@mifune/agro 0.20.0 → 0.22.0

package/README.md

@@ -4,7 +4,7 @@ The **AGRO CLI** (`agro`) — create an [AGRO](https://github.com/mifunedev/agro
 Docker sandbox for coding agents and drive its lifecycle from the command line.
 
 AGRO is a portable harness for running coding agents (Claude Code, Codex, Pi,
-and others) in an isolated Docker sandbox, with the agent's identity, skills, and crons
+and others) in an isolated Docker sandbox, with the agent's identity and skills
 versioned in git. This package is the standalone `agro` CLI that creates sandboxes and
 manages their lifecycle.
 
@@ -54,7 +54,7 @@ To bind one of your own checkouts into the sandbox, equip it and pass `--checkou
 
 ```bash
 cd your-project
-agro vendor                                       # vendor .agro/ + crons/ — and nothing else (compatibility window)
+agro vendor                                       # vendor .agro/ — and nothing else (compatibility window)
 agro sandbox install docker --checkout "$PWD" --name your-project
 ```
 
@@ -133,7 +133,7 @@ conflicting `AGRO_SANDBOX_IMAGE` values in the host shell or entry `.env` before
 
 `agro update` upgrades only the installed CLI. It does not recreate the sandbox
 or change its image. During the compatibility window `agro vendor` vendors
-`.agro/` + `crons/` into the current directory, equipping an empty checkout and upgrading an
+`.agro/` into the current directory, equipping an empty checkout and upgrading an
 equipped one (`--from <dir>` / `--from-remote [--ref <ref>]`, `--dry-run`, `--force`); it
 writes nothing else and never prompts. `agro update` rejects those flags and points at
 `agro vendor`. `agro vendor` prefers the payload bundled into the CLI itself; with `--from-remote`

package/dist/agro.js

@@ -908,6 +908,7 @@ var RESERVED_HOME_PATHS = [
   "/usr",
   "/var"
 ];
+var EGRESS_MODES = ["open", "allowlist"];
 var SANDBOX_RUNTIMES = PROVISIONABLE_RUNTIMES;
 function configCheckout(config) {
   const value = config.checkout ?? config.repo;
@@ -927,11 +928,11 @@ function defaultAgroConfig(name) {
       ssh: false,
       sshPort: 2222,
       sshPasswordAuth: false,
-      dockerSocket: false
+      dockerSocket: false,
+      egress: "open",
+      egressAllow: []
     },
     hermesDashboard: { enabled: false, port: 9119 },
-    cron: { agentBin: "claude" },
-    build: { skipPnpmInstall: false },
     image: { mode: "build", pullPolicy: "missing" },
     langfuse: {},
     composeOverrides: []
@@ -1019,16 +1020,14 @@ function validateAgroConfig(value) {
     expectBoolean(access, "sshPasswordAuth", "access.");
     expectString(access, "sshAuthorizedKeys", "access.");
     expectBoolean(access, "dockerSocket", "access.");
+    expectEnum(access, "egress", "access.", EGRESS_MODES);
+    expectStringArray(access, "egressAllow", "access.");
   }
   const dashboard = expectSection(record, "hermesDashboard");
   if (dashboard) {
     expectBoolean(dashboard, "enabled", "hermesDashboard.");
     expectPort(dashboard, "port", "hermesDashboard.");
   }
-  const cron = expectSection(record, "cron");
-  if (cron) expectString(cron, "agentBin", "cron.");
-  const build = expectSection(record, "build");
-  if (build) expectBoolean(build, "skipPnpmInstall", "build.");
   const image = expectSection(record, "image");
   if (image) {
     expectString(image, "ref", "image.");
@@ -1086,6 +1085,16 @@ function expectPort(record, key, prefix = "") {
     throw fieldError(`${prefix}${key}`, "must be an integer between 1 and 65535");
   }
 }
+function expectStringArray(record, key, prefix = "") {
+  const value = record[key];
+  if (value === void 0) return;
+  if (!Array.isArray(value)) throw fieldError(`${prefix}${key}`, "must be an array of strings");
+  for (const entry of value) {
+    if (typeof entry !== "string") {
+      throw fieldError(`${prefix}${key}`, "must be an array of strings");
+    }
+  }
+}
 function expectEnum(record, key, prefix, allowed) {
   const value = record[key];
   if (value === void 0) return;
@@ -1106,10 +1115,10 @@ var AGRO_CONFIG_FIELDS = [
   { path: "access.sshPasswordAuth", type: "boolean" },
   { path: "access.sshAuthorizedKeys", type: "string" },
   { path: "access.dockerSocket", type: "boolean" },
+  { path: "access.egress", type: "enum", values: EGRESS_MODES },
+  { path: "access.egressAllow", type: "list" },
   { path: "hermesDashboard.enabled", type: "boolean" },
   { path: "hermesDashboard.port", type: "port" },
-  { path: "cron.agentBin", type: "string" },
-  { path: "build.skipPnpmInstall", type: "boolean" },
   { path: "image.ref", type: "string" },
   { path: "image.mode", type: "enum", values: ["build", "image"] },
   { path: "image.pullPolicy", type: "enum", values: ["missing", "always", "never"] },
@@ -1415,10 +1424,16 @@ async function askSecretPiped(question) {
   process.on("SIGINT", onSigint);
   try {
     return await new Promise((resolve14) => {
-      rl.question(`  ${question} `, (answer) => {
+      let settled = false;
+      const settle = (answer) => {
+        if (settled) return;
+        settled = true;
         process.stdout.write("\n");
         resolve14(answer.trim());
-      });
+      };
+      rl.question(`  ${question} `, settle);
+      rl.once("line", settle);
+      rl.once("close", () => settle(rl.line));
     });
   } finally {
     process.removeListener("SIGINT", onSigint);
@@ -1462,10 +1477,10 @@ import { existsSync as existsSync6, mkdirSync as mkdirSync3, readdirSync as read
 import { dirname as dirname4, join as join4, resolve as resolve5, sep as sep2 } from "node:path";
 
 // agro-asset:/home/runner/work/agro/agro/.devcontainer/docker-compose.yml
-var docker_compose_default = 'name: ${SANDBOX_NAME:-agro}\n\nservices:\n  sandbox:\n    image: ${AGRO_SANDBOX_IMAGE:-sandbox-${SANDBOX_NAME:-agro}}\n    pull_policy: ${AGRO_PULL_POLICY:-missing}\n    container_name: ${SANDBOX_NAME:-agro}\n    build:\n      context: ${AGRO_REPO_DIR:-..}\n      dockerfile: .devcontainer/Dockerfile\n    volumes:\n      - ${AGRO_HOME_MOUNT:-workspace}:/home/sandbox\n      - ${AGRO_REPO_DIR:-..}:/home/sandbox/harness\n    extra_hosts:\n      - "host.docker.internal:host-gateway"\n    environment:\n      - SANDBOX_NAME=${SANDBOX_NAME:-agro}\n      - SANDBOX_PASSWORD=${SANDBOX_PASSWORD:-test1234}\n      - TZ=${TZ:-America/Los_Angeles}\n      - CLAUDE_DANGEROUSLY_SKIP_PERMISSIONS=true\n      - CC_SAFETY_NET_STRICT=1\n      - CC_SAFETY_NET_WORKTREE=1\n      - GIT_USER_NAME=${GIT_USER_NAME:-}\n      - GIT_USER_EMAIL=${GIT_USER_EMAIL:-}\n      - GH_TOKEN=${GH_TOKEN:-}\n      - TYPESAFE_API_KEY=${TYPESAFE_API_KEY:-}\n    stdin_open: true\n    tty: true\n    cgroup: private\n    cap_add:\n      - SYS_ADMIN\n    security_opt:\n      - apparmor=unconfined\n    tmpfs:\n      - /run\n      - /run/lock\n      - /sys/fs\n    healthcheck:\n      test: ["CMD", "bash", "-c", "exec bash /home/sandbox/harness/.agro/scripts/sandbox-healthcheck.sh"]\n      interval: 30s\n      timeout: 10s\n      retries: 3\n      start_period: 600s\n    restart: unless-stopped\n\nvolumes:\n  workspace:\n';
+var docker_compose_default = 'name: ${SANDBOX_NAME:-agro}\n\nservices:\n  sandbox:\n    image: ${AGRO_SANDBOX_IMAGE:-sandbox-${SANDBOX_NAME:-agro}}\n    pull_policy: ${AGRO_PULL_POLICY:-missing}\n    container_name: ${SANDBOX_NAME:-agro}\n    build:\n      context: ${AGRO_REPO_DIR:-..}\n      dockerfile: .devcontainer/Dockerfile\n    volumes:\n      - ${AGRO_HOME_MOUNT:-workspace}:/home/sandbox\n      - ${AGRO_REPO_DIR:-..}:/home/sandbox/harness\n    extra_hosts:\n      - "host.docker.internal:host-gateway"\n    environment:\n      - SANDBOX_NAME=${SANDBOX_NAME:-agro}\n      - SANDBOX_PASSWORD=${SANDBOX_PASSWORD:-}\n      - TZ=${TZ:-America/Los_Angeles}\n      - CLAUDE_DANGEROUSLY_SKIP_PERMISSIONS=true\n      - CC_SAFETY_NET_STRICT=1\n      - CC_SAFETY_NET_WORKTREE=1\n      - GIT_USER_NAME=${GIT_USER_NAME:-}\n      - GIT_USER_EMAIL=${GIT_USER_EMAIL:-}\n      - GH_TOKEN=${GH_TOKEN:-}\n      - TYPESAFE_API_KEY=${TYPESAFE_API_KEY:-}\n      - XAI_API_KEY=${XAI_API_KEY:-}\n    stdin_open: true\n    tty: true\n    init: true\n    entrypoint: ["/usr/local/bin/sandbox-main.sh"]\n    stop_signal: SIGTERM\n    healthcheck:\n      test: ["CMD", "bash", "-c", "exec bash /home/sandbox/harness/.agro/scripts/sandbox-healthcheck.sh"]\n      interval: 30s\n      timeout: 10s\n      retries: 3\n      start_period: 600s\n    restart: unless-stopped\n\nvolumes:\n  workspace:\n';
 
