@lazehq/cli 0.1.42 → 0.1.44

package/dist/laze.mjs

@@ -96,9 +96,9 @@ var require_node_gyp_build = __commonJS({
         var debug = getFirst(path.join(dir, "build/Debug"), matchBuild);
         if (debug) return debug;
       }
-      var prebuild = resolve17(dir);
+      var prebuild = resolve19(dir);
       if (prebuild) return prebuild;
-      var nearby = resolve17(path.dirname(process.execPath));
+      var nearby = resolve19(path.dirname(process.execPath));
       if (nearby) return nearby;
       var target = [
         "platform=" + platform,
@@ -114,7 +114,7 @@ var require_node_gyp_build = __commonJS({
         // eslint-disable-line
       ].filter(Boolean).join(" ");
       throw new Error("No native build was found for " + target + "\n    loaded from: " + dir + "\n");
-      function resolve17(dir2) {
+      function resolve19(dir2) {
         var tuples = readdirSync(path.join(dir2, "prebuilds")).map(parseTuple);
         var tuple2 = tuples.filter(matchTuple(platform, arch)).sort(compareTuples)[0];
         if (!tuple2) return;
@@ -6561,9 +6561,9 @@ var require_dispatcher_base = __commonJS({
       }
       close(callback) {
         if (callback === void 0) {
-          return new Promise((resolve17, reject) => {
+          return new Promise((resolve19, reject) => {
             this.close((err, data) => {
-              return err ? reject(err) : resolve17(data);
+              return err ? reject(err) : resolve19(data);
             });
           });
         }
@@ -6601,9 +6601,9 @@ var require_dispatcher_base = __commonJS({
           err = null;
         }
         if (callback === void 0) {
-          return new Promise((resolve17, reject) => {
+          return new Promise((resolve19, reject) => {
             this.destroy(err, (err2, data) => {
-              return err2 ? reject(err2) : resolve17(data);
+              return err2 ? reject(err2) : resolve19(data);
             });
           });
         }
@@ -11558,12 +11558,12 @@ upgrade: ${upgrade2}\r
           cb();
         }
       }
-      const waitForDrain = () => new Promise((resolve17, reject) => {
+      const waitForDrain = () => new Promise((resolve19, reject) => {
         assert2(callback === null);
         if (socket[kError]) {
           reject(socket[kError]);
         } else {
-          callback = resolve17;
+          callback = resolve19;
         }
       });
       socket.on("close", onDrain).on("drain", onDrain);
@@ -12921,12 +12921,12 @@ var require_client_h2 = __commonJS({
           cb();
         }
       }
-      const waitForDrain = () => new Promise((resolve17, reject) => {
+      const waitForDrain = () => new Promise((resolve19, reject) => {
         assert2(callback === null);
         if (socket[kError]) {
           reject(socket[kError]);
         } else {
-          callback = resolve17;
+          callback = resolve19;
         }
       });
       h2stream.on("close", onDrain).on("drain", onDrain);
@@ -13294,16 +13294,16 @@ var require_client = __commonJS({
         return this[kNeedDrain] < 2;
       }
       [kClose]() {
-        return new Promise((resolve17) => {
+        return new Promise((resolve19) => {
           if (this[kSize]) {
-            this[kClosedResolve] = resolve17;
+            this[kClosedResolve] = resolve19;
           } else {
-            resolve17(null);
+            resolve19(null);
           }
         });
       }
       [kDestroy](err) {
-        return new Promise((resolve17) => {
+        return new Promise((resolve19) => {
           const requests2 = this[kQueue].splice(this[kPendingIdx]);
           for (let i = 0; i < requests2.length; i++) {
             const request2 = requests2[i];
@@ -13316,7 +13316,7 @@ var require_client = __commonJS({
               this[kClosedResolve]();
               this[kClosedResolve] = null;
             }
-            resolve17(null);
+            resolve19(null);
           };
           if (this[kHTTPContext]) {
             this[kHTTPContext].destroy(err, callback);
@@ -13729,8 +13729,8 @@ var require_pool_base = __commonJS({
           }
           return Promise.all(closeAll);
         } else {
-          return new Promise((resolve17) => {
-            this[kClosedResolve] = resolve17;
+          return new Promise((resolve19) => {
+            this[kClosedResolve] = resolve19;
           });
         }
       }
@@ -16241,7 +16241,7 @@ var require_readable = __commonJS({
         if (this._readableState.closeEmitted) {
           return Promise.resolve(null);
         }
-        return new Promise((resolve17, reject) => {
+        return new Promise((resolve19, reject) => {
           if (this[kContentLength] && this[kContentLength] > limit || this[kBytesRead] > limit) {
             this.destroy(new AbortError());
           }
@@ -16255,11 +16255,11 @@ var require_readable = __commonJS({
               if (signal.aborted) {
                 reject(signal.reason ?? new AbortError());
               } else {
-                resolve17(null);
+                resolve19(null);
               }
             });
           } else {
-            this.on("close", resolve17);
+            this.on("close", resolve19);
           }
           this.on("error", noop2).on("data", () => {
             if (this[kBytesRead] > limit) {
@@ -16287,7 +16287,7 @@ var require_readable = __commonJS({
     }
     function consume(stream, type) {
       assert2(!stream[kConsume]);
-      return new Promise((resolve17, reject) => {
+      return new Promise((resolve19, reject) => {
         if (isUnusable(stream)) {
           const rState = stream._readableState;
           if (rState.destroyed && rState.closeEmitted === false) {
@@ -16302,7 +16302,7 @@ var require_readable = __commonJS({
             stream[kConsume] = {
               type,
               stream,
-              resolve: resolve17,
+              resolve: resolve19,
               reject,
               length: 0,
               body: []
@@ -16380,18 +16380,18 @@ var require_readable = __commonJS({
       return buffer;
     }
     function consumeEnd(consume2, encoding) {
-      const { type, body, resolve: resolve17, stream, length } = consume2;
+      const { type, body, resolve: resolve19, stream, length } = consume2;
       try {
         if (type === "text") {
-          resolve17(chunksDecode(body, length, encoding));
+          resolve19(chunksDecode(body, length, encoding));
         } else if (type === "json") {
-          resolve17(JSON.parse(chunksDecode(body, length, encoding)));
+          resolve19(JSON.parse(chunksDecode(body, length, encoding)));
         } else if (type === "arrayBuffer") {
-          resolve17(chunksConcat(body, length).buffer);
+          resolve19(chunksConcat(body, length).buffer);
         } else if (type === "blob") {
-          resolve17(new Blob(body, { type: stream[kContentType] }));
+          resolve19(new Blob(body, { type: stream[kContentType] }));
         } else if (type === "bytes") {
-          resolve17(chunksConcat(body, length));
+          resolve19(chunksConcat(body, length));
         }
         consumeFinish(consume2);
       } catch (err) {
@@ -16610,9 +16610,9 @@ var require_api_request = __commonJS({
     };
     function request2(opts, callback) {
       if (callback === void 0) {
-        return new Promise((resolve17, reject) => {
+        return new Promise((resolve19, reject) => {
           request2.call(this, opts, (err, data) => {
-            return err ? reject(err) : resolve17(data);
+            return err ? reject(err) : resolve19(data);
           });
         });
       }
@@ -16873,9 +16873,9 @@ var require_api_stream = __commonJS({
     };
     function stream(opts, factory, callback) {
       if (callback === void 0) {
-        return new Promise((resolve17, reject) => {
+        return new Promise((resolve19, reject) => {
           stream.call(this, opts, factory, (err, data) => {
-            return err ? reject(err) : resolve17(data);
+            return err ? reject(err) : resolve19(data);
           });
         });
       }
@@ -17175,9 +17175,9 @@ var require_api_upgrade = __commonJS({
     };
     function upgrade2(opts, callback) {
       if (callback === void 0) {
-        return new Promise((resolve17, reject) => {
+        return new Promise((resolve19, reject) => {
           upgrade2.call(this, opts, (err, data) => {
-            return err ? reject(err) : resolve17(data);
+            return err ? reject(err) : resolve19(data);
           });
         });
       }
@@ -17271,9 +17271,9 @@ var require_api_connect = __commonJS({
     };
     function connect6(opts, callback) {
       if (callback === void 0) {
-        return new Promise((resolve17, reject) => {
+        return new Promise((resolve19, reject) => {
           connect6.call(this, opts, (err, data) => {
-            return err ? reject(err) : resolve17(data);
+            return err ? reject(err) : resolve19(data);
           });
         });
       }
@@ -18733,8 +18733,8 @@ var require_snapshot_utils = __commonJS({
 var require_snapshot_recorder = __commonJS({
   "../../node_modules/.pnpm/undici@8.10.0/node_modules/undici/lib/mock/snapshot-recorder.js"(exports, module) {
     "use strict";
-    var { writeFile: writeFile23, readFile: readFile39, mkdir: mkdir22 } = __require("node:fs/promises");
-    var { dirname: dirname23, resolve: resolve17 } = __require("node:path");
+    var { writeFile: writeFile23, readFile: readFile40, mkdir: mkdir22 } = __require("node:fs/promises");
+    var { dirname: dirname24, resolve: resolve19 } = __require("node:path");
     var { setTimeout: setTimeout2, clearTimeout: clearTimeout2 } = __require("node:timers");
     var { InvalidArgumentError, UndiciError } = require_errors();
     var { hashId, isUrlExcludedFactory, normalizeHeaders, createHeaderFilters } = require_snapshot_utils();
@@ -18950,7 +18950,7 @@ var require_snapshot_recorder = __commonJS({
           throw new InvalidArgumentError("Snapshot path is required");
         }
         try {
-          const data = await readFile39(resolve17(path), "utf8");
+          const data = await readFile40(resolve19(path), "utf8");
           const parsed = JSON.parse(data);
           if (Array.isArray(parsed)) {
             this.#snapshots.clear();
@@ -18979,8 +18979,8 @@ var require_snapshot_recorder = __commonJS({
         if (!path) {
           throw new InvalidArgumentError("Snapshot path is required");
         }
-        const resolvedPath = resolve17(path);
-        await mkdir22(dirname23(resolvedPath), { recursive: true });
+        const resolvedPath = resolve19(path);
+        await mkdir22(dirname24(resolvedPath), { recursive: true });
         const data = Array.from(this.#snapshots.entries()).map(([hash2, snapshot]) => ({
           hash: hash2,
           snapshot
@@ -26477,7 +26477,7 @@ var require_fetch = __commonJS({
         const hasTrailingQuestionMark = url2.search.length === 0 && url2.href[url2.href.length - url2.hash.length - 1] === "?";
         return dispatchWithProtocolPreference(body);
         function dispatchWithProtocolPreference(body2, allowH2) {
-          return new Promise((resolve17, reject) => agent2.dispatch(
+          return new Promise((resolve19, reject) => agent2.dispatch(
             {
               path: hasTrailingQuestionMark ? `${path}?` : path,
               origin: url2.origin,
@@ -26560,7 +26560,7 @@ var require_fetch = __commonJS({
                   }
                 }
                 const onError = (err) => this.onResponseError(controller, err);
-                resolve17({
+                resolve19({
                   status: status9,
                   statusText,
                   headersList,
@@ -26593,7 +26593,7 @@ var require_fetch = __commonJS({
                   fetchParams.controller.off("terminated", this.abort);
                 }
                 if (request2.mode === "websocket" && allowH2 !== false && error62?.code === "UND_ERR_INFO" && error62?.message === "HTTP/2: Extended CONNECT protocol not supported by server") {
-                  resolve17(dispatchWithProtocolPreference(body2, false));
+                  resolve19(dispatchWithProtocolPreference(body2, false));
                   return;
                 }
                 this.body?.destroy(error62);
@@ -26607,7 +26607,7 @@ var require_fetch = __commonJS({
                 const rawHeaders = controller?.rawHeaders ?? [];
                 const headersList = new HeadersList();
                 appendHeadersListFromResponseHeaders(headersList, headers, rawHeaders);
-                resolve17({
+                resolve19({
                   status: status9,
                   statusText: STATUS_CODES[status9],
                   headersList,
@@ -31581,7 +31581,7 @@ function runRedacted({
   signal
 }) {
   const values = Object.values(env);
-  return new Promise((resolve17, reject) => {
+  return new Promise((resolve19, reject) => {
     const [file3, ...args] = command;
     const child = spawn(file3, args, {
       env: { ...baseEnv, ...env },
@@ -31607,7 +31607,7 @@ function runRedacted({
     child.on("error", reject);
     child.on("close", (code, ended) => {
       signal?.removeEventListener("abort", killGroup);
-      void drained.then(() => resolve17(code ?? (ended ? 128 + signalNumber(ended) : 1)));
+      void drained.then(() => resolve19(code ?? (ended ? 128 + signalNumber(ended) : 1)));
     });
   });
 }
@@ -35671,7 +35671,9 @@ var SWITCHES = /* @__PURE__ */ new Set([
   "wait-reply",
   "no-publish",
   "local",
-  "done"
+  "done",
+  "names",
+  "shell"
 ]);
 function parseArgs({ argv }) {
   const words = [];
@@ -35709,7 +35711,7 @@ function flagText({
 }
 
