waveterm/docs/docs/wsh-reference.mdx

---
sidebar_position: 4.1
id: "wsh-reference"
title: "wsh reference"
---

import { Kbd } from "@site/src/components/kbd";
import { PlatformProvider, PlatformSelectorButton } from "@site/src/components/platformcontext";

<PlatformProvider>

# wsh command

The `wsh` command is always available from Wave blocks. It is a powerful tool for interacting with Wave blocks and can bridge data between your CLI and the widget GUIs.

This is the detailed wsh reference documention. For an overview of `wsh` functionality, please see our [wsh command docs](/wsh).

---

## view

You can open a preview block with the contents of any file or directory by running:

```sh
wsh view [path]
wsh view -m [path]           # opens in magnified block
```

You can use this command to easily preview images, markdown files, and directories. For code/text files this will open
a codeedit block which you can use to quickly edit the file using Wave's embedded graphical editor.

---

## edit

```sh
wsh edit [path]
wsh edit -m [path]           # opens in magnified block
```

This will open up a codeedit block for the specified file. This is useful for quickly editing files on a local or remote machine in Wave's graphical editor. This command returns immediately after opening the block. 

For `$EDITOR` integration (e.g. with `git commit`), see [`wsh editor`](#editor) which blocks until the editor is closed.

---

## editor

```sh
wsh editor [path]
wsh editor -m [path]         # opens in magnified block
```

This opens a codeedit block for the specified file and **blocks until the editor is closed**. This is useful for setting your `$EDITOR` environment variable so that CLI tools (e.g. `git commit`, `crontab -e`) open files in Wave's graphical editor:

```sh
export EDITOR="wsh editor"
```

The file must already exist. Use `-m` to open the editor in magnified mode.

---

## getmeta

You can view the metadata of any block or tab by running:

```sh
# get the metadata for the current terminal block
wsh getmeta

# get the metadata for block num 2 (see block numbers by holidng down Ctrl+Shift)
wsh getmeta -b 2

# get the metadata for a blockid (get block ids by right clicking any block header "Copy Block Id")
wsh getmeta -b [blockid]

# get the metadata for a tab
wsh getmeta -b tab

# dump a single metadata key
wsh getmeta [-b [blockid]] [key]

# dump a set of keys with a certain prefix
wsh getmeta -b tab "bg:*"

# dump a set of keys with prefix (and include the 'clear' key)
wsh getmeta -b tab --clear-prefix "bg:*"
```

This is especially useful for preview and web blocks as you can see the file or url that they are pointing to and use that in your CLI scripts.

blockid format:

- `this` -- the current block (this is also the default)
- `tab` -- the id of the current tab
- `d6ff4966-231a-4074-b78a-20acc7226b41` -- a full blockid is a UUID
- `a67f55a3` -- blockids may be truncated to the first 8 characters
- `5` -- if a number less than 100 is given, it is a block number. blocks are numbered sequentially in the current tab from the top-left to bottom-right. holding <Kbd k="Ctrl:Shift"/> will show a block number overlay.

---

## setmeta

You can update any metadata key value pair for blocks (and tabs) by using the setmeta command. The setmeta command takes the same `-b` arguments as getmeta.

```sh
wsh setmeta -b [blockid] [key]=[value]
wsh setmeta -b [blockid] file=~/myfile.txt
wsh setmeta -b [blockid] url=https://waveterm.dev/

# set the metadata for the current tab using the given json file
wsh setmeta -b tab --json [jsonfile]

# set the metadata for the current tab using a json file read from stdin
wsh setmeta -b tab --json
```

You can get block and tab ids by right clicking on the appropriate block and selecting "Copy BlockId" (or use the block number via Ctrl:Shift). When you
update the metadata for a preview or web block you'll see the changes reflected instantly in the block.

Other useful metadata values to override block titles, icons, colors, themes, etc.

Here's a complex command that will copy the background (bg:\* keys) from one tab to the current tab:

```sh
wsh getmeta -b [other-tab-id] "bg:*" --clear-prefix | wsh setmeta -b tab --json -
```

---

## ai

Append content to the Wave AI sidebar. Files are attached as proper file attachments (supporting images, PDFs, and text), not encoded as text. By default, content is added to the sidebar without auto-submitting, allowing you to review and add more context before sending to the AI.

