diff --git a/.claude/skills/changelog/watermark b/.claude/skills/changelog/watermark
index 60e33b400..f75bde743 100644
--- a/.claude/skills/changelog/watermark
+++ b/.claude/skills/changelog/watermark
@@ -1 +1 @@
-9122d42de851f9b6260000c93fa193699f4e1f47
+d6fdeb81353d3bdf86a87fc499a2a5889206524b
diff --git a/.claude/skills/docs/watermark b/.claude/skills/docs/watermark
index 60e33b400..f75bde743 100644
--- a/.claude/skills/docs/watermark
+++ b/.claude/skills/docs/watermark
@@ -1 +1 @@
-9122d42de851f9b6260000c93fa193699f4e1f47
+d6fdeb81353d3bdf86a87fc499a2a5889206524b
diff --git a/docs/changelog/2026-03-18.mdx b/docs/changelog/2026-03-18.mdx
new file mode 100644
index 000000000..2c2978461
--- /dev/null
+++ b/docs/changelog/2026-03-18.mdx
@@ -0,0 +1,33 @@
+---
+title: "Secret management and repo commands"
+date: "2026-03-18"
+---
+
+## Secret management from the CLI
+
+Managing API keys and credentials previously meant manually editing `~/.fabro/.env`. The new `fabro secret` commands let you get, set, list, and remove secrets directly from the CLI.
+
+```bash
+fabro secret set ANTHROPIC_API_KEY sk-ant-...
+fabro secret list
+fabro secret get ANTHROPIC_API_KEY
+fabro secret rm ANTHROPIC_API_KEY
+```
+
+## Repository lifecycle with `fabro repo`
+
+Project setup commands now live under `fabro repo`. You can initialize a project with `fabro repo init` and, when you want to remove Fabro from a project, reverse it with `fabro repo deinit` — which removes `fabro.toml` and the `fabro/` directory.
+
+```bash
+fabro repo init
+fabro repo deinit
+```
+
+The old `fabro init` still works but prints a deprecation warning.
+
+## More
+
+<Accordion title="CLI">
+- Moved `fabro init` to `fabro repo init` with a backwards-compatible deprecation shim
+- Added `--show-values` flag to `fabro secret list` to reveal secret values
+</Accordion>
diff --git a/docs/docs.json b/docs/docs.json
index 76a40f140..4862d4f74 100644
--- a/docs/docs.json
+++ b/docs/docs.json
@@ -272,6 +272,7 @@
             "group": "March 2026",
             "icon": "clock-rotate-left",
             "pages": [
+              "changelog/2026-03-18",
               "changelog/2026-03-17",
               "changelog/2026-03-16",
               "changelog/2026-03-15",
diff --git a/docs/reference/cli.mdx b/docs/reference/cli.mdx
index a2255aa2b..48ae9becc 100644
--- a/docs/reference/cli.mdx
+++ b/docs/reference/cli.mdx
@@ -537,12 +537,12 @@ fabro parse workflow.fabro
 
 ---
 
-## `fabro init`
+## `fabro repo init`
 
-Initialize a new Fabro project in the current git repository. Creates an `fabro.toml` project config and a sample `hello` workflow.
+Initialize a new Fabro project in the current git repository. Creates a `fabro.toml` project config and a sample `hello` workflow.
 
 ```bash
-fabro init
+fabro repo init
 ```
 
 The command must be run inside a git repository. It creates:
@@ -550,6 +550,18 @@ The command must be run inside a git repository. It creates:
 - `fabro/workflows/hello/workflow.fabro` — a simple greeting workflow
 - `fabro/workflows/hello/workflow.toml` — run config for the hello workflow
 
+<Note>
+The old `fabro init` still works but prints a deprecation warning. Use `fabro repo init` instead.
+</Note>
+
+## `fabro repo deinit`
+
+Remove Fabro from a project by deleting `fabro.toml` and the `fabro/` directory. Fails with an error if the project is not initialized.
+
+```bash
+fabro repo deinit
+```
+
 ## `fabro diff`
 
 Show the diff from a workflow run. Displays the `final.patch` for completed runs, or connects to the sandbox for a live diff from in-progress runs.
@@ -686,6 +698,58 @@ fabro install
 
 ---
 
+## `fabro secret set`
+
+Store a secret in `~/.fabro/.env`.
+
+```bash
+fabro secret set ANTHROPIC_API_KEY sk-ant-...
+```
+
+| Argument | Description |
+|---|---|
+| `<KEY>` | Name of the secret (required) |
+| `<VALUE>` | Value to store (required) |
+
+## `fabro secret get`
+
+Print the value of a secret from `~/.fabro/.env`.
+
+```bash
+fabro secret get ANTHROPIC_API_KEY
+```
+
+| Argument | Description |
+|---|---|
+| `<KEY>` | Name of the secret (required) |
+
+## `fabro secret list`
+
+List secret names stored in `~/.fabro/.env`.
+
+```bash
+fabro secret list
+fabro secret list --show-values
+```
+
+| Flag | Description |
+|---|---|
+| `--show-values` | Print values alongside keys |
+
+## `fabro secret rm`
+
+Remove a secret from `~/.fabro/.env`.
+
+```bash
+fabro secret rm ANTHROPIC_API_KEY
+```
+
+| Argument | Description |
+|---|---|
+| `<KEY>` | Name of the secret to remove (required) |
+
+---
+
 ## `fabro docs`
 
 Open the Fabro documentation website in your default browser.