@mifune/agro 0.20.0-rc.2 → 0.21.0

package/README.md

@@ -4,7 +4,7 @@ The **AGRO CLI** (`agro`) — create an [AGRO](https://github.com/mifunedev/agro
 Docker sandbox for coding agents and drive its lifecycle from the command line.
 
 AGRO is a portable harness for running coding agents (Claude Code, Codex, Pi,
-and others) in an isolated Docker sandbox, with the agent's identity, skills, and crons
+and others) in an isolated Docker sandbox, with the agent's identity and skills
 versioned in git. This package is the standalone `agro` CLI that creates sandboxes and
 manages their lifecycle.
 
@@ -54,7 +54,7 @@ To bind one of your own checkouts into the sandbox, equip it and pass `--checkou
 
 ```bash
 cd your-project
-agro vendor                                       # vendor .agro/ + crons/ — and nothing else (compatibility window)
+agro vendor                                       # vendor .agro/ — and nothing else (compatibility window)
 agro sandbox install docker --checkout "$PWD" --name your-project
 ```
 
@@ -133,7 +133,7 @@ conflicting `AGRO_SANDBOX_IMAGE` values in the host shell or entry `.env` before
 
 `agro update` upgrades only the installed CLI. It does not recreate the sandbox
 or change its image. During the compatibility window `agro vendor` vendors
-`.agro/` + `crons/` into the current directory, equipping an empty checkout and upgrading an
+`.agro/` into the current directory, equipping an empty checkout and upgrading an
 equipped one (`--from <dir>` / `--from-remote [--ref <ref>]`, `--dry-run`, `--force`); it
 writes nothing else and never prompts. `agro update` rejects those flags and points at
 `agro vendor`. `agro vendor` prefers the payload bundled into the CLI itself; with `--from-remote`

package/dist/agro.js

@@ -908,6 +908,7 @@ var RESERVED_HOME_PATHS = [
   "/usr",
   "/var"
 ];
+var EGRESS_MODES = ["open", "allowlist"];
 var SANDBOX_RUNTIMES = PROVISIONABLE_RUNTIMES;
 function configCheckout(config) {
   const value = config.checkout ?? config.repo;
@@ -927,11 +928,11 @@ function defaultAgroConfig(name) {
       ssh: false,
       sshPort: 2222,
       sshPasswordAuth: false,
-      dockerSocket: false
+      dockerSocket: false,
+      egress: "open",
+      egressAllow: []
     },
     hermesDashboard: { enabled: false, port: 9119 },
-    cron: { agentBin: "claude" },
-    build: { skipPnpmInstall: false },
     image: { mode: "build", pullPolicy: "missing" },
     langfuse: {},
     composeOverrides: []
@@ -1019,16 +1020,14 @@ function validateAgroConfig(value) {
     expectBoolean(access, "sshPasswordAuth", "access.");
     expectString(access, "sshAuthorizedKeys", "access.");
     expectBoolean(access, "dockerSocket", "access.");
+    expectEnum(access, "egress", "access.", EGRESS_MODES);
+    expectStringArray(access, "egressAllow", "access.");
   }
   const dashboard = expectSection(record, "hermesDashboard");
   if (dashboard) {
     expectBoolean(dashboard, "enabled", "hermesDashboard.");
     expectPort(dashboard, "port", "hermesDashboard.");
   }
-  const cron = expectSection(record, "cron");
-  if (cron) expectString(cron, "agentBin", "cron.");
-  const build = expectSection(record, "build");
-  if (build) expectBoolean(build, "skipPnpmInstall", "build.");
   const image = expectSection(record, "image");
   if (image) {
     expectString(image, "ref", "image.");
@@ -1086,6 +1085,16 @@ function expectPort(record, key, prefix = "") {
     throw fieldError(`${prefix}${key}`, "must be an integer between 1 and 65535");
   }
 }
+function expectStringArray(record, key, prefix = "") {
+  const value = record[key];
+  if (value === void 0) return;
+  if (!Array.isArray(value)) throw fieldError(`${prefix}${key}`, "must be an array of strings");
+  for (const entry of value) {
+    if (typeof entry !== "string") {
+      throw fieldError(`${prefix}${key}`, "must be an array of strings");
+    }
+  }
+}
 function expectEnum(record, key, prefix, allowed) {
   const value = record[key];
   if (value === void 0) return;
@@ -1106,10 +1115,10 @@ var AGRO_CONFIG_FIELDS = [
   { path: "access.sshPasswordAuth", type: "boolean" },
   { path: "access.sshAuthorizedKeys", type: "string" },
   { path: "access.dockerSocket", type: "boolean" },
+  { path: "access.egress", type: "enum", values: EGRESS_MODES },
+  { path: "access.egressAllow", type: "list" },
   { path: "hermesDashboard.enabled", type: "boolean" },
   { path: "hermesDashboard.port", type: "port" },
-  { path: "cron.agentBin", type: "string" },
-  { path: "build.skipPnpmInstall", type: "boolean" },
   { path: "image.ref", type: "string" },
   { path: "image.mode", type: "enum", values: ["build", "image"] },
   { path: "image.pullPolicy", type: "enum", values: ["missing", "always", "never"] },
@@ -1462,10 +1471,10 @@ import { existsSync as existsSync6, mkdirSync as mkdirSync3, readdirSync as read
 import { dirname as dirname4, join as join4, resolve as resolve5, sep as sep2 } from "node:path";
 
