@seekrit/cli 0.43.0 → 0.44.0

package/dist/index.js

@@ -8,6 +8,11 @@ import { dirname, join, parse, resolve } from "node:path";
 import { createInterface } from "node:readline";
 import { Writable } from "node:stream";
 import { createHash } from "node:crypto";
+/** Default lifetime of a published bundle (7 days), in seconds. */
+const POLICY_DEFAULT_TTL_SECONDS = 10080 * 60;
+/** Bounds on a bundle's lifetime: an hour at the short end, 90 days at the long. */
+const POLICY_MIN_TTL_SECONDS = 3600;
+const POLICY_MAX_TTL_SECONDS = 2160 * 60 * 60;
 /** A bare hostname: no scheme, no port, no path, no wildcard. */
 const policyHostSchema = z.string().trim().min(1).max(253).toLowerCase().refine((h) => !/[:/\s*]/.test(h), { message: "host must be a bare hostname (no scheme, port, path, or wildcard)" }).refine((h) => /^[a-z0-9.-]+$/.test(h), { message: "host contains invalid characters" });
 const policyMethodSchema = z.string().trim().toUpperCase().regex(/^[A-Z]{3,10}$/, "method must be an HTTP method name");
@@ -17,7 +22,7 @@ const policyMethodSchema = z.string().trim().toUpperCase().regex(/^[A-Z]{3,10}$/
 */
 const policyPathSchema = z.string().trim().min(1).max(512).startsWith("/", "path pattern must start with /").refine((p) => !p.includes("?"), { message: "path patterns match the path only, not the query" });
 const policySecretNameSchema = z.string().trim().regex(/^[A-Za-z0-9_]+$/, "secret names are letters, digits, and underscores");
-z.object({
+const agentPolicyRuleSchema = z.object({
 	host: policyHostSchema,
 	methods: z.array(policyMethodSchema).max(16).default([]),
 	paths: z.array(policyPathSchema).max(64).default([]),
@@ -44,6 +49,88 @@ z.object({
 	path: z.string().trim().min(1).max(2048),
 	secret: policySecretNameSchema.optional()
 });
+/**
+* Serialize a bundle to the exact bytes that get signed and transported.
+*
+* Explicit field order rather than a generic sorted-key walk: the field list is
+* the format, and a reviewer should be able to read it here. Optional fields are
+* omitted rather than emitted as `null`, and empty `methods`/`paths`/`allow`
+* arrays are kept, since their emptiness is meaningful (any/any/none).
+*/
+function canonicalizeAgentPolicy(bundle) {
+	const rules = bundle.rules.map((rule) => {
+		const out = {
+			host: rule.host.trim().toLowerCase(),
+			methods: rule.methods.map((m) => m.trim().toUpperCase()).sort(),
+			paths: rule.paths.map((p) => p.trim()),
+			allow: [...rule.allow].sort()
+		};
+		if (rule.label?.trim()) out.label = rule.label.trim();
+		return out;
+	});
+	return JSON.stringify({
+		v: bundle.v,
+		org: bundle.org,
+		agent: bundle.agent,
+		agent_slug: bundle.agent_slug,
+		policy_version: bundle.policy_version,
+		issued_at: bundle.issued_at,
+		expires_at: bundle.expires_at,
+		rules,
+		signer: {
+			kid: bundle.signer.kid,
+			jwk: {
+				crv: bundle.signer.jwk.crv,
+				kty: bundle.signer.jwk.kty,
+				x: bundle.signer.jwk.x,
+				y: bundle.signer.jwk.y
+			}
+		}
+	});
+}
+/**
+* RFC 7638 JWK thumbprint (SHA-256, base64url, no padding) — the identifier an
+* operator pins in the proxy's TOML.
+*/
+async function policySignerThumbprint(jwk) {
+	const canonical = JSON.stringify({
+		crv: jwk.crv,
+		kty: jwk.kty,
+		x: jwk.x,
+		y: jwk.y
+	});
+	const digest = await crypto.subtle.digest("SHA-256", utf8(canonical));
+	return base64url(new Uint8Array(digest));
+}
+/**
+* Sign a draft bundle with the publishing admin's key, returning the `ap1.`
+* envelope to hand to the API.
+*
+* `privateKey` must be an ECDSA P-256 key with the `sign` usage — in the
+* dashboard that is the signed-in admin's existing principal key, re-imported
+* for signing (`importPolicySigningKey` in `@seekrit/crypto`). No new key
+* material is involved, which is what makes this shippable without a second
+* passphrase-protected keypair to manage.
+*/
+async function signAgentPolicy(privateKey, signerJwk, draft) {
+	const kid = await policySignerThumbprint(signerJwk);
+	const bytes = utf8(canonicalizeAgentPolicy({
+		...draft,
+		signer: {
+			kid,
+			jwk: signerJwk
+		}
+	}));
+	const sig = new Uint8Array(await crypto.subtle.sign({
+		name: "ECDSA",
+		hash: "SHA-256"
+	}, privateKey, bytes));
+	return [
+		"ap1",
+		base64url(bytes),
+		base64url(sig)
+	].join(".");
+}
 /** A structurally invalid, unverifiable, or expired bundle. */
 var AgentPolicyError = class extends Error {
 	constructor(message) {
@@ -72,9 +159,149 @@ function parseAgentPolicyUnverified(envelope) {
 	if (!Array.isArray(body.rules) || !body.signer?.jwk) throw new AgentPolicyError("policy bundle is missing rules or signer");
 	return body;
 }
+/**
+* Match a request path against a glob pattern: `*` matches within one segment,
+* `**` matches any number of segments (including none, so `/v1/**` covers
+* `/v1`). Case-sensitive, and the query string never participates.
+*/
+function matchPolicyPath(pattern, path) {
+	const bare = path.split("?")[0] ?? path;
+	return matchSegments(pattern.split("/"), bare.split("/"));
+}
+function matchSegments(pattern, segments) {
+	if (pattern.length === 0) return segments.length === 0;
+	const [head, ...rest] = pattern;
+	if (head === "**") {
+		for (let skip = 0; skip <= segments.length; skip++) if (matchSegments(rest, segments.slice(skip))) return true;
+		return false;
+	}
+	if (segments.length === 0) return false;
+	return matchSegment(head, segments[0]) && matchSegments(rest, segments.slice(1));
+}
+function matchSegment(pattern, segment) {
+	if (!pattern.includes("*")) return pattern === segment;
+	const parts = pattern.split("*");
+	let rest = segment;
+	for (let i = 0; i < parts.length; i++) {
+		const part = parts[i];
+		if (part === "") continue;
+		if (i === 0) {
+			if (!rest.startsWith(part)) return false;
+			rest = rest.slice(part.length);
+		} else if (i === parts.length - 1) return rest.length >= part.length && rest.endsWith(part);
+		else {
+			const at = rest.indexOf(part);
+			if (at === -1) return false;
+			rest = rest.slice(at + part.length);
+		}
+	}
+	return true;
+}
+function ruleCoversMethod(rule, method) {
+	if (rule.methods.length === 0) return true;
+	const wanted = method.trim().toUpperCase();
+	return rule.methods.some((m) => m.trim().toUpperCase() === wanted);
+}
+function ruleCoversPath(rule, path) {
+	if (rule.paths.length === 0) return true;
+	return rule.paths.some((p) => matchPolicyPath(p, path));
+}
+/**
+* Decide a request against an ordered rule set, first match wins — the same
+* evaluation `RuleSet::decide` performs in the proxy, including which rule
+* decided and *why* a refusal happened. Naming the constraint matters: a
+* default-deny policy fails in exactly the confusing direction.