You can attach multiple files at once (up to 15 files). Use `-m` to add a message along with files, `-s` to auto-submit immediately, and `-n` to start a new chat conversation. Use "-" to read from stdin.

```sh
# Pipe command output to AI (ask question in UI)
git diff | wsh ai -
docker logs mycontainer | wsh ai -

# Attach files without auto-submit (review in UI first)
wsh ai main.go utils.go
wsh ai screenshot.png logs.txt

# Attach files with message
wsh ai app.py -m "find potential bugs"
wsh ai *.log -m "analyze these error logs"

# Auto-submit immediately
wsh ai config.json -s -m "explain this configuration"
tail -n 50 app.log | wsh ai -s - -m "what's causing these errors?"

# Start new chat and attach files
wsh ai -n report.pdf data.csv -m "summarize these reports"

# Attach different file types (images, PDFs, code)
wsh ai architecture.png api-spec.pdf server.go -m "review the system design"
```

**File Size Limits:**
- Text files: 200KB maximum
- PDF files: 5MB maximum
- Image files: 7MB maximum (accounts for base64 encoding overhead)
- Maximum 15 files per command

**Flags:**
- `-m, --message <text>` - Add message text along with files
- `-s, --submit` - Auto-submit immediately (default waits for user)
- `-n, --new` - Clear current chat and start fresh conversation

---

## editconfig

You can easily open up any of Wave's config files using this command.

```sh
wsh editconfig [config-file-name]

# opens the default settings.json file
wsh editconfig

# opens presets.json
wsh editconfig presets.json

# opens widgets.json
wsh editconfig widgets.json

# opens ai presets
wsh editconfig presets/ai.json
```

---

## setbg

The `setbg` command allows you to set a background image or color for the current tab with various customization options.

```sh
wsh setbg [--opacity value] [--tile|--center] [--size value] (image-path|"#color"|color-name)
```

You can set a background using:

- An image file (displayed as cover, tiled, or centered)
- A hex color (must be quoted like "#ff0000")
- A CSS color name (like "blue" or "forestgreen")

Flags:

- `--opacity value` - set the background opacity (0.0-1.0, default 0.5)
- `--tile` - tile the background image instead of using cover mode
- `--center` - center the image without scaling (good for logos)
- `--size` - size for centered images (px, %, or auto)
- `--clear` - remove the background
- `--print` - show the metadata without applying it

Supported image formats: JPEG, PNG, GIF, WebP, and SVG.

Examples:

```sh
# Set an image background with default settings
wsh setbg ~/pictures/background.jpg

# Set a background with custom opacity
wsh setbg --opacity 0.3 ~/pictures/light-pattern.png

# Set a tiled background
wsh setbg --tile --opacity 0.2 ~/pictures/texture.png

# Center an image (good for logos)
wsh setbg --center ~/pictures/logo.png
wsh setbg --center --size 200px ~/pictures/logo.png

# Set color backgrounds
wsh setbg "#ff0000"          # hex color (requires quotes)
wsh setbg forestgreen        # CSS color name

# Change just the opacity of current background
wsh setbg --opacity 0.7

# Remove background
wsh setbg --clear

# Preview the metadata
wsh setbg --print "#ff0000"
```

The command validates that:

- Color values are valid hex codes or CSS color names
- Image paths point to accessible, supported image files
- The opacity value is between 0.0 and 1.0
- The center and tile options are not used together

:::tip
Use `--print` to preview the metadata for any background configuration without applying it. You can then copy this JSON representation to use as a [Background Preset](/presets#background-configurations)
:::

---

## run

The `run` command creates a new terminal command block and executes a specified command within it. The command can be provided either as arguments after `--` or using the `-c` flag. Unless the `-x` or `-X` flags are passed, commands can be re-executed by pressing `Enter` once the command has finished running.

```sh
# Run a command specified after --
wsh run -- ls -la

# Run a command using -c flag
wsh run -c "ls -la"

# Run with working directory specified
wsh run --cwd /path/to/dir -- ./script.sh

# Run in magnified mode
wsh run -m -- make build

# Run and auto-close on successful completion
wsh run -x -- npm test

# Run and auto-close regardless of exit status
wsh run -X -- ./long-running-task.sh
```

The command inherits the current environment variables and working directory by default.

