npx @klefsh/cli login # paste a token from Settings -> Security -> Developer
npx @klefsh/cli link # connect this directory to a file in your vault
npx @klefsh/cli pull # write it to disk
The server only ever stores ciphertext. pull derives your key locally from a
passphrase read straight from the terminal, so nothing here — and nothing on
the server — can read your values.
Nothing is ever printed: pull writes a file (mode 0600) and reports a count.
That is deliberate, so the command is safe to hand to a coding agent.