diff --git a/CHANGELOG.md b/CHANGELOG.md
index 108c2ea..0fe84fd 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,6 @@
 # abra x.x.x (UNRELEASED)
 
+- `secret auto` goes away and `secret generate` does it instead; `app new` loses `--auto` and does it by default now ([#XX](https://???))
 - Support choosing an `$EDITOR` when editing configs ([29cc392dff3e93e48e0e2edd3ce11b405c66a95a](https://git.autonomic.zone/coop-cloud/abra/commit/29cc392dff3e93e48e0e2edd3ce11b405c66a95a))
 - "server" shell completion fixed ([8839bd45951d00dccf4ef81ece445bcc49e13ee6](https://git.autonomic.zone/coop-cloud/abra/commit/8839bd45951d00dccf4ef81ece445bcc49e13ee6))
 - Make `-v` spit out the version ([0179f600f5ce40fc1520fc365f92b7cb6eeec1f5](https://git.autonomic.zone/coop-cloud/abra/commit/0179f600f5ce40fc1520fc365f92b7cb6eeec1f5))
diff --git a/abra b/abra
index 248bfc6..41f2875 100755
--- a/abra
+++ b/abra
@@ -12,7 +12,7 @@ DOC="
 The cooperative cloud utility belt 🎩🐇
 