Flags:

- `-m, --magnified` - open the block in magnified mode
- `-c, --command string` - run a command string in _shell_
- `-x, --exit` - close block if command exits successfully (stays open if there was an error)
- `-X, --forceexit` - close block when command exits, regardless of exit status
- `--delay int` - if using -x/-X, delay in milliseconds before closing block (default 2000)
- `-p, --paused` - create block in paused state
- `-a, --append` - append output on command restart instead of clearing
- `--cwd string` - set working directory for command

Examples:

```sh
# Run a build command in magnified mode
wsh run -m -- npm run build

# Execute a script and auto-close after success
wsh run -x -- ./backup-script.sh

# Run a command in a specific directory
wsh run --cwd ./project -- make test

# Run a shell command and force close after completion
wsh run -X -c "find . -name '*.log' -delete"

# Start a command in paused state
wsh run -p -- ./server --dev

# Run with custom close delay
wsh run -x --delay 5000 -- ./deployment.sh
```

When using the `-x` or `-X` flags, the block will automatically close after the command completes. The `-x` flag only closes on successful completion (exit code 0), while `-X` closes regardless of exit status. The `--delay` flag controls how long to wait before closing (default 2000ms).

The `-p` flag creates the block in a paused state, allowing you to review the command before execution.

:::tip
You can use either `--` followed by your command and arguments, or the `-c` flag with a quoted command string. The `--` method is preferred when you want to preserve argument handling, while `-c` is useful for shell commands with pipes or redirections.
:::

---

## deleteblock

```sh
wsh deleteblock -b [blockid]
```

This will delete the block with the specified id.

---

## ssh

```sh
wsh ssh [user@host]
```

This will use Wave's internal ssh implementation to connect to the specified remote machine. The `-i` flag can be used to specify a path to an identity file.

---

## wsl

```sh
wsh wsl [-d <distribution-name>]
```

This will connect to a WSL distribution on the local machine. It will use the default if no distribution is provided.

---

## web

The `web` command opens URLs in a web block within Wave Terminal.

```sh
wsh web open [url] [-m] [-r blockid]
```

You can open a specific URL or perform a search using the configured search engine.

Flags:

- `-m, --magnified` - open the web block in magnified mode
- `-r, --replace <blockid>` - replace an existing block instead of creating a new one

Examples:

```sh
# Open a URL
wsh web open https://waveterm.dev

# Search with the configured search engine
wsh web open "wave terminal documentation"

# Open in magnified mode
wsh web open -m https://github.com

# Replace an existing block
wsh web open -r 2 https://example.com
```

The command will open a new web block with the desired page, or replace an existing block if the `-r` flag is used. Note that `--replace` and `--magnified` cannot be used together.

---

## notify

The `notify` command creates a desktop notification from Wave Terminal.

```sh
wsh notify [message] [-t title] [-s]
```

This allows you to trigger desktop notifications from scripts or commands. The notification will appear using your system's native notification system. It works on remote machines as well as your local machine.

Flags:

- `-t, --title string` - set the notification title (default "Wsh Notify")
- `-s, --silent` - disable the notification sound

Examples:

```sh
# Basic notification
wsh notify "Build completed successfully"

# Notification with custom title
wsh notify -t "Deployment Status" "Production deployment finished"

# Silent notification
wsh notify -s "Background task completed"
```

This is particularly useful for long-running commands where you want to be notified of completion or status changes.

---

## conn

This has several subcommands which all perform various features related to connections.

### status

```sh
wsh conn status
```

This command gives the status of all connections made since waveterm started.

### reinstall

For ssh connections,

```sh
wsh conn reinstall [user@host]
```

For wsl connections,

```sh
wsh conn reinstall [wsl://<distribution-name>]
```

This command reinstalls the Wave Shell Extensions on the specified connection.

### disconnect

For ssh connections,

```sh
wsh conn disconnect [user@host]
```

For wsl connections,

```sh
wsh conn disconnect [wsl://<distribution name>]
```

This command completely disconnects the specified connection. This will apply to all blocks where the connection is being used

### connect

For ssh connections,

```sh
wsh conn connect [user@host]
```

For wsl connections,

```sh
wsh conn connect [wsl://<distribution-name>]
```

This command connects to the specified connection but does not create a block for it.

### ensure

For ssh connections,

```sh
wsh conn ensure [user@host]
```

For wsl connections,

```sh
wsh conn ensure [wsl://<distribution-name>]
```

This command connects to the specified connection if it isn't already connected.

