@seekrit/cli 0.45.0 → 0.46.0

package/dist/index.js

@@ -1936,6 +1936,7 @@ const AUDIT_ACTIONS = [
 	"secret.rotated",
 	"secret.rotation_failed",
 	"token.created",
+	"token.updated",
 	"token.revoked",
 	"token.deleted",
 	"honey_token.created",
@@ -2108,6 +2109,8 @@ z.object({
 z.object({ name: nameSchema });
 z.object({ name: nameSchema });
 z.object({ name: nameSchema });
+z.object({ name: nameSchema });
+z.object({ name: nameSchema });
 z.object({ required: z.boolean() });
 z.object({
 	email: emailSchema,
@@ -4873,7 +4876,7 @@ async function createAgentTaskToken() {
 }
 //#endregion
 //#region package.json
-var version = "0.45.0";
+var version = "0.46.0";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 var SeekritApiError = class extends Error {
@@ -5025,6 +5028,10 @@ var SeekritClient = class {
 	getEnv(orgId, envId) {
 		return this.request("GET", `/v1/orgs/${orgId}/envs/${envId}`);
 	}
+	/** Rename an environment (display name only — the slug is immutable). */
+	updateEnv(orgId, envId, input) {
+		return this.request("PATCH", `/v1/orgs/${orgId}/envs/${envId}`, input);
+	}
 	deleteEnv(orgId, envId) {
 		return this.request("DELETE", `/v1/orgs/${orgId}/envs/${envId}`);
 	}
@@ -5178,6 +5185,10 @@ var SeekritClient = class {
 	createToken(orgId, input) {
 		return this.request("POST", `/v1/orgs/${orgId}/tokens`, input);
 	}
+	/** Rename a token. Role, environment binding, and expiry are immutable. */
+	updateToken(orgId, tokenId, input) {
+		return this.request("PATCH", `/v1/orgs/${orgId}/tokens/${tokenId}`, input);
+	}
 	revokeToken(orgId, tokenId) {
 		return this.request("DELETE", `/v1/orgs/${orgId}/tokens/${tokenId}`);
 	}
@@ -10065,584 +10076,273 @@ function registerOrgCommands(program) {
 	});
 }
 //#endregion
-//#region src/pg.ts
+//#region src/proxy-presets.ts
+/** `Authorization: Bearer {{seekrit:NAME}}` — the shape most providers take. */
+function placeholder(secret) {
+	return `{{seekrit:${secret}}}`;
+}
 /**
-* `seekrit pg` — temporary Postgres credentials (Vault-style dynamic secrets).
-*
-* Zero-knowledge: minting generates the password and its SCRAM verifier on THIS
-* machine and sends only the verifier; the plaintext password never reaches the
-* API or gets stored. Registering a target wraps the admin connection string to
-* the broker's public key locally, so the control plane only ever stores
-* ciphertext.
+* The catalogue. Ordered as `seekrit proxy presets` prints it: the three model
+* APIs an agent almost certainly calls, then the aggregators, then the generic
+* escape hatches.
 */
-/** Parse a duration like `30m`, `1h`, `7d`, or a bare seconds count. */
-function parseTtlSeconds$2(input) {
-	const m = /^(\d+)\s*([smhd]?)$/.exec(input.trim());
-	if (!m) fail(`invalid --ttl "${input}" (try 30m, 1h, 7d)`);
-	return Number(m[1]) * ({
-		s: 1,
-		m: 60,
-		h: 3600,
-		d: 86400
-	}[m[2] || "s"] ?? 1);
+const PROXY_PRESETS = [
+	{
+		id: "openai",
+		label: "OpenAI API (api.openai.com)",
+		host: "api.openai.com",
+		prefix: "/openai",
+		secret: "OPENAI_API_KEY",
+		methods: ["GET", "POST"],
+		paths: ["/v1/**"],
+		baseUrlSuffix: "/v1",
+		env: (mode) => mode === "reverse" ? [{
+			name: "OPENAI_BASE_URL",
+			value: "{{base}}"
+		}, {
+			name: "OPENAI_API_KEY",
+			value: placeholder("OPENAI_API_KEY")
+		}] : [{
+			name: "OPENAI_API_KEY",
+			value: placeholder("OPENAI_API_KEY")
+		}]
+	},
+	{
+		id: "anthropic",
+		label: "Anthropic API (api.anthropic.com)",
+		host: "api.anthropic.com",
+		prefix: "/anthropic",
+		secret: "ANTHROPIC_API_KEY",
+		methods: ["GET", "POST"],
+		paths: ["/v1/**"],
+		baseUrlSuffix: "",
+		env: (mode) => mode === "reverse" ? [{
+			name: "ANTHROPIC_BASE_URL",
+			value: "{{base}}"
+		}, {
+			name: "ANTHROPIC_API_KEY",
+			value: placeholder("ANTHROPIC_API_KEY")
+		}] : [{
+			name: "ANTHROPIC_API_KEY",
+			value: placeholder("ANTHROPIC_API_KEY")
+		}]
+	},
+	{
+		id: "gemini",
+		label: "Gemini API (generativelanguage.googleapis.com)",
+		host: "generativelanguage.googleapis.com",
+		prefix: "/gemini",
+		secret: "GEMINI_API_KEY",
+		methods: ["GET", "POST"],
+		paths: ["/v1beta/**", "/v1/**"],
+		baseUrlSuffix: "",
+		env: (mode) => mode === "reverse" ? [{
+			name: "GOOGLE_GEMINI_BASE_URL",
+			value: "{{base}}",
+			note: "gemini-cli reads GEMINI_BASE_URL instead — set both if you run either."