+*/
+function evaluatePolicy(rules, query) {
+	const host = query.host.trim().toLowerCase();
+	let hostMatched = false;
+	let pathMatchedIndex = null;
+	for (let i = 0; i < rules.length; i++) {
+		const rule = rules[i];
+		if (rule.host.trim().toLowerCase() !== host) continue;
+		hostMatched = true;
+		const pathsOk = ruleCoversPath(rule, query.path);
+		if (pathsOk && ruleCoversMethod(rule, query.method)) {
+			if (query.secret !== void 0 && !rule.allow.includes(query.secret)) return {
+				decision: "secret_not_allowed",
+				ruleIndex: i
+			};
+			return {
+				decision: "allow",
+				ruleIndex: i
+			};
+		}
+		if (pathsOk && pathMatchedIndex === null) pathMatchedIndex = i;
+	}
+	if (pathMatchedIndex !== null) return {
+		decision: "method_not_allowed",
+		ruleIndex: pathMatchedIndex
+	};
+	return {
+		decision: hostMatched ? "path_not_allowed" : "no_rule",
+		ruleIndex: null
+	};
+}
+/** A one-line, human-readable reason for a verdict — shared by UI and API. */
+function describePolicyVerdict(verdict, rules) {
+	const rule = verdict.ruleIndex === null ? null : rules[verdict.ruleIndex];
+	switch (verdict.decision) {
+		case "allow": return `permitted by rule ${(verdict.ruleIndex ?? 0) + 1}${rule?.label ? ` (${rule.label})` : ""}`;
+		case "no_rule": return "no rule covers this host";
+		case "method_not_allowed": return `rule ${(verdict.ruleIndex ?? 0) + 1} covers this path but not this method`;
+		case "path_not_allowed": return "this host has rules, but none cover this path";
+		case "secret_not_allowed": return `rule ${(verdict.ruleIndex ?? 0) + 1} permits the request but not this secret`;
+	}
+}
+/** Every host a rule set names — what a forward proxy would intercept. */
+function policyHosts(rules) {
+	return [...new Set(rules.map((r) => r.host.trim().toLowerCase()))].sort();
+}
+function diffPolicyRules(before, after) {
+	const out = [];
+	const same = (a, b) => JSON.stringify(normalizeRule(a)) === JSON.stringify(normalizeRule(b));
+	for (let i = 0; i < Math.max(before.length, after.length); i++) {
+		const b = before[i];
+		const a = after[i];
+		if (b && a) out.push({
+			kind: same(b, a) ? "unchanged" : "changed",
+			index: i,
+			before: b,
+			after: a
+		});
+		else if (a) out.push({
+			kind: "added",
+			index: i,
+			after: a
+		});
+		else if (b) out.push({
+			kind: "removed",
+			index: i,
+			before: b
+		});
+	}
+	return out;
+}
+function normalizeRule(rule) {
+	return {
+		host: rule.host.trim().toLowerCase(),
+		methods: rule.methods.map((m) => m.toUpperCase()).sort(),
+		paths: [...rule.paths],
+		allow: [...rule.allow].sort(),
+		label: rule.label?.trim() || void 0
+	};
+}
+function utf8(text) {
+	return new TextEncoder().encode(text);
+}
 function utf8Decode$1(bytes) {
 	return new TextDecoder().decode(bytes);
 }
+function base64url(bytes) {
+	let binary = "";
+	for (const b of bytes) binary += String.fromCharCode(b);
+	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
 function fromBase64url(text) {
 	const padded = text.replace(/-/g, "+").replace(/_/g, "/");
 	const binary = atob(padded + "=".repeat((4 - padded.length % 4) % 4));
@@ -82,6 +309,259 @@ function fromBase64url(text) {
 	for (let i = 0; i < binary.length; i++) out[i] = binary.charCodeAt(i);
 	return out;
 }
+/** One aggregated cell: a dimension tuple and how many times it happened. */
+const activityEntrySchema = z.object({
+	host: policyHostSchema,
+	method: policyMethodSchema,
+	decision: z.enum([
+		"allow",
+		"no_rule",
+		"method_not_allowed",
+		"path_not_allowed",
+		"secret_not_allowed",
+		"unknown_secret",
+		"ratchet_withdrawn",
+		"policy_unavailable"
+	]),
+	/**
+	* Which published rule decided, when one did. Null for refusals that never
+	* reached a rule (`no_rule`, `policy_unavailable`) — the distinction matters to
+	* a review, because "rule 3 refused this" and "nothing covered this" call for
+	* opposite changes.
+	*/
+	ruleIndex: z.number().int().min(0).max(255).nullable(),
+	count: z.number().int().min(1).max(1e6),
+	/**
+	* Secret names actually injected, name → count. Only meaningful on `allow`.
+	* This is what lets a review say "rule 2 permits three secrets and the agent
+	* has only ever used one" — the most useful narrowing there is, and impossible
+	* to see from policy alone.
+	*/
+	secrets: z.record(policySecretNameSchema, z.number().int().min(1)).optional()
+});
+z.object({
+	/** Start of the window these counts cover (ISO 8601). */
+	windowStart: z.string().trim().min(20).max(40),
+	/** Policy version in force while they were collected, for the ledger. */
+	policyVersion: z.number().int().min(0).optional(),
+	/**
+	* Capped so one report cannot be unbounded work. A proxy with more distinct
+	* cells than this in a window has a policy far broader than a review can help
+	* with, and truncating loudly beats accepting anything.
+	*/
+	entries: z.array(activityEntrySchema).min(1).max(500)
+});
+//#endregion
+//#region ../../packages/core/src/agent-review.ts
+function emptyStats() {
+	return {
+		allows: 0,
+		denials: 0,
+		methods: /* @__PURE__ */ new Set(),
+		secrets: /* @__PURE__ */ new Set()
+	};
+}
+/**
+* Compare an agent's live rules against what it actually did.
+*
+* Returns proposals ordered narrowing-first, because that is the order they
+* should be read in: the safe changes, then the ones needing a judgment call.
+*/
+function reviewPolicy(input) {
+	const { rules, activity } = input;
+	const byRule = /* @__PURE__ */ new Map();
+	/** Hosts refused with no rule to attribute it to → candidates for widening. */
+	const uncovered = /* @__PURE__ */ new Map();
+	for (const row of activity) {
+		if (row.ruleIndex === null) {
+			if (row.decision === "no_rule" || row.decision === "path_not_allowed") {
+				const entry = uncovered.get(row.host) ?? {
+					denials: 0,
+					methods: /* @__PURE__ */ new Set()
+				};
+				entry.denials += row.count;
+				entry.methods.add(row.method);
+				uncovered.set(row.host, entry);
+			}
+			continue;
+		}
+		const stats = byRule.get(row.ruleIndex) ?? emptyStats();
+		if (row.decision === "allow") {
+			stats.allows += row.count;
+			stats.methods.add(row.method);
+			for (const name of Object.keys(row.secrets ?? {})) stats.secrets.add(name);
+		} else stats.denials += row.count;
+		byRule.set(row.ruleIndex, stats);
+	}
+	const narrowing = [];
+	const widening = [];
+	/**
+	* Did this agent demonstrably do anything in the window?
+	*
+	* This is what licenses a conclusion from *absence*. With permitted traffic on
+	* the record, a rule that never came up is unused. With none, the window says
+	* nothing about any rule, and every proposal below would be noise.
+	*/
+	const workedAtAll = [...byRule.values()].some((s) => s.allows > 0);
+	for (const [index, rule] of rules.entries()) {
+		const stats = byRule.get(index);
+		if (!stats) {
+			if (workedAtAll) narrowing.push({
+				kind: "remove_rule",
+				ruleIndex: index,
+				host: rule.host,
+				evidence: {
+					allows: 0,
+					denials: 0,
+					observations: 0
+				},
+				rationale: `rule ${index + 1} (${rule.host}) never matched a request, while other rules did`,
+				applicable: true
+			});
+			continue;
+		}
+		const evidence = {
+			allows: stats.allows,
+			denials: stats.denials,
+			observations: stats.allows + stats.denials
+		};
+		if (stats.allows === 0) {
+			narrowing.push({
+				kind: "remove_rule",
+				ruleIndex: index,
+				host: rule.host,
+				evidence,
+				rationale: stats.denials > 0 ? `rule ${index + 1} (${rule.host}) authorized nothing in this window and refused ${stats.denials} — it may be misconfigured rather than unused` : `rule ${index + 1} (${rule.host}) authorized nothing in this window`,
+				applicable: true
+			});
+			continue;
+		}
+		const unusedSecrets = rule.allow.filter((name) => !stats.secrets.has(name));
+		if (unusedSecrets.length > 0) narrowing.push({
+			kind: "remove_secret",
+			ruleIndex: index,
+			host: rule.host,
+			names: unusedSecrets,
+			evidence,
+			rationale: `rule ${index + 1} (${rule.host}) permits ${unusedSecrets.join(", ")}, never injected in ${stats.allows} permitted request(s)`,
+			applicable: true
+		});
+		const unusedMethods = rule.methods.filter((m) => !stats.methods.has(m.toUpperCase()));
+		if (rule.methods.length > 0 && unusedMethods.length > 0) narrowing.push({
+			kind: "narrow_methods",
+			ruleIndex: index,
+			host: rule.host,
+			names: unusedMethods,
+			evidence,
+			rationale: `rule ${index + 1} (${rule.host}) permits ${unusedMethods.join(", ")}, never used in ${stats.allows} permitted request(s)`,
+			applicable: true
+		});
+	}
+	for (const [host, entry] of uncovered) widening.push({
+		kind: "widen",
+		ruleIndex: null,
+		host,
+		names: [...entry.methods].sort(),
+		evidence: {
+			allows: 0,
+			denials: entry.denials,
+			observations: entry.denials
+		},
+		rationale: `${entry.denials} request(s) to ${host} matched no rule (${[...entry.methods].sort().join(", ")}) — the agent wants this and cannot have it`,
+		applicable: false
+	});
+	narrowing.sort((a, b) => (a.ruleIndex ?? 0) - (b.ruleIndex ?? 0));
+	widening.sort((a, b) => b.evidence.denials - a.evidence.denials);
+	return [...narrowing, ...widening];
+}
+/**
+* Apply the accepted narrowing proposals, returning a new rule list.
+*
+* Pure and total: the input rules are untouched, and anything not applicable is
+* skipped rather than throwing, so a caller can pass the whole review back.
+*
+* Rule *positions* shift when one is removed, which matters because order decides
+* (first match wins). Removals are therefore applied last, after the by-index
+* edits, so an index in a proposal always refers to the policy the review was
+* computed against.
+*/
+function applyProposals(rules, accepted) {
+	const applicable = accepted.filter((p) => p.applicable && p.ruleIndex !== null);
+	const next = rules.map((rule) => ({
+		...rule,
+		methods: [...rule.methods],
+		paths: [...rule.paths],
+		allow: [...rule.allow]
+	}));
+	for (const proposal of applicable) {
+		const index = proposal.ruleIndex;
+		const rule = next[index];
+		if (!rule) continue;
+		if (proposal.kind === "remove_secret") {
+			const drop = new Set(proposal.names ?? []);
+			rule.allow = rule.allow.filter((name) => !drop.has(name));
+		} else if (proposal.kind === "narrow_methods") {
+			const drop = new Set((proposal.names ?? []).map((m) => m.toUpperCase()));
+			rule.methods = rule.methods.filter((m) => !drop.has(m.toUpperCase()));
+			if (rule.methods.length === 0) rule.methods = [...rules[index]?.methods ?? []];
+		}
+	}
+	const removed = new Set(applicable.filter((p) => p.kind === "remove_rule").map((p) => p.ruleIndex));
+	return next.filter((_, index) => !removed.has(index));
+}
+/** How many of a review's proposals `applyProposals` would act on. */
+function countApplicable(proposals) {
+	return proposals.filter((p) => p.applicable).length;
+}
+/**
+* Twelve hours, matching `[control] max_ttl` in a proxy config. A task is meant
+* to bound one run; something that needs longer wants a policy change, not a
+* longer ticket.
