clan-cli/secrets: suggest clan vars keygen instead

Found that while reading through some code.

devFlake/flake.lock

@@ -3,10 +3,10 @@
     "clan-core-for-checks": {
       "flake": false,
       "locked": {
-        "lastModified": 1759727242,
+        "lastModified": 1759795610,
-        "narHash": "sha256-15Q9eXbfsLmzIbYWasZ3Nuqafnc5o9al9RmGuBGVK74=",
+        "narHash": "sha256-YFOK+aoJjWLfMHj2spvrQIe0ufIsv6P8o44NqoFPwp0=",
         "ref": "main",
-        "rev": "c737271585ff3df308feab22c09967fce8f278d3",
+        "rev": "0de79962eacfe6f09d7aabca2a7305deef4fde0c",
         "shallow": true,
         "type": "git",
         "url": "https://git.clan.lol/clan/clan-core"
@@ -105,11 +105,11 @@
     },
     "nixpkgs-dev": {
       "locked": {
-        "lastModified": 1759670943,
+        "lastModified": 1759794031,
-        "narHash": "sha256-JBjTDfwzAwtd8+5X/Weg27WE/3hVYOP3uggP2JPaQVQ=",
+        "narHash": "sha256-Zruni/00BlDHSWVJf3mb0o+OHnxIvJNuXkPloY9c+PU=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "21980a9c20f34648121f60bda15f419fa568db21",
+        "rev": "09c221b2f0726da85b124efb60a1d123971dfa08",
         "type": "github"
       },
       "original": {

docs/site/guides/nixpkgs-flake-input/index.md

@@ -5,11 +5,11 @@
 ## Option 1: Follow `clan-core`
 
 - **Pros**:
-  - Recommended for most users.
+    - Recommended for most users.
-  - Verified by our CI and widely used by others.
+    - Verified by our CI and widely used by others.
 - **Cons**:
-  - Coupled to version bumps in `clan-core`.
+    - Coupled to version bumps in `clan-core`.
-  - Upstream features and packages may take longer to land.
+    - Upstream features and packages may take longer to land.
 
 Example:
 
@@ -24,10 +24,10 @@ inputs = {
 ## Option 2: Use Your Own `nixpkgs` Version
 
 - **Pros**:
-  - Faster access to new upstream features and packages.
+    - Faster access to new upstream features and packages.
 - **Cons**:
-  - Recommended for advanced users.
+    - Recommended for advanced users.
-  - Not covered by our CI — you’re on the frontier.
+    - Not covered by our CI — you’re on the frontier.
 
 Example:
 

pkgs/clan-cli/clan_cli/secrets/secrets.py

@@ -158,8 +158,10 @@ def encrypt_secret(
     admin_keys = sops.ensure_admin_public_keys(flake_dir)
 
     if not admin_keys:
-        # TODO double check the correct command to run
+        msg = (
-        msg = "No keys found. Please run 'clan secrets add-key' to add a key."
+            "No admin keys found.\n\n"
+            "Please run 'clan vars keygen' to generate and set up keys."
+        )
         raise ClanError(msg)
 
     username = next(iter(admin_keys)).username

pkgs/clan-cli/clan_lib/cmd/__init__.py

@@ -74,9 +74,6 @@ def handle_io(
     )  # wlist is a list of file descriptors to be monitored for write events
     stdout_buf = b""
     stderr_buf = b""
-    # Buffers for incomplete lines (no trailing newline yet)
-    stdout_line_buf = ""
-    stderr_line_buf = ""
     start = time.time()
 
     # Function to handle file descriptors
@@ -88,40 +85,6 @@ def handle_io(
             rlist.remove(fd)
         return b""
 
-    # Function to process output with proper carriage return handling
-    def process_output(
-        chunk: bytes, line_buf: str, extra: dict[str, str], cmdlog_func: Any
-    ) -> str:
-        """Process output chunk, handling carriage returns properly.
-        Returns the updated line buffer (incomplete lines).
-        """
-        if not chunk:
-            return line_buf
-
-        # Decode the chunk and append to line buffer
-        decoded = chunk.decode("utf-8", "replace")
-        line_buf += decoded
-
-        # Split by newlines to get complete lines
-        lines = line_buf.split("\n")
-
-        # The last element might be an incomplete line
-        line_buf = lines[-1]
-        complete_lines = lines[:-1]
-
-        # Process each complete line
-        for line in complete_lines:
-            if "\r" in line:
-                # Handle carriage return: only keep the last segment after final \r
-                # This is what would be visible on a terminal
-                visible_line = line.split("\r")[-1]
-                if visible_line:  # Only log non-empty lines
-                    cmdlog_func(visible_line, extra=extra)
-            elif line:  # Only log non-empty lines
-                cmdlog_func(line, extra=extra)
-
-        return line_buf
-
     # Extra information passed to the logger
     stdout_extra = {}
     stderr_extra = {}
@@ -163,9 +126,9 @@ def handle_io(
 
         # If Log.STDOUT is set, log the stdout output
         if ret and log in [Log.STDOUT, Log.BOTH]:
-            stdout_line_buf = process_output(
+            lines = ret.decode("utf-8", "replace").rstrip("\n").rstrip().split("\n")
-                ret, stdout_line_buf, stdout_extra, cmdlog.info
+            for line in lines:
-            )
+                cmdlog.info(line, extra=stdout_extra)
 
         # If stdout file is set, stream the stdout output
         if ret and stdout:
@@ -180,9 +143,9 @@ def handle_io(
 
         # If Log.STDERR is set, log the stderr output
         if ret and log in [Log.STDERR, Log.BOTH]:
-            stderr_line_buf = process_output(
+            lines = ret.decode("utf-8", "replace").rstrip("\n").rstrip().split("\n")
-                ret, stderr_line_buf, stderr_extra, cmdlog.info
+            for line in lines:
-            )
+                cmdlog.info(line, extra=stderr_extra)
 
         # If stderr file is set, stream the stderr output
         if ret and stderr:
@@ -210,24 +173,6 @@ def handle_io(
                     process.stdin.close()
             else:
                 wlist.remove(process.stdin)
-
-    # Flush any remaining buffered lines at the end
-    if stdout_line_buf and log in [Log.STDOUT, Log.BOTH]:
-        if "\r" in stdout_line_buf:
-            visible_line = stdout_line_buf.split("\r")[-1]
-            if visible_line:
-                cmdlog.info(visible_line, extra=stdout_extra)
-        elif stdout_line_buf:
-            cmdlog.info(stdout_line_buf, extra=stdout_extra)
-
-    if stderr_line_buf and log in [Log.STDERR, Log.BOTH]:
-        if "\r" in stderr_line_buf:
-            visible_line = stderr_line_buf.split("\r")[-1]
-            if visible_line:
-                cmdlog.info(visible_line, extra=stderr_extra)
-        elif stderr_line_buf:
-            cmdlog.info(stderr_line_buf, extra=stderr_extra)
-
     return stdout_buf.decode("utf-8", "replace"), stderr_buf.decode("utf-8", "replace")