 // agro-asset:/home/runner/work/agro/agro/.devcontainer/docker-compose.yml
-var docker_compose_default = 'name: ${SANDBOX_NAME:-agro}\n\nservices:\n  sandbox:\n    image: ${AGRO_SANDBOX_IMAGE:-sandbox-${SANDBOX_NAME:-agro}}\n    pull_policy: ${AGRO_PULL_POLICY:-missing}\n    container_name: ${SANDBOX_NAME:-agro}\n    build:\n      context: ${AGRO_REPO_DIR:-..}\n      dockerfile: .devcontainer/Dockerfile\n    volumes:\n      - ${AGRO_HOME_MOUNT:-workspace}:/home/sandbox\n      - ${AGRO_REPO_DIR:-..}:/home/sandbox/harness\n    extra_hosts:\n      - "host.docker.internal:host-gateway"\n    environment:\n      - SANDBOX_NAME=${SANDBOX_NAME:-agro}\n      - SANDBOX_PASSWORD=${SANDBOX_PASSWORD:-test1234}\n      - TZ=${TZ:-America/Los_Angeles}\n      - CLAUDE_DANGEROUSLY_SKIP_PERMISSIONS=true\n      - CC_SAFETY_NET_STRICT=1\n      - CC_SAFETY_NET_WORKTREE=1\n      - GIT_USER_NAME=${GIT_USER_NAME:-}\n      - GIT_USER_EMAIL=${GIT_USER_EMAIL:-}\n      - GH_TOKEN=${GH_TOKEN:-}\n      - TYPESAFE_API_KEY=${TYPESAFE_API_KEY:-}\n    stdin_open: true\n    tty: true\n    cgroup: private\n    cap_add:\n      - SYS_ADMIN\n    security_opt:\n      - apparmor=unconfined\n    tmpfs:\n      - /run\n      - /run/lock\n      - /sys/fs\n    healthcheck:\n      test: ["CMD", "bash", "-c", "exec bash /home/sandbox/harness/.agro/scripts/sandbox-healthcheck.sh"]\n      interval: 30s\n      timeout: 10s\n      retries: 3\n      start_period: 600s\n    restart: unless-stopped\n\nvolumes:\n  workspace:\n';
+var docker_compose_default = 'name: ${SANDBOX_NAME:-agro}\n\nservices:\n  sandbox:\n    image: ${AGRO_SANDBOX_IMAGE:-sandbox-${SANDBOX_NAME:-agro}}\n    pull_policy: ${AGRO_PULL_POLICY:-missing}\n    container_name: ${SANDBOX_NAME:-agro}\n    build:\n      context: ${AGRO_REPO_DIR:-..}\n      dockerfile: .devcontainer/Dockerfile\n    volumes:\n      - ${AGRO_HOME_MOUNT:-workspace}:/home/sandbox\n      - ${AGRO_REPO_DIR:-..}:/home/sandbox/harness\n    extra_hosts:\n      - "host.docker.internal:host-gateway"\n    environment:\n      - SANDBOX_NAME=${SANDBOX_NAME:-agro}\n      - SANDBOX_PASSWORD=${SANDBOX_PASSWORD:-}\n      - TZ=${TZ:-America/Los_Angeles}\n      - CLAUDE_DANGEROUSLY_SKIP_PERMISSIONS=true\n      - CC_SAFETY_NET_STRICT=1\n      - CC_SAFETY_NET_WORKTREE=1\n      - GIT_USER_NAME=${GIT_USER_NAME:-}\n      - GIT_USER_EMAIL=${GIT_USER_EMAIL:-}\n      - GH_TOKEN=${GH_TOKEN:-}\n      - TYPESAFE_API_KEY=${TYPESAFE_API_KEY:-}\n    stdin_open: true\n    tty: true\n    init: true\n    entrypoint: ["/usr/local/bin/sandbox-main.sh"]\n    stop_signal: SIGTERM\n    healthcheck:\n      test: ["CMD", "bash", "-c", "exec bash /home/sandbox/harness/.agro/scripts/sandbox-healthcheck.sh"]\n      interval: 30s\n      timeout: 10s\n      retries: 3\n      start_period: 600s\n    restart: unless-stopped\n\nvolumes:\n  workspace:\n';
 
