@seekrit/cli 0.42.0 → 0.44.0

package/dist/index.js

@@ -1,14 +1,18 @@
 #!/usr/bin/env node
 import { spawn, spawnSync } from "node:child_process";
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { z } from "zod";
 import { Command } from "commander";
-import { homedir, hostname, tmpdir, userInfo } from "node:os";
-import { dirname, join, parse } from "node:path";
+import { arch, homedir, hostname, platform, tmpdir, userInfo } from "node:os";
+import { dirname, join, parse, resolve } from "node:path";
 import { createInterface } from "node:readline";
 import { Writable } from "node:stream";
 import { createHash } from "node:crypto";
-//#region ../../packages/core/src/agent-policy.ts
+/** Default lifetime of a published bundle (7 days), in seconds. */
+const POLICY_DEFAULT_TTL_SECONDS = 10080 * 60;
+/** Bounds on a bundle's lifetime: an hour at the short end, 90 days at the long. */
+const POLICY_MIN_TTL_SECONDS = 3600;
+const POLICY_MAX_TTL_SECONDS = 2160 * 60 * 60;
 /** A bare hostname: no scheme, no port, no path, no wildcard. */
 const policyHostSchema = z.string().trim().min(1).max(253).toLowerCase().refine((h) => !/[:/\s*]/.test(h), { message: "host must be a bare hostname (no scheme, port, path, or wildcard)" }).refine((h) => /^[a-z0-9.-]+$/.test(h), { message: "host contains invalid characters" });
 const policyMethodSchema = z.string().trim().toUpperCase().regex(/^[A-Z]{3,10}$/, "method must be an HTTP method name");
@@ -18,7 +22,7 @@ const policyMethodSchema = z.string().trim().toUpperCase().regex(/^[A-Z]{3,10}$/
 */
 const policyPathSchema = z.string().trim().min(1).max(512).startsWith("/", "path pattern must start with /").refine((p) => !p.includes("?"), { message: "path patterns match the path only, not the query" });
 const policySecretNameSchema = z.string().trim().regex(/^[A-Za-z0-9_]+$/, "secret names are letters, digits, and underscores");
-z.object({
+const agentPolicyRuleSchema = z.object({
 	host: policyHostSchema,
 	methods: z.array(policyMethodSchema).max(16).default([]),
 	paths: z.array(policyPathSchema).max(64).default([]),
@@ -45,6 +49,519 @@ z.object({
 	path: z.string().trim().min(1).max(2048),
 	secret: policySecretNameSchema.optional()
 });
+/**
+* Serialize a bundle to the exact bytes that get signed and transported.
+*
+* Explicit field order rather than a generic sorted-key walk: the field list is
+* the format, and a reviewer should be able to read it here. Optional fields are
+* omitted rather than emitted as `null`, and empty `methods`/`paths`/`allow`
+* arrays are kept, since their emptiness is meaningful (any/any/none).
+*/
+function canonicalizeAgentPolicy(bundle) {
+	const rules = bundle.rules.map((rule) => {
+		const out = {
+			host: rule.host.trim().toLowerCase(),
+			methods: rule.methods.map((m) => m.trim().toUpperCase()).sort(),
+			paths: rule.paths.map((p) => p.trim()),
+			allow: [...rule.allow].sort()
+		};
+		if (rule.label?.trim()) out.label = rule.label.trim();
+		return out;
+	});
+	return JSON.stringify({
+		v: bundle.v,
+		org: bundle.org,
+		agent: bundle.agent,
+		agent_slug: bundle.agent_slug,
+		policy_version: bundle.policy_version,
+		issued_at: bundle.issued_at,
+		expires_at: bundle.expires_at,
+		rules,
+		signer: {
+			kid: bundle.signer.kid,
+			jwk: {
+				crv: bundle.signer.jwk.crv,
+				kty: bundle.signer.jwk.kty,
+				x: bundle.signer.jwk.x,
+				y: bundle.signer.jwk.y
+			}
+		}
+	});
+}
+/**
+* RFC 7638 JWK thumbprint (SHA-256, base64url, no padding) — the identifier an
+* operator pins in the proxy's TOML.
+*/
+async function policySignerThumbprint(jwk) {
+	const canonical = JSON.stringify({
+		crv: jwk.crv,
+		kty: jwk.kty,
+		x: jwk.x,
+		y: jwk.y
+	});
+	const digest = await crypto.subtle.digest("SHA-256", utf8(canonical));
+	return base64url(new Uint8Array(digest));
+}
+/**
+* Sign a draft bundle with the publishing admin's key, returning the `ap1.`
+* envelope to hand to the API.
+*
+* `privateKey` must be an ECDSA P-256 key with the `sign` usage — in the
+* dashboard that is the signed-in admin's existing principal key, re-imported
+* for signing (`importPolicySigningKey` in `@seekrit/crypto`). No new key
+* material is involved, which is what makes this shippable without a second
+* passphrase-protected keypair to manage.
+*/
+async function signAgentPolicy(privateKey, signerJwk, draft) {
+	const kid = await policySignerThumbprint(signerJwk);
+	const bytes = utf8(canonicalizeAgentPolicy({
+		...draft,
+		signer: {
+			kid,
+			jwk: signerJwk
+		}
+	}));
+	const sig = new Uint8Array(await crypto.subtle.sign({
+		name: "ECDSA",
+		hash: "SHA-256"
+	}, privateKey, bytes));
+	return [
+		"ap1",
+		base64url(bytes),
+		base64url(sig)
+	].join(".");
+}
+/** A structurally invalid, unverifiable, or expired bundle. */
+var AgentPolicyError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "AgentPolicyError";
+	}
+};
+/**
+* Read a bundle **without** verifying its signature — for display only.
+*
+* Named to be hard to misuse: anything that acts on policy must go through
+* {@link verifyAgentPolicy} (or the Rust verifier). The dashboard uses this to
+* render version history it fetched from the API, where the trust question is
+* already settled differently: the API is the one showing you the list.
+*/
+function parseAgentPolicyUnverified(envelope) {
+	const parts = envelope.trim().split(".");
+	if (parts.length !== 3 || parts[0] !== "ap1") throw new AgentPolicyError(`not a policy bundle (expected a ap1. envelope)`);
+	let body;
+	try {
+		body = JSON.parse(utf8Decode$1(fromBase64url(parts[1])));
+	} catch (e) {
+		throw new AgentPolicyError(`policy bundle body is unreadable: ${e.message}`);
+	}
+	if (body?.v !== 1) throw new AgentPolicyError(`unsupported policy bundle version ${String(body?.v)}`);
+	if (!Array.isArray(body.rules) || !body.signer?.jwk) throw new AgentPolicyError("policy bundle is missing rules or signer");
+	return body;
+}
+/**
+* Match a request path against a glob pattern: `*` matches within one segment,
+* `**` matches any number of segments (including none, so `/v1/**` covers
+* `/v1`). Case-sensitive, and the query string never participates.
+*/
+function matchPolicyPath(pattern, path) {
+	const bare = path.split("?")[0] ?? path;
+	return matchSegments(pattern.split("/"), bare.split("/"));
+}
+function matchSegments(pattern, segments) {
+	if (pattern.length === 0) return segments.length === 0;
+	const [head, ...rest] = pattern;
+	if (head === "**") {
+		for (let skip = 0; skip <= segments.length; skip++) if (matchSegments(rest, segments.slice(skip))) return true;
+		return false;
+	}
+	if (segments.length === 0) return false;
+	return matchSegment(head, segments[0]) && matchSegments(rest, segments.slice(1));
+}
+function matchSegment(pattern, segment) {
+	if (!pattern.includes("*")) return pattern === segment;
+	const parts = pattern.split("*");
+	let rest = segment;
+	for (let i = 0; i < parts.length; i++) {
+		const part = parts[i];
+		if (part === "") continue;
+		if (i === 0) {
+			if (!rest.startsWith(part)) return false;
+			rest = rest.slice(part.length);
+		} else if (i === parts.length - 1) return rest.length >= part.length && rest.endsWith(part);
+		else {
+			const at = rest.indexOf(part);
+			if (at === -1) return false;
+			rest = rest.slice(at + part.length);
+		}
+	}
+	return true;
+}
+function ruleCoversMethod(rule, method) {
+	if (rule.methods.length === 0) return true;
+	const wanted = method.trim().toUpperCase();
+	return rule.methods.some((m) => m.trim().toUpperCase() === wanted);
+}
+function ruleCoversPath(rule, path) {
+	if (rule.paths.length === 0) return true;
+	return rule.paths.some((p) => matchPolicyPath(p, path));
+}
+/**
+* Decide a request against an ordered rule set, first match wins — the same
+* evaluation `RuleSet::decide` performs in the proxy, including which rule
+* decided and *why* a refusal happened. Naming the constraint matters: a
+* default-deny policy fails in exactly the confusing direction.
+*/
+function evaluatePolicy(rules, query) {
+	const host = query.host.trim().toLowerCase();
+	let hostMatched = false;
+	let pathMatchedIndex = null;
+	for (let i = 0; i < rules.length; i++) {
+		const rule = rules[i];
+		if (rule.host.trim().toLowerCase() !== host) continue;
+		hostMatched = true;
+		const pathsOk = ruleCoversPath(rule, query.path);
+		if (pathsOk && ruleCoversMethod(rule, query.method)) {
+			if (query.secret !== void 0 && !rule.allow.includes(query.secret)) return {
+				decision: "secret_not_allowed",
+				ruleIndex: i
+			};
+			return {
+				decision: "allow",
+				ruleIndex: i
+			};
+		}
+		if (pathsOk && pathMatchedIndex === null) pathMatchedIndex = i;
+	}
+	if (pathMatchedIndex !== null) return {
+		decision: "method_not_allowed",
+		ruleIndex: pathMatchedIndex
+	};
+	return {
+		decision: hostMatched ? "path_not_allowed" : "no_rule",
+		ruleIndex: null
+	};
+}
+/** A one-line, human-readable reason for a verdict — shared by UI and API. */
+function describePolicyVerdict(verdict, rules) {
+	const rule = verdict.ruleIndex === null ? null : rules[verdict.ruleIndex];
+	switch (verdict.decision) {
+		case "allow": return `permitted by rule ${(verdict.ruleIndex ?? 0) + 1}${rule?.label ? ` (${rule.label})` : ""}`;
+		case "no_rule": return "no rule covers this host";
+		case "method_not_allowed": return `rule ${(verdict.ruleIndex ?? 0) + 1} covers this path but not this method`;
+		case "path_not_allowed": return "this host has rules, but none cover this path";
+		case "secret_not_allowed": return `rule ${(verdict.ruleIndex ?? 0) + 1} permits the request but not this secret`;
+	}
+}
+/** Every host a rule set names — what a forward proxy would intercept. */
+function policyHosts(rules) {
+	return [...new Set(rules.map((r) => r.host.trim().toLowerCase()))].sort();
+}
+function diffPolicyRules(before, after) {
+	const out = [];
+	const same = (a, b) => JSON.stringify(normalizeRule(a)) === JSON.stringify(normalizeRule(b));
+	for (let i = 0; i < Math.max(before.length, after.length); i++) {
+		const b = before[i];
+		const a = after[i];
+		if (b && a) out.push({
+			kind: same(b, a) ? "unchanged" : "changed",
+			index: i,
+			before: b,
+			after: a
+		});
+		else if (a) out.push({
+			kind: "added",
+			index: i,
+			after: a
+		});
+		else if (b) out.push({
+			kind: "removed",
+			index: i,
+			before: b
+		});
+	}
+	return out;
+}
+function normalizeRule(rule) {
+	return {
+		host: rule.host.trim().toLowerCase(),
+		methods: rule.methods.map((m) => m.toUpperCase()).sort(),
+		paths: [...rule.paths],
+		allow: [...rule.allow].sort(),
+		label: rule.label?.trim() || void 0
+	};
+}
+function utf8(text) {
+	return new TextEncoder().encode(text);
+}
+function utf8Decode$1(bytes) {
+	return new TextDecoder().decode(bytes);
+}
+function base64url(bytes) {
+	let binary = "";
+	for (const b of bytes) binary += String.fromCharCode(b);
+	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function fromBase64url(text) {
+	const padded = text.replace(/-/g, "+").replace(/_/g, "/");
+	const binary = atob(padded + "=".repeat((4 - padded.length % 4) % 4));
+	const out = new Uint8Array(binary.length);
+	for (let i = 0; i < binary.length; i++) out[i] = binary.charCodeAt(i);
+	return out;
+}
+/** One aggregated cell: a dimension tuple and how many times it happened. */
+const activityEntrySchema = z.object({
+	host: policyHostSchema,
+	method: policyMethodSchema,
+	decision: z.enum([
+		"allow",
+		"no_rule",
+		"method_not_allowed",
+		"path_not_allowed",
+		"secret_not_allowed",
+		"unknown_secret",
+		"ratchet_withdrawn",
+		"policy_unavailable"
+	]),
+	/**
+	* Which published rule decided, when one did. Null for refusals that never
+	* reached a rule (`no_rule`, `policy_unavailable`) — the distinction matters to
+	* a review, because "rule 3 refused this" and "nothing covered this" call for
+	* opposite changes.
+	*/
+	ruleIndex: z.number().int().min(0).max(255).nullable(),
+	count: z.number().int().min(1).max(1e6),
+	/**
+	* Secret names actually injected, name → count. Only meaningful on `allow`.
+	* This is what lets a review say "rule 2 permits three secrets and the agent
+	* has only ever used one" — the most useful narrowing there is, and impossible
+	* to see from policy alone.
+	*/
+	secrets: z.record(policySecretNameSchema, z.number().int().min(1)).optional()
+});
+z.object({
+	/** Start of the window these counts cover (ISO 8601). */
+	windowStart: z.string().trim().min(20).max(40),
+	/** Policy version in force while they were collected, for the ledger. */
+	policyVersion: z.number().int().min(0).optional(),
+	/**
+	* Capped so one report cannot be unbounded work. A proxy with more distinct
+	* cells than this in a window has a policy far broader than a review can help
+	* with, and truncating loudly beats accepting anything.
+	*/
+	entries: z.array(activityEntrySchema).min(1).max(500)
+});
+//#endregion
+//#region ../../packages/core/src/agent-review.ts
+function emptyStats() {
+	return {
+		allows: 0,
+		denials: 0,
+		methods: /* @__PURE__ */ new Set(),
+		secrets: /* @__PURE__ */ new Set()
+	};
+}
+/**
+* Compare an agent's live rules against what it actually did.
+*
+* Returns proposals ordered narrowing-first, because that is the order they
+* should be read in: the safe changes, then the ones needing a judgment call.
+*/
+function reviewPolicy(input) {
+	const { rules, activity } = input;
+	const byRule = /* @__PURE__ */ new Map();
+	/** Hosts refused with no rule to attribute it to → candidates for widening. */
+	const uncovered = /* @__PURE__ */ new Map();
+	for (const row of activity) {
+		if (row.ruleIndex === null) {
+			if (row.decision === "no_rule" || row.decision === "path_not_allowed") {
+				const entry = uncovered.get(row.host) ?? {
+					denials: 0,
+					methods: /* @__PURE__ */ new Set()
+				};
+				entry.denials += row.count;
+				entry.methods.add(row.method);
+				uncovered.set(row.host, entry);
+			}
+			continue;
+		}
+		const stats = byRule.get(row.ruleIndex) ?? emptyStats();
+		if (row.decision === "allow") {
+			stats.allows += row.count;
+			stats.methods.add(row.method);
+			for (const name of Object.keys(row.secrets ?? {})) stats.secrets.add(name);
+		} else stats.denials += row.count;
+		byRule.set(row.ruleIndex, stats);
+	}
+	const narrowing = [];
+	const widening = [];
+	/**
+	* Did this agent demonstrably do anything in the window?
+	*
+	* This is what licenses a conclusion from *absence*. With permitted traffic on
+	* the record, a rule that never came up is unused. With none, the window says
+	* nothing about any rule, and every proposal below would be noise.
+	*/
+	const workedAtAll = [...byRule.values()].some((s) => s.allows > 0);
+	for (const [index, rule] of rules.entries()) {
+		const stats = byRule.get(index);
+		if (!stats) {
+			if (workedAtAll) narrowing.push({
+				kind: "remove_rule",
+				ruleIndex: index,
+				host: rule.host,
+				evidence: {
+					allows: 0,
+					denials: 0,
+					observations: 0
+				},
+				rationale: `rule ${index + 1} (${rule.host}) never matched a request, while other rules did`,
+				applicable: true
+			});
+			continue;
+		}
+		const evidence = {
+			allows: stats.allows,
+			denials: stats.denials,
+			observations: stats.allows + stats.denials
+		};
+		if (stats.allows === 0) {
+			narrowing.push({
+				kind: "remove_rule",
+				ruleIndex: index,
+				host: rule.host,
+				evidence,
+				rationale: stats.denials > 0 ? `rule ${index + 1} (${rule.host}) authorized nothing in this window and refused ${stats.denials} — it may be misconfigured rather than unused` : `rule ${index + 1} (${rule.host}) authorized nothing in this window`,
+				applicable: true
+			});
+			continue;
+		}
+		const unusedSecrets = rule.allow.filter((name) => !stats.secrets.has(name));
+		if (unusedSecrets.length > 0) narrowing.push({
+			kind: "remove_secret",
+			ruleIndex: index,
+			host: rule.host,
+			names: unusedSecrets,
+			evidence,
+			rationale: `rule ${index + 1} (${rule.host}) permits ${unusedSecrets.join(", ")}, never injected in ${stats.allows} permitted request(s)`,
+			applicable: true
+		});
+		const unusedMethods = rule.methods.filter((m) => !stats.methods.has(m.toUpperCase()));
+		if (rule.methods.length > 0 && unusedMethods.length > 0) narrowing.push({
+			kind: "narrow_methods",
+			ruleIndex: index,
+			host: rule.host,
+			names: unusedMethods,
+			evidence,
+			rationale: `rule ${index + 1} (${rule.host}) permits ${unusedMethods.join(", ")}, never used in ${stats.allows} permitted request(s)`,
+			applicable: true
+		});
+	}
+	for (const [host, entry] of uncovered) widening.push({
+		kind: "widen",
+		ruleIndex: null,
+		host,
+		names: [...entry.methods].sort(),
+		evidence: {
+			allows: 0,
+			denials: entry.denials,
+			observations: entry.denials
+		},
+		rationale: `${entry.denials} request(s) to ${host} matched no rule (${[...entry.methods].sort().join(", ")}) — the agent wants this and cannot have it`,
+		applicable: false
+	});
+	narrowing.sort((a, b) => (a.ruleIndex ?? 0) - (b.ruleIndex ?? 0));
+	widening.sort((a, b) => b.evidence.denials - a.evidence.denials);
+	return [...narrowing, ...widening];
+}
+/**
+* Apply the accepted narrowing proposals, returning a new rule list.
