@fiscalmindset/blindfold 0.4.0

package/bin/cmd-lifecycle.ts

@@ -0,0 +1,151 @@
+/** CLI command group (auto-split from the dispatcher; bodies unchanged). */
+import fs from "node:fs";
+import path from "node:path";
+import { spawn } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import { loadBlindfoldEnv, configPath, homeDir, stateDir } from "../src/env.ts";
+import { keychainAvailable, keychainBackend, keychainSet, keychainDelete } from "../src/keychain.ts";
+import { readSecretLine } from "../src/prompt.ts";
+import { registerSecret, registerContract } from "../src/register.ts";
+import { startProxy } from "../src/proxy.ts";
+import { attest, attestationGate, writePinnedRtmr3 } from "../src/attest.ts";
+import { startDashboard } from "../src/dashboard.ts";
+import { clearUsage, defaultLogPath, readUsage } from "../src/usage-log.ts";
+import { runInit, runVerify } from "../src/init.ts";
+import { runCompat } from "../src/compat.ts";
+import { defaultSealedLogPath, readSealed, verifyLedgerChain } from "../src/sealed-ledger.ts";
+import { type Argv, die, assetPath, fingerprint, resolveEnvVar } from "./cli-shared.ts";
+
+export async function handleLifecycle(cmd: string, argv: Argv, cmdArgs: string[]): Promise<void> {
+  switch (cmd) {
+    case "rotate": {
+      const name = String(argv.flags.name ?? "");
+      const fromEnv = argv.flags["from-env"] ? String(argv.flags["from-env"]) : undefined;
+      if (!name) {
+        die("usage: blindfold rotate --name <secret> [--from-env <ENV_VAR>]");
+      }
+      const env = loadBlindfoldEnv();
+      const { openT3Client } = await import("../src/t3-client.ts");
+      const { recordVersion, versionKeyFor } = await import("../src/versions.ts");
+      const client = await openT3Client(env);
+      try {
+        // Snapshot the current value into the enclave (for rollback) before overwriting.
+        try {
+          const old = await client.releaseSecret(name);
+          const vKey = versionKeyFor(name, Date.now());
+          await client.seedSecret(vKey, old);
+          recordVersion({ t: new Date().toISOString(), name, versionKey: vKey, length: old.length, fingerprint: fingerprint(old) });
+          console.log(`  before:  "${name}"  ${old.length} B  fp=${fingerprint(old)}  (snapshot saved — rollback available)`);
+        } catch {
+          console.log(`  before:  (no existing value for "${name}" — sealing fresh)`);
+        }
+        await registerSecret({ name, fromEnv }); // overwrites the live entry + records the ledger
+        const now = await client.releaseSecret(name);
+        console.log(`✓ Rotated "${name}"  →  ${now.length} B  fp=${fingerprint(now)}  (mode=real)`);
+        console.log(`  Every place that uses "${name}" now gets the new value — no code/config change.`);
+        console.log(`  Made a mistake? \`blindfold rollback --name ${name}\``);
+        if (fromEnv) console.log(`  You can now DELETE ${fromEnv} from your .env.`);
+      } finally {
+        await client.close();
+      }
+      return;
+    }
+    case "rollback": {
+      const name = String(argv.flags.name ?? "");
+      if (!name) die("usage: blindfold rollback --name <secret> [--to <iso-ts | fingerprint>]");
+      const { readVersions, isValidVersionKey } = await import("../src/versions.ts");
+      const versions = readVersions(name);
+      if (versions.length === 0) {
+        die(`no saved versions for "${name}". \`blindfold rotate\` creates them; \`blindfold versions --name ${name}\` lists them.`);
+      }
+      const want = argv.flags.to ? String(argv.flags.to) : "";
+      let target = versions[versions.length - 1]!; // most recent snapshot
+      if (want) {
+        const sel = versions.find((v) => v.t === want || v.fingerprint === want || v.fingerprint.startsWith(want));
+        if (!sel) die(`no version of "${name}" matches --to ${want} (see \`blindfold versions --name ${name}\`)`);
+        target = sel;
+      }
+      // Integrity guard: versions.jsonl is local and could be tampered with to
+      // point `versionKey` at an arbitrary enclave key. A legitimate key always
+      // matches __bfver__<name>__<ts>; reject anything else before releasing.
