Requests

Requests shows requests from paired clients to receive secret data, sign Git content, or authenticate over SSH. It includes automatic approvals and denials as well as requests that need your decision.

Pairing attempts appear in Clients, and secret uploads appear in Secrets. The audit log records the individual events behind these operations, including activity that has left the request list.

Browse requests

The list separates requests into three groups:

Group	Contents
Waiting for you	Requests that need a human decision.
In progress	AI reviews and requests waiting for the client to confirm the result.
Earlier	Completed, denied, aborted, and failed requests.

Each group shows its request count, with newer requests first. The app keeps the 100 most recent completed requests across all three request types, alongside requests still in progress.

An entry shows the operation, client, requested secrets, received time, and status. Secret-use entries show the command. Git entries show the signing content summary and available repository information. SSH entries show the remote account and the command that triggered authentication. A decision summary identifies automatic approval, AI review, temporary access, or your own decision when available.

Tap an entry to open its full details:

• Secret use explains which data a command will receive.
• Git signing shows the content to sign.
• SSH authentication shows the authentication operation to sign.

Allow or deny a request

For a request waiting for you, Allow once approves that request and Deny once refuses it. These actions do not change the secret’s approval mode. You can also swipe a pending row right to allow once or left to deny once.

A secret-use request can include several secrets. The decision covers the request as a whole: it does not release a selected subset after denying the rest. SSH authentication and Git signing are separate requests, even when they follow an already approved command.

Agentknock checks the client, secrets, and current approval settings again when you approve. If something changed while the request was open, the app may update its details and ask you to review it again. A current Deny setting for a protected use blocks approval. If an SSH key was changed or renamed after the original command began, start the command again.

An unavailable client, missing secret, unreadable stored value, or request that has already ended can also prevent a decision. The app reports the reason. A request waiting for AI review or client confirmation has no decision buttons.

AI review

When the applicable approval mode is Ask AI, a request can enter AI reviewing. The reviewer can approve, deny, or ask you to decide. For a command requesting several secrets, any applicable Deny blocks the whole request. If any protected secret requires Ask me, the command goes directly to you without an AI review.

AI review uses the request context, including captured script source when provided, and the applicable general, client, and secret instructions. Secret-use context includes variable delivery and values marked non-sensitive. Git review includes the exact signing content and available repository context. SSH review includes the remote account, authentication method, and available host-key identity. Sensitive environment values and private SSH keys are excluded from this review context.

The detail page shows the review result and explanation. If AI review is inactive, unavailable, interrupted, or unable to make a decision, the request comes to you. Restarting the app after an interrupted review does not silently submit a second review. Changes to the client, secret, instructions, or approval settings during a review can also require a human decision instead of applying the earlier result.

AI approval and denial are final decisions for that request. An AI denial can include its explanation in the result returned to the client.

Allow for four hours

Eligible requests offer Allow for 4 hours…. The confirmation names the client, secrets, and kind of access being granted. Confirming approves the current request and allows matching future requests automatically for four hours, without asking you or AI.

Temporary access is specific to the client, secret, and operation:

Operation	What the grant allows
Secret delivery	Protected values from the listed secrets, for any command on that client.
Git signing	Git signatures using the listed key, for any repository on that client.
SSH authentication	SSH authentication using the listed key, for any SSH server on that client.

The grant is broader than the command, repository, server, or variable selection shown in the current request. It does not grant the other kinds of access in the table.

The option is available for protected uses requiring Ask me, and for Ask AI uses that have come to you because review was skipped, interrupted, unsuccessful, or deferred. It is unavailable while AI review is running. Uses already approved by AI or covered by temporary access do not receive a new four-hour grant from this action. The confirmation lists exactly which secrets gain temporary access; any other protected uses are approved only for the current request.

You can end temporary access in the secret’s settings or the client’s details. Changes to secret contents, secret names, secret instructions, or applicable approval modes can also end grants. Editing general or client instructions does not end existing temporary access. Ending access stops future automatic approvals; it cannot retrieve data or signatures already delivered.

If the current request is approved but the grant cannot be started, the app explicitly reports that only a one-time approval succeeded.

Understand the result

An approval and a confirmed delivery are separate stages. Waiting for client means a decision has been prepared, but the app is still waiting for the client’s confirmation. This applies to denials as well as approvals.

Result in the list	Meaning
Delivered	The client confirmed receipt of the requested secret data.
Signed	The client confirmed receipt of a Git signature.
Authenticated	The client confirmed receipt of an SSH authentication signature.
Denied	The request was refused.
Aborted	The client stopped the request.
Invalid request	The request failed validation.
Verification failed	Agentknock could not verify a cryptographic message or confirmation.
Completed	The exchange ended without a recorded client result; open its details for the explanation.

These results describe Agentknock’s exchange with the client. They do not report whether the command finished successfully, Git saved a commit, or an SSH server accepted the login. Open an ended or failed request for the recorded explanation; a connection failure after approval does not prove that nothing was delivered.

Refresh and connection problems

Refresh checks for outstanding requests and results. It is disabled while a refresh is already running. If the app reports a connection problem, open the problem indicator for details or use Retry in the banner.

A disabled-notifications indicator opens Settings. Requests can still be reviewed inside the app; enabling notifications lets the phone alert you when a decision is needed.