Save a secret. The value is sealed and never returned.

kind: env sets the environment variable name on every session that uses it; name follows environment-variable rules and may not be one Rush sets itself. kind: header never reaches the session's environment: E2B's egress proxy adds header_name: header_format(value) to the session's HTTPS requests to each host in targets, outside the sandbox. Basic {value} takes username:password and encodes it. A header secret's name is a label (letters, digits, ., -, _). kind: login takes one https origin in targets plus username, password and an optional base32 totp_secret. Its value is never in the session's environment or conversation: the agent runs rush-sign-in <name> and Rush types it into the session's browser on that origin only. The agent shares that browser, so this keeps the value out of the transcript, not out of the sandbox. project_id is required: the secret reaches every session in that Project.