 // agro-asset:/home/runner/work/agro/agro/.devcontainer/docker-compose.image-only.yml
-var docker_compose_image_only_default = 'name: ${SANDBOX_NAME:-agro}\n\nservices:\n  sandbox:\n    image: ${AGRO_SANDBOX_IMAGE:-ghcr.io/mifunedev/agro:latest}\n    pull_policy: ${AGRO_PULL_POLICY:-always}\n    container_name: ${SANDBOX_NAME:-agro}\n    volumes:\n      - ${AGRO_HOME_MOUNT:-workspace}:/home/sandbox\n    extra_hosts:\n      - "host.docker.internal:host-gateway"\n    environment:\n      - SANDBOX_NAME=${SANDBOX_NAME:-agro}\n      - SANDBOX_PASSWORD=${SANDBOX_PASSWORD:-test1234}\n      - TZ=${TZ:-America/Los_Angeles}\n      - CLAUDE_DANGEROUSLY_SKIP_PERMISSIONS=true\n      - CC_SAFETY_NET_STRICT=1\n      - CC_SAFETY_NET_WORKTREE=1\n      - GIT_USER_NAME=${GIT_USER_NAME:-}\n      - GIT_USER_EMAIL=${GIT_USER_EMAIL:-}\n      - GH_TOKEN=${GH_TOKEN:-}\n      - TYPESAFE_API_KEY=${TYPESAFE_API_KEY:-}\n    stdin_open: true\n    tty: true\n    cgroup: private\n    cap_add:\n      - SYS_ADMIN\n    security_opt:\n      - apparmor=unconfined\n    tmpfs:\n      - /run\n      - /run/lock\n      - /sys/fs\n    healthcheck:\n      test: ["CMD", "bash", "-c", "exec bash /home/sandbox/harness/.agro/scripts/sandbox-healthcheck.sh"]\n      interval: 30s\n      timeout: 10s\n      retries: 3\n      start_period: 600s\n    restart: unless-stopped\n\nvolumes:\n  workspace:\n';
+var docker_compose_image_only_default = 'name: ${SANDBOX_NAME:-agro}\n\nservices:\n  sandbox:\n    image: ${AGRO_SANDBOX_IMAGE:-ghcr.io/mifunedev/agro:latest}\n    pull_policy: ${AGRO_PULL_POLICY:-always}\n    container_name: ${SANDBOX_NAME:-agro}\n    volumes:\n      - ${AGRO_HOME_MOUNT:-workspace}:/home/sandbox\n    extra_hosts:\n      - "host.docker.internal:host-gateway"\n    environment:\n      - SANDBOX_NAME=${SANDBOX_NAME:-agro}\n      - SANDBOX_PASSWORD=${SANDBOX_PASSWORD:-}\n      - TZ=${TZ:-America/Los_Angeles}\n      - CLAUDE_DANGEROUSLY_SKIP_PERMISSIONS=true\n      - CC_SAFETY_NET_STRICT=1\n      - CC_SAFETY_NET_WORKTREE=1\n      - GIT_USER_NAME=${GIT_USER_NAME:-}\n      - GIT_USER_EMAIL=${GIT_USER_EMAIL:-}\n      - GH_TOKEN=${GH_TOKEN:-}\n      - TYPESAFE_API_KEY=${TYPESAFE_API_KEY:-}\n    stdin_open: true\n    tty: true\n    init: true\n    entrypoint: ["/usr/local/bin/sandbox-main.sh"]\n    stop_signal: SIGTERM\n    healthcheck:\n      test: ["CMD", "bash", "-c", "exec bash /home/sandbox/harness/.agro/scripts/sandbox-healthcheck.sh"]\n      interval: 30s\n      timeout: 10s\n      retries: 3\n      start_period: 600s\n    restart: unless-stopped\n\nvolumes:\n  workspace:\n';
 
 // agro-asset:/home/runner/work/agro/agro/.devcontainer/docker-compose.ssh.yml
 var docker_compose_ssh_default = 'services:\n  sandbox:\n    ports:\n      - "127.0.0.1:${SANDBOX_SSH_PORT:-2222}:22"\n';
@@ -1473,6 +1482,9 @@ var docker_compose_ssh_default = 'services:\n  sandbox:\n    ports:\n      - "12
 // agro-asset:/home/runner/work/agro/agro/.devcontainer/docker-compose.docker-sock.yml
 var docker_compose_docker_sock_default = "services:\n  sandbox:\n    volumes:\n      - /var/run/docker.sock:/var/run/docker.sock\n";
 
+// agro-asset:/home/runner/work/agro/agro/.devcontainer/docker-compose.egress.yml
+var docker_compose_egress_default = 'services:\n  sandbox:\n    networks:\n      - egress-internal\n    depends_on:\n      - proxy\n    environment:\n      - HTTPS_PROXY=http://proxy:3128\n      - HTTP_PROXY=http://proxy:3128\n      - https_proxy=http://proxy:3128\n      - http_proxy=http://proxy:3128\n      - NO_PROXY=localhost,127.0.0.1\n      - no_proxy=localhost,127.0.0.1\n      - NODE_USE_ENV_PROXY=1\n\n  proxy:\n    image: ubuntu/squid@sha256:6a097f68bae708cedbabd6188d68c7e2e7a38cedd05a176e1cc0ba29e3bbe029\n    networks:\n      - egress-internal\n      - egress-out\n    configs:\n      - source: egress-squid\n        target: /etc/squid/squid.conf\n    volumes:\n      - type: bind\n        source: ../egress-allow.txt\n        target: /etc/squid/egress-allow.txt\n        read_only: true\n    restart: unless-stopped\n\nconfigs:\n  egress-squid:\n    content: |\n      http_port 3128\n      acl SSL_ports port 443\n      acl Safe_ports port 80\n      acl Safe_ports port 443\n      acl CONNECT method CONNECT\n      acl egress_allow dstdomain "/etc/squid/egress-allow.txt"\n      http_access deny !Safe_ports\n      http_access deny CONNECT !SSL_ports\n      http_access allow egress_allow\n      http_access deny all\n\nnetworks:\n  egress-internal:\n    internal: true\n  egress-out: {}\n';
+
 // agro-asset:/home/runner/work/agro/agro/.agro/scripts/docker-compose.sh
 var docker_compose_default2 = `#!/usr/bin/env bash
 
@@ -1612,6 +1624,11 @@ fi
 
 args+=(-f "$(compose_path ".devcontainer/docker-compose.yml")")
 
+egress_value=\${AGRO_EGRESS:-$(read_env_value AGRO_EGRESS)}
+if [ "$(printf '%s' "$egress_value" | tr '[:upper:]' '[:lower:]')" = "allowlist" ]; then
+  args+=(-f "$(compose_path ".devcontainer/docker-compose.egress.yml")")
+fi
+
 docker_socket_value=\${DOCKER_SOCKET:-$(read_env_value DOCKER_SOCKET)}
 if truthy "$docker_socket_value"; then
   args+=(-f "$(compose_path ".devcontainer/docker-compose.docker-sock.yml")")
@@ -1803,7 +1820,7 @@ exit 0
 `;
 
