@envseal/cli 0.1.4 → 0.1.6

package/dist/bin.js

@@ -11,9 +11,10 @@ import { verify } from './commands/verify.js';
 import { run } from './commands/run.js';
 import { doctor } from './commands/doctor.js';
 import { revoke } from './commands/revoke.js';
+import { audit } from './commands/audit.js';
 import { mcp } from './commands/mcp.js';
 import { init } from './commands/init.js';
-const VERSION = '0.1.4';
+const VERSION = '0.1.5';
 async function main() {
     const argv = process.argv.slice(2);
     if (argv.length === 0 || argv[0] === '--help' || argv[0] === '-h') {
@@ -115,6 +116,10 @@ async function main() {
                 await revoke(root, key, json, parsed.flags.yes === true);
                 break;
             }
+            case 'audit': {
+                await audit(root, json, parsed.flags.verify === true);
+                break;
+            }
             case 'mcp': {
                 await mcp(root);
                 break;
@@ -137,7 +142,7 @@ function showHelp() {
 Usage: envseal <command> [options]
 
 Commands:
-  init [--host <name>]          Initialize env.schema.jsonc
+  init [--host <name>]          Initialize manifest, AGENTS.md, and host MCP
   ensure [--check]             Prompt for all missing required keys
                                (--check: report only, exit 0/1, never prompt)
   set <KEY>                     Prompt for a single key
@@ -146,6 +151,8 @@ Commands:
   run -- <cmd...>               Execute command with injected secrets
   doctor                        Report project configuration status
   revoke <KEY>                  Revoke a key from the sink
+  audit [--verify]              Print audit events (--json for machine form);
+                                --verify checks the log's tamper-evidence chain
   mcp                           Start the MCP server
 
 Global Options:

package/dist/cli-utils.js

@@ -161,9 +161,9 @@ export function parseArgs(argv) {
 const COMMAND_USAGE = {
     init: `Usage: envseal init [--host <name>] [--json] [--project <path>]
 
-Initialize env.schema.jsonc, declaring every environment-variable reference found by scanning the project.
+Initialize env.schema.jsonc, merge AGENTS.md (Layer 1), and write project host MCP/config for every matching marker.
 
-  --host <name>     Override host detection. Valid values: claude-code, cursor, continue, aider, windsurf, cline, zed, codex, jetbrains, goose, copilot, generic, unknown.
+  --host <name>     Write this host's project config (comma-separated ok). Valid values: claude-code, cursor, continue, aider, windsurf, cline, zed, codex, jetbrains, goose, copilot, generic, unknown, openhands.
   --json            Output as JSON.
   --project <path>  Project root (default: auto-detect).`,
     ensure: `Usage: envseal ensure [--check] [--json] [--project <path>]
@@ -202,8 +202,8 @@ Asks for confirmation first; --yes (or ENVSEAL_ASSUME_YES=1) pre-approves it.
   --project <path>  Project root (default: auto-detect).`,
     doctor: `Usage: envseal doctor [--json] [--project <path>]
 
-Audit the project configuration: detected host and tier, gitignore coverage,
-file permissions, missing required keys.
+Audit the project configuration: detected host and tier, agent wiring (MCP +
+AGENTS.md), gitignore coverage, file permissions, missing required keys.
 
   --json            Output as JSON.
   --project <path>  Project root (default: auto-detect).`,

package/dist/commands/audit.d.ts

@@ -0,0 +1,16 @@
+/**
+ * `envseal audit` — inspect the project's audit log.
+ *
+ * Default: print recorded events (human-readable) or the raw event array
+ * (--json). With --verify: check the hash chain instead; exit 7
+ * (AUDIT_CHAIN_FAILED) when the chain is broken. A missing log verifies as
+ * intact with zero records — there is nothing to attest, and "no log yet"
+ * must not look like tampering.
+ *
+ * When the project's out-of-band mirror (~/.envseal/mirrors/) exists, verify
+ * also compares the log against it: the mirror is a second copy the project's
+ * agent cannot silently shrink, so records the mirror proves existed but the
+ * log lost are tail truncation — exit 7. See docs/residual-risks.md §10.
+ */
+export declare function audit(root: string, json: boolean, verifyMode: boolean): Promise<void>;
+//# sourceMappingURL=audit.d.ts.map