 // src/rules/cli-version.rules.ts
-var STAMPED = "0.1.42";
+var STAMPED = "0.1.44";
 function cliVersionOf({ stamped = STAMPED } = {}) {
   return stamped.startsWith("__") ? "dev" : stamped;
 }
@@ -40748,7 +40750,7 @@ var recursive = /* @__PURE__ */ new WeakMap();
 var NONE = 0;
 var ASSUMED = 1;
 var PROVEN = 2;
-function isRecursive(inst, stack, resolve17) {
+function isRecursive(inst, stack, resolve19) {
   const cached2 = recursive.get(inst);
   if (cached2 !== void 0)
     return cached2 ? PROVEN : NONE;
@@ -40758,7 +40760,7 @@ function isRecursive(inst, stack, resolve17) {
   let result = NONE;
   const check3 = (child) => {
     if (result !== PROVEN && child?._zod) {
-      const answer4 = isRecursive(child, stack, resolve17);
+      const answer4 = isRecursive(child, stack, resolve19);
       if (answer4 > result)
         result = answer4;
     }
@@ -40769,7 +40771,7 @@ function isRecursive(inst, stack, resolve17) {
       const desc = Object.getOwnPropertyDescriptor(sh, key);
       if (spread && !desc.enumerable)
         continue;
-      const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack, resolve17) : NONE;
+      const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack, resolve19) : NONE;
       if (child > answer4)
         answer4 = child;
     }
@@ -40833,7 +40835,7 @@ function isRecursive(inst, stack, resolve17) {
       break;
     // `$ZodLazy` caches its inner on the def, so a resolved edge is followed exactly
     case "lazy": {
-      const inner = def._cachedInner ?? (resolve17 ? inst._zod.innerType : void 0);
+      const inner = def._cachedInner ?? (resolve19 ? inst._zod.innerType : void 0);
       merge2(inner ? isRecursive(inner, stack, false) : ASSUMED);
       break;
     }
@@ -59661,6 +59663,7 @@ var noticeKindSchema = external_exports.enum([
   "channel",
   "reaction"
 ]);
+var quietKindSchema = external_exports.enum([...noticeKindSchema.options, "broadcast"]);
 var noticeSenderSchemaDefinition = external_exports.object({
   kind: external_exports.enum(["person", "agent"]),
   id: external_exports.string().min(1).max(64),
@@ -59687,7 +59690,9 @@ var messageNoticeSchema = external_exports.object({
   /** The sender picked "Notify anyway": it breaks through Do Not Disturb, once. */
   urgent: external_exports.boolean().optional(),
   /** It came in through a mirror such as Slack, whose own app already rings: Laze stays silent. */
-  mirrored: external_exports.boolean().optional()
+  mirrored: external_exports.boolean().optional(),
+  /** An @channel or @here raised it, not the conversation's every-message level. */
+  broadcast: external_exports.boolean().optional()
 });
 var approvalNoticeSchema = external_exports.object({
   workspaceId: workspaceIdSchema2,
@@ -60093,6 +60098,70 @@ var burstSummaryIntentSchemaDefinition = external_exports.object({
   fromName: external_exports.string(),
   since: external_exports.iso.datetime()
 });
+var heldFeedPushSchema = external_exports.object({
+  itemId: external_exports.string().min(1),
+  idempotencyKey: external_exports.string().min(1),
+  collapseId: external_exports.string().optional(),
+  title: external_exports.string(),
+  body: external_exports.string(),
+  path: external_exports.string().min(1)
+});
+var heldBurstPushSchema = external_exports.object({
+  fromKey: external_exports.string().min(1),
+  fromName: external_exports.string(),
+  since: external_exports.iso.datetime()
+});
+var heldPhonePushShape = {
+  noticeId: external_exports.string().min(1).optional(),
+  channelId: external_exports.string().min(1).optional(),
+  messageId: external_exports.string().min(1).optional(),
+  kind: noticeKindSchema.optional(),
+  /** A `channel` notice an @channel or @here raised. */
+  broadcast: external_exports.boolean().optional(),
+  silent: external_exports.boolean().optional(),
+  feed: heldFeedPushSchema.optional(),
+  burst: heldBurstPushSchema.optional()
+};
+var phonePushHeldPayloadSchemaDefinition = external_exports.object({
+  workspaceId: external_exports.string().min(1),
+  userId: external_exports.string().min(1),
+  ...heldPhonePushShape,
+  dueAt: external_exports.iso.datetime(),
+  at: external_exports.iso.datetime()
+});
+var phonePushHoldStateSchemaDefinition = external_exports.object({
+  workspaceId: external_exports.string(),
+  userId: external_exports.string(),
+  pending: external_exports.array(
+    external_exports.object({
+      ...heldPhonePushShape,
+      /** In epoch milliseconds. */
+      dueAt: external_exports.number()
+    })
+  )
+});
+var heldPhonePushIntentSchemaDefinition = external_exports.object({
+  workspaceId: external_exports.string().min(1),
+  userId: external_exports.string().min(1),
+  ...heldPhonePushShape
+});
+var conversationQuietedPayloadSchemaDefinition = external_exports.object({
+  workspaceId: external_exports.string().min(1),
+  userId: external_exports.string().min(1),
+  channelId: external_exports.string().min(1),
+  changeId: external_exports.string().min(1),
+  levelQuiets: external_exports.array(quietKindSchema),
+  muteQuiets: external_exports.array(quietKindSchema),
+  mutedUntil: external_exports.iso.datetime().nullable(),
+  at: external_exports.iso.datetime()
+});
+var feedCardSettledPayloadSchemaDefinition = external_exports.object({
+  workspaceId: external_exports.string().min(1),
+  userId: external_exports.string().min(1),
+  itemId: external_exports.string().min(1),
+  changeId: external_exports.string().min(1),
+  at: external_exports.iso.datetime()
+});
 var feedDigestSetPayloadSchemaDefinition = external_exports.object({
   workspaceId: external_exports.string().min(1),
   userId: external_exports.string().min(1),
@@ -60129,6 +60198,16 @@ var NotificationDefaultHooksToken = notificationUi.hooks("channel-default");
 var NotificationPauseDialogSlot = notificationUi.component("pause-dialog");
 