+      if (!isValidVersionKey(name, target.versionKey)) {
+        die(`refusing rollback: version key "${target.versionKey}" is not a valid snapshot key for "${name}" (tampered versions.jsonl?)`);
+      }
+      const env = loadBlindfoldEnv();
+      const { openT3Client } = await import("../src/t3-client.ts");
+      const client = await openT3Client(env);
+      try {
+        const before = await client.verifySecret(name);
+        const restored = await client.releaseSecret(target.versionKey);
+        // And verify the released value matches the fingerprint recorded when the
+        // snapshot was taken — catches a versionKey swapped to a different value.
+        if (fingerprint(restored) !== target.fingerprint) {
+          die(`refusing rollback: released snapshot fingerprint ${fingerprint(restored)} ≠ recorded ${target.fingerprint} (tampered versions.jsonl?)`);
+        }
+        await client.seedSecret(name, restored);
+        console.log(`✓ Rolled back "${name}"`);
+        console.log(`  ${before.present ? `fp ${before.fingerprint} (${before.length} B)` : "(no current value)"}  →  fp ${fingerprint(restored)} (${restored.length} B)`);
+        console.log(`  restored the snapshot from ${target.t}.`);
+      } finally {
+        await client.close();
+      }
+      return;
+    }
+    case "versions": {
+      const name = argv.flags.name ? String(argv.flags.name) : undefined;
+      const { readVersions } = await import("../src/versions.ts");
+      const list = readVersions(name);
+      if (list.length === 0) {
+        console.log(name ? `No saved versions for "${name}".` : "No saved versions yet. `blindfold rotate` creates them.");
+        return;
+      }
+      console.log(`Saved versions${name ? ` for "${name}"` : ""} (newest last):\n`);
+      console.log("  WHEN                  NAME                   BYTES  FINGERPRINT");
+      console.log("  ────                  ────                   ─────  ───────────");
+      for (const v of list) {
+        const when = v.t.replace("T", " ").slice(0, 19);
+        console.log(`  ${when}   ${v.name.padEnd(22)} ${String(v.length).padStart(5)}  ${v.fingerprint}`);
+      }
+      console.log(`\n  Restore the newest:  blindfold rollback --name <name>`);
+      console.log(`  Restore a specific:  blindfold rollback --name <name> --to <fingerprint>`);
+      return;
+    }
+    case "migrate": {
+      const { planMigration, runMigrate } = await import("../src/migrate.ts");
+      const dryRun = !!argv.flags["dry-run"];
+      const keep = !!argv.flags.keep;
+      const plan = planMigration();
+      const toSeal = plan.filter((p) => p.action === "seal");
+
+      console.log(dryRun ? "🔍 blindfold migrate --dry-run (no changes will be made)\n" : "🚚 blindfold migrate\n");
+      console.log("  Plan:");
+      for (const p of plan) {
+        if (p.action === "seal") console.log(`    SEAL  ${p.envVar.padEnd(26)} → ${p.sealName}  (${p.bytes} B)`);
+        else console.log(`    skip  ${p.envVar.padEnd(26)} — ${p.reason}`);
+      }
+      if (toSeal.length === 0) {
+        console.log("\n  Nothing to seal (no secret-looking vars found).");
+        return;
+      }
+      if (dryRun) {
+        console.log(`\n  Would seal ${toSeal.length} secret(s), then ${keep ? "comment out" : "remove"} their .env lines (a .env backup is kept either way).`);
+        console.log("  Re-run without --dry-run to do it.");
