Secrets | GigLabo

Secret Value Modes

Mode	Syntax	Example
Script	Path ending in `.sh`, `.cmd`, `.ps1`, `.bat`	`~/.heretic/get-key.sh`
Env var	`$VAR` or `${VAR}` (entire value)	`$MY_HOST_TOKEN`
Plain	Anything else	`sk-ant-api03-abc123...`

secrets:
  # Script (executed, stdout is the value)
  ANTHROPIC_API_KEY: "~/.heretic/get-anthropic-key.sh"
  ZAI_API_KEY: "~/.heretic/get-secret.sh zai"

  # Env var reference (resolved from host environment)
  GH_TOKEN: "$GITHUB_TOKEN"

  # Plain value (used as-is)
  CUSTOM_KEY: "my-api-key-12345"

How It Works

Before starting the agent, the CLI executes each script
The script's stdout (trimmed) becomes the environment variable value
Resolved secrets are merged into the variable context for ${VAR} interpolation
Secrets are passed as environment variables to the container

Runtime Resolution

Secrets are resolved at runtime, not stored. If a script fails, the agent won't start.

Script Requirements

Must be executable (chmod +x on Unix; .cmd/.ps1 on Windows)
Must output the secret value to stdout (single line)
Must exit with code 0 on success
Has a 30-second timeout
Can accept arguments: "~/.heretic/get-secret.sh my-key-name"

Cross-Platform Execution

Extension	Unix	Windows
`.sh`	Default shell	`bash` (Git Bash / WSL)
`.cmd` / `.bat`	N/A	`cmd.exe`
`.ps1`	N/A	`powershell -ExecutionPolicy Bypass -File`

Example Scripts

1Password CLI

#!/bin/bash
op read 'op://Personal/Anthropic API/credential'

macOS Keychain

#!/bin/bash
security find-generic-password -s "heretic-$1" -w

GitHub CLI

#!/bin/bash
gh auth token

pass (GPG-encrypted store)

#!/bin/bash
pass show "heretic/$1"

AWS Secrets Manager

#!/bin/bash
aws secretsmanager get-secret-value --secret-id "$1" --query SecretString --output text

Windows (1Password CLI)

@echo off
op read "op://Personal/Anthropic API/credential"

Using Secrets in Env

Resolved secrets are available for ${VAR} interpolation:

secrets:
  ANTHROPIC_API_KEY: "~/.heretic/get-anthropic-key.sh"

env:
  # Reference the resolved secret
  ANTHROPIC_API_KEY: "${ANTHROPIC_API_KEY}"