 Usage:
-  abra [options] app new [--server=<server>] [--domain=<domain>] [--app-name=<app_name>] [--pass] [--auto] <type>
+  abra [options] app new [--server=<server>] [--domain=<domain>] [--app-name=<app_name>] [--pass] <type>
   abra [options] app (list|ls) [--status] [--server=<server>]
   abra [options] app <app> deploy [--skip-check]
   abra [options] app <app> undeploy
@@ -23,8 +23,7 @@ Usage:
   abra [options] app <app> check
   abra [options] app <app> ps
   abra [options] app <app> run [--no-tty] [--user=<user>] <service> <args>...
-  abra [options] app <app> secret auto [--pass]
-  abra [options] app <app> secret generate <secret> <version> [<cmd>] [--pass]
+  abra [options] app <app> secret generate [--secret=<secret>] [--version=<version>] [<cmd>] [--pass]
   abra [options] app <app> secret insert <secret> <version> <data> [--pass]
   abra [options] app <app> secret (delete|rm) (<secret>|--all) [--pass] [--force]
   abra [options] app <app> <command> [<args>...]
@@ -143,99 +142,102 @@ eval "var_$1+=($value)"; else eval "var_$1=$value"; fi; return 0; fi; done
 return 1; }; stdout() { printf -- "cat <<'EOM'\n%s\nEOM\n" "$1"; }; stderr() {
 printf -- "cat <<'EOM' >&2\n%s\nEOM\n" "$1"; }; error() {
 [[ -n $1 ]] && stderr "$1"; stderr "$usage"; _return 1; }; _return() {
-printf -- "exit %d\n" "$1"; exit "$1"; }; set -e; trimmed_doc=${DOC:1:1429}
-usage=${DOC:40:1165}; digest=cb5e2
-shorts=(-s -e -h '' '' '' '' '' '' '' '' '' '' '')
-longs=(--stack --env --help --server --domain --app-name --pass --auto --status --skip-check --force --no-tty --user --all)
-argcounts=(1 1 0 1 1 1 0 0 0 0 0 0 1 0); node_0(){ value __stack 0; }; node_1(){
-value __env 1; }; node_2(){ switch __help 2; }; node_3(){ value __server 3; }
-node_4(){ value __domain 4; }; node_5(){ value __app_name 5; }; node_6(){
-switch __pass 6; }; node_7(){ switch __auto 7; }; node_8(){ switch __status 8; }
-node_9(){ switch __skip_check 9; }; node_10(){ switch __force 10; }; node_11(){
-switch __no_tty 11; }; node_12(){ value __user 12; }; node_13(){ switch __all 13
-}; node_14(){ value _type_ a; }; node_15(){ value _app_ a; }; node_16(){
-value _service_ a; }; node_17(){ value _src_ a; }; node_18(){ value _dst_ a; }
-node_19(){ value _args_ a true; }; node_20(){ value _secret_ a; }; node_21(){
-value _version_ a; }; node_22(){ value _cmd_ a; }; node_23(){ value _data_ a; }
-node_24(){ value _command_ a; }; node_25(){ value _host_ a; }; node_26(){
-value _user_ a; }; node_27(){ value _port_ a; }; node_28(){ _command app; }
-node_29(){ _command new; }; node_30(){ _command list; }; node_31(){ _command ls
-}; node_32(){ _command deploy; }; node_33(){ _command undeploy; }; node_34(){
-_command config; }; node_35(){ _command delete; }; node_36(){ _command rm; }
-node_37(){ _command logs; }; node_38(){ _command cp; }; node_39(){
-_command check; }; node_40(){ _command ps; }; node_41(){ _command run; }
-node_42(){ _command secret; }; node_43(){ _command auto; }; node_44(){
+printf -- "exit %d\n" "$1"; exit "$1"; }; set -e; trimmed_doc=${DOC:1:1395}
+usage=${DOC:40:1131}; digest=61f1b
+shorts=(-s -h -e '' '' '' '' '' '' '' '' '' '' '' '')
+longs=(--stack --help --env --server --domain --app-name --pass --status --skip-check --force --no-tty --user --secret --version --all)
+argcounts=(1 0 1 1 1 1 0 0 0 0 0 1 1 1 0); node_0(){ value __stack 0; }
+node_1(){ switch __help 1; }; node_2(){ value __env 2; }; node_3(){
+value __server 3; }; node_4(){ value __domain 4; }; node_5(){ value __app_name 5
+}; node_6(){ switch __pass 6; }; node_7(){ switch __status 7; }; node_8(){
+switch __skip_check 8; }; node_9(){ switch __force 9; }; node_10(){
+switch __no_tty 10; }; node_11(){ value __user 11; }; node_12(){
+value __secret 12; }; node_13(){ value __version 13; }; node_14(){