+*/
+const TASK_MAX_TTL_SECONDS = 720 * 60;
+/** An EC P-256 public JWK, for a sender-constraint proof key. */
+const taskProofJwkSchema = z.object({
+	kty: z.literal("EC"),
+	crv: z.literal("P-256"),
+	x: z.string().min(1).max(128),
+	y: z.string().min(1).max(128)
+});
+z.object({
+	/**
+	* The public `skd_…` segment of the minted token. Sent because the API never
+	* sees the token at dispatch and still needs a readable handle for the audit
+	* row and for a revoke to name — the id half of a credential, without the
+	* secret half.
+	*/
+	taskRef: z.string().trim().regex(/^skd_[0-9A-Za-z]+$/, "taskRef must be the skd_… segment of the minted token"),
+	/**
+	* SHA-256 (base64url) of the token the dispatcher minted. The token itself
+	* never reaches this API on the dispatch path — only on introspection, where
+	* it is hashed and discarded.
+	*/
+	tokenHash: z.string().trim().min(16).max(128),
+	/**
+	* Secret names this run may use. Omit for "whatever the agent's policy
+	* allows" — mirroring `Session.scopes: Option<BTreeSet<String>>` in the proxy,
+	* so absent means unnarrowed in both places.
+	*/
+	scopes: z.array(policySecretNameSchema).max(64).optional(),
+	ttlSeconds: z.number().int().min(60).max(TASK_MAX_TTL_SECONDS).optional(),
+	/**
+	* What this run is for, for the audit row and the operator's task list. Free
+	* text, and **not** a security input: never put a secret value in it.
+	*/
+	label: z.string().trim().max(200).optional(),
+	/**
+	* Public half of a proof key the presenter holds, recorded as an RFC 7638
+	* thumbprint. See `AgentTaskSession.proofThumbprint` for what this does and —
+	* importantly — does not yet do.
+	*/
+	proofJwk: taskProofJwkSchema.optional()
+});
+z.object({ 
+/** The presented token. In the body, never a URL — it is a credential. */
+token: z.string().trim().min(8).max(512) });
 /** All catalog keys as a runtime array (for iteration / zod enums). */
 const ENTITLEMENT_KEYS = Object.keys({
 	"feature.kms": {
@@ -1267,7 +1747,9 @@ const AUDIT_ACTIONS = [
 	"agent.updated",
 	"agent.deleted",
 	"agent.policy_published",
-	"agent.policy_rolled_back"
+	"agent.policy_rolled_back",
+	"agent.task_dispatched",
+	"agent.task_revoked"
 ];
 /**
 * Transactional notification emails seekrit can send. Each id is one
@@ -3492,6 +3974,76 @@ async function decryptPrivateKey(passphrase, blob) {
 	}
 }
 //#endregion
+//#region ../../packages/crypto/src/policy-key.ts
+/**
+* Signing with a principal's **existing** keypair, for agent access policy.
+*
+* Policy bundles are signed in the browser so the API can serve a blob it cannot
+* forge (`docs/agent-access-governance.md` §1). Every user already has a P-256
+* keypair whose private half is passphrase-encrypted and opaque to the server
+* (`users.public_key_jwk`), so this feature needs **no new key material**: no
+* second passphrase, no wrapping, no schema, and nothing extra for an admin to
+* lose. That was a deliberate condition of the design.
+*
+* The catch is that WebCrypto keys are algorithm-bound. A principal key is
+* imported for ECDH (`deriveBits`) and cannot sign, even though the underlying
+* curve is the same one ECDSA uses. So the JWK is re-imported here with the
+* algorithm hints stripped — the same private scalar, presented as an ECDSA key.
+*
+* **The tradeoff, stated plainly:** this reuses one key for two algorithms,
+* which key-management hygiene (NIST SP 800-57 §5.2) advises against. We accept
+* it because the alternative — a second keypair per admin — is the kind of
+* ceremony that gets skipped, and because both uses stay inside the same trust
+* boundary: the key already authorizes reading every secret the admin can read,
+* so a signature capability adds no reach an attacker holding it wouldn't have.
+* If a future version wants separation, the clean path is a managed KMS `sign`
+* key granted to publishers — the thumbprint pinning in the proxy works
+* unchanged, which is why the format carries the key rather than a user id.
+*/
+const ECDSA_PARAMS$1 = {
+	name: "ECDSA",
+	namedCurve: "P-256"
+};
+/**
+* Re-import a principal's private key JWK as an ECDSA signing key.
+*
+* `key_ops`, `alg`, and `use` are dropped: they say "ECDH" on a principal key,
+* and WebCrypto refuses an import whose declared operations don't include the
+* requested usage. Everything that determines the key — `crv`, `d`, `x`, `y` —
+* is passed through untouched.
+*/
+async function importPolicySigningKey(privateKeyJwk) {
+	const jwk = JSON.parse(privateKeyJwk);
+	if (jwk.kty !== "EC" || jwk.crv !== "P-256") throw new SeekritCryptoError("MALFORMED_BLOB", "policy signing needs an EC P-256 principal key");
+	if (!jwk.d) throw new SeekritCryptoError("MALFORMED_BLOB", "policy signing needs the private half of the key");
+	const { kty, crv, d, x, y } = jwk;
+	return crypto.subtle.importKey("jwk", {
+		kty,
+		crv,
+		d,
+		x,
+		y
+	}, ECDSA_PARAMS$1, false, ["sign"]);
+}
+/**
+* Trim a principal's public key JWK to the members a policy bundle carries.
+*
+* The bundle names its signer by thumbprint, which is computed over exactly
+* these four members — so anything else in the stored JWK (`key_ops`, `ext`,
+* `alg`) must be dropped here, or the thumbprint an admin pins would depend on
+* incidental fields.
+*/
+function policySignerJwk(publicKeyJwk) {
+	const jwk = JSON.parse(publicKeyJwk);
+	if (jwk.kty !== "EC" || jwk.crv !== "P-256" || !jwk.x || !jwk.y) throw new SeekritCryptoError("MALFORMED_BLOB", "not an EC P-256 public key");
+	return {
+		kty: "EC",
+		crv: "P-256",
+		x: jwk.x,
+		y: jwk.y
+	};
+}
+//#endregion
 //#region ../../packages/crypto/src/shamir.ts
 /**
 * Shamir's Secret Sharing over GF(2^8) — the same field AES uses, with the
@@ -3985,10 +4537,13 @@ function encodeOpensshPrivateKey(seed, pub, comment) {
 */
 const TOKEN_PREFIX = "skt";
 const CLI_SESSION_PREFIX = "skc";
+const TASK_PREFIX = "skd";
 const TOKEN_ID_LENGTH = 22;
 const ID_ALPHABET = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
 /** 32 bytes of entropy for the CLI session secret. */
 const CLI_SESSION_SECRET_BYTES = 32;
+/** 32 bytes for a task token's secret, matching the CLI session. */
+const TASK_SECRET_BYTES = 32;
 function randomTokenId(prefix = TOKEN_PREFIX) {
 	let out = "";
 	while (out.length < TOKEN_ID_LENGTH) {
@@ -4058,9 +4613,18 @@ function parseCliSessionToken(token) {
 function isCliSessionToken(value) {
 	return value.startsWith(`${CLI_SESSION_PREFIX}_`);
 }
+async function createAgentTaskToken() {
+	const taskRef = randomTokenId(TASK_PREFIX);
+	const token = `${taskRef}_${toBase64Url(crypto.getRandomValues(new Uint8Array(TASK_SECRET_BYTES)))}`;
+	return {
+		token,
+		taskRef,
+		tokenHash: await hashToken(token)
+	};
+}
 //#endregion
 //#region package.json
-var version = "0.43.0";
+var version = "0.44.0";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 var SeekritApiError = class extends Error {
@@ -4437,6 +5001,60 @@ var SeekritClient = class {
 	getAgentPolicyBundle(agentRef) {
 		return this.request("GET", `/v1/agents/${encodeURIComponent(agentRef)}/policy`);
 	}
+	/**
+	* Dispatch a task for one agent run.
+	*
+	* The caller mints the token (`createAgentTaskToken` in `@seekrit/crypto`) and
+	* sends only its hash plus the public `skd_…` segment, so no presentable
+	* credential ever reaches this API — the same shape as service-token and CLI
+	* session creation. `scopes` may only narrow what the agent's published policy
+	* already permits; a name outside it is refused rather than dropped.
+	*
+	* Not org-scoped, because an orchestrator is not: it knows an agent slug.
+	*/
+	dispatchAgentTask(agentRef, input) {
+		return this.request("POST", `/v1/agents/${encodeURIComponent(agentRef)}/dispatch`, input);
+	}
+	/**
+	* Exchange a presented token for the session it authorizes — what an
+	* enforcement point calls once per task and caches until expiry.
