fix: CLI consistency — secrets bootstrap engine list, ghes flag punctuation, docs description

cmd/gh-aw/main.go

@@ -775,7 +775,7 @@ Use "` + string(constants.CLIExtensionPrefix) + ` help all" to show help for all
 	compileCmd.Flags().Bool("approve", false, "Approve all safe update changes. When strict mode is active (the default), the compiler emits warnings for new restricted secrets or unapproved action additions/removals not present in the existing gh-aw-manifest. Use this flag to approve and skip safe update enforcement")
 	compileCmd.Flags().Bool("validate-images", false, "Require Docker to be available for container image validation. Without this flag, container image validation is silently skipped when Docker is not installed or the daemon is not running")
 	compileCmd.Flags().String("prior-manifest-file", "", "Path to a JSON file containing pre-cached gh-aw-manifests (map[lockFile]*GHAWManifest); used by the MCP server to supply a tamper-proof manifest baseline captured at startup")
-	compileCmd.Flags().Bool("ghes", false, "Enable GitHub Enterprise Server (GHES) compatibility mode. Artifact actions continue using latest non-v3 pins (v3 is deprecated). Overrides the aw.json ghes field")
+	compileCmd.Flags().Bool("ghes", false, "Enable GitHub Enterprise Server (GHES) compatibility mode. Artifact actions continue using latest non-v3 pins (v3 is deprecated). Overrides the aw.json ghes field.")
 	if err := compileCmd.Flags().MarkHidden("prior-manifest-file"); err != nil {
 		// Non-fatal: flag is registered even if MarkHidden fails
 		_ = err

docs/src/content/docs/setup/cli.md

@@ -255,7 +255,7 @@ gh aw secrets set MY_SECRET --value-from-env MY_TOKEN          # From env var
 
 ##### `secrets bootstrap`
 
-Analyze workflows to determine required secrets and interactively prompt for missing ones. Auto-detects engines in use and validates tokens before uploading to the repository.
+Analyze workflows to determine required secrets and interactively prompt for missing ones. Auto-detects engines in use and checks which required secrets are already configured.
 
 ```bash wrap
 gh aw secrets bootstrap                                  # Analyze all workflows and prompt for missing secrets

pkg/cli/secrets_command_test.go

@@ -71,7 +71,7 @@ func TestSecretsCommandStructure(t *testing.T) {
 	}
 }
 
-func TestSecretsBootstrapEngineFlagIncludesGemini(t *testing.T) {
+func TestSecretsBootstrapEngineFlagUsage(t *testing.T) {
 	cmd := NewSecretsCommand()
 
 	var bootstrapCmd *cobra.Command
@@ -86,7 +86,12 @@ func TestSecretsBootstrapEngineFlagIncludesGemini(t *testing.T) {
 
 	engineFlag := bootstrapCmd.Flags().Lookup("engine")
 	require.NotNil(t, engineFlag, "--engine flag should exist on bootstrap")
-	assert.Contains(t, engineFlag.Usage, "gemini", "--engine help should include gemini engine")
+
+	// Assert the full shared engine list is present so future additions are detected.
+	expectedEngines := []string{"copilot", "claude", "codex", "gemini", "antigravity", "opencode", "pi"}
+	for _, engine := range expectedEngines {
+		assert.Contains(t, engineFlag.Usage, engine, "--engine help should include %s engine", engine)
+	}
 }
 
 func TestSecretsCommandUnknownSubcommandReturnsError(t *testing.T) {

pkg/cli/tokens_bootstrap.go

@@ -35,7 +35,7 @@ Only required secrets are prompted for. Optional secrets are not shown.`,
 	}
 
 	cmd.Flags().BoolVar(&nonInteractiveFlag, "non-interactive", false, "Check secrets without prompting (display-only mode)")
-	cmd.Flags().StringVarP(&engineFlag, "engine", "e", "", "Check tokens for specific engine (copilot, claude, codex, gemini)")
+	cmd.Flags().StringVarP(&engineFlag, "engine", "e", "", "Check tokens for specific engine ("+engineFlagHelpList+")")
 	addRepoFlag(cmd)
 
 	return cmd