+switch __all 14; }; node_15(){ value _type_ a; }; node_16(){ value _app_ a; }
+node_17(){ value _service_ a; }; node_18(){ value _src_ a; }; node_19(){
+value _dst_ a; }; node_20(){ value _args_ a true; }; node_21(){ value _cmd_ a; }
+node_22(){ value _secret_ a; }; node_23(){ value _version_ a; }; node_24(){
+value _data_ a; }; node_25(){ value _command_ a; }; node_26(){ value _host_ a; }
+node_27(){ value _user_ a; }; node_28(){ value _port_ a; }; node_29(){
+_command app; }; node_30(){ _command new; }; node_31(){ _command list; }
+node_32(){ _command ls; }; node_33(){ _command deploy; }; node_34(){
+_command undeploy; }; node_35(){ _command config; }; node_36(){ _command delete
+}; node_37(){ _command rm; }; node_38(){ _command logs; }; node_39(){
+_command cp; }; node_40(){ _command check; }; node_41(){ _command ps; }
+node_42(){ _command run; }; node_43(){ _command secret; }; node_44(){
 _command generate; }; node_45(){ _command insert; }; node_46(){ _command server
 }; node_47(){ _command add; }; node_48(){ _command init; }; node_49(){
 _command apps; }; node_50(){ _command upgrade; }; node_51(){ _command version; }
 node_52(){ optional 0 1 2; }; node_53(){ optional 52; }; node_54(){ optional 3
 }; node_55(){ optional 4; }; node_56(){ optional 5; }; node_57(){ optional 6; }
-node_58(){ optional 7; }; node_59(){ required 53 28 29 54 55 56 57 58 14; }
-node_60(){ either 30 31; }; node_61(){ required 60; }; node_62(){ optional 8; }
-node_63(){ required 53 28 61 62 54; }; node_64(){ optional 9; }; node_65(){
-required 53 28 15 32 64; }; node_66(){ required 53 28 15 33; }; node_67(){
-required 53 28 15 34; }; node_68(){ either 35 36; }; node_69(){ required 68; }
-node_70(){ optional 10; }; node_71(){ required 53 28 15 69 70; }; node_72(){
-optional 16; }; node_73(){ required 53 28 15 37 72; }; node_74(){
-required 53 28 15 38 17 18; }; node_75(){ required 53 28 15 39; }; node_76(){
-required 53 28 15 40; }; node_77(){ optional 11; }; node_78(){ optional 12; }
-node_79(){ oneormore 19; }; node_80(){ required 53 28 15 41 77 78 16 79; }
-node_81(){ required 53 28 15 42 43 57; }; node_82(){ optional 22; }; node_83(){
-required 53 28 15 42 44 20 21 82 57; }; node_84(){
-required 53 28 15 42 45 20 21 23 57; }; node_85(){ either 20 13; }; node_86(){
-required 85; }; node_87(){ required 53 28 15 42 69 86 57 70; }; node_88(){
-optional 79; }; node_89(){ required 53 28 15 24 88; }; node_90(){ optional 26; }
-node_91(){ optional 27; }; node_92(){ required 53 46 47 25 90 91; }; node_93(){
-required 53 46 61; }; node_94(){ required 53 46 25 36; }; node_95(){
-required 53 46 25 48; }; node_96(){ required 53 46 25 49 62; }; node_97(){
+node_58(){ required 53 29 30 54 55 56 57 15; }; node_59(){ either 31 32; }
+node_60(){ required 59; }; node_61(){ optional 7; }; node_62(){
+required 53 29 60 61 54; }; node_63(){ optional 8; }; node_64(){
+required 53 29 16 33 63; }; node_65(){ required 53 29 16 34; }; node_66(){
+required 53 29 16 35; }; node_67(){ either 36 37; }; node_68(){ required 67; }
+node_69(){ optional 9; }; node_70(){ required 53 29 16 68 69; }; node_71(){
+optional 17; }; node_72(){ required 53 29 16 38 71; }; node_73(){
+required 53 29 16 39 18 19; }; node_74(){ required 53 29 16 40; }; node_75(){
+required 53 29 16 41; }; node_76(){ optional 10; }; node_77(){ optional 11; }
+node_78(){ oneormore 20; }; node_79(){ required 53 29 16 42 76 77 17 78; }
+node_80(){ optional 12; }; node_81(){ optional 13; }; node_82(){ optional 21; }
+node_83(){ required 53 29 16 43 44 80 81 82 57; }; node_84(){
+required 53 29 16 43 45 22 23 24 57; }; node_85(){ either 22 14; }; node_86(){
+required 85; }; node_87(){ required 53 29 16 43 68 86 57 69; }; node_88(){
+optional 78; }; node_89(){ required 53 29 16 25 88; }; node_90(){ optional 27; }
+node_91(){ optional 28; }; node_92(){ required 53 46 47 26 90 91; }; node_93(){