+        return;
+      }
+
+      console.log(`\n  Sealing ${toSeal.length} secret(s) …`);
+      const results = await runMigrate({ keep });
+      console.log("");
+      let ok = 0, fail = 0;
+      for (const r of results) {
+        if (r.action !== "seal") continue;
+        if (r.sealed) { ok++; console.log(`    ✓ ${r.sealName} sealed (${r.bytes} B) — .env line ${keep ? "commented" : "removed"}`); }
+        else { fail++; console.log(`    ✖ ${r.sealName}: ${(r.error ?? "").slice(0, 100)}`); }
+      }
+      console.log(`\n  Done: ${ok} sealed, ${fail} failed.  (.env backup saved alongside .env)`);
+      if (ok > 0) console.log(`  Use any of them with no code:  blindfold use --name <name> -- <command>`);
+      if (fail > 0) { console.log(`  Failed seals kept their .env line. Check \`blindfold doctor\`.`); process.exitCode = 1; }
+      return;
+    }
+  }
+}

package/bin/cmd-secrets.ts

@@ -0,0 +1,136 @@
+/** CLI command group (auto-split from the dispatcher; bodies unchanged). */
+import fs from "node:fs";
+import path from "node:path";
+import { spawn } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import { loadBlindfoldEnv, configPath, homeDir, stateDir } from "../src/env.ts";
+import { keychainAvailable, keychainBackend, keychainSet, keychainDelete } from "../src/keychain.ts";
+import { readSecretLine } from "../src/prompt.ts";
+import { registerSecret, registerContract } from "../src/register.ts";
+import { startProxy } from "../src/proxy.ts";
+import { attest, attestationGate, writePinnedRtmr3 } from "../src/attest.ts";
+import { startDashboard } from "../src/dashboard.ts";
+import { clearUsage, defaultLogPath, readUsage } from "../src/usage-log.ts";
+import { runInit, runVerify } from "../src/init.ts";
+import { runCompat } from "../src/compat.ts";
+import { defaultSealedLogPath, readSealed, verifyLedgerChain } from "../src/sealed-ledger.ts";
+import { type Argv, die, assetPath, fingerprint, resolveEnvVar } from "./cli-shared.ts";
+
+export async function handleSecrets(cmd: string, argv: Argv, cmdArgs: string[]): Promise<void> {
+  switch (cmd) {
+    case "register": {
+      const name = String(argv.flags.name ?? "");
+      const fromEnv = argv.flags["from-env"] ? String(argv.flags["from-env"]) : undefined;
+      if (!name) {
+        die("usage: blindfold register --name <KV_KEY> [--from-env <ENV_VAR>]");
+      }
+      // Attestation gate (no-op unless a measurement is pinned): don't seal into
+      // an enclave that doesn't verify.
+      const sealGate = await attestationGate({ skip: !!argv.flags["no-attest"], requirePin: true });
+      if (sealGate.warning) console.error(`⚠️  ${sealGate.warning}`);
+      if (sealGate.enforced && !sealGate.ok) {
+        die(`attestation gate: ${sealGate.message}. Refusing to seal into an unverified enclave. (bypass: --no-attest, or clear the pin)`);
+      }
+      if (sealGate.enforced) console.log("✓ enclave attestation verified");
+      await registerSecret({ name, fromEnv });
+      if (fromEnv) {
+        console.log(`✓ Registered "${name}" (value read from ${fromEnv} once, then dropped).`);
+        console.log(`  You can now DELETE ${fromEnv} from your .env.`);
+      } else {
+        console.log(`✓ Registered "${name}" — value lives only in the enclave.`);
+      }
+      // The other half: tell the user how to actually USE what they just sealed.