package/dist/commands/audit.js

@@ -0,0 +1,117 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { compareWithMirror, projectPaths, readAudit, readMirrorLines, verifyAuditChain } from '@envseal/core';
+import { EXIT } from '../exit-codes.js';
+import { finish } from '../exit.js';
+/**
+ * `envseal audit` — inspect the project's audit log.
+ *
+ * Default: print recorded events (human-readable) or the raw event array
+ * (--json). With --verify: check the hash chain instead; exit 7
+ * (AUDIT_CHAIN_FAILED) when the chain is broken. A missing log verifies as
+ * intact with zero records — there is nothing to attest, and "no log yet"
+ * must not look like tampering.
+ *
+ * When the project's out-of-band mirror (~/.envseal/mirrors/) exists, verify
+ * also compares the log against it: the mirror is a second copy the project's
+ * agent cannot silently shrink, so records the mirror proves existed but the
+ * log lost are tail truncation — exit 7. See docs/residual-risks.md §10.
+ */
+export async function audit(root, json, verifyMode) {
+    if (!verifyMode) {
+        // No manifest gate here on purpose: the log is written by provisioning and
+        // use flows, and it stays readable even in a half-torn-down project whose
+        // env.schema.jsonc is already gone. An audit surface that refuses to
+        // audit would be its own finding.
+        const events = readAudit(projectPaths(root));
+        if (json) {
+            console.log(JSON.stringify(events, null, 0));
+            finish(EXIT.OK);
+            return;
+        }
+        if (events.length === 0) {
+            console.log('No audit events recorded.');
+            finish(EXIT.OK);
+            return;
+        }
+        for (const e of events) {
+            console.log(formatEvent(e));
+        }
+        finish(EXIT.OK);
+        return;
+    }
+    // --verify mode: chain check over the raw bytes. A missing file is an empty
+    // chain, not an error (see doc comment).
+    let raw = '';
+    try {
+        raw = readFileSync(join(root, '.envseal', 'audit.jsonl'), 'utf8');
+    }
+    catch {
+        raw = '';
+    }
+    const result = verifyAuditChain(raw);
+    const mirror = compareWithMirror(raw, readMirrorLines(root));
+    const ok = result.ok && !mirror.tailTruncated;
+    if (json) {
+        console.log(JSON.stringify(!ok
+            ? {
+                ok: false,
+                brokenAt: result.ok ? null : (result.brokenAt ?? null),
+                count: result.count,
+                mirror: { present: mirror.mirrorPresent, records: mirror.mirrorRecords },
+            }
+            : { ok: true, count: result.count, mirror: { present: mirror.mirrorPresent, records: mirror.mirrorRecords } }, null, 0));
+        finish(ok ? EXIT.OK : EXIT.AUDIT_CHAIN_FAILED);
+        return;
+    }
+    if (!ok) {
+        if (!result.ok) {
+            console.error(`AUDIT CHAIN FAILED: first break at record ${result.brokenAt} of ${result.count}. ` +
+                'Records were edited, deleted, reordered, or spliced after the fact. ' +
+                'Treat every record after the break as untrusted and investigate the host.');
+        }
+        else {
+            console.error(`AUDIT TAIL LOST: the project log holds ${mirror.projectRecords} record(s) but its out-of-band mirror ` +
+                `attests ${mirror.mirrorRecords}. Records after the surviving tail were deleted after being mirrored. ` +
+                'Treat the log as incomplete and investigate the host (docs/residual-risks.md §10).');
+        }
+        finish(EXIT.AUDIT_CHAIN_FAILED);
+        return;
+    }
+    if (mirror.mirrorPresent && mirror.mirrorRecords > mirror.projectRecords) {
+        console.log(`Audit chain intact (${result.count} record${result.count === 1 ? '' : 's'}); mirror holds ` +
+            `${mirror.mirrorRecords} — pre-reset history, not tampering.`);
+    }
+    else {
+        console.log(`Audit chain intact (${result.count} record${result.count === 1 ? '' : 's'}).`);
+    }
+    finish(EXIT.OK);
+}
+function formatEvent(e) {
+    const at = e.at;
+    switch (e.type) {
+        case 'declare':
+            return `${at} declare keys=${JSON.stringify(e.keys)}`;
+        case 'request':
+            return `${at} request ticket=${e.ticket} keys=${JSON.stringify(e.keys)} surface=${e.surface}`;
+        case 'stored':
+            return `${at} stored key=${e.key} sink=${e.sink}`;
+        case 'skipped':
+        case 'cancelled':
+        case 'timeout':
+            return `${at} ${e.type} ticket=${e.ticket} key=${e.key}`;
+        case 'verify':
+            return `${at} verify key=${e.key} result=${e.result}`;
+        case 'revoke':
+            return `${at} revoke key=${e.key} sink=${e.sink}`;
+        case 'blocked':
+            return `${at} blocked reason=${e.reason}`;
+        case 'use':
+            return `${at} use keys=${JSON.stringify(e.keys)} networkEgress=${String(e.networkEgress)} cmd=${e.command}`;
+        case 'use_result':
+            return `${at} use_result exit=${String(e.exitCode)} signal=${String(e.signal)} ${e.durationMs}ms`;
+        default:
+            return `${at} ${e.type}`;
+    }
+}
+//# sourceMappingURL=audit.js.map