 // agro-asset:/home/runner/work/agro/agro/.devcontainer/openshell-policy.yaml
-var openshell_policy_default = "version: 1\n\nfilesystem_policy:\n  include_workdir: true\n  read_only:\n    - /bin\n    - /usr\n    - /lib\n    - /etc\n    - /opt\n    - /proc\n    - /var/log\n    - /dev/urandom\n  read_write:\n    - /home/sandbox\n    - /tmp\n    - /dev/null\n\nprocess:\n  run_as_user: sandbox\n  run_as_group: sandbox\n\nnetwork_policies:\n  github:\n    endpoints:\n      - host: github.com\n        port: 443\n        protocol: rest\n        enforcement: enforce\n        access: read-write\n      - host: api.github.com\n        port: 443\n        protocol: rest\n        enforcement: enforce\n        access: read-write\n      - host: release-assets.githubusercontent.com\n        port: 443\n        protocol: rest\n        enforcement: enforce\n        access: read-only\n    binaries:\n      - path: /usr/bin/git\n      - path: /usr/bin/gh\n      - path: /usr/bin/curl\n  npm:\n    endpoints:\n      - host: registry.npmjs.org\n        port: 443\n        protocol: rest\n        enforcement: enforce\n        access: read-only\n        allow_encoded_slash: true\n    binaries:\n      - path: /usr/local/bin/node\n  anthropic:\n    endpoints:\n      - host: api.anthropic.com\n        port: 443\n        protocol: rest\n        enforcement: enforce\n        access: read-write\n    binaries:\n      - path: /home/sandbox/.local/lib/node_modules/@anthropic-ai/claude-code/bin/*\n";
+var openshell_policy_default = "version: 1\n\nfilesystem_policy:\n  include_workdir: true\n  read_only:\n    - /bin\n    - /usr\n    - /lib\n    - /etc\n    - /opt\n    - /proc\n    - /var/log\n    - /dev/urandom\n  read_write:\n    - /home/sandbox\n    - /tmp\n    - /dev/null\n\nprocess:\n  run_as_user: sandbox\n  run_as_group: sandbox\n\nnetwork_policies:\n  github:\n    endpoints:\n      - host: github.com\n        port: 443\n        protocol: rest\n        enforcement: enforce\n        access: read-write\n      - host: api.github.com\n        port: 443\n        protocol: rest\n        enforcement: enforce\n        access: read-write\n      - host: release-assets.githubusercontent.com\n        port: 443\n        protocol: rest\n        enforcement: enforce\n        access: read-only\n    binaries:\n      - path: /usr/bin/git\n      - path: /usr/bin/gh\n      - path: /usr/bin/curl\n  npm:\n    endpoints:\n      - host: registry.npmjs.org\n        port: 443\n        protocol: rest\n        enforcement: enforce\n        access: read-only\n        allow_encoded_slash: true\n    binaries:\n      - path: /usr/local/bin/node\n  anthropic:\n    endpoints:\n      - host: api.anthropic.com\n        port: 443\n        protocol: rest\n        enforcement: enforce\n        access: read-write\n      - host: platform.claude.com\n        port: 443\n        protocol: rest\n        enforcement: enforce\n        access: read-write\n    binaries:\n      - path: /home/sandbox/.local/lib/node_modules/@anthropic-ai/claude-code/bin/*\n";
 
 // src/lib/registry.ts
 var SANDBOX_NAME_PATTERN = /^[a-z0-9][a-z0-9-]*$/;
@@ -1864,9 +1881,29 @@ function nextDefaultName(run = spawnRunner) {
 function openshellFiles(entry) {
   return [{ dest: join4(entry, "openshell-policy.yaml"), body: openshell_policy_default, mode: 420 }];
 }
-function dockerFiles(entry, opts) {
+function policyHosts(policyText) {
+  const marker = "network_policies:";
+  const start = policyText.indexOf(marker);
+  const section = start === -1 ? "" : policyText.slice(start);
+  const hosts = /* @__PURE__ */ new Set();
+  for (const match of section.matchAll(/^\s*-\s*host:\s*(\S+)/gm)) hosts.add(match[1]);
+  return [...hosts];
+}
+function egressAllowHosts(config) {
+  const hosts = new Set(policyHosts(openshell_policy_default));
+  for (const host of config.access?.egressAllow ?? []) hosts.add(host);
+  return [...hosts].sort();
+}
+function safeReadAgroConfig(entry) {
+  try {
+    return readAgroConfig(agroConfigPath(entry));
+  } catch {
+    return { version: 1 };
+  }
+}
+function dockerFiles(entry, opts, config) {
   const scripts = join4(resolveProjectLayout(entry).controlDir, "scripts");
-  return [
+  const files = [
     {
       dest: join4(entry, ".devcontainer", "docker-compose.yml"),
       body: (opts.checkout ?? opts.repo) === void 0 ? docker_compose_image_only_default : docker_compose_default,
@@ -1874,14 +1911,25 @@ function dockerFiles(entry, opts) {
     },
     { dest: join4(entry, ".devcontainer", "docker-compose.ssh.yml"), body: docker_compose_ssh_default, mode: 420 },
     { dest: join4(entry, ".devcontainer", "docker-compose.docker-sock.yml"), body: docker_compose_docker_sock_default, mode: 420 },
+    { dest: join4(entry, ".devcontainer", "docker-compose.egress.yml"), body: docker_compose_egress_default, mode: 420 },
     { dest: join4(scripts, "docker-compose.sh"), body: docker_compose_default2, mode: 493 },
     { dest: join4(scripts, "paths.sh"), body: paths_default, mode: 420 },
     { dest: join4(scripts, "check-host-port.sh"), body: check_host_port_default, mode: 493 }
   ];
+  if ((config.access?.egress ?? "open") === "allowlist") {
+    files.push({
+      dest: join4(entry, "egress-allow.txt"),
+      body: `${egressAllowHosts(config).join("\n")}
+`,
+      mode: 420
+    });
+  }
+  return files;
 }
 function materialize(root, opts = {}) {
   const entry = resolve5(root);
-  const files = entryRuntime(entry) === "openshell" ? openshellFiles(entry) : dockerFiles(entry, opts);
+  const config = safeReadAgroConfig(entry);
+  const files = entryRuntime(entry) === "openshell" ? openshellFiles(entry) : dockerFiles(entry, opts, config);
   for (const file of files) {
     const dest = resolve5(file.dest);
     if (!dest.startsWith(entry + sep2)) {
@@ -1921,6 +1969,7 @@ function resolveSandboxRoot(opts = {}) {
 }
 