+*
+* Pure and total: the input rules are untouched, and anything not applicable is
+* skipped rather than throwing, so a caller can pass the whole review back.
+*
+* Rule *positions* shift when one is removed, which matters because order decides
+* (first match wins). Removals are therefore applied last, after the by-index
+* edits, so an index in a proposal always refers to the policy the review was
+* computed against.
+*/
+function applyProposals(rules, accepted) {
+	const applicable = accepted.filter((p) => p.applicable && p.ruleIndex !== null);
+	const next = rules.map((rule) => ({
+		...rule,
+		methods: [...rule.methods],
+		paths: [...rule.paths],
+		allow: [...rule.allow]
+	}));
+	for (const proposal of applicable) {
+		const index = proposal.ruleIndex;
+		const rule = next[index];
+		if (!rule) continue;
+		if (proposal.kind === "remove_secret") {
+			const drop = new Set(proposal.names ?? []);
+			rule.allow = rule.allow.filter((name) => !drop.has(name));
+		} else if (proposal.kind === "narrow_methods") {
+			const drop = new Set((proposal.names ?? []).map((m) => m.toUpperCase()));
+			rule.methods = rule.methods.filter((m) => !drop.has(m.toUpperCase()));
+			if (rule.methods.length === 0) rule.methods = [...rules[index]?.methods ?? []];
+		}
+	}
+	const removed = new Set(applicable.filter((p) => p.kind === "remove_rule").map((p) => p.ruleIndex));
+	return next.filter((_, index) => !removed.has(index));
+}
+/** How many of a review's proposals `applyProposals` would act on. */
+function countApplicable(proposals) {
+	return proposals.filter((p) => p.applicable).length;
+}
+/**
+* Twelve hours, matching `[control] max_ttl` in a proxy config. A task is meant
+* to bound one run; something that needs longer wants a policy change, not a
+* longer ticket.
+*/
+const TASK_MAX_TTL_SECONDS = 720 * 60;
+/** An EC P-256 public JWK, for a sender-constraint proof key. */
+const taskProofJwkSchema = z.object({
+	kty: z.literal("EC"),
+	crv: z.literal("P-256"),
+	x: z.string().min(1).max(128),
+	y: z.string().min(1).max(128)
+});
+z.object({
+	/**
+	* The public `skd_…` segment of the minted token. Sent because the API never
+	* sees the token at dispatch and still needs a readable handle for the audit
+	* row and for a revoke to name — the id half of a credential, without the
+	* secret half.
+	*/
+	taskRef: z.string().trim().regex(/^skd_[0-9A-Za-z]+$/, "taskRef must be the skd_… segment of the minted token"),
+	/**
+	* SHA-256 (base64url) of the token the dispatcher minted. The token itself
+	* never reaches this API on the dispatch path — only on introspection, where
+	* it is hashed and discarded.
+	*/
+	tokenHash: z.string().trim().min(16).max(128),
+	/**
+	* Secret names this run may use. Omit for "whatever the agent's policy
+	* allows" — mirroring `Session.scopes: Option<BTreeSet<String>>` in the proxy,
+	* so absent means unnarrowed in both places.
+	*/
+	scopes: z.array(policySecretNameSchema).max(64).optional(),
+	ttlSeconds: z.number().int().min(60).max(TASK_MAX_TTL_SECONDS).optional(),
+	/**
+	* What this run is for, for the audit row and the operator's task list. Free
+	* text, and **not** a security input: never put a secret value in it.
+	*/
+	label: z.string().trim().max(200).optional(),
+	/**
+	* Public half of a proof key the presenter holds, recorded as an RFC 7638
+	* thumbprint. See `AgentTaskSession.proofThumbprint` for what this does and —
+	* importantly — does not yet do.
+	*/
+	proofJwk: taskProofJwkSchema.optional()
+});
+z.object({ 
+/** The presented token. In the body, never a URL — it is a credential. */
+token: z.string().trim().min(8).max(512) });
 /** All catalog keys as a runtime array (for iteration / zod enums). */
 const ENTITLEMENT_KEYS = Object.keys({
 	"feature.kms": {
@@ -1230,7 +1747,9 @@ const AUDIT_ACTIONS = [
 	"agent.updated",
 	"agent.deleted",
 	"agent.policy_published",
-	"agent.policy_rolled_back"
+	"agent.policy_rolled_back",
+	"agent.task_dispatched",
+	"agent.task_revoked"
 ];
 /**
 * Transactional notification emails seekrit can send. Each id is one
@@ -1709,7 +2228,8 @@ const SYNC_PROVIDER_KINDS = [
 	"netlify",
 	"bunnyshell",
 	"github-actions",
-	"gcp-secret-manager"
+	"gcp-secret-manager",
+	"langgraph-platform"
 ];
 z.enum(SYNC_PROVIDER_KINDS);
 /**
@@ -1990,6 +2510,66 @@ const gcpSecretManagerConnectionConfigSchema = z.object({
 	/** Project ID (`acme-prod`) or project number. */
 	projectId: gcpProjectSchema
 });
+/**
+* The four hosts LangChain runs the deployment control plane on. A LangSmith
+* account lives in exactly one of them, and an API key minted in one is not
+* accepted by another — so this is the "which account" half of a LangGraph
+* Platform connection, the way Cloudflare's account id is.
+*
+* `us` is the default because it is what `https://smith.langchain.com` signs
+* into; the other three are chosen at signup and never change afterwards.
+*/
+const LANGGRAPH_PLATFORM_REGIONS = [
+	"us",
+	"eu",
+	"apac",
+	"aws-us"
+];
+/**
+* LangSmith workspace/tenant scope for LangGraph Platform.
+*
+* The API key is never here — it is wrapped to the connection's public key and
+* stored as ciphertext, exactly as Vercel's token is.
+*
+* Two optional fields, for two different situations, and setting both is
+* rejected rather than silently resolved:
+*
+*  - `region` picks one of {@link LANGGRAPH_PLATFORM_HOSTS}. Omitted means
+*    `us`, which is where an account created at `smith.langchain.com` lives.
+*  - `baseUrl` points the connection at a **self-hosted** LangSmith install,
+*    whose control plane is served from the customer's own host under
+*    `/api-host` rather than from `*.api.host.langchain.com`.
+*
+* `tenantId` is the workspace a key was minted in. A workspace-scoped key names
+* its own tenant and does not need it; an organization-scoped key reaches
+* several workspaces and gets a bare 403 without it, which is the same trap
+* Vercel's `teamId` sets — so it is passed through as `X-Tenant-Id` whenever
+* it is present.
+*/
+const langgraphPlatformConnectionConfigSchema = z.object({
+	provider: z.literal("langgraph-platform"),
+	/** Control-plane region. Omit for `us`. Mutually exclusive with `baseUrl`. */
+	region: z.enum(LANGGRAPH_PLATFORM_REGIONS).optional(),
+	/**
+	* Self-hosted LangSmith control-plane root, e.g.
+	* `https://langsmith.acme.com/api-host`. Omit for LangChain's own hosts.
+	* Must be `https:` — this URL carries the API key.
+	*/
+	baseUrl: z.string().trim().max(300).refine((value) => {
+		let parsed;
+		try {
+			parsed = new URL(value);
+		} catch {
+			return false;
+		}
+		return parsed.protocol === "https:" && !parsed.username && !parsed.password;
+	}, "must be an https:// URL — the self-hosted control-plane root, e.g. https://langsmith.acme.com/api-host").optional(),
+	/** LangSmith workspace (tenant) UUID, sent as `X-Tenant-Id`. */
+	tenantId: z.string().trim().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "must be a LangSmith workspace UUID").optional()
+}).refine((c) => !(c.baseUrl !== void 0 && c.region !== void 0), {
+	message: "set region for a LangChain-hosted account or baseUrl for a self-hosted one, not both",
+	path: ["baseUrl"]
+});
 const syncConnectionConfigSchema = z.discriminatedUnion("provider", [
 	vercelConnectionConfigSchema,
 	cloudflareWorkersConnectionConfigSchema,
@@ -2006,7 +2586,8 @@ const syncConnectionConfigSchema = z.discriminatedUnion("provider", [
 	netlifyConnectionConfigSchema,
 	bunnyshellConnectionConfigSchema,
 	githubActionsConnectionConfigSchema,
-	gcpSecretManagerConnectionConfigSchema
+	gcpSecretManagerConnectionConfigSchema,
+	langgraphPlatformConnectionConfigSchema
 ]);
 /** Vercel's three deployment targets. A binding writes to one or more. */
 const VERCEL_TARGETS = [
@@ -2717,6 +3298,27 @@ const gcpSecretManagerDestinationSchema = z.object({
 	message: "a customer-managed key covers one location — use automatic replication, or a single location",
 	path: ["kmsKeyName"]
 });
+/**
+* One LangGraph Platform (Agent Server) **deployment**, addressed by its id.
+*
+* A deployment is the whole unit here: its secrets are a property of the
+* deployment, delivered to the agent container as environment variables, and
+* there is nothing finer to point at — no per-revision or per-graph scope, and
+* no equivalent of Vercel's `production`/`preview` split. A deployment that
+* needs different values is a different deployment, so it is a different
+* binding.
+*
+* Validated as a UUID because `PATCH /v2/deployments/{deployment_id}` declares
+* the path parameter as one: a name or a URL slug in the slot fails validation
+* at the control plane hours later inside an alarm, with nobody watching. It is
+* the `id` from `GET /v2/deployments`, and the UUID in the deployment's
+* dashboard URL.
+*/
+const langgraphPlatformDestinationSchema = z.object({
+	provider: z.literal("langgraph-platform"),
+	/** Deployment UUID, from the dashboard URL or `GET /v2/deployments`. */
+	deploymentId: z.string().trim().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "must be a LangGraph Platform deployment UUID")
+});
 const syncDestinationSchema = z.discriminatedUnion("provider", [
 	vercelDestinationSchema,
 	cloudflareWorkersDestinationSchema,
@@ -2733,7 +3335,8 @@ const syncDestinationSchema = z.discriminatedUnion("provider", [
 	netlifyDestinationSchema,
 	bunnyshellDestinationSchema,
 	githubActionsDestinationSchema,
-	gcpSecretManagerDestinationSchema
+	gcpSecretManagerDestinationSchema,
+	langgraphPlatformDestinationSchema
 ]);
 /**
 * How seekrit secret names become destination key names. Applied in order:
@@ -3371,6 +3974,76 @@ async function decryptPrivateKey(passphrase, blob) {
 	}
 }
 //#endregion
+//#region ../../packages/crypto/src/policy-key.ts
+/**
+* Signing with a principal's **existing** keypair, for agent access policy.
+*
+* Policy bundles are signed in the browser so the API can serve a blob it cannot
+* forge (`docs/agent-access-governance.md` §1). Every user already has a P-256
+* keypair whose private half is passphrase-encrypted and opaque to the server
+* (`users.public_key_jwk`), so this feature needs **no new key material**: no
+* second passphrase, no wrapping, no schema, and nothing extra for an admin to
+* lose. That was a deliberate condition of the design.
+*
+* The catch is that WebCrypto keys are algorithm-bound. A principal key is
+* imported for ECDH (`deriveBits`) and cannot sign, even though the underlying
+* curve is the same one ECDSA uses. So the JWK is re-imported here with the
+* algorithm hints stripped — the same private scalar, presented as an ECDSA key.
+*
+* **The tradeoff, stated plainly:** this reuses one key for two algorithms,
+* which key-management hygiene (NIST SP 800-57 §5.2) advises against. We accept
+* it because the alternative — a second keypair per admin — is the kind of
+* ceremony that gets skipped, and because both uses stay inside the same trust
+* boundary: the key already authorizes reading every secret the admin can read,
+* so a signature capability adds no reach an attacker holding it wouldn't have.
+* If a future version wants separation, the clean path is a managed KMS `sign`
+* key granted to publishers — the thumbprint pinning in the proxy works
+* unchanged, which is why the format carries the key rather than a user id.
+*/
+const ECDSA_PARAMS$1 = {
+	name: "ECDSA",
+	namedCurve: "P-256"
+};
+/**
+* Re-import a principal's private key JWK as an ECDSA signing key.
+*
+* `key_ops`, `alg`, and `use` are dropped: they say "ECDH" on a principal key,
+* and WebCrypto refuses an import whose declared operations don't include the
+* requested usage. Everything that determines the key — `crv`, `d`, `x`, `y` —
+* is passed through untouched.
+*/
+async function importPolicySigningKey(privateKeyJwk) {
+	const jwk = JSON.parse(privateKeyJwk);
+	if (jwk.kty !== "EC" || jwk.crv !== "P-256") throw new SeekritCryptoError("MALFORMED_BLOB", "policy signing needs an EC P-256 principal key");
+	if (!jwk.d) throw new SeekritCryptoError("MALFORMED_BLOB", "policy signing needs the private half of the key");
+	const { kty, crv, d, x, y } = jwk;
+	return crypto.subtle.importKey("jwk", {
+		kty,
+		crv,
+		d,
+		x,
+		y
+	}, ECDSA_PARAMS$1, false, ["sign"]);
+}
+/**
+* Trim a principal's public key JWK to the members a policy bundle carries.
+*
+* The bundle names its signer by thumbprint, which is computed over exactly
+* these four members — so anything else in the stored JWK (`key_ops`, `ext`,
+* `alg`) must be dropped here, or the thumbprint an admin pins would depend on
+* incidental fields.
+*/
+function policySignerJwk(publicKeyJwk) {
+	const jwk = JSON.parse(publicKeyJwk);
+	if (jwk.kty !== "EC" || jwk.crv !== "P-256" || !jwk.x || !jwk.y) throw new SeekritCryptoError("MALFORMED_BLOB", "not an EC P-256 public key");
+	return {
+		kty: "EC",
+		crv: "P-256",
+		x: jwk.x,
+		y: jwk.y
+	};
+}
+//#endregion
 //#region ../../packages/crypto/src/shamir.ts
 /**
 * Shamir's Secret Sharing over GF(2^8) — the same field AES uses, with the
@@ -3864,10 +4537,13 @@ function encodeOpensshPrivateKey(seed, pub, comment) {
 */
 const TOKEN_PREFIX = "skt";
 const CLI_SESSION_PREFIX = "skc";
+const TASK_PREFIX = "skd";
 const TOKEN_ID_LENGTH = 22;
 const ID_ALPHABET = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
 /** 32 bytes of entropy for the CLI session secret. */
 const CLI_SESSION_SECRET_BYTES = 32;
+/** 32 bytes for a task token's secret, matching the CLI session. */
+const TASK_SECRET_BYTES = 32;
 function randomTokenId(prefix = TOKEN_PREFIX) {
 	let out = "";
 	while (out.length < TOKEN_ID_LENGTH) {
@@ -3937,9 +4613,18 @@ function parseCliSessionToken(token) {
 function isCliSessionToken(value) {
 	return value.startsWith(`${CLI_SESSION_PREFIX}_`);
 }
+async function createAgentTaskToken() {
+	const taskRef = randomTokenId(TASK_PREFIX);
+	const token = `${taskRef}_${toBase64Url(crypto.getRandomValues(new Uint8Array(TASK_SECRET_BYTES)))}`;
+	return {
+		token,
+		taskRef,
+		tokenHash: await hashToken(token)
+	};
+}
 //#endregion
 //#region package.json
-var version = "0.42.0";
+var version = "0.44.0";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 var SeekritApiError = class extends Error {
@@ -4299,6 +4984,77 @@ var SeekritClient = class {
 	getMyPolicySigner(orgId) {
 		return this.request("GET", `/v1/orgs/${orgId}/agents/signers/me`);
 	}
+	/**
+	* The bundle a proxy would see — `GET /v1/agents/:ref/policy`, the same route
+	* `seekrit-proxy` polls, resolved by agent id or slug.
+	*
+	* Not org-scoped, because the caller is not: a proxy holds a service token that
+	* knows an agent slug and nothing about org ids. Reachable with any service
+	* token bound to the agent's org (or a user session), which is what lets
+	* `seekrit proxy init` generate a config on the machine that holds the proxy's
+	* own token rather than requiring an admin credential there.
+	*
+	* The `bundle` is signed and opaque to the API. Anything that *acts* on it must
+	* verify the signature against locally pinned signers; decoding it for display
+	* or to name a route is not acting on it.
+	*/
+	getAgentPolicyBundle(agentRef) {
+		return this.request("GET", `/v1/agents/${encodeURIComponent(agentRef)}/policy`);
+	}
+	/**
+	* Dispatch a task for one agent run.