 // ../../modules/chat/contract/src/chat.events.ts
+var memberNotifySetPayloadSchemaDefinition = external_exports.object({
+  workspaceId: external_exports.string().min(1),
+  channelId: external_exports.string().min(1),
+  userId: external_exports.string().min(1),
+  changeId: external_exports.string().min(1),
+  levelQuiets: external_exports.array(quietKindSchema),
+  muteQuiets: external_exports.array(quietKindSchema),
+  mutedUntil: external_exports.iso.datetime().nullable(),
+  at: external_exports.iso.datetime()
+});
 var personErasedPayloadSchemaDefinition = external_exports.object({
   workspaceId: external_exports.string().min(1),
   channelId: external_exports.string().min(1),
@@ -60635,6 +60714,8 @@ function connectionNameForField(field) {
 var VaultSecretOfferSlot = uiTokens("vault").component("secretOffer");
 
 // ../../modules/vault/contract/src/vault-reason.ts
+var VAULT_EXIT_BAD_REASON = 2;
+var VAULT_REASON_GUIDANCE = 'Write --reason as one short plain sentence a person understands on a phone: what you want to do and why. Good: --reason "Read the query plan to find why the events dashboard is slow".';
 var COMMAND_STARTS = new Set(
   "sudo laze kv aws curl wget npm pnpm yarn npx git gh kubectl helm docker terraform python python3 node bash sh zsh export cd make cargo go ssh scp psql uv pip echo cat env clickhouse-client".split(
     " "
@@ -60715,7 +60796,7 @@ var vaultOwnedKeychainSchemaDefinition = external_exports.discriminatedUnion("ki
   agentKeychain
 ]);
 var vaultOwnedKeychainSchema = vaultOwnedKeychainSchemaDefinition;
-var vaultConnectionKindSchema = external_exports.enum(["api_key_set", "oauth", "mcp"]);
+var vaultConnectionKindSchema = external_exports.enum(["api_key_set", "oauth", "mcp", "aws"]);
 var vaultConnectionStatusSchema = external_exports.enum(["active", "needs_reconnect"]);
 var vaultFieldNameSchema = external_exports.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/).max(64);
 var vaultConnectionNameSchema = external_exports.string().regex(/^[a-z0-9][a-z0-9-]{0,62}$/);
@@ -60760,6 +60841,15 @@ var vaultSecretBundleSchemaDefinition = external_exports.discriminatedUnion("kin
     serverUrl: external_exports.url(),
     headers: external_exports.record(external_exports.string().regex(/^[A-Za-z0-9-]{1,64}$/), external_exports.string().min(1)).default({}),
     tokens: vaultOAuthTokensSchema.nullable().default(null)
+  }),
+  /** An AWS access key: vaultd signs STS calls with it, releases carry only the session. */
+  external_exports.object({
+    kind: external_exports.literal("aws"),
+    accessKeyId: external_exports.string().regex(/^[A-Z0-9]{16,128}$/),
+    secretAccessKey: external_exports.string().min(16).max(256),
+    roleArn: external_exports.string().regex(/^arn:aws[a-z-]*:iam::\d{12}:role\/[\w+=,.@/-]{1,512}$/).nullable().default(null),
+    region: external_exports.string().regex(/^[a-z]{2}(-[a-z]+)+-\d$/),
+    externalId: external_exports.string().min(2).max(1224).nullable().default(null)
   })
 ]);
 var vaultSecretBundleSchema = vaultSecretBundleSchemaDefinition;
@@ -61016,6 +61106,7 @@ var vaultRunReleaseSchemaDefinition = external_exports.discriminatedUnion("outco
   }),
   external_exports.object({ outcome: external_exports.literal("deny"), exitCode: external_exports.number().int(), message: external_exports.string() })
 ]);
+var vaultRunReleaseSchema = vaultRunReleaseSchemaDefinition;
 var vaultEgressResolveInputSchemaDefinition = external_exports.object({
   agentId: external_exports.string().min(1),
   connectionId: external_exports.string().min(1),
@@ -61342,6 +61433,8 @@ var vaultConfig = Config.define((c) => ({
   auditHeadFile: c.env("VAULT_AUDIT_HEAD_FILE", external_exports.string().min(1).optional()),
   /** vaultd's socket; set, the master key and data keys stay in vaultd, unset keeps them here. */
   vaultdSocket: c.env("LAZE_VAULTD_SOCKET", external_exports.string().min(1).optional()),
+  /** Where the in-process key sends AWS STS calls instead of AWS; vaultd has its own flag. */
+  awsStsEndpoint: c.env("LAZE_VAULT_AWS_STS_ENDPOINT", external_exports.url().optional()),
   /** The workspace whose admins get vault alert cards; unset only logs the alerts. */
   alertWorkspaceId: c.env("VAULT_ALERT_WORKSPACE_ID", external_exports.string().min(1).optional())
 }));
@@ -61970,6 +62063,56 @@ var vaultAlertClearedPayloadSchemaDefinition = external_exports.object({
   at: external_exports.iso.datetime()
 });
 
+// ../../modules/vault/contract/src/vault-env.ts
+var VAULT_BATCH_MAX_REFS = 100;
+var vaultBatchRefSchema = external_exports.string().regex(/^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/, "A connection name or a variable name");
+var batchFieldsDefinition = {
+  refs: external_exports.array(vaultBatchRefSchema).min(1).max(VAULT_BATCH_MAX_REFS),
+  reason: external_exports.string(),
+  command: external_exports.array(external_exports.string()).default([]),
+  /** The run's P-256 public key, base64url; a sealed connection is released only to it. */
+  recipient: external_exports.string().max(200).optional(),
+  /** Resolve the names only: no decision, no card, no audit line and no value. */
+  resolveOnly: external_exports.boolean().default(false)
+};
+var vaultBatchReleaseInputSchemaDefinition = external_exports.object({
+  agentId: external_exports.string().min(1),
+  ...batchFieldsDefinition
+});
+var vaultBatchReleaseInputSchema = vaultBatchReleaseInputSchemaDefinition;
+var vaultBatchConnectionSchemaDefinition = external_exports.object({
+  name: vaultConnectionNameSchema,
+  label: external_exports.string(),
+  kind: vaultConnectionKindSchema,
+  sensitivity: vaultSensitivitySchema,
+  fieldNames: external_exports.array(external_exports.string())
+});
+var vaultBatchConnectionSchema = vaultBatchConnectionSchemaDefinition;
+var vaultBatchEntrySchemaDefinition = external_exports.object({
+  ref: external_exports.string(),
+  connection: vaultBatchConnectionSchema.nullable(),
+  release: vaultRunReleaseSchema.nullable()
+});
+var vaultBatchEntrySchema = vaultBatchEntrySchemaDefinition;
+var vaultBatchReleaseSchemaDefinition = external_exports.object({
+  entries: external_exports.array(vaultBatchEntrySchema)
+});
+var VAULT_AWS_SESSION_FIELDS = [
+  "AWS_ACCESS_KEY_ID",
+  "AWS_SECRET_ACCESS_KEY",
+  "AWS_SESSION_TOKEN",
+  "AWS_REGION",
+  "AWS_DEFAULT_REGION",
+  "AWS_CREDENTIAL_EXPIRATION"
+];
+var vaultAwsSessionSchemaDefinition = external_exports.object({
+  accessKeyId: external_exports.string().min(1),
+  secretAccessKey: external_exports.string().min(1),
+  sessionToken: external_exports.string().min(1),
+  /** ISO 8601, as STS gives it. */
+  expiration: external_exports.iso.datetime({ offset: true })
+});
+
 // ../../modules/agent/contract/src/agent-access.ts
 var idSchema5 = external_exports.string().min(1).max(80);
 var agentGranteeSchemaDefinition = external_exports.discriminatedUnion("kind", [
@@ -62708,7 +62851,9 @@ var supervisorFrameSchemaDefinition = external_exports.discriminatedUnion("type"
     method: external_exports.enum(["GET", "POST"]),
     releaseId: external_exports.string().regex(/^[A-Za-z0-9_-]+$/).max(200).optional(),
     body: external_exports.string().max(64 * 1024).optional(),
-    turnToken: external_exports.string().min(1).max(8192)
+    turnToken: external_exports.string().min(1).max(8192),
+    /** `laze vault env`: the body is a batch of names, posted to the batch release. */
+    batch: external_exports.boolean().optional()
   })
 ]);
 var computerLaunchSchemaDefinition = external_exports.object({
@@ -65154,6 +65299,11 @@ var agentVaultReleaseInputSchemaDefinition = external_exports.object({
   ...releaseShape,
   channelId: external_exports.string().min(1).max(80).nullable().default(null)
 });
+var { agentId: _batchAgentId, ...batchShape } = vaultBatchReleaseInputSchema.shape;
+var agentVaultBatchReleaseInputSchemaDefinition = external_exports.object({
+  ...batchShape,
+  channelId: external_exports.string().min(1).max(80).nullable().default(null)
+});
 var { id, name: name2, label, kind, keychain, sensitivity, fieldNames, status } = vaultConnectionSchema.shape;
 var agentOwnerKeySchemaDefinition = external_exports.object({
   id,
@@ -68757,8 +68907,10 @@ var openclawConfig = Config.define((c) => ({
   reconnectMaxSeconds: c.env("OPENCLAW_RECONNECT_MAX_SECONDS", positiveInt5.default(60)),
   /** How long one inbox read waits for an agent's next message. */
   inboxWaitSeconds: c.env("OPENCLAW_INBOX_WAIT_SECONDS", positiveInt5.max(55).default(25)),
-  /** A run with no answer after this long is given up and said so in the conversation. */
-  runTimeoutMinutes: c.env("OPENCLAW_RUN_TIMEOUT_MINUTES", positiveInt5.default(30))
+  /** A run that shows no progress for this long is given up and said so in the conversation. */
+  runTimeoutMinutes: c.env("OPENCLAW_RUN_TIMEOUT_MINUTES", positiveInt5.default(30)),
+  /** The hard limit of one run, progress or not; OpenClaw gets it as the run's `timeoutMs`. */
+  runMaxHours: c.env("OPENCLAW_RUN_MAX_HOURS", positiveInt5.default(6))
 }));
 