 // src/lib/secrets.ts
+import { randomBytes } from "node:crypto";
 import { existsSync as existsSync8, readFileSync as readFileSync6 } from "node:fs";
 import { resolve as resolve6 } from "node:path";
 
@@ -2020,6 +2069,10 @@ function setSecret(root, key, value) {
   const { content } = setKeyInEnv(original, key, value);
   writeEnvFile(file, content);
 }
+function ensureSandboxPassword(root) {
+  if (readSecret(root, "SANDBOX_PASSWORD") !== void 0) return;
+  setSecret(root, "SANDBOX_PASSWORD", randomBytes(24).toString("base64url"));
+}
 function listSecretKeys(root) {
   const file = secretsFilePath(root);
   if (!existsSync8(file)) return [];
@@ -2046,7 +2099,7 @@ import { basename as basename6, join as join6, sep as sep3 } from "node:path";
 import { basename as basename4, resolve as resolve7 } from "node:path";
 
 // src/lib/version.ts
-var AGRO_VERSION = true ? "0.20.0-rc.2" : "0.0.0-dev";
+var AGRO_VERSION = true ? "0.21.0" : "0.0.0-dev";
 var OFFICIAL_IMAGE = "ghcr.io/mifunedev/agro";
 var RELEASE_VERSION = /^[0-9]+\.[0-9]+\.[0-9]+(?:-[a-z][a-z0-9]*\.[0-9]+)?$/;
 function parseReleaseVersion(value) {
@@ -2621,6 +2674,7 @@ function renderComposeVars(config) {
   put("GIT_USER_NAME", config.git?.userName);
   put("GIT_USER_EMAIL", config.git?.userEmail);
   put("DOCKER_SOCKET", config.access?.dockerSocket);
+  put("AGRO_EGRESS", config.access?.egress);
   put("SANDBOX_SSH", config.access?.ssh);
   put("SANDBOX_SSH_PORT", config.access?.sshPort);
   put("AGRO_SANDBOX_IMAGE", sandboxImageRef(config));
@@ -2848,6 +2902,7 @@ async function runSandbox(opts, io) {
   }
   await maybePromptDockerSocket(root, io, opts.bin);
   requireLifecycleScript(root, "docker-compose.sh");
+  ensureSandboxPassword(root);
   if (imageRef !== void 0) {
     io.stdout(`image mode: ${imageRef} (skipping local build)
 `);
@@ -3388,7 +3443,26 @@ ${secretKeyList()}
 `);
     return 1;
   }
-  io.stdout(`.env: set ${key}=${redact(value)}
+  io.stdout(`.env: set ${key}
+`);
+  return 0;
+}
+async function runSecretGet(key, opts, io) {
+  const root = secretsRoot(opts);
+  let value;
+  try {
+    value = readSecret(root, key);
+  } catch (error) {
+    io.stderr(`${error instanceof Error ? error.message : String(error)}
+`);
+    return 1;
+  }
+  if (value === void 0) {
+    io.stderr(`${opts.bin} secret get: ${key} has no value
+`);
+    return 1;
+  }
+  io.stdout(`${value}
 `);
   return 0;
 }
@@ -3403,7 +3477,7 @@ async function runSecretList(opts, io) {
   const width = Math.max(...keys.map((key) => key.length));
   for (const key of keys) {
     const value = readSecret(root, key);
-    io.stdout(`${key.padEnd(width)}  ${value === void 0 ? "\u2014" : redact(value)}
+    io.stdout(`${key.padEnd(width)}  ${value === void 0 ? "\u2014" : "set"}
 `);
   }
   return 0;
@@ -3751,7 +3825,7 @@ function quoteFragmentValue(key, value) {
   if (value === "") throw new Error(`${key} must not be empty`);
   if (UNCARRIABLE_IN_VALUE.test(value)) {
     throw new Error(
-      `${key} must not contain a newline, a control character, or a single quote \u2014 zsh and systemd read the same fragment and neither carries that value safely`
+      `${key} must not contain a newline, a control character, or a single quote \u2014 zsh reads the fragment and does not carry that value safely`
     );
   }
   return BARE_SAFE_VALUE.test(value) ? value : `'${value}'`;
@@ -4968,6 +5042,59 @@ async function runSandboxCommand(rest, bin) {
   );
 }
 
