ak secrets trust

Use ak secrets trust for the operation described below. The command help records its arguments, effects, and options.

Command contract

Show or re-pin a coding agent's trusted binary

Synopsis

Show which binary AgentKit trusts as <adapter>, or re-pin it with --refresh. AgentKit identifies the coding agent that spawned it by walking the parent process chain and hashing that binary; a pin records the binary's absolute path and SHA-256 so an upgraded, replaced, or substituted binary is noticed instead of silently trusted. Re-pin after upgrading an agent, or after an anti-virus quarantine restores its binary. --refresh needs an interactive terminal: it is the one place an operator confirms a change of trust in person.

Effects: With --refresh, and only after the operator confirms the new binary, runs <adapter> --version to record a version hint and writes the adapter's entry to ~/.agentkit/trust.json. Without it, read-only.

Exit status: 0 success 2 invalid flags or arguments, or --refresh outside an interactive terminal 3 the adapter's binary was not found or could not be hashed 5 trust file failure

ak secrets trust <adapter> [flags]

Examples

  ak secrets trust claude            # show the current pin
  ak secrets trust claude --refresh  # confirm and re-pin after an upgrade
  ak secrets trust codex --json      # machine-readable pin metadata

Options

  -h, --help             help for trust
      --json             Emit machine-readable JSON (implies --no-interactive)
      --no-interactive   Disable interactive prompts (CI-safe)
  -q, --quiet            Suppress non-error output on stderr
      --refresh          Re-pin the adapter to the binary currently on PATH, after confirmation
  -V, --verbose          Extra diagnostic output on stderr (loses to --quiet)
  -y, --yes              Assume yes for all prompts

SEE ALSO

• ak secrets - Manage named secret values (API keys, tokens)