 // ../../modules/openclaw/contract/src/openclaw.events.ts
@@ -70108,8 +70260,8 @@ var CodexAppServer = class _CodexAppServer {
   }
   async call(method, params) {
     const id2 = ++this.#nextId;
-    const reply2 = await new Promise((resolve17) => {
-      this.#pending.set(id2, resolve17);
+    const reply2 = await new Promise((resolve19) => {
+      this.#pending.set(id2, resolve19);
       this.write({ id: id2, method, params });
     });
     if (reply2.error !== void 0) throw new Error(`${method}: ${JSON.stringify(reply2.error)}`);
@@ -70121,12 +70273,12 @@ var CodexAppServer = class _CodexAppServer {
   /** Starts one turn; `done` settles when it completes, keeping its last agent message. */
   async startTurn({ threadId, text: text2 }) {
     const result = { answer: "" };
-    const done = new Promise((resolve17) => {
+    const done = new Promise((resolve19) => {
       const listen = (message2) => {
         absorbTurnEvent({ result, message: message2 });
         if (message2.method !== "turn/completed") return;
         this.#listeners.delete(listen);
-        resolve17(result);
+        resolve19(result);
       };
       this.#listeners.add(listen);
     });
@@ -75805,6 +75957,16 @@ async function profileOf({
     ...me.agent ? { agentId: me.agent.id } : {}
   };
 }
+async function signInFolder(input2) {
+  const profile = await profileOf(input2);
+  await input2.context.store.saveProfile({
+    name: input2.name,
+    profile,
+    bindDirectory: input2.folder,
+    onlyThere: true
+  });
+  return profile;
+}
 async function login({ context, args }) {
   const url2 = serverUrlOf({ context, args });
   const name3 = flagText({ args, name: "profile", fallback: "default" });
@@ -76242,7 +76404,7 @@ function tunnel({
   host: host2,
   port
 }) {
-  return new Promise((resolve17, reject) => {
+  return new Promise((resolve19, reject) => {
     const socket = connectTcp(proxy.port, proxy.host);
     let answer4 = "";
     const auth = proxy.authorization ? `Proxy-Authorization: ${proxy.authorization}\r
@@ -76259,7 +76421,7 @@ ${auth}\r
       answer4 += chunk.toString("latin1");
       if (!answer4.includes(HEADER_END)) return;
       socket.off("data", onData);
-      if (/^HTTP\/1\.[01] 200/.test(answer4)) return resolve17(socket);
+      if (/^HTTP\/1\.[01] 200/.test(answer4)) return resolve19(socket);
       socket.destroy();
       reject(new Error(`proxy refused the tunnel: ${answer4.split("\r\n")[0] ?? ""}`));
     };
@@ -76272,8 +76434,8 @@ async function upstreamOf({ target, proxy }) {
   const raw = proxy ? await tunnel({ proxy, host: target.hostname, port }) : connectTcp(port, target.hostname);
   if (!secure) return raw;
   const tls = connectTls({ socket: raw, servername: target.hostname });
-  await new Promise((resolve17, reject) => {
-    tls.once("secureConnect", () => resolve17());
+  await new Promise((resolve19, reject) => {
+    tls.once("secureConnect", () => resolve19());
     tls.once("error", reject);
   });
   return tls;
@@ -76315,8 +76477,8 @@ async function browserSocket({
     createConnection: () => upstream,
     perMessageDeflate: false
   });
-  await new Promise((resolve17, reject) => {
-    socket.once("open", () => resolve17());
+  await new Promise((resolve19, reject) => {
+    socket.once("open", () => resolve19());
     socket.once("error", reject);
   });
   return socket;
@@ -76329,12 +76491,12 @@ async function browserCall({
 }) {
   const socket = await browserSocket({ target, proxy });
   try {
-    return await new Promise((resolve17, reject) => {
+    return await new Promise((resolve19, reject) => {
       socket.on("message", (data) => {
         const reply2 = JSON.parse(textOf2(data));
         if (reply2.id !== 1) return;
         if (reply2.error) reject(new Error(`${method}: ${JSON.stringify(reply2.error)}`));
-        else resolve17(reply2.result ?? {});
+        else resolve19(reply2.result ?? {});
       });
       socket.once(
         "close",
@@ -76498,18 +76660,18 @@ function retargetCdpBridge({
   target,
   expiresAt
 }) {
-  return new Promise((resolve17) => {
+  return new Promise((resolve19) => {
     const call = httpRequest(
       { host: "127.0.0.1", port, path: TARGET_PATH, method: "PUT", timeout: 2e3 },
       (response) => {
         response.resume();
-        resolve17(response.statusCode === 204);
+        resolve19(response.statusCode === 204);
       }
     );
     call.setHeader(KEY_HEADER, key);
     call.setHeader("content-type", "application/json");
     call.once("timeout", () => call.destroy());
-    call.once("error", () => resolve17(false));
+    call.once("error", () => resolve19(false));
     call.end(JSON.stringify({ target, expiresAt }));
   });
 }
@@ -76558,15 +76720,15 @@ async function startCdpBridge({
       (socket) => relayPage({ client: socket, targetId, target: url2, proxy })
     );
   });
-  await new Promise((resolve17) => server.listen(0, "127.0.0.1", resolve17));
+  await new Promise((resolve19) => server.listen(0, "127.0.0.1", resolve19));
   const port = server.address().port;
   return {
     port,
-    close: () => new Promise((resolve17) => {
+    close: () => new Promise((resolve19) => {
       for (const client of relayed) client.destroy();
       pages.close();
       server.closeAllConnections();
-      server.close(() => resolve17());
+      server.close(() => resolve19());
     })
   };
 }
@@ -76583,7 +76745,7 @@ function launchCdpBridge({
     stdio: ["ignore", "pipe", "ignore"],
     env: { ...env, LAZE_CDP_TARGET: target, LAZE_CDP_EXPIRES_AT: expiresAt, LAZE_CDP_KEY: key }
   });
-  return new Promise((resolve17, reject) => {
+  return new Promise((resolve19, reject) => {
     let printed = "";
     child.once("error", reject);
     child.once("exit", (code) => reject(new Error(`the CDP bridge stopped (${code})`)));
@@ -76594,7 +76756,7 @@ function launchCdpBridge({
       child.stdout.destroy();
       child.removeAllListeners("exit");
       child.unref();
-      if (Number.isInteger(port) && port > 0) resolve17(port);
+      if (Number.isInteger(port) && port > 0) resolve19(port);
       else reject(new Error("the CDP bridge printed no port"));
     });
   });
@@ -81190,8 +81352,8 @@ var DOMAINS_USAGE = `Usage:
 var printJson5 = (context, data) => context.out(`${JSON.stringify(data, null, 2)}
 `);
 function printDomain(context, row) {
-  const join24 = row.autoJoin ? "auto-join on" : "auto-join off";
-  context.out(`${row.domain}	${join24}${row.enforced ? "	single sign-on enforced" : ""}
+  const join25 = row.autoJoin ? "auto-join on" : "auto-join off";
+  context.out(`${row.domain}	${join25}${row.enforced ? "	single sign-on enforced" : ""}
 `);
 }
 async function list4({ context, args }) {
@@ -82363,14 +82525,14 @@ async function signedGhArgs({
     const arg = args[index] ?? "";
     const [flag2 = "", inline] = arg.startsWith("--") ? arg.split(/=(.*)/s, 2) : [arg];
     const isBody = BODY_FLAGS.has(flag2);
-    const isFile = BODY_FILE_FLAGS.has(flag2);
-    if (!isBody && !isFile) {
+    const isFile2 = BODY_FILE_FLAGS.has(flag2);
+    if (!isBody && !isFile2) {
       out.push(arg);
       continue;
     }
     const value = inline ?? args[index + 1] ?? "";
     if (inline === void 0) index += 1;
-    const body = isFile ? await readBodyFile(value) : value;
+    const body = isFile2 ? await readBodyFile(value) : value;
     out.push("--body", signed({ body, signature }));
     bodied = true;
   }
@@ -84108,6 +84270,7 @@ async function notifications({ context, args }) {
 }
 