+      const asVar = name.toUpperCase();
+      console.log("");
+      console.log("  Use it (the plaintext never returns to your env):");
+      console.log(`    blindfold use --name ${name} -- <your command>       # injects ${asVar} into that command only`);
+      console.log(`    blindfold use --name ${name} --as ${asVar} -- <cmd>  # custom env-var name`);
+      console.log(`    blindfold use --name ${name} --url <https url>       # quick "does it auth?" check`);
+      console.log(`    proxy/SDK:  set the key to "__BLINDFOLD__" + route via \`blindfold proxy\`, or \`release("${name}")\` in code`);
+      return;
+    }
+    case "use": {
+      const name = String(argv.flags.name ?? "");
+      if (!name) {
+        die("usage: blindfold use --name <secret> [--as <ENV_VAR>] -- <command...>\n" +
+            "       blindfold use --name <secret> --url <https url>   (quick auth test)");
+      }
+      const { release } = await import("../src/release.ts");
+      const value = await release(name, { via: "use" }); // plaintext, kept local; never printed
+
+      // Mode 0: --check just confirms the secret is sealed + usable (no URL, no
+      // command, no value printed). The dashboard's "copy command" uses this.
+      if (argv.flags.check) {
+        console.log(`✓ "${name}" is sealed and usable — ${value.length} bytes (value never shown)`);
+        return;
+      }
+
+      // Mode A: quick auth test against an HTTPS endpoint with Bearer auth.
+      if (argv.flags.url) {
+        const url = String(argv.flags.url);
+        // The released plaintext key is sent as a Bearer token to this URL.
+        // Refuse a non-https target (localhost excepted) so a mistyped/hostile
+        // URL can't exfiltrate the key. --allow-insecure overrides for testing.
+        if (!argv.flags["allow-insecure"]) {
+          let u: URL;
+          try { u = new URL(url); } catch (e) { die(`invalid --url: ${(e as Error).message}`); return; }
+          const isLocal = ["localhost", "127.0.0.1", "::1", "[::1]"].includes(u.hostname);
+          if (u.protocol !== "https:" && !isLocal) {
+            die(`refusing to send the released key to a non-https URL (${u.protocol}//${u.hostname}). Use https, target localhost, or pass --allow-insecure to override.`);
+            return;
+          }
+          // M3: gate --url behind the same egress allowlist the proxy uses, so a
+          // hijacked agent can't POST the released key to an arbitrary https host.
+          if (!isLocal) {
+            const { loadEgressHosts } = await import("../src/t3-client.ts");
+            const env = loadBlindfoldEnv();
+            const granted = loadEgressHosts(env.did);
+            const allowed = granted.some((h) => h === u.hostname || u.hostname.endsWith(`.${h}`));
+            if (!allowed) {
+              die(`refusing to send the released key to ${u.hostname}: host is not in the egress allowlist. Run \`blindfold grant --host ${u.hostname}\` first, or pass --allow-insecure to override.`);
+              return;
+            }
+          }
+        }
+        const res = await fetch(url, {
+          headers: { Authorization: `Bearer ${value}`, "User-Agent": "blindfold", Accept: "*/*" },
+        });
+        console.log(`✓ released "${name}" (${value.length} B, value not shown) → ${url}`);
+        console.log(`  HTTP ${res.status} ${res.statusText}  ${res.ok ? "✅ accepted" : "✖ rejected"}`);
+        return;
+      }
+
+      // Mode B: run any command with the secret injected as an env var, for
+      // that subprocess only. The parent never persists the plaintext.
+      if (cmdArgs.length === 0) {
+        die("provide a command after `--` (e.g. `-- gh api user`), or pass --url <url> to test auth");
+      }
+      const asVar = resolveEnvVar(argv.flags.as ? String(argv.flags.as) : undefined, cmdArgs[0], name);
+      console.error(`✓ released "${name}" (${value.length} B) → injecting $${asVar} into: ${cmdArgs.join(" ")}`);
+      const child = spawn(cmdArgs[0]!, cmdArgs.slice(1), {
+        stdio: "inherit",
+        env: { ...process.env, [asVar]: value },
+      });
+      child.on("exit", (code) => process.exit(code ?? 0));
+      child.on("error", (e) => die(`failed to run "${cmdArgs[0]}": ${e.message}`));
+      return;
+    }
+    case "export": {
+      // CI-only: release a sealed secret into $GITHUB_ENV for later steps, and
+      // mask it in the logs. Lets a GitHub Action pull keys from the enclave
+      // instead of storing them as GitHub secrets.
