📄 opsctl 密码入口改为单个 --password（终端无回显交互输入）

--password-stdin 已移除。明文入口收敛为单个 --password：裸写在终端里提示
输入且不回显，无 TTY 时以退出码 3 + NEEDS TTY 拒绝；带值形态沿用 argv 路径
与既有警告，值以 "-" 开头时必须写成 --password=<value>。

同步 EN 与 zh-CN 的 cli/assets 与 guide/audit。

Author: CodFrm

docs/cli/assets.md

@@ -41,21 +41,21 @@ The supported secret/reference inputs are mutually exclusive:
 
 | Input | Behavior |
 |---|---|
-| `--password-stdin` | Reads plaintext from standard input without a prompt or echo. This is the recommended plaintext path. |
-| `--password <value>` | Accepts plaintext in argv and prints a warning because the value may be exposed in shell history, process listings, or CI logs. |
+| `--password` (bare) | Prompts for the plaintext in your terminal and reads it without echo. This is the recommended plaintext path. It needs an interactive terminal: without one the command exits with code 3 and a `NEEDS TTY` marker telling you to run it yourself. |
+| `--password <value>` | Accepts plaintext in argv and prints a warning because the value may be exposed in shell history, process listings, or CI logs. `--password=<value>` is equivalent, and is required when the value starts with `-`. |
 | `--credential-id <id>` | Reuses an existing compatible managed password or SSH-key credential. |
 | `--agent-source-id <id>` with `--agent-key-fingerprint <fingerprint>` | Selects an existing SSH Agent source and identity for SSH Agent authentication. |
 
 For example:
 
 ```bash
-printf '%s\n' "$APP_PASSWORD" | \
-  opsctl create asset --type redis --name cache \
-    --config '{"host":"redis.internal","username":"default"}' \
-    --password-stdin
+opsctl create asset --type redis --name cache \
+  --config '{"host":"redis.internal","username":"default"}' \
+  --password
+# Password: (typed in your terminal, never echoed)
 ```
 
-Plaintext supplied through `--password-stdin`, `--password`, or an accepted JSON secret field is encrypted in the asset. It does **not** create a reusable managed credential. Create managed passwords and SSH keys explicitly in the desktop key manager, then reference them with `--credential-id`.
+Plaintext supplied through `--password`, or an accepted JSON secret field, is encrypted in the asset. It does **not** create a reusable managed credential. Create managed passwords and SSH keys explicitly in the desktop key manager, then reference them with `--credential-id`.
 
 Do not put SSH private keys or passphrases into automation configuration. Import the key in the desktop key manager and reference its credential ID. Kubernetes kubeconfig remains encrypted directly in the asset. Asset types without password authentication reject password inputs.
 

docs/guide/audit.md

@@ -63,7 +63,7 @@ Audit payloads are raw by default: the audit writer stores the command, request,
 
 Some producers own a narrower write-only contract. AI/opsctl `put_asset`, desktop asset changes, and external-edit metadata write explicit allowlisted projections. For asset creation and updates, password, Secret Access Key, kubeconfig, private-key, and passphrase fields are omitted from the audit request; they do not appear as placeholder values. Safe asset and credential queries likewise return narrow metadata DTOs and never expose password, private-key, passphrase, token, kubeconfig, or SSH Agent endpoint values.
 
-Direct execution and approval surfaces are different boundaries. Tool input/output, command history, errors, and approval subjects preserve the content supplied to those surfaces. Do not pass secrets in commands or arguments on the assumption that Audit or the UI will redact them. Prefer managed credential references or a command's documented standard-input secret path, such as [`opsctl create asset --password-stdin`](/docs/cli/assets#passwords-and-authentication-references).
+Direct execution and approval surfaces are different boundaries. Tool input/output, command history, errors, and approval subjects preserve the content supplied to those surfaces. Do not pass secrets in commands or arguments on the assumption that Audit or the UI will redact them. Prefer managed credential references or a command's documented no-echo secret path, such as [a bare `opsctl create asset --password`](/docs/cli/assets#passwords-and-authentication-references), which prompts in your terminal instead of taking the value from argv.
 
 ## Approval Workflow
 

i18n/zh-CN/docusaurus-plugin-content-docs/current/cli/assets.md

@@ -41,21 +41,21 @@ opsctl create asset \
 
 | 输入 | 行为 |
 |---|---|
-| `--password-stdin` | 从标准输入读取明文，不显示提示也不回显；这是推荐的明文输入方式。 |
-| `--password <value>` | 从 argv 接收明文，并警告该值可能暴露在 Shell 历史、进程列表或 CI 日志中。 |
+| `--password`（不带值） | 在终端里提示输入明文，输入过程不回显；这是推荐的明文输入方式。它需要交互式终端，没有终端时命令以退出码 3 和 `NEEDS TTY` 标记结束，并提示你自己去终端里执行。 |
+| `--password <value>` | 从 argv 接收明文，并警告该值可能暴露在 Shell 历史、进程列表或 CI 日志中。`--password=<value>` 等价；值以 `-` 开头时必须用这种写法。 |
 | `--credential-id <id>` | 复用已有且类型兼容的托管密码或 SSH 密钥凭据。 |
 | `--agent-source-id <id>` 与 `--agent-key-fingerprint <fingerprint>` | 为 SSH Agent 认证选择已有 Agent 来源和身份。 |
 
 例如：
 
 ```bash
-printf '%s\n' "$APP_PASSWORD" | \
-  opsctl create asset --type redis --name cache \
-    --config '{"host":"redis.internal","username":"default"}' \
-    --password-stdin
+opsctl create asset --type redis --name cache \
+  --config '{"host":"redis.internal","username":"default"}' \
+  --password
+# 密码：（在终端里输入，不回显）
 ```
 
-通过 `--password-stdin`、`--password` 或允许的 JSON 秘密字段传入的明文会加密到资产中，**不会**隐式创建可复用的托管凭据。请先在桌面端密钥管理器中显式创建托管密码或导入 SSH 密钥，再通过 `--credential-id` 引用。
+通过 `--password` 或允许的 JSON 秘密字段传入的明文会加密到资产中，**不会**隐式创建可复用的托管凭据。请先在桌面端密钥管理器中显式创建托管密码或导入 SSH 密钥，再通过 `--credential-id` 引用。
 
 不要把 SSH 私钥或 passphrase 放进自动化配置。应先在桌面端密钥管理器中导入密钥，再引用其凭据 ID。Kubernetes kubeconfig 仍直接加密在资产中。不使用密码认证的资产类型会拒绝密码输入。
 

i18n/zh-CN/docusaurus-plugin-content-docs/current/guide/audit.md

@@ -24,7 +24,7 @@ opsctl list audit --asset web-01 --limit 50
 
 审计写入默认不会扫描命令、请求、结果或错误并猜测其中的秘密；请求最多保留 4KB，结果最多保留 32KB。资产创建/更新以及安全资产/凭据查询使用窄字段投影，不写入密码、Secret Access Key、kubeconfig、私钥或 passphrase。
 
-不要假设审计或 UI 会替命令参数脱敏。优先使用托管凭据引用或命令明确提供的标准输入秘密通道，例如 [`opsctl create asset --password-stdin`](/docs/cli/assets#密码与认证引用)。
+不要假设审计或 UI 会替命令参数脱敏。优先使用托管凭据引用或命令明确提供的无回显输入通道，例如[不带值的 `opsctl create asset --password`](/docs/cli/assets#密码与认证引用)——它在终端里提示输入，不经过 argv。
 
 ## opsctl 审批流程