modscode / Gallery / secret-broker
secret-broker
Pops up when Claude needs an API key or token for a terminal command and injects it without Claude ever seeing it
What it does
- Draws a band above the prompt, a pane, the status line, toasts
- Adds /secrets
- Watches Bash, PowerShell calls and can refuse them
- Hooks prompt.compose, prompt.submit, session.start, turn.complete and 1 more
- Keeps its own state between turns
Good points
- No network calls
- Written in TypeScript
- Handles errors
Code to start from
Two kinds: a starter modscode writes from the design above, and the lines of the mod's own code that draw it.
Starter (register.tsx)
import type { Register } from 'claude-code'
// Drawn like secret-broker by cesarroger (pane, band, status, toast), as modscode read it from the mod's code:
// https://modscode.com/gallery/cesarroger-secret-broker/
// Written by modscode from that reading, not copied from the mod: use it as you like.
// Each value below stands for one the mod works out at run time; put in your own.
export const register: Register = on => {
// the band above the prompt; what else goes there is drawn under it
on('ui.render', { component: 'AbovePrompt' }, async ($, e, next) => {
const { Box, Text, Button } = $.ui.resolve(e)
const line = '…'
const line2 = '…'
const line3 = '…'
return (
<Box flexDirection="column">
<Box flexDirection="row" borderStyle="round" borderColor="#ff5e1a" backgroundColor="#120804" paddingX={1} alignItems="center">
<Box flexDirection="column">
<Text color="#d9822b" bold>
{line}
</Text>
<Text color="#d9822b" bold>
{line2}
</Text>
<Text color="#d9822b" bold>
{line3}
</Text>
</Box>
<Box flexDirection="column" paddingX={1} flexGrow={1}>
<Text color="#d9822b" bold>
THE LOG HAS NOTICED.
</Text>
<Text color="#ffe9c7">
Claude just asked you to handle a key step yourself. The log can take it from here.
</Text>
</Box>
<Button variant="primary" hotkey="l" label="Feed the log" />
<Text>
{" "}
</Text>
<Button dimColor label="Dismiss" />
</Box>
{await next(e)}
</Box>
)
})
// the pane: open it with $.ui.open({ id: 'my-pane', title: "Secret needed" })
on('ui.render', { component: 'Pane', requestId: 'my-pane' }, async ($, e) => {
const { Box, Text, Input, Button } = $.ui.resolve(e)
const line = '…'
const line2 = '…'
const line3 = '…'
const logLine = '…'
const command = '…'
const name = '…'
const name2 = '…'
const name3 = '…'
const note = '…'
const missing = '…'
return (
<Box flexDirection="column" backgroundColor="#120804" paddingX={1}>
<Box flexDirection="row" alignItems="center">
<Box flexDirection="column">
<Text color="#d9822b" bold>
{line}
</Text>
<Text color="#d9822b" bold>
{line2}
</Text>
<Text color="#d9822b" bold>
{line3}
</Text>
</Box>
<Box flexDirection="column" paddingX={1}>
<Text color="#ff5e1a" bold>
{"▌ THE LOG REQUIRES "}
A SECRET
</Text>
<Text color="#d9822b" italic>
{logLine}
</Text>
<Text color="#ffe9c7" dimColor>
Claude never sees the value. It goes to this one command, then it is gone.
</Text>
</Box>
</Box>
<Box flexDirection="column" borderStyle="round" borderColor="#3b1f0e" paddingX={1}>
<Text color="#d9822b" bold>
the command, exactly as it will run
</Text>
<Text color="#ffe9c7" wrap="wrap">
{command}
</Text>
</Box>
<Box flexDirection="column" borderStyle="round" borderColor="#d9822b" paddingX={1}>
<Box flexDirection="column">
<Text color="#ff5e1a" bold>
{"◯ "}
{name}
</Text>
<Input label=" ▶ " placeholder="paste it here, press Enter. the log is watching." autoFocus submitLabel="feed" />
<Box flexDirection="row">
<Button>
From clipboard
</Button>
<Text>
{" "}
</Text>
<Button>
Use saved
</Button>
</Box>
</Box>
</Box>
<Box flexDirection="column" borderStyle="round" borderColor="#d9822b" paddingX={1}>
<Box flexDirection="column">
<Text color="#ff5e1a" bold>
{"◯ "}
{name2}
</Text>
<Input label=" ▶ " placeholder="paste it here, press Enter. the log is watching." autoFocus submitLabel="feed" />
<Box flexDirection="row">
<Button>
From clipboard
</Button>
<Text>
{" "}
</Text>
<Button>
Use saved
</Button>
</Box>
</Box>
</Box>
<Box flexDirection="column" borderStyle="round" borderColor="#d9822b" paddingX={1}>
<Box flexDirection="column">
<Text color="#ff5e1a" bold>
{"◯ "}
{name3}
</Text>
<Input label=" ▶ " placeholder="paste it here, press Enter. the log is watching." autoFocus submitLabel="feed" />
<Box flexDirection="row">
<Button>
From clipboard
</Button>
<Text>
{" "}
</Text>
<Button>
Use saved
</Button>
</Box>
</Box>
</Box>
<Text color="#ff5e1a" bold>
{"! "}
{note}
</Text>
<Button plain dimColor label="◉ the log remembers these for this session" />
<Box flexDirection="row" paddingY={1} alignItems="center">
<Text color="#d9822b" dimColor>
{"the log waits for: "}
{missing}
</Text>
<Text>
{" "}
</Text>
<Button role="dismiss" hotkey="n">
Decline
</Button>
</Box>
</Box>
)
})
on('session.start', async ($, e, next) => {
const names = '…'
await $.ui.status(`secret-broker: waiting for ${names}`)
await $.ui.toast(`secret-broker: a command needs a secret; widen the window to see the pane`)
await $.ui.toast(`secret-broker reloaded and dropped the pending secret request; ask Claude to run the command again`)
return next(e)
})
}
The mod's own code
Its licence text was not found at the commit read, so only the places in the source are linked.