package/dist/commands/doctor.js

@@ -1,12 +1,13 @@
 import { existsSync, statSync } from 'node:fs';
 import { join } from 'node:path';
 import { SepError } from '@envseal/protocol';
-import { inspectDotenvGitSafety, projectPaths } from '@envseal/core';
+import { inspectDotenvGitSafety, loadManifest, projectPaths, readHookHeartbeat } from '@envseal/core';
 import { emit, fail } from '../output.js';
 import { EXIT } from '../exit-codes.js';
 import { detectHost } from '../host.js';
 import { createBroker } from '../cli-utils.js';
 import { finish } from '../exit.js';
+import { inspectPrimaryHostWiring, wiringFailsDoctor } from '../host-wiring/inspect.js';
 export async function doctor(root, json) {
     try {
         // An audit of a project with no configuration would report an empty,
@@ -21,6 +22,7 @@ export async function doctor(root, json) {
             }));
             return;
         }
+        const manifest = loadManifest(projectPaths(root));
         const broker = await createBroker(root);
         const status = await broker.describe();
         const gitignorePath = join(root, '.gitignore');
@@ -28,13 +30,25 @@ export async function doctor(root, json) {
         const gitSafety = inspectDotenvGitSafety(projectPaths(root));
         const gitignoreCovers = gitSafety.ignored;
         const hookFailClosed = process.env.ENVSEAL_HOOK_FAIL_CLOSED === '1';
-        // Check .env permissions
-        let envFileOk = false;
+        // Check .env permissions.
+        //
+        // POSIX mode bits are only enforced on POSIX. Windows statSync still
+        // reports a mode (0o666 writable, 0o444 read-only), so the group/other
+        // test would produce 0o066 ≠ 0 and report permissionsOk:false on EVERY
+        // Windows machine regardless of the real ACLs — a permanent false alarm.
+        // Report null ("not measurable here") instead; access on Windows is an
+        // ACL question this check cannot answer.
+        let envFileOk = null;
         if (existsSync(envPath)) {
-            const stats = statSync(envPath);
-            envFileOk = (stats.mode & 0o077) === 0;
+            if (process.platform !== 'win32') {
+                const stats = statSync(envPath);
+                envFileOk = (stats.mode & 0o077) === 0;
+            }
         }
         const host = detectHost(root);
+        const egress = manifest?.policy?.egress;
+        const inspection = inspectPrimaryHostWiring(root, host.id, { probe: true });
+        const hookLastRan = readHookHeartbeat(root);
         const output = {
             projectRoot: root,
             manifestPath,
@@ -45,6 +59,7 @@ export async function doctor(root, json) {
                 reason: host.reason,
                 recommendation: host.recommendation,
             },
+            agentWiring: inspection.wiring,
             gitignore: {
                 exists: existsSync(gitignorePath),
                 covers: gitignoreCovers,
@@ -54,29 +69,57 @@ export async function doctor(root, json) {
                 isTracked: gitSafety.tracked,
                 permissionsOk: envFileOk,
             },
+            egressPolicy: egress ?? { mode: 'warn', allow: [] },
             hookFailClosed,
+            hookLastRan,
             missingRequiredCount: status.missingRequired.length,
             missingRequired: status.missingRequired,
+            rotationOverdue: status.entries
+                .filter((e) => isOverdue(e.rotationDue))
+                .map((e) => ({ key: e.key, due: e.rotationDue })),
+            ...(inspection.mcp === undefined
+                ? {}
+                : {
+                    mcp: {
+                        wired: inspection.mcp.wired,
+                        status: inspection.mcp.status,
