Secret use request
A Secret use request asks the phone to provide data from named secrets to a command on a paired client. The request describes the command and the data it will receive. SSH private-key operations appear later as separate Git signing or SSH authentication requests.
Review the request
Section titled “Review the request”The main card identifies the client and requested secrets, followed by the client’s reason when supplied and the complete command with its arguments.
Command arguments are quoted to make their boundaries visible. Longer commands are displayed with one argument per line, without removing or reordering arguments. Control and invisible formatting characters are escaped, and the app flags non-ASCII characters in the displayed command. Command text is selectable for copying.
When the client supplies captured script source, expand Script contents to read or copy it.
The command, reason, script source, and process details are reported by the paired client. They describe the client’s request; the phone does not independently inspect the process running on the computer.
Requested data
Section titled “Requested data”Requested secrets shows each available secret’s name, type, and description. For an environment-variable secret, it also shows how the client’s selection will be delivered:
| Display | Meaning |
|---|---|
| A variable name | Delivered under that environment-variable name. |
SOURCE → TARGET |
Delivered under a different environment-variable name. |
SOURCE → standard input |
Delivered through the command’s standard input. |
| Not provided | Excluded from this request’s delivery. |
Values marked non-sensitive are visible in the recorded request context. Sensitive values are hidden and cannot be revealed from this screen. A non-sensitive value may still appear beside an omitted variable to provide context, although that variable is not delivered. Older requests without a recorded value snapshot show Values were not recorded for this request.
For an SSH-key secret, this request provides the public key. The private key stays on the phone, and each later signing operation is evaluated separately.
Approval modes apply to the sensitive environment values selected for delivery. A request containing only public SSH keys or non-sensitive environment values is allowed automatically. Omitting every sensitive variable therefore removes the need for a protected-value approval, even if other variables in that secret are sensitive.
Decide and track delivery
Section titled “Decide and track delivery”When the request needs your decision, Allow once releases the requested data and Deny once refuses the whole request. Allow for 4 hours…, when available, also grants this client temporary delivery access to the secrets listed in its confirmation, for any command or variable selection. It does not approve later SSH authentication or Git signing.
See Requests for AI decisions, temporary access, and checks performed again at approval time. The detail page keeps the decision history, including AI explanations and any temporary-access expiry recorded for this request.
After approval, the page waits for the client to confirm receipt. Delivered means the requested data reached the client. It does not mean the command has finished. A denied request releases none of its requested values. Aborted, invalid, or unverifiable exchanges show their recorded outcome instead.
Unavailable or invalid data
Section titled “Unavailable or invalid data”Secrets are unavailable lists missing secrets and disables approval. Other problems can reject the request or prevent approval, including:
- A selected environment variable no longer exists.
- Different requested secrets would deliver conflicting environment-variable names.
- Environment-variable options were applied to an SSH-key secret.
- More than one SSH key was requested.
- A stored value is unavailable, cannot be authenticated, or uses unsupported encryption.
If a secret or approval setting changed while the request was open, review the updated request before approving again. The app does not silently approve newly changed data using the earlier screen contents.
Technical details
Section titled “Technical details”Expand Technical details for the exact request time, working directory, execution mode, launcher chain when present, executable path and available hash, and the kinds of standard input, output, and error streams reported by the client.
Available system information includes the platform, architecture, hostname, OS version, machine ID, client software, and Agentknock library version. The hostname is omitted when it matches the client name, and the library version is shown separately when it differs from the client application.
Client and request IDs, plus decision and completion times when available, help connect the request to its audit events. For the command-side effects of delivery options, see the CLI run reference.