Environment variable editor

Use Add in an environment secret’s details to open New environment variable. A variable’s Edit action opens Edit environment variable. The editor identifies the secret that owns the variable.

Name and value

Name is the stored variable name. It must start with an ASCII letter or underscore and contain only ASCII letters, digits, and underscores. Names are case-sensitive and must be unique within this secret. Different secrets may contain the same variable name.

By default, a command receives the variable under this name. Renaming it changes future deliveries unless the client explicitly selects a different destination with --rename-env. Update commands that select the old stored name.

Value accepts text, including spaces, newlines, and an empty string. The value is stored exactly as entered, without trimming whitespace or interpreting shell expressions. A null byte is rejected. Clearing the field saves an empty value; it does not delete the variable.

Sensitive values are concealed in the editor until you use Show. Opening an available sensitive value for editing already uses your configured device authentication, so toggling its visibility inside the editor does not start a separate check. A current authenticated session can satisfy the initial check.

Sensitivity

New variables start with Sensitive enabled. This setting controls both how the value is presented on the phone and how Agentknock may use it.

Setting	Behavior
Sensitive on	Hidden until revealed. Protected reads use device authentication, and delivery to a client follows the secret’s approval settings. The stored value is excluded from AI review context.
Sensitive off	Displayed automatically and provided to clients without approval. Its value may be sent as context for AI review.

Non-sensitive values bypass the secret’s approval mode, including Deny. They may also be included in an AI review when their secret is requested but the individual variable is omitted from delivery to the command. Use this setting for context such as a hostname or region that may be shared along with a sensitive credential.

Both kinds of value are stored encrypted. The sensitivity switch controls use and disclosure; it does not select whether storage is encrypted.

Creating a non-sensitive variable or changing an existing sensitive variable to non-sensitive uses the configured device authentication when saved. Changing a non-sensitive value to sensitive does not require that extra check. Changing sensitivity does not alter the value itself.

Save changes

Add creates the variable. Save becomes available when an existing variable’s name, value, or sensitivity changes. Duplicate names and invalid values leave the editor open with an error.

You can change the name or sensitivity while keeping the current value concealed. If you leave the value unchanged, Agentknock retains it rather than treating the edit as a replacement. A successful create, edit, or deletion ends the containing secret’s temporary access grants.

Replace an unavailable value

If the phone no longer has the key needed to decrypt a value, the editor opens with a warning and an empty value field. That empty field is a placeholder for a replacement; leaving it untouched does not replace the lost value.

Enter a replacement to make the variable usable again. To replace it with an empty string, edit the field and then clear it. Renaming or changing sensitivity while retaining an unavailable value fails because Agentknock cannot preserve the old contents.

If the phone reports corrupted or unsupported encrypted data when opening an otherwise available value, the editor cannot open it. A corrected secret upload can replace the affected variable with a known value.

Delete a variable

For an existing variable, choose Delete from the editor’s menu and confirm. This permanently removes its stored value and metadata from the secret. The secret itself remains, including when its last variable is deleted. Deletion does not revoke the corresponding credential at the service that issued it.

Unsaved changes

Back asks whether to discard a changed draft or keep editing. Saving disables further edits and Back until the operation finishes.

Putting the app in the background closes an editor for a sensitive variable and discards its unsaved changes. This also applies if you have turned sensitivity off in the draft but have not saved that change. Drafts for variables that were and remain non-sensitive can remain open. A brief handoff to device authentication preserves the draft; see Security for authentication and background behavior.