+      const name = String(argv.flags.name ?? "");
+      if (!name) die("usage: blindfold export --name <secret> [--as <ENV_VAR>]   (for GitHub Actions / CI)");
+      const ghEnv = process.env.GITHUB_ENV;
+      if (!ghEnv) die("`export` writes to $GITHUB_ENV (GitHub Actions only). Use `blindfold use` locally.");
+      const asVar = resolveEnvVar(argv.flags.as ? String(argv.flags.as) : undefined, undefined, name);
+      const { release } = await import("../src/release.ts");
+      const value = await release(name, { via: "export" });
+      // ::add-mask:: tells the runner to redact this value everywhere in the logs.
+      console.log(`::add-mask::${value}`);
+      fs.appendFileSync(ghEnv, `${asVar}=${value}\n`);
+      console.error(`✓ exported $${asVar} from sealed "${name}" (${value.length} B, masked in logs)`);
+      return;
+    }
+  }
+}

package/bin/cmd-serve.ts

@@ -0,0 +1,165 @@
+/** CLI command group (auto-split from the dispatcher; bodies unchanged). */
+import fs from "node:fs";
+import path from "node:path";
+import { spawn } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import { loadBlindfoldEnv, configPath, homeDir, stateDir } from "../src/env.ts";
+import { keychainAvailable, keychainBackend, keychainSet, keychainDelete } from "../src/keychain.ts";
+import { readSecretLine } from "../src/prompt.ts";
+import { registerSecret, registerContract } from "../src/register.ts";
+import { startProxy } from "../src/proxy.ts";
+import { attest, attestationGate, writePinnedRtmr3 } from "../src/attest.ts";
+import { startDashboard } from "../src/dashboard.ts";
+import { clearUsage, defaultLogPath, readUsage } from "../src/usage-log.ts";
+import { runInit, runVerify } from "../src/init.ts";
+import { runCompat } from "../src/compat.ts";
+import { defaultSealedLogPath, readSealed, verifyLedgerChain } from "../src/sealed-ledger.ts";
+import { type Argv, die, assetPath, fingerprint, resolveEnvVar } from "./cli-shared.ts";
+
+export async function handleServe(cmd: string, argv: Argv, cmdArgs: string[]): Promise<void> {
+  switch (cmd) {
+    case "proxy": {
+      const port = argv.flags.port ? Number(argv.flags.port) : undefined;
+      const secret = argv.flags.secret ? String(argv.flags.secret) : undefined;
+      // Per-session auth: `--token <t>` supplies one; `--auth` mints a random
+      // one. Without either, the proxy stays open to any local process (the key
+      // still can't be stolen — this only gates *use* by co-resident processes).
+      let token = argv.flags.token ? String(argv.flags.token) : undefined;
+      if (!token && argv.flags.auth) token = randomBytes(24).toString("hex");
+      // `--socket [path]` binds a unix-domain socket (0600) instead of a TCP
+      // port, so only same-user processes can connect. Bare `--socket` defaults
+      // to <stateDir>/proxy.sock.
+      let socket: string | undefined;
+      if (argv.flags.socket !== undefined) {
+        socket = typeof argv.flags.socket === "string" && argv.flags.socket.length > 0
+          ? String(argv.flags.socket)
+          : path.join(stateDir(), "proxy.sock");
+      }
+      // Attestation gate (no-op unless a measurement is pinned): don't route
+      // secrets through an enclave that doesn't verify.