+		}, {
+			name: "GEMINI_API_KEY",
+			value: placeholder("GEMINI_API_KEY")
+		}] : [{
+			name: "GEMINI_API_KEY",
+			value: placeholder("GEMINI_API_KEY")
+		}],
+		note: "Gemini authenticates with an x-goog-api-key header; a ?key= query string is substituted too, but prefer the header."
+	},
+	{
+		id: "openrouter",
+		label: "OpenRouter (openrouter.ai) — OpenAI-compatible",
+		host: "openrouter.ai",
+		prefix: "/openrouter",
+		secret: "OPENROUTER_API_KEY",
+		methods: ["GET", "POST"],
+		paths: ["/api/v1/**"],
+		baseUrlSuffix: "/api/v1",
+		env: (mode) => mode === "reverse" ? [{
+			name: "OPENAI_BASE_URL",
+			value: "{{base}}"
+		}, {
+			name: "OPENAI_API_KEY",
+			value: placeholder("OPENROUTER_API_KEY")
+		}] : [{
+			name: "OPENROUTER_API_KEY",
+			value: placeholder("OPENROUTER_API_KEY")
+		}]
+	},
+	{
+		id: "github",
+		label: "GitHub REST + GraphQL API (api.github.com)",
+		host: "api.github.com",
+		prefix: "/github",
+		secret: "GITHUB_TOKEN",
+		methods: [],
+		paths: [],
+		baseUrlSuffix: "",
+		env: (mode) => mode === "reverse" ? [{
+			name: "GITHUB_API_URL",
+			value: "{{base}}"
+		}, {
+			name: "GITHUB_TOKEN",
+			value: placeholder("GITHUB_TOKEN")
+		}] : [{
+			name: "GITHUB_TOKEN",
+			value: placeholder("GITHUB_TOKEN")
+		}],
+		note: "`gh` resolves api.github.com from GH_HOST, not a base URL — prefer forward mode for it."
+	},
+	{
+		id: "openai-compatible",
+		label: "Any OpenAI-compatible gateway — LiteLLM, vLLM, Ollama, Together, self-hosted",
+		host: "",
+		prefix: "/gateway",
+		secret: "OPENAI_API_KEY",
+		methods: ["GET", "POST"],
+		paths: ["/v1/**"],
+		baseUrlSuffix: "/v1",
+		requiresBaseUrl: true,
+		env: (mode) => mode === "reverse" ? [{
+			name: "OPENAI_BASE_URL",
+			value: "{{base}}"
+		}, {
+			name: "OPENAI_API_KEY",
+			value: placeholder("OPENAI_API_KEY")
+		}] : [{
+			name: "OPENAI_API_KEY",
+			value: placeholder("OPENAI_API_KEY")
+		}],
+		note: "Needs --base-url (e.g. --base-url https://litellm.internal:4000)."
+	}
+];
+function findPreset(id) {
+	return PROXY_PRESETS.find((p) => p.id === id);
 }
-/** A fresh, valid Postgres role name: `tmp_` + lowercase alphanumerics. */
-function generateRoleName(prefix = "tmp") {
-	const alphabet = "abcdefghijklmnopqrstuvwxyz0123456789";
-	let out = "";
-	const bytes = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(12));
-	for (const b of bytes) out += alphabet[b % 36];
-	return `${prefix}_${out}`;
+function presetIds() {
+	return PROXY_PRESETS.map((p) => p.id);
 }
-function registerPgCommands(program) {
-	const pg = program.command("pg").description("temporary Postgres credentials (short-lived, zero-knowledge)");
-	const target = pg.command("target").description("manage provisioning targets");
-	target.command("add").description("register a Postgres cluster to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-db").option("--org <slug>").requiredOption("--host <host>", "database host").option("--port <port>", "database port", "5432").requiredOption("--database <name>", "database to connect to").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--schema <name>", "schema for preset grants", "public").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--hmac-key <base64>", "shared HMAC key for the remote executor (or set SEEKRIT_PROVISIONER_HMAC_KEY); `seekrit provisioner keygen` mints one").option("--admin-url <url>", "in_do: admin postgres:// connection string (or set SEEKRIT_PG_ADMIN_URL); wrapped locally").option("--create-statement <sql>", "custom CREATE template (repeatable)", collect$2, []).option("--revoke-statement <sql>", "custom REVOKE template (repeatable)", collect$2, []).action(async (options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const executor = options.executor === "remote" ? "remote" : "in_do";
-		if (executor === "remote" && !options.provisionerUrl) fail("--provisioner-url is required for the remote executor");
-		if (![
-			"readonly",
-			"readwrite",
-			"custom"
-		].includes(options.access)) fail("--access must be readonly, readwrite, or custom");
-		const accessLevel = options.access;
-		const adminSecret = resolveLeaseAdminSecret({
-			executor,
-			hmacKey: options.hmacKey,
-			adminUrl: options.adminUrl,
-			adminUrlEnv: "SEEKRIT_PG_ADMIN_URL"
-		});
-		const config = {
-			provider: "postgres",
-			executor,
-			accessLevel,
-			connection: {
-				host: options.host,
-				port: Number.parseInt(options.port, 10),
-				database: options.database
-			},
-			...accessLevel === "custom" ? {
-				...options.createStatement.length ? { createStatements: options.createStatement } : {},
-				...options.revokeStatement.length ? { revokeStatements: options.revokeStatement } : {}
-			} : { schema: options.schema },
-			...options.provisionerUrl ? { provisionerUrl: options.provisionerUrl } : {}
-		};
-		const { publicKeyJwk } = await ctx.client.getLeaseBrokerKey(org.id);
-		const wrappedAdminSecret = await wrapDek(new TextEncoder().encode(adminSecret), publicKeyJwk);
-		const { target: created } = await ctx.client.registerLeaseTarget(org.id, {
-			name: options.name,
-			config,
-			wrappedAdminSecret
-		});
-		console.error(`registered ${accessLevel} target ${created.name} (${created.id})`);
-		const bootstrap = postgresGroupBootstrapSql(config);
-		if (bootstrap) {
-			console.error("\nRun this once in your database as an admin (safe to re-run):\n");
-			console.log(bootstrap);
-		}
-	});
-	target.command("list").description("list provisioning targets").option("--org <slug>").action(async (options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const { targets } = await ctx.client.listLeaseTargets(org.id);
-		for (const t of targets) {
-			const cfg = t.config;
-			if (cfg.provider !== "postgres") continue;
-			console.log(`${t.id}\t${t.name}\t${cfg.connection.host}:${cfg.connection.port}/${cfg.connection.database}\t${cfg.accessLevel ?? "custom"}\t${cfg.executor}`);
+/**
+* Apply `--base-url` / `--secret` / `--prefix` overrides to a preset.