+	*
+	* The caller mints the token (`createAgentTaskToken` in `@seekrit/crypto`) and
+	* sends only its hash plus the public `skd_…` segment, so no presentable
+	* credential ever reaches this API — the same shape as service-token and CLI
+	* session creation. `scopes` may only narrow what the agent's published policy
+	* already permits; a name outside it is refused rather than dropped.
+	*
+	* Not org-scoped, because an orchestrator is not: it knows an agent slug.
+	*/
+	dispatchAgentTask(agentRef, input) {
+		return this.request("POST", `/v1/agents/${encodeURIComponent(agentRef)}/dispatch`, input);
+	}
+	/**
+	* Exchange a presented token for the session it authorizes — what an
+	* enforcement point calls once per task and caches until expiry.
+	*
+	* A POST because the token is a credential and must not land in a URL or an
+	* access log. Fails closed and says which way: revoked, expired, or a disabled
+	* identity are three different answers.
+	*/
+	introspectAgentTask(token) {
+		return this.request("POST", "/v1/tasks/introspect", { token });
+	}
+	/** End a run's authority now. Idempotent. */
+	revokeAgentTask(taskId) {
+		return this.request("POST", `/v1/tasks/${taskId}/revoke`);
+	}
+	getAgentTask(taskId) {
+		return this.request("GET", `/v1/tasks/${taskId}`);
+	}
+	/** Runs dispatched for one identity, newest first (admin). */
+	listAgentTasks(orgId, agentId) {
+		return this.request("GET", `/v1/orgs/${orgId}/agents/${agentId}/tasks`);
+	}
+	/**
+	* Report aggregate decisions. Called by an enforcement point, not a person.
+	*
+	* Counts only — hosts, methods, secret *names*, decisions, and rule indices.
+	* Never a request path: see the module comment in `agent-activity.ts` for why
+	* that line is drawn where it is.
+	*/
+	reportAgentActivity(agentRef, input) {
+		return this.request("POST", `/v1/agents/${encodeURIComponent(agentRef)}/activity`, input);
+	}
+	/**
+	* What an agent actually did, collapsed onto its dimensions — the evidence a
+	* grant review reasons over. The proposals themselves are computed client-side
+	* (`reviewPolicy` in `@seekrit/core`), so the API never opines on policy.
+	*/
+	getAgentActivity(orgId, agentId, days = 14) {
+		return this.request("GET", `/v1/orgs/${orgId}/agents/${agentId}/activity?days=${encodeURIComponent(String(days))}`);
+	}
 	/** Keys the caller can see: all org keys for admins, granted keys otherwise. */
 	listKmsKeys(orgId) {
 		return this.request("GET", `/v1/orgs/${orgId}/kms/keys`);
@@ -4610,6 +5366,24 @@ function fail(message) {
 	console.error(`error: ${message}`);
 	process.exit(1);
 }
+/**
+* Parse a duration flag like `30m`, `24h`, `90d`, or a bare seconds count.
+*
+* Lives here rather than in a command module because more than one command
+* takes a duration and they must agree: `--every 7d` and `--ttl 7d` meaning
+* different things would be a nasty surprise. Invalid input is a flag error, so
+* it exits through `fail` with the accepted forms named.
+*/
+function parseDurationSeconds(input, flag) {
+	const m = /^(\d+)\s*([smhd]?)$/.exec(input.trim());
+	if (!m) fail(`invalid ${flag} "${input}" (try 12h, 7d, 90d)`);
+	return Number(m[1]) * ({
+		s: 1,
+		m: 60,
+		h: 3600,
+		d: 86400
+	}[m[2] || "s"] ?? 1);
+}
 /** Prompt without echoing input (for passphrases). */
 function promptHidden(question) {
 	const muted = new Writable({ write(_chunk, _encoding, callback) {
@@ -4745,6 +5519,31 @@ async function getPrivateKey(ctx) {
 	const { encryptedPrivateKey } = await ctx.client.getMyKeys();
 	return importPrivateKey(await decryptPrivateKey(process.env.SEEKRIT_PASSPHRASE ?? await promptHidden("Passphrase: "), encryptedPrivateKey));
 }
+/**
+* Recover the caller's **policy signing** key: the same P-256 principal key,
+* re-imported for ECDSA rather than ECDH. The dashboard does exactly this in
+* `keyring.getPolicySigner`, so a bundle signed here and one signed in a browser
+* are indistinguishable — same key, same thumbprint, same pin in a proxy config.
+*
+* Service tokens are refused *here* rather than at the API, so the reason is
+* legible at the point of use: publishing policy is deliberately gated on a
+* human's key, because an agent that can widen its own authorization is not
+* governed by it. See the module comment in `apps/api/src/routes/agents.ts`.
+*
+* The honest caveat is `SEEKRIT_PASSPHRASE`: where it is set, anything that can
+* read the environment can sign. That is already true of every other CLI
+* decryption, but it matters more here, so the docs say to leave it unset on any
+* machine an agent shares.
+*/
+async function getPolicySigner(ctx) {
+	if (ctx.auth.type === "bearer" && isServiceToken(ctx.auth.token)) fail("publishing agent policy needs a human's signing key — sign in with `seekrit login` (a service token cannot publish, by design)");
+	const { encryptedPrivateKey } = await ctx.client.getMyKeys();
+	const privateKeyJwk = await decryptPrivateKey(process.env.SEEKRIT_PASSPHRASE ?? await promptHidden("Passphrase: "), encryptedPrivateKey);
+	return {
+		signingKey: await importPolicySigningKey(privateKeyJwk),
+		jwk: policySignerJwk(privateKeyJwk)
+	};
+}
 /** Recover one environment's DEK for the current principal. */
 async function getDek(ctx, orgId, envId) {
 	const [{ wrappedDek }, privateKey] = await Promise.all([ctx.client.getMyEnvKey(orgId, envId), getPrivateKey(ctx)]);
@@ -5075,36 +5874,673 @@ function registerAccountCommands(program) {
 	});
 }
 //#endregion
-//#region src/kms.ts
-/** Collect a repeatable option into a list. */
-function collect$6(value, acc = []) {
-	acc.push(value);
-	return acc;
-}
-/** The calling principal's identity + public key (for a self-grant). */
-async function kmsCallerIdentity(ctx) {
-	if (ctx.auth.type === "bearer" && isServiceToken(ctx.auth.token)) {
-		const { tokenId, privateKey } = await parseServiceToken(ctx.auth.token);
-		const { d: _d, key_ops: _ops, ext: _ext, ...pub } = await crypto.subtle.exportKey("jwk", privateKey);
-		return {
-			principalType: "service_token",
-			principalId: tokenId,
-			publicKeyJwk: JSON.stringify(pub)
-		};
+//#region src/agents.ts
+/**
+* Agent access governance from the CLI.
+*
+* Policy lived only in the dashboard until now, which was backwards: the people
+* deploying agents work in a terminal and a repo, and a rule set is exactly the
+* kind of thing that wants review and version control. So the loop this module
+* exists for is:
+*
+*   seekrit agents policy pull nova -o nova.policy.json   # current rules
+*   $EDITOR nova.policy.json                              # commit it, review it
+*   seekrit agents policy publish nova -f nova.policy.json
+*
+* **Signing still happens here, on this machine, with the operator's own key**
+* (`getPolicySigner` in `context.ts`), so nothing about the trust argument in
+* `docs/agent-access-governance.md` §1 changes: the API receives an opaque
+* envelope it cannot forge, and a proxy verifies it against thumbprints pinned in
+* its own local file. A service token is refused — an agent that can publish its
+* own policy is not governed by it.
+*
+* Everything else here is read-only, and two commands are deliberately *local*
+* evaluations rather than API calls:
+*
+* - `simulate` runs `evaluatePolicy` from `@seekrit/core`, the mirror of
+*   `RuleSet::decide` in the proxy — so a dry run and a real refusal give the
+*   same verdict in the same words.
+* - `fetch` asks for the bytes a proxy would get (`GET /v1/agents/:ref/policy`)
+*   and re-derives the signer thumbprint from the bundle itself, rather than
+*   trusting the field the API echoes beside it.
+*/
+/** How many published versions the API returns per page. */
+const POLICY_PAGE = 50;
+/** The `-` sentinel every other seekrit command uses to mean stdin. */
+const STDIN = "-";
+/**
+* Resolve `nova`, or `agt_…`, to an identity.
+*
+* The org-scoped API routes take an id, but nobody types ids — so a slug is
+* resolved from the list. The list is small (agents are a per-deployment thing,
+* not a per-request one), which is why this costs one request rather than
+* needing a lookup route.
+*/
+async function resolveAgent(ctx, orgId, ref) {
+	const { agents } = await ctx.client.listAgents(orgId);
+	const found = agents.find((a) => a.slug === ref || a.id === ref);
+	if (!found) {
+		const known = agents.map((a) => a.slug).join(", ");
+		fail(`no agent "${ref}"${known ? ` — this org has: ${known}` : " in this org"}`);
 	}
-	const { user } = await ctx.client.me();
-	if (!user.publicKeyJwk) fail("run `seekrit keys setup` first");
-	return {
-		principalType: "user",
-		principalId: user.id,
-		publicKeyJwk: user.publicKeyJwk
-	};
+	return found;
 }
-/** Look up an org member (by email) or service token (by id) as a grant recipient. */
-async function kmsResolveRecipient(ctx, orgId, who) {
-	if (who.user) {
-		const { members } = await ctx.client.listMembers(orgId);
-		const m = members.find((x) => x.email === who.user);
+/**
+* One published version: the newest by default, or an explicit `--version`.
+*
+* An agent with no published policy is a real state, not an error — a proxy for
+* it fails closed — so the caller decides how to report it.
+*/
+async function loadVersion(ctx, orgId, agent, version) {
+	const { policies } = await ctx.client.listAgentPolicies(orgId, agent.id);
+	if (version === void 0) return policies[0] ?? null;
+	const found = policies.find((p) => p.version === version);
+	if (!found) fail(policies.length >= POLICY_PAGE ? `no version ${version} in the last ${POLICY_PAGE} published` : `no version ${version} — published: ${policies.map((p) => p.version).join(", ") || "none"}`);
+	return found;
+}
+/**
+* Read a rule file: either a bare array or `{ "rules": [...] }`, from a path or
+* stdin. Both shapes are accepted because `policy pull` writes the second and
+* hand-written files tend to be the first.
+*
+* Validation is the same zod schema the API and the dashboard use, so a file
+* rejected here would have been rejected there — before anything is signed.
+*
+* Exported for its own test: this is the one place a hand-written file meets the
+* schema, and its error messages are the whole user experience of a typo.
+*/
+function parseRuleFile(raw, source) {
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch (err) {
+		fail(`${source} is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	const list = Array.isArray(parsed) ? parsed : parsed?.rules === void 0 ? fail(`${source} must be a JSON array of rules, or an object with a "rules" array`) : parsed.rules;
+	if (!Array.isArray(list)) fail(`${source}: "rules" must be an array`);
+	if (list.length === 0) console.error(`note: ${source} has no rules — publishing it denies every request`);
+	return list.map((rule, i) => {
+		const result = agentPolicyRuleSchema.safeParse(rule);
+		if (!result.success) {
+			const first = result.error.issues[0];
+			fail(`${source}: rule ${i + 1} is invalid — ${first?.path.join(".") || "rule"}: ${first?.message ?? "unknown error"}`);
+		}
+		return result.data;
+	});
+}
+/** `--file path` or `--file -`. */
+async function readRuleSource(file) {
+	if (file === STDIN) return {
+		raw: await readStdin(),
+		label: "stdin"
+	};
+	try {
+		return {
+			raw: readFileSync(file, "utf8"),
+			label: file
+		};
+	} catch (err) {
+		return fail(`cannot read ${file}: ${err instanceof Error ? err.message : String(err)}`);
+	}
+}
+/**
+* An empty `methods` or `paths` list means *any*: those fields narrow a rule that
+* already matched its host, so absent means unconstrained. A blank column would
+* read as the opposite, so it renders as `any`.
+*
+* Exported for its own test — this is a real invariant of the format, not a
+* cosmetic choice.
+*/
+function describeList(values) {
+	return values.length === 0 ? "any" : values.join(" ");
+}
+/**
+* `allow` is the field where empty means the **opposite** — no secret may be
+* injected toward this host at all (`Decision::SecretNotAllowed` for every name;
+* see `crates/seekrit-core/src/policy.rs`). Such a rule is useful and
+* intentional: it permits the *request* while granting no credential, which is
+* how you let an agent read a public API through the proxy without handing it a
+* key. Rendering that as `any` would invert the meaning of the one column an
+* operator reviews most carefully, so it gets its own function.
+*/
+function describeSecrets(values) {
+	return values.length === 0 ? "none" : values.join(" ");
+}
+function printRules(rules) {
+	printTable(rules.map((rule, i) => ({
+		n: i + 1,
+		rule
+	})), [
+		col("#", (r) => r.n),
+		col("host", (r) => r.rule.host),
+		col("methods", (r) => describeList(r.rule.methods)),
+		col("paths", (r) => describeList(r.rule.paths)),
+		col("secrets", (r) => describeSecrets(r.rule.allow)),
+		col("label", (r) => r.rule.label ?? "-")
+	], "no rules — this policy denies every request");
+}
+/** One rule as a single line, for the publish diff. */
+function ruleLine(rule) {
+	const parts = [
+		rule.host,
+		describeList(rule.methods),
+		describeList(rule.paths),
+		`secrets=${describeSecrets(rule.allow)}`
+	];
+	return rule.label ? `${parts.join(" ")}  (${rule.label})` : parts.join(" ");
+}
+/**
+* The change a publish would make. Rules are compared by *position* because
+* order decides — first match wins — so a reordering is a real change and shows
+* up as one.
+*/
+function printPolicyDiff(before, after) {
+	const changes = diffPolicyRules(before, after).filter((c) => c.kind !== "unchanged");
+	if (changes.length === 0) {
+		console.error(after.length === 0 ? "no rules — this policy denies every request" : "no rule changes — publishing would only extend the expiry");
+		return;
+	}
+	for (const change of changes) {
+		const n = change.index + 1;
+		if (change.kind === "added") console.log(`+ ${n}  ${ruleLine(change.after)}`);
+		else if (change.kind === "removed") console.log(`- ${n}  ${ruleLine(change.before)}`);
+		else {
+			console.log(`- ${n}  ${ruleLine(change.before)}`);
+			console.log(`+ ${n}  ${ruleLine(change.after)}`);
+		}
+	}
+}
+/** Seconds until an ISO instant, or a negative number when it has passed. */
+function secondsUntil(iso) {
+	return Math.round((new Date(iso).getTime() - Date.now()) / 1e3);
+}
+/** Collect a repeated `--scope NAME` into a list. */
+function collectScope(value, acc = []) {
+	acc.push(value);
+	return acc;
+}
+/**
+* A task's state, derived rather than stored: `revoked` beats `expired`, so a run
+* somebody killed does not read as one that merely lapsed.
+*
+* Exported for its own test — it mirrors `taskState` in
+* `apps/api/src/lib/agent-tasks.ts`, and the two disagreeing would mean the list
+* screen and the enforcement point describe the same run differently.
+*/
+function taskStateOf(task, now) {
+	if (task.revokedAt) return "revoked";
+	return Date.parse(task.expiresAt) <= now ? "expired" : "active";
+}
+/**
+* A detail view on **stderr**, so a command whose stdout is a credential can
+* still explain itself to a person without corrupting `$(…)`.
+*/
+function printFieldsToStderr(fields) {
+	const present = fields.filter(([, value]) => value !== null && value !== void 0);
+	const width = Math.max(...present.map(([label]) => label.length));
+	for (const [label, value] of present) console.error(`${label.padEnd(width)}  ${value}`);
+}
+/**
+* Exported for its own test: the expired branch is the one that must be loud.
+*
+* The granularity has to span both users of this — a policy bundle lasting a
+* week and a task lasting fifteen minutes. Rounding a task to the nearest hour
+* printed "in 0h", which is worse than no estimate at all.