+      const proxyGate = await attestationGate({ skip: !!argv.flags["no-attest"] });
+      if (proxyGate.warning) console.error(`⚠️  ${proxyGate.warning}`);
+      if (proxyGate.enforced && !proxyGate.ok) {
+        die(`attestation gate: ${proxyGate.message}. Refusing to start the proxy against an unverified enclave. (bypass: --no-attest, or clear the pin)`);
+      }
+      if (proxyGate.enforced) console.log("✓ enclave attestation verified");
+      if (socket && !token) {
+        console.error("⚠️  --socket without --auth: access is gated only by the socket's 0600 owner permission. Add --auth for a per-process token too.");
+      }
+      const handle = await startProxy({ port, secretKey: secret, token, socket });
+      console.log(`✓ Blindfold proxy listening at ${handle.url}`);
+      if (handle.socket) {
+        console.log(`  Unix socket (0600) — only your user's processes can connect.`);
+        console.log(`  Call it with:          curl --unix-socket ${handle.socket} http://localhost/v1/...`);
+      } else {
+        console.log(`  Point your agent at:   OPENAI_BASE_URL=${handle.url}/v1`);
+      }
+      if (handle.token) {
+        // Print auth material to STDERR (not stdout) so it doesn't land in piped
+        // logs, and warn that env/argv are readable by other same-user processes.
+        console.error(`  Auth ON — every request must send header:`);
+        console.error(`    x-blindfold-token: ${handle.token}`);
+        console.error(`  Give it to your agent via BLINDFOLD_PROXY_TOKEN or wrap({ token }).`);
+        console.error(`  NOTE: env vars and argv are readable by same-user processes — on a shared`);
+        console.error(`        machine prefer --socket (OS-enforced) over the token alone.`);
+        if (argv.flags.token) {
+          console.error(`  ⚠️  --token on the command line is visible in \`ps\`/proc; prefer --auth (mints one) or BLINDFOLD_PROXY_TOKEN.`);
+        }
+      } else {
+        console.log(`  Auth OFF — add --auth to require a per-session token (recommended on shared machines).`);
+      }
+      console.log(`  Health check:          ${handle.url}/health`);
+      // long-running: don't close until SIGINT
+      process.on("SIGINT", async () => {
+        await handle.close();
+        process.exit(0);
+      });
+      return;
+    }
+    case "attest": {
+      // Verify the T3 enclave cluster's TDX attestation (chains to Intel's root
+      // CA). Optionally pin RTMR3 (the running code/config measurement).
+      const expectRtmr3 = argv.flags["expect-rtmr3"] ? String(argv.flags["expect-rtmr3"]) : undefined;
+      const r = await attest({ expectRtmr3, noCache: true }); // CLI check is always fresh
+      if (argv.flags.json) {
+        console.log(JSON.stringify(r, null, 2));
+        return;
+      }
+      if (!r.available) {
+        console.log(`ℹ️  ${r.nodeUrl} publishes no attestation (mock signer or still bootstrapping).`);
+        return;
+      }
+      console.log(`Attestation for ${r.nodeUrl}`);
+      console.log(`  chain to Intel root:  ${r.valid ? "✅ valid" : "✖ INVALID"}${r.error ? ` (${r.error})` : ""}`);
+      console.log(`  quotes verified:      ${r.validCount}/${r.expectedCount}`);
+      for (const m of r.rtmr3s) console.log(`  RTMR3 (code measure): ${m}`);
+      if (expectRtmr3) {
+        console.log(`  RTMR3 pin:            ${r.pinned ? "✅ matches expected" : "✖ DID NOT MATCH"}`);
+      } else if (r.rtmr3s.length) {
+        console.log(`  Tip: pin it next time → blindfold attest --expect-rtmr3 ${r.rtmr3s[0]}`);
+      }
+      // `--pin` persists the measurement so seal/proxy auto-gate on it hereafter.