---

## setconfig

```sh
wsh setconfig [<config-name>=<config-value>]
```

This allows setting various options in the `config/settings.json` file. It will check to be sure a valid config option was provided.

---

## file

The `file` command provides a set of subcommands for managing files across different storage systems, such as `wsh` remote servers.

:::note

Wave Terminal is capable of managing files from remote SSH hosts. Files are addressed via URIs, which
vary depending on the storage system. If no scheme is specified, the file will be treated as a local connection.

URI format: `[profile]:[uri-scheme]://[connection]/[path]`

Supported URI schemes:

- `wsh` - Used to access files on remote hosts over SSH via the WSH helper. Allows for file streaming to Wave and other remotes.

  Profiles are optional for WSH URIs, provided that you have configured the remote host in your "connections.json" or "~/.ssh/config" file.

  If a profile is provided, it must be defined in "profiles.json" in the Wave configuration directory.

  Format: `wsh://[remote]/[path]`

  Shorthands can be used for the current remote and your local computer:
  `[path]` a relative or absolute path on the current remote
  `//[remote]/[path]` a path on a remote
  `/~/[path]` a path relative to the home directory on your local computer

:::

### cat

```sh
wsh file cat [file-uri]
```

Display the contents of a file (maximum file size 10MB). For example:

```sh
wsh file cat wsh://user@ec2/home/user/config.txt
wsh file cat ./local-config.txt
```

### write

```sh
wsh file write [file-uri]
```

Write data from stdin to a file. The maximum file size is 10MB. For example:

```sh
echo "hello" | wsh file write ./greeting.txt
cat config.json | wsh file write //ec2-user@remote01/~/config.json
```

### append

```sh
wsh file append [file-uri]
```

Append data from stdin to a file. Input is buffered locally (up to 10MB total file size limit) before being written. For example:

```sh
cat additional-content.txt | wsh file append ./notes.txt
echo "new line" | wsh file append //user@remote/~/notes.txt
```

### rm

```sh
wsh file rm [flag] [file-uri]
```

Remove a file. For example:

```sh
wsh file rm wsh://user@ec2/home/user/config.txt
wsh file rm ./local-config.txt
```

Flags:

- `-r, --recursive` - recursively deletes directory entries

### info

```sh
wsh file info [file-uri]
```

Display information about a file including size, creation time, modification time, and metadata. For example:

```sh
wsh file info wsh://user@ec2/home/user/config.txt
wsh file info ./local-config.txt
```

### cp

```sh
wsh file cp [flags] [source-uri] [destination-uri]
```

Copy files between different storage systems (maximum file size 10MB). For example:

```sh
# Copy a remote file to your local filesystem
wsh file cp wsh://user@ec2/home/user/config.txt ./local-config.txt

# Copy a local file to a remote system
wsh file cp ./local-config.txt wsh://user@ec2/home/user/config.txt

# Copy between remote systems
wsh file cp wsh://user@ec2/home/user/config.txt wsh://user@server2/home/user/backup.txt
```

Flags:

- `-f, --force` - overwrites any conflicts when copying
- `-m, --merge` - does not clear existing directory entries when copying a directory, instead merging its contents with the destination's

### mv

```sh
wsh file mv [flags] [source-uri] [destination-uri]
```

Move files between different storage systems (maximum file size 10MB). The source file will be deleted once the operation completes successfully. For example:

```sh
# Move a remote file to your local filesystem
wsh file mv wsh://user@ec2/home/user/config.txt ./local-config.txt

# Move a local file to a remote system
wsh file mv ./local-config.txt wsh://user@ec2/home/user/config.txt

# Move between remote systems
wsh file mv wsh://user@ec2/home/user/config.txt wsh://user@server2/home/user/backup.txt
```

Flags:

- `-f, --force` - overwrites any conflicts when moving

### ls

```sh
wsh file ls [flags] [file-uri]
```

List files in a directory. By default, lists files in the current directory for the current terminal session.

Examples:

```sh
wsh file ls wsh://user@ec2/home/user/
wsh file ls ./local-dir/
```

Flags:

- `-l, --long` - use long listing format showing size, timestamps, and metadata
- `-1, --one` - list one file per line
- `-f, --files` - list only files (no directories)

When output is piped to another command, automatically switches to one-file-per-line format:

```sh
# Easy to process with grep, awk, etc.
wsh file ls ./ | grep ".json$"
```

---

## launch

The `wsh launch` command allows you to open pre-configured widgets directly from your terminal.

```sh
wsh launch [flags] widget-id
```

The command will search for the specified widget ID in both user-defined widgets and default widgets, then create a new block using the widget's configuration.

