# KeyVault Sidekick integration

When the user asks to "save a key to KeyVault", "send to my vault",
"save this secret", "store this in KeyVault", or similar:

1. URL-encode the name, value, type, project, and notes.
2. Build this URL:
   https://keyvault-sidekick.pages.dev/app.html#action=prefill&name=<N>&value=<V>&type=<T>&project=<P>&notes=<X>

   Where:
     <N> = URL-encoded key name (e.g. STRIPE_API_KEY)
     <V> = URL-encoded secret value
     <T> = one of: api_key, secret, token, oauth, webhook, other
           (default: api_key)
     <P> = URL-encoded project name (ask user if not provided)
     <X> = URL-encoded notes (optional)

3. Open the URL in the user's default browser via shell:
     start "" "<URL>"     # Windows
     open "<URL>"         # macOS
     xdg-open "<URL>"     # Linux

4. Confirm to the user: "Opening KeyVault — review and click Save key
   in the prefill modal."

Reading existing keys back out of KeyVault:
- KeyVault has no API — the vault is fully client-side and encrypted.
- If the user wants you to use existing keys, ask them to click
  "Hand off to AI ↗" inside the vault's project view. That copies a
  paste-ready prompt containing the project's KEY=value pairs plus
  guardrails (don't echo, don't log, don't commit). They'll paste it
  back into this chat.

Notes:
- KeyVault Sidekick is free and needs no sign-in — opening the URL goes
  straight to the vault, which pops the prefill modal once it's unlocked.
- The user must have their vault unlocked (master password) to save the key.
- The secret value appears in this chat, the shell command, and the
  browser URL bar (~100ms). For maximum-secrecy keys, the user should
  paste directly into the vault's Add Key form instead.