---
url: https://docs.mochiexec.io/guides/workspaces.md
description: >-
  Add and edit executables and workspace settings without losing the comments
  and formatting in your flow files, and connect vaults to 1Password, pass, or
  AWS SSM with tested presets.
---

# Workspaces & Secrets

flow files are YAML you keep in your repo, and you can always edit them by hand. Mochi adds
edits that **preserve everything they don't touch**: comments, key order, and the
executables next to the one you changed. That's what lets the desktop app's editors write
to your files safely. For secrets, Mochi adds tested presets that connect a vault to the
secret manager you already use.

## Edit executables

```sh
mochi executable edit "build my-project/app:image" --data '{ ... }'
```

Replaces one executable with a JSON definition. Other executables, file-level fields, and
comments outside that entry are kept.

```sh
mochi executable add --file path/to/app.flow --content "$(cat snippet.yaml)"
```

Appends the executables from a flow-file snippet, keeping the rest of the target file.

In the desktop app, **Edit** on an executable's page opens it with a **Form** / **YAML**
toggle, then **Save**. **New executable** on the Executables page (`⌘N`) starts **From a
template**, as a **Blank file**, or, with AI on, by describing what you want.

[Discovered](/guides/discovery) executables aren't edited here: change the file they come
from instead.

flow docs: [Flow file reference](https://flowexec.io/types/flowfile)

Every field an executable definition can have.

## Edit a workspace

```sh
mochi workspace edit my-project --display-name "My Project" --tags go,api
```

Only the flags you pass are changed. Pass an empty value to clear a field.

In the desktop app, **Edit** on the workspace page changes its display name, description
and tags, as a form or as YAML.

## Connect a secret manager

flow can store secrets in its own encrypted vaults, or read them from a secret manager you
already use. Presets are tested configurations for that second case, so you don't have to
write one by hand.

A vault created from a preset **reads through** to the provider: it holds links to secrets
that already exist there and never writes to them.

| Preset | Provider | Requires |
|---|---|---|
| `1password` | 1Password | `op`, `jq` |
| `pass` | pass (GPG) | `pass` |
| `aws-ssm` | AWS Systems Manager Parameter Store | `aws` |

```sh
mochi vault preset list                           # available presets
mochi vault preset preflight --preset 1password   # is the provider installed and usable?
mochi vault preset connect --preset 1password     # run the provider's sign-in step
mochi vault preset render op --preset 1password --out op-vault.json
mochi vault create op --type external --config op-vault.json
```

Provider options such as the 1Password vault or the AWS region are passed with
`--set key=value`.

`mochi vault preset browse` lists what a provider holds, to help you find secrets worth
linking.

flow docs: [Secrets & vaults](https://flowexec.io/guides/secrets)

How flow vaults work, and how executables read secrets from them.