+*/
+function describeExpiry(iso) {
+	const seconds = secondsUntil(iso);
+	if (seconds <= 0) return `${iso} (EXPIRED — proxies for this agent fail closed)`;
+	const days = Math.floor(seconds / 86400);
+	const hours = Math.floor(seconds % 86400 / 3600);
+	const minutes = Math.floor(seconds % 3600 / 60);
+	if (days > 0) return `${iso} (in ${days}d ${hours}h)`;
+	if (hours > 0) return `${iso} (in ${hours}h ${minutes}m)`;
+	if (minutes > 0) return `${iso} (in ${minutes}m)`;
+	return `${iso} (in ${seconds}s)`;
+}
+function registerAgentCommands(program) {
+	const agents = program.command("agents").description("agent access policy — which agent may reach which upstream with which secret");
+	agents.command("list", { isDefault: true }).description("list agent identities").option("--org <slug>", "organization").option("--json", "machine-readable output").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { agents: rows } = await ctx.client.listAgents(org.id);
+		emit(options, { agents: rows }, () => printTable(rows, [
+			col("slug", (a) => a.slug),
+			col("name", (a) => a.name),
+			col("policy", (a) => a.currentPolicyVersion === 0 ? "none" : `v${a.currentPolicyVersion}`),
+			col("enabled", (a) => a.enabled ? "yes" : "no"),
+			col("last fetch", (a) => a.lastPolicyFetchAt ?? "never")
+		], "no agent identities — create one with `seekrit agents create`"));
+	});
+	agents.command("create <name>").description("create an agent identity (a policy subject; it holds no key material)").requiredOption("--slug <slug>", "short name a proxy config and a ticket refer to").option("--org <slug>", "organization").option("--app <slug>", "application, when scoping the agent to one environment").option("--env <slug>", "environment whose secret names its rules may reference").option("--json", "machine-readable output").action(async (name, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const environmentId = options.env ? (await resolveAppEnv(ctx, {
+			org: options.org,
+			app: options.app,
+			env: options.env
+		})).envId : void 0;
+		const { agent } = await ctx.client.createAgent(org.id, {
+			name,
+			slug: options.slug,
+			...environmentId ? { environmentId } : {}
+		});
+		emit(options, { agent }, () => {
+			console.error(`created ${agent.slug} — no policy published yet, so any proxy for it fails closed`);
+			console.error(`next: seekrit agents policy publish ${agent.slug} -f rules.json`);
+		});
+	});
+	agents.command("show <ref>").description("an identity and its live rules").option("--org <slug>", "organization").option("--json", "machine-readable output").action(async (ref, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const agent = await resolveAgent(ctx, org.id, ref);
+		const { environment } = await ctx.client.getAgent(org.id, agent.id);
+		const live = await loadVersion(ctx, org.id, agent);
+		emit(options, {
+			agent,
+			environment,
+			policy: live
+		}, () => {
+			printFields([
+				["name", agent.name],
+				["slug", agent.slug],
+				["id", agent.id],
+				["environment", environment ? environment.slug : "any in the org"],
+				["enabled", agent.enabled ? "yes" : "no"],
+				["policy", live ? `v${live.version}` : "none published"],
+				["signer", live?.signerThumbprint],
+				["expires", live ? describeExpiry(live.expiresAt) : void 0],
+				["last fetch", agent.lastPolicyFetchAt ?? "never"]
+			]);
+			if (live) {
+				section(`rules (v${live.version})`);
+				printRules(live.rules);
+				section("hosts a forward proxy would intercept");
+				console.log(policyHosts(live.rules).join("\n") || "none");
+			}
+		});
+	});
+	agents.command("disable <ref>").description("stop serving this identity's policy (the revocation path)").option("--org <slug>", "organization").option("-y, --yes", "skip the confirmation").action(async (ref, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const agent = await resolveAgent(ctx, org.id, ref);
+		await confirmDestructive(options.yes, `Disable ${agent.slug}? Running proxies keep their current bundle until it expires.`);
+		await ctx.client.updateAgent(org.id, agent.id, { enabled: false });
+		console.error(`${agent.slug} disabled — its next policy refresh is refused`);
+	});
+	agents.command("enable <ref>").description("serve this identity's policy again").option("--org <slug>", "organization").action(async (ref, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const agent = await resolveAgent(ctx, org.id, ref);
+		await ctx.client.updateAgent(org.id, agent.id, { enabled: true });
+		console.error(`${agent.slug} enabled`);
+	});
+	agents.command("rm <ref>").description("delete an identity and its published history").option("--org <slug>", "organization").option("-y, --yes", "skip the confirmation").action(async (ref, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const agent = await resolveAgent(ctx, org.id, ref);
+		await confirmDestructive(options.yes, `Delete ${agent.slug} and all ${agent.currentPolicyVersion} published version(s)? The audit_log rows survive.`);
+		await ctx.client.deleteAgent(org.id, agent.id);
+		console.error(`${agent.slug} deleted`);
+	});
+	/**
+	* The trust anchor. This prints a *public* key fingerprint — the security of
+	* pinning comes from the operator putting it in a local file the API cannot
+	* reach, not from this command being honest. Which is why it prints the TOML
+	* line to paste rather than offering to write the config.
+	*/
+	agents.command("signer").description("your policy signing thumbprint, to pin in a proxy config").option("--org <slug>", "organization").option("--json", "machine-readable output").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { signer } = await ctx.client.getMyPolicySigner(org.id);
+		if (!signer) fail("your account has no keypair yet — run `seekrit keys setup`");
+		emit(options, { signer }, () => {
+			printFields([["thumbprint", signer.thumbprint], ["user", signer.userId]]);
+			section("pin it in seekrit-proxy.toml");
+			console.log("[policy]");
+			console.log(`signers = ["${signer.thumbprint}"]`);
+			console.error("");
+			console.error("pin a second admin's key too — one pinned signer means one lost passphrase leaves nobody able to publish");
+		});
+	});
+	/**
+	* The token is printed to **stdout** and everything else to stderr, so the
+	* common thing works without parsing:
+	*
+	*   TASK=$(seekrit agents dispatch nova --scope GITHUB_TOKEN --ttl 15m)
+	*
+	* It is shown exactly once. The API stores only a hash, so a lost token cannot
+	* be recovered — dispatch another and revoke the first.
+	*/
+	agents.command("dispatch <ref>").description("mint task-scoped authority for one agent run").option("--scope <NAME>", "narrow this run to one secret (repeatable)", collectScope).option("--ttl <duration>", "how long the run stays authorized (e.g. 15m, 2h)").option("--label <text>", "what this run is for — recorded in the audit trail").option("--json", "machine-readable output (includes the token)").action(async (ref, options) => {
+		const ctx = buildContext();
+		const ttlSeconds = options.ttl ? parseDurationSeconds(options.ttl, "--ttl") : 900;
+		if (ttlSeconds < 60 || ttlSeconds > 43200) fail(`--ttl must be between 60s and ${TASK_MAX_TTL_SECONDS / 3600}h`);
+		const minted = await createAgentTaskToken();
+		const { task, header } = await ctx.client.dispatchAgentTask(ref, {
+			taskRef: minted.taskRef,
+			tokenHash: minted.tokenHash,
+			ttlSeconds,
+			...options.scope ? { scopes: options.scope } : {},
+			...options.label ? { label: options.label } : {}
+		});
+		if (options.json) {
+			console.log(JSON.stringify({
+				task,
+				header,
+				token: minted.token
+			}, null, 2));
+			return;
+		}
+		console.log(minted.token);
+		printFieldsToStderr([
+			["task", task.id],
+			["agent", ref],
+			["scopes", task.scopes ? describeSecrets(task.scopes) : "the agent's full policy"],
+			["policy", `v${task.policyVersion}`],
+			["expires", describeExpiry(task.expiresAt)],
+			["header", header]
+		]);
+	});
+	agents.command("tasks <ref>").description("runs dispatched for an agent identity, newest first").option("--org <slug>", "organization").option("--all", "include expired and revoked runs").option("--json", "machine-readable output").action(async (ref, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const agent = await resolveAgent(ctx, org.id, ref);
+		const { tasks } = await ctx.client.listAgentTasks(org.id, agent.id);
+		const now = Date.now();
+		const rows = options.all ? tasks : tasks.filter((t) => taskStateOf(t, now) === "active");
+		emit(options, { tasks: rows }, () => printTable(rows, [
+			col("task", (t) => t.id),
+			col("state", (t) => taskStateOf(t, now)),
+			col("scopes", (t) => t.scopes ? describeSecrets(t.scopes) : "policy"),
+			col("policy", (t) => `v${t.policyVersion}`),
+			col("expires", (t) => t.expiresAt),
+			col("last seen", (t) => t.lastSeenAt ?? "never"),
+			col("label", (t) => t.label ?? "-")
+		], options.all ? "no runs dispatched yet" : "no live runs (try --all)"));
+	});
+	agents.command("revoke <taskId>").description("end a run's authority now").action(async (taskId) => {
+		const { task } = await buildContext().client.revokeAgentTask(taskId);
+		console.error(`${task.id} revoked — enforcement points refuse it at their next introspection`);
+	});
+	registerPolicyCommands(agents.command("policy").description("published policy versions (`seekrit agents policy --help`)"));
+	agents.command("activity <ref>").description("what this agent actually did — aggregate decisions, not a request log").option("--days <n>", "how far back to look (1–90)", "14").option("--org <slug>", "organization").option("--json", "machine-readable output").action(async (ref, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const agent = await resolveAgent(ctx, org.id, ref);
+		const days = Number(options.days ?? 14);
+		if (!Number.isInteger(days) || days < 1 || days > 90) fail("--days must be 1–90");
+		const { activity, summary } = await ctx.client.getAgentActivity(org.id, agent.id, days);
+		emit(options, {
+			activity,
+			summary
+		}, () => {
+			printFields([
+				["window", `${days}d`],
+				["allowed", summary.allowed],
+				["denied", summary.denied],
+				["hosts", summary.hosts],
+				["earliest", summary.from ?? "no activity reported"]
+			]);
+			if (activity.length === 0) {
+				console.error("");
+				console.error("nothing reported — add an [activity] block to the proxy (`seekrit proxy init --activity`)");
+				return;
+			}
+			section("decisions");
+			printTable(activity, [
+				col("host", (a) => a.host),
+				col("method", (a) => a.method),
+				col("decision", (a) => a.decision),
+				col("rule", (a) => a.ruleIndex === null ? "-" : String(a.ruleIndex + 1)),
+				col("count", (a) => a.count),
+				col("secrets", (a) => a.secrets ? Object.entries(a.secrets).map(([name, n]) => `${name}×${n}`).join(" ") : "-")
+			]);
+		});
+	});
+	/**
+	* The grant review loop. Proposals are computed *here*, from activity the API
+	* served — the API is deliberately not in the business of saying what a policy
+	* should be. And `--out` writes a rule file rather than publishing: the change
+	* still goes through `policy publish`, which still needs a human's key.
+	*/
+	agents.command("review <ref>").description("compare published policy against observed activity, and propose changes").option("--days <n>", "how far back to look (1–90)", "14").option("-o, --out <path>", "write the narrowed rules to a file, ready to publish").option("--org <slug>", "organization").option("--json", "machine-readable output").action(async (ref, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const agent = await resolveAgent(ctx, org.id, ref);
+		const days = Number(options.days ?? 14);
+		if (!Number.isInteger(days) || days < 1 || days > 90) fail("--days must be 1–90");
+		const live = await loadVersion(ctx, org.id, agent);
+		if (!live) fail(`${agent.slug} has no published policy to review`);
+		const { activity, summary } = await ctx.client.getAgentActivity(org.id, agent.id, days);
+		const proposals = reviewPolicy({
+			rules: live.rules,
+			activity
+		});
+		emit(options, {
+			proposals,
+			summary,
+			version: live.version
+		}, () => {
+			console.error(`${agent.slug} — policy v${live.version}, ${summary.allowed + summary.denied} decision(s) over ${days}d`);
+			if (activity.length === 0) {
+				console.error("");
+				console.error("no activity reported yet — nothing to review against");
+				return;
+			}
+			if (proposals.length === 0) {
+				console.error("");
+				console.error("no changes proposed: every rule is in use and nothing was refused");
+				return;
+			}
+			section("proposals");
+			for (const p of proposals) {
+				const marker = p.applicable ? "-" : "?";
+				console.log(`${marker} ${p.rationale}`);
+			}
+			const applicable = countApplicable(proposals);
+			console.error("");
+			console.error(`${applicable} narrowing change(s) can be applied; ${proposals.length - applicable} need a human decision`);
+		});
+		if (options.out) {
+			const narrowed = applyProposals(live.rules, proposals);
+			writeFileSync(options.out, `${JSON.stringify({ rules: narrowed }, null, 2)}\n`);
+			console.error(`wrote ${narrowed.length} rule(s) to ${options.out} — review the diff, then: seekrit agents policy publish ${agent.slug} -f ${options.out}`);
+			console.error("widening proposals are never applied: an agent must not earn permissions by retrying");
+		}
+	});
+	agents.command("simulate <ref>").description("ask what a policy would decide, without sending a request").requiredOption("--host <host>", "upstream hostname").requiredOption("--path <path>", "request path").option("--method <method>", "HTTP method", "GET").option("--secret <NAME>", "the secret the request would inject").option("--version <n>", "evaluate a specific published version").option("--org <slug>", "organization").option("--json", "machine-readable output").action(async (ref, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const agent = await resolveAgent(ctx, org.id, ref);
+		const version = options.version === void 0 ? void 0 : Number(options.version);
+		if (version !== void 0 && !Number.isInteger(version)) fail("--version must be an integer");
+		const published = await loadVersion(ctx, org.id, agent, version);
+		if (!published) fail(`${agent.slug} has no published policy — every request is denied`);
+		const verdict = evaluatePolicy(published.rules, {
+			host: options.host,
+			method: options.method,
+			path: options.path,
+			...options.secret === void 0 ? {} : { secret: options.secret }
+		});
+		const reason = describePolicyVerdict(verdict, published.rules);
+		emit(options, {
+			version: published.version,
+			verdict,
+			reason
+		}, () => {
+			const target = `${options.method.toUpperCase()} ${options.host}${options.path}`;
+			console.log(`${verdict.decision === "allow" ? "allow" : "DENY"}  ${target}${options.secret ? ` [${options.secret}]` : ""}`);
+			console.log(`  v${published.version}: ${reason}`);
+		});
+		if (verdict.decision !== "allow") process.exitCode = 1;
+	});
+}
+function registerPolicyCommands(policy) {
+	policy.command("list <ref>").description("published versions, newest first").option("--org <slug>", "organization").option("--json", "machine-readable output").action(async (ref, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const agent = await resolveAgent(ctx, org.id, ref);
+		const { policies } = await ctx.client.listAgentPolicies(org.id, agent.id);
+		emit(options, { policies }, () => printTable(policies, [
+			col("version", (p) => `v${p.version}`),
+			col("rules", (p) => p.ruleCount),
+			col("signer", (p) => p.signerThumbprint.slice(0, 12)),
+			col("published", (p) => p.publishedAt),
+			col("expires", (p) => secondsUntil(p.expiresAt) <= 0 ? `${p.expiresAt} (expired)` : p.expiresAt),
+			col("note", (p) => p.rolledBackFromVersion ? `restored v${p.rolledBackFromVersion}` : "-")
+		], "nothing published yet"));
+	});
+	policy.command("show <ref>").description("the rules in a published version (live by default)").option("--version <n>", "a specific version").option("--org <slug>", "organization").option("--json", "machine-readable output").action(async (ref, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const agent = await resolveAgent(ctx, org.id, ref);
+		const version = options.version === void 0 ? void 0 : Number(options.version);
+		if (version !== void 0 && !Number.isInteger(version)) fail("--version must be an integer");
+		const published = await loadVersion(ctx, org.id, agent, version);
+		if (!published) fail(`${agent.slug} has no published policy`);
+		emit(options, { policy: published }, () => {
+			printFields([
+				["version", `v${published.version}`],
+				["signer", published.signerThumbprint],
+				["published", published.publishedAt],
+				["expires", describeExpiry(published.expiresAt)]
+			]);
+			section("rules");
+			printRules(published.rules);
+		});
+	});
+	/**
+	* Write the live rules out as the editable source for the next publish. This
+	* is the half that makes policy-as-code work: what comes back out is exactly
+	* the shape `publish` takes in, so a round trip is a no-op diff.
+	*/
+	policy.command("pull <ref>").description("write a version's rules to a JSON file you can edit and publish").option("-o, --out <path>", "where to write it (default: stdout)").option("--version <n>", "a specific version").option("--org <slug>", "organization").action(async (ref, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const agent = await resolveAgent(ctx, org.id, ref);
+		const version = options.version === void 0 ? void 0 : Number(options.version);
+		if (version !== void 0 && !Number.isInteger(version)) fail("--version must be an integer");
+		const published = await loadVersion(ctx, org.id, agent, version);
+		const rules = published?.rules ?? [];
+		const body = `${JSON.stringify({ rules }, null, 2)}\n`;
+		if (options.out) {
+			writeFileSync(options.out, body);
+			console.error(published ? `wrote ${rules.length} rule(s) from v${published.version} to ${options.out}` : `wrote an empty rule set to ${options.out} (nothing published yet)`);
+			return;
+		}
+		process.stdout.write(body);
+	});
+	policy.command("publish <ref>").description("sign a rule file with your own key and publish it").requiredOption("-f, --file <path>", `rule file, or ${STDIN} for stdin`).option("--ttl <duration>", "how long the bundle stays valid (e.g. 7d, 12h)").option("--org <slug>", "organization").option("-y, --yes", "skip the confirmation").option("--json", "machine-readable output").action(async (ref, options) => {
+		const ctx = buildContext();
+		if (isTokenAuth(ctx)) fail("publishing agent policy needs a human's signing key — sign in with `seekrit login`. A service token cannot publish, so an agent cannot widen its own policy.");
+		const org = await resolveOrg(ctx, options.org);
+		const agent = await resolveAgent(ctx, org.id, ref);
+		const ttlSeconds = options.ttl ? parseDurationSeconds(options.ttl, "--ttl") : POLICY_DEFAULT_TTL_SECONDS;
+		if (ttlSeconds < 3600 || ttlSeconds > 7776e3) fail(`--ttl must be between ${POLICY_MIN_TTL_SECONDS / 3600}h and ${POLICY_MAX_TTL_SECONDS / 86400}d`);
+		const { raw, label } = await readRuleSource(options.file);
+		const rules = parseRuleFile(raw, label);
+		const live = await loadVersion(ctx, org.id, agent);
+		const nextVersion = agent.currentPolicyVersion + 1;
+		const from = agent.currentPolicyVersion === 0 ? "nothing" : `v${agent.currentPolicyVersion}`;
+		console.error(`${agent.slug}: ${from} → v${nextVersion}`);
+		printPolicyDiff(live?.rules ?? [], rules);
+		await confirmDestructive(options.yes, `Publish v${nextVersion} for ${agent.slug} (${rules.length} rule(s), valid ${options.ttl ?? "7d"})?`);
+		const { signingKey, jwk } = await getPolicySigner(ctx);
+		const issuedAt = Math.floor(Date.now() / 1e3);
+		const bundle = await signAgentPolicy(signingKey, jwk, {
+			v: 1,
+			org: org.id,
+			agent: agent.id,
+			agent_slug: agent.slug,
+			policy_version: nextVersion,
+			issued_at: issuedAt,
+			expires_at: issuedAt + ttlSeconds,
+			rules
+		});
+		const { policy: published } = await ctx.client.publishAgentPolicy(org.id, agent.id, bundle);
+		emit(options, { policy: published }, () => {
+			console.error(`published v${published.version} — signed with ${published.signerThumbprint.slice(0, 12)}…, expires ${published.expiresAt}`);
+			console.error("proxies pick it up at their next refresh");
+		});
+	});
+	policy.command("rollback <ref> <version>").description("republish an earlier version's bundle as the newest one").option("--org <slug>", "organization").option("-y, --yes", "skip the confirmation").action(async (ref, versionArg, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const agent = await resolveAgent(ctx, org.id, ref);
+		const version = Number(versionArg);
+		if (!Number.isInteger(version) || version < 1) fail("version must be a positive integer");
+		const source = await loadVersion(ctx, org.id, agent, version);
+		if (!source) fail(`no version ${version}`);
+		if (secondsUntil(source.expiresAt) <= 0) fail(`v${version} expired at ${source.expiresAt} — a rollback keeps the original expiry, so it would be inert. Publish the rules again instead: seekrit agents policy pull ${agent.slug} --version ${version} -o rules.json`);
+		await confirmDestructive(options.yes, `Roll ${agent.slug} back to v${version} (${source.ruleCount} rule(s))?`);
+		const { policy: published } = await ctx.client.rollbackAgentPolicy(org.id, agent.id, version);
+		console.error(`published v${published.version} carrying v${version}'s bundle`);
+	});
+	/**
+	* What a proxy actually gets. Useful when a deployment misbehaves and the
+	* question is whether the API, the pin, or the rules are at fault — so it
+	* re-derives the thumbprint from the bundle rather than reporting the one the
+	* API sends beside it, and says plainly when the two disagree.