 // agro-asset:/home/runner/work/agro/agro/.devcontainer/docker-compose.image-only.yml
-var docker_compose_image_only_default = 'name: ${SANDBOX_NAME:-agro}\n\nservices:\n  sandbox:\n    image: ${AGRO_SANDBOX_IMAGE:-ghcr.io/mifunedev/agro:latest}\n    pull_policy: ${AGRO_PULL_POLICY:-always}\n    container_name: ${SANDBOX_NAME:-agro}\n    volumes:\n      - ${AGRO_HOME_MOUNT:-workspace}:/home/sandbox\n    extra_hosts:\n      - "host.docker.internal:host-gateway"\n    environment:\n      - SANDBOX_NAME=${SANDBOX_NAME:-agro}\n      - SANDBOX_PASSWORD=${SANDBOX_PASSWORD:-test1234}\n      - TZ=${TZ:-America/Los_Angeles}\n      - CLAUDE_DANGEROUSLY_SKIP_PERMISSIONS=true\n      - CC_SAFETY_NET_STRICT=1\n      - CC_SAFETY_NET_WORKTREE=1\n      - GIT_USER_NAME=${GIT_USER_NAME:-}\n      - GIT_USER_EMAIL=${GIT_USER_EMAIL:-}\n      - GH_TOKEN=${GH_TOKEN:-}\n      - TYPESAFE_API_KEY=${TYPESAFE_API_KEY:-}\n    stdin_open: true\n    tty: true\n    cgroup: private\n    cap_add:\n      - SYS_ADMIN\n    security_opt:\n      - apparmor=unconfined\n    tmpfs:\n      - /run\n      - /run/lock\n      - /sys/fs\n    healthcheck:\n      test: ["CMD", "bash", "-c", "exec bash /home/sandbox/harness/.agro/scripts/sandbox-healthcheck.sh"]\n      interval: 30s\n      timeout: 10s\n      retries: 3\n      start_period: 600s\n    restart: unless-stopped\n\nvolumes:\n  workspace:\n';
+var docker_compose_image_only_default = 'name: ${SANDBOX_NAME:-agro}\n\nservices:\n  sandbox:\n    image: ${AGRO_SANDBOX_IMAGE:-ghcr.io/mifunedev/agro:latest}\n    pull_policy: ${AGRO_PULL_POLICY:-always}\n    container_name: ${SANDBOX_NAME:-agro}\n    volumes:\n      - ${AGRO_HOME_MOUNT:-workspace}:/home/sandbox\n    extra_hosts:\n      - "host.docker.internal:host-gateway"\n    environment:\n      - SANDBOX_NAME=${SANDBOX_NAME:-agro}\n      - SANDBOX_PASSWORD=${SANDBOX_PASSWORD:-}\n      - TZ=${TZ:-America/Los_Angeles}\n      - CLAUDE_DANGEROUSLY_SKIP_PERMISSIONS=true\n      - CC_SAFETY_NET_STRICT=1\n      - CC_SAFETY_NET_WORKTREE=1\n      - GIT_USER_NAME=${GIT_USER_NAME:-}\n      - GIT_USER_EMAIL=${GIT_USER_EMAIL:-}\n      - GH_TOKEN=${GH_TOKEN:-}\n      - TYPESAFE_API_KEY=${TYPESAFE_API_KEY:-}\n    stdin_open: true\n    tty: true\n    init: true\n    entrypoint: ["/usr/local/bin/sandbox-main.sh"]\n    stop_signal: SIGTERM\n    healthcheck:\n      test: ["CMD", "bash", "-c", "exec bash /home/sandbox/harness/.agro/scripts/sandbox-healthcheck.sh"]\n      interval: 30s\n      timeout: 10s\n      retries: 3\n      start_period: 600s\n    restart: unless-stopped\n\nvolumes:\n  workspace:\n';
 
 // agro-asset:/home/runner/work/agro/agro/.devcontainer/docker-compose.ssh.yml
 var docker_compose_ssh_default = 'services:\n  sandbox:\n    ports:\n      - "127.0.0.1:${SANDBOX_SSH_PORT:-2222}:22"\n';
@@ -1473,6 +1488,9 @@ var docker_compose_ssh_default = 'services:\n  sandbox:\n    ports:\n      - "12
 // agro-asset:/home/runner/work/agro/agro/.devcontainer/docker-compose.docker-sock.yml
 var docker_compose_docker_sock_default = "services:\n  sandbox:\n    volumes:\n      - /var/run/docker.sock:/var/run/docker.sock\n";
 
+// agro-asset:/home/runner/work/agro/agro/.devcontainer/docker-compose.egress.yml
+var docker_compose_egress_default = 'services:\n  sandbox:\n    networks:\n      - egress-internal\n    depends_on:\n      - proxy\n    environment:\n      - HTTPS_PROXY=http://proxy:3128\n      - HTTP_PROXY=http://proxy:3128\n      - https_proxy=http://proxy:3128\n      - http_proxy=http://proxy:3128\n      - NO_PROXY=localhost,127.0.0.1\n      - no_proxy=localhost,127.0.0.1\n      - NODE_USE_ENV_PROXY=1\n\n  proxy:\n    image: ubuntu/squid@sha256:6a097f68bae708cedbabd6188d68c7e2e7a38cedd05a176e1cc0ba29e3bbe029\n    networks:\n      - egress-internal\n      - egress-out\n    configs:\n      - source: egress-squid\n        target: /etc/squid/squid.conf\n    volumes:\n      - type: bind\n        source: ../egress-allow.txt\n        target: /etc/squid/egress-allow.txt\n        read_only: true\n    restart: unless-stopped\n\nconfigs:\n  egress-squid:\n    content: |\n      http_port 3128\n      acl SSL_ports port 443\n      acl Safe_ports port 80\n      acl Safe_ports port 443\n      acl CONNECT method CONNECT\n      acl egress_allow dstdomain "/etc/squid/egress-allow.txt"\n      http_access deny !Safe_ports\n      http_access deny CONNECT !SSL_ports\n      http_access allow egress_allow\n      http_access deny all\n\nnetworks:\n  egress-internal:\n    internal: true\n  egress-out: {}\n';
+
 // agro-asset:/home/runner/work/agro/agro/.agro/scripts/docker-compose.sh
 var docker_compose_default2 = `#!/usr/bin/env bash
 
@@ -1612,6 +1630,11 @@ fi
 
 args+=(-f "$(compose_path ".devcontainer/docker-compose.yml")")
 
