kapi trust

$ kapi trust

List, inspect and change which projects may run commands.

A recipe that names an exec-class step (external-command, script, or the exec format) runs code the recipe chooses, with your privileges and your environment. kapi asks once per project before running it and remembers the answer, allow or deny, against a fingerprint of the commands shown. A recipe edit that changes what would run asks again. A comment edit's project formatter is decided the same way and kept in the same record, keyed by the configuration file that selects it.

These commands read and change that record, which is kept in the kapi config directory, not in the project. They are about execution only: plugin installs and package adoption are confirmed at the time and keep no record.

KAPI_TRUST_EXEC=1 grants trust to one process without consulting or writing the record; it is for automation and is not shown here as a decision.

Commandtrust

Groupadvanced

Watch it

trust needs network access, an API key, or local system access, so it can’t run in the browser playground. See the guides for a recorded run, or try it locally with the installed CLI.

Flags

This command has no local flags.

More examples

kapi trust show -p ./appkapi trust allow -p ./appkapi trust revoke ./app

← Back to the Command Reference