+	*/
+	policy.command("fetch <ref>").description("the bundle a proxy would fetch, with its signer re-derived locally").option("--bundle", "print the raw ap1. envelope and nothing else").option("--json", "machine-readable output").action(async (ref, options) => {
+		const fetched = await buildContext().client.getAgentPolicyBundle(ref);
+		if (options.bundle) {
+			process.stdout.write(`${fetched.bundle}\n`);
+			return;
+		}
+		const body = parseAgentPolicyUnverified(fetched.bundle);
+		const derived = await policySignerThumbprint(body.signer.jwk);
+		emit(options, {
+			...fetched,
+			derivedThumbprint: derived,
+			rules: body.rules
+		}, () => {
+			printFields([
+				["agent", `${fetched.agent.slug} (${fetched.agent.name})`],
+				["version", `v${fetched.version}`],
+				["expires", describeExpiry(fetched.expiresAt)],
+				["signer (in bundle)", derived],
+				["signer (reported)", fetched.signerThumbprint === derived ? "matches" : `${fetched.signerThumbprint} — DOES NOT MATCH the bundle; a proxy would refuse this`]
+			]);
+			section("rules");
+			printRules(body.rules);
+			console.error("");
+			console.error("this command does not verify the signature — only a pinned signer list can, which lives in the proxy's own config");
+		});
+	});
+}
+//#endregion
+//#region src/kms.ts
+/** Collect a repeatable option into a list. */
+function collect$6(value, acc = []) {
+	acc.push(value);
+	return acc;
+}
+/** The calling principal's identity + public key (for a self-grant). */
+async function kmsCallerIdentity(ctx) {
+	if (ctx.auth.type === "bearer" && isServiceToken(ctx.auth.token)) {
+		const { tokenId, privateKey } = await parseServiceToken(ctx.auth.token);
+		const { d: _d, key_ops: _ops, ext: _ext, ...pub } = await crypto.subtle.exportKey("jwk", privateKey);
+		return {
+			principalType: "service_token",
+			principalId: tokenId,
+			publicKeyJwk: JSON.stringify(pub)
+		};
+	}
+	const { user } = await ctx.client.me();
+	if (!user.publicKeyJwk) fail("run `seekrit keys setup` first");
+	return {
+		principalType: "user",
+		principalId: user.id,
+		publicKeyJwk: user.publicKeyJwk
+	};
+}
+/** Look up an org member (by email) or service token (by id) as a grant recipient. */
+async function kmsResolveRecipient(ctx, orgId, who) {
+	if (who.user) {
+		const { members } = await ctx.client.listMembers(orgId);
+		const m = members.find((x) => x.email === who.user);
 		if (!m) fail(`no member ${who.user}`);
 		if (!m.publicKeyJwk) fail(`${who.user} has not completed key setup`);
 		return {
@@ -7360,6 +8796,1051 @@ function collect$2(value, acc) {
 	return acc;
 }
 //#endregion
+//#region src/proxy-binary.ts
+/**
+* Fetch and run the `seekrit-proxy` binary without a Rust toolchain.
+*
+* The proxy is the strongest answer seekrit has for an untrusted workload — the
+* agent holds `{{seekrit:NAME}}` and never the key — and it was also the hardest
+* thing here to *try*, because trying it meant `cargo` and a TOML file. This
+* module removes the first half: it resolves a prebuilt, checksum-verified
+* binary for the host platform and execs it, so `npx @seekrit/proxy` and
+* `seekrit proxy run` behave like the proxy was already installed.
+*
+* The logic lives in the CLI (and is re-exported as `@seekrit/cli/proxy-launcher`)
+* for the same reason the MCP server does: `@seekrit/proxy` is a thin npx
+* entrypoint over it, and the two must not drift.
+*
+* Three properties worth stating, since this downloads and executes code:
+*
+* - **The checksum is verified before anything is executed**, against a
+*   `.sha256` fetched from the same release. That is integrity, not provenance —
+*   it proves the bytes match what the release published, which is exactly the
+*   guarantee `install.sh` gives and no more.
+* - **Nothing is fetched when a binary is already available.** `SEEKRIT_PROXY_BIN`
+*   short-circuits entirely, and a cached download for the same version+target is
+*   reused, so this is a one-time cost per version.
+* - **Version is pinned, not floating.** A default of `latest` would make two
+*   machines run different proxies from the same command; the pinned constant is
+*   what this CLI was built against, overridable when you want otherwise.
+*/
+/**
+* The proxy version this CLI was built against.
+*
+* Bumped by release-please when `apps/proxy` releases (an `extra-files` entry in
+* release-please-config.json), so the pin follows the crate without anyone
+* remembering to move it.
+*/
+const PROXY_VERSION = "0.10.0";
+const BIN = "seekrit-proxy";
+/**
+* Host → Rust target triple.
+*
+* Linux always resolves to **musl**: that build is statically linked, so one
+* artifact covers glibc, musl, alpine, and distroless, and there is no libc
+* detection to get wrong on a machine where `ldd` says something unexpected.
+*/
+function detectTarget(os = platform(), cpu = arch()) {
+	const machine = cpu === "x64" ? "x86_64" : cpu === "arm64" ? "aarch64" : null;
+	if (!machine) throw new Error(`unsupported architecture "${cpu}" — build from source (apps/proxy) or set SEEKRIT_PROXY_BIN`);
+	switch (os) {
+		case "linux": return {
+			target: `${machine}-unknown-linux-musl`,
+			exe: ""
+		};
+		case "darwin": return {
+			target: `${machine}-apple-darwin`,
+			exe: ""
+		};
+		case "win32":
+			if (machine !== "x86_64") throw new Error(`no prebuilt seekrit-proxy for ${machine} Windows — set SEEKRIT_PROXY_BIN to a binary you built`);
+			return {
+				target: "x86_64-pc-windows-msvc",
+				exe: ".exe"
+			};
+		default: throw new Error(`unsupported platform "${os}" — build from source (apps/proxy) or set SEEKRIT_PROXY_BIN`);
+	}
+}
+/** `latest` stays `latest`; everything else is normalized to `v<x.y.z>`. */
+function versionPrefix(version) {
+	if (version === "latest") return "latest";
+	return version.startsWith("v") ? version : `v${version}`;
+}
+function resolveVersion(explicit) {
+	return explicit ?? process.env.SEEKRIT_PROXY_VERSION ?? "0.10.0";
+}
+function resolveBaseUrl(explicit) {
+	return (explicit ?? process.env.SEEKRIT_PROXY_BASE_URL ?? "https://proxy.seekrit.dev").replace(/\/+$/, "");
+}
+/** Where a resolved binary is kept, keyed so versions and targets never collide. */
+function proxyBinaryPath(version, target, exe) {
+	return join(defaultCacheDir(), "proxy", versionPrefix(version), target, `${BIN}${exe}`);
+}
+async function fetchBytes(url) {
+	const res = await fetch(url);
+	if (!res.ok) throw new Error(`GET ${url} → ${res.status} ${res.statusText}`);
+	return new Uint8Array(await res.arrayBuffer());
+}
+/**
+* Ensure a `seekrit-proxy` binary exists locally and return its path.
+*
+* Order: an explicit `SEEKRIT_PROXY_BIN`, then a cached download for this
+* version+target, then a fresh download. A binary already on `PATH` is
+* deliberately *not* used — silently running a different version than the one
+* this CLI pins is the kind of surprise that costs an afternoon.
+*/
+async function resolveProxyBinary(options = {}) {
+	const override = process.env.SEEKRIT_PROXY_BIN;
+	if (override) {
+		if (!existsSync(override)) throw new Error(`SEEKRIT_PROXY_BIN points at ${override}, which does not exist`);
+		return override;
+	}
+	const version = resolveVersion(options.version);
+	const { target, exe } = detectTarget();
+	const dest = proxyBinaryPath(version, target, exe);
+	if (!options.force && version !== "latest" && existsSync(dest)) return dest;
+	const baseUrl = resolveBaseUrl(options.baseUrl);
+	const prefix = versionPrefix(version);
+	const name = `${BIN}-${target}${exe}`;
+	const binUrl = `${baseUrl}/${prefix}/bin/${name}`;
+	const sumUrl = `${binUrl}.sha256`;
+	if (!options.quiet) process.stderr.write(`seekrit: fetching ${BIN} ${prefix} (${target})…\n`);
+	let bytes;
+	let expected;
+	try {
+		[bytes, expected] = await Promise.all([fetchBytes(binUrl), fetchBytes(sumUrl).then((b) => Buffer.from(b).toString("utf8").trim().split(/\s+/)[0] ?? "")]);
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		throw new Error(`could not download ${BIN} ${prefix} for ${target}: ${message}\n  Set SEEKRIT_PROXY_BIN to a binary you already have, or build it from apps/proxy.`);
+	}
+	const actual = createHash("sha256").update(bytes).digest("hex");
+	if (!expected || actual !== expected.toLowerCase()) throw new Error(`checksum mismatch for ${name}: expected ${expected || "(none published)"}, got ${actual}. Refusing to run it.`);
+	const dir = dirname(dest);
+	mkdirSync(dir, { recursive: true });
+	const staging = join(dir, `.${BIN}-${process.pid}-${actual.slice(0, 12)}${exe}`);
+	try {
+		writeFileSync(staging, bytes, { mode: 493 });
+		renameSync(staging, dest);
+	} catch (err) {
+		rmSync(staging, { force: true });
+		throw err;
+	}
+	chmodSync(dest, 493);
+	return dest;
+}
+/**
+* Run the proxy, forwarding stdio, signals, and its exit status.
+*
+* The proxy is a long-lived foreground process, so this wrapper has to be
+* transparent: Node cannot exec-replace itself, and without relaying signals
+* Node's default SIGINT handler would kill *this* process on Ctrl-C and leave
+* the proxy running, holding decrypted secrets, with the shell prompt back.
+*/
+async function runProxyBinary(argv, options = {}) {
+	const bin = await resolveProxyBinary(options);
+	const child = spawn(bin, argv, {
+		stdio: "inherit",
+		env: {
+			...process.env,
+			...options.env
+		}
+	});
+	const signals = [
+		"SIGINT",
+		"SIGTERM",
+		"SIGHUP",
+		"SIGQUIT"
+	];
+	const forward = (signal) => {
+		if (child.exitCode !== null || child.signalCode !== null) return;
+		child.kill(signal);
+	};
+	for (const signal of signals) process.on(signal, forward);
+	return new Promise((resolve, reject) => {
+		child.on("error", (err) => {
+			for (const s of signals) process.off(s, forward);
+			reject(/* @__PURE__ */ new Error(`could not start ${bin}: ${err.message}\n  If this is a fresh download, the platform may not match — set SEEKRIT_PROXY_BIN.`));
+		});
+		child.on("exit", (code, signal) => {
+			for (const s of signals) process.off(s, forward);
+			resolve(signal ? 128 + signalNumber(signal) : code ?? 0);
+		});
+	});
+}
+/** Signal name → number, for the 128+n exit convention. */
+function signalNumber(signal) {
+	return {
+		SIGHUP: 1,
+		SIGINT: 2,
+		SIGQUIT: 3,
+		SIGKILL: 9,
+		SIGTERM: 15
+	}[signal] ?? 0;
+}
+//#endregion
+//#region src/proxy-presets.ts
+/** `Authorization: Bearer {{seekrit:NAME}}` — the shape most providers take. */
+function placeholder(secret) {
+	return `{{seekrit:${secret}}}`;
+}
+/**
+* The catalogue. Ordered as `seekrit proxy presets` prints it: the two model
+* APIs an agent almost certainly calls, then the aggregators, then the generic
+* escape hatches.
+*/
+const PROXY_PRESETS = [
+	{
+		id: "openai",
+		label: "OpenAI API (api.openai.com)",
+		host: "api.openai.com",
+		prefix: "/openai",
+		secret: "OPENAI_API_KEY",
+		methods: ["GET", "POST"],
+		paths: ["/v1/**"],
+		baseUrlSuffix: "/v1",
+		env: (mode) => mode === "reverse" ? [{
+			name: "OPENAI_BASE_URL",
+			value: "{{base}}"
+		}, {
+			name: "OPENAI_API_KEY",
+			value: placeholder("OPENAI_API_KEY")
+		}] : [{
+			name: "OPENAI_API_KEY",
+			value: placeholder("OPENAI_API_KEY")
+		}]
+	},
+	{
+		id: "anthropic",
+		label: "Anthropic API (api.anthropic.com)",
+		host: "api.anthropic.com",
+		prefix: "/anthropic",
+		secret: "ANTHROPIC_API_KEY",
+		methods: ["GET", "POST"],
+		paths: ["/v1/**"],
+		baseUrlSuffix: "",
+		env: (mode) => mode === "reverse" ? [{
+			name: "ANTHROPIC_BASE_URL",
+			value: "{{base}}"
+		}, {
+			name: "ANTHROPIC_API_KEY",
+			value: placeholder("ANTHROPIC_API_KEY")
+		}] : [{
+			name: "ANTHROPIC_API_KEY",
+			value: placeholder("ANTHROPIC_API_KEY")
+		}]
+	},
+	{
+		id: "openrouter",
+		label: "OpenRouter (openrouter.ai) — OpenAI-compatible",
+		host: "openrouter.ai",
+		prefix: "/openrouter",
+		secret: "OPENROUTER_API_KEY",
+		methods: ["GET", "POST"],
+		paths: ["/api/v1/**"],
+		baseUrlSuffix: "/api/v1",
+		env: (mode) => mode === "reverse" ? [{
+			name: "OPENAI_BASE_URL",
+			value: "{{base}}"
+		}, {
+			name: "OPENAI_API_KEY",
+			value: placeholder("OPENROUTER_API_KEY")
+		}] : [{
+			name: "OPENROUTER_API_KEY",
+			value: placeholder("OPENROUTER_API_KEY")
+		}]
+	},
+	{
+		id: "github",
+		label: "GitHub REST + GraphQL API (api.github.com)",
+		host: "api.github.com",
+		prefix: "/github",
+		secret: "GITHUB_TOKEN",
+		methods: [],
+		paths: [],
+		baseUrlSuffix: "",
+		env: (mode) => mode === "reverse" ? [{
+			name: "GITHUB_API_URL",
+			value: "{{base}}"
+		}, {
+			name: "GITHUB_TOKEN",
+			value: placeholder("GITHUB_TOKEN")
+		}] : [{
+			name: "GITHUB_TOKEN",
+			value: placeholder("GITHUB_TOKEN")
+		}],
+		note: "`gh` resolves api.github.com from GH_HOST, not a base URL — prefer forward mode for it."
+	},
+	{
+		id: "openai-compatible",
+		label: "Any OpenAI-compatible gateway — LiteLLM, vLLM, Ollama, Together, self-hosted",
+		host: "",
+		prefix: "/gateway",
+		secret: "OPENAI_API_KEY",
+		methods: ["GET", "POST"],
+		paths: ["/v1/**"],
+		baseUrlSuffix: "/v1",
+		requiresBaseUrl: true,
+		env: (mode) => mode === "reverse" ? [{
+			name: "OPENAI_BASE_URL",
+			value: "{{base}}"
+		}, {
+			name: "OPENAI_API_KEY",
+			value: placeholder("OPENAI_API_KEY")
+		}] : [{
+			name: "OPENAI_API_KEY",
+			value: placeholder("OPENAI_API_KEY")
+		}],
+		note: "Needs --base-url (e.g. --base-url https://litellm.internal:4000)."
+	}
+];
+function findPreset(id) {
+	return PROXY_PRESETS.find((p) => p.id === id);
+}
+function presetIds() {
+	return PROXY_PRESETS.map((p) => p.id);
+}
+/**
+* Apply `--base-url` / `--secret` / `--prefix` overrides to a preset.
+*
+* Returns a new preset rather than mutating the catalogue entry: the same
+* process can generate two configs in one run (a test does), and a preset that
+* remembered the last `--base-url` would be a genuinely confusing bug.
