Secrets in Plain are a type

SECRET_KEY: Secret[str]

plain settings get now masks them like settings list already did. Matters more with agents: everything a command prints lands in the transcript.

plain settings get --reveal is the explicit ask