+*
+* Returns a new preset rather than mutating the catalogue entry: the same
+* process can generate two configs in one run (a test does), and a preset that
+* remembered the last `--base-url` would be a genuinely confusing bug.
+*/
+function specialize(preset, overrides) {
+	let host = preset.host;
+	let paths = preset.paths;
+	let baseUrlSuffix = preset.baseUrlSuffix;
+	if (overrides.baseUrl) {
+		const url = new URL(overrides.baseUrl);
+		host = url.hostname.toLowerCase();
+		const upstreamPath = url.pathname.replace(/\/+$/, "");
+		if (upstreamPath) {
+			paths = [];
+			baseUrlSuffix = `${upstreamPath}${preset.baseUrlSuffix}`;
 		}
-	});
-	target.command("setup-sql <targetId>").description("print the one-time group-role setup SQL for a preset target").option("--org <slug>").action(async (targetId, options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const { targets } = await ctx.client.listLeaseTargets(org.id);
-		const t = targets.find((x) => x.id === targetId || x.name === targetId);
-		if (!t) fail(`no target "${targetId}" in ${org.slug}`);
-		const cfg = t.config;
-		if (cfg.provider !== "postgres") fail("not a postgres target (see `seekrit ssh`)");
-		const bootstrap = postgresGroupBootstrapSql(cfg);
-		if (!bootstrap) fail("this is a custom target — it has no generated setup SQL");
-		console.log(bootstrap);
-	});
-	target.command("rm <targetId>").description("remove a provisioning target").option("--org <slug>").action(async (targetId, options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		await ctx.client.deleteLeaseTarget(org.id, targetId);
-		console.error(`removed ${targetId}`);
-	});
-	pg.command("lease <target>").description("mint a temporary credential; prints a ready-to-use connection URL").option("--org <slug>").option("--role <name>", "role name to create (default: a random tmp_ name)").option("--ttl <duration>", "lifetime, e.g. 30m, 1h, 7d", "1h").option("--json", "print the full connection as JSON").action(async (targetRef, options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const { targets } = await ctx.client.listLeaseTargets(org.id);
-		const target = targets.find((t) => t.id === targetRef || t.name === targetRef);
-		if (!target) fail(`no target "${targetRef}" in ${org.slug}`);
-		if (target.config.provider !== "postgres") fail(`"${target.name}" is not a postgres target (see \`seekrit ssh\`)`);
-		const roleName = options.role ?? generateRoleName();
-		const ttlSeconds = parseTtlSeconds$2(options.ttl);
-		const { password, verifier } = await generatePostgresCredential();
-		const { connection } = await ctx.client.mintLease(org.id, {
-			provider: "postgres",
-			targetId: target.id,
-			roleName,
-			verifier,
-			ttlSeconds
-		});
-		const url = `postgres://${roleName}:${encodeURIComponent(password)}@${connection.host}:${connection.port}/${connection.database}`;
-		console.error(`leased ${roleName} on ${connection.host}/${connection.database} — expires ${connection.expiresAt}`);
-		if (options.json) console.log(JSON.stringify({
-			...connection,
-			password,
-			url
-		}, null, 2));
-		else console.log(url);
-	});
-	pg.command("leases").description("list leases (the ledger — never secret material)").option("--org <slug>").action(async (options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const { leases } = await ctx.client.listLeases(org.id);
-		for (const l of leases) console.log(`${l.id}\t${l.status}\t${l.resourceRef}\texpires ${l.expiresAt}`);
-	});
-	pg.command("revoke <leaseId>").description("revoke a lease now (drops the role immediately)").option("--org <slug>").action(async (leaseId, options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		await ctx.client.revokeLease(org.id, leaseId);
-		console.error(`revoked ${leaseId}`);
-	});
+	}
+	const secret = overrides.secret ?? preset.secret;
+	const specialized = {
+		...preset,
+		host,
+		paths,
+		baseUrlSuffix,
+		secret,
+		prefix: overrides.prefix ?? preset.prefix
+	};
+	if (preset.allow && secret !== preset.secret) specialized.allow = preset.allow.map((name) => name === preset.secret ? secret : name);
+	if (secret !== preset.secret) specialized.env = (mode) => preset.env(mode).map((hint) => ({
+		...hint,
+		value: hint.value.replace(/\{\{seekrit:[A-Za-z0-9_]+\}\}/, placeholder(secret))
+	}));
+	return specialized;
 }
-/** Collect a repeatable option into an array. */
-function collect$2(value, acc) {
-	acc.push(value);
-	return acc;
+/** The secret names a preset's rule permits. Default-deny: empty means none. */
+function presetAllow(preset) {
+	if (preset.allow) return preset.allow;
+	return preset.secret ? [preset.secret] : [];
 }
 //#endregion
-//#region src/proxy-binary.ts
-/**
-* Fetch and run the `seekrit-proxy` binary without a Rust toolchain.