+                        message: inspection.mcp.message,
+                        commandOk: inspection.mcp.commandOk,
+                    },
+                }),
         };
         if (!json) {
             console.log(`Project root: ${root}`);
             console.log(`Host: ${host.name} (Tier ${host.tier})`);
             console.log(`  ${host.reason}`);
             console.log(`  ${host.recommendation}`);
+            console.log(`Agent wiring: MCP ${inspection.wiring.mcp}, instructions ${inspection.wiring.instructions}`);
+            if (inspection.notOotb) {
+                console.log('  This host is not OOTB (print-only MCP). Layer 1 AGENTS.md is the working path.');
+            }
+            console.log(`  ${inspection.message}`);
             console.log(`Gitignore covers .env: ${gitignoreCovers ? 'yes' : 'no'}`);
+            console.log(`Egress policy: ${egress?.mode === 'allowlist' ? `allowlist (${egress.allow.length} allowed host${egress.allow.length === 1 ? '' : 's'})` : 'warn (default)'}`);
             console.log(`Hook on internal error: ${hookFailClosed ? 'fail-closed' : 'fail-open (default)'}`);
+            console.log(`Hook heartbeat: ${describeHeartbeatAge(hookLastRan)}`);
             console.log(`Missing required keys: ${status.missingRequired.length}`);
             if (status.missingRequired.length > 0) {
                 for (const key of status.missingRequired) {
                     console.log(`  - ${key}`);
                 }
             }
+            const overdue = status.entries.filter((e) => e.rotationDue !== null && isOverdue(e.rotationDue));
+            if (overdue.length > 0) {
+                console.log('Rotation overdue (advisory — rotate the credential, then rewrite the value):');
+                for (const e of overdue) {
+                    console.log(`  - ${e.key}: due ${e.rotationDue.slice(0, 10)}`);
+                }
+            }
         }
         else {
             emit(json, '', output);
         }
-        // Exit with UNSATISFIED if required keys are missing
-        if (status.missingRequired.length > 0) {
+        if (status.missingRequired.length > 0 || wiringFailsDoctor(inspection)) {
             finish(EXIT.UNSATISFIED);
             return;
         }
@@ -85,4 +128,38 @@ export async function doctor(root, json) {
         fail(json, error);
     }
 }
+/** Advisory by design: overdue rotation never fails doctor the way a
+ * missing required key does, because an aged-but-working credential is a
+ * hygiene problem, not an outage. */
+function isOverdue(rotationDue) {
+    if (rotationDue === null)
+        return false;
+    const due = Date.parse(rotationDue);
+    return !Number.isNaN(due) && due <= Date.now();
+}
+/**
+ * Human phrasing for the hook heartbeat. Advisory only — wiring can be
+ * present while the hook has never run (no plugin version, no tool call yet),
+ * and a recent timestamp proves liveness, not correctness.
+ */
+function describeHeartbeatAge(hookLastRan) {
+    if (hookLastRan === null) {
+        return 'none recorded (hook has not run for this project, or pre-heartbeat plugin)';
+    }
+    const then = Date.parse(hookLastRan);
+    if (Number.isNaN(then)) {
+        return 'unreadable timestamp';
+    }
+    const seconds = Math.max(0, Math.round((Date.now() - then) / 1000));
+    if (seconds < 90)
+        return `${seconds}s ago`;
+    const minutes = Math.round(seconds / 60);
+    if (minutes < 90)
+        return `${minutes}m ago`;
+    const hours = Math.round(minutes / 60);
+    if (hours < 36)
+        return `${hours}h ago`;
+    const days = Math.round(hours / 24);
+    return `${days}d ago`;
+}
 //# sourceMappingURL=doctor.js.map