+      if (argv.flags.pin) {
+        const toPin = expectRtmr3 ?? r.rtmr3s[0];
+        if (r.valid && toPin) {
+          // TOFU caveat: pinning what the node reported only helps if that value
+          // matches your reproducible enclave build. Warn unless the user
+          // supplied the expected value explicitly (--expect-rtmr3).
+          if (!expectRtmr3) {
+            console.error(`  ⚠️  Pinning the measurement the node just reported (trust-on-first-use).`);
+            console.error(`      Cross-check ${toPin} against your enclave's published/reproducible build hash;`);
+            console.error(`      if this first contact was with a malicious node, you'd be pinning its measurement.`);
+          }
+          writePinnedRtmr3(toPin);
+          console.log(`  ✓ pinned — \`seal\` and \`proxy\` will now verify this measurement first.`);
+        } else {
+          console.log(`  ✗ not pinning: attestation must pass first.`);
+        }
+      }
+      if (!r.valid || (expectRtmr3 && !r.pinned)) process.exitCode = 1;
+      return;
+    }
+    case "dashboard": {
+      const port = argv.flags.port ? Number(argv.flags.port) : undefined;
+      const handle = await startDashboard({ port });
+      console.log(`✓ Blindfold dashboard at ${handle.url}`);
+      console.log(`  Reading: ${defaultLogPath()}`);
+      console.log(`  (open in your browser; auto-refreshes every 2s)`);
+      process.on("SIGINT", async () => { await handle.close(); process.exit(0); });
+      return;
+    }
+    case "stats": {
+      const events = readUsage();
+      if (events.length === 0) {
+        console.log("No usage recorded yet. Reads from " + defaultLogPath());
+        return;
+      }
+      const byProvider: Record<string, number> = {};
+      let ok = 0, bad = 0, totalLat = 0, sentinel = 0;
+      for (const e of events) {
+        byProvider[e.provider] = (byProvider[e.provider] ?? 0) + 1;
+        if (e.status >= 200 && e.status < 300) ok++;
+        else if (e.status >= 400) bad++;
+        totalLat += e.latency_ms;
+        if (e.sentinel_in_outbound) sentinel++;
+      }
+      const total = events.length;
+      console.log("Blindfold usage stats (source: " + defaultLogPath() + ")");
+      console.log(`  Total requests:     ${total}`);
+      console.log(`  2xx / 4xx+:         ${ok} / ${bad}`);
+      console.log(`  Sentinel substituted: ${sentinel}/${total}  (should equal total)`);
+      console.log(`  Avg latency:        ${total ? Math.round(totalLat / total) : 0} ms`);
+      console.log(`  By provider:        ${Object.entries(byProvider).map(([k, v]) => `${k}×${v}`).join("  ")}`);
+      console.log(`  Recent (last 5):`);
+      for (const e of events.slice(-5)) {
+        console.log(`    ${e.t}  ${e.method.padEnd(6)} ${e.path}  → ${e.status} (${e.latency_ms}ms, ${e.provider}, ${e.mode})`);
+      }
+      return;
+    }
+    case "stats:clear": {
+      clearUsage();
+      console.log("✓ Cleared " + defaultLogPath());
+      return;
+    }
+  }
+}

package/bin/cmd-tenant.ts

@@ -0,0 +1,84 @@
+/** CLI command group (auto-split from the dispatcher; bodies unchanged). */
+import fs from "node:fs";
+import path from "node:path";
+import { spawn } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import { loadBlindfoldEnv, configPath, homeDir, stateDir } from "../src/env.ts";
+import { keychainAvailable, keychainBackend, keychainSet, keychainDelete } from "../src/keychain.ts";
+import { readSecretLine } from "../src/prompt.ts";
+import { registerSecret, registerContract } from "../src/register.ts";
+import { startProxy } from "../src/proxy.ts";
+import { attest, attestationGate, writePinnedRtmr3 } from "../src/attest.ts";
+import { startDashboard } from "../src/dashboard.ts";
+import { clearUsage, defaultLogPath, readUsage } from "../src/usage-log.ts";
+import { runInit, runVerify } from "../src/init.ts";
+import { runCompat } from "../src/compat.ts";
+import { defaultSealedLogPath, readSealed, verifyLedgerChain } from "../src/sealed-ledger.ts";
+import { type Argv, die, assetPath, fingerprint, resolveEnvVar } from "./cli-shared.ts";
+
+export async function handleTenant(cmd: string, argv: Argv, cmdArgs: string[]): Promise<void> {
+  switch (cmd) {
+    case "grant": {
+      // Authorize the contract to make outbound calls to one or more hosts.