-*
-* The proxy is the strongest answer seekrit has for an untrusted workload — the
-* agent holds `{{seekrit:NAME}}` and never the key — and it was also the hardest
-* thing here to *try*, because trying it meant `cargo` and a TOML file. This
-* module removes the first half: it resolves a prebuilt, checksum-verified
-* binary for the host platform and execs it, so `npx @seekrit/proxy` and
-* `seekrit proxy run` behave like the proxy was already installed.
-*
-* The logic lives in the CLI (and is re-exported as `@seekrit/cli/proxy-launcher`)
-* for the same reason the MCP server does: `@seekrit/proxy` is a thin npx
-* entrypoint over it, and the two must not drift.
-*
-* Three properties worth stating, since this downloads and executes code:
-*
-* - **The checksum is verified before anything is executed**, against a
-*   `.sha256` fetched from the same release. That is integrity, not provenance —
-*   it proves the bytes match what the release published, which is exactly the
-*   guarantee `install.sh` gives and no more.
-* - **Nothing is fetched when a binary is already available.** `SEEKRIT_PROXY_BIN`
-*   short-circuits entirely, and a cached download for the same version+target is
-*   reused, so this is a one-time cost per version.
-* - **Version is pinned, not floating.** A default of `latest` would make two
-*   machines run different proxies from the same command; the pinned constant is
-*   what this CLI was built against, overridable when you want otherwise.
-*/
+//#region src/proxy-config.ts
 /**
-* The proxy version this CLI was built against.
-*
-* Bumped by release-please when `apps/proxy` releases (an `extra-files` entry in
-* release-please-config.json), so the pin follows the crate without anyone
-* remembering to move it.
+* A deliberately small TOML writer: basic strings and arrays of them, which is
+* every value in this config. Full TOML is not needed and a general emitter
+* would be one more thing that can disagree with the parser on an edge case.
 */
-const PROXY_VERSION = "0.10.0";
-const BIN = "seekrit-proxy";
+function tomlString(value) {
+	return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\t/g, "\\t").replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, (c) => {
+		return `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`;
+	})}"`;
+}
+function tomlArray(values) {
+	return `[${values.map(tomlString).join(", ")}]`;
+}
 /**
-* Host → Rust target triple.
+* Claim `preferred` if nothing else has it, else derive one from `host`.
 *
-* Linux always resolves to **musl**: that build is statically linked, so one
-* artifact covers glibc, musl, alpine, and distroless, and there is no libc
-* detection to get wrong on a machine where `ldd` says something unexpected.
+* Two rules can name the same preset-known host (a narrow rule above a broad
+* one is the documented pattern), and two routes cannot share a prefix — so the
+* second one needs a distinct, still-recognisable name rather than an error.
 */
-function detectTarget(os = platform(), cpu = arch()) {
-	const machine = cpu === "x64" ? "x86_64" : cpu === "arm64" ? "aarch64" : null;
-	if (!machine) throw new Error(`unsupported architecture "${cpu}" — build from source (apps/proxy) or set SEEKRIT_PROXY_BIN`);
-	switch (os) {
-		case "linux": return {
-			target: `${machine}-unknown-linux-musl`,
-			exe: ""
-		};
-		case "darwin": return {
-			target: `${machine}-apple-darwin`,
-			exe: ""
-		};
-		case "win32":
-			if (machine !== "x86_64") throw new Error(`no prebuilt seekrit-proxy for ${machine} Windows — set SEEKRIT_PROXY_BIN to a binary you built`);
-			return {
-				target: "x86_64-pc-windows-msvc",
-				exe: ".exe"
-			};
-		default: throw new Error(`unsupported platform "${os}" — build from source (apps/proxy) or set SEEKRIT_PROXY_BIN`);
+function claimPrefix(preferred, host, taken) {
+	if (preferred && !taken.has(preferred)) {
+		taken.add(preferred);
+		return preferred;
 	}
+	return prefixForHost(host, taken);
 }
-/** `latest` stays `latest`; everything else is normalized to `v<x.y.z>`. */
-function versionPrefix(version) {
-	if (version === "latest") return "latest";
-	return version.startsWith("v") ? version : `v${version}`;
-}
-function resolveVersion(explicit) {
-	return explicit ?? process.env.SEEKRIT_PROXY_VERSION ?? "0.10.0";
-}
-function resolveBaseUrl(explicit) {
-	return (explicit ?? process.env.SEEKRIT_PROXY_BASE_URL ?? "https://proxy.seekrit.dev").replace(/\/+$/, "");
-}
-/** Where a resolved binary is kept, keyed so versions and targets never collide. */
-function proxyBinaryPath(version, target, exe) {
-	return join(defaultCacheDir(), "proxy", versionPrefix(version), target, `${BIN}${exe}`);
-}
-async function fetchBytes(url) {
-	const res = await fetch(url);
-	if (!res.ok) throw new Error(`GET ${url} → ${res.status} ${res.statusText}`);
-	return new Uint8Array(await res.arrayBuffer());
+/** Slug for a route prefix, derived from a hostname. */
+function prefixForHost(host, taken) {
+	const labels = host.split(".").filter(Boolean);
+	while (labels.length > 1 && (labels[0] === "api" || labels[0] === "www")) labels.shift();
+	const base = (labels[0] ?? "upstream").replace(/[^a-z0-9-]/gi, "").toLowerCase() || "upstream";
+	let prefix = `/${base}`;
+	let n = 2;
+	while (taken.has(prefix)) prefix = `/${base}-${n++}`;
+	taken.add(prefix);
+	return prefix;
 }
-/**
-* Ensure a `seekrit-proxy` binary exists locally and return its path.
