alias
ak secrets alias set
Point an alias name at a stored ref, replacing any earlier target.
Use ak secrets alias set to pick which stored secret an alias name follows.
Running it again with another ref switches the alias in one step.
Usage
ak secrets alias set <NAME> <REF> [--backend <backend>]Exactly two arguments are required. NAME must be an environment-variable
name: letters, digits and _, not starting with a digit. REF must be a valid
ref and may not be NAME itself.
| Flag | Default | Description |
|---|---|---|
--backend <backend> | keychain | Backend whose index is read to warn about a target with no stored value: keychain, file or memory. |
--unlock-with-recovery | off | Open the file backend's vault with a recovery private key and set a new passphrase. |
REF need not be stored yet. A missing target is a warning, not a refusal, so
an alias can be set up before a sync brings the value in; until then, a release
through the alias is refused as a missing secret. A second warning is printed
when a secret named NAME is already stored, because a stored secret wins over
an alias and the alias is not followed while it exists. Both warnings go to
stderr and are suppressed by --quiet. Grants are checked against REF, never
NAME.
The command writes ~/.agentkit/secrets/aliases.json and reads the secrets
index for the warnings. It never reads or writes a value.
Output
Human stdout prints NAME -> REF, followed by (was OLD) when the alias
already pointed at a different ref.
JSON success uses:
schema_version: 1
kind: secrets.alias
data.action: set
data.aliases[]: name, ref, updatedAt
data.previous?data.aliases holds the one alias that was written. data.previous is the
earlier target and is omitted when the alias is new.
Exit behavior
| Exit | Meaning |
|---|---|
0 | Success, including a target that is not stored yet. |
2 | Invalid NAME or REF. |
5 | The aliases file could not be read or written. |