#239 feat: redesign auth → secret subcommand (#216)

[Anonymous]

Originally created by: kumaakh

Summary

• Redesigns the internal apra-fleet auth subcommand into a user-facing apra-fleet secret CLI
• Adds credential store path hardening: CREDENTIALS_PATH is now resolved at call-time via getCredentialsPath(), respecting APRA_FLEET_DATA_DIR env var
• Implements full secret CLI: --set (OOB delivery + persist), --list (table, no values), --update (metadata), --delete (single/all with confirmation)
• Upgrades credential_store_set OOB to three-signal flow: spawn terminal + tool message + info log; kills terminal PID on receipt
• Keeps auth as undocumented backward-compatible alias
• Default network_policy is deny per requirements (confirm reserved for V2)
• 40 new tests (secret-cli.test.ts + credential-store-path.test.ts); 1143 passing

Test plan

• [ ] npm run build — passes clean
• [ ] npm test — 1143 passed, 6 skipped; 3 pre-existing auth-socket timing flakes on Windows named pipes (not introduced by this sprint)
• [ ] apra-fleet secret --help shows correct synopsis
• [ ] apra-fleet --help shows secret lines, auth line removed
• [ ] apra-fleet auth <name> still works (backward compat alias)
• [ ] APRA_FLEET_DATA_DIR=/tmp/test apra-fleet secret --list reads from /tmp/test/credentials.json

🤖 Generated with Claude Code

[Anonymous]

Ticket changed by: kumaakh

• status: open --> closed