+egress_value=\${AGRO_EGRESS:-$(read_env_value AGRO_EGRESS)}
+if [ "$(printf '%s' "$egress_value" | tr '[:upper:]' '[:lower:]')" = "allowlist" ]; then
+  args+=(-f "$(compose_path ".devcontainer/docker-compose.egress.yml")")
+fi
+
 docker_socket_value=\${DOCKER_SOCKET:-$(read_env_value DOCKER_SOCKET)}
 if truthy "$docker_socket_value"; then
   args+=(-f "$(compose_path ".devcontainer/docker-compose.docker-sock.yml")")
@@ -1864,9 +1887,29 @@ function nextDefaultName(run = spawnRunner) {
 function openshellFiles(entry) {
   return [{ dest: join4(entry, "openshell-policy.yaml"), body: openshell_policy_default, mode: 420 }];
 }
-function dockerFiles(entry, opts) {
+function policyHosts(policyText) {
+  const marker = "network_policies:";
+  const start = policyText.indexOf(marker);
+  const section = start === -1 ? "" : policyText.slice(start);
+  const hosts = /* @__PURE__ */ new Set();
+  for (const match of section.matchAll(/^\s*-\s*host:\s*(\S+)/gm)) hosts.add(match[1]);
+  return [...hosts];
+}
+function egressAllowHosts(config) {
+  const hosts = new Set(policyHosts(openshell_policy_default));
+  for (const host of config.access?.egressAllow ?? []) hosts.add(host);
+  return [...hosts].sort();
+}
+function safeReadAgroConfig(entry) {
+  try {
+    return readAgroConfig(agroConfigPath(entry));
+  } catch {
+    return { version: 1 };
+  }
+}
+function dockerFiles(entry, opts, config) {
   const scripts = join4(resolveProjectLayout(entry).controlDir, "scripts");
-  return [
+  const files = [
     {
       dest: join4(entry, ".devcontainer", "docker-compose.yml"),
       body: (opts.checkout ?? opts.repo) === void 0 ? docker_compose_image_only_default : docker_compose_default,
@@ -1874,14 +1917,25 @@ function dockerFiles(entry, opts) {
     },
     { dest: join4(entry, ".devcontainer", "docker-compose.ssh.yml"), body: docker_compose_ssh_default, mode: 420 },
     { dest: join4(entry, ".devcontainer", "docker-compose.docker-sock.yml"), body: docker_compose_docker_sock_default, mode: 420 },
+    { dest: join4(entry, ".devcontainer", "docker-compose.egress.yml"), body: docker_compose_egress_default, mode: 420 },
     { dest: join4(scripts, "docker-compose.sh"), body: docker_compose_default2, mode: 493 },
     { dest: join4(scripts, "paths.sh"), body: paths_default, mode: 420 },
     { dest: join4(scripts, "check-host-port.sh"), body: check_host_port_default, mode: 493 }
   ];
+  if ((config.access?.egress ?? "open") === "allowlist") {
+    files.push({
+      dest: join4(entry, "egress-allow.txt"),
+      body: `${egressAllowHosts(config).join("\n")}
+`,
+      mode: 420
+    });
+  }
+  return files;
 }
 function materialize(root, opts = {}) {
   const entry = resolve5(root);
-  const files = entryRuntime(entry) === "openshell" ? openshellFiles(entry) : dockerFiles(entry, opts);
+  const config = safeReadAgroConfig(entry);
+  const files = entryRuntime(entry) === "openshell" ? openshellFiles(entry) : dockerFiles(entry, opts, config);
   for (const file of files) {
     const dest = resolve5(file.dest);
     if (!dest.startsWith(entry + sep2)) {
@@ -1921,6 +1975,7 @@ function resolveSandboxRoot(opts = {}) {
 }
 
 // src/lib/secrets.ts
+import { randomBytes } from "node:crypto";
 import { existsSync as existsSync8, readFileSync as readFileSync6 } from "node:fs";
 import { resolve as resolve6 } from "node:path";
 
@@ -1985,7 +2040,15 @@ var SECRET_KEYS = [
   "PI_SLACK_BOT_TOKEN",
   "LANGFUSE_PUBLIC_KEY",
   "LANGFUSE_SECRET_KEY",
-  "TYPESAFE_API_KEY"
+  "TYPESAFE_API_KEY",
+  "AGRO_CONSOLE_URL",
+  "AGRO_CONSOLE_TOKEN"
+];
+var COMPOSE_SECRET_KEYS = [
+  "GH_TOKEN",
+  "SANDBOX_PASSWORD",
+  "TYPESAFE_API_KEY",
+  "XAI_API_KEY"
 ];
 var ALLOWED = new Set(SECRET_KEYS);
 function secretsFilePath(root) {
@@ -2020,6 +2083,10 @@ function setSecret(root, key, value) {
   const { content } = setKeyInEnv(original, key, value);
   writeEnvFile(file, content);
 }
+function ensureSandboxPassword(root) {
+  if (readSecret(root, "SANDBOX_PASSWORD") !== void 0) return;
+  setSecret(root, "SANDBOX_PASSWORD", randomBytes(24).toString("base64url"));
+}
 function listSecretKeys(root) {
   const file = secretsFilePath(root);
   if (!existsSync8(file)) return [];
@@ -2046,7 +2113,7 @@ import { basename as basename6, join as join6, sep as sep3 } from "node:path";
 import { basename as basename4, resolve as resolve7 } from "node:path";
 
 // src/lib/version.ts
-var AGRO_VERSION = true ? "0.20.0" : "0.0.0-dev";
+var AGRO_VERSION = true ? "0.22.0" : "0.0.0-dev";
 var OFFICIAL_IMAGE = "ghcr.io/mifunedev/agro";
 var RELEASE_VERSION = /^[0-9]+\.[0-9]+\.[0-9]+(?:-[a-z][a-z0-9]*\.[0-9]+)?$/;
 function parseReleaseVersion(value) {
@@ -2621,6 +2688,7 @@ function renderComposeVars(config) {
   put("GIT_USER_NAME", config.git?.userName);
   put("GIT_USER_EMAIL", config.git?.userEmail);
   put("DOCKER_SOCKET", config.access?.dockerSocket);
+  put("AGRO_EGRESS", config.access?.egress);
   put("SANDBOX_SSH", config.access?.ssh);
   put("SANDBOX_SSH_PORT", config.access?.sshPort);
   put("AGRO_SANDBOX_IMAGE", sandboxImageRef(config));
@@ -2848,6 +2916,7 @@ async function runSandbox(opts, io) {
   }
   await maybePromptDockerSocket(root, io, opts.bin);
   requireLifecycleScript(root, "docker-compose.sh");
+  ensureSandboxPassword(root);
   if (imageRef !== void 0) {
     io.stdout(`image mode: ${imageRef} (skipping local build)
 `);
@@ -3368,6 +3437,14 @@ Set it with \`${opts.bin} config set ${key}\` instead.
 
 Keys:
 ${secretKeyList()}
+`
+    );
+    return 1;
+  }
+  if (opts.sandbox !== void 0 && !COMPOSE_SECRET_KEYS.includes(key)) {
+    io.stderr(
+      `${opts.bin} secret set: ${key} does not reach the container from --sandbox ${opts.sandbox} \u2014 Compose passes only ${COMPOSE_SECRET_KEYS.join(", ")}.
+Run \`${opts.bin} secret set ${key}\` in the project checkout instead.
 `
     );
     return 1;
@@ -3388,7 +3465,26 @@ ${secretKeyList()}
 `);
     return 1;
   }
-  io.stdout(`.env: set ${key}=${redact(value)}
+  io.stdout(`.env: set ${key}
+`);
+  return 0;
+}
+async function runSecretGet(key, opts, io) {
+  const root = secretsRoot(opts);
+  let value;
+  try {
+    value = readSecret(root, key);
+  } catch (error) {
+    io.stderr(`${error instanceof Error ? error.message : String(error)}
+`);
+    return 1;
+  }
+  if (value === void 0) {
+    io.stderr(`${opts.bin} secret get: ${key} has no value
+`);
+    return 1;
+  }
+  io.stdout(`${value}
 `);
   return 0;
 }
@@ -3403,7 +3499,7 @@ async function runSecretList(opts, io) {
   const width = Math.max(...keys.map((key) => key.length));
   for (const key of keys) {
     const value = readSecret(root, key);
-    io.stdout(`${key.padEnd(width)}  ${value === void 0 ? "\u2014" : redact(value)}
+    io.stdout(`${key.padEnd(width)}  ${value === void 0 ? "\u2014" : "set"}
 `);
   }
   return 0;
@@ -3415,6 +3511,9 @@ import { homedir as homedir2, tmpdir as tmpdir2 } from "node:os";
 import { dirname as dirname7, join as join11, relative } from "node:path";
 
 // src/lib/tracing/harness-writers.ts
+import { join as join10 } from "node:path";
+
+// src/lib/tracing/providers/langfuse.ts
 import { join as join9 } from "node:path";
 