+      const hosts: string[] = [];
+      if (argv.flags.host) hosts.push(...String(argv.flags.host).split(",").map((h) => h.trim()).filter(Boolean));
+      if (argv.flags.hosts) hosts.push(...String(argv.flags.hosts).split(",").map((h) => h.trim()).filter(Boolean));
+      if (hosts.length === 0) {
+        die("usage: blindfold grant --host <host>[,<host2>...]   (e.g. --host api.openai.com)");
+      }
+      const replace = !!argv.flags.replace;
+      const env = loadBlindfoldEnv();
+      const { openT3Client } = await import("../src/t3-client.ts");
+      const client = await openT3Client(env);
+      try {
+        // T3 replaces the allowlist on every update, so grant is additive by
+        // default (merges with previously-granted hosts). Use --replace to reset.
+        const authorized = await client.grantEgress(hosts, { replace });
+        console.log(`✓ Egress granted for: ${hosts.join(", ")}${replace ? "  (replaced allowlist)" : ""}`);
+        console.log(`  Contract is now authorized to call ALL of: ${authorized.join(", ")}`);
+        console.log(`  Run \`blindfold publish\` first if you haven't — the grant targets the published contract.`);
+      } finally {
+        await client.close();
+      }
+      return;
+    }
+    case "share": {
+      // Authorize a teammate's agent to USE this tenant's sealed keys (via the
+      // in-enclave forward path) for specific hosts — they never receive the key.
+      const to = String(argv.flags.to ?? "");
+      const hosts: string[] = [];
+      if (argv.flags.host) hosts.push(...String(argv.flags.host).split(",").map((h) => h.trim()).filter(Boolean));
+      if (argv.flags.hosts) hosts.push(...String(argv.flags.hosts).split(",").map((h) => h.trim()).filter(Boolean));
+      if (!to || hosts.length === 0) {
+        die("usage: blindfold share --to <agent-did> --host <host>[,host2]   (e.g. --to did:t3n:… --host api.openai.com)");
+      }
+      const env = loadBlindfoldEnv();
+      const { openT3Client } = await import("../src/t3-client.ts");
+      const client = await openT3Client(env);
+      try {
+        await client.setAgentGrant(to, hosts, ["forward"]); // forward only — least privilege, no plaintext extraction
+        console.log(`✓ Shared access with ${to}`);
+        console.log(`  authorized: forward → ${hosts.join(", ")}  (they can USE the key via the enclave; they never receive the plaintext)`);
+        console.log(`  Revoke any time:  blindfold revoke --to ${to}`);
+      } finally {
+        await client.close();
+      }
+      return;
+    }
+    case "revoke": {
+      const to = String(argv.flags.to ?? "");
+      if (!to) die("usage: blindfold revoke --to <agent-did>");
+      const env = loadBlindfoldEnv();
+      const { openT3Client } = await import("../src/t3-client.ts");
+      const client = await openT3Client(env);
+      try {
+        await client.setAgentGrant(to, [], []); // empty scripts → remove all authorization
+        console.log(`✓ Revoked all contract access for ${to}`);
+        console.log(`  Nobody holds the raw key, so revocation is immediate and complete — there's no leaked copy to chase.`);
+      } finally {
+        await client.close();
+      }
+      return;
+    }
+  }
+}