-*
-* Order: an explicit `SEEKRIT_PROXY_BIN`, then a cached download for this
-* version+target, then a fresh download. A binary already on `PATH` is
-* deliberately *not* used — silently running a different version than the one
-* this CLI pins is the kind of surprise that costs an afternoon.
-*/
-async function resolveProxyBinary(options = {}) {
-	const override = process.env.SEEKRIT_PROXY_BIN;
-	if (override) {
-		if (!existsSync(override)) throw new Error(`SEEKRIT_PROXY_BIN points at ${override}, which does not exist`);
-		return override;
+const HEADER = `# seekrit-proxy configuration — generated by \`seekrit proxy init\`.
+#
+# The proxy resolves the secrets its service token grants (SEEKRIT_TOKEN in the
+# environment, never in this file), then swaps {{seekrit:NAME}} placeholders in
+# outbound requests for the decrypted values before forwarding upstream.
+#
+# Safe to commit: it contains hostnames, secret *names*, and thumbprints — no
+# secret values and no credential. Review it before you rely on it; the
+# allowlist below is a security boundary, and a generator does not know your
+# threat model.`;
+/** Render the plan as the text of a `seekrit-proxy.toml`. */
+function renderProxyConfig(plan) {
+	const out = [HEADER];
+	const server = Boolean(plan.policy);
+	if (plan.notes.length > 0) {
+		out.push("#");
+		for (const note of plan.notes) out.push(`# ${note}`);
 	}
-	const version = resolveVersion(options.version);
-	const { target, exe } = detectTarget();
-	const dest = proxyBinaryPath(version, target, exe);
-	if (!options.force && version !== "latest" && existsSync(dest)) return dest;
-	const baseUrl = resolveBaseUrl(options.baseUrl);
-	const prefix = versionPrefix(version);
-	const name = `${BIN}-${target}${exe}`;
-	const binUrl = `${baseUrl}/${prefix}/bin/${name}`;
-	const sumUrl = `${binUrl}.sha256`;
-	if (!options.quiet) process.stderr.write(`seekrit: fetching ${BIN} ${prefix} (${target})…\n`);
-	let bytes;
-	let expected;
-	try {
-		[bytes, expected] = await Promise.all([fetchBytes(binUrl), fetchBytes(sumUrl).then((b) => Buffer.from(b).toString("utf8").trim().split(/\s+/)[0] ?? "")]);
-	} catch (err) {
-		const message = err instanceof Error ? err.message : String(err);
-		throw new Error(`could not download ${BIN} ${prefix} for ${target}: ${message}\n  Set SEEKRIT_PROXY_BIN to a binary you already have, or build it from apps/proxy.`);
+	out.push("");
+	const reverse = plan.mode === "reverse" || plan.mode === "both";
+	const forward = plan.mode === "forward" || plan.mode === "both";
+	if (reverse) {
+		out.push(`listen = ${tomlString(plan.listen)}`);
+		out.push("");
+	} else {
+		out.push("# Forward-proxy only: the reverse plane still binds this address and");
+		out.push("# serves nothing, since no [[route]] is declared below.");
+		out.push(`listen = ${tomlString(plan.listen)}`);
+		out.push("");
 	}
-	const actual = createHash("sha256").update(bytes).digest("hex");
-	if (!expected || actual !== expected.toLowerCase()) throw new Error(`checksum mismatch for ${name}: expected ${expected || "(none published)"}, got ${actual}. Refusing to run it.`);
-	const dir = dirname(dest);
-	mkdirSync(dir, { recursive: true });
-	const staging = join(dir, `.${BIN}-${process.pid}-${actual.slice(0, 12)}${exe}`);
-	try {
-		writeFileSync(staging, bytes, { mode: 493 });
-		renameSync(staging, dest);
-	} catch (err) {
-		rmSync(staging, { force: true });
-		throw err;
-	}
-	chmodSync(dest, 493);
-	return dest;
-}
-/**
-* Run the proxy, forwarding stdio, signals, and its exit status.