 // src/lib/tracing/writer.ts
@@ -3457,16 +3556,66 @@ function isPlainObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
+// src/lib/tracing/providers/langfuse.ts
+var LANGFUSE_PLUGIN_MAX_CHARS = 1e5;
+var LANGFUSE_FRAGMENT_KEYS = [
+  "LANGFUSE_PUBLIC_KEY",
+  "LANGFUSE_SECRET_KEY",
+  "LANGFUSE_BASE_URL",
+  "LANGFUSE_TRACING_ENVIRONMENT",
+  "PI_LANGFUSE_MAX_CHARS"
+];
+function langfuseFragmentPath(home) {
+  return join9(home, ".config", "agro", "langfuse.env");
+}
+function loadLangfuseCredentials(root) {
+  const publicKey = readSecret(root, "LANGFUSE_PUBLIC_KEY");
+  const secretKey = readSecret(root, "LANGFUSE_SECRET_KEY");
+  if (publicKey !== void 0 && secretKey !== void 0) return { publicKey, secretKey };
+  const missing = [
+    publicKey === void 0 ? "LANGFUSE_PUBLIC_KEY" : void 0,
+    secretKey === void 0 ? "LANGFUSE_SECRET_KEY" : void 0
+  ].filter((key) => key !== void 0);
+  throw new Error(
+    `${missing.join(" and ")} ${missing.length === 1 ? "is" : "are"} not set in .env \u2014 run \`${activeBin()} secret set ${missing[0]} <value>\` first`
+  );
+}
+var BARE_SAFE_VALUE = /^[A-Za-z0-9_.:/@%+=,-]+$/;
+var UNCARRIABLE_IN_VALUE = /[\u0000-\u001f\u007f']/;
+function renderLangfuseFragment(input) {
+  const values = {
+    LANGFUSE_PUBLIC_KEY: input.publicKey,
+    LANGFUSE_SECRET_KEY: input.secretKey,
+    LANGFUSE_BASE_URL: input.baseUrl,
+    LANGFUSE_TRACING_ENVIRONMENT: input.environment,
+    PI_LANGFUSE_MAX_CHARS: String(LANGFUSE_PLUGIN_MAX_CHARS)
+  };
+  return LANGFUSE_FRAGMENT_KEYS.map((key) => `${key}=${quoteFragmentValue(key, values[key])}
+`).join("");
+}
+function writeLangfuseFragment(home, input) {
+  return writeTextIfChanged(langfuseFragmentPath(home), renderLangfuseFragment(input), PRIVATE_FILE_MODE);
+}
+function quoteFragmentValue(key, value) {
+  if (value === "") throw new Error(`${key} must not be empty`);
+  if (UNCARRIABLE_IN_VALUE.test(value)) {
+    throw new Error(
+      `${key} must not contain a newline, a control character, or a single quote \u2014 zsh reads the fragment and does not carry that value safely`
+    );
+  }
+  return BARE_SAFE_VALUE.test(value) ? value : `'${value}'`;
+}
+
 // src/lib/tracing/harness-writers.ts
 var CODEX_TRACING_TAGS = ["codex"];
 function claudeCodeSettingsPath(home) {
-  return join9(home, ".claude", "settings.json");
+  return join10(home, ".claude", "settings.json");
 }
 function piTracingConfigPath(home) {
-  return join9(home, ".pi", "agent", "langfuse.json");
+  return join10(home, ".pi", "agent", "langfuse.json");
 }
 function codexTracingConfigPath(home) {
-  return join9(home, ".codex", "langfuse.json");
+  return join10(home, ".codex", "langfuse.json");
 }
 var claudeCodeTracingWriter = (home, settings) => {
   const path4 = claudeCodeSettingsPath(home);
@@ -3480,7 +3629,8 @@ var claudeCodeTracingWriter = (home, settings) => {
     env: {
       ...env,
       LANGFUSE_BASE_URL: settings.baseUrl,
-      LANGFUSE_TRACING_ENVIRONMENT: settings.environment
+      LANGFUSE_TRACING_ENVIRONMENT: settings.environment,
+      CC_LANGFUSE_MAX_CHARS: String(LANGFUSE_PLUGIN_MAX_CHARS)
     }
   };
   return writeTextIfChanged(path4, renderJson(next));
@@ -3709,54 +3859,6 @@ function harnessBinPath(prefix) {
   return `${prefix}/bin`;
 }
 
-// src/lib/tracing/providers/langfuse.ts
-import { join as join10 } from "node:path";
-var LANGFUSE_FRAGMENT_KEYS = [
-  "LANGFUSE_PUBLIC_KEY",
-  "LANGFUSE_SECRET_KEY",
-  "LANGFUSE_BASE_URL",
-  "LANGFUSE_TRACING_ENVIRONMENT"
-];
-function langfuseFragmentPath(home) {
-  return join10(home, ".config", "agro", "langfuse.env");
-}
-function loadLangfuseCredentials(root) {
-  const publicKey = readSecret(root, "LANGFUSE_PUBLIC_KEY");
-  const secretKey = readSecret(root, "LANGFUSE_SECRET_KEY");
-  if (publicKey !== void 0 && secretKey !== void 0) return { publicKey, secretKey };
-  const missing = [
-    publicKey === void 0 ? "LANGFUSE_PUBLIC_KEY" : void 0,
-    secretKey === void 0 ? "LANGFUSE_SECRET_KEY" : void 0
-  ].filter((key) => key !== void 0);
-  throw new Error(
-    `${missing.join(" and ")} ${missing.length === 1 ? "is" : "are"} not set in .env \u2014 run \`${activeBin()} secret set ${missing[0]} <value>\` first`
-  );
-}
-var BARE_SAFE_VALUE = /^[A-Za-z0-9_.:/@%+=,-]+$/;
-var UNCARRIABLE_IN_VALUE = /[\u0000-\u001f\u007f']/;
-function renderLangfuseFragment(input) {
-  const values = {
-    LANGFUSE_PUBLIC_KEY: input.publicKey,
-    LANGFUSE_SECRET_KEY: input.secretKey,
-    LANGFUSE_BASE_URL: input.baseUrl,
-    LANGFUSE_TRACING_ENVIRONMENT: input.environment
-  };
-  return LANGFUSE_FRAGMENT_KEYS.map((key) => `${key}=${quoteFragmentValue(key, values[key])}
-`).join("");
-}
-function writeLangfuseFragment(home, input) {
-  return writeTextIfChanged(langfuseFragmentPath(home), renderLangfuseFragment(input), PRIVATE_FILE_MODE);
-}
-function quoteFragmentValue(key, value) {
-  if (value === "") throw new Error(`${key} must not be empty`);
-  if (UNCARRIABLE_IN_VALUE.test(value)) {
-    throw new Error(
-      `${key} must not contain a newline, a control character, or a single quote \u2014 zsh and systemd read the same fragment and neither carries that value safely`
-    );
-  }
-  return BARE_SAFE_VALUE.test(value) ? value : `'${value}'`;
-}
-
 // src/commands/langfuse.ts
 var DEFAULT_LANGFUSE_BASE_URL = "https://cloud.langfuse.com";
 var LANGFUSE_FRAGMENT_LABEL = "~/.config/agro/langfuse.env";
@@ -4968,6 +5070,404 @@ async function runSandboxCommand(rest, bin) {
   );
 }
 