 // src/services/openclaw-commands.service.ts
+import { resolve as resolve12 } from "node:path";
 var OPENCLAW_USAGE = `Usage (a person's key; a gateway belongs to the person who connects it):
   laze openclaw list                             the gateways connected here and their agents
   laze openclaw connect <wss url> [--label <label>] (< token | --from-file <file> | --from-vault <connection>)
@@ -84116,9 +84279,11 @@ var OPENCLAW_USAGE = `Usage (a person's key; a gateway belongs to the person who
   laze openclaw connect --local [--gateway ws://127.0.0.1:18789] [--label <label>] (< token | --from-vault <connection>)
       a gateway on this machine: Laze never dials it; the laze connect service relays it out to
       Laze. Run it again to give the kept relay a new key
-  laze openclaw agent <connectionId> <openclawAgentId> on|off   make one of its agents a Laze agent
-  laze openclaw agent-key <connectionId> <openclawAgentId>   a Laze CLI key for an agent that is on,
-      printed once as the login line to run on its machine; its previous key stops working
+  laze openclaw agent <connectionId> <openclawAgentId> on|off [--login <folder>]   make one of its
+      agents a Laze agent; --login also signs its CLI in for its workspace folder on this machine
+  laze openclaw agent-key <connectionId> <openclawAgentId> [--login <folder>]   a Laze CLI key for an
+      agent that is on, printed once as the login line to run on its machine, or with --login kept
+      as its profile for that folder here, never printed; its previous key stops working
   laze openclaw feed <connectionId> on|off       temporary Workboard migration bridge, off by default
   laze openclaw disconnect <connectionId>        remove it, its Laze agents and its credentials`;
 function wordAt4(args, index) {
@@ -84235,13 +84400,16 @@ var connect3 = async (input2) => {
   });
   answer2({ context, args, connection });
 };
-var agent = async ({ context, args, client }) => {
+var agent = async (input2) => {
+  const { context, args, client } = input2;
+  const enabled = switchAt(args, 4);
   const connection = await client.post(OPENCLAW_KEY_PATHS.setAgent, {
     connectionId: wordAt4(args, 2),
     openclawAgentId: wordAt4(args, 3),
-    enabled: switchAt(args, 4)
+    enabled
   });
   answer2({ context, args, connection });
+  if (enabled && flagText({ args, name: "login" })) await agentKey(input2);
 };
 function profileNameOf(agentName) {
   return agentName.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "agent";
@@ -84251,6 +84419,17 @@ var agentKey = async ({ context, args, client, url: url2 }) => {
     connectionId: wordAt4(args, 2),
     openclawAgentId: wordAt4(args, 3)
   });
+  const login2 = flagText({ args, name: "login" });
+  if (login2) {
+    const folder = resolve12(context.cwd, login2);
+    const profile = profileNameOf(key.agentName);
+    await signInFolder({ context, url: url2, token: key.token, name: profile, folder });
+    context.out(
+      `Signed ${key.agentName} (${key.agentId}) in with a new key, profile "${profile}", used in ${folder} and below; its previous key stopped working.
+`
+    );
+    return;
+  }
   if (args.flags.json) return context.out(`${JSON.stringify(key)}
 `);
   context.out(
@@ -84341,17 +84520,13 @@ var MANAGERS = [
 ];
 var NPM_PREFIX = /^(.+)[\\/]lib[\\/]node_modules[\\/]@lazehq[\\/]cli[\\/]/;
 var NPX_CACHE2 = /[\\/]_npx[\\/]/;
-function releaseAgeOverrideOf({
-  manager,
-  nowMs
-}) {
-  if (manager === "npm")
-    return [`--before=${Temporal3.Instant.fromEpochMilliseconds(nowMs).toString()}`];
+function releaseAgeOverrideOf({ manager }) {
+  if (manager === "npm") return ["--prefer-online", "--min-release-age=0"];
   if (manager === "pnpm") return [`--config.minimum-release-age-exclude=${CLI_PACKAGE}`];
   if (manager === "bun") return ["--minimum-release-age=0"];
   return [];
 }
-function updatePlanOf({ script, nowMs }) {
+function updatePlanOf({ script }) {
   if (script === SANDBOX_CLI_PATH) return { kind: "sandbox" };
   const found = MANAGERS.find(({ pattern }) => pattern.test(script));
   if (!found) return { kind: "unmanaged", script };
@@ -84362,7 +84537,7 @@ function updatePlanOf({ script, nowMs }) {
     command: [
       ...found.command,
       ...prefix ? ["--prefix", prefix] : [],
-      ...releaseAgeOverrideOf({ manager: found.manager, nowMs }),
+      ...releaseAgeOverrideOf({ manager: found.manager }),
       CLI_PACKAGE_LATEST
     ]
   };
@@ -84472,7 +84647,7 @@ async function startedUpdate({
   server
 }) {
   if (context.environment.inherited.LAZE_AUTO_UPDATE === "0") return null;
-  const plan2 = updatePlanOf({ script: await scriptOf(context), nowMs: context.nowMs() });
+  const plan2 = updatePlanOf({ script: await scriptOf(context) });
   if (plan2.kind !== "install") return null;
   const folder = dirname21(context.environment.configPath);
   const stamp = join22(folder, "auto-update.json");
@@ -84733,7 +84908,7 @@ async function schedule({ context, args }) {
 
 // src/services/skill-commands.service.ts
 import { readdir as readdir7, readFile as readFile33 } from "node:fs/promises";
-import { join as join23, relative as relative6, resolve as resolve12 } from "node:path";
+import { join as join23, relative as relative6, resolve as resolve13 } from "node:path";
 var USAGE16 = `Usage:
   laze skill list [--agent <agentId>]
   laze skill install <catalogue-id> [--as <name>] [--agent <agentId>]
@@ -84786,7 +84961,7 @@ async function skillInstall({ context, args }) {
   if (!catalogueId === !from) throw new CliUsageError(USAGE16);
   const name3 = flagText({ args, name: "as" });
   const agent2 = flagText({ args, name: "agent" });
-  const files2 = from ? await folderFiles({ root: resolve12(context.cwd, from) }) : void 0;
+  const files2 = from ? await folderFiles({ root: resolve13(context.cwd, from) }) : void 0;
   const { client } = await signedIn({ context, args });
   const installed = await client.post("/api/skills/install", {
     ...catalogueId ? { catalogueId } : {},
@@ -84853,7 +85028,7 @@ async function skillUpdate({ context, args }) {
   if (!name3 || !newName && description === void 0 && !skillMdFile) {
     throw new CliUsageError(USAGE16);
   }
-  const skillMd = skillMdFile ? await readFile33(resolve12(context.cwd, skillMdFile), "utf8") : void 0;
+  const skillMd = skillMdFile ? await readFile33(resolve13(context.cwd, skillMdFile), "utf8") : void 0;
   const { client } = await signedIn({ context, args });
   const updated = await client.post("/api/skills/update", {
     name: name3,
@@ -84900,7 +85075,7 @@ async function skill({ context, args }) {
 
 // src/services/slack-commands.service.ts
 import { readFile as readFile34 } from "node:fs/promises";
-import { resolve as resolve13 } from "node:path";
+import { resolve as resolve14 } from "node:path";
 var SLACK_USAGE = `Usage (a person's key; Slack stays the source, the bot joins no channel by itself):
   laze slack overview                            connected Slack workspaces, mirrors, your link
   laze slack link-prompts                        Slack workspaces you have not linked yet
@@ -84947,7 +85122,7 @@ async function secretLines({ context, args }) {
     throw new CliUsageError("A secret never goes in a flag: pipe it on stdin or use --from-file.");
   }
   const file3 = flagText({ args, name: "from-file" });
-  const text2 = file3 ? await readFile34(resolve13(context.cwd, file3), "utf8") : await context.readStdin();
+  const text2 = file3 ? await readFile34(resolve14(context.cwd, file3), "utf8") : await context.readStdin();
   return text2.split("\n").map((line) => line.trim()).filter(Boolean);
 }
 async function secretsOf({
@@ -85608,10 +85783,7 @@ async function update2({
   args,
   mine: mine4 = cliVersionOf()
 }) {
-  const plan2 = updatePlanOf({
-    script: await realScriptOf({ program: context.program }),
-    nowMs: context.nowMs()
-  });
+  const plan2 = updatePlanOf({ script: await realScriptOf({ program: context.program }) });
   if (plan2.kind === "sandbox") {
     context.out("This laze comes with your computer and updates with every Laze release.\n");
     return 0;
@@ -85672,6 +85844,456 @@ async function update2({
   return 1;
 }
 