-*
-* The proxy is a long-lived foreground process, so this wrapper has to be
-* transparent: Node cannot exec-replace itself, and without relaying signals
-* Node's default SIGINT handler would kill *this* process on Ctrl-C and leave
-* the proxy running, holding decrypted secrets, with the shell prompt back.
-*/
-async function runProxyBinary(argv, options = {}) {
-	const bin = await resolveProxyBinary(options);
-	const child = spawn(bin, argv, {
-		stdio: "inherit",
-		env: {
-			...process.env,
-			...options.env
-		}
-	});
-	const signals = [
-		"SIGINT",
-		"SIGTERM",
-		"SIGHUP",
-		"SIGQUIT"
-	];
-	const forward = (signal) => {
-		if (child.exitCode !== null || child.signalCode !== null) return;
-		child.kill(signal);
-	};
-	for (const signal of signals) process.on(signal, forward);
-	return new Promise((resolve, reject) => {
-		child.on("error", (err) => {
-			for (const s of signals) process.off(s, forward);
-			reject(/* @__PURE__ */ new Error(`could not start ${bin}: ${err.message}\n  If this is a fresh download, the platform may not match — set SEEKRIT_PROXY_BIN.`));
-		});
-		child.on("exit", (code, signal) => {
-			for (const s of signals) process.off(s, forward);
-			resolve(signal ? 128 + signalNumber(signal) : code ?? 0);
-		});
-	});
-}
-/** Signal name → number, for the 128+n exit convention. */
-function signalNumber(signal) {
-	return {
-		SIGHUP: 1,
-		SIGINT: 2,
-		SIGQUIT: 3,
-		SIGKILL: 9,
-		SIGTERM: 15
-	}[signal] ?? 0;
-}
-//#endregion
-//#region src/proxy-presets.ts
-/** `Authorization: Bearer {{seekrit:NAME}}` — the shape most providers take. */
-function placeholder(secret) {
-	return `{{seekrit:${secret}}}`;
-}
-/**
-* The catalogue. Ordered as `seekrit proxy presets` prints it: the two model
-* APIs an agent almost certainly calls, then the aggregators, then the generic
-* escape hatches.
-*/
-const PROXY_PRESETS = [
-	{
-		id: "openai",
-		label: "OpenAI API (api.openai.com)",
-		host: "api.openai.com",
-		prefix: "/openai",
-		secret: "OPENAI_API_KEY",
-		methods: ["GET", "POST"],
-		paths: ["/v1/**"],
-		baseUrlSuffix: "/v1",
-		env: (mode) => mode === "reverse" ? [{
-			name: "OPENAI_BASE_URL",
-			value: "{{base}}"
-		}, {
-			name: "OPENAI_API_KEY",
-			value: placeholder("OPENAI_API_KEY")
-		}] : [{
-			name: "OPENAI_API_KEY",
-			value: placeholder("OPENAI_API_KEY")
-		}]
-	},
-	{
-		id: "anthropic",
-		label: "Anthropic API (api.anthropic.com)",
-		host: "api.anthropic.com",
-		prefix: "/anthropic",
-		secret: "ANTHROPIC_API_KEY",
-		methods: ["GET", "POST"],
-		paths: ["/v1/**"],
-		baseUrlSuffix: "",
-		env: (mode) => mode === "reverse" ? [{
-			name: "ANTHROPIC_BASE_URL",
-			value: "{{base}}"
-		}, {
-			name: "ANTHROPIC_API_KEY",
-			value: placeholder("ANTHROPIC_API_KEY")
-		}] : [{
-			name: "ANTHROPIC_API_KEY",
-			value: placeholder("ANTHROPIC_API_KEY")
-		}]
-	},
-	{
-		id: "openrouter",
-		label: "OpenRouter (openrouter.ai) — OpenAI-compatible",
-		host: "openrouter.ai",
-		prefix: "/openrouter",
-		secret: "OPENROUTER_API_KEY",
-		methods: ["GET", "POST"],
-		paths: ["/api/v1/**"],
-		baseUrlSuffix: "/api/v1",
-		env: (mode) => mode === "reverse" ? [{
-			name: "OPENAI_BASE_URL",
-			value: "{{base}}"
-		}, {
-			name: "OPENAI_API_KEY",
-			value: placeholder("OPENROUTER_API_KEY")
-		}] : [{
-			name: "OPENROUTER_API_KEY",
-			value: placeholder("OPENROUTER_API_KEY")
-		}]
-	},
-	{
-		id: "github",
-		label: "GitHub REST + GraphQL API (api.github.com)",
-		host: "api.github.com",
-		prefix: "/github",
-		secret: "GITHUB_TOKEN",
-		methods: [],
-		paths: [],
-		baseUrlSuffix: "",
-		env: (mode) => mode === "reverse" ? [{
-			name: "GITHUB_API_URL",
-			value: "{{base}}"
-		}, {
-			name: "GITHUB_TOKEN",
-			value: placeholder("GITHUB_TOKEN")
-		}] : [{
-			name: "GITHUB_TOKEN",
-			value: placeholder("GITHUB_TOKEN")
-		}],
-		note: "`gh` resolves api.github.com from GH_HOST, not a base URL — prefer forward mode for it."
