Secret editor

New secret creates a secret on the phone. Edit secret, opened from Secret details, changes an existing secret’s name and description.

Name and description

Field	Behavior
Secret name	Required and unique across all stored secret types. Names are case-sensitive, and leading or trailing whitespace is rejected. Spaces within a name are allowed.
Description	Optional text describing the secret’s purpose. Clearing it removes the description.

Clients use the secret’s exact name with -s. The CLI rejects names containing commas, so choose a name without commas for CLI use. Quote names containing spaces in shell commands.

Names and descriptions are visible to paired clients through secret listing. Put credentials in the secret’s values or key material.

Create an environment secret

Environment variables is the initial type. Add any number of variables with a name, value, and Sensitive setting. Add inserts another row, and a row’s remove action removes it from the draft.

Variable names must start with an ASCII letter or underscore and contain only ASCII letters, digits, and underscores. Each name must be unique within this secret. Empty values are allowed. Rows with neither a name nor a value are ignored, so you can create an empty secret and populate it later.

Variables are sensitive by default. Turning Sensitive off makes the value visible and available to clients without approval, and permits its inclusion in AI review context. Saving a new secret containing any non-sensitive values uses your configured device authentication. See Environment variable editor for the full implications.

Create secret saves the secret and its variables together, then opens its details. Invalid or duplicate variable names prevent creation. If the secret name is already in use, the editor stays open so you can choose another.

Create an SSH secret

Select SSH key, then generate or import a key using the SSH key editor controls. Review the public identity before selecting Create secret. Preparing a key does not save the secret; the final create action is required.

New SSH secrets initially offer generation of an Ed25519 key. You can also generate RSA or paste a supported OpenSSH private key. Switching back to Environment variables discards pasted or prepared private-key material from the draft.

Both secret types start with Ask as their default approval mode, no client overrides, and no secret AI instructions. Configure those from Secret details after creation. The type cannot be changed once saved.

Edit an existing secret

The type is displayed but cannot be changed. Save secret becomes available when the name or description differs from its stored value. Manage variables and SSH key material through the separate actions in Secret details.

Renaming preserves the stored contents and client access settings, but commands must use the new name. Renaming also ends the secret’s temporary access grants. Changing only the description preserves them.

Unsaved changes

Leaving an edited form with Back asks whether to Discard or Keep editing. While a save is in progress, editing and Back are unavailable; validation or save failures return you to the editor.

If you put the app in the background with entered sensitive values or pasted or prepared private-key material, Agentknock closes that draft and discards its unsaved contents. Save before switching to another app. A brief handoff to device authentication preserves the draft; see Security for authentication and background behavior.