# K1 daemon CLI
`kcode-k1-daemon-cli` is the local process-command owner for the current thin K1 runner. Its sole public API is `run(PathBuf) -> ExitCode`.
With no process arguments, `run` delegates directly to `kcode_k1_daemon_lib::run`, so the daemon retains its single normal Vault prompt. The only administrative forms are `set-secrets <name>`, `remove-secrets <name>`, and `list-secrets`. Invalid shapes and non-UTF-8 commands or names fail before prompting or opening state.
Administrative commands are offline and local. Stop the normal daemon first: K1 has one trusted exclusive state owner, and this crate adds no lock, PID file, process probe, socket, listener, networking, retry, or background work. Local OS access plus the Vault passphrase is the intended authority.
An administrative command prompts once for `Unlock K1 vault: `. Set additionally prompts, without echo, for `Value for <name>: ` and `Confirm secret value: `. Empty or mismatched values are rejected and discarded. Passphrases and values are never accepted in arguments or environment variables and are never printed, logged, formatted, forwarded to stdin, or sent to a subprocess or API.
State opens in this order: `<root>/state/ordering`, `<root>/state/peering`, then `<root>/state/vault`. The live values are composed as `Arc<K1TxnOrdering>`, `Arc<K1Peering>`, and `K1Vault::open`. No daemon files, Persons, Invites, provider, HTTP state, signal handler, or listener is opened. Existing plaintext Peering identity storage is unchanged.
Set performs exactly one synchronous `K1Vault::set`, adding or replacing the name. Remove performs `K1Vault::remove` and distinguishes removal from an absent name. List calls only `K1Vault::names` and prints those already-sorted names, never values. All dependencies, prompts, operations, and output writes fail closed with a fixed secret-free command error.
An entirely empty Vault has no encrypted item with which to verify a password. Its first Set establishes encrypted state; populated Vaults reject a wrong password. This accepted Vault limitation is not supplemented with a verifier.
A local operation opens current K1 state and the Vault projection. List is linear in the number of names. Set performs at most one age encryption and one Peering submission; remove performs at most one Peering submission and absent removal performs none. There is no finite latency claim.
This package does not change daemon-lib, Vault, Peering, transaction ordering, any runner artifact, or any existing package. It does not provide an HTTP/admin API, provider integration, Peering identity encryption, migration, recovery, rotation, hot update, online concurrent administration, networking, aliases, command hierarchies, flags, or password input through environment variables or arguments.
Version 0.1.1 preserves every command and prompt while selecting daemon-lib 0.6.0, whose normal run always composes the audio HTTP subsystem.
Version 0.1.2 preserves every command and prompt while selecting daemon-lib 0.7.0, whose normal run also mounts the authenticated Persons HTTP routes.