+required 53 46 60; }; node_94(){ required 53 46 26 37; }; node_95(){
+required 53 46 26 48; }; node_96(){ required 53 46 26 49 61; }; node_97(){
 required 53 50; }; node_98(){ required 53 51; }; node_99(){
-either 59 63 65 66 67 71 73 74 75 76 80 81 83 84 87 89 92 93 94 95 96 97 98; }
+either 58 62 64 65 66 70 72 73 74 75 79 83 84 87 89 92 93 94 95 96 97 98; }
 node_100(){ required 99; }; cat <<<' docopt_exit() {
-[[ -n $1 ]] && printf "%s\n" "$1" >&2; printf "%s\n" "${DOC:40:1165}" >&2
-exit 1; }'; unset var___stack var___env var___help var___server var___domain \
-var___app_name var___pass var___auto var___status var___skip_check var___force \
-var___no_tty var___user var___all var__type_ var__app_ var__service_ var__src_ \
-var__dst_ var__args_ var__secret_ var__version_ var__cmd_ var__data_ \
-var__command_ var__host_ var__user_ var__port_ var_app var_new var_list var_ls \
-var_deploy var_undeploy var_config var_delete var_rm var_logs var_cp var_check \
-var_ps var_run var_secret var_auto var_generate var_insert var_server var_add \
-var_init var_apps var_upgrade var_version; parse 100 "$@"
-local prefix=${DOCOPT_PREFIX:-''}; unset "${prefix}__stack" "${prefix}__env" \
-"${prefix}__help" "${prefix}__server" "${prefix}__domain" \
-"${prefix}__app_name" "${prefix}__pass" "${prefix}__auto" "${prefix}__status" \
+[[ -n $1 ]] && printf "%s\n" "$1" >&2; printf "%s\n" "${DOC:40:1131}" >&2
+exit 1; }'; unset var___stack var___help var___env var___server var___domain \
+var___app_name var___pass var___status var___skip_check var___force \
+var___no_tty var___user var___secret var___version var___all var__type_ \
+var__app_ var__service_ var__src_ var__dst_ var__args_ var__cmd_ var__secret_ \
+var__version_ var__data_ var__command_ var__host_ var__user_ var__port_ \
+var_app var_new var_list var_ls var_deploy var_undeploy var_config var_delete \
+var_rm var_logs var_cp var_check var_ps var_run var_secret var_generate \
+var_insert var_server var_add var_init var_apps var_upgrade var_version
+parse 100 "$@"; local prefix=${DOCOPT_PREFIX:-''}; unset "${prefix}__stack" \
+"${prefix}__help" "${prefix}__env" "${prefix}__server" "${prefix}__domain" \
+"${prefix}__app_name" "${prefix}__pass" "${prefix}__status" \
 "${prefix}__skip_check" "${prefix}__force" "${prefix}__no_tty" \
-"${prefix}__user" "${prefix}__all" "${prefix}_type_" "${prefix}_app_" \
-"${prefix}_service_" "${prefix}_src_" "${prefix}_dst_" "${prefix}_args_" \
-"${prefix}_secret_" "${prefix}_version_" "${prefix}_cmd_" "${prefix}_data_" \
-"${prefix}_command_" "${prefix}_host_" "${prefix}_user_" "${prefix}_port_" \
-"${prefix}app" "${prefix}new" "${prefix}list" "${prefix}ls" "${prefix}deploy" \
-"${prefix}undeploy" "${prefix}config" "${prefix}delete" "${prefix}rm" \
-"${prefix}logs" "${prefix}cp" "${prefix}check" "${prefix}ps" "${prefix}run" \
-"${prefix}secret" "${prefix}auto" "${prefix}generate" "${prefix}insert" \
-"${prefix}server" "${prefix}add" "${prefix}init" "${prefix}apps" \
-"${prefix}upgrade" "${prefix}version"
+"${prefix}__user" "${prefix}__secret" "${prefix}__version" "${prefix}__all" \
+"${prefix}_type_" "${prefix}_app_" "${prefix}_service_" "${prefix}_src_" \
+"${prefix}_dst_" "${prefix}_args_" "${prefix}_cmd_" "${prefix}_secret_" \
+"${prefix}_version_" "${prefix}_data_" "${prefix}_command_" "${prefix}_host_" \
+"${prefix}_user_" "${prefix}_port_" "${prefix}app" "${prefix}new" \
+"${prefix}list" "${prefix}ls" "${prefix}deploy" "${prefix}undeploy" \
+"${prefix}config" "${prefix}delete" "${prefix}rm" "${prefix}logs" \
+"${prefix}cp" "${prefix}check" "${prefix}ps" "${prefix}run" "${prefix}secret" \
+"${prefix}generate" "${prefix}insert" "${prefix}server" "${prefix}add" \
+"${prefix}init" "${prefix}apps" "${prefix}upgrade" "${prefix}version"
 eval "${prefix}"'__stack=${var___stack:-}'