-	},
-	{
-		id: "openai-compatible",
-		label: "Any OpenAI-compatible gateway — LiteLLM, vLLM, Ollama, Together, self-hosted",
-		host: "",
-		prefix: "/gateway",
-		secret: "OPENAI_API_KEY",
-		methods: ["GET", "POST"],
-		paths: ["/v1/**"],
-		baseUrlSuffix: "/v1",
-		requiresBaseUrl: true,
-		env: (mode) => mode === "reverse" ? [{
-			name: "OPENAI_BASE_URL",
-			value: "{{base}}"
-		}, {
-			name: "OPENAI_API_KEY",
-			value: placeholder("OPENAI_API_KEY")
-		}] : [{
-			name: "OPENAI_API_KEY",
-			value: placeholder("OPENAI_API_KEY")
-		}],
-		note: "Needs --base-url (e.g. --base-url https://litellm.internal:4000)."
-	}
-];
-function findPreset(id) {
-	return PROXY_PRESETS.find((p) => p.id === id);
-}
-function presetIds() {
-	return PROXY_PRESETS.map((p) => p.id);
-}
-/**
-* Apply `--base-url` / `--secret` / `--prefix` overrides to a preset.
-*
-* Returns a new preset rather than mutating the catalogue entry: the same
-* process can generate two configs in one run (a test does), and a preset that
-* remembered the last `--base-url` would be a genuinely confusing bug.
-*/
-function specialize(preset, overrides) {
-	let host = preset.host;
-	let paths = preset.paths;
-	let baseUrlSuffix = preset.baseUrlSuffix;
-	if (overrides.baseUrl) {
-		const url = new URL(overrides.baseUrl);
-		host = url.hostname.toLowerCase();
-		const upstreamPath = url.pathname.replace(/\/+$/, "");
-		if (upstreamPath) {
-			paths = [];
-			baseUrlSuffix = `${upstreamPath}${preset.baseUrlSuffix}`;
-		}
-	}
-	const secret = overrides.secret ?? preset.secret;
-	const specialized = {
-		...preset,
-		host,
-		paths,
-		baseUrlSuffix,
-		secret,
-		prefix: overrides.prefix ?? preset.prefix
-	};
-	if (preset.allow && secret !== preset.secret) specialized.allow = preset.allow.map((name) => name === preset.secret ? secret : name);
-	if (secret !== preset.secret) specialized.env = (mode) => preset.env(mode).map((hint) => ({
-		...hint,
-		value: hint.value.replace(/\{\{seekrit:[A-Za-z0-9_]+\}\}/, placeholder(secret))
-	}));
-	return specialized;
-}
-/** The secret names a preset's rule permits. Default-deny: empty means none. */
-function presetAllow(preset) {
-	if (preset.allow) return preset.allow;
-	return preset.secret ? [preset.secret] : [];
-}
-//#endregion
-//#region src/proxy-config.ts
-/**
-* A deliberately small TOML writer: basic strings and arrays of them, which is
-* every value in this config. Full TOML is not needed and a general emitter
-* would be one more thing that can disagree with the parser on an edge case.
-*/
-function tomlString(value) {
-	return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\t/g, "\\t").replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, (c) => {
-		return `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`;
-	})}"`;
-}
-function tomlArray(values) {
-	return `[${values.map(tomlString).join(", ")}]`;
-}
-/**
-* Claim `preferred` if nothing else has it, else derive one from `host`.
-*
-* Two rules can name the same preset-known host (a narrow rule above a broad
-* one is the documented pattern), and two routes cannot share a prefix — so the
-* second one needs a distinct, still-recognisable name rather than an error.
-*/
-function claimPrefix(preferred, host, taken) {
-	if (preferred && !taken.has(preferred)) {
-		taken.add(preferred);
-		return preferred;
-	}
-	return prefixForHost(host, taken);
-}
-/** Slug for a route prefix, derived from a hostname. */
-function prefixForHost(host, taken) {
-	const labels = host.split(".").filter(Boolean);
-	while (labels.length > 1 && (labels[0] === "api" || labels[0] === "www")) labels.shift();
-	const base = (labels[0] ?? "upstream").replace(/[^a-z0-9-]/gi, "").toLowerCase() || "upstream";
-	let prefix = `/${base}`;
-	let n = 2;
-	while (taken.has(prefix)) prefix = `/${base}-${n++}`;
-	taken.add(prefix);
-	return prefix;
-}
-const HEADER = `# seekrit-proxy configuration — generated by \`seekrit proxy init\`.
-#
-# The proxy resolves the secrets its service token grants (SEEKRIT_TOKEN in the
-# environment, never in this file), then swaps {{seekrit:NAME}} placeholders in
-# outbound requests for the decrypted values before forwarding upstream.