+// src/commands/egress.ts
+import { basename as basename7 } from "node:path";
+var EGRESS_LOG_PATH = "/var/log/squid/access.log";
+var EGRESS_LOG_LINES = 1e3;
+var PROXY_EXEC = ["exec", "-T", "proxy"];
+var EGRESS_COMMANDS = Object.freeze({
+  log: Object.freeze([...PROXY_EXEC, "tail", "-n", String(EGRESS_LOG_LINES), EGRESS_LOG_PATH]),
+  reload: Object.freeze([...PROXY_EXEC, "squid", "-k", "reconfigure"])
+});
+var RUNTIME_REFUSAL = Object.freeze({
+  docker: void 0,
+  openshell: (name) => `the sandbox ${name} uses runtime openshell; access.egress allowlist applies to the docker runtime`
+});
+function markDenied(text) {
+  return text.split("\n").map((line) => line.includes("TCP_DENIED") ? `DENIED ${line}` : line).join("\n");
+}
+function refusal(root, name) {
+  const runtimeRefusal = RUNTIME_REFUSAL[entryRuntime(root)];
+  if (runtimeRefusal !== void 0) return runtimeRefusal(name);
+  const egress = readAgroConfig(agroConfigPath(root)).access?.egress ?? "open";
+  if (egress !== "allowlist") return `the sandbox ${name} uses access.egress ${egress}; set access.egress allowlist`;
+  return void 0;
+}
+function rematerialize(root) {
+  const repo = readAgroConfig(agroConfigPath(root)).repo;
+  materialize(root, repo === void 0 || repo === "" ? {} : { repo });
+}
+function runEgress(verb, opts, io) {
+  const run = opts.run ?? spawnRunner;
+  const root = resolveSandboxRoot({ name: opts.name, cwd: opts.cwd });
+  const name = basename7(root);
+  const refused = refusal(root, name);
+  if (refused !== void 0) {
+    io.stderr(`${opts.bin} egress ${verb}: ${refused}
+`);
+    return 1;
+  }
+  rematerialize(root);
+  const script = requireLifecycleScript(root, "docker-compose.sh");
+  const capture2 = verb === "log";
+  return withComposeEnvFile(root, (extraArgs) => {
+    const r = run("bash", [script, ...extraArgs, ...EGRESS_COMMANDS[verb]], {
+      stdio: capture2 ? "capture" : "inherit"
+    });
+    assertSpawned(r, `bash ${script} egress ${verb}`);
+    if (capture2) {
+      if (r.stdout) io.stdout(markDenied(r.stdout));
+      if (r.stderr) io.stderr(r.stderr);
+    }
+    return r.status ?? 1;
+  });
+}
+
 // src/commands/harness.ts
 import { existsSync as existsSync20 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
@@ -4985,7 +5112,7 @@ function sourceDocsUrl(docsPath) {
 
 // src/lib/host-config.ts
 import { existsSync as existsSync18, mkdirSync as mkdirSync9, readFileSync as readFileSync12, renameSync as renameSync4, unlinkSync as unlinkSync6, writeFileSync as writeFileSync9 } from "node:fs";
-import { basename as basename7, dirname as dirname8, isAbsolute, join as join15, resolve as resolve10 } from "node:path";
+import { basename as basename8, dirname as dirname8, isAbsolute, join as join15, resolve as resolve10 } from "node:path";
 var HOST_CONFIG_MODE = 420;
 var HOST_CONFIG_FILE = "config.json";
 var WORKSPACES_SUBDIR = "workspaces";
@@ -5091,7 +5218,7 @@ function readHostConfig(env, home) {
   try {
     parsed = JSON.parse(raw);
   } catch {
-    throw new Error(`${basename7(path4)} is not valid JSON: ${path4}`);
+    throw new Error(`${basename8(path4)} is not valid JSON: ${path4}`);
   }
   return validateHostConfig(parsed);
 }
@@ -5453,6 +5580,19 @@ async function validateHermesHome(target, io, bin, user, inheritedHome, root = s
   }
   return result.exitCode;
 }
+async function seedHermes(target, io, bin, user, root = sandboxTargetRoot(target)) {
+  const result = await target.exec({
+    argv: remoteControlDirScript(root, "scripts/hermes-workspace.sh", ["seed", root, `${root}/.hermes`]),
+    env: hermesEnv(root),
+    ...user ? { user } : {},
+    stdio: "inherit"
+  });
+  if (result.exitCode !== 0) {
+    io.stderr(`${bin} harness: could not write the Hermes defaults to ${root}/.hermes/config.yaml (exit ${result.exitCode}); nothing was installed.
+`);
+  }
+  return result.exitCode;
+}
 async function configureHermes(target, io, bin, user, root = sandboxTargetRoot(target)) {
   const result = await target.exec({
     argv: remoteControlDirScript(root, "scripts/hermes-workspace.sh", [
@@ -5655,6 +5795,10 @@ Run: bash ${root}/.agro/scripts/link-providers.sh --init
     if (openclaw) openclawLaunch(io, root);
     return 0;
   }
+  if (hermes) {
+    const code = await seedHermes(target, io, bin, void 0, root);
+    if (code !== 0) return code;
+  }
   io.stdout(`${present && hasReceipt ? "updating" : "installing"} ${entry.title} on the host\u2026
 `);
   const r = await target.exec({
@@ -5863,6 +6007,10 @@ async function runHarnessInstall(name, opts, io) {
     io.stderr("docker is required to install into the running sandbox but was not found on PATH\n");
     return 1;
   }
+  if (hermes) {
+    const code = await seedHermes(target, io, opts.bin, "sandbox");
+    if (code !== 0) return code;
+  }
   if (already && await sandboxMarkerExists(target, entry)) {
     io.stdout(`updating ${entry.title} in the sandbox\u2026
 `);
@@ -7101,12 +7249,13 @@ function fetchRemoteSource(opts) {
 // src/command-table.ts
 var CONFIG_VERBS = ["show", "set", "repo"];
 var CONFIG_INTEGRATIONS = ["langfuse"];
-var SECRET_VERBS = ["set", "list"];
+var SECRET_VERBS = ["set", "get", "list"];
 var LANGFUSE_VERBS = ["apply", "status", "disable"];
 var SANDBOX_SUBCOMMANDS = ["install", "list", "upgrade"];
 var WORKSPACE_SUBCOMMANDS = ["create", "list"];
 var HARNESS_SUBCOMMANDS = ["list", "install", "status", "uninstall"];
 var TOOL_SUBCOMMANDS = ["list", "install", "status", "uninstall"];
+var EGRESS_VERBS = ["log", "reload"];
 function isOneOf(values, value) {
   return value !== void 0 && values.includes(value);
 }
@@ -7124,6 +7273,7 @@ var AGRO_COMMANDS = Object.freeze({
   harness: HARNESS_SUBCOMMANDS,
   tool: TOOL_SUBCOMMANDS,
   gateway: null,
+  egress: EGRESS_VERBS,
   ...Object.fromEntries(composeVerbs().map((verb) => [verb, null]))
 });
 