+	*
+	* A POST because the token is a credential and must not land in a URL or an
+	* access log. Fails closed and says which way: revoked, expired, or a disabled
+	* identity are three different answers.
+	*/
+	introspectAgentTask(token) {
+		return this.request("POST", "/v1/tasks/introspect", { token });
+	}
+	/** End a run's authority now. Idempotent. */
+	revokeAgentTask(taskId) {
+		return this.request("POST", `/v1/tasks/${taskId}/revoke`);
+	}
+	getAgentTask(taskId) {
+		return this.request("GET", `/v1/tasks/${taskId}`);
+	}
+	/** Runs dispatched for one identity, newest first (admin). */
+	listAgentTasks(orgId, agentId) {
+		return this.request("GET", `/v1/orgs/${orgId}/agents/${agentId}/tasks`);
+	}
+	/**
+	* Report aggregate decisions. Called by an enforcement point, not a person.
+	*
+	* Counts only — hosts, methods, secret *names*, decisions, and rule indices.
+	* Never a request path: see the module comment in `agent-activity.ts` for why
+	* that line is drawn where it is.
+	*/
+	reportAgentActivity(agentRef, input) {
+		return this.request("POST", `/v1/agents/${encodeURIComponent(agentRef)}/activity`, input);
+	}
+	/**
+	* What an agent actually did, collapsed onto its dimensions — the evidence a
+	* grant review reasons over. The proposals themselves are computed client-side
+	* (`reviewPolicy` in `@seekrit/core`), so the API never opines on policy.
+	*/
+	getAgentActivity(orgId, agentId, days = 14) {
+		return this.request("GET", `/v1/orgs/${orgId}/agents/${agentId}/activity?days=${encodeURIComponent(String(days))}`);
+	}
 	/** Keys the caller can see: all org keys for admins, granted keys otherwise. */
 	listKmsKeys(orgId) {
 		return this.request("GET", `/v1/orgs/${orgId}/kms/keys`);
@@ -4748,6 +5366,24 @@ function fail(message) {
 	console.error(`error: ${message}`);
 	process.exit(1);
 }
+/**
+* Parse a duration flag like `30m`, `24h`, `90d`, or a bare seconds count.
+*
+* Lives here rather than in a command module because more than one command
+* takes a duration and they must agree: `--every 7d` and `--ttl 7d` meaning
+* different things would be a nasty surprise. Invalid input is a flag error, so
+* it exits through `fail` with the accepted forms named.
+*/
+function parseDurationSeconds(input, flag) {
+	const m = /^(\d+)\s*([smhd]?)$/.exec(input.trim());
+	if (!m) fail(`invalid ${flag} "${input}" (try 12h, 7d, 90d)`);
+	return Number(m[1]) * ({
+		s: 1,
+		m: 60,
+		h: 3600,
+		d: 86400
+	}[m[2] || "s"] ?? 1);
+}
 /** Prompt without echoing input (for passphrases). */
 function promptHidden(question) {
 	const muted = new Writable({ write(_chunk, _encoding, callback) {
@@ -4883,6 +5519,31 @@ async function getPrivateKey(ctx) {
 	const { encryptedPrivateKey } = await ctx.client.getMyKeys();
 	return importPrivateKey(await decryptPrivateKey(process.env.SEEKRIT_PASSPHRASE ?? await promptHidden("Passphrase: "), encryptedPrivateKey));
 }
+/**
+* Recover the caller's **policy signing** key: the same P-256 principal key,
+* re-imported for ECDSA rather than ECDH. The dashboard does exactly this in
+* `keyring.getPolicySigner`, so a bundle signed here and one signed in a browser
+* are indistinguishable — same key, same thumbprint, same pin in a proxy config.
+*
+* Service tokens are refused *here* rather than at the API, so the reason is
+* legible at the point of use: publishing policy is deliberately gated on a
+* human's key, because an agent that can widen its own authorization is not
+* governed by it. See the module comment in `apps/api/src/routes/agents.ts`.
+*
+* The honest caveat is `SEEKRIT_PASSPHRASE`: where it is set, anything that can
+* read the environment can sign. That is already true of every other CLI
+* decryption, but it matters more here, so the docs say to leave it unset on any
+* machine an agent shares.
+*/
+async function getPolicySigner(ctx) {
+	if (ctx.auth.type === "bearer" && isServiceToken(ctx.auth.token)) fail("publishing agent policy needs a human's signing key — sign in with `seekrit login` (a service token cannot publish, by design)");
+	const { encryptedPrivateKey } = await ctx.client.getMyKeys();
+	const privateKeyJwk = await decryptPrivateKey(process.env.SEEKRIT_PASSPHRASE ?? await promptHidden("Passphrase: "), encryptedPrivateKey);
+	return {
+		signingKey: await importPolicySigningKey(privateKeyJwk),
+		jwk: policySignerJwk(privateKeyJwk)
+	};
+}
 /** Recover one environment's DEK for the current principal. */
 async function getDek(ctx, orgId, envId) {
 	const [{ wrappedDek }, privateKey] = await Promise.all([ctx.client.getMyEnvKey(orgId, envId), getPrivateKey(ctx)]);
@@ -5213,6 +5874,643 @@ function registerAccountCommands(program) {
 	});
 }
 //#endregion
+//#region src/agents.ts
+/**
+* Agent access governance from the CLI.
+*
+* Policy lived only in the dashboard until now, which was backwards: the people
+* deploying agents work in a terminal and a repo, and a rule set is exactly the
+* kind of thing that wants review and version control. So the loop this module
+* exists for is:
+*
+*   seekrit agents policy pull nova -o nova.policy.json   # current rules
+*   $EDITOR nova.policy.json                              # commit it, review it
+*   seekrit agents policy publish nova -f nova.policy.json
+*
+* **Signing still happens here, on this machine, with the operator's own key**
+* (`getPolicySigner` in `context.ts`), so nothing about the trust argument in
+* `docs/agent-access-governance.md` §1 changes: the API receives an opaque
+* envelope it cannot forge, and a proxy verifies it against thumbprints pinned in
+* its own local file. A service token is refused — an agent that can publish its
+* own policy is not governed by it.
+*
+* Everything else here is read-only, and two commands are deliberately *local*
+* evaluations rather than API calls:
+*
+* - `simulate` runs `evaluatePolicy` from `@seekrit/core`, the mirror of
+*   `RuleSet::decide` in the proxy — so a dry run and a real refusal give the
+*   same verdict in the same words.
+* - `fetch` asks for the bytes a proxy would get (`GET /v1/agents/:ref/policy`)
+*   and re-derives the signer thumbprint from the bundle itself, rather than
+*   trusting the field the API echoes beside it.
+*/
+/** How many published versions the API returns per page. */
+const POLICY_PAGE = 50;
+/** The `-` sentinel every other seekrit command uses to mean stdin. */
+const STDIN = "-";
+/**
+* Resolve `nova`, or `agt_…`, to an identity.
+*
+* The org-scoped API routes take an id, but nobody types ids — so a slug is
+* resolved from the list. The list is small (agents are a per-deployment thing,
+* not a per-request one), which is why this costs one request rather than
+* needing a lookup route.
+*/
+async function resolveAgent(ctx, orgId, ref) {
+	const { agents } = await ctx.client.listAgents(orgId);
+	const found = agents.find((a) => a.slug === ref || a.id === ref);
+	if (!found) {
+		const known = agents.map((a) => a.slug).join(", ");
+		fail(`no agent "${ref}"${known ? ` — this org has: ${known}` : " in this org"}`);
+	}
+	return found;
+}
+/**
+* One published version: the newest by default, or an explicit `--version`.
+*
+* An agent with no published policy is a real state, not an error — a proxy for
+* it fails closed — so the caller decides how to report it.
+*/
+async function loadVersion(ctx, orgId, agent, version) {
+	const { policies } = await ctx.client.listAgentPolicies(orgId, agent.id);
+	if (version === void 0) return policies[0] ?? null;
+	const found = policies.find((p) => p.version === version);
+	if (!found) fail(policies.length >= POLICY_PAGE ? `no version ${version} in the last ${POLICY_PAGE} published` : `no version ${version} — published: ${policies.map((p) => p.version).join(", ") || "none"}`);
+	return found;
+}
+/**
+* Read a rule file: either a bare array or `{ "rules": [...] }`, from a path or
+* stdin. Both shapes are accepted because `policy pull` writes the second and
+* hand-written files tend to be the first.
+*
+* Validation is the same zod schema the API and the dashboard use, so a file
+* rejected here would have been rejected there — before anything is signed.
+*
+* Exported for its own test: this is the one place a hand-written file meets the
+* schema, and its error messages are the whole user experience of a typo.
+*/
+function parseRuleFile(raw, source) {
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch (err) {
+		fail(`${source} is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	const list = Array.isArray(parsed) ? parsed : parsed?.rules === void 0 ? fail(`${source} must be a JSON array of rules, or an object with a "rules" array`) : parsed.rules;
+	if (!Array.isArray(list)) fail(`${source}: "rules" must be an array`);
+	if (list.length === 0) console.error(`note: ${source} has no rules — publishing it denies every request`);
+	return list.map((rule, i) => {
+		const result = agentPolicyRuleSchema.safeParse(rule);
+		if (!result.success) {
+			const first = result.error.issues[0];
+			fail(`${source}: rule ${i + 1} is invalid — ${first?.path.join(".") || "rule"}: ${first?.message ?? "unknown error"}`);
+		}
+		return result.data;
+	});
+}
+/** `--file path` or `--file -`. */
+async function readRuleSource(file) {
+	if (file === STDIN) return {
+		raw: await readStdin(),
+		label: "stdin"
+	};
+	try {
+		return {
+			raw: readFileSync(file, "utf8"),
+			label: file
+		};
+	} catch (err) {
+		return fail(`cannot read ${file}: ${err instanceof Error ? err.message : String(err)}`);
+	}
+}
+/**
+* An empty `methods` or `paths` list means *any*: those fields narrow a rule that
+* already matched its host, so absent means unconstrained. A blank column would
+* read as the opposite, so it renders as `any`.
