canvas config list - surface set vs unset status (without exposing values)

[dposada]

Following up on #998: I understand the security stance against returning secret values via CLI, and I agree with that principle. The narrower ask here is a per-key boolean indicator (does each declared secret have a value configured?), without revealing what the value is.

Use case: Verifying that all required plugin secrets are populated in a target Canvas instance, as a scripted pre-flight before deploying plugin code that depends on them. Today this is only possible via the web UI as far as I can tell. A flag like canvas config list --show-status returning KEY: set / KEY: unset (or similar) would help without any value disclosure.

Concrete scenario: A plugin-secret-schema change (renaming several existing secrets and adding new ones) needs the new secrets populated in the target Canvas instance before the plugin code is deployed. Without programmatic set/unset visibility, an operator who misses one only finds out when things start breaking in production.

[rmagier1]

Hi @dposada, I created issue #1669, so we can pass it back to our engineering team to see if this is something we want to support.