-eval "${prefix}"'__env=${var___env:-}'
 eval "${prefix}"'__help=${var___help:-false}'
+eval "${prefix}"'__env=${var___env:-}'
 eval "${prefix}"'__server=${var___server:-}'
 eval "${prefix}"'__domain=${var___domain:-}'
 eval "${prefix}"'__app_name=${var___app_name:-}'
 eval "${prefix}"'__pass=${var___pass:-false}'
-eval "${prefix}"'__auto=${var___auto:-false}'
 eval "${prefix}"'__status=${var___status:-false}'
 eval "${prefix}"'__skip_check=${var___skip_check:-false}'
 eval "${prefix}"'__force=${var___force:-false}'
 eval "${prefix}"'__no_tty=${var___no_tty:-false}'
 eval "${prefix}"'__user=${var___user:-}'
+eval "${prefix}"'__secret=${var___secret:-}'
+eval "${prefix}"'__version=${var___version:-}'
 eval "${prefix}"'__all=${var___all:-false}'
 eval "${prefix}"'_type_=${var__type_:-}'; eval "${prefix}"'_app_=${var__app_:-}'
 eval "${prefix}"'_service_=${var__service_:-}'
 eval "${prefix}"'_src_=${var__src_:-}'; eval "${prefix}"'_dst_=${var__dst_:-}'
 if declare -p var__args_ >/dev/null 2>&1; then
 eval "${prefix}"'_args_=("${var__args_[@]}")'; else eval "${prefix}"'_args_=()'
-fi; eval "${prefix}"'_secret_=${var__secret_:-}'
+fi; eval "${prefix}"'_cmd_=${var__cmd_:-}'
+eval "${prefix}"'_secret_=${var__secret_:-}'
 eval "${prefix}"'_version_=${var__version_:-}'
-eval "${prefix}"'_cmd_=${var__cmd_:-}'; eval "${prefix}"'_data_=${var__data_:-}'
+eval "${prefix}"'_data_=${var__data_:-}'
 eval "${prefix}"'_command_=${var__command_:-}'
 eval "${prefix}"'_host_=${var__host_:-}'
 eval "${prefix}"'_user_=${var__user_:-}'
@@ -251,7 +253,6 @@ eval "${prefix}"'cp=${var_cp:-false}'
 eval "${prefix}"'check=${var_check:-false}'
 eval "${prefix}"'ps=${var_ps:-false}'; eval "${prefix}"'run=${var_run:-false}'
 eval "${prefix}"'secret=${var_secret:-false}'
-eval "${prefix}"'auto=${var_auto:-false}'
 eval "${prefix}"'generate=${var_generate:-false}'
 eval "${prefix}"'insert=${var_insert:-false}'
 eval "${prefix}"'server=${var_server:-false}'
@@ -261,20 +262,20 @@ eval "${prefix}"'apps=${var_apps:-false}'
 eval "${prefix}"'upgrade=${var_upgrade:-false}'
 eval "${prefix}"'version=${var_version:-false}'; local docopt_i=1
 [[ $BASH_VERSION =~ ^4.3 ]] && docopt_i=2; for ((;docopt_i>0;docopt_i--)); do
-declare -p "${prefix}__stack" "${prefix}__env" "${prefix}__help" \
+declare -p "${prefix}__stack" "${prefix}__help" "${prefix}__env" \
 "${prefix}__server" "${prefix}__domain" "${prefix}__app_name" \
-"${prefix}__pass" "${prefix}__auto" "${prefix}__status" \
-"${prefix}__skip_check" "${prefix}__force" "${prefix}__no_tty" \
-"${prefix}__user" "${prefix}__all" "${prefix}_type_" "${prefix}_app_" \
+"${prefix}__pass" "${prefix}__status" "${prefix}__skip_check" \
+"${prefix}__force" "${prefix}__no_tty" "${prefix}__user" "${prefix}__secret" \
+"${prefix}__version" "${prefix}__all" "${prefix}_type_" "${prefix}_app_" \
 "${prefix}_service_" "${prefix}_src_" "${prefix}_dst_" "${prefix}_args_" \
-"${prefix}_secret_" "${prefix}_version_" "${prefix}_cmd_" "${prefix}_data_" \
+"${prefix}_cmd_" "${prefix}_secret_" "${prefix}_version_" "${prefix}_data_" \
 "${prefix}_command_" "${prefix}_host_" "${prefix}_user_" "${prefix}_port_" \
 "${prefix}app" "${prefix}new" "${prefix}list" "${prefix}ls" "${prefix}deploy" \
 "${prefix}undeploy" "${prefix}config" "${prefix}delete" "${prefix}rm" \
 "${prefix}logs" "${prefix}cp" "${prefix}check" "${prefix}ps" "${prefix}run" \
-"${prefix}secret" "${prefix}auto" "${prefix}generate" "${prefix}insert" \
-"${prefix}server" "${prefix}add" "${prefix}init" "${prefix}apps" \
-"${prefix}upgrade" "${prefix}version"; done; }
+"${prefix}secret" "${prefix}generate" "${prefix}insert" "${prefix}server" \
+"${prefix}add" "${prefix}init" "${prefix}apps" "${prefix}upgrade" \
+"${prefix}version"; done; }
 # docopt parser above, complete command for generating this parser is `docopt.sh abra`
 