+*
+* Exported for its own test — this is a real invariant of the format, not a
+* cosmetic choice.
+*/
+function describeList(values) {
+	return values.length === 0 ? "any" : values.join(" ");
+}
+/**
+* `allow` is the field where empty means the **opposite** — no secret may be
+* injected toward this host at all (`Decision::SecretNotAllowed` for every name;
+* see `crates/seekrit-core/src/policy.rs`). Such a rule is useful and
+* intentional: it permits the *request* while granting no credential, which is
+* how you let an agent read a public API through the proxy without handing it a
+* key. Rendering that as `any` would invert the meaning of the one column an
+* operator reviews most carefully, so it gets its own function.
+*/
+function describeSecrets(values) {
+	return values.length === 0 ? "none" : values.join(" ");
+}
+function printRules(rules) {
+	printTable(rules.map((rule, i) => ({
+		n: i + 1,
+		rule
+	})), [
+		col("#", (r) => r.n),
+		col("host", (r) => r.rule.host),
+		col("methods", (r) => describeList(r.rule.methods)),
+		col("paths", (r) => describeList(r.rule.paths)),
+		col("secrets", (r) => describeSecrets(r.rule.allow)),
+		col("label", (r) => r.rule.label ?? "-")
+	], "no rules — this policy denies every request");
+}
+/** One rule as a single line, for the publish diff. */
+function ruleLine(rule) {
+	const parts = [
+		rule.host,
+		describeList(rule.methods),
+		describeList(rule.paths),
+		`secrets=${describeSecrets(rule.allow)}`
+	];
+	return rule.label ? `${parts.join(" ")}  (${rule.label})` : parts.join(" ");
+}
+/**
+* The change a publish would make. Rules are compared by *position* because
+* order decides — first match wins — so a reordering is a real change and shows
+* up as one.
+*/
+function printPolicyDiff(before, after) {
+	const changes = diffPolicyRules(before, after).filter((c) => c.kind !== "unchanged");
+	if (changes.length === 0) {
+		console.error(after.length === 0 ? "no rules — this policy denies every request" : "no rule changes — publishing would only extend the expiry");
+		return;
+	}
+	for (const change of changes) {
+		const n = change.index + 1;
+		if (change.kind === "added") console.log(`+ ${n}  ${ruleLine(change.after)}`);
+		else if (change.kind === "removed") console.log(`- ${n}  ${ruleLine(change.before)}`);
+		else {
+			console.log(`- ${n}  ${ruleLine(change.before)}`);
+			console.log(`+ ${n}  ${ruleLine(change.after)}`);
+		}
+	}
+}
+/** Seconds until an ISO instant, or a negative number when it has passed. */
+function secondsUntil(iso) {
+	return Math.round((new Date(iso).getTime() - Date.now()) / 1e3);
+}
+/** Collect a repeated `--scope NAME` into a list. */
+function collectScope(value, acc = []) {
+	acc.push(value);
+	return acc;
+}
+/**
+* A task's state, derived rather than stored: `revoked` beats `expired`, so a run
+* somebody killed does not read as one that merely lapsed.
+*
+* Exported for its own test — it mirrors `taskState` in
+* `apps/api/src/lib/agent-tasks.ts`, and the two disagreeing would mean the list
+* screen and the enforcement point describe the same run differently.
+*/
+function taskStateOf(task, now) {
+	if (task.revokedAt) return "revoked";
+	return Date.parse(task.expiresAt) <= now ? "expired" : "active";
+}
+/**
+* A detail view on **stderr**, so a command whose stdout is a credential can
+* still explain itself to a person without corrupting `$(…)`.
+*/
+function printFieldsToStderr(fields) {
+	const present = fields.filter(([, value]) => value !== null && value !== void 0);
+	const width = Math.max(...present.map(([label]) => label.length));
+	for (const [label, value] of present) console.error(`${label.padEnd(width)}  ${value}`);
+}
+/**
+* Exported for its own test: the expired branch is the one that must be loud.
+*
+* The granularity has to span both users of this — a policy bundle lasting a
+* week and a task lasting fifteen minutes. Rounding a task to the nearest hour
+* printed "in 0h", which is worse than no estimate at all.
+*/
+function describeExpiry(iso) {
+	const seconds = secondsUntil(iso);
+	if (seconds <= 0) return `${iso} (EXPIRED — proxies for this agent fail closed)`;
+	const days = Math.floor(seconds / 86400);
+	const hours = Math.floor(seconds % 86400 / 3600);
+	const minutes = Math.floor(seconds % 3600 / 60);
+	if (days > 0) return `${iso} (in ${days}d ${hours}h)`;
+	if (hours > 0) return `${iso} (in ${hours}h ${minutes}m)`;
+	if (minutes > 0) return `${iso} (in ${minutes}m)`;
+	return `${iso} (in ${seconds}s)`;
+}
+function registerAgentCommands(program) {
+	const agents = program.command("agents").description("agent access policy — which agent may reach which upstream with which secret");
+	agents.command("list", { isDefault: true }).description("list agent identities").option("--org <slug>", "organization").option("--json", "machine-readable output").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { agents: rows } = await ctx.client.listAgents(org.id);
+		emit(options, { agents: rows }, () => printTable(rows, [
+			col("slug", (a) => a.slug),
+			col("name", (a) => a.name),
+			col("policy", (a) => a.currentPolicyVersion === 0 ? "none" : `v${a.currentPolicyVersion}`),
+			col("enabled", (a) => a.enabled ? "yes" : "no"),
+			col("last fetch", (a) => a.lastPolicyFetchAt ?? "never")
+		], "no agent identities — create one with `seekrit agents create`"));
+	});
+	agents.command("create <name>").description("create an agent identity (a policy subject; it holds no key material)").requiredOption("--slug <slug>", "short name a proxy config and a ticket refer to").option("--org <slug>", "organization").option("--app <slug>", "application, when scoping the agent to one environment").option("--env <slug>", "environment whose secret names its rules may reference").option("--json", "machine-readable output").action(async (name, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const environmentId = options.env ? (await resolveAppEnv(ctx, {
+			org: options.org,
+			app: options.app,
+			env: options.env
+		})).envId : void 0;
+		const { agent } = await ctx.client.createAgent(org.id, {
+			name,
+			slug: options.slug,
+			...environmentId ? { environmentId } : {}
+		});
+		emit(options, { agent }, () => {
+			console.error(`created ${agent.slug} — no policy published yet, so any proxy for it fails closed`);
+			console.error(`next: seekrit agents policy publish ${agent.slug} -f rules.json`);
+		});
+	});
+	agents.command("show <ref>").description("an identity and its live rules").option("--org <slug>", "organization").option("--json", "machine-readable output").action(async (ref, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const agent = await resolveAgent(ctx, org.id, ref);
+		const { environment } = await ctx.client.getAgent(org.id, agent.id);
+		const live = await loadVersion(ctx, org.id, agent);
+		emit(options, {
+			agent,
+			environment,
+			policy: live
+		}, () => {
+			printFields([
+				["name", agent.name],
+				["slug", agent.slug],
+				["id", agent.id],
+				["environment", environment ? environment.slug : "any in the org"],
+				["enabled", agent.enabled ? "yes" : "no"],
+				["policy", live ? `v${live.version}` : "none published"],
+				["signer", live?.signerThumbprint],
+				["expires", live ? describeExpiry(live.expiresAt) : void 0],
+				["last fetch", agent.lastPolicyFetchAt ?? "never"]
+			]);
+			if (live) {
+				section(`rules (v${live.version})`);
+				printRules(live.rules);
+				section("hosts a forward proxy would intercept");
+				console.log(policyHosts(live.rules).join("\n") || "none");
+			}
+		});
+	});
+	agents.command("disable <ref>").description("stop serving this identity's policy (the revocation path)").option("--org <slug>", "organization").option("-y, --yes", "skip the confirmation").action(async (ref, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const agent = await resolveAgent(ctx, org.id, ref);
+		await confirmDestructive(options.yes, `Disable ${agent.slug}? Running proxies keep their current bundle until it expires.`);
+		await ctx.client.updateAgent(org.id, agent.id, { enabled: false });
+		console.error(`${agent.slug} disabled — its next policy refresh is refused`);
+	});
+	agents.command("enable <ref>").description("serve this identity's policy again").option("--org <slug>", "organization").action(async (ref, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const agent = await resolveAgent(ctx, org.id, ref);
+		await ctx.client.updateAgent(org.id, agent.id, { enabled: true });
+		console.error(`${agent.slug} enabled`);
+	});
+	agents.command("rm <ref>").description("delete an identity and its published history").option("--org <slug>", "organization").option("-y, --yes", "skip the confirmation").action(async (ref, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const agent = await resolveAgent(ctx, org.id, ref);
+		await confirmDestructive(options.yes, `Delete ${agent.slug} and all ${agent.currentPolicyVersion} published version(s)? The audit_log rows survive.`);
+		await ctx.client.deleteAgent(org.id, agent.id);
+		console.error(`${agent.slug} deleted`);
+	});
+	/**
+	* The trust anchor. This prints a *public* key fingerprint — the security of
+	* pinning comes from the operator putting it in a local file the API cannot
+	* reach, not from this command being honest. Which is why it prints the TOML
+	* line to paste rather than offering to write the config.