What its code calls
runs programswrites filesenv varsdrives Claudetool callsremembers
The design, read from code
Drawn from the mod's source at the commit read, not from a run: a list is drawn three times, a condition takes its first branch that draws in the desktop app, and a value only the run time knows is shown as a made-up sample (dotted underline) or left out. Colours and type are this site's.
What its code shows
Read from the source at commit 15114133b3cd on 2026-10-06. The first group decides whether a mod is listed; the rest is for you to weigh. A later commit is not read until the next crawl.
| Decides the listing: code you can check | |
|---|---|
| Entry read | Every module hooks/hooks.json names was read.hooks/register.tsx |
| Parses | Every file parses as TypeScript or JavaScript.1 files parsed |
| All its code is in the mod | Every import is a file of the mod or the engine's own module; no packages, no require.all its code is in the mod |
| Readable | No minified lines, no eval or new Function, no import of a computed path, no encoded blobs.no minified code, no eval, no encoded blobs |
| Calls in the open | Network and programs are reached as $.http.fetch and $.process.run in place, never passed around.every call outside goes through $ in the open |
| For you to weigh before installing | |
| Where it draws | The terminal, the desktop app, both, or nothing (hooks only: a guard or a prompt rewriter), as its code says. Shown, never a reason to leave a mod out.draws in the terminal and the desktop app, the same in both |
| Install line | Whether its repository's own .claude-plugin/marketplace.json lists it, so it installs from that marketplace with the lines on its page.its repository's .claude-plugin/marketplace.json does not list it: no install line to give |
| Programs on Windows | Whether every program it starts through $.process exists on Windows (tail, date, open, osascript, /usr/… do not).hooks/register.tsx:239 /bin/sh (not on Windows); hooks/register.tsx:261 /bin/rm (not on Windows) |
| Network | Whether every fetch names its https host in the code.no network |
| Programs | Whether every program it starts is named in the code and is not a shell, an interpreter or a network tool.hooks/register.tsx:155 a program named at run time; hooks/register.tsx:239 /bin/sh (a shell or interpreter); hooks/register.tsx:272 cmd.exe (a shell or interpreter) |
| Reads and sends | Whether it both reads files or environment variables and reaches the network.reaches no network |
| Keys in the source | Whether the source holds what looks like an API key or a private key.no keys in the source |
| Licence | An open licence (MIT, Apache-2.0, BSD, ISC, Unlicense, 0BSD, CC0) with its text lets modscode show its code; otherwise the code is linked.no licence |
This is a reading of the code text, not a security review: it does not run the mod, and it cannot see what a program the mod starts does. The check before installing is yours. How mods are chosen
Install it
Check it yourself before you install it. Mods run unsandboxed, with your permissions, and modscode does not vouch for what this code does. Read the code below (or run claude plugin validate . in its folder), weigh what it reaches, and install the commit you read.
Its repository's .claude-plugin/marketplace.json does not list it, so there is no install line to give. Read it as code, or follow its author's README.
Ask Claude about it
With the modscode connector added, Claude can read this design, what its code reaches and its code, and build on them. Ask it like this:
Read the modscode design "cesarroger-secret-broker" with its code and make me a pane like itSearch them from Claude: the MCP connector
Similar designs
-
Ask Claude…2h 10m · █████░░░✓ build ✓ build ✓ buildJavaKotlin3 Python■ ok 3 ■ ok 3 ■ ok 3 Razor proven 3 Razor proven 3 Razor proven 3Phases ──────── 3/3build Pythonbuild Pythonbuild Python… 3 more phasesLua ──────── 3/Kotlin■ the whole upgrade Ruby■ build build Ruby■ build build Ruby■ build build Ruby … 3 moreNext ──────── PythonRuby (by hand)Podsclick a button, or ctrl+x tab then Tab, EnterAttention ──────── 3! Scala ! Scala ! Scala … 3 moreSession ──────── okJava
-
Ask Claude…agent-discoverbuildbuildbuildRefreshMCP Browse/3Tab / shift+Tab move · Enter presses · ↑↓ scroll · Esc back to the promptBrowse...Audit asks:DeclineAcceptDeclineCancelAudit asks:DeclineAcceptDeclineCancelAudit asks:DeclineAcceptDeclineCancel
-
spending-effort-with-jev: no TypeSafe API key, so effort tips are off. Set it in /plugin.⚠ effort: long run, fuzzy spec → have Claude interview you, then go maxAsk Claude…
-
✦ explain as pick how Claude answers×3 ● build3 ● build3 ● build▸ VideoAsk Claude…
-
Ask Claude…superpowersϟ Arc tokens showing buildNot now██ FinalFinal42%:1 ✓██ FinalFinal42%:1 ✓██ FinalFinal42%:1 ✓███ brand gradient (OKLCH)Not now██ FinalFinal42%:1 ✓██ FinalFinal42%:1 ✓██ FinalFinal42%:1 ✓███ brand gradient (OKLCH)Not now██ FinalFinal42%:1 ✓██ FinalFinal42%:1 ✓██ FinalFinal42%:1 ✓███ brand gradient (OKLCH)d darkl lightz daltonizeda ansiu auto
-
Ask Claude…────────Clear doneClaude⋯└─ buildCancelCancelCancel└─ buildCancelCancelCancel└─ buildCancelCancelCancel