+// src/commands/egress.ts
+import { basename as basename7 } from "node:path";
+var EGRESS_LOG_PATH = "/var/log/squid/access.log";
+var EGRESS_LOG_LINES = 1e3;
+var PROXY_EXEC = ["exec", "-T", "proxy"];
+var EGRESS_COMMANDS = Object.freeze({
+  log: Object.freeze([...PROXY_EXEC, "tail", "-n", String(EGRESS_LOG_LINES), EGRESS_LOG_PATH]),
+  reload: Object.freeze([...PROXY_EXEC, "squid", "-k", "reconfigure"])
+});
+var RUNTIME_REFUSAL = Object.freeze({
+  docker: void 0,
+  openshell: (name) => `the sandbox ${name} uses runtime openshell; access.egress allowlist applies to the docker runtime`
+});
+function markDenied(text) {
+  return text.split("\n").map((line) => line.includes("TCP_DENIED") ? `DENIED ${line}` : line).join("\n");
+}
+function refusal(root, name) {
+  const runtimeRefusal = RUNTIME_REFUSAL[entryRuntime(root)];
+  if (runtimeRefusal !== void 0) return runtimeRefusal(name);
+  const egress = readAgroConfig(agroConfigPath(root)).access?.egress ?? "open";
+  if (egress !== "allowlist") return `the sandbox ${name} uses access.egress ${egress}; set access.egress allowlist`;
+  return void 0;
+}
+function rematerialize(root) {
+  const repo = readAgroConfig(agroConfigPath(root)).repo;
+  materialize(root, repo === void 0 || repo === "" ? {} : { repo });
+}
+function runEgress(verb, opts, io) {
+  const run = opts.run ?? spawnRunner;
+  const root = resolveSandboxRoot({ name: opts.name, cwd: opts.cwd });
+  const name = basename7(root);
+  const refused = refusal(root, name);
+  if (refused !== void 0) {
+    io.stderr(`${opts.bin} egress ${verb}: ${refused}
+`);
+    return 1;
+  }
+  rematerialize(root);
+  const script = requireLifecycleScript(root, "docker-compose.sh");
+  const capture2 = verb === "log";
+  return withComposeEnvFile(root, (extraArgs) => {
+    const r = run("bash", [script, ...extraArgs, ...EGRESS_COMMANDS[verb]], {
+      stdio: capture2 ? "capture" : "inherit"
+    });
+    assertSpawned(r, `bash ${script} egress ${verb}`);
+    if (capture2) {
+      if (r.stdout) io.stdout(markDenied(r.stdout));
+      if (r.stderr) io.stderr(r.stderr);
+    }
+    return r.status ?? 1;
+  });
+}
+
+// src/command-table.ts
+var CONFIG_VERBS = ["show", "set", "repo"];
+var CONFIG_INTEGRATIONS = ["langfuse"];
+var SECRET_VERBS = ["set", "get", "list"];
+var LANGFUSE_VERBS = ["apply", "status", "disable"];
+var SANDBOX_SUBCOMMANDS = ["install", "list", "upgrade"];
+var WORKSPACE_SUBCOMMANDS = ["create", "list"];
+var HARNESS_SUBCOMMANDS = ["list", "install", "status", "uninstall"];
+var TOOL_SUBCOMMANDS = ["list", "install", "status", "uninstall"];
+var EGRESS_VERBS = ["log", "reload"];
+var NODE_VERBS = ["create", "list", "delete"];
+function isOneOf(values, value) {
+  return value !== void 0 && values.includes(value);
+}
+var AGRO_COMMANDS = Object.freeze({
+  config: [...CONFIG_VERBS, ...CONFIG_INTEGRATIONS],
+  secret: SECRET_VERBS,
+  langfuse: LANGFUSE_VERBS,
+  update: null,
+  "self-upgrade": null,
+  vendor: null,
+  sandbox: SANDBOX_SUBCOMMANDS,
+  shell: null,
+  compose: null,
+  workspace: WORKSPACE_SUBCOMMANDS,
+  harness: HARNESS_SUBCOMMANDS,
+  tool: TOOL_SUBCOMMANDS,
+  gateway: null,
+  egress: EGRESS_VERBS,
+  node: NODE_VERBS,
+  ...Object.fromEntries(composeVerbs().map((verb) => [verb, null]))
+});
+
+// src/commands/node.ts
+var DEFAULT_CONSOLE_URL = "https://console.mifune.dev";
+var CONSOLE_CONFIG_MISSING = "set AGRO_CONSOLE_TOKEN, or run agro secret set AGRO_CONSOLE_TOKEN";
+var NODE_READY_TIMEOUT_MS = 15 * 60 * 1e3;
+var NODE_POLL_INTERVAL_MS = 5e3;
+var FREE_TIER_SPEC = "n4";
+var FAILURE_STATUSES = /* @__PURE__ */ new Set(["failed", "destroy_requested", "destroying", "destroyed", "retired"]);
+function resolveConsoleConfig(env, readSecret2) {
+  const lookup = (key) => {
+    const fromEnv = env[key]?.trim();
+    if (fromEnv !== void 0 && fromEnv !== "") return fromEnv;
+    const fromSecret = readSecret2(key)?.trim();
+    return fromSecret === void 0 || fromSecret === "" ? void 0 : fromSecret;
+  };
+  const token = lookup("AGRO_CONSOLE_TOKEN");
+  if (token === void 0) return void 0;
+  const url = lookup("AGRO_CONSOLE_URL") ?? DEFAULT_CONSOLE_URL;
+  return { url: url.replace(/\/+$/, ""), token };
+}
+function readProjectSecret(key) {
+  try {
+    return readSecret(resolveProjectRoot(), key);
+  } catch {
+    return void 0;
+  }
+}
+function defaultDeps2() {
+  return {
+    fetch: (input, init) => globalThis.fetch(input, init),
+    env: process.env,
+    readSecret: readProjectSecret,
+    sleep: (ms) => new Promise((done) => setTimeout(done, ms)),
+    now: () => Date.now(),
+    pollIntervalMs: NODE_POLL_INTERVAL_MS,
+    timeoutMs: NODE_READY_TIMEOUT_MS,
+    confirm: (question) => confirm(question, false)
+  };
+}
+function nodeHelp(bin) {
+  return `${bin} node \u2014 Create, list, and delete agro-console sandbox nodes (remote VMs)
+
+Usage:
+  ${bin} node create --spec <spec> --ssh-key <uuid> [--ssh-key <uuid>] [--name <name>] [--free-tier] [--json]
+  ${bin} node list [--json]
+  ${bin} node delete <id> [--yes]
+
+\`create\` waits up to 15 minutes for the node to reach \`running\`, then prints
+its SSH command. \`--free-tier\` requests the console free tier. The spec
+defaults to n4. The verbs read AGRO_CONSOLE_URL and AGRO_CONSOLE_TOKEN from the
+environment, then from the project .env (\`${bin} secret set <KEY>\`).
+AGRO_CONSOLE_URL defaults to ${DEFAULT_CONSOLE_URL}.
+`;
+}
+function asRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
+}
+function asText(value) {
+  if (typeof value === "string" && value !== "") return value;
+  if (typeof value === "number") return String(value);
+  return null;
+}
+function toNode(value) {
+  const outer = asRecord(value);
+  const record = asRecord(outer?.node) ?? outer;
+  const id = asText(record?.id);
+  if (record === void 0 || id === null) return void 0;
+  return {
+    id,
+    name: asText(record.name),
+    profile: asText(record.profile),
+    status: asText(record.status) ?? "unknown",
+    ipv4: asText(record.ipv4),
+    ssh: asText(record.ssh)
+  };
+}
+function sshCommand(node) {
+  if (node.ssh !== null) return node.ssh;
+  return node.ipv4 === null ? null : `ssh sandbox@${node.ipv4}`;
+}
+function errorDetail(status, body) {
+  const record = asRecord(body);
+  const nested = asRecord(record?.error);
+  const code = asText(record?.code) ?? asText(nested?.code) ?? "no code";
+  const message = asText(record?.error) ?? asText(nested?.message) ?? asText(record?.message);
+  return `HTTP ${status} ${code}${message === null ? "" : `: ${message}`}`;
+}
+async function callApi(deps, config, method, path4, payload) {
+  let response;
+  try {
+    response = await deps.fetch(`${config.url}${path4}`, {
+      method,
+      headers: {
+        Authorization: `Bearer ${config.token}`,
+        Accept: "application/json",
+        ...payload === void 0 ? {} : { "Content-Type": "application/json" }
+      },
+      ...payload === void 0 ? {} : { body: JSON.stringify(payload) }
+    });
+  } catch (error) {
+    return { ok: false, message: `request failed: ${error instanceof Error ? error.message : String(error)}` };
+  }
+  const text = await response.text();
+  let body = null;
+  try {
+    body = text === "" ? null : JSON.parse(text);
+  } catch {
+    body = null;
+  }
+  if (response.status >= 400) {
+    return { ok: false, status: response.status, message: errorDetail(response.status, body) };
+  }
+  return { ok: true, status: response.status, body };
+}
+function parseCreate(tokens) {
+  const args = { sshKeyIds: [], freeTier: false, json: false };
+  for (let i = 0; i < tokens.length; i += 1) {
+    const token = tokens[i];
+    if (token === "--json") {
+      args.json = true;
+      continue;
+    }
+    if (token === "--free-tier") {
+      args.freeTier = true;
+      continue;
+    }
+    const [flag, inline] = token.startsWith("--") && token.includes("=") ? [token.slice(0, token.indexOf("=")), token.slice(token.indexOf("=") + 1)] : [token, void 0];
+    if (flag !== "--spec" && flag !== "--ssh-key" && flag !== "--name") {
+      return { ok: false, error: token.startsWith("-") ? `unknown flag "${token}"` : `unexpected argument "${token}"` };
+    }
+    const value = inline ?? tokens[++i];
+    if (value === void 0 || value === "") return { ok: false, error: `${flag} requires a value` };
+    if (flag === "--spec") args.spec = value;
+    else if (flag === "--name") args.name = value;
+    else args.sshKeyIds.push(value);
+  }
+  if (args.spec === void 0 && args.freeTier) args.spec = FREE_TIER_SPEC;
+  if (args.spec === void 0) return { ok: false, error: "--spec is required" };
+  if (args.sshKeyIds.length === 0) return { ok: false, error: "at least one --ssh-key is required" };
+  return { ok: true, args };
+}
+function printCreateResult(io, node, json) {
+  const ssh = node.status === "running" ? sshCommand(node) : null;
+  if (json) {
+    io.stdout(`${JSON.stringify({ id: node.id, status: node.status, ssh })}
+`);
+    return;
+  }
+  io.stdout(`id: ${node.id}
+status: ${node.status}
+${ssh === null ? "" : `${ssh}
+`}`);
+}
+async function runCreate(tokens, io, deps, config, bin) {
+  const prefix = `${bin} node create`;
+  const parsed = parseCreate(tokens);
+  if (!parsed.ok) {
+    io.stderr(`${prefix}: ${parsed.error}
+`);
+    return 1;
+  }
+  const { spec, sshKeyIds, name, freeTier, json } = parsed.args;
+  const created = await callApi(deps, config, "POST", "/api/nodes", {
+    profile: "sandbox",
+    spec,
+    sshKeyIds,
+    ...name === void 0 ? {} : { name },
+    ...freeTier ? { freeTier: true } : {}
+  });
+  if (!created.ok) {
+    io.stderr(`${prefix}: ${created.message}
+`);
+    return 1;
+  }
+  let node = toNode(created.body);
+  if (node === void 0) {
+    io.stderr(`${prefix}: the console response has no node id
+`);
+    return 1;
+  }
+  io.stderr(`${prefix}: node ${node.id} ${node.status}
+`);
+  const deadline = deps.now() + deps.timeoutMs;
+  while (node.status !== "running" && !FAILURE_STATUSES.has(node.status)) {
+    const remaining = deadline - deps.now();
+    if (remaining <= 0) {
+      printCreateResult(io, node, json);
+      io.stderr(`${prefix}: node ${node.id} is not running after 15 minutes \u2014 last status ${node.status}
+`);
+      return 1;
+    }
+    await deps.sleep(Math.min(deps.pollIntervalMs, remaining));
+    const polled = await callApi(deps, config, "GET", `/api/nodes/${encodeURIComponent(node.id)}`);
+    if (!polled.ok) {
+      io.stderr(`${prefix}: node ${node.id}: ${polled.message}
+`);
+      return 1;
+    }
+    const previous = node.status;
+    node = toNode(polled.body) ?? { ...node, status: "unknown" };
+    if (node.status !== previous) io.stderr(`${prefix}: node ${node.id} ${node.status}
+`);
+  }
+  printCreateResult(io, node, json);
+  if (node.status !== "running") {
+    io.stderr(`${prefix}: node ${node.id} failed \u2014 last status ${node.status}
+`);
+    return 1;
+  }
+  return 0;
+}
+function toNodeList(body) {
+  const record = asRecord(body);
+  const items = Array.isArray(body) ? body : record?.nodes ?? record?.data ?? record?.items;
+  if (!Array.isArray(items)) return [];
+  return items.flatMap((item) => toNode(item) ?? []);
+}
+async function runList(tokens, io, deps, config, bin) {
+  const prefix = `${bin} node list`;
+  const extra = tokens.find((token) => token !== "--json");
+  if (extra !== void 0) {
+    io.stderr(`${prefix}: ${extra.startsWith("-") ? "unknown flag" : "unexpected argument"} "${extra}"
+`);
+    return 1;
+  }
+  const listed = await callApi(deps, config, "GET", "/api/nodes");
+  if (!listed.ok) {
+    io.stderr(`${prefix}: ${listed.message}
+`);
+    return 1;
+  }
+  const rows = toNodeList(listed.body).map(({ id, name, profile, status, ipv4 }) => ({ id, name, profile, status, ipv4 }));
+  if (tokens.includes("--json")) {
+    io.stdout(`${JSON.stringify(rows)}
+`);
+    return 0;
+  }
+  if (rows.length === 0) {
+    io.stdout("no nodes\n");
+    return 0;
+  }
+  const table = [
+    ["ID", "NAME", "PROFILE", "STATUS", "IPV4"],
+    ...rows.map((row) => [row.id, row.name ?? "-", row.profile ?? "-", row.status, row.ipv4 ?? "-"])
+  ];
+  const widths = table[0].map((_, column) => Math.max(...table.map((cells) => cells[column].length)));
+  for (const cells of table) {
+    io.stdout(`${cells.map((cell3, column) => cell3.padEnd(widths[column])).join("  ").trimEnd()}
+`);
+  }
+  return 0;
+}
+async function runDelete(tokens, io, deps, config, bin) {
+  const prefix = `${bin} node delete`;
+  const flag = tokens.find((token) => token.startsWith("-") && token !== "--yes" && token !== "-y");
+  if (flag !== void 0) {
+    io.stderr(`${prefix}: unknown flag "${flag}"
+`);
+    return 1;
+  }
+  const ids = tokens.filter((token) => !token.startsWith("-"));
+  if (ids.length !== 1) {
+    io.stderr(`${prefix}: takes exactly one node id
+`);
+    return 1;
+  }
+  const [id] = ids;
+  const yes = tokens.includes("--yes") || tokens.includes("-y");
+  if (!yes && !await deps.confirm(`Destroy console node ${id}?`)) {
+    io.stderr(`${prefix}: aborted \u2014 node ${id} unchanged
+`);
+    return 1;
+  }
+  const deleted = await callApi(deps, config, "DELETE", `/api/nodes/${encodeURIComponent(id)}`);
+  if (!deleted.ok) {
+    io.stderr(
+      deleted.status === 403 ? `${prefix}: destroy needs the admin role in agro-console
+` : `${prefix}: ${deleted.message}
+`
+    );
+    return 1;
+  }
+  io.stdout(`deleted ${id}
+`);
+  return 0;
+}
+async function runNode(args, io, overrides = {}, bin = "agro") {
+  const [verb, ...rest] = args;
+  if (verb === void 0 || verb === "--help" || verb === "-h" || verb === "help") {
+    io.stdout(nodeHelp(bin));
+    return verb === void 0 ? 1 : 0;
+  }
+  if (!isOneOf(NODE_VERBS, verb)) {
+    io.stderr(`${bin} node: unknown subcommand "${verb}" \u2014 expected ${NODE_VERBS.join(", ")}
+`);
+    return 1;
+  }
+  if (rest.some((token) => token === "--help" || token === "-h")) {
+    io.stdout(nodeHelp(bin));
+    return 0;
+  }
+  const deps = { ...defaultDeps2(), ...overrides };
+  const config = resolveConsoleConfig(deps.env, deps.readSecret);
+  if (config === void 0) {
+    io.stderr(`${bin} node ${verb}: ${CONSOLE_CONFIG_MISSING}
+`);
+    return 1;
+  }
+  if (verb === "list") return runList(rest, io, deps, config, bin);
+  if (verb === "delete") return runDelete(rest, io, deps, config, bin);
+  return runCreate(rest, io, deps, config, bin);
+}
+
 // src/commands/harness.ts
 import { existsSync as existsSync20 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
@@ -4985,7 +5485,7 @@ function sourceDocsUrl(docsPath) {
 
