Save a secret. The value is sealed and never returned.

kind: env sets the environment variable name on every session that uses it; name follows environment-variable rules and may not be one Rush sets itself. kind: header never reaches the session's environment: E2B's egress proxy adds header_name: header_format(value) to the session's HTTPS requests to each host in targets, outside the sandbox. Basic {value} takes username:password and encodes it. A header secret's name is a label (letters, digits, ., -, _). kind: login takes one https origin in targets plus username, password and an optional base32 totp_secret. Its value is never in the session's environment or conversation: the agent runs rush-sign-in <name> and Rush types it into the session's browser on that origin only. The agent shares that browser, so this keeps the value out of the transcript, not out of the sandbox. source: onepassword (header and login only; an environment variable is readable by the agent, so it stays in Rush) stores no value: value is an op:// reference, read with the creator's connected 1Password service account when a session starts or signs in. A header takes one field (op://Vault/Item/field), a login takes the item (op://Vault/Item, read as its username, password and, with totp: true, its one-time code). The reference must be readable when it is saved, or the request is refused with a SECRET_ONEPASSWORD_* code. project_id is required: the secret reaches every session in that Project.