+// src/services/vault-env-commands.service.ts
+import { readFile as readFile36, stat as stat5 } from "node:fs/promises";
+import { dirname as dirname22, join as join24, resolve as resolve15 } from "node:path";
+
+// src/rules/vault-manifest.rules.ts
+var VARIABLE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var CONNECTION = /^[a-z0-9][a-z0-9-]{0,62}$/;
+var REFERENCE = /^\{\{vault:([A-Za-z0-9][A-Za-z0-9_/-]{0,127})\}\}$/;
+function refOf(name3) {
+  return name3.split("/").at(-1) ?? name3;
+}
+function unquoted(value) {
+  const trimmed = value.trim();
+  const quote4 = trimmed[0];
+  if ((quote4 === '"' || quote4 === "'") && trimmed.length >= 2 && trimmed.endsWith(quote4)) {
+    return trimmed.slice(1, -1);
+  }
+  return trimmed;
+}
+function bareLineOf({ line, where }) {
+  if (CONNECTION.test(line)) return { kind: "connection", ref: line };
+  if (VARIABLE.test(line)) return { kind: "field", variable: line, ref: line };
+  throw new CliUsageError(`${where}: not a name: ${line}`);
+}
+function lineOf4({ line, where }) {
+  const at = line.indexOf("=");
+  if (at === -1) return bareLineOf({ line, where });
+  const variable = line.slice(0, at).trim();
+  const value = line.slice(at + 1).trim();
+  if (!VARIABLE.test(variable)) {
+    throw new CliUsageError(`${where}: not a variable name: ${variable}`);
+  }
+  const reference = REFERENCE.exec(value);
+  if (reference?.[1]) return { kind: "reference", variable, ref: refOf(reference[1]) };
+  return { kind: "plain", variable, value: unquoted(value) };
+}
+function parseManifest({ text: text2, file: file3 }) {
+  const lines2 = [];
+  for (const [index, raw] of text2.split(/\r?\n/).entries()) {
+    const line = raw.trim().replace(/^export\s+/, "");
+    if (!line || line.startsWith("#")) continue;
+    lines2.push(lineOf4({ line, where: `${file3}:${index + 1}` }));
+  }
+  return lines2;
+}
+function refsOf(lines2) {
+  return [...new Set(lines2.flatMap((line) => line.kind === "plain" ? [] : [line.ref]))];
+}
+var isAwsSession = (fields) => VAULT_AWS_SESSION_FIELDS.every((name3) => fields[name3] !== void 0);
+function environmentOf({
+  lines: lines2,
+  released
+}) {
+  const env = {};
+  for (const line of lines2) {
+    if (line.kind === "plain") {
+      env[line.variable] = line.value;
+      continue;
+    }
+    const fields = released.get(line.ref)?.fields;
+    if (!fields) throw new CliUsageError(`laze vault: nothing was released for ${line.ref}`);
+    if (line.kind === "connection" || isAwsSession(fields)) {
+      Object.assign(env, fields);
+      continue;
+    }
+    const names = Object.keys(fields);
+    const value = fields[line.variable] ?? (names.length === 1 ? fields[names[0] ?? ""] : void 0);
+    if (value === void 0) {
+      throw new CliUsageError(
+        `laze vault: ${line.ref} has no field ${line.variable} (it has ${names.join(", ")}); write ${line.variable}={{vault:<connection>}} for a one-field key, or name the connection on its own line`
+      );
+    }
+    env[line.variable] = value;
+  }
+  return env;
+}
+function shellExports(env) {
+  return Object.entries(env).map(([name3, value]) => `export ${name3}='${value.replaceAll("'", `'\\''`)}'`).join("\n");
+}
+function credentialProcessJson(fields) {
+  return JSON.stringify({
+    Version: 1,
+    AccessKeyId: fields.AWS_ACCESS_KEY_ID,
+    SecretAccessKey: fields.AWS_SECRET_ACCESS_KEY,
+    SessionToken: fields.AWS_SESSION_TOKEN,
+    Expiration: fields.AWS_CREDENTIAL_EXPIRATION
+  });
+}
+
+// src/services/vault-batch.service.ts
+import { rm as rm14 } from "node:fs/promises";
+var WHERE = "laze vault env works only on a Laze agent's computer, on a machine it runs on, or signed in as a connected agent";
+async function batchOf({ response }) {
+  const text2 = await response.text();
+  if (!response.ok) {
+    const code = /"code"\s*:\s*"([^"]+)"/.exec(text2)?.[1] ?? `status ${response.status}`;
+    throw new CliUsageError(`laze vault: the batch was refused (${code})`);
+  }
+  return JSON.parse(text2);
+}
+async function doorOf({
+  context,
+  args,
+  keyName
+}) {
+  const env = context.environment.inherited;
+  const proxy = proxyOf({ env });
+  if (proxy) {
+    const turnFile = turnFileOf({ env });
+    const headers = {
+      "proxy-authorization": proxy.authorization,
+      "x-laze-turn": await turnTokenOf3({ env, turnFile, command: "laze vault env" })
+    };
+    return {
+      keyPath: runKeyPathOf({ turnFile, connection: keyName }),
+      ask: async (body) => batchOf({
+        response: await reach({
+          context,
+          url: `${proxy.origin}/vault/release-batch`,
+          init: {
+            method: "POST",
+            headers: { ...headers, "content-type": "application/json" },
+            body: JSON.stringify(body)
+          }
+        })
+      }),
+      status: async (requestId) => releaseOf({
+        response: await reach({
+          context,
+          url: `${proxy.origin}/vault/release/${encodeURIComponent(requestId)}`,
+          init: { method: "GET", headers }
+        })
+      })
+    };
+  }
+  const signed2 = await signedIn({ context, args }).catch(() => null);
+  if (signed2?.profile.kind !== "agent") throw new CliUsageError(WHERE);
+  const { client, name: name3 } = signed2;
+  const channelId = flagText({ args, name: "channel" }) || null;
+  return {
+    keyPath: runKeyPathOf({ turnFile: void 0, connection: keyName, profile: name3 }),
+    ask: async (body) => {
+      try {
+        return await client.post("/api/agents/me/vault/release-batch", {
+          ...body,
+          channelId
+        });
+      } catch (error62) {
+        if (!(error62 instanceof LazeApiError)) throw error62;
+        throw new CliUsageError(
+          `laze vault: the batch was refused: ${error62.message} (${error62.code})`
+        );
+      }
+    },
+    status: (requestId) => client.post("/api/agents/me/vault/release-status", { requestId, channelId }).catch(refusedRelease)
+  };
+}
+async function resolveBatch({
+  context,
+  args,
+  refs
+}) {
+  const door = await doorOf({ context, args, keyName: "env-names" });
+  const answer4 = await door.ask({ refs, reason: "", command: [], resolveOnly: true });
+  return answer4.entries;
+}
+var keyOf = (entry) => entry.connection?.name ?? entry.ref;
+async function untilAllAnswered({
+  context,
+  door,
+  waiting,
+  deadline
+}) {
+  const answered = /* @__PURE__ */ new Map();
+  if (waiting.size === 0) return answered;
+  const [first] = waiting.values();
+  context.err(
+    `laze vault: ${[...waiting.keys()].join(", ")} wait for an answer (${first?.message ?? "a card"}); cards expire after 12 hours...
+`
+  );
+  while (waiting.size > 0) {
+    if (context.nowMs() + POLL_MS2 > deadline) {
+      context.err(
+        `laze vault: ${[...waiting.keys()].join(", ")} not approved yet; ask again later.
+`
+      );
+      return "capped";
+    }
+    await context.sleep(POLL_MS2);
+    for (const [key, pending] of waiting) {
+      const next = await door.status(pending.requestId);
+      if (next.outcome === "ask") waiting.set(key, next);
+      else {
+        waiting.delete(key);
+        answered.set(key, next);
+      }
+    }
+  }
+  return answered;
+}
+async function releaseBatch({
+  context,
+  args,
+  refs,
+  reason,
+  command
+}) {
+  const deadline = deadlineOf({ args, nowMs: context.nowMs() });
+  const door = await doorOf({ context, args, keyName: `env:${[...refs].toSorted().join(",")}` });
+  const run4 = await runKeyAt({ path: door.keyPath });
+  let answer4;
+  let settled2;
+  try {
+    answer4 = await door.ask({ refs, reason, command, recipient: run4.publicKey });
+    const missing = answer4.entries.filter((entry) => !entry.connection);
+    if (missing.length > 0) {
+      context.err(
+        `laze vault: no key named ${missing.map((entry) => entry.ref).join(", ")} in your vault or reachable by this agent
+`
+      );
+      return { exitCode: 1 };
+    }
+    settled2 = /* @__PURE__ */ new Map();
+    const waiting = /* @__PURE__ */ new Map();
+    for (const entry of answer4.entries) {
+      const release2 = entry.release;
+      if (!release2) continue;
+      if (release2.outcome === "ask") waiting.set(keyOf(entry), release2);
+      else settled2.set(keyOf(entry), release2);
+    }
+    const later = await untilAllAnswered({ context, door, waiting, deadline });
+    if (later === "capped") return { exitCode: 75 };
+    for (const [key, release2] of later) settled2.set(key, release2);