+	*/
+	agents.command("signer").description("your policy signing thumbprint, to pin in a proxy config").option("--org <slug>", "organization").option("--json", "machine-readable output").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { signer } = await ctx.client.getMyPolicySigner(org.id);
+		if (!signer) fail("your account has no keypair yet — run `seekrit keys setup`");
+		emit(options, { signer }, () => {
+			printFields([["thumbprint", signer.thumbprint], ["user", signer.userId]]);
+			section("pin it in seekrit-proxy.toml");
+			console.log("[policy]");
+			console.log(`signers = ["${signer.thumbprint}"]`);
+			console.error("");
+			console.error("pin a second admin's key too — one pinned signer means one lost passphrase leaves nobody able to publish");
+		});
+	});
+	/**
+	* The token is printed to **stdout** and everything else to stderr, so the
+	* common thing works without parsing:
+	*
+	*   TASK=$(seekrit agents dispatch nova --scope GITHUB_TOKEN --ttl 15m)
+	*
+	* It is shown exactly once. The API stores only a hash, so a lost token cannot
+	* be recovered — dispatch another and revoke the first.
+	*/
+	agents.command("dispatch <ref>").description("mint task-scoped authority for one agent run").option("--scope <NAME>", "narrow this run to one secret (repeatable)", collectScope).option("--ttl <duration>", "how long the run stays authorized (e.g. 15m, 2h)").option("--label <text>", "what this run is for — recorded in the audit trail").option("--json", "machine-readable output (includes the token)").action(async (ref, options) => {
+		const ctx = buildContext();
+		const ttlSeconds = options.ttl ? parseDurationSeconds(options.ttl, "--ttl") : 900;
+		if (ttlSeconds < 60 || ttlSeconds > 43200) fail(`--ttl must be between 60s and ${TASK_MAX_TTL_SECONDS / 3600}h`);
+		const minted = await createAgentTaskToken();
+		const { task, header } = await ctx.client.dispatchAgentTask(ref, {
+			taskRef: minted.taskRef,
+			tokenHash: minted.tokenHash,
+			ttlSeconds,
+			...options.scope ? { scopes: options.scope } : {},
+			...options.label ? { label: options.label } : {}
+		});
+		if (options.json) {
+			console.log(JSON.stringify({
+				task,
+				header,
+				token: minted.token
+			}, null, 2));
+			return;
+		}
+		console.log(minted.token);
+		printFieldsToStderr([
+			["task", task.id],
+			["agent", ref],
+			["scopes", task.scopes ? describeSecrets(task.scopes) : "the agent's full policy"],
+			["policy", `v${task.policyVersion}`],
+			["expires", describeExpiry(task.expiresAt)],
+			["header", header]
+		]);
+	});
+	agents.command("tasks <ref>").description("runs dispatched for an agent identity, newest first").option("--org <slug>", "organization").option("--all", "include expired and revoked runs").option("--json", "machine-readable output").action(async (ref, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const agent = await resolveAgent(ctx, org.id, ref);
+		const { tasks } = await ctx.client.listAgentTasks(org.id, agent.id);
+		const now = Date.now();
+		const rows = options.all ? tasks : tasks.filter((t) => taskStateOf(t, now) === "active");
+		emit(options, { tasks: rows }, () => printTable(rows, [
+			col("task", (t) => t.id),
+			col("state", (t) => taskStateOf(t, now)),
+			col("scopes", (t) => t.scopes ? describeSecrets(t.scopes) : "policy"),
+			col("policy", (t) => `v${t.policyVersion}`),
+			col("expires", (t) => t.expiresAt),
+			col("last seen", (t) => t.lastSeenAt ?? "never"),
+			col("label", (t) => t.label ?? "-")
+		], options.all ? "no runs dispatched yet" : "no live runs (try --all)"));
+	});
+	agents.command("revoke <taskId>").description("end a run's authority now").action(async (taskId) => {
+		const { task } = await buildContext().client.revokeAgentTask(taskId);
+		console.error(`${task.id} revoked — enforcement points refuse it at their next introspection`);
+	});
+	registerPolicyCommands(agents.command("policy").description("published policy versions (`seekrit agents policy --help`)"));
+	agents.command("activity <ref>").description("what this agent actually did — aggregate decisions, not a request log").option("--days <n>", "how far back to look (1–90)", "14").option("--org <slug>", "organization").option("--json", "machine-readable output").action(async (ref, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const agent = await resolveAgent(ctx, org.id, ref);
+		const days = Number(options.days ?? 14);
+		if (!Number.isInteger(days) || days < 1 || days > 90) fail("--days must be 1–90");
+		const { activity, summary } = await ctx.client.getAgentActivity(org.id, agent.id, days);
+		emit(options, {
+			activity,
+			summary
+		}, () => {
+			printFields([
+				["window", `${days}d`],
+				["allowed", summary.allowed],
+				["denied", summary.denied],
+				["hosts", summary.hosts],
+				["earliest", summary.from ?? "no activity reported"]
+			]);
+			if (activity.length === 0) {
+				console.error("");
+				console.error("nothing reported — add an [activity] block to the proxy (`seekrit proxy init --activity`)");
+				return;
+			}
+			section("decisions");
+			printTable(activity, [
+				col("host", (a) => a.host),
+				col("method", (a) => a.method),
+				col("decision", (a) => a.decision),
+				col("rule", (a) => a.ruleIndex === null ? "-" : String(a.ruleIndex + 1)),
+				col("count", (a) => a.count),
+				col("secrets", (a) => a.secrets ? Object.entries(a.secrets).map(([name, n]) => `${name}×${n}`).join(" ") : "-")
+			]);
+		});
+	});
+	/**
+	* The grant review loop. Proposals are computed *here*, from activity the API
+	* served — the API is deliberately not in the business of saying what a policy
+	* should be. And `--out` writes a rule file rather than publishing: the change
+	* still goes through `policy publish`, which still needs a human's key.
+	*/
+	agents.command("review <ref>").description("compare published policy against observed activity, and propose changes").option("--days <n>", "how far back to look (1–90)", "14").option("-o, --out <path>", "write the narrowed rules to a file, ready to publish").option("--org <slug>", "organization").option("--json", "machine-readable output").action(async (ref, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const agent = await resolveAgent(ctx, org.id, ref);
+		const days = Number(options.days ?? 14);
+		if (!Number.isInteger(days) || days < 1 || days > 90) fail("--days must be 1–90");
+		const live = await loadVersion(ctx, org.id, agent);
+		if (!live) fail(`${agent.slug} has no published policy to review`);
+		const { activity, summary } = await ctx.client.getAgentActivity(org.id, agent.id, days);
+		const proposals = reviewPolicy({
+			rules: live.rules,
+			activity
+		});
+		emit(options, {
+			proposals,
+			summary,
+			version: live.version
+		}, () => {
+			console.error(`${agent.slug} — policy v${live.version}, ${summary.allowed + summary.denied} decision(s) over ${days}d`);
+			if (activity.length === 0) {
+				console.error("");
+				console.error("no activity reported yet — nothing to review against");
+				return;
+			}
+			if (proposals.length === 0) {
+				console.error("");
+				console.error("no changes proposed: every rule is in use and nothing was refused");
+				return;
+			}
+			section("proposals");
+			for (const p of proposals) {
+				const marker = p.applicable ? "-" : "?";
+				console.log(`${marker} ${p.rationale}`);
+			}
+			const applicable = countApplicable(proposals);
+			console.error("");
+			console.error(`${applicable} narrowing change(s) can be applied; ${proposals.length - applicable} need a human decision`);
+		});
+		if (options.out) {
+			const narrowed = applyProposals(live.rules, proposals);
+			writeFileSync(options.out, `${JSON.stringify({ rules: narrowed }, null, 2)}\n`);
+			console.error(`wrote ${narrowed.length} rule(s) to ${options.out} — review the diff, then: seekrit agents policy publish ${agent.slug} -f ${options.out}`);
+			console.error("widening proposals are never applied: an agent must not earn permissions by retrying");
+		}
+	});
+	agents.command("simulate <ref>").description("ask what a policy would decide, without sending a request").requiredOption("--host <host>", "upstream hostname").requiredOption("--path <path>", "request path").option("--method <method>", "HTTP method", "GET").option("--secret <NAME>", "the secret the request would inject").option("--version <n>", "evaluate a specific published version").option("--org <slug>", "organization").option("--json", "machine-readable output").action(async (ref, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const agent = await resolveAgent(ctx, org.id, ref);
+		const version = options.version === void 0 ? void 0 : Number(options.version);
+		if (version !== void 0 && !Number.isInteger(version)) fail("--version must be an integer");
+		const published = await loadVersion(ctx, org.id, agent, version);
+		if (!published) fail(`${agent.slug} has no published policy — every request is denied`);
+		const verdict = evaluatePolicy(published.rules, {
+			host: options.host,
+			method: options.method,
+			path: options.path,
+			...options.secret === void 0 ? {} : { secret: options.secret }
+		});
+		const reason = describePolicyVerdict(verdict, published.rules);
+		emit(options, {
+			version: published.version,
+			verdict,
+			reason
+		}, () => {
+			const target = `${options.method.toUpperCase()} ${options.host}${options.path}`;
+			console.log(`${verdict.decision === "allow" ? "allow" : "DENY"}  ${target}${options.secret ? ` [${options.secret}]` : ""}`);
+			console.log(`  v${published.version}: ${reason}`);
+		});
+		if (verdict.decision !== "allow") process.exitCode = 1;
+	});
+}
+function registerPolicyCommands(policy) {
+	policy.command("list <ref>").description("published versions, newest first").option("--org <slug>", "organization").option("--json", "machine-readable output").action(async (ref, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const agent = await resolveAgent(ctx, org.id, ref);
+		const { policies } = await ctx.client.listAgentPolicies(org.id, agent.id);
+		emit(options, { policies }, () => printTable(policies, [
+			col("version", (p) => `v${p.version}`),
+			col("rules", (p) => p.ruleCount),
+			col("signer", (p) => p.signerThumbprint.slice(0, 12)),
+			col("published", (p) => p.publishedAt),
+			col("expires", (p) => secondsUntil(p.expiresAt) <= 0 ? `${p.expiresAt} (expired)` : p.expiresAt),
+			col("note", (p) => p.rolledBackFromVersion ? `restored v${p.rolledBackFromVersion}` : "-")
+		], "nothing published yet"));
+	});
+	policy.command("show <ref>").description("the rules in a published version (live by default)").option("--version <n>", "a specific version").option("--org <slug>", "organization").option("--json", "machine-readable output").action(async (ref, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const agent = await resolveAgent(ctx, org.id, ref);
+		const version = options.version === void 0 ? void 0 : Number(options.version);
+		if (version !== void 0 && !Number.isInteger(version)) fail("--version must be an integer");
+		const published = await loadVersion(ctx, org.id, agent, version);
+		if (!published) fail(`${agent.slug} has no published policy`);
+		emit(options, { policy: published }, () => {
+			printFields([
+				["version", `v${published.version}`],
+				["signer", published.signerThumbprint],
+				["published", published.publishedAt],
+				["expires", describeExpiry(published.expiresAt)]
+			]);
+			section("rules");
+			printRules(published.rules);
+		});
+	});
+	/**
+	* Write the live rules out as the editable source for the next publish. This
+	* is the half that makes policy-as-code work: what comes back out is exactly
+	* the shape `publish` takes in, so a round trip is a no-op diff.