 // src/lib/host-config.ts
 import { existsSync as existsSync18, mkdirSync as mkdirSync9, readFileSync as readFileSync12, renameSync as renameSync4, unlinkSync as unlinkSync6, writeFileSync as writeFileSync9 } from "node:fs";
-import { basename as basename7, dirname as dirname8, isAbsolute, join as join15, resolve as resolve10 } from "node:path";
+import { basename as basename8, dirname as dirname8, isAbsolute, join as join15, resolve as resolve10 } from "node:path";
 var HOST_CONFIG_MODE = 420;
 var HOST_CONFIG_FILE = "config.json";
 var WORKSPACES_SUBDIR = "workspaces";
@@ -5091,7 +5591,7 @@ function readHostConfig(env, home) {
   try {
     parsed = JSON.parse(raw);
   } catch {
-    throw new Error(`${basename7(path4)} is not valid JSON: ${path4}`);
+    throw new Error(`${basename8(path4)} is not valid JSON: ${path4}`);
   }
   return validateHostConfig(parsed);
 }
@@ -5453,6 +5953,19 @@ async function validateHermesHome(target, io, bin, user, inheritedHome, root = s
   }
   return result.exitCode;
 }
+async function seedHermes(target, io, bin, user, root = sandboxTargetRoot(target)) {
+  const result = await target.exec({
+    argv: remoteControlDirScript(root, "scripts/hermes-workspace.sh", ["seed", root, `${root}/.hermes`]),
+    env: hermesEnv(root),
+    ...user ? { user } : {},
+    stdio: "inherit"
+  });
+  if (result.exitCode !== 0) {
+    io.stderr(`${bin} harness: could not write the Hermes defaults to ${root}/.hermes/config.yaml (exit ${result.exitCode}); nothing was installed.
+`);
+  }
+  return result.exitCode;
+}
 async function configureHermes(target, io, bin, user, root = sandboxTargetRoot(target)) {
   const result = await target.exec({
     argv: remoteControlDirScript(root, "scripts/hermes-workspace.sh", [
@@ -5655,6 +6168,10 @@ Run: bash ${root}/.agro/scripts/link-providers.sh --init
     if (openclaw) openclawLaunch(io, root);
     return 0;
   }
+  if (hermes) {
+    const code = await seedHermes(target, io, bin, void 0, root);
+    if (code !== 0) return code;
+  }
   io.stdout(`${present && hasReceipt ? "updating" : "installing"} ${entry.title} on the host\u2026
 `);
   const r = await target.exec({
@@ -5863,6 +6380,10 @@ async function runHarnessInstall(name, opts, io) {
     io.stderr("docker is required to install into the running sandbox but was not found on PATH\n");
     return 1;
   }
+  if (hermes) {
+    const code = await seedHermes(target, io, opts.bin, "sandbox");
+    if (code !== 0) return code;
+  }
   if (already && await sandboxMarkerExists(target, entry)) {
     io.stdout(`updating ${entry.title} in the sandbox\u2026
 `);
@@ -6305,6 +6826,54 @@ install -d -m 0700 "$HOME/.tailscale"`
     ]),
     docsPath: TOOLS_DOC
   }),
+  Object.freeze({
+    id: "ffmpeg",
+    title: "FFmpeg + FFprobe",
+    kind: "installable",
+    binary: "ffmpeg",
+    verifyArgv: Object.freeze(["bash", "-lc", "command -v ffmpeg >/dev/null && command -v ffprobe >/dev/null"]),
+    versionArgv: Object.freeze(["ffmpeg", "-version"]),
+    installArgv: Object.freeze([
+      "bash",
+      "-lc",
+      [
+        "set -e",
+        "release=b6.1.1",
+        'case "$(dpkg --print-architecture)" in',
+        "  amd64) arch=x64; ffmpeg_sha=bfe8a8fc511530457b528c48d77b5737527b504a3797a9bc4866aeca69c2dffa; ffprobe_sha=25d9b6ccb05e3d9de9e04e31e2506d8dd7f9f0418981965ac6df12e8d3afd067 ;;",
+        "  arm64) arch=arm64; ffmpeg_sha=754a678672298bc68156adff58aa7385a592c2b30b1d0ae8750c45c915c4bac0; ffprobe_sha=2ab6aba60ee84412dff9188720703376cb4e7aaf7e0b5e43aa8249f2acae5bf8 ;;",
+        '  *) echo "no pinned FFmpeg build for $(dpkg --print-architecture)" >&2; exit 1 ;;',
+        "esac",
+        'prefix="${NPM_USER_PREFIX:-$HOME/.local}"',
+        'tmp="$(mktemp -d)"',
+        `trap 'rm -rf "$tmp"' EXIT`,
+        "for name in ffmpeg ffprobe; do",
+        '  curl -fsSL "https://github.com/eugeneware/ffmpeg-static/releases/download/$release/$name-linux-$arch.gz" -o "$tmp/$name.gz"',
+        "done",
+        'echo "$ffmpeg_sha  $tmp/ffmpeg.gz" | sha256sum -c -',
+        'echo "$ffprobe_sha  $tmp/ffprobe.gz" | sha256sum -c -',
+        'install -d "$prefix/bin"',
+        "for name in ffmpeg ffprobe; do",
+        '  gzip -dc "$tmp/$name.gz" > "$tmp/$name"',
+        '  install -m 0755 "$tmp/$name" "$prefix/bin/$name"',
+        "done",
+        '"$prefix/bin/ffprobe" -version >/dev/null',
+        'if ! "$prefix/bin/ffmpeg" -hide_banner -encoders | grep -qw libx264; then',
+        '  echo "$prefix/bin/ffmpeg lists no libx264 encoder" >&2',
+        "  exit 1",
+        "fi"
+      ].join("\n")
+    ]),
+    installUser: "sandbox",
+    hostCapable: true,
+    uninstallArgv: Object.freeze([
+      "rm",
+      "-rf",
+      `${HARNESS_PREFIX_TOKEN}/bin/ffmpeg`,
+      `${HARNESS_PREFIX_TOKEN}/bin/ffprobe`
+    ]),
+    docsPath: TOOLS_DOC
+  }),
   Object.freeze({
     id: "docker-engine",
     title: "Docker Engine + Compose",
@@ -7098,35 +7667,6 @@ function fetchRemoteSource(opts) {
   return opts.destDir;
 }
 