@@ -7161,7 +7311,7 @@ Usage:
   ${bin} sandbox <args...>      Create, list, and upgrade sandboxes (install|list|upgrade)
   ${bin} shell [name]           Open a zsh shell in the running sandbox container
   ${bin} config <args...>       Read and write ${stateNames(bin).configFile} (show|set), or run a wizard
-  ${bin} secret <args...>       Read and write the gitignored root .env (set|list)
+  ${bin} secret <args...>       Read and write the gitignored root .env (set|get|list)
   ${bin} langfuse <args...>     Render, check, or disable Langfuse tracing files (apply|status|disable)
   ${bin} self-upgrade           Upgrade the installed ${bin} CLI
   ${bin} vendor                 Vendor or upgrade the ${stateNames(bin).controlDir}/ control plane
@@ -7171,6 +7321,7 @@ Usage:
   ${bin} ps [name]              Show sandbox service status
   ${bin} destroy [name]         Remove the sandbox and wipe its named volumes
   ${bin} compose config         Print the resolved docker compose configuration
+  ${bin} egress <args...>       Read the egress proxy log or reload its allowlist (log|reload)
   ${bin} workspace <args...>    Create and list host AGRO workspaces (create|list)
   ${bin} harness <args...>      Install and inspect agent CLI harnesses
   ${bin} tool <args...>         Install and inspect sandbox tooling
@@ -7214,14 +7365,16 @@ function printSecretHelp(bin = AGRO_PRODUCT.bin) {
 
 Usage:
   ${bin} secret set <KEY> [--sandbox <name>]   Prompt for the value (input hidden)
+  ${bin} secret get <KEY> [--sandbox <name>]   Print the raw value
   ${bin} secret list [--sandbox <name>]        List the keys that hold a value
 
-Without --sandbox both verbs write the equipped project root; with it they write
-the registry entry \`${bin} sandbox list\` names.
+Without --sandbox all three verbs act on the equipped project root; with it they
+act on the registry entry \`${bin} sandbox list\` names.
 
 The value is never read from the command line \u2014 an argument would land in your
-shell history. \`${bin} secret list\` never prints a raw value. .env is mode 0600 and
-gitignored; every non-secret setting belongs in ${stateNames(bin).configFile} (\`${bin} config set\`).
+shell history. \`${bin} secret get\` is the only command that prints a raw value;
+\`${bin} secret list\` never does. .env is mode 0600 and gitignored; every non-secret
+setting belongs in ${stateNames(bin).configFile} (\`${bin} config set\`).
 
 Keys:
 ${secretKeyList()}
@@ -7236,7 +7389,7 @@ Usage:
   ${bin} langfuse disable   Set langfuse.enabled=false, delete the credential fragment, rewrite the files
 
 \`${bin} config langfuse\` is the interactive wizard that writes these settings.
-\`apply\` never prompts and never installs anything; bootstrap, systemd, and cron run it.
+\`apply\` never prompts and never installs anything; the bootstrap runs it.
 It reads langfuse.* from ${stateNames(bin).configFile} and the keys from the gitignored .env,
 and writes nothing when langfuse.enabled is not true. The generated files live in the
 sandbox home, so \`apply\` and \`disable\` refuse to touch them from the host.
@@ -7279,7 +7432,7 @@ Flags:
   --dry-run       Report the installation kind, target, and versions without
                   changing anything.
 
-Project payload vendoring (${stateNames(bin).controlDir}/ + crons/) is \`${bin} vendor\`; its --from,
+Project payload vendoring (${stateNames(bin).controlDir}/) is \`${bin} vendor\`; its --from,
 --from-remote, --ref and --force flags are not accepted here.
 `);
 }
@@ -7289,7 +7442,7 @@ function printVendorHelp(bin = AGRO_PRODUCT.bin) {
 Usage:
   ${bin} vendor [--from <dir> | --from-remote [--ref <ref>]] [--dry-run] [--force]
 