+	*/
+	policy.command("pull <ref>").description("write a version's rules to a JSON file you can edit and publish").option("-o, --out <path>", "where to write it (default: stdout)").option("--version <n>", "a specific version").option("--org <slug>", "organization").action(async (ref, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const agent = await resolveAgent(ctx, org.id, ref);
+		const version = options.version === void 0 ? void 0 : Number(options.version);
+		if (version !== void 0 && !Number.isInteger(version)) fail("--version must be an integer");
+		const published = await loadVersion(ctx, org.id, agent, version);
+		const rules = published?.rules ?? [];
+		const body = `${JSON.stringify({ rules }, null, 2)}\n`;
+		if (options.out) {
+			writeFileSync(options.out, body);
+			console.error(published ? `wrote ${rules.length} rule(s) from v${published.version} to ${options.out}` : `wrote an empty rule set to ${options.out} (nothing published yet)`);
+			return;
+		}
+		process.stdout.write(body);
+	});
+	policy.command("publish <ref>").description("sign a rule file with your own key and publish it").requiredOption("-f, --file <path>", `rule file, or ${STDIN} for stdin`).option("--ttl <duration>", "how long the bundle stays valid (e.g. 7d, 12h)").option("--org <slug>", "organization").option("-y, --yes", "skip the confirmation").option("--json", "machine-readable output").action(async (ref, options) => {
+		const ctx = buildContext();
+		if (isTokenAuth(ctx)) fail("publishing agent policy needs a human's signing key — sign in with `seekrit login`. A service token cannot publish, so an agent cannot widen its own policy.");
+		const org = await resolveOrg(ctx, options.org);
+		const agent = await resolveAgent(ctx, org.id, ref);
+		const ttlSeconds = options.ttl ? parseDurationSeconds(options.ttl, "--ttl") : POLICY_DEFAULT_TTL_SECONDS;
+		if (ttlSeconds < 3600 || ttlSeconds > 7776e3) fail(`--ttl must be between ${POLICY_MIN_TTL_SECONDS / 3600}h and ${POLICY_MAX_TTL_SECONDS / 86400}d`);
+		const { raw, label } = await readRuleSource(options.file);
+		const rules = parseRuleFile(raw, label);
+		const live = await loadVersion(ctx, org.id, agent);
+		const nextVersion = agent.currentPolicyVersion + 1;
+		const from = agent.currentPolicyVersion === 0 ? "nothing" : `v${agent.currentPolicyVersion}`;
+		console.error(`${agent.slug}: ${from} → v${nextVersion}`);
+		printPolicyDiff(live?.rules ?? [], rules);
+		await confirmDestructive(options.yes, `Publish v${nextVersion} for ${agent.slug} (${rules.length} rule(s), valid ${options.ttl ?? "7d"})?`);
+		const { signingKey, jwk } = await getPolicySigner(ctx);
+		const issuedAt = Math.floor(Date.now() / 1e3);
+		const bundle = await signAgentPolicy(signingKey, jwk, {
+			v: 1,
+			org: org.id,
+			agent: agent.id,
+			agent_slug: agent.slug,
+			policy_version: nextVersion,
+			issued_at: issuedAt,
+			expires_at: issuedAt + ttlSeconds,
+			rules
+		});
+		const { policy: published } = await ctx.client.publishAgentPolicy(org.id, agent.id, bundle);
+		emit(options, { policy: published }, () => {
+			console.error(`published v${published.version} — signed with ${published.signerThumbprint.slice(0, 12)}…, expires ${published.expiresAt}`);
+			console.error("proxies pick it up at their next refresh");
+		});
+	});
+	policy.command("rollback <ref> <version>").description("republish an earlier version's bundle as the newest one").option("--org <slug>", "organization").option("-y, --yes", "skip the confirmation").action(async (ref, versionArg, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const agent = await resolveAgent(ctx, org.id, ref);
+		const version = Number(versionArg);
+		if (!Number.isInteger(version) || version < 1) fail("version must be a positive integer");
+		const source = await loadVersion(ctx, org.id, agent, version);
+		if (!source) fail(`no version ${version}`);
+		if (secondsUntil(source.expiresAt) <= 0) fail(`v${version} expired at ${source.expiresAt} — a rollback keeps the original expiry, so it would be inert. Publish the rules again instead: seekrit agents policy pull ${agent.slug} --version ${version} -o rules.json`);
+		await confirmDestructive(options.yes, `Roll ${agent.slug} back to v${version} (${source.ruleCount} rule(s))?`);
+		const { policy: published } = await ctx.client.rollbackAgentPolicy(org.id, agent.id, version);
+		console.error(`published v${published.version} carrying v${version}'s bundle`);
+	});
+	/**
+	* What a proxy actually gets. Useful when a deployment misbehaves and the
+	* question is whether the API, the pin, or the rules are at fault — so it
+	* re-derives the thumbprint from the bundle rather than reporting the one the
+	* API sends beside it, and says plainly when the two disagree.
+	*/
+	policy.command("fetch <ref>").description("the bundle a proxy would fetch, with its signer re-derived locally").option("--bundle", "print the raw ap1. envelope and nothing else").option("--json", "machine-readable output").action(async (ref, options) => {
+		const fetched = await buildContext().client.getAgentPolicyBundle(ref);
+		if (options.bundle) {
+			process.stdout.write(`${fetched.bundle}\n`);
+			return;
+		}
+		const body = parseAgentPolicyUnverified(fetched.bundle);
+		const derived = await policySignerThumbprint(body.signer.jwk);
+		emit(options, {
+			...fetched,
+			derivedThumbprint: derived,
+			rules: body.rules
+		}, () => {
+			printFields([
+				["agent", `${fetched.agent.slug} (${fetched.agent.name})`],
+				["version", `v${fetched.version}`],
+				["expires", describeExpiry(fetched.expiresAt)],
+				["signer (in bundle)", derived],
+				["signer (reported)", fetched.signerThumbprint === derived ? "matches" : `${fetched.signerThumbprint} — DOES NOT MATCH the bundle; a proxy would refuse this`]
+			]);
+			section("rules");
+			printRules(body.rules);
+			console.error("");
+			console.error("this command does not verify the signature — only a pinned signer list can, which lives in the proxy's own config");
+		});
+	});
+}
+//#endregion
 //#region src/kms.ts
 /** Collect a repeatable option into a list. */
 function collect$6(value, acc = []) {
@@ -7533,7 +8831,7 @@ function collect$2(value, acc) {
 * release-please-config.json), so the pin follows the crate without anyone
 * remembering to move it.
 */
-const PROXY_VERSION = "0.8.0";
+const PROXY_VERSION = "0.10.0";
 const BIN = "seekrit-proxy";
 /**
 * Host → Rust target triple.