-// src/command-table.ts
-var CONFIG_VERBS = ["show", "set", "repo"];
-var CONFIG_INTEGRATIONS = ["langfuse"];
-var SECRET_VERBS = ["set", "list"];
-var LANGFUSE_VERBS = ["apply", "status", "disable"];
-var SANDBOX_SUBCOMMANDS = ["install", "list", "upgrade"];
-var WORKSPACE_SUBCOMMANDS = ["create", "list"];
-var HARNESS_SUBCOMMANDS = ["list", "install", "status", "uninstall"];
-var TOOL_SUBCOMMANDS = ["list", "install", "status", "uninstall"];
-function isOneOf(values, value) {
-  return value !== void 0 && values.includes(value);
-}
-var AGRO_COMMANDS = Object.freeze({
-  config: [...CONFIG_VERBS, ...CONFIG_INTEGRATIONS],
-  secret: SECRET_VERBS,
-  langfuse: LANGFUSE_VERBS,
-  update: null,
-  "self-upgrade": null,
-  vendor: null,
-  sandbox: SANDBOX_SUBCOMMANDS,
-  shell: null,
-  compose: null,
-  workspace: WORKSPACE_SUBCOMMANDS,
-  harness: HARNESS_SUBCOMMANDS,
-  tool: TOOL_SUBCOMMANDS,
-  gateway: null,
-  ...Object.fromEntries(composeVerbs().map((verb) => [verb, null]))
-});
-
 // src/cli.ts
 var DEFAULT_SOURCE_CONTROL_DIR = resolve13(
   dirname10(fileURLToPath(import.meta.url)),
@@ -7161,7 +7701,7 @@ Usage:
   ${bin} sandbox <args...>      Create, list, and upgrade sandboxes (install|list|upgrade)
   ${bin} shell [name]           Open a zsh shell in the running sandbox container
   ${bin} config <args...>       Read and write ${stateNames(bin).configFile} (show|set), or run a wizard
-  ${bin} secret <args...>       Read and write the gitignored root .env (set|list)
+  ${bin} secret <args...>       Read and write the gitignored root .env (set|get|list)
   ${bin} langfuse <args...>     Render, check, or disable Langfuse tracing files (apply|status|disable)
   ${bin} self-upgrade           Upgrade the installed ${bin} CLI
   ${bin} vendor                 Vendor or upgrade the ${stateNames(bin).controlDir}/ control plane
@@ -7171,7 +7711,9 @@ Usage:
   ${bin} ps [name]              Show sandbox service status
   ${bin} destroy [name]         Remove the sandbox and wipe its named volumes
   ${bin} compose config         Print the resolved docker compose configuration
+  ${bin} egress <args...>       Read the egress proxy log or reload its allowlist (log|reload)
   ${bin} workspace <args...>    Create and list host AGRO workspaces (create|list)
+  ${bin} node <args...>         Manage remote agro-console sandbox nodes (create|list|delete)
   ${bin} harness <args...>      Install and inspect agent CLI harnesses
   ${bin} tool <args...>         Install and inspect sandbox tooling
   ${bin} gateway <args...>      Manage a messaging client session (pi|hermes|openclaw)
@@ -7214,14 +7756,16 @@ function printSecretHelp(bin = AGRO_PRODUCT.bin) {
 
 Usage:
   ${bin} secret set <KEY> [--sandbox <name>]   Prompt for the value (input hidden)
+  ${bin} secret get <KEY> [--sandbox <name>]   Print the raw value
   ${bin} secret list [--sandbox <name>]        List the keys that hold a value
 
-Without --sandbox both verbs write the equipped project root; with it they write
-the registry entry \`${bin} sandbox list\` names.
+Without --sandbox all three verbs act on the equipped project root; with it they
+act on the registry entry \`${bin} sandbox list\` names.
 