+  } catch (error62) {
+    if (!(error62 instanceof ServerGoneError)) throw error62;
+    context.err(`${error62.message}. Run the command again to keep waiting.
+`);
+    return { exitCode: 75 };
+  }
+  return valuesOf({ context, entries: answer4.entries, settled: settled2, run: run4, keyPath: door.keyPath });
+}
+function refusalOf({
+  context,
+  settled: settled2
+}) {
+  const codes = [];
+  for (const [key, release2] of settled2) {
+    if (release2.outcome !== "deny") continue;
+    context.err(`laze vault: ${key}: ${release2.message}
+`);
+    codes.push(release2.exitCode || 1);
+  }
+  if (codes.length === 0) return 0;
+  return codes.includes(77) ? 77 : codes[0] ?? 1;
+}
+async function valuesOf({
+  context,
+  entries,
+  settled: settled2,
+  run: run4,
+  keyPath
+}) {
+  const refused = refusalOf({ context, settled: settled2 });
+  if (refused !== 0) {
+    await rm14(keyPath, { force: true });
+    return { exitCode: refused };
+  }
+  const opened = /* @__PURE__ */ new Map();
+  let keep = false;
+  for (const [key, release2] of settled2) {
+    if (release2.outcome !== "allow") continue;
+    opened.set(key, await envOf({ release: release2, run: run4 }));
+    if (leaseHolds({ release: release2, nowMs: context.nowMs() })) keep = true;
+    if (release2.message) context.err(`${release2.message}
+`);
+  }
+  if (!keep) await rm14(keyPath, { force: true });
+  const released = /* @__PURE__ */ new Map();
+  for (const entry of entries) {
+    const fields = opened.get(keyOf(entry));
+    if (fields) released.set(entry.ref, { fields });
+  }
+  return { released, entries };
+}
+
+// src/services/vault-env-commands.service.ts
+var ENV_USAGE = `Usage: laze vault env [<file>] [--env <name>] --reason "<one plain sentence>" [--wait <s>] -- <command> [args...]
+       laze vault env [<file>] [--env <name>] --names
+       laze vault env [<file>] --shell [--command-b64 <base64>] --reason "<one plain sentence>"
+Runs the command with every key the manifest names in its environment, asked in one go.
+The manifest is .env.vault (.env.<name>.vault with --env), here or in the nearest parent folder.
+Lines: KEY (the field KEY of the key that holds it), KEY={{vault:<name>}}, a key's name (all its
+fields) or KEY=value (plain text); # starts a comment.
+  --names     what each line resolves to, never a value
+  --shell     export lines to eval instead of running a command; refused on a terminal
+  --reason    or KV_REASON / LAZE_VAULT_REASON in the environment
+Exit codes: the command's own; 2 the reason was refused; 77 the vault denied a key, do not retry;
+75 the wait ran out, run it again to keep waiting; 1 a usage error or a name nothing resolves.`;
+var AWS_USAGE = `Usage: laze vault aws <connection> [--reason "<one plain sentence>"] [-- <command> [args...]]
+Prints AWS credential_process JSON with a short-lived STS session minted from the key, for
+~/.aws/config: credential_process = laze vault aws <connection>
+With -- <command>, runs it with AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and AWS_SESSION_TOKEN set.
+The reason comes from --reason, else KV_REASON or LAZE_VAULT_REASON: set it on each aws, kubectl,
+helm or terraform command, which reach this through credential_process.`;
+function reasonOf({ context, args }) {
+  const env = context.environment.inherited;
+  return flagText({ args, name: "reason" }) || env.KV_REASON?.trim() || env.LAZE_VAULT_REASON?.trim() || "";
+}
+function refusedReason({
+  context,
+  reason
+}) {
+  const problem = checkVaultReason(reason);
+  if (problem === "ok") return null;
+  context.err(`laze vault: the reason is refused (${problem}). ${VAULT_REASON_GUIDANCE}
+`);
+  return VAULT_EXIT_BAD_REASON;
+}
+async function isFile(path) {
+  return stat5(path).then(
+    (found) => found.isFile(),
+    () => false
+  );
+}
+async function manifestPathOf({
+  context,
+  args
+}) {
+  const named = args.words[2];
+  if (named) return resolve15(context.cwd, named);
+  const environment = flagText({ args, name: "env" });
+  const file3 = environment ? `.env.${environment}.vault` : ".env.vault";
+  for (let dir = resolve15(context.cwd); ; dir = dirname22(dir)) {
+    if (await isFile(join24(dir, file3))) return join24(dir, file3);
+    if (dirname22(dir) === dir) break;
+  }
+  throw new CliUsageError(`laze vault: no ${file3} here or in a parent folder
+${ENV_USAGE}`);
+}
+async function manifestOf({
+  context,
+  args
+}) {
+  const file3 = await manifestPathOf({ context, args });
+  const text2 = await readFile36(file3, "utf8").catch(() => {
+    throw new CliUsageError(`laze vault: cannot read ${file3}`);
+  });
+  return { file: file3, lines: parseManifest({ text: text2, file: file3 }) };
+}
+async function printNames({
+  context,
+  args,
+  lines: lines2
+}) {
+  const refs = refsOf(lines2);
+  const entries = refs.length > 0 ? await resolveBatch({ context, args, refs }) : [];
+  const byRef = new Map(entries.map((entry) => [entry.ref, entry.connection]));
+  let missing = false;
+  for (const line of lines2) {
+    const label3 = line.kind === "connection" ? line.ref : line.variable;
+    if (line.kind === "plain") {
+      context.out(`${label3}  plain
+`);
+      continue;
+    }
+    const connection = byRef.get(line.ref);
+    if (!connection) missing = true;
+    context.out(
+      connection ? `${label3}  ${connection.name}  ${vaultLevelLabel(connection.sensitivity)}
+` : `${label3}  not found
+`
+    );
+  }
+  return missing ? 1 : 0;
+}
+function wrappedCommandOf(args) {
+  const encoded = flagText({ args, name: "command-b64" });
+  if (!encoded) return ["(shell)"];
+  return [Buffer.from(encoded, "base64").toString("utf8").slice(0, 2e3)];
+}
+async function vaultEnv2({
+  context,
+  args
+}) {
+  if (args.flags.help) {
+    context.out(`${ENV_USAGE}
+`);
+    return 0;
+  }
+  const { lines: lines2 } = await manifestOf({ context, args });
+  if (args.flags.names) return printNames({ context, args, lines: lines2 });
+  const shell = args.flags.shell === true;
+  if (shell && context.stdoutIsTerminal) {
+    throw new CliUsageError(
+      "laze vault env --shell prints values: it runs only with its output to a pipe, such as the Bash hook's eval"
+    );
+  }
+  if (!shell && args.rest.length === 0) throw new CliUsageError(ENV_USAGE);
+  const reason = reasonOf({ context, args });
+  if (!reason)
+    throw new CliUsageError(`Say why with --reason "<one plain sentence>"
+${ENV_USAGE}`);
+  const badReason = refusedReason({ context, reason });
+  if (badReason !== null) return badReason;
+  const refs = refsOf(lines2);
+  let released = /* @__PURE__ */ new Map();
+  if (refs.length > 0) {
+    const command = shell ? wrappedCommandOf(args) : args.rest;
+    const outcome = await releaseBatch({ context, args, refs, reason, command });
+    if ("exitCode" in outcome) return outcome.exitCode;
+    released = outcome.released;
+  }
+  const env = environmentOf({ lines: lines2, released });
+  if (shell) {
+    context.out(`${shellExports(env)}
+`);
+    return 0;
+  }
+  return context.runCommand({ command: args.rest, env });
+}
+async function vaultAws({
+  context,
+  args
+}) {
+  const connection = args.words[2];
+  if (!connection || args.flags.help) throw new CliUsageError(AWS_USAGE);
+  const reason = reasonOf({ context, args });
+  if (!reason) {
+    throw new CliUsageError(
+      `Say why with --reason "<one plain sentence>" or KV_REASON
+${AWS_USAGE}`
+    );
+  }
+  const badReason = refusedReason({ context, reason });
+  if (badReason !== null) return badReason;
+  const command = args.rest.length > 0 ? args.rest : ["credential_process"];
+  const outcome = await releaseBatch({ context, args, refs: [connection], reason, command });
+  if ("exitCode" in outcome) return outcome.exitCode;
+  const fields = outcome.released.get(connection)?.fields ?? {};
+  if (!fields.AWS_SESSION_TOKEN) {
+    context.err(`laze vault: ${connection} is not an AWS key; use laze vault run for it
+`);
+    return 1;
+  }
+  if (args.rest.length > 0) return context.runCommand({ command: args.rest, env: fields });
+  context.out(`${credentialProcessJson(fields)}
+`);
+  return 0;
+}
+
 // src/services/vault-save-message-commands.service.ts
 var SAVE_USAGE = `Usage: laze vault save <pending> --name <name> --description "<what it is for>"
 Names a key Laze held from a message you received, in the sender's vault.
@@ -85745,7 +86367,7 @@ async function vaultSave({ context, args }) {
 }
 