package/dist/commands/init.js

@@ -1,32 +1,16 @@
 import { projectPaths, loadManifest, declareEntries, scanManifestEntry } from '@envseal/core';
 import { SepError } from '@envseal/protocol';
 import { emit, fail } from '../output.js';
-import { detectHost } from '../host.js';
+import { detectHost, resolveInitHostIds } from '../host.js';
 import { scanForEnvKeys, entryForKey } from '../scan.js';
 import { EXIT } from '../exit-codes.js';
 import { finish } from '../exit.js';
-// The ids detectHost can ever return. --host used to accept any string
-// silently, recording a host detection would never report and printing a tier
-// computed for a fiction.
-const KNOWN_HOST_IDS = [
-    'claude-code',
-    'cursor',
-    'continue',
-    'aider',
-    'windsurf',
-    'cline',
-    'zed',
-    'codex',
-    'jetbrains',
-    'goose',
-    'copilot',
-    'generic',
-    'unknown',
-];
+import { applyHostWiring } from '../host-wiring/apply.js';
 export async function init(root, json, hostOverride) {
     try {
-        if (hostOverride !== undefined && !KNOWN_HOST_IDS.includes(hostOverride)) {
-            console.error(`Error: unknown --host '${hostOverride}'. Valid values: ${KNOWN_HOST_IDS.join(', ')}.`);
+        const resolved = resolveInitHostIds(root, hostOverride);
+        if (resolved.error !== undefined) {
+            console.error(`Error: ${resolved.error}`);
             finish(EXIT.USAGE);
             return;
         }
@@ -60,13 +44,19 @@ export async function init(root, json, hostOverride) {
         // below must be true, not aspirational.
         const result = declareEntries(paths, entries);
         const manifest = loadManifest(paths);
-        const host = hostOverride
-            ? { id: hostOverride, name: hostOverride, tier: 'C', reason: 'specified with --host', recommendation: '' }
-            : detectHost(root);
+        const wiring = applyHostWiring(root, resolved.ids);
+        // Evidence after write: --host cursor on a bare tree now has `.cursor/`.
+        // Never invent a fake tier from the flag alone.
+        const detected = detectHost(root);
+        const cursorEntry = wiring.hosts.find((h) => h.id === 'cursor');
+        const cursorWiring = wiring.cursor;
         const output = {
             manifestPath: paths.manifest,
-            host: host.id,
-            protectionTier: host.tier,
+            host: detected.id,
+            protectionTier: detected.tier,
+            requestedHosts: resolved.source === 'flag' ? resolved.ids : undefined,
+            wiredHosts: resolved.ids,
+            wiringSource: resolved.source,
             scanned: discovered.length,
             added: result.added,
             updated: result.updated,
@@ -74,6 +64,25 @@ export async function init(root, json, hostOverride) {
             secretKeys: discovered.filter((d) => d.secret).map((d) => d.key),
             configKeys: discovered.filter((d) => !d.secret).map((d) => d.key),
             entries: manifest?.entries.length ?? 0,
+            agentsMd: {
+                action: wiring.agentsMd.action,
+                path: wiring.agentsMd.path,
+            },
+            hostWiring: wiring.hosts.map((h) => ({
+                id: h.id,
+                action: h.action,
+                path: h.path,
+            })),
+            ...(cursorWiring === undefined
+                ? {}
+                : {
+                    cursorWiring: {
+                        mcp: cursorWiring.mcp,
+                        rules: cursorWiring.rules,
