agentknock secret list

agentknock secret list requests the names and public metadata of secrets available to this client from the paired phone:

agentknock secret list

The command takes no arguments or command-specific options. It requires a completed pairing and a response from the phone each time you run it. Use the returned names with agentknock run or to identify an existing secret for secret upload --update.

Output

On success, the command writes a formatted JSON object to standard output. Its secrets property maps secret names to metadata:

{
  "secrets": {
    "git-signing": {
      "description": null,
      "type": "ssh",
      "public_key": "ssh-ed25519 AAAA..."
    },
    "github": {
      "description": "GitHub API access",
      "type": "environment",
      "variables": ["GH_TOKEN"]
    }
  }
}

The public key above is abbreviated. Each entry contains:

Field	Meaning
description	The secret’s description, or null when none is set.
type	environment, ssh, or another type name reported by the phone.
variables	For environment secrets, an array of environment variable names, sorted with duplicates removed.
public_key	For ssh secrets, the public key in OpenSSH format.

Secret names are sorted. If no secrets are available, the result is {"secrets": {}}. Types the CLI doesn’t recognize still appear with their reported type and description, but without any additional metadata.

The output contains no environment values or private keys. Listing a secret doesn’t request permission to use it; the phone evaluates that request when you run a command.

Use the result in scripts

Progress and errors go to standard error, keeping standard output available for JSON. For example, agentknock secret list | jq -r '.secrets | keys[]' prints just the names.

The CLI waits for the phone and reports progress and elapsed time every 30 seconds. If the request fails or you interrupt it before a response arrives, the command exits unsuccessfully without printing a JSON result. Check the exit status before treating an empty output as an empty secret list.

After receiving the list, the CLI sends a final confirmation before printing it. A connection failure during this step can still make the command fail without JSON. If you interrupt this wait after the CLI has verified the phone’s response, it can finish successfully and print the received list.