Workspaces & Secrets
flow files are YAML you keep in your repo, and you can always edit them by hand. Mochi adds edits that preserve everything they don't touch: comments, key order, and the executables next to the one you changed. That's what lets the desktop app's editors write to your files safely. For secrets, Mochi adds tested presets that connect a vault to the secret manager you already use.
Edit executables
mochi executable edit "build my-project/app:image" --data '{ ... }'Replaces one executable with a JSON definition. Other executables, file-level fields, and comments outside that entry are kept.
mochi executable add --file path/to/app.flow --content "$(cat snippet.yaml)"Appends the executables from a flow-file snippet, keeping the rest of the target file.
In the desktop app, Edit on an executable's page opens it with a Form / YAML toggle, then Save. New executable on the Executables page (⌘N) starts From a template, as a Blank file, or, with AI on, by describing what you want.
Discovered executables aren't edited here: change the file they come from instead.
Edit a workspace
mochi workspace edit my-project --display-name "My Project" --tags go,apiOnly the flags you pass are changed. Pass an empty value to clear a field.
In the desktop app, Edit on the workspace page changes its display name, description and tags, as a form or as YAML.
Connect a secret manager
flow can store secrets in its own encrypted vaults, or read them from a secret manager you already use. Presets are tested configurations for that second case, so you don't have to write one by hand.
A vault created from a preset reads through to the provider: it holds links to secrets that already exist there and never writes to them.
| Preset | Provider | Requires |
|---|---|---|
1password | 1Password | op, jq |
pass | pass (GPG) | pass |
aws-ssm | AWS Systems Manager Parameter Store | aws |
mochi vault preset list # available presets
mochi vault preset preflight --preset 1password # is the provider installed and usable?
mochi vault preset connect --preset 1password # run the provider's sign-in step
mochi vault preset render op --preset 1password --out op-vault.json
mochi vault create op --type external --config op-vault.jsonProvider options such as the 1Password vault or the AWS region are passed with --set key=value.
mochi vault preset browse lists what a provider holds, to help you find secrets worth linking.