+                        mcpPath: cursorWiring.mcpPath,
+                        rulesPath: cursorWiring.rulesPath,
+                    },
+                }),
         };
         if (json) {
             emit(json, '', output);
@@ -96,23 +105,42 @@ export async function init(root, json, hostOverride) {
                 console.log(`  Config (not prompted): ${config.map((s) => s.key).join(', ')}`);
             }
         }
-        console.log(`  Host: ${host.name} (protection tier ${host.tier})`);
-        if (host.recommendation)
-            console.log(`  ${host.recommendation}`);
-        if (hostOverride) {
-            // The override line above is what was ASKED for, not what is here. An
-            // auto-detected init on the same project can print a different tier, and
-            // doctor is the one that reports evidence.
-            console.log('  Override recorded; envseal doctor reports what is actually detected.');
+        console.log(`  AGENTS.md: ${wiring.agentsMd.action} (Layer 1 — envseal ensure / envseal run --)`);
+        console.log(`  Detected host: ${detected.name} (protection tier ${detected.tier})`);
+        console.log(`    ${detected.reason}`);
+        if (detected.recommendation)
+            console.log(`    ${detected.recommendation}`);
+        if (resolved.source === 'flag') {
+            console.log(`  Requested host(s): ${resolved.ids.join(', ')}. Override recorded; envseal doctor reports what is actually detected.`);
         }
-        if (host.id === 'claude-code') {
-            // Without this the first run ends at a manifest and no connection: init
-            // writes env.schema.jsonc but nothing tells the user the agent still has
-            // to be pointed at the broker.
-            console.log('');
-            console.log('Connect your agent: create .mcp.json in the project root containing');
-            console.log('  {"mcpServers":{"envseal-mcp":{"command":"envseal-mcp","args":[]}}}');
-            console.log('then restart Claude Code — or install plugins/claude-code for Tier A hooks.');
+        if (resolved.source === 'none') {
+            console.log('  No project host markers and this process is not an IDE.');
+            console.log('  Wrote AGENTS.md only. Re-run from the IDE, or `envseal init --host cursor`.');
+        }
+        else if (resolved.ids.length > 0) {
+            console.log(`  Wired host(s): ${resolved.ids.join(', ')} (${resolved.source})`);
+        }
+        for (const entry of wiring.hosts) {
+            if (entry.hint) {
+                for (const line of entry.hint.split('\n')) {
+                    console.log(`  ${line}`);
+                }
+            }
+        }
+        if (cursorEntry === undefined && !wiring.bareTerminal) {
+            console.log('  Reload MCP / restart the host, then run `envseal doctor`.');
+        }
+        else if (cursorWiring !== undefined && cursorWiring.mcp !== 'skipped' && wiring.hosts.length === 1) {
+            // Cursor entry already printed reloadHint.
+        }
+        else if (wiring.bareTerminal && resolved.source === 'none') {
+            // Already printed the re-run hint.
+        }
+        else if (wiring.hosts.some((h) => h.id !== 'cursor')) {
+            // Per-host hints already cover reload; keep a single closer.
+        }
+        if (resolved.ids.includes('claude-code')) {
+            console.log('  Claude Code: protocol connected (Tier B) via .mcp.json. Plugin = Tier A.');
         }
     }
     catch (error) {

