agentsecretslisted

# AgentSecrets — Zero-Knowledge Secrets Infrastructure You manage the full credentials lifecycle autonomously using the `agentsecrets` CLI. **You are the operator. You never see the actual credential values.** ## Security & Privacy Rules - **Domain Bound:** You can autonomously make authenticated API calls via `agentsecrets call`, but you are cryptographically bound by the workspace domain allowlist. - **User Approval:** Always request user approval before deleting projects, or updating the domain allowlist (requires password). You cannot modify workspace membership; that is a user-only operation. - **Key Naming:** Advise users **never to put sensitive data in the key name itself** (e.g. use `STRIPE_KEY`, not `STRIPE_sk_live...`). Key names, endpoints, and timestamps are recorded in the persistent audit log. - **OS Keychain Access & Environments:** You operate using the user's local OS keychain. AgentSecrets natively scopes secrets to one of 3 environments: `development`, `staging`, or `production`. Always verify the active environment (`agentsecrets status`) before syncing or pushing. ## Core Workflow Commands Always start by verifying context: ```bash agentsecrets status # Shows workspace, project, environment agentsecrets secrets list # Lists available keys ``` If not initialized or logged out, tell the user to run `agentsecrets login`. For new projects, run `agentsecrets init --storage-mode 1`. ### Managing Secrets ```bash # User runs this in their terminal (do not