+*/
+function specialize(preset, overrides) {
+	let host = preset.host;
+	let paths = preset.paths;
+	let baseUrlSuffix = preset.baseUrlSuffix;
+	if (overrides.baseUrl) {
+		const url = new URL(overrides.baseUrl);
+		host = url.hostname.toLowerCase();
+		const upstreamPath = url.pathname.replace(/\/+$/, "");
+		if (upstreamPath) {
+			paths = [];
+			baseUrlSuffix = `${upstreamPath}${preset.baseUrlSuffix}`;
+		}
+	}
+	const secret = overrides.secret ?? preset.secret;
+	const specialized = {
+		...preset,
+		host,
+		paths,
+		baseUrlSuffix,
+		secret,
+		prefix: overrides.prefix ?? preset.prefix
+	};
+	if (preset.allow && secret !== preset.secret) specialized.allow = preset.allow.map((name) => name === preset.secret ? secret : name);
+	if (secret !== preset.secret) specialized.env = (mode) => preset.env(mode).map((hint) => ({
+		...hint,
+		value: hint.value.replace(/\{\{seekrit:[A-Za-z0-9_]+\}\}/, placeholder(secret))
+	}));
+	return specialized;
+}
+/** The secret names a preset's rule permits. Default-deny: empty means none. */
+function presetAllow(preset) {
+	if (preset.allow) return preset.allow;
+	return preset.secret ? [preset.secret] : [];
+}
+//#endregion
+//#region src/proxy-config.ts
+/**
+* A deliberately small TOML writer: basic strings and arrays of them, which is
+* every value in this config. Full TOML is not needed and a general emitter
+* would be one more thing that can disagree with the parser on an edge case.
+*/
+function tomlString(value) {
+	return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\t/g, "\\t").replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, (c) => {
+		return `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`;
+	})}"`;
+}
+function tomlArray(values) {
+	return `[${values.map(tomlString).join(", ")}]`;
+}
+/**
+* Claim `preferred` if nothing else has it, else derive one from `host`.
+*
+* Two rules can name the same preset-known host (a narrow rule above a broad
+* one is the documented pattern), and two routes cannot share a prefix — so the
+* second one needs a distinct, still-recognisable name rather than an error.
+*/
+function claimPrefix(preferred, host, taken) {
+	if (preferred && !taken.has(preferred)) {
+		taken.add(preferred);
+		return preferred;
+	}
+	return prefixForHost(host, taken);
+}
+/** Slug for a route prefix, derived from a hostname. */
+function prefixForHost(host, taken) {
+	const labels = host.split(".").filter(Boolean);
+	while (labels.length > 1 && (labels[0] === "api" || labels[0] === "www")) labels.shift();
+	const base = (labels[0] ?? "upstream").replace(/[^a-z0-9-]/gi, "").toLowerCase() || "upstream";
+	let prefix = `/${base}`;
+	let n = 2;
+	while (taken.has(prefix)) prefix = `/${base}-${n++}`;
+	taken.add(prefix);
+	return prefix;
+}
+const HEADER = `# seekrit-proxy configuration — generated by \`seekrit proxy init\`.
+#
+# The proxy resolves the secrets its service token grants (SEEKRIT_TOKEN in the
+# environment, never in this file), then swaps {{seekrit:NAME}} placeholders in
+# outbound requests for the decrypted values before forwarding upstream.
+#
+# Safe to commit: it contains hostnames, secret *names*, and thumbprints — no
+# secret values and no credential. Review it before you rely on it; the
+# allowlist below is a security boundary, and a generator does not know your
+# threat model.`;
+/** Render the plan as the text of a `seekrit-proxy.toml`. */
+function renderProxyConfig(plan) {
+	const out = [HEADER];
+	const server = Boolean(plan.policy);
+	if (plan.notes.length > 0) {
+		out.push("#");
+		for (const note of plan.notes) out.push(`# ${note}`);
+	}
+	out.push("");
+	const reverse = plan.mode === "reverse" || plan.mode === "both";
+	const forward = plan.mode === "forward" || plan.mode === "both";
+	if (reverse) {
+		out.push(`listen = ${tomlString(plan.listen)}`);
+		out.push("");
+	} else {
+		out.push("# Forward-proxy only: the reverse plane still binds this address and");
+		out.push("# serves nothing, since no [[route]] is declared below.");
+		out.push(`listen = ${tomlString(plan.listen)}`);
+		out.push("");
+	}
+	if (reverse) for (const route of plan.routes) {
+		out.push("[[route]]");
+		out.push(`prefix = ${tomlString(route.prefix)}`);
+		out.push(`upstream = ${tomlString(route.upstream)}`);
+		if (server) out.push("# allow/methods/paths come from published policy in server mode.");
+		else {
+			if (route.allow.length > 0) out.push(`allow = ${tomlArray(route.allow)}`);
+			else out.push("# No `allow`: this route permits the operation but carries no credential.");
+			if (route.methods.length > 0) out.push(`methods = ${tomlArray(route.methods)}`);
+			if (route.paths.length > 0) out.push(`paths = ${tomlArray(route.paths)}`);
+			if (route.label) out.push(`label = ${tomlString(route.label)}`);
+		}
+		out.push("");
+	}
+	if (forward) {
+		out.push("[forward]");
+		out.push(`listen = ${tomlString(plan.forwardListen)}`);
+		out.push(`unmatched_host_policy = ${tomlString(plan.unmatched)}`);
+		out.push(`ca_cert = ${tomlString(plan.caCert)}`);
+		out.push(`ca_key = ${tomlString(plan.caKey)}`);
+		out.push("");
+		if (server) {
+			out.push("# Intercepted hosts come from published policy in server mode, so there are");
+			out.push("# no [[forward.host]] blocks here — adding an upstream is a dashboard change.");
+			out.push("");
+		} else for (const route of plan.routes) {
+			out.push("[[forward.host]]");
+			out.push(`match = ${tomlString(route.host)}`);
+			if (route.allow.length > 0) out.push(`allow = ${tomlArray(route.allow)}`);
+			else out.push("# No `allow`: reachable, but no credential travels toward it.");
+			if (route.methods.length > 0) out.push(`methods = ${tomlArray(route.methods)}`);
+			if (route.paths.length > 0) out.push(`paths = ${tomlArray(route.paths)}`);
+			if (route.label) out.push(`label = ${tomlString(route.label)}`);
+			out.push("");
+		}
+	}
+	if (plan.policy) {
+		out.push("# ---------------------------------------------------------------------------");
+		out.push("# Rules come from agent access policy in the dashboard. The bundle is signed");
+		out.push("# in a publishing admin's browser, and this proxy refuses any bundle not");
+		out.push("# signed by a key whose thumbprint is pinned below. So seekrit can withhold");
+		out.push("# your policy (the proxy then fails closed) but cannot widen it.");
+		out.push("# ---------------------------------------------------------------------------");
+		out.push("[policy]");
+		out.push("source = \"server\"");
+		out.push(`agent = ${tomlString(plan.policy.agent)}`);
+		if (plan.policy.agents.length > 1) out.push(`agents = ${tomlArray(plan.policy.agents)}`);
+		out.push(`refresh_interval = ${tomlString(plan.policy.refreshInterval)}`);
+		out.push("");
+		out.push("# THE TRUST ANCHOR — the one value that must not come from the API. Confirm");
+		out.push("# each thumbprint against the dashboard's trust-anchor panel before relying");
+		out.push("# on this file, and pin a second admin's key too: one pinned signer means one");
+		out.push("# lost passphrase leaves nobody able to publish.");
+		for (const signer of plan.policy.signers) out.push(signer.provenance === "own" ? `#   ${signer.thumbprint} — your own signing key (derived locally).` : `#   ${signer.thumbprint} — read from the policy the API served. VERIFY THIS.`);
+		if (plan.policy.signers.length === 0) {
+			out.push("#   (none found — paste the thumbprint from the dashboard.)");
+			out.push("# signers = [\"<thumbprint>\"]");
+			out.push("signers = []   # ← the proxy refuses to start until this is filled in.");
+		} else out.push(`signers = ${tomlArray(plan.policy.signers.map((s) => s.thumbprint))}`);
+		out.push("");
+	} else if (plan.secretsRefresh) {
+		out.push("# Re-resolve on an interval, so a secret added later reaches a running proxy.");
+		out.push("# No new grant is involved: a new secret in an environment this proxy already");
+		out.push("# has a key grant for decrypts with the key it already holds.");
+		out.push("[secrets]");
+		out.push(`refresh_interval = ${tomlString(plan.secretsRefresh)}`);
+		out.push("");
+	}
+	if (plan.cache) {
+		out.push("# Start on the last (encrypted) resolve response if the API is unreachable.");
+		out.push("# A *refused* resolve still fails closed, and decrypting a cached entry still");
+		out.push("# needs this proxy's service token.");
+		out.push("[cache]");
+		out.push("enabled = true");
+		out.push(`max_age = ${tomlString(plan.cache.maxAge)}`);
+		out.push("");
+	}
+	if (plan.control) {
+		out.push("# One proxy fronting several agents: the orchestrator mints a ticket per");
+		out.push("# agent. Requires SEEKRIT_PROXY_CONTROL_TOKEN in the environment, and that");
+		out.push("# token must not be readable by the agents.");
+		out.push("[control]");
+		out.push(`listen = ${tomlString(plan.control.listen)}`);
+		out.push(`ttl = ${tomlString(plan.control.ttl)}`);
+		out.push(`max_ttl = ${tomlString(plan.control.maxTtl)}`);
+		out.push("");
+	}
+	if (plan.tasks) {
+		out.push("# Honour tasks dispatched through the API (`seekrit agents dispatch`): a run");
+		out.push("# presents its skd_… token in the same header a local ticket uses, and this");
+		out.push("# proxy asks the API what it authorizes. Opt-in, because it makes authorizing");
+		out.push("# a new run depend on reaching seekrit — a refused or unreachable check denies");
+		out.push("# the request rather than admitting it.");
+		out.push("#");
+		out.push("# cache_ttl bounds how long a revoked run keeps working. Short on purpose.");
+		out.push("[tasks]");
+		out.push(`cache_ttl = ${tomlString(plan.tasks.cacheTtl)}`);
+		out.push("");
+	}
+	if (plan.activity) {
+		out.push("# Report aggregate decisions back, so `seekrit agents review` can compare this");
+		out.push("# policy against what the agent actually does. Counts only: hosts, methods,");
+		out.push("# secret *names*, and which rule decided — never a request path, never a value.");
+		out.push("# Full per-request detail stays in your own OTLP collector.");
+		out.push("[activity]");
+		out.push(`flush_interval = ${tomlString(plan.activity.flushInterval)}`);
+		out.push("");
+	}
+	if (plan.envHints.length > 0) {
+		out.push("# ---------------------------------------------------------------------------");
+		out.push("# Point the workload at the proxy (these go in its environment, not here):");
+		out.push("#");
+		for (const hint of plan.envHints) {
+			out.push(`#   export ${hint.name}='${hint.value}'`);
+			if (hint.note) out.push(`#     ${hint.note}`);
+		}
+		out.push("# ---------------------------------------------------------------------------");
+	}
+	return `${out.join("\n").replace(/\n{3,}/g, "\n\n").trimEnd()}\n`;
+}
+const PLAN_DEFAULTS = {
+	mode: "reverse",
+	listen: "127.0.0.1:8080",
+	forwardListen: "127.0.0.1:8081",
+	unmatched: "tunnel",
+	caCert: "seekrit-proxy-ca.pem",
+	caKey: "seekrit-proxy-ca-key.pem"
+};
+/** The base URL a workload points an SDK at, for a route in reverse mode. */
+function baseUrlFor(listen, prefix, suffix) {
+	const [hostPart = "127.0.0.1", port = "8080"] = splitHostPort(listen);
+	return `http://${hostPart === "0.0.0.0" || hostPart === "[::]" ? "127.0.0.1" : hostPart}:${port}${prefix}${suffix}`;
+}
+/** Split `host:port`, tolerating a bracketed IPv6 literal. */
+function splitHostPort(addr) {
+	const bracketed = /^\[(.+)\]:(\d+)$/.exec(addr);
+	if (bracketed) return [`[${bracketed[1]}]`, bracketed[2]];
+	const idx = addr.lastIndexOf(":");
+	if (idx === -1) return [addr, "8080"];
+	return [addr.slice(0, idx), addr.slice(idx + 1)];
+}
+/** Build a file-policy plan from presets and/or ad-hoc `host=SECRET` rules. */
+function planFromPresets(presets, options) {
+	const taken = /* @__PURE__ */ new Set();
+	const routes = [];
+	const envHints = [];
+	const notes = [];
+	const hintMode = options.mode === "forward" ? "forward" : "reverse";
+	for (const preset of presets) {
+		const prefix = claimPrefix(preset.prefix, preset.host, taken);
+		const baseUrl = baseUrlFor(options.listen, prefix, preset.baseUrlSuffix);
+		routes.push({
+			prefix,
+			upstream: `https://${preset.host}`,
+			host: preset.host,
+			allow: presetAllow(preset),
+			methods: preset.methods,
+			paths: preset.paths,
+			label: preset.label,
+			baseUrl
+		});
+		for (const hint of preset.env(hintMode)) envHints.push({
+			...hint,
+			value: hint.value.replace("{{base}}", baseUrl)
+		});
+		if (preset.note) notes.push(`${preset.id}: ${preset.note}`);
+	}
+	if (hintMode === "forward") envHints.unshift({
+		name: "HTTPS_PROXY",
+		value: `http://${options.forwardListen}`
+	}, {
+		name: "NODE_EXTRA_CA_CERTS",
+		value: `$PWD/${options.caCert}`,
+		note: "or SSL_CERT_FILE / REQUESTS_CA_BUNDLE, depending on the runtime."
+	});
+	return {
+		mode: options.mode,
+		listen: options.listen,
+		forwardListen: options.forwardListen,
+		routes,
+		unmatched: options.unmatched,
+		caCert: options.caCert,
+		caKey: options.caKey,
+		...options.cacheMaxAge ? { cache: { maxAge: options.cacheMaxAge } } : {},
+		...options.secretsRefresh ? { secretsRefresh: options.secretsRefresh } : {},
+		...options.control ? { control: options.control } : {},
+		...options.tasks ? { tasks: options.tasks } : {},
+		...options.activity ? { activity: options.activity } : {},
+		envHints,
+		notes
+	};
+}
+/**
+* Build a server-policy plan from an agent's published rules.
+*
+* The rules are used for **routing only** — one `[[route]]` per distinct host,
+* so the workload has a base URL to point at — and never copied into the file as
+* authorization. That is the whole trade of server mode: adding an upstream
+* becomes a dashboard change, and a rule this file also stated would be a
+* startup error rather than a belt-and-braces duplicate.
+*/
+function planFromPolicy(args, options) {
+	const taken = /* @__PURE__ */ new Set();
+	const routes = [];
+	const envHints = [];
+	const notes = [];
+	const hintMode = options.mode === "forward" ? "forward" : "reverse";
+	const seen = /* @__PURE__ */ new Set();
+	for (const rule of args.rules) {
+		if (!rule.host || seen.has(rule.host)) continue;
+		seen.add(rule.host);
+		const preset = PRESET_BY_HOST.get(rule.host);
+		const prefix = claimPrefix(preset?.prefix, rule.host, taken);
+		const baseUrl = baseUrlFor(options.listen, prefix, preset?.baseUrlSuffix ?? "");
+		routes.push({
+			prefix,
+			upstream: `https://${rule.host}`,
+			host: rule.host,
+			allow: [],
+			methods: [],
+			paths: [],
+			baseUrl
+		});
+		if (preset) for (const hint of preset.env(hintMode)) envHints.push({
+			...hint,
+			value: hint.value.replace("{{base}}", baseUrl)
+		});
+	}
+	if (hintMode === "forward") envHints.unshift({
+		name: "HTTPS_PROXY",
+		value: `http://${options.forwardListen}`
+	}, {
+		name: "NODE_EXTRA_CA_CERTS",
+		value: `$PWD/${options.caCert}`,
+		note: "or SSL_CERT_FILE / REQUESTS_CA_BUNDLE, depending on the runtime."
+	});
+	if (args.rules.length === 0) notes.push("The published policy has no rules yet, so this proxy permits nothing until one is published.");
+	return {
+		mode: options.mode,
+		listen: options.listen,
+		forwardListen: options.forwardListen,
+		routes,
+		policy: {
+			agent: args.agent,
+			agents: args.agents,
+			refreshInterval: args.refreshInterval,
+			signers: args.signers
+		},
+		unmatched: options.unmatched,
+		caCert: options.caCert,
+		caKey: options.caKey,
+		...options.cacheMaxAge ? { cache: { maxAge: options.cacheMaxAge } } : {},
+		...options.control ? { control: options.control } : {},
+		...options.tasks ? { tasks: options.tasks } : {},
+		...options.activity ? { activity: options.activity } : {},
+		envHints,
+		notes
+	};
+}
+/** Host → preset, for naming routes generated from published policy. */
+const PRESET_BY_HOST = /* @__PURE__ */ new Map();
+for (const id of [
+	"openai",
+	"anthropic",
+	"openrouter",
+	"github"
+]) {
+	const preset = findPreset(id);
+	if (preset?.host) PRESET_BY_HOST.set(preset.host, preset);
+}
+/** YAML double-quoted scalar. Compose values here are hostnames and URLs. */
+function yamlString(value) {
+	return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
+}
+const COMPOSE_DEFAULTS = {
+	service: "seekrit-proxy",
+	workload: "agent",
+	publish: false
+};
+/**
+* A `docker compose` sidecar snippet for a generated config.
+*
+* The container case differs from the local one in exactly the ways that break a
+* copied-from-the-docs compose file: the proxy has to bind `0.0.0.0` to be
+* reachable from a sibling container, the workload dials it by *service name*
+* rather than loopback, and in forward mode the CA has to live on a shared
+* volume or the workload trusts a certificate the proxy no longer has.