Flags:

- `-m, --magnify` - open the widget in magnified mode, overriding the widget's default magnification setting

Examples:

```sh
# Launch a widget with its default settings
wsh launch my-custom-widget

# Launch a widget in magnified mode
wsh launch -m system-monitor
```

The widget's configuration determines the initial block settings, including the view type, metadata, and default magnification state. The `-m` flag can be used to override the widget's default magnification setting.

:::tip
Widget configurations can be customized in your `widgets.json` configuration file, which you can edit using `wsh editconfig widgets.json`
:::

---

## getvar/setvar

Wave Terminal provides commands for managing persistent variables at different scopes (block, tab, workspace, or client-wide).

### setvar

```sh
wsh setvar [flags] KEY=VALUE...
```

Set one or more variables. By default, variables are set at the client (global) level. Use `-l` for block-local variables.

Examples:

```sh
# Set a single variable
wsh setvar API_KEY=abc123

# Set multiple variables at once
wsh setvar HOST=localhost PORT=8080 DEBUG=true

# Set a block-local variable
wsh setvar -l BLOCK_SPECIFIC=value

# Remove variables
wsh setvar -r API_KEY PORT
```

Flags:

- `-l, --local` - set variables local to the current block
- `-r, --remove` - remove the specified variables instead of setting them
- `--varfile string` - use a different variable file (default "var")
- `-b [blockid]` - used to set a specific zone (block, tab, workspace, client, or UUID)

### getvar

```sh
wsh getvar [flags] [key]
```

Get the value of a variable. Returns exit code 0 if the variable exists, 1 if it doesn't. This allows for shell scripting like:

```sh
# Check if a variable exists
if wsh getvar API_KEY >/dev/null; then
    echo "API key is set"
fi

# Use a variable in a command
curl -H "Authorization: $(wsh getvar API_KEY)" https://api.example.com

# Get a block-local variable
wsh getvar -l BLOCK_SPECIFIC

# List all variables
wsh getvar --all

# List all variables with null terminators (for scripting)
wsh getvar --all -0
```

Flags:

- `-l, --local` - get variables local to the current block
- `--all` - list all variables
- `-0, --null` - use null terminators in output instead of newlines
- `--varfile string` - use a different variable file (default "var")

Variables can be accessed at different scopes using the `-b` flag:

```sh
# Get/set at block level
wsh getvar -b block MYVAR
wsh setvar -b block MYVAR=value

# Get/set at tab level
wsh getvar -b tab MYVAR
wsh setvar -b tab MYVAR=value

# Get/set at workspace level
wsh getvar -b workspace MYVAR
wsh setvar -b workspace MYVAR=value

# Get/set at client (global) level
wsh getvar -b client MYVAR
wsh setvar -b client MYVAR=value
```

Variables set with these commands persist across sessions and can be used to store configuration values, secrets, or any other string data that needs to be accessible across blocks or tabs.

---

## termscrollback

Get the terminal scrollback from a terminal block. This is useful for capturing terminal output for processing or archiving.

```sh
wsh termscrollback [-b blockid] [flags]
```

By default, retrieves all lines from the current terminal block. You can specify line ranges or get only the output of the last command.

Flags:

- `-b, --block <blockid>` - specify target terminal block (default: current block)
- `--start <line>` - starting line number (0 = beginning, default: 0)
- `--end <line>` - ending line number (0 = all lines, default: 0)
- `--lastcommand` - get output of last command (requires shell integration)
- `-o, --output <file>` - write output to file instead of stdout

Examples:

```sh
# Get all scrollback from current terminal
wsh termscrollback

# Get scrollback from a specific terminal block
wsh termscrollback -b 2

# Get only the last command's output
wsh termscrollback --lastcommand

# Get a specific line range (lines 100-200)
wsh termscrollback --start 100 --end 200

# Save scrollback to a file
wsh termscrollback -o terminal-log.txt

# Save last command output to a file
wsh termscrollback --lastcommand -o last-output.txt

# Process last command output with grep
wsh termscrollback --lastcommand | grep "ERROR"
```

:::note
The `--lastcommand` flag requires shell integration to be enabled. This feature allows you to capture just the output from the most recent command, which is particularly useful for scripting and automation.
:::

---

## wavepath

The `wavepath` command lets you get the paths to various Wave Terminal directories and files, including configuration, data storage, and logs.

```sh
wsh wavepath {config|data|log}
```

This command returns the full path to the requested Wave Terminal system directory or file. It's useful for accessing Wave's configuration files, data storage, or checking logs.

