ak secrets approve

Trả lời các yêu cầu bí mật mà agent đang để chờ.

Dùng ak secrets approve với đối số và tùy chọn dưới đây. Phần help nguyên bản giữ nguyên thuật ngữ, cú pháp, tác động và điều kiện thực thi của CLI để đối chiếu chính xác.

Contract và help của lệnh

Answer the secret requests agents left waiting

Synopsis

Answer the secrets that agents asked for and could not have. A resolve that no grant covers does not prompt — a hook has no terminal to prompt on, and one that stalled would be ignored rather than obeyed — so it files the request here and fails closed. This is where you answer it, in a terminal of your own.

There are four answers. Deny once refuses this request and stores nothing, so the next one asks again. Allow once releases the secret exactly once. Allow for a while is the default and expires on its own. Allow until revoked never expires. Each writes the same grant rows ak secrets grant does, keyed by the same four fields, so ak secrets grants and ak secrets revoke work on them unchanged.

With no --state and a terminal, each waiting request is shown in turn and answered by a single key. Without a terminal, or with --json, the command only lists: there is nobody at the keyboard to ask. --state answers without the prompt and needs the request named unambiguously.

The command refuses to run at all when an agent adapter sits above it in the process tree, and records that attempt in the audit ledger. An agent answering its own request would make the whole inbox theatre. This is a speed bump, not a guaranteed boundary: it depends on recognizing an adapter in the parent-process chain, and a detached process or a redirected AGENTKIT_HOME looks like an operator's own terminal to it.

Effects: Reads the approval inbox under AGENTKIT_HOME. An answer writes one row into the grants file and clears that request; a denial writes an audit row and clears it. Stored secret values are never read or printed.

Exit status: 0 success 2 invalid flags, or the answer matches no request or more than one 5 the inbox, grant file, or audit ledger could not be used 6 an agent adapter is above this process; an agent may not answer its own request

ak secrets approve [<ref>] [flags]

Examples

  ak secrets approve                              # review everything waiting
  ak secrets approve ${REF} --state once           # release once, then ask again
  ak secrets approve ${REF} --state ttl --ttl 30d  # allow for 30 days
  ak secrets approve ${REF} --state deny           # refuse this request

Options

      --agent string     Narrow to one agent fingerprint, sha256:<64 hex>
  -h, --help             help for approve
      --json             Emit machine-readable JSON (implies --no-interactive)
      --no-interactive   Disable interactive prompts (CI-safe)
      --project string   Narrow to one project slot
      --purpose string   Narrow to one purpose label; an empty value is a literal, not a wildcard
  -q, --quiet            Suppress non-error output on stderr
      --state string     Answer without the prompt: deny, once, ttl, or persist
      --ttl string       How long an allow lives, e.g. 12h, 30d, 2w (default 24h)
  -V, --verbose          Extra diagnostic output on stderr (loses to --quiet)
  -y, --yes              Assume yes for all prompts

SEE ALSO

• ak secrets - Manage named secret values (API keys, tokens)