+*/
+function renderComposeSnippet(plan, options) {
+	const reverse = plan.mode === "reverse" || plan.mode === "both";
+	const forward = plan.mode === "forward" || plan.mode === "both";
+	const [, listenPort = "8080"] = splitHostPort(plan.listen);
+	const [, forwardPort = "8081"] = splitHostPort(plan.forwardListen);
+	const host = options.service;
+	const out = [
+		"# seekrit-proxy sidecar — generated by `seekrit proxy compose`.",
+		"#",
+		"# The proxy holds the decrypted secrets; the workload holds only placeholders.",
+		"# Keeping them in separate containers is what makes that boundary real: the",
+		"# service token is in the proxy's environment, where the workload cannot read it.",
+		"services:",
+		`  ${host}:`,
+		`    image: ${options.image}`
+	];
+	const command = [];
+	if (reverse) command.push("--listen", `0.0.0.0:${listenPort}`);
+	if (command.length > 0) out.push(`    command: [${command.map(yamlString).join(", ")}]`);
+	if (forward) {
+		out.push(`    # Forward mode: set \`[forward] listen = "0.0.0.0:${forwardPort}"\` in the`);
+		out.push("    # config too — there is no flag for the forward plane's address.");
+	}
+	out.push("    environment:");
+	out.push("      # Never inline the token. Compose reads it from your shell or a .env file.");
+	out.push("      SEEKRIT_TOKEN: ${SEEKRIT_TOKEN:?SEEKRIT_TOKEN is required}");
+	out.push("    volumes:");
+	out.push("      - ./seekrit-proxy.toml:/seekrit-proxy.toml:ro");
+	if (forward) {
+		out.push("      # The interception CA must survive restarts, or the certificate the");
+		out.push("      # workload trusts stops matching the one the proxy mints leaves from.");
+		out.push("      - seekrit-proxy-ca:/ca");
+	}
+	if (options.publish) {
+		out.push("    ports:");
+		if (reverse) out.push(`      - ${yamlString(`127.0.0.1:${listenPort}:${listenPort}`)}`);
+		if (forward) out.push(`      - ${yamlString(`127.0.0.1:${forwardPort}:${forwardPort}`)}`);
+	} else {
+		out.push("    # No `ports`: reachable on the compose network only, which is what you");
+		out.push("    # want — nothing outside this project can ask the proxy to inject a key.");
+	}
+	out.push("    restart: unless-stopped");
+	out.push("");
+	out.push(`  ${options.workload}:`);
+	out.push("    # ← your workload. It never holds a real credential.");
+	out.push("    image: your-agent:latest");
+	out.push("    depends_on:");
+	out.push(`      - ${host}`);
+	out.push("    environment:");
+	if (forward) {
+		out.push(`      HTTPS_PROXY: ${yamlString(`http://${host}:${forwardPort}`)}`);
+		out.push(`      HTTP_PROXY: ${yamlString(`http://${host}:${forwardPort}`)}`);
+		out.push("      NODE_EXTRA_CA_CERTS: \"/ca/seekrit-proxy-ca.pem\"");
+		out.push("      # …or SSL_CERT_FILE / REQUESTS_CA_BUNDLE, depending on the runtime.");
+	}
+	for (const hint of plan.envHints) {
+		if (hint.name === "HTTPS_PROXY" || hint.name === "NODE_EXTRA_CA_CERTS") continue;
+		const value = hint.value.replace(/http:\/\/[^/]+/, `http://${host}:${listenPort}`);
+		out.push(`      ${hint.name}: ${yamlString(value)}`);
+	}
+	out.push("");
+	if (forward) {
+		out.push("volumes:");
+		out.push("  seekrit-proxy-ca:");
+		out.push("");
+	}
+	out.push(forward ? "# The workload can unset HTTPS_PROXY, so in a threat model where the workload" : "# The workload can ignore the base URL above, so in a threat model where the");
+	out.push(forward ? "# is the adversary, make the proxy the only route out: put the workload on an" : "# workload is the adversary, make the proxy the only route out: put the workload");
+	out.push(forward ? "# `internal: true` network with the proxy as its only peer." : "# on an `internal: true` network with the proxy as its only peer.");
+	return `${out.join("\n").replace(/\n{3,}/g, "\n\n").trimEnd()}\n`;
+}
+//#endregion
+//#region src/proxy.ts
+/**
+* `seekrit proxy` — get `seekrit-proxy` running without a Rust toolchain or a
+* hand-written TOML file.
+*
+* The proxy is the only thing here that keeps a decrypted secret out of an
+* untrusted workload's memory entirely, and it was also the least likely to be
+* tried: `cargo build` and a config file, before you learn anything. These
+* subcommands close that gap from both ends —
+*
+*   seekrit proxy run --preset openai        # nothing installed, nothing written
+*   seekrit proxy init --agent nova          # a reviewable file from live policy
+*
+* — and none of them changes what the proxy does. The generated config is the
+* same config; the fetched binary is the released binary, checksum-verified.
+*/
+const DEFAULT_CONFIG = "seekrit-proxy.toml";
+/**
+* The exact grammar `seekrit_cache::parse_duration` accepts: a positive integer,
+* optionally suffixed `s`/`m`/`h`/`d` (bare means seconds). Notably **not** `ms`
+* — `--refresh 500ms` is the typo this catches, and catching it here saves a
+* binary download before the proxy's own startup error.
+*/
+const DURATION = /^[1-9]\d*[smhd]?$/;
+function duration(value, flag) {
+	if (value === void 0) return void 0;
+	const trimmed = value.trim();
+	if (!DURATION.test(trimmed)) fail(`${flag} must be a duration like 30s, 10m, 24h, or 7d (got "${value}")`);
+	return trimmed;
+}
+function planOptions(options) {
+	const mode = options.mode ?? PLAN_DEFAULTS.mode;
+	if (mode !== "reverse" && mode !== "forward" && mode !== "both") fail(`--mode must be reverse, forward, or both (got "${mode}")`);
+	const unmatched = options.unmatched ?? PLAN_DEFAULTS.unmatched;
+	if (unmatched !== "tunnel" && unmatched !== "deny") fail(`--unmatched must be tunnel or deny (got "${unmatched}")`);
+	const listen = options.listen ?? PLAN_DEFAULTS.listen;
+	const forwardListen = options.forwardListen ?? PLAN_DEFAULTS.forwardListen;
+	if (mode === "both" && listen === forwardListen) fail(`--listen and --forward-listen cannot both be ${listen} — the two planes need separate ports`);
+	if (options.control && (options.control === listen || options.control === forwardListen)) fail(`--control cannot share an address with a data plane (${options.control})`);
+	const refresh = duration(options.refresh, "--refresh");
+	return {
+		mode,
+		listen,
+		forwardListen,
+		unmatched,
+		caCert: options.caCert ?? PLAN_DEFAULTS.caCert,
+		caKey: options.caKey ?? PLAN_DEFAULTS.caKey,
+		...options.cache || options.cacheMaxAge ? { cacheMaxAge: duration(options.cacheMaxAge, "--cache-max-age") ?? "24h" } : {},
+		...refresh ? { secretsRefresh: refresh } : {},
+		...options.control ? { control: {
+			listen: options.control,
+			ttl: "1h",
+			maxTtl: "12h"
+		} } : {},
+		...options.tasks || options.tasksCacheTtl ? { tasks: { cacheTtl: duration(options.tasksCacheTtl, "--tasks-cache-ttl") ?? "30s" } } : {},
+		...options.activity || options.activityInterval ? { activity: { flushInterval: duration(options.activityInterval, "--activity-interval") ?? "60s" } } : {}
+	};
+}
+/**
+* Turn `--host api.foo.com=FOO_KEY,BAR_KEY` into a preset-shaped rule.
+*
+* The `=SECRET` half is optional on purpose: a rule with no `allow` permits an
+* operation without letting a credential travel with it, which is a real thing
+* to want and impossible to express if the flag demanded a secret name.
+*/
+function presetFromHostSpec(spec, index) {
+	const [hostPart = "", secretPart] = spec.split("=", 2);
+	const host = hostPart.trim().toLowerCase();
+	if (!host) fail(`--host needs a hostname (got "${spec}")`);
+	if (/^[a-z][a-z0-9+.-]*:\/\//.test(host) || host.includes("/")) fail(`--host takes a bare hostname, not a URL (got "${host}")`);
+	if (host.includes(":")) fail(`--host takes a hostname without a port (got "${host}")`);
+	const secrets = (secretPart ?? "").split(",").map((s) => s.trim()).filter(Boolean);
+	for (const name of secrets) if (!/^[A-Za-z0-9_]+$/.test(name)) fail(`"${name}" is not a valid secret name (letters, digits, and _ only)`);
+	const labels = host.split(".").filter(Boolean);
+	while (labels.length > 1 && (labels[0] === "api" || labels[0] === "www")) labels.shift();
+	return {
+		id: host,
+		label: host,
+		host,
+		prefix: `/${(labels[0] ?? `upstream${index}`).replace(/[^a-z0-9-]/g, "") || `upstream${index}`}`,
+		secret: secrets[0] ?? "",
+		allow: secrets,
+		methods: [],
+		paths: [],
+		baseUrlSuffix: "",
+		env: () => secrets[0] ? [{
+			name: secrets[0],
+			value: `{{seekrit:${secrets[0]}}}`
+		}] : [],
+		...secrets.length > 1 ? { note: `also allows ${secrets.slice(1).join(", ")} — pass each as a placeholder.` } : {}
+	};
+}
+/** Collect the presets/hosts a `--preset`/`--host`-driven invocation names. */
+function gatherPresets(options) {
+	const chosen = [];
+	for (const id of options.preset ?? []) {
+		const preset = findPreset(id);
+		if (!preset) fail(`unknown preset "${id}" — try one of: ${presetIds().join(", ")}`);
+		if (preset.requiresBaseUrl && !options.baseUrl) fail(`preset "${id}" needs --base-url (e.g. --base-url https://litellm.internal:4000)`);
+		chosen.push(specialize(preset, {
+			...options.baseUrl ? { baseUrl: options.baseUrl } : {},
+			...options.secret ? { secret: options.secret } : {},
+			...options.prefix ? { prefix: options.prefix } : {}
+		}));
+	}
+	(options.host ?? []).forEach((spec, i) => {
+		chosen.push(presetFromHostSpec(spec, i));
+	});
+	return chosen;
+}
+/**
+* Read an agent's published policy through the route the proxy itself polls.
+*
+* Deliberately the proxy-facing route rather than the org-scoped admin one: the
+* machine that runs `seekrit proxy init` is usually the machine that holds the
+* *proxy's* token, not an admin's, and a config generated from the same bytes the
+* proxy will fetch cannot disagree with what the proxy then does.
+*/
+async function fetchPolicy(ctx, agentRef, orgSlug) {
+	let served;
+	try {
+		served = await ctx.client.getAgentPolicyBundle(agentRef);
+	} catch (err) {
+		fail(`could not read policy for agent "${agentRef}": ${err instanceof Error ? err.message : String(err)}\n  Publish a policy for it in the dashboard first (Agents → the identity → Publish),
+  or generate a file-policy config instead with --preset / --host.`);
+	}
+	let rules = [];
+	try {
+		rules = parseAgentPolicyUnverified(served.bundle).rules;
+	} catch (err) {
+		fail(`the API served a policy bundle this CLI cannot decode: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	const signers = [];
+	try {
+		const org = await resolveOrg(ctx, orgSlug);
+		const { signer } = await ctx.client.getMyPolicySigner(org.id);
+		if (signer) signers.push({
+			thumbprint: signer.thumbprint,
+			provenance: "own"
+		});
+	} catch {}
+	if (!signers.some((s) => s.thumbprint === served.signerThumbprint)) signers.push({
+		thumbprint: served.signerThumbprint,
+		provenance: "published"
+	});
+	return {
+		slug: served.agent.slug,
+		rules,
+		signers,
+		version: served.version
+	};
+}
+/** Build the plan a `--agent` / `--preset` invocation describes. */
+async function buildPlan(options) {
+	const plan = planOptions(options);
+	if (options.agent) {
+		if ((options.preset ?? []).length > 0 || (options.host ?? []).length > 0) fail("--agent takes the rules from published policy, so --preset/--host cannot also apply.\n  Server-policy mode rejects local rules rather than silently ignoring them.");
+		const policy = await fetchPolicy(buildContext(), options.agent, options.org);
+		const agents = options.agents?.length ? options.agents : [policy.slug];
+		process.stderr.write(`seekrit: agent ${policy.slug} — policy v${policy.version}, ${policy.rules.length} rule(s)\n`);
+		return planFromPolicy({
+			agent: policy.slug,
+			agents,
+			rules: policy.rules,
+			signers: policy.signers,
+			refreshInterval: plan.secretsRefresh ?? "10s"
+		}, plan);
+	}
+	const presets = gatherPresets(options);
+	if (presets.length === 0) fail("nothing to configure — pass --preset <name> (see `seekrit proxy presets`), --host <host>[=SECRET],\n  or --agent <slug> to take the rules from published policy.");
+	return planFromPresets(presets, plan);
+}
+/** Add the generation flags to a command, so `init` and `run` stay in step. */
+function withGenerateOptions(cmd) {
+	return cmd.option("--preset <name>", "gateway preset (repeatable; see `seekrit proxy presets`)", (value, acc = []) => [...acc, value]).option("--host <host[=SECRET,…]>", "ad-hoc rule: bare hostname, optionally the secrets it may receive (repeatable)", (value, acc = []) => [...acc, value]).option("--base-url <url>", "upstream base URL for an OpenAI-compatible gateway").option("--secret <NAME>", "override a preset's secret name").option("--prefix <path>", "override a preset's route prefix").option("--agent <slug>", "take the rules from published agent policy (server mode)").option("--agents <slug>", "additional identities this proxy may serve", (v, a = []) => [...a, v]).option("--org <slug>", "organization (for --agent)").option("--mode <reverse|forward|both>", "which data plane(s) to configure", "reverse").option("--listen <addr>", `reverse-proxy address (default: ${PLAN_DEFAULTS.listen})`).option("--forward-listen <addr>", `forward-proxy address (default: ${PLAN_DEFAULTS.forwardListen})`).option("--unmatched <tunnel|deny>", "what to do with an unruled host in forward mode").option("--ca-cert <path>", "interception CA certificate path (forward mode)").option("--ca-key <path>", "interception CA key path (forward mode)").option("--cache", "add a [cache] block so the proxy can start during an outage").option("--cache-max-age <dur>", "how stale a cached resolve may be (implies --cache)").option("--refresh <dur>", "re-resolve/re-fetch interval").option("--control <addr>", "add a [control] listener for per-agent session tickets").option("--tasks", "add a [tasks] block so this proxy honours runs dispatched with `seekrit agents dispatch`").option("--tasks-cache-ttl <dur>", "how long an introspected task is reused (implies --tasks)").option("--activity", "add an [activity] block so this proxy reports aggregate decisions for `seekrit agents review`").option("--activity-interval <dur>", "how often counts are flushed (implies --activity)");
+}
+function registerProxyCommands(program) {
+	const proxy = program.command("proxy").description("run and configure the agent egress proxy (`seekrit proxy --help`)");
+	proxy.command("presets").description("list the ready-made upstream presets").option("--json", "machine-readable output").action((options) => {
+		emit(options, { presets: PROXY_PRESETS }, () => {
+			printTable(PROXY_PRESETS, [
+				col("PRESET", (p) => p.id),
+				col("HOST", (p) => p.host || "(--base-url)"),
+				col("SECRET", (p) => p.secret),
+				col("PREFIX", (p) => p.prefix),
+				col("DESCRIPTION", (p) => p.label)
+			], "no presets");
+			process.stderr.write("\nUse one with: seekrit proxy run --preset openai\nAnything not listed here works too: --host api.example.com=EXAMPLE_API_KEY\n");
+		});
+	});
+	withGenerateOptions(proxy.command("init").description("write a seekrit-proxy.toml from presets or published policy")).option("-o, --out <path>", "where to write it", DEFAULT_CONFIG).option("--print", "write to stdout instead of a file").option("--force", "overwrite an existing file").action(async (options) => {
+		const plan = await buildPlan(options);
+		const text = renderProxyConfig(plan);
+		if (options.print) {
+			process.stdout.write(text);
+			return;
+		}
+		const out = resolve(options.out);
+		if (existsSync(out) && !options.force) fail(`${options.out} already exists — pass --force to overwrite, or --print to review it`);
+		writeFileSync(out, text, { mode: 420 });
+		process.stderr.write(`Wrote ${options.out}\n`);
+		process.stderr.write(`
+Next:
+  export SEEKRIT_TOKEN=skt_…            # a service token with a key grant
+  seekrit proxy run --config ${options.out}\n`);
+		if (plan.policy) process.stderr.write("\nBefore you rely on this: confirm each pinned thumbprint against the dashboard's\ntrust-anchor panel. `signers` is the one field that must not come from the API.\n");
+	});
+	withGenerateOptions(proxy.command("run").description("fetch the proxy binary if needed and run it")).option("-c, --config <path>", "config file to use", DEFAULT_CONFIG).option("--proxy-version <version>", `binary version (default: ${PROXY_VERSION})`).option("--print-config", "print the config that would be used, then exit").action(async (options) => {
+		const generating = Boolean(options.agent) || (options.preset ?? []).length > 0 || (options.host ?? []).length > 0;
+		let configPath = resolve(options.config);
+		let ephemeralDir;
+		if (generating) {
+			const text = renderProxyConfig(await buildPlan(options));
+			if (options.printConfig) {
+				process.stdout.write(text);
+				return;
+			}
+			ephemeralDir = mkdtempSync(join(tmpdir(), "seekrit-proxy-"));
+			configPath = join(ephemeralDir, DEFAULT_CONFIG);
+			writeFileSync(configPath, text, { mode: 384 });
+			process.stderr.write("seekrit: running with a generated config (nothing written to the project — use `seekrit proxy init` to keep it)\n");
+		} else if (options.printConfig) fail("--print-config needs generation flags (--preset/--host/--agent)");
+		else if (!existsSync(configPath)) fail(`no ${options.config} here, and no --preset/--host/--agent to generate one.\n  Try: seekrit proxy run --preset openai
+   or: seekrit proxy init --preset openai   (to write a reviewable file first)`);
+		if (!process.env.SEEKRIT_TOKEN) process.stderr.write("seekrit: SEEKRIT_TOKEN is not set — the proxy needs a service token with a key\n  grant for the environment it serves, and will refuse to start without one.\n");
+		try {
+			process.exitCode = await runProxyBinary(["--config", configPath], { ...options.proxyVersion ? { version: options.proxyVersion } : {} });
+		} finally {
+			if (ephemeralDir) rmSync(ephemeralDir, {
+				recursive: true,
+				force: true
+			});
+		}
+	});
+	proxy.command("install").description("download the proxy binary and print its path").option("--proxy-version <version>", `version to fetch (default: ${PROXY_VERSION})`).option("--force", "re-download even if it is already cached").action(async (options) => {
+		const path = await resolveProxyBinary({
+			...options.proxyVersion ? { version: options.proxyVersion } : {},
+			...options.force ? { force: true } : {}
+		});
+		console.log(path);
+		const { target } = detectTarget();
+		process.stderr.write(`seekrit-proxy ${versionPrefix(options.proxyVersion ?? "0.10.0")} (${target})\n`);
+	});
+	proxy.command("where").description("show which binary `seekrit proxy run` would use, without fetching it").option("--proxy-version <version>", `version to report (default: ${PROXY_VERSION})`).option("--json", "machine-readable output").action((options) => {
+		const version = options.proxyVersion ?? process.env.SEEKRIT_PROXY_VERSION ?? "0.10.0";
+		const override = process.env.SEEKRIT_PROXY_BIN;
+		const { target, exe } = detectTarget();
+		const path = override ?? proxyBinaryPath(version, target, exe);
+		const info = {
+			path,
+			version,
+			target,
+			source: override ? "SEEKRIT_PROXY_BIN" : existsSync(path) ? "cache" : "not-yet-downloaded",
+			baseUrl: process.env.SEEKRIT_PROXY_BASE_URL ?? "https://proxy.seekrit.dev"
+		};
+		emit(options, info, () => {
+			console.log(info.path);
+			process.stderr.write(`${info.version} · ${info.target} · ${info.source}\n`);
+		});
+	});
+	withGenerateOptions(proxy.command("compose").description("print a docker compose sidecar snippet for a generated config")).option("--service <name>", "compose service name for the proxy", COMPOSE_DEFAULTS.service).option("--workload <name>", "compose service name for your workload", COMPOSE_DEFAULTS.workload).option("--image <ref>", "image to pin (default: seekritdev/proxy:<version>)").option("--publish", "also publish the proxy's ports to the host").action(async (options) => {
+		const plan = await buildPlan(options);
+		process.stdout.write(renderComposeSnippet(plan, {
+			service: options.service,
+			workload: options.workload,
+			image: options.image ?? `seekritdev/proxy:0.10.0`,
+			publish: Boolean(options.publish)
+		}));
+	});
+}
+//#endregion
 //#region src/redis.ts
 /**
 * `seekrit redis` — temporary Redis (6+) credentials (Vault-style dynamic
@@ -7512,17 +9993,6 @@ function collect$1(value, acc) {
 * Rotated values are never printed here. Read them like any other secret
 * (`seekrit secrets get NAME`), which decrypts locally.