package/dist/commands/status.js

@@ -18,7 +18,8 @@ export async function status(root, keys, json) {
             else {
                 for (const entry of entriesToShow) {
                     const status_str = entry.present ? '✓' : '✗';
-                    console.log(`${status_str} ${entry.key}`);
+                    const due = describeRotation(entry.rotationDue);
+                    console.log(`${status_str} ${entry.key}${due}`);
                 }
             }
         }
@@ -33,6 +34,7 @@ export async function status(root, keys, json) {
                     fingerprint: e.fingerprint,
                     lastVerified: e.lastVerified,
                     verifyResult: e.verifyResult,
+                    rotationDue: e.rotationDue,
                 })),
             });
         }
@@ -46,4 +48,21 @@ export async function status(root, keys, json) {
         fail(json, error);
     }
 }
+/**
+ * Overdue rotation is the only state worth a human's glance in the terse
+ * listing; a future due date is noise. Absent policy or unknown age (hand
+ * written .env before first status) reports nothing.
+ */
+function describeRotation(rotationDue) {
+    if (rotationDue === null)
+        return '';
+    const due = Date.parse(rotationDue);
+    if (Number.isNaN(due))
+        return '';
+    if (due > Date.now())
+        return '';
+    const days = Math.floor((Date.now() - due) / (24 * 60 * 60 * 1000));
+    const when = days === 0 ? 'today' : `${days}d ago`;
+    return ` (rotation overdue, due ${rotationDue.slice(0, 10)}, ${when})`;
+}
 //# sourceMappingURL=status.js.map

package/dist/exit-codes.d.ts

@@ -7,6 +7,7 @@ export declare const EXIT: {
     readonly NO_SURFACE: 4;
     readonly SINK_FAILURE: 5;
     readonly VERIFY_FAILED: 6;
+    readonly AUDIT_CHAIN_FAILED: 7;
 };
 export declare function exitCodeForError(e: unknown): number;
 /**

package/dist/exit-codes.js

@@ -7,6 +7,7 @@ export const EXIT = {
     NO_SURFACE: 4,
     SINK_FAILURE: 5,
     VERIFY_FAILED: 6,
+    AUDIT_CHAIN_FAILED: 7,
 };
 export function exitCodeForError(e) {
     if (!isSepError(e)) {
@@ -39,6 +40,11 @@ export function exitCodeForError(e) {
         case 'SEP_CONFIRMATION_DENIED':
         case 'SEP_KEYS_MISSING':
             return EXIT.UNSATISFIED;
+        case 'SEP_EGRESS_DENIED':
+            // The project's standing policy refused the command before anything
+            // ran. Not retriable by re-running: the policy file must change first,
+            // so this maps to USAGE (configuration), not a transient failure.
+            return EXIT.USAGE;
         default: {
             const _exhaustive = code;
             return _exhaustive;

package/dist/host-wiring/agents-md-content.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Layer 1 instruction file shipped by `envseal init`.
+ *
+ * Keep this string identical to `plugins/generic/AGENTS.md`. The host-wiring
+ * test fails if they drift. Embedding (not reading plugins/ at runtime) is
+ * what makes published `@envseal/cli` able to write the file.
+ */
+export declare const AGENTS_MD_CONTENT = "# envseal \u2014 instructions for any coding agent\n\nThis repository uses envseal to provision secrets. The secret values must never\nappear in this chat, in your tool output, in files you write, or in commands you\nrun. Follow these rules without exception.\n\n## You must never\n\n- Read, write, or copy the contents of any `.env` or `.env.*` file. (`.env.example`\n  is the only exception: it holds placeholders, never values.)\n- Run `printenv`, bare `env`, `export -p`, `set`, or `echo $VAR` / `echo $KEY...`\n  to inspect or display environment variables.\n- Use `cat`, `head`, `tail`, `less`, `grep`, `xxd`, `base64`, `sed`, or any other\n  reader on a secrets file: `*.pem`, `*.key`, `id_rsa*`, `credentials.json`,\n  `secrets.json` / `secrets.yaml` / `secrets.toml`, `.envseal/*`.\n- Ask the user to paste an API key, token, or connection string into the chat.\n- Echo an environment variable into a transcript, log, diff, or tool result.\n\n## How to check which keys exist\n\n```sh\nenvseal status          # human-readable\nenvseal status --json   # machine-readable; never contains values\n```\n\nStatuses are presence + metadata only (format-valid, length bucket, fingerprint,\nlast verified). There is no way to make envseal print a value.\n\n## How to provision a missing key\n\n```sh\nenvseal ensure          # prompts the user for every missing required key\nenvseal set KEY         # prompts for a single key\n```\n\nNever ask the user to add a key to `.env` and tell you about it. Run\n`envseal ensure` instead, and wait for its exit code.\n\n## How to run a command that needs secrets\n\n```sh\nenvseal run -- <command...>\n```\n\nSecrets are injected only into that child process and its stdout/stderr are\nredacted. Never run the command plain and never try to read the key yourself.\n\n## How to verify a key actually works\n\n```sh\nenvseal verify          # classified results: ok, auth_failed, rate_limited, ...\n```\n\n## How to ask the user what is wrong\n\n```sh\nenvseal doctor          # project root, detected host + tier, gitignore, missing keys\n```\n\n## Exit codes (for scripts)\n\n`0` ok \u00B7 `1` required keys missing \u00B7 `2` usage error \u00B7 `3` cancelled \u00B7\n`4` no interactive surface \u00B7 `5` sink failure \u00B7 `6` verification failed.\nUse them; never parse human text for secrets.\n";
+//# sourceMappingURL=agents-md-content.d.ts.map

