Use this WHENEVER a task needs a secret/API key/token/password/connection string/credential written to a project .env file - e.g. "add my OpenAI key", "set DATABASE_URL", "configure my .env", "save this API token". You pass ONLY the variable NAME; the user types the value into a local masked dialog and it is written straight to .env - you never see or handle the value. DO NOT ask the user to paste the secret into the chat; DO NOT write the value or a placeholder yourself; DO NOT cat/read .env to verify (use env_key_exists). The value must be single-line (not for multi-line PEM keys / JSON blobs - for those, tell the user to edit .env manually).

Check whether an environment variable NAME already exists in a project .env file. Returns ONLY true/false - never the value. Use this to verify set_env_secret worked, INSTEAD of reading/cat-ing .env (which would expose the secret).