-Writes ONLY the ${stateNames(bin).controlDir}/ control plane and crons/ (skills, scripts, CLI) into the
+Writes ONLY the ${stateNames(bin).controlDir}/ control plane (skills, scripts, CLI) into the
 current directory. An empty directory is equipped from scratch; everything else
 in your project is left untouched \u2014 it writes no ${stateNames(bin).configFile}, .env, AGENTS.md,
 .gitignore or .devcontainer/.
@@ -7488,6 +7641,38 @@ Flags:
 See ${sourceDocsUrl("docs/lifecycle-commands.md")} for the full mapping.
 `);
 }
+function printEgressHelp(bin = AGRO_PRODUCT.bin) {
+  process.stdout.write(`${bin} egress \u2014 Read the egress proxy log or reload its allowlist
+
+Usage:
+  ${bin} egress log [name]      Print the last ${EGRESS_LOG_LINES} lines of the proxy access log; prefix denied lines with DENIED
+  ${bin} egress reload [name]   Rewrite egress-allow.txt and send the proxy \`squid -k reconfigure\`
+
+Both verbs run ${stateNames(bin).controlDir}/scripts/docker-compose.sh \`exec proxy\` in the sandbox entry.
+The log is ${EGRESS_LOG_PATH} in the proxy container. \`reload\` keeps the sandbox running.
+Both verbs need a docker sandbox with access.egress allowlist; any other sandbox exits 1.
+[name] is a sandbox entry from \`${bin} sandbox list\`; with exactly one registered sandbox it can be omitted.
+
+See ${sourceDocsUrl("docs/lifecycle-commands.md")} for every verb.
+`);
+}
+function parseEgressArgs(rest, bin = AGRO_PRODUCT.bin) {
+  if (rest.length === 0 || isHelpFlag2(rest[0])) return { ok: true, args: { help: true } };
+  const [head, ...tail] = rest;
+  if (!isOneOf(EGRESS_VERBS, head)) {
+    return {
+      ok: false,
+      error: `${bin} egress: unknown subcommand "${head}" \u2014 expected ${EGRESS_VERBS.join(" or ")}`,
+      showHelp: true
+    };
+  }
+  if (isHelpFlag2(tail[0])) return { ok: true, args: { help: true } };
+  if (tail.length > 0 && tail[0].startsWith("-")) {
+    return { ok: false, error: `${bin} egress ${head}: unknown flag "${tail[0]}"` };
+  }
+  if (tail.length > 1) return { ok: false, error: `${bin} egress ${head}: unexpected argument "${tail[1]}"` };
+  return { ok: true, args: tail.length === 0 ? { help: false, verb: head } : { help: false, verb: head, name: tail[0] } };
+}
 function printComposeHelp(bin = AGRO_PRODUCT.bin) {
   process.stdout.write(`${bin} compose \u2014 Inspect the resolved docker compose setup
 
@@ -7603,7 +7788,7 @@ function parseSecretArgs(input, bin = AGRO_PRODUCT.bin) {
   if (!SECRET_VERBS.includes(head)) {
     return {
       ok: false,
-      error: `${bin} secret: unknown subcommand "${head}" \u2014 expected set or list`,
+      error: `${bin} secret: unknown subcommand "${head}" \u2014 expected set, list, or get`,
       showHelp: true
     };
   }
@@ -7617,12 +7802,12 @@ function parseSecretArgs(input, bin = AGRO_PRODUCT.bin) {
   }
   const [key, ...extra] = tail;
   if (key === void 0) {
-    return { ok: false, error: `${bin} secret set: a key is required`, showHelp: true };
+    return { ok: false, error: `${bin} secret ${verb}: a key is required`, showHelp: true };
   }
   if (extra.length > 0) {
     return {
       ok: false,
-      error: `${bin} secret set: takes only a key \u2014 the value is prompted for, never passed on the command line where your shell history would keep it`
+      error: verb === "get" ? `${bin} secret get: takes only a key` : `${bin} secret set: takes only a key \u2014 the value is prompted for, never passed on the command line where your shell history would keep it`
     };
   }
   return { ok: true, args: { ...args, verb, key } };
@@ -8095,6 +8280,7 @@ async function main(argv) {
     };
     const scope = a.sandbox === void 0 ? { bin } : { bin, sandbox: a.sandbox };
     if (a.verb === "list") return await runSecretList(scope, io);
+    if (a.verb === "get") return await runSecretGet(a.key, scope, io);
     return await runSecretSet(a.key, scope, io);
   }
   if (first === "langfuse") {
@@ -8219,6 +8405,21 @@ async function main(argv) {
     }
     return runComposeConfig({ bin }, parsed.args.passthrough);
   }
+  if (first === "egress") {
+    const parsed = parseEgressArgs(argv.slice(1), bin);
+    if (!parsed.ok) {
+      process.stderr.write(`${parsed.error}
+`);
+      if (parsed.showHelp) printEgressHelp(bin);
+      return 1;
+    }
+    const a = parsed.args;
+    if (a.help || a.verb === void 0) {
+      printEgressHelp(bin);
+      return second === void 0 ? 1 : 0;
+    }
+    return runEgress(a.verb, a.name === void 0 ? { bin } : { bin, name: a.name }, lifecycleIo());
+  }
   if (first === "workspace") {
     const parsed = parseWorkspaceArgs(argv.slice(1), bin);
     if (!parsed.ok) {
@@ -8400,6 +8601,7 @@ export {
   parseComposeArgs,
   parseConfigArgs,
   parseDestroyArgs,
+  parseEgressArgs,
   parseGatewayArgs,
   parseHarnessArgs,
   parseLangfuseArgs,
@@ -8414,6 +8616,7 @@ export {
   printComposeHelp,
   printComposeVerbHelp,
   printDestroyHelp,
+  printEgressHelp,
   printGatewayHelp,
   printHarnessHelp,
   printLangfuseHelp,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mifune/agro",
-  "version": "0.20.0-rc.2",
+  "version": "0.21.0",
   "description": "AGRO CLI — create and manage sandboxes for coding agents.",
   "license": "Apache-2.0",
   "homepage": "https://github.com/mifunedev/agro#readme",