 // src/services/vault-scrub-commands.service.ts
-function lineOf4(channel) {
+function lineOf5(channel) {
   const where = channel.name ? `#${channel.name}` : channel.channelId;
   const found = Object.entries(channel.found).map(([vendor, count5]) => `${vendor} ${count5}`).join(", ");
   const kinds = [`held ${channel.held}`, ...found ? [`found: ${found}`] : []].join("; ");
@@ -85759,7 +86381,7 @@ async function vaultScrub({ context, args }) {
   if (args.flags.json) return context.out(`${JSON.stringify(report3, null, 2)}
 `);
   const changed = report3.channels.filter((channel) => channel.messages > 0);
-  for (const channel of changed) context.out(lineOf4(channel));
+  for (const channel of changed) context.out(lineOf5(channel));
   const total = changed.reduce((sum, channel) => sum + channel.messages, 0);
   context.out(
     report3.dryRun ? `Dry run: ${total} message(s) would change. Nothing was changed.
@@ -85769,8 +86391,8 @@ async function vaultScrub({ context, args }) {
 }
 
 // src/services/whatsapp-business-commands.service.ts
-import { readFile as readFile36 } from "node:fs/promises";
-import { resolve as resolve14 } from "node:path";
+import { readFile as readFile37 } from "node:fs/promises";
+import { resolve as resolve16 } from "node:path";
 
 // ../../modules/whatsapp-business/contract/src/whatsapp-business.prices.ts
 var whatsappBusinessCategorySchema = external_exports.enum([
@@ -86189,7 +86811,7 @@ async function secretsOf2({ context, args }) {
   const fromConnection = flagText({ args, name: "from-vault" });
   if (fromConnection) return { fromConnection };
   const file3 = flagText({ args, name: "from-file" });
-  const text2 = file3 ? await readFile36(resolve14(context.cwd, file3), "utf8") : await context.readStdin();
+  const text2 = file3 ? await readFile37(resolve16(context.cwd, file3), "utf8") : await context.readStdin();
   const lines2 = text2.split("\n").map((line) => line.trim()).filter(Boolean);
   if (lines2.length !== 2) {
     throw new CliUsageError(
@@ -86391,7 +87013,7 @@ async function whatsappBusiness({
 
 // src/services/whatsapp-pairing-commands.service.ts
 import { writeFile as writeFile22 } from "node:fs/promises";
-import { resolve as resolve15 } from "node:path";
+import { resolve as resolve17 } from "node:path";
 var WHATSAPP_PAIRING_USAGE = [
   "       laze whatsapp pair <machine> [--qr <file.svg>]     link WhatsApp on your machine; scan the code (owner)",
   "       laze whatsapp pairing <pairing-id> [--qr <file.svg>]   where the linking stands, with a fresh code",
@@ -86410,7 +87032,7 @@ function svgOf(dataUrl) {
   return decodeURIComponent(body);
 }
 async function report({ context, args, pairing: pairing2 }) {
-  const qrFile = pairing2.qrSvg ? resolve15(context.cwd, flagText({ args, name: "qr", fallback: "whatsapp-qr.svg" })) : null;
+  const qrFile = pairing2.qrSvg ? resolve17(context.cwd, flagText({ args, name: "qr", fallback: "whatsapp-qr.svg" })) : null;
   if (qrFile && pairing2.qrSvg) await writeFile22(qrFile, svgOf(pairing2.qrSvg), "utf8");
   if (args.flags.json) return context.out(`${JSON.stringify({ ...pairing2, qrFile }, null, 2)}
 `);
@@ -86770,8 +87392,8 @@ async function flags({ context, args }) {
 }
 
 // src/services/workspace-commands.service.ts
-import { readFile as readFile37 } from "node:fs/promises";
-import { resolve as resolve16 } from "node:path";
+import { readFile as readFile38 } from "node:fs/promises";
+import { resolve as resolve18 } from "node:path";
 var ROLE_NAMES2 = {
   OWNER: "Owner",
   ADMIN: "Admin",
@@ -86953,7 +87575,7 @@ var LOGO_USAGE = "Usage: laze workspace logo set <file.png|jpg|webp> | laze work
 async function readLogo({ context, file: file3 }) {
   let bytes;
   try {
-    bytes = new Uint8Array(await readFile37(resolve16(context.cwd, file3)));
+    bytes = new Uint8Array(await readFile38(resolve18(context.cwd, file3)));
   } catch {
     throw new CliUsageError(`No file to read at ${file3}.`);
   }
@@ -87317,6 +87939,9 @@ var HELP = `laze: work in a Laze workspace from your terminal or your agent.
   laze adopt codex [--thread <id>]               answer Laze messages in a Codex thread
   laze adopt codex --status | --stop             the background adopt that laze agent link started
   laze vault run <name> --reason "<why>" -- <cmd>  run a command with a vault connection (agents)
+  laze vault env [<file>] --reason "<why>" -- <cmd>   run a command with every key .env.vault names (agents)
+  laze vault env --names | --shell               what .env.vault resolves to; export lines for a shell hook
+  laze vault aws <connection> [--reason "<why>"]   AWS credential_process JSON from a short-lived STS session
   laze vault save <pending> --name <name> --description "<text>"   name a key Laze held from a message (agents)
   laze vault save --from-message <id> --name <name> --description "<text>"   save a key a person sent,
       read from stdin, to their own vault; the message keeps {{vault:<name>}} (agents, no vault access)
@@ -87477,6 +88102,8 @@ var COMMANDS3 = {
   skill,
   app,
   "vault run": vaultRun,
+  "vault env": vaultEnv2,
+  "vault aws": vaultAws,
   "vault save": vaultSave,
   "vault save-from-message": vaultSaveFromMessage,
   connect,
@@ -87622,8 +88249,8 @@ async function runCli({
 // src/services/processes.service.ts
 import { execFile as execFile2, spawn as spawn4 } from "node:child_process";
 import { mkdirSync, openSync } from "node:fs";
-import { readFile as readFile38, readlink } from "node:fs/promises";
-import { dirname as dirname22 } from "node:path";
+import { readFile as readFile39, readlink } from "node:fs/promises";
+import { dirname as dirname23 } from "node:path";
 import { promisify as promisify2 } from "node:util";
 var run3 = promisify2(execFile2);
 function alive(pid) {
@@ -87636,15 +88263,15 @@ function alive(pid) {
   }
 }
 async function argsOf(pid) {
-  const raw = await readFile38(`/proc/${pid}/cmdline`, "utf8").catch(() => void 0);
+  const raw = await readFile39(`/proc/${pid}/cmdline`, "utf8").catch(() => void 0);
   if (raw) return raw.split("\0").filter(Boolean);
   const listed = await run3("ps", ["-o", "args=", "-p", String(pid)]).catch(() => void 0);
   const line = listed?.stdout.trim();
   return line ? line.split(/\s+/) : void 0;
 }
 async function parentOf(pid) {
-  const stat5 = await readFile38(`/proc/${pid}/stat`, "utf8").catch(() => void 0);
-  const fromStat = stat5 ? Number(stat5.slice(stat5.lastIndexOf(")") + 2).split(" ")[1]) : NaN;
+  const stat6 = await readFile39(`/proc/${pid}/stat`, "utf8").catch(() => void 0);
+  const fromStat = stat6 ? Number(stat6.slice(stat6.lastIndexOf(")") + 2).split(" ")[1]) : NaN;
   if (fromStat > 0) return fromStat;
   const listed = await run3("ps", ["-o", "ppid=", "-p", String(pid)]).catch(() => void 0);
   const parent = Number(listed?.stdout.trim());
@@ -87660,7 +88287,7 @@ async function cwdOf(pid) {
   return line ? line.slice(1) : void 0;
 }
 function spawnDetached({ argv, logPath }) {
-  mkdirSync(dirname22(logPath), { recursive: true, mode: 448 });
+  mkdirSync(dirname23(logPath), { recursive: true, mode: 448 });
   const log = openSync(logPath, "a", 384);
   const [program = "", ...rest] = argv;
   const child = spawn4(program, rest, { detached: true, stdio: ["ignore", log, log] });
@@ -87754,15 +88381,15 @@ function terminalAsk() {
   };
 }
 function sleep(ms, signal) {
-  return new Promise((resolve17) => {
-    if (signal?.aborted) return resolve17();
+  return new Promise((resolve19) => {
+    if (signal?.aborted) return resolve19();
     const stop3 = () => {
       clearTimeout(timer);
-      resolve17();
+      resolve19();
     };
     const timer = setTimeout(() => {
       signal?.removeEventListener("abort", stop3);
-      resolve17();
+      resolve19();
     }, ms);
     signal?.addEventListener("abort", stop3, { once: true });
   });
@@ -87786,6 +88413,7 @@ if (true) {
       out: (text2) => void process.stdout.write(text2),
       err: (text2) => void process.stderr.write(text2),
       readStdin,
+      stdoutIsTerminal: process.stdout.isTTY === true,
       ...ask ? { ask } : {},
       sleep,
       nowMs: () => nowInstant().epochMilliseconds,