 PROGRAM_NAME=$(basename "$0")
@@ -473,6 +474,18 @@ stack_logs (){
   sleep infinity
 }
 
+auto_generate_secrets (){
+  get_app_secrets
+
+  for PASSWORD in "${PASSWORDS[@]}"; do
+    parse_secret "$PASSWORD"
+  done
+
+  for KEY in "${KEYS[@]}"; do
+    parse_secret "$KEY"
+  done
+}
+
 #######################################
 # abra app ..
 #######################################
@@ -611,8 +624,8 @@ sub_app_new (){
 
   get_app_secrets
 
-  if [ "${#PASSWORDS[@]}" -gt 0 ] || [ "${#KEYS[@]}" -gt 0 ] && [ "$abra___auto" == "true" ]; then
-    sub_app_secret_auto
+  if [ "${#PASSWORDS[@]}" -gt 0 ] || [ "${#KEYS[@]}" -gt 0 ]; then
+    auto_generate_secrets
   fi
 
   echo "$(tput setaf 4)Your new '$TYPE' is ready for action:$(tput sgr0)"
@@ -824,16 +837,17 @@ sub_app_secret_generate(){
   VERSION="$abra__version_"
   LENGTH="$abra__length_"
 
+  if [ -z "$SECRET" ] || [ -z "$VERSION" ]; then
+    auto_generate_secrets
+    return 0
+  fi
+
   if [[ "$SECRET" == *"password"* ]]; then
     PWGEN="${abra__cmd_:-pwqgen}"
   else
     PWGEN=${abra__cmd_:-pwgen -s "$LENGTH" 1}
   fi
 
-  if [ -z "$SECRET" ] || [ -z "$VERSION" ]; then
-    error "Required arguments missing"
-  fi
-
   PW=$($PWGEN|tr -d "\n")
 
   success "Password: $PW"
@@ -845,21 +859,6 @@ sub_app_secret_generate(){
   sub_app_secret_insert
 }
 
-sub_app_secret_auto(){
-  load_instance
-  load_instance_env
-
-  get_app_secrets
-
-  for PASSWORD in "${PASSWORDS[@]}"; do
-    parse_secret "$PASSWORD"
-  done
-
-  for KEY in "${KEYS[@]}"; do
-    parse_secret "$KEY"
-  done
-}
-
 ###### .. app <domain> run <args>...
 sub_app_run(){
   load_instance
@@ -1063,7 +1062,7 @@ abra() {
     abra__secret_ abra__version_ abra__data_ abra___user abra__host_ \
     abra__type_ abra__port_ abra__user_ abra__service_ abra__src_ abra__dst_ \
     abra__app_ abra___server abra___domain abra___force abra___pass \
-    abra___auto abra___status abra___no_tty abra___skip_check \
+    abra___status abra___no_tty abra___skip_check \
     abra___app_name
 
   if ! type tput > /dev/null 2>&1; then