Flags:

- `-o, --open` - open the path in a new block
- `-O, --open-external` - open the path in the default external application
- `-t, --tail` - show the last ~100 lines of the log file (only valid for log path)

Examples:

```sh
# Get path to config directory
wsh wavepath config

# Get path to data directory
wsh wavepath data

# Get path to log file
wsh wavepath log

# Open log file in a new block
wsh wavepath -o log

# Open config directory in system file explorer
wsh wavepath -O config

# View recent log entries
wsh wavepath -t log
```

The command will show you the full path to:

- `config` - Where Wave Terminal stores its configuration files
- `data` - Where Wave Terminal stores its persistent data
- `log` - The main Wave Terminal log file

:::tip
Use the `-t` flag with the log path to quickly view recent log entries without having to open the full file. This is particularly useful for troubleshooting.
:::

---

## blocks

The `blocks` command provides operations for listing and querying blocks across workspaces, windows, and tabs. Primarily useful for debugging and scripting.

### list

```sh
wsh blocks list [flags]
```

List all blocks with optional filtering by workspace, window, tab, or view type. Output can be formatted as a table (default) or JSON for scripting.

Flags:
- `--workspace <id>` - restrict to specific workspace id
- `--window <id>` - restrict to specific window id
- `--tab <id>` - restrict to specific tab id
- `--view <type>` - filter by view type (term, web, preview, edit, sysinfo, waveai)
- `--json` - output results as JSON
- `--timeout <ms>` - RPC timeout in milliseconds (default: 5000)

Examples:

```sh
# List all blocks
wsh blocks list

# List only terminal blocks
wsh blocks list --view=term

# Filter by workspace
wsh blocks list --workspace=12d0c067-378e-454c-872e-77a314248114

# Output as JSON for scripting
wsh blocks list --json
```


---

## secret

The `secret` command provides secure storage and management of sensitive information like API keys, passwords, and tokens. Secrets are stored using your system's native secure storage backend (Keychain on macOS, Secret Service on Linux, Credential Manager on Windows).

Secret names must start with a letter and contain only letters, numbers, and underscores.

### get

```sh
wsh secret get [name]
```

Retrieve and display the value of a stored secret.

Examples:

```sh
# Get an API key
wsh secret get github_token

# Use in scripts
export API_KEY=$(wsh secret get my_api_key)
```

### set

```sh
wsh secret set [name]=[value]
```

Store a secret value securely. This command requires an appropriate system secret manager to be available and will fail if only basic text storage is available.

Examples:

```sh
# Set an API token
wsh secret set github_token=ghp_abc123xyz

# Set a database password
wsh secret set db_password=mySecurePassword123
```

:::warning
The `set` command requires a proper system secret manager (Keychain, Secret Service, or Credential Manager). It will not work with basic text storage for security reasons.
:::

### list

```sh
wsh secret list
```

Display all stored secret names (values are not shown).

Example:

```sh
# List all secrets
wsh secret list
```

### delete

```sh
wsh secret delete [name]
```

Remove a secret from secure storage.

Examples:

```sh
# Delete an API key
wsh secret delete github_token

# Delete multiple secrets
wsh secret delete old_api_key
wsh secret delete temp_token
```

### ui

```sh
wsh secret ui [-m]
```

Open the secrets management interface in a new block. This provides a graphical interface for viewing and managing all your secrets.

Flags:

- `-m, --magnified` - open the secrets UI in magnified mode

Examples:

```sh
# Open the secrets UI
wsh secret ui

# Open the secrets UI in magnified mode
wsh secret ui -m
```

The secrets UI provides a convenient visual way to browse, add, edit, and delete secrets without needing to use the command-line interface.

:::tip
Use secrets in your scripts to avoid hardcoding sensitive values. Secrets work across remote machines - store an API key locally with `wsh secret set`, then access it from any SSH or WSL connection with `wsh secret get`. The secret is securely retrieved from your local machine without needing to duplicate it on remote systems.
:::
</PlatformProvider>