@@ -7569,7 +8867,7 @@ function versionPrefix(version) {
 	return version.startsWith("v") ? version : `v${version}`;
 }
 function resolveVersion(explicit) {
-	return explicit ?? process.env.SEEKRIT_PROXY_VERSION ?? "0.8.0";
+	return explicit ?? process.env.SEEKRIT_PROXY_VERSION ?? "0.10.0";
 }
 function resolveBaseUrl(explicit) {
 	return (explicit ?? process.env.SEEKRIT_PROXY_BASE_URL ?? "https://proxy.seekrit.dev").replace(/\/+$/, "");
@@ -7999,6 +9297,27 @@ function renderProxyConfig(plan) {
 		out.push(`max_ttl = ${tomlString(plan.control.maxTtl)}`);
 		out.push("");
 	}
+	if (plan.tasks) {
+		out.push("# Honour tasks dispatched through the API (`seekrit agents dispatch`): a run");
+		out.push("# presents its skd_… token in the same header a local ticket uses, and this");
+		out.push("# proxy asks the API what it authorizes. Opt-in, because it makes authorizing");
+		out.push("# a new run depend on reaching seekrit — a refused or unreachable check denies");
+		out.push("# the request rather than admitting it.");
+		out.push("#");
+		out.push("# cache_ttl bounds how long a revoked run keeps working. Short on purpose.");
+		out.push("[tasks]");
+		out.push(`cache_ttl = ${tomlString(plan.tasks.cacheTtl)}`);
+		out.push("");
+	}
+	if (plan.activity) {
+		out.push("# Report aggregate decisions back, so `seekrit agents review` can compare this");
+		out.push("# policy against what the agent actually does. Counts only: hosts, methods,");
+		out.push("# secret *names*, and which rule decided — never a request path, never a value.");
+		out.push("# Full per-request detail stays in your own OTLP collector.");
+		out.push("[activity]");
+		out.push(`flush_interval = ${tomlString(plan.activity.flushInterval)}`);
+		out.push("");
+	}
 	if (plan.envHints.length > 0) {
 		out.push("# ---------------------------------------------------------------------------");
 		out.push("# Point the workload at the proxy (these go in its environment, not here):");
@@ -8077,6 +9396,8 @@ function planFromPresets(presets, options) {
 		...options.cacheMaxAge ? { cache: { maxAge: options.cacheMaxAge } } : {},
 		...options.secretsRefresh ? { secretsRefresh: options.secretsRefresh } : {},
 		...options.control ? { control: options.control } : {},
+		...options.tasks ? { tasks: options.tasks } : {},
+		...options.activity ? { activity: options.activity } : {},
 		envHints,
 		notes
 	};
@@ -8142,6 +9463,8 @@ function planFromPolicy(args, options) {
 		caKey: options.caKey,
 		...options.cacheMaxAge ? { cache: { maxAge: options.cacheMaxAge } } : {},
 		...options.control ? { control: options.control } : {},
+		...options.tasks ? { tasks: options.tasks } : {},
+		...options.activity ? { activity: options.activity } : {},
 		envHints,
 		notes
 	};
@@ -8300,7 +9623,9 @@ function planOptions(options) {
 			listen: options.control,
 			ttl: "1h",
 			maxTtl: "12h"
-		} } : {}
+		} } : {},
+		...options.tasks || options.tasksCacheTtl ? { tasks: { cacheTtl: duration(options.tasksCacheTtl, "--tasks-cache-ttl") ?? "30s" } } : {},
+		...options.activity || options.activityInterval ? { activity: { flushInterval: duration(options.activityInterval, "--activity-interval") ?? "60s" } } : {}
 	};
 }
 /**
@@ -8419,7 +9744,7 @@ async function buildPlan(options) {
 }
 /** Add the generation flags to a command, so `init` and `run` stay in step. */
 function withGenerateOptions(cmd) {
-	return cmd.option("--preset <name>", "gateway preset (repeatable; see `seekrit proxy presets`)", (value, acc = []) => [...acc, value]).option("--host <host[=SECRET,…]>", "ad-hoc rule: bare hostname, optionally the secrets it may receive (repeatable)", (value, acc = []) => [...acc, value]).option("--base-url <url>", "upstream base URL for an OpenAI-compatible gateway").option("--secret <NAME>", "override a preset's secret name").option("--prefix <path>", "override a preset's route prefix").option("--agent <slug>", "take the rules from published agent policy (server mode)").option("--agents <slug>", "additional identities this proxy may serve", (v, a = []) => [...a, v]).option("--org <slug>", "organization (for --agent)").option("--mode <reverse|forward|both>", "which data plane(s) to configure", "reverse").option("--listen <addr>", `reverse-proxy address (default: ${PLAN_DEFAULTS.listen})`).option("--forward-listen <addr>", `forward-proxy address (default: ${PLAN_DEFAULTS.forwardListen})`).option("--unmatched <tunnel|deny>", "what to do with an unruled host in forward mode").option("--ca-cert <path>", "interception CA certificate path (forward mode)").option("--ca-key <path>", "interception CA key path (forward mode)").option("--cache", "add a [cache] block so the proxy can start during an outage").option("--cache-max-age <dur>", "how stale a cached resolve may be (implies --cache)").option("--refresh <dur>", "re-resolve/re-fetch interval").option("--control <addr>", "add a [control] listener for per-agent session tickets");
+	return cmd.option("--preset <name>", "gateway preset (repeatable; see `seekrit proxy presets`)", (value, acc = []) => [...acc, value]).option("--host <host[=SECRET,…]>", "ad-hoc rule: bare hostname, optionally the secrets it may receive (repeatable)", (value, acc = []) => [...acc, value]).option("--base-url <url>", "upstream base URL for an OpenAI-compatible gateway").option("--secret <NAME>", "override a preset's secret name").option("--prefix <path>", "override a preset's route prefix").option("--agent <slug>", "take the rules from published agent policy (server mode)").option("--agents <slug>", "additional identities this proxy may serve", (v, a = []) => [...a, v]).option("--org <slug>", "organization (for --agent)").option("--mode <reverse|forward|both>", "which data plane(s) to configure", "reverse").option("--listen <addr>", `reverse-proxy address (default: ${PLAN_DEFAULTS.listen})`).option("--forward-listen <addr>", `forward-proxy address (default: ${PLAN_DEFAULTS.forwardListen})`).option("--unmatched <tunnel|deny>", "what to do with an unruled host in forward mode").option("--ca-cert <path>", "interception CA certificate path (forward mode)").option("--ca-key <path>", "interception CA key path (forward mode)").option("--cache", "add a [cache] block so the proxy can start during an outage").option("--cache-max-age <dur>", "how stale a cached resolve may be (implies --cache)").option("--refresh <dur>", "re-resolve/re-fetch interval").option("--control <addr>", "add a [control] listener for per-agent session tickets").option("--tasks", "add a [tasks] block so this proxy honours runs dispatched with `seekrit agents dispatch`").option("--tasks-cache-ttl <dur>", "how long an introspected task is reused (implies --tasks)").option("--activity", "add an [activity] block so this proxy reports aggregate decisions for `seekrit agents review`").option("--activity-interval <dur>", "how often counts are flushed (implies --activity)");
 }
 function registerProxyCommands(program) {
 	const proxy = program.command("proxy").description("run and configure the agent egress proxy (`seekrit proxy --help`)");
@@ -8486,10 +9811,10 @@ Next:
 		});
 		console.log(path);
 		const { target } = detectTarget();
-		process.stderr.write(`seekrit-proxy ${versionPrefix(options.proxyVersion ?? "0.8.0")} (${target})\n`);
+		process.stderr.write(`seekrit-proxy ${versionPrefix(options.proxyVersion ?? "0.10.0")} (${target})\n`);
 	});
 	proxy.command("where").description("show which binary `seekrit proxy run` would use, without fetching it").option("--proxy-version <version>", `version to report (default: ${PROXY_VERSION})`).option("--json", "machine-readable output").action((options) => {
-		const version = options.proxyVersion ?? process.env.SEEKRIT_PROXY_VERSION ?? "0.8.0";
+		const version = options.proxyVersion ?? process.env.SEEKRIT_PROXY_VERSION ?? "0.10.0";
 		const override = process.env.SEEKRIT_PROXY_BIN;
 		const { target, exe } = detectTarget();
 		const path = override ?? proxyBinaryPath(version, target, exe);
@@ -8510,7 +9835,7 @@ Next:
 		process.stdout.write(renderComposeSnippet(plan, {
 			service: options.service,
 			workload: options.workload,
-			image: options.image ?? `seekritdev/proxy:0.8.0`,
+			image: options.image ?? `seekritdev/proxy:0.10.0`,
 			publish: Boolean(options.publish)
 		}));
 	});
@@ -8668,17 +9993,6 @@ function collect$1(value, acc) {
 * Rotated values are never printed here. Read them like any other secret
 * (`seekrit secrets get NAME`), which decrypts locally.
 */
-/** Parse a duration like `30m`, `24h`, `90d`, or a bare seconds count. */
-function parseDurationSeconds(input, flag) {
-	const m = /^(\d+)\s*([smhd]?)$/.exec(input.trim());
-	if (!m) fail(`invalid ${flag} "${input}" (try 12h, 7d, 90d)`);
-	return Number(m[1]) * ({
-		s: 1,
-		m: 60,
-		h: 3600,
-		d: 86400
-	}[m[2] || "s"] ?? 1);
-}
 function formatInterval(seconds) {
 	if (seconds % 86400 === 0) return `${seconds / 86400}d`;
 	if (seconds % 3600 === 0) return `${seconds / 3600}h`;
@@ -10512,6 +11826,7 @@ registerMysqlCommands(program);
 registerRedisCommands(program);
 registerProvisionerCommands(program);
 registerProxyCommands(program);
+registerAgentCommands(program);
 registerSshCommands(program);
 registerAwsCommands(program);
 registerGcpCommands(program);