • I work through refs like
    ss://stripe/prod/STRIPE_WEBHOOK_SECRET — never the raw value.
  • Production actions open an approval window in your browser. You approve there. No CLI bypass.
  • For Vercel, GitHub Actions, Cloudflare, Supabase I use shipped templates — the secret reaches the CLI on stdin or a 0600 env-file. Never argv, never env.
Want me to install it?

>yes

scene 03 — installing · unlocking the vault

~/projects/myapp — claude

⏺Bash(npx secret-shuttle init)
⎿  { "daemon": "started", "pid": 8421 }
  Opening passphrase window in your browser…
  (I cannot read the passphrase. Type it into the window →)

waiting

Unlock Secret Shuttle

Create a vault passphrase

This protects every secret you'll store. The CLI never sees it. Lose it and the vault is unrecoverable.

scene 04 — installing the agent skill

~/projects/myapp — claude

init already wrote my skill — .claude/skills/secret-shuttle/SKILL.md (3,481 bytes; it detected a Claude project).

Other agents are one command away:
  secret-shuttle agent install codex     # AGENTS.md
  secret-shuttle agent install cursor    # .cursor/rules/secret-shuttle.mdc
  secret-shuttle agent install copilot   # .github/copilot-instructions.md

Skill loaded. From here I'll follow the protocol — status first, prefer template over browser, never log raw values, surface manual_recovery_required if the daemon can't prove the secret is gone.

Ready for the next request.

scene 05 — first quick win · generate + push to vercel

~/projects/myapp — claude

>generate an INTERNAL_CRON_SECRET for prod and add it to vercel

⏺Bash(secret-shuttle status --json)
⎿  daemon_reachable: true · unlocked: true
  agentic_browser.available: false (not needed)

⏺Bash(secret-shuttle secrets set \
--name INTERNAL_CRON_SECRET --env production \
--kind random_32_bytes \
--allow-domain vercel.com \
--allow-action use_as_stdin)
⎿  approval_required → opening UI

…waiting for approval (1 of 2)

Secret Shuttle Approval

✓ approved

Secret Shuttle

Generate and store a new secret ss://local/prod/INTERNAL_CRON_SECRET (production)

Environmentproduction

Injectable intovercel.com

Action scopeuse_as_stdin

Secret Shuttle Approval

Secret Shuttle

Run template vercel-env-add with secret ss://local/prod/INTERNAL_CRON_SECRET

Environmentproduction

Templatevercel-env-add

param: nameINTERNAL_CRON_SECRET

param: environmentproduction

Technical details

Binary/usr/local/bin/vercel

Binary sha2561b4f…0e7d

Deliverystdin

scene 06 — daemon-owned chrome · marking the reveal + field

claude

>ok now the stripe webhook → vercel one

⏺Bash(secret-shuttle browser start)
⎿  { "started": true,
    "proxy_url": "ws://127.0.0.1:7421/cdp/9c…" }

⏺Browser(open https://dashboard.stripe.com/webhooks)

⏺Bash(secret-shuttle browser mark pick --as reveal-btn)
⎿  (click the reveal button →)
  ▸ marked: reveal-btn

⏺Bash(... mark pick --as webhook-secret-field)
⎿  ▸ marked: webhook-secret-field
  ready for reveal-capture

Stripe Dashboard — daemon-managed Chrome

‹›

🔒dashboard.stripe.com/webhooks/we_1NaKx2…

⟳

Stripe

Developers › Webhooks › we_1NaKx2…

Endpoint signing secret

Stripe signs the webhook event body with this secret. Verify the signature before processing.

Signing secret

Signing secrets begin with whsec_ and are 38 characters.

webhook-secret-field

reveal-btn

scene 07 — reveal-capture · daemon takes the wheel

claude

⏺Bash(secret-shuttle reveal-capture \
--name STRIPE_WEBHOOK_SECRET \
--env production --source stripe \
--reveal-handle reveal-btn \
--field-handle webhook-secret-field \
--allow-domain dashboard.stripe.com \
--allow-domain vercel.com)
⎿  approval_required → opening UI

🔒 blind mode active

agent observation suspended

Stripe — daemon-managed Chrome

‹›

🔒dashboard.stripe.com/webhooks/we_1NaKx2…

⟳

Stripe

Developers › Webhooks › we_1NaKx2…

Endpoint signing secret

Signing secret

Secret Shuttle Approval

Secret Shuttle

Click reveal-btn on dashboard.stripe.com, capture into ss://stripe/prod/STRIPE_WEBHOOK_SECRET (from webhook-secret-field, mode field), hide it, and auto-resume only if the secret is verified gone from the daemon-observable DOM.

Environmentproduction

URL hostdashboard.stripe.com

Injectable intostripe.com, vercel.com

Capture modefield

Technical details

Browser targetpage/9c…f2

Reveal fpfp:b3a…d2

Field fpfp:f7e…11

Approving authorizes auto-resume only if the secret is verified gone from the daemon-observable DOM (capture and absence checks pass). If not, blind mode stays on.

scene 08 — inject-submit · daemon writes, clicks save, hands back

claude

Captured. value_visible_to_agent: false. Navigating to Vercel env vars…

⏺Bash(... browser mark focused --as value-field)
⎿  ▸ marked
⏺Bash(... browser mark pick --as save-button)
⎿  ▸ marked

⏺Bash(secret-shuttle inject-submit \
--ref ss://stripe/prod/STRIPE_WEBHOOK_SECRET \
--field-handle value-field \
--submit-handle save-button \
--success-text "Environment Variable Added" \
--domain vercel.com)
⎿  approval_required → opening UI

Vercel — daemon-managed Chrome

‹›

🔒vercel.com/acme/myapp/settings/environment-variables

⟳

▲

Vercel

acme / myapp › Settings › Env Vars

Add Environment Variable

Key

Value whsec_… (38 chars)

production

Secret Shuttle Approval

Secret Shuttle

Inject ss://stripe/prod/STRIPE_WEBHOOK_SECRET into value-field on vercel.com, click save-button, wait for success, and auto-resume only if the secret is verified gone from the daemon-observable DOM.

Environmentproduction

URL hostvercel.com

Injectable intostripe.com, vercel.com

Success markerEnvironment Variable Added

Technical details

Browser targetpage/8a…21

Field fpfp:c91…83

Submit fpfp:5e2…07

Approving authorizes auto-resume only if the secret is verified gone from the daemon-observable DOM (success and absence checks pass). If not, blind mode stays on.

scene 09 — all green · the loop closes

~/projects/myapp — claude

Injected and submitted. absence_proof: passed. Observation auto-resumed.

⏺Bash(secret-shuttle status)
⎿  daemon:           running (pid 8421)
  vault:            unlocked
  browser:          ready (proxy active)
  policy:           ok (allow-list scoped)
  local files:      ok (0600)
  agentic flows:    available

Done.
Stripe webhook signing secret is now in Vercel production env. You never saw the value. I never saw the value. It never appeared in any argv, env var, log line, or chat transcript.
  stored at:   ss://stripe/prod/STRIPE_WEBHOOK_SECRET
  fingerprint: sha256:9c7…f2a
Next time you need a secret, just ask.

Shipped without seeing it →

ss://stripe/prod/STRIPE_WEBHOOK_SECRET

fingerprint:

sha256:9c7…f2a