feat: phantom add --stdin + phantom sync --only filter

[masonwyatt23]

Summary

• phantom add KEY (no positional value) now prompts silently on the terminal via rpassword so the secret never enters shell history or the process arg list. Positional phantom add KEY VALUE still works for backward compat.
• phantom add KEY --stdin reads one line from a piped stdin, trims the trailing newline. For CI / secret-manager pipelines: echo "$VAL" | phantom add KEY --stdin. Bails with a clear error if stdin is not a tty and --stdin is not set, so CI jobs never hang silently.
• phantom sync --only PATTERN filters which keys are pushed using glob syntax (STRIPE_*, *_KEY). Multiple --only flags are OR-ed. Also wired into the [[sync]] toml block as only = ["STRIPE_*"] so phantom sync (no flags) respects it. Filters are applied per-target and merged with any CLI flags.

Changed files

File	What changed
crates/phantom-cli/Cargo.toml	Added rpassword, libc deps
crates/phantom-core/Cargo.toml	Added glob, tracing deps
crates/phantom-cli/src/commands/add.rs	Optional value arg + --stdin flag + tty check
crates/phantom-cli/src/main.rs	Updated Add + Sync subcommand definitions and dispatch
crates/phantom-cli/src/commands/sync.rs	only: Vec<String> param, filter applied before push
crates/phantom-cli/src/commands/rotate.rs	Pass empty only to sync::run (arity fix)
crates/phantom-core/src/sync.rs	only field on SyncTarget, filter_by_only() helper
crates/phantom-cli/tests/add_stdin_test.rs	5 new integration tests for --stdin
docs/getting-started.md	Examples for both new features

Test plan

• cargo build && cargo test from workspace root — all 118 tests pass, 3 ignored (cloud, require auth token)
• phantom add MY_KEY interactively — value prompted silently on terminal, does not appear in ps aux or history
• echo "myval" | phantom add MY_KEY --stdin — stores correctly, .env gets phantom token
• phantom add MY_KEY --stdin with empty stdin (echo "" | ...) — exits non-zero with clear message
• phantom add MY_KEY piped (non-tty, no --stdin) — exits non-zero, does not hang
• phantom sync --only "STRIPE_*" — only STRIPE_* keys pushed; OPENAI_KEY skipped
• phantom sync --only "STRIPE_*" --only "SENDGRID_*" — OR union works
• [[sync]] only = ["STRIPE_*"] in .phantom.toml — phantom sync (no flags) respects it
• phantom sync with no --only and no toml only — all secrets pushed (no regression)

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
web	Canceled		Apr 29, 2026 8:40pm