 */
-/** Parse a duration like `30m`, `24h`, `90d`, or a bare seconds count. */
-function parseDurationSeconds(input, flag) {
-	const m = /^(\d+)\s*([smhd]?)$/.exec(input.trim());
-	if (!m) fail(`invalid ${flag} "${input}" (try 12h, 7d, 90d)`);
-	return Number(m[1]) * ({
-		s: 1,
-		m: 60,
-		h: 3600,
-		d: 86400
-	}[m[2] || "s"] ?? 1);
-}
 function formatInterval(seconds) {
 	if (seconds % 86400 === 0) return `${seconds / 86400}d`;
 	if (seconds % 3600 === 0) return `${seconds / 3600}h`;
@@ -8023,6 +10493,17 @@ function assertRailwayId(value, flag) {
 	if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(id)) fail(`${flag} should be a Railway UUID, not "${id}"`);
 	return id;
 }
+/**
+* A LangGraph Platform deployment id is a UUID — the one in its dashboard URL.
+* The deployment *name* in the slot is the common slip, and it fails at the
+* control plane rather than here.
+*/
+function assertLanggraphDeploymentId(value) {
+	if (!value) fail("--langgraph-deployment is required for langgraph-platform (a UUID)");
+	const id = value.trim();
+	if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(id)) fail(`--langgraph-deployment should be the deployment UUID from its dashboard URL, not "${id}"`);
+	return id;
+}
 /** Reject a single value outside a known set, naming the choices. */
 function assertMember(value, allowed, flag, fallback) {
 	if (value === void 0) return fallback;
@@ -8147,6 +10628,7 @@ function assertRepoIds(raw) {
 function credentialNoun(provider) {
 	if (provider.startsWith("aws-")) return "secret access key";
 	if (provider === "gcp-secret-manager") return "service-account key JSON";
+	if (provider === "langgraph-platform") return "LangSmith API key";
 	return "API token";
 }
 /** Account-scope config for a connection (never the credential itself). */
@@ -8203,6 +10685,17 @@ function buildConfig(provider, options) {
 				provider: "gcp-secret-manager",
 				projectId: options.projectId
 			};
+		case "langgraph-platform": {
+			const region = options.langgraphRegion?.trim();
+			if (region && options.baseUrl) fail("pass --langgraph-region for a LangChain-hosted account or --base-url for a self-hosted one, not both");
+			if (region && !LANGGRAPH_PLATFORM_REGIONS.includes(region)) fail(`unknown --langgraph-region ${region} — one of: ${LANGGRAPH_PLATFORM_REGIONS.join(", ")}`);
+			return {
+				provider: "langgraph-platform",
+				...region ? { region } : {},
+				...options.baseUrl ? { baseUrl: options.baseUrl } : {},
+				...options.langgraphTenant ? { tenantId: options.langgraphTenant.trim() } : {}
+			};
+		}
 	}
 }
 /** Where inside the platform a binding writes. */
@@ -8401,6 +10894,10 @@ function buildDestination(provider, options) {
 				...options.gcpPruneVersions ? { pruneVersions: true } : {}
 			};
 		}
+		case "langgraph-platform": return {
+			provider: "langgraph-platform",
+			deploymentId: assertLanggraphDeploymentId(options.langgraphDeployment)
+		};
 	}
 }
 /** One-line description of a destination, for list output. */
@@ -8421,6 +10918,7 @@ function describeDestination(destination) {
 		case "netlify": return `${destination.siteId} (${destination.contexts.map((context) => context === "branch" ? `branch @${destination.branch}` : context).join(", ")})`;
 		case "bunnyshell": return destination.kind === "environment" ? `environment ${destination.environmentId}` : `project ${destination.projectId} (inherited by new environments)`;
 		case "gcp-secret-manager": return destination.layout === "json-bundle" ? `${destination.secretId} · json` : `${destination.idPrefix ?? ""}* · one per name`;
+		case "langgraph-platform": return `deployment ${destination.deploymentId}`;
 		case "github-actions": switch (destination.kind) {
 			case "repo": return `${destination.owner}/${destination.repo}`;
 			case "environment": return `${destination.owner}/${destination.repo} @${destination.environment}`;
@@ -8436,7 +10934,7 @@ function describeDestination(destination) {
 * application whose environment the binding reads from.
 */
 function destinationOptions(command) {
-	return command.option("--project <id>", "vercel: project id or name · cloudflare-pages / northflank: project name or slug · bunnyshell: project ID (writes variables new environments inherit)").option("--target <list>", "vercel / cloudflare-pages: comma-separated deployment targets", "production").option("--git-branch <branch>", "vercel: restrict preview writes to one branch").option("--script <name>", "cloudflare-workers: Worker script name").option("--store-id <id>", "cloudflare-secrets-store: store ID (32 hex)").option("--scopes <list>", "cloudflare-secrets-store: comma-separated scopes", "workers").option("--railway-project <id>", "railway: project ID (a UUID)").option("--railway-environment <id>", "railway: environment ID (a UUID)").option("--service <id>", "railway: service ID (omit for the environment's shared variables) · render: service ID (srv-…, or crn-… for a cron job)").option("--skip-deploys", "railway: stage values without triggering a redeploy").option("--path <path>", "aws-parameter-store: hierarchy, e.g. /prod/storefront/ · aws-secrets-manager: name prefix").option("--layout <layout>", `aws-secrets-manager: ${AWS_SECRETS_MANAGER_LAYOUTS.join(" | ")}`).option("--secret-name <name>", "aws-secrets-manager: the secret a json-bundle writes to").option("--param-type <type>", `aws-parameter-store: ${AWS_PARAMETER_TYPES.join(" | ")}`).option("--tier <tier>", `aws-parameter-store: ${AWS_PARAMETER_TIERS.join(" | ")}`).option("--kms-key-id <id>", "aws: customer-managed KMS key id, ARN, or alias").option("--env-group <id>", "render: environment group ID (evg-…)").option("--fly-app <name>", "fly: app name, as `fly apps list` shows it").option("--secret-group <id>", "northflank: secret group ID (the slug in its URL)").option("--do-app <id>", "digitalocean: App Platform app ID (the UUID in its URL)").option("--component <name>", "digitalocean: write to one component's variables (omit for app-level)").option("--env-scope <scope>", `digitalocean: ${DIGITALOCEAN_ENV_SCOPES.join(" | ")}`).option("--heroku-app <name>", "heroku: app name, as `heroku apps` shows it (or its UUID)").option("--netlify-site <id>", "netlify: site API ID (the UUID under Project configuration)").option("--no-netlify-secret", "netlify: create readable variables instead of Netlify secrets (write-only)").option("--bunnyshell-environment <id>", "bunnyshell: environment ID (omit to write a project)").option("--no-bunnyshell-secret", "bunnyshell: create variables visible in the dashboard instead of secret ones").option("--gh-repo <owner/name>", "github-actions: repository, e.g. acme/storefront").option("--gh-environment <name>", "github-actions: write to one deployment environment's secrets (needs --gh-repo)").option("--gh-org <login>", "github-actions: write organization secrets instead of a repo's").option("--gh-visibility <v>", `github-actions org secrets: ${GITHUB_ACTIONS_VISIBILITIES.join(" | ")}`).option("--gh-repo-ids <ids>", "github-actions: comma-separated numeric repository IDs for --gh-visibility selected").option("--gcp-prefix <prefix>", "gcp: prepended to every secret ID, e.g. prod-storefront-").option("--gcp-replication <policy>", `gcp: ${GCP_REPLICATION_POLICIES.join(" | ")}`, "automatic").option("--gcp-locations <list>", "gcp: regions for user-managed replication, e.g. us-east1").option("--gcp-kms-key <name>", "gcp: Cloud KMS key (projects/…/cryptoKeys/…)").option("--gcp-prune-versions", "gcp: destroy the version each push supersedes, keeping one active version");
+	return command.option("--project <id>", "vercel: project id or name · cloudflare-pages / northflank: project name or slug · bunnyshell: project ID (writes variables new environments inherit)").option("--target <list>", "vercel / cloudflare-pages: comma-separated deployment targets", "production").option("--git-branch <branch>", "vercel: restrict preview writes to one branch").option("--script <name>", "cloudflare-workers: Worker script name").option("--store-id <id>", "cloudflare-secrets-store: store ID (32 hex)").option("--scopes <list>", "cloudflare-secrets-store: comma-separated scopes", "workers").option("--railway-project <id>", "railway: project ID (a UUID)").option("--railway-environment <id>", "railway: environment ID (a UUID)").option("--service <id>", "railway: service ID (omit for the environment's shared variables) · render: service ID (srv-…, or crn-… for a cron job)").option("--skip-deploys", "railway: stage values without triggering a redeploy").option("--path <path>", "aws-parameter-store: hierarchy, e.g. /prod/storefront/ · aws-secrets-manager: name prefix").option("--layout <layout>", `aws-secrets-manager: ${AWS_SECRETS_MANAGER_LAYOUTS.join(" | ")}`).option("--secret-name <name>", "aws-secrets-manager: the secret a json-bundle writes to").option("--param-type <type>", `aws-parameter-store: ${AWS_PARAMETER_TYPES.join(" | ")}`).option("--tier <tier>", `aws-parameter-store: ${AWS_PARAMETER_TIERS.join(" | ")}`).option("--kms-key-id <id>", "aws: customer-managed KMS key id, ARN, or alias").option("--env-group <id>", "render: environment group ID (evg-…)").option("--fly-app <name>", "fly: app name, as `fly apps list` shows it").option("--secret-group <id>", "northflank: secret group ID (the slug in its URL)").option("--do-app <id>", "digitalocean: App Platform app ID (the UUID in its URL)").option("--component <name>", "digitalocean: write to one component's variables (omit for app-level)").option("--env-scope <scope>", `digitalocean: ${DIGITALOCEAN_ENV_SCOPES.join(" | ")}`).option("--heroku-app <name>", "heroku: app name, as `heroku apps` shows it (or its UUID)").option("--netlify-site <id>", "netlify: site API ID (the UUID under Project configuration)").option("--no-netlify-secret", "netlify: create readable variables instead of Netlify secrets (write-only)").option("--bunnyshell-environment <id>", "bunnyshell: environment ID (omit to write a project)").option("--no-bunnyshell-secret", "bunnyshell: create variables visible in the dashboard instead of secret ones").option("--gh-repo <owner/name>", "github-actions: repository, e.g. acme/storefront").option("--gh-environment <name>", "github-actions: write to one deployment environment's secrets (needs --gh-repo)").option("--gh-org <login>", "github-actions: write organization secrets instead of a repo's").option("--gh-visibility <v>", `github-actions org secrets: ${GITHUB_ACTIONS_VISIBILITIES.join(" | ")}`).option("--gh-repo-ids <ids>", "github-actions: comma-separated numeric repository IDs for --gh-visibility selected").option("--langgraph-deployment <id>", "langgraph-platform: deployment UUID (the one in its dashboard URL)").option("--gcp-prefix <prefix>", "gcp: prepended to every secret ID, e.g. prod-storefront-").option("--gcp-replication <policy>", `gcp: ${GCP_REPLICATION_POLICIES.join(" | ")}`, "automatic").option("--gcp-locations <list>", "gcp: regions for user-managed replication, e.g. us-east1").option("--gcp-kms-key <name>", "gcp: Cloud KMS key (projects/…/cryptoKeys/…)").option("--gcp-prune-versions", "gcp: destroy the version each push supersedes, keeping one active version");
 }
 /** Find a connection by id or name — nobody keeps `syc_…` ids in their head. */
 async function resolveConnection(ctx, orgId, ref) {
@@ -8460,7 +10958,7 @@ function registerSyncCommands(program) {
 			col("id", (c) => c.id)
 		], "no connections — add one with `seekrit sync connect`"));
 	});
-	sync.command("connect").description("register a destination account (reads its API token from stdin)").option("--org <slug>").requiredOption("--name <name>", "what to call this account, e.g. acme-vercel").option("--provider <kind>", SYNC_PROVIDER_KINDS.join(" | "), "vercel").option("--team-id <id>", "vercel: Team id (omit for a personal account)").option("--token-kind <kind>", `railway: ${RAILWAY_TOKEN_KINDS.join(" | ")}`, "account").option("--account-id <id>", "cloudflare: account ID (32 hex, from the dashboard sidebar) · netlify: team slug or account ID").option("--region <region>", "aws: region ID, e.g. us-east-1").option("--access-key-id <id>", "aws: IAM access key ID (the secret key is read from stdin)").option("--base-url <url>", "github-actions: GitHub Enterprise Server API root (omit for github.com)").option("--project-id <id>", "gcp: project ID or number whose Secret Manager to write").action(async (options) => {
+	sync.command("connect").description("register a destination account (reads its API token from stdin)").option("--org <slug>").requiredOption("--name <name>", "what to call this account, e.g. acme-vercel").option("--provider <kind>", SYNC_PROVIDER_KINDS.join(" | "), "vercel").option("--team-id <id>", "vercel: Team id (omit for a personal account)").option("--token-kind <kind>", `railway: ${RAILWAY_TOKEN_KINDS.join(" | ")}`, "account").option("--account-id <id>", "cloudflare: account ID (32 hex, from the dashboard sidebar) · netlify: team slug or account ID").option("--region <region>", "aws: region ID, e.g. us-east-1").option("--access-key-id <id>", "aws: IAM access key ID (the secret key is read from stdin)").option("--base-url <url>", "github-actions: GitHub Enterprise Server API root (omit for github.com) · langgraph-platform: self-hosted LangSmith control-plane root").option("--project-id <id>", "gcp: project ID or number whose Secret Manager to write").option("--langgraph-region <region>", `langgraph-platform: ${LANGGRAPH_PLATFORM_REGIONS.join(" | ")} (omit for us)`).option("--langgraph-tenant <id>", "langgraph-platform: LangSmith workspace UUID (only an org-scoped key needs it)").action(async (options) => {
 		const provider = assertProvider(options.provider);
 		const ctx = buildContext();
 		const ref = await resolveOrg(ctx, options.org);
@@ -9327,6 +11825,8 @@ registerPgCommands(program);
 registerMysqlCommands(program);
 registerRedisCommands(program);
 registerProvisionerCommands(program);
+registerProxyCommands(program);
+registerAgentCommands(program);
 registerSshCommands(program);
 registerAwsCommands(program);
 registerGcpCommands(program);