 The value is never read from the command line \u2014 an argument would land in your
-shell history. \`${bin} secret list\` never prints a raw value. .env is mode 0600 and
-gitignored; every non-secret setting belongs in ${stateNames(bin).configFile} (\`${bin} config set\`).
+shell history. \`${bin} secret get\` is the only command that prints a raw value;
+\`${bin} secret list\` never does. .env is mode 0600 and gitignored; every non-secret
+setting belongs in ${stateNames(bin).configFile} (\`${bin} config set\`).
 
 Keys:
 ${secretKeyList()}
@@ -7236,7 +7780,7 @@ Usage:
   ${bin} langfuse disable   Set langfuse.enabled=false, delete the credential fragment, rewrite the files
 
 \`${bin} config langfuse\` is the interactive wizard that writes these settings.
-\`apply\` never prompts and never installs anything; bootstrap, systemd, and cron run it.
+\`apply\` never prompts and never installs anything; the bootstrap runs it.
 It reads langfuse.* from ${stateNames(bin).configFile} and the keys from the gitignored .env,
 and writes nothing when langfuse.enabled is not true. The generated files live in the
 sandbox home, so \`apply\` and \`disable\` refuse to touch them from the host.
@@ -7279,7 +7823,7 @@ Flags:
   --dry-run       Report the installation kind, target, and versions without
                   changing anything.
 
-Project payload vendoring (${stateNames(bin).controlDir}/ + crons/) is \`${bin} vendor\`; its --from,
+Project payload vendoring (${stateNames(bin).controlDir}/) is \`${bin} vendor\`; its --from,
 --from-remote, --ref and --force flags are not accepted here.
 `);
 }
@@ -7289,7 +7833,7 @@ function printVendorHelp(bin = AGRO_PRODUCT.bin) {
 Usage:
   ${bin} vendor [--from <dir> | --from-remote [--ref <ref>]] [--dry-run] [--force]
 
-Writes ONLY the ${stateNames(bin).controlDir}/ control plane and crons/ (skills, scripts, CLI) into the
+Writes ONLY the ${stateNames(bin).controlDir}/ control plane (skills, scripts, CLI) into the
 current directory. An empty directory is equipped from scratch; everything else
 in your project is left untouched \u2014 it writes no ${stateNames(bin).configFile}, .env, AGENTS.md,
 .gitignore or .devcontainer/.
@@ -7488,6 +8032,38 @@ Flags:
 See ${sourceDocsUrl("docs/lifecycle-commands.md")} for the full mapping.
 `);
 }
+function printEgressHelp(bin = AGRO_PRODUCT.bin) {
+  process.stdout.write(`${bin} egress \u2014 Read the egress proxy log or reload its allowlist
+
+Usage:
+  ${bin} egress log [name]      Print the last ${EGRESS_LOG_LINES} lines of the proxy access log; prefix denied lines with DENIED
+  ${bin} egress reload [name]   Rewrite egress-allow.txt and send the proxy \`squid -k reconfigure\`
+
+Both verbs run ${stateNames(bin).controlDir}/scripts/docker-compose.sh \`exec proxy\` in the sandbox entry.
+The log is ${EGRESS_LOG_PATH} in the proxy container. \`reload\` keeps the sandbox running.
+Both verbs need a docker sandbox with access.egress allowlist; any other sandbox exits 1.
+[name] is a sandbox entry from \`${bin} sandbox list\`; with exactly one registered sandbox it can be omitted.
+
+See ${sourceDocsUrl("docs/lifecycle-commands.md")} for every verb.
+`);
+}
+function parseEgressArgs(rest, bin = AGRO_PRODUCT.bin) {
+  if (rest.length === 0 || isHelpFlag2(rest[0])) return { ok: true, args: { help: true } };
+  const [head, ...tail] = rest;
+  if (!isOneOf(EGRESS_VERBS, head)) {
+    return {
+      ok: false,
+      error: `${bin} egress: unknown subcommand "${head}" \u2014 expected ${EGRESS_VERBS.join(" or ")}`,
+      showHelp: true
+    };
+  }
+  if (isHelpFlag2(tail[0])) return { ok: true, args: { help: true } };
+  if (tail.length > 0 && tail[0].startsWith("-")) {
+    return { ok: false, error: `${bin} egress ${head}: unknown flag "${tail[0]}"` };
+  }
+  if (tail.length > 1) return { ok: false, error: `${bin} egress ${head}: unexpected argument "${tail[1]}"` };
+  return { ok: true, args: tail.length === 0 ? { help: false, verb: head } : { help: false, verb: head, name: tail[0] } };
+}
 function printComposeHelp(bin = AGRO_PRODUCT.bin) {
   process.stdout.write(`${bin} compose \u2014 Inspect the resolved docker compose setup
 
@@ -7603,7 +8179,7 @@ function parseSecretArgs(input, bin = AGRO_PRODUCT.bin) {
   if (!SECRET_VERBS.includes(head)) {
     return {
       ok: false,
-      error: `${bin} secret: unknown subcommand "${head}" \u2014 expected set or list`,
+      error: `${bin} secret: unknown subcommand "${head}" \u2014 expected set, list, or get`,
       showHelp: true
     };
   }
@@ -7617,12 +8193,12 @@ function parseSecretArgs(input, bin = AGRO_PRODUCT.bin) {
   }
   const [key, ...extra] = tail;
   if (key === void 0) {
-    return { ok: false, error: `${bin} secret set: a key is required`, showHelp: true };
+    return { ok: false, error: `${bin} secret ${verb}: a key is required`, showHelp: true };
   }
   if (extra.length > 0) {
     return {
       ok: false,
-      error: `${bin} secret set: takes only a key \u2014 the value is prompted for, never passed on the command line where your shell history would keep it`
+      error: verb === "get" ? `${bin} secret get: takes only a key` : `${bin} secret set: takes only a key \u2014 the value is prompted for, never passed on the command line where your shell history would keep it`
     };
   }
   return { ok: true, args: { ...args, verb, key } };
@@ -8095,6 +8671,7 @@ async function main(argv) {
     };
     const scope = a.sandbox === void 0 ? { bin } : { bin, sandbox: a.sandbox };
     if (a.verb === "list") return await runSecretList(scope, io);
+    if (a.verb === "get") return await runSecretGet(a.key, scope, io);
     return await runSecretSet(a.key, scope, io);
   }
   if (first === "langfuse") {
@@ -8219,6 +8796,29 @@ async function main(argv) {
     }
     return runComposeConfig({ bin }, parsed.args.passthrough);
   }
+  if (first === "egress") {
+    const parsed = parseEgressArgs(argv.slice(1), bin);
+    if (!parsed.ok) {
+      process.stderr.write(`${parsed.error}
+`);
+      if (parsed.showHelp) printEgressHelp(bin);
+      return 1;
+    }
+    const a = parsed.args;
+    if (a.help || a.verb === void 0) {
+      printEgressHelp(bin);
+      return second === void 0 ? 1 : 0;
+    }
+    return runEgress(a.verb, a.name === void 0 ? { bin } : { bin, name: a.name }, lifecycleIo());
+  }
+  if (first === "node") {
+    return await runNode(
+      argv.slice(1),
+      { stdout: (s) => process.stdout.write(s), stderr: (s) => process.stderr.write(s) },
+      {},
+      bin
+    );
+  }
   if (first === "workspace") {
     const parsed = parseWorkspaceArgs(argv.slice(1), bin);
     if (!parsed.ok) {
@@ -8400,6 +9000,7 @@ export {
   parseComposeArgs,
   parseConfigArgs,
   parseDestroyArgs,
+  parseEgressArgs,
   parseGatewayArgs,
   parseHarnessArgs,
   parseLangfuseArgs,
@@ -8414,6 +9015,7 @@ export {
   printComposeHelp,
   printComposeVerbHelp,
   printDestroyHelp,
+  printEgressHelp,
   printGatewayHelp,
   printHarnessHelp,
   printLangfuseHelp,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mifune/agro",
-  "version": "0.20.0",
+  "version": "0.22.0",
   "description": "AGRO CLI — create and manage sandboxes for coding agents.",
   "license": "Apache-2.0",
   "homepage": "https://github.com/mifunedev/agro#readme",