package/dist/host-wiring/agents-md-content.js

@@ -0,0 +1,73 @@
+/**
+ * Layer 1 instruction file shipped by `envseal init`.
+ *
+ * Keep this string identical to `plugins/generic/AGENTS.md`. The host-wiring
+ * test fails if they drift. Embedding (not reading plugins/ at runtime) is
+ * what makes published `@envseal/cli` able to write the file.
+ */
+export const AGENTS_MD_CONTENT = `# envseal — instructions for any coding agent
+
+This repository uses envseal to provision secrets. The secret values must never
+appear in this chat, in your tool output, in files you write, or in commands you
+run. Follow these rules without exception.
+
+## You must never
+
+- Read, write, or copy the contents of any \`.env\` or \`.env.*\` file. (\`.env.example\`
+  is the only exception: it holds placeholders, never values.)
+- Run \`printenv\`, bare \`env\`, \`export -p\`, \`set\`, or \`echo $VAR\` / \`echo $KEY...\`
+  to inspect or display environment variables.
+- Use \`cat\`, \`head\`, \`tail\`, \`less\`, \`grep\`, \`xxd\`, \`base64\`, \`sed\`, or any other
+  reader on a secrets file: \`*.pem\`, \`*.key\`, \`id_rsa*\`, \`credentials.json\`,
+  \`secrets.json\` / \`secrets.yaml\` / \`secrets.toml\`, \`.envseal/*\`.
+- Ask the user to paste an API key, token, or connection string into the chat.
+- Echo an environment variable into a transcript, log, diff, or tool result.
+
+## How to check which keys exist
+
+\`\`\`sh
+envseal status          # human-readable
+envseal status --json   # machine-readable; never contains values
+\`\`\`
+
+Statuses are presence + metadata only (format-valid, length bucket, fingerprint,
+last verified). There is no way to make envseal print a value.
+
+## How to provision a missing key
+
+\`\`\`sh
+envseal ensure          # prompts the user for every missing required key
+envseal set KEY         # prompts for a single key
+\`\`\`
+
+Never ask the user to add a key to \`.env\` and tell you about it. Run
+\`envseal ensure\` instead, and wait for its exit code.
+
+## How to run a command that needs secrets
+
+\`\`\`sh
+envseal run -- <command...>
+\`\`\`
+
+Secrets are injected only into that child process and its stdout/stderr are
+redacted. Never run the command plain and never try to read the key yourself.
+
+## How to verify a key actually works
+
+\`\`\`sh
+envseal verify          # classified results: ok, auth_failed, rate_limited, ...
+\`\`\`
+
+## How to ask the user what is wrong
+
+\`\`\`sh
+envseal doctor          # project root, detected host + tier, gitignore, missing keys
+\`\`\`
+
+## Exit codes (for scripts)
+
+\`0\` ok · \`1\` required keys missing · \`2\` usage error · \`3\` cancelled ·
+\`4\` no interactive surface · \`5\` sink failure · \`6\` verification failed.
+Use them; never parse human text for secrets.
+`;
+//# sourceMappingURL=agents-md-content.js.map