-#
-# Safe to commit: it contains hostnames, secret *names*, and thumbprints — no
-# secret values and no credential. Review it before you rely on it; the
-# allowlist below is a security boundary, and a generator does not know your
-# threat model.`;
-/** Render the plan as the text of a `seekrit-proxy.toml`. */
-function renderProxyConfig(plan) {
-	const out = [HEADER];
-	const server = Boolean(plan.policy);
-	if (plan.notes.length > 0) {
-		out.push("#");
-		for (const note of plan.notes) out.push(`# ${note}`);
-	}
-	out.push("");
-	const reverse = plan.mode === "reverse" || plan.mode === "both";
-	const forward = plan.mode === "forward" || plan.mode === "both";
-	if (reverse) {
-		out.push(`listen = ${tomlString(plan.listen)}`);
-		out.push("");
-	} else {
-		out.push("# Forward-proxy only: the reverse plane still binds this address and");
-		out.push("# serves nothing, since no [[route]] is declared below.");
-		out.push(`listen = ${tomlString(plan.listen)}`);
-		out.push("");
-	}
-	if (reverse) for (const route of plan.routes) {
-		out.push("[[route]]");
-		out.push(`prefix = ${tomlString(route.prefix)}`);
-		out.push(`upstream = ${tomlString(route.upstream)}`);
-		if (server) out.push("# allow/methods/paths come from published policy in server mode.");
-		else {
-			if (route.allow.length > 0) out.push(`allow = ${tomlArray(route.allow)}`);
-			else out.push("# No `allow`: this route permits the operation but carries no credential.");
-			if (route.methods.length > 0) out.push(`methods = ${tomlArray(route.methods)}`);
-			if (route.paths.length > 0) out.push(`paths = ${tomlArray(route.paths)}`);
-			if (route.label) out.push(`label = ${tomlString(route.label)}`);
-		}
-		out.push("");
+	if (reverse) for (const route of plan.routes) {
+		out.push("[[route]]");
+		out.push(`prefix = ${tomlString(route.prefix)}`);
+		out.push(`upstream = ${tomlString(route.upstream)}`);
+		if (server) out.push("# allow/methods/paths come from published policy in server mode.");
+		else {
+			if (route.allow.length > 0) out.push(`allow = ${tomlArray(route.allow)}`);
+			else out.push("# No `allow`: this route permits the operation but carries no credential.");
+			if (route.methods.length > 0) out.push(`methods = ${tomlArray(route.methods)}`);
+			if (route.paths.length > 0) out.push(`paths = ${tomlArray(route.paths)}`);
+			if (route.label) out.push(`label = ${tomlString(route.label)}`);
+		}
+		out.push("");
 	}
 	if (forward) {
 		out.push("[forward]");
@@ -10797,197 +10497,719 @@ function planFromPresets(presets, options) {
 		});
 		if (preset.note) notes.push(`${preset.id}: ${preset.note}`);
 	}
-	if (hintMode === "forward") envHints.unshift({
-		name: "HTTPS_PROXY",
-		value: `http://${options.forwardListen}`
-	}, {
-		name: "NODE_EXTRA_CA_CERTS",
-		value: `$PWD/${options.caCert}`,
-		note: "or SSL_CERT_FILE / REQUESTS_CA_BUNDLE, depending on the runtime."
-	});
-	return {
+	if (hintMode === "forward") envHints.unshift({
+		name: "HTTPS_PROXY",
+		value: `http://${options.forwardListen}`
+	}, {
+		name: "NODE_EXTRA_CA_CERTS",
+		value: `$PWD/${options.caCert}`,
+		note: "or SSL_CERT_FILE / REQUESTS_CA_BUNDLE, depending on the runtime."
+	});
+	return {
+		mode: options.mode,
+		listen: options.listen,
+		forwardListen: options.forwardListen,
+		routes,
+		unmatched: options.unmatched,
+		caCert: options.caCert,
+		caKey: options.caKey,
+		...options.cacheMaxAge ? { cache: { maxAge: options.cacheMaxAge } } : {},
+		...options.secretsRefresh ? { secretsRefresh: options.secretsRefresh } : {},
+		...options.control ? { control: options.control } : {},
+		...options.tasks ? { tasks: options.tasks } : {},
+		...options.activity ? { activity: options.activity } : {},
+		envHints,
+		notes
+	};
+}
+/**
+* Build a server-policy plan from an agent's published rules.
+*
+* The rules are used for **routing only** — one `[[route]]` per distinct host,
+* so the workload has a base URL to point at — and never copied into the file as
+* authorization. That is the whole trade of server mode: adding an upstream
+* becomes a dashboard change, and a rule this file also stated would be a
+* startup error rather than a belt-and-braces duplicate.
+*/
+function planFromPolicy(args, options) {
+	const taken = /* @__PURE__ */ new Set();
+	const routes = [];
+	const envHints = [];
+	const notes = [];
+	const hintMode = options.mode === "forward" ? "forward" : "reverse";
+	const seen = /* @__PURE__ */ new Set();
+	for (const rule of args.rules) {
+		if (!rule.host || seen.has(rule.host)) continue;
+		seen.add(rule.host);
+		const preset = PRESET_BY_HOST.get(rule.host);
+		const prefix = claimPrefix(preset?.prefix, rule.host, taken);
+		const baseUrl = baseUrlFor(options.listen, prefix, preset?.baseUrlSuffix ?? "");
+		routes.push({
+			prefix,
+			upstream: `https://${rule.host}`,
+			host: rule.host,
+			allow: [],
+			methods: [],
+			paths: [],
+			baseUrl
+		});
+		if (preset) for (const hint of preset.env(hintMode)) envHints.push({
+			...hint,
+			value: hint.value.replace("{{base}}", baseUrl)
+		});
+	}
+	if (hintMode === "forward") envHints.unshift({
+		name: "HTTPS_PROXY",
+		value: `http://${options.forwardListen}`
+	}, {
+		name: "NODE_EXTRA_CA_CERTS",
+		value: `$PWD/${options.caCert}`,
+		note: "or SSL_CERT_FILE / REQUESTS_CA_BUNDLE, depending on the runtime."
+	});
+	if (args.rules.length === 0) notes.push("The published policy has no rules yet, so this proxy permits nothing until one is published.");
+	return {
+		mode: options.mode,
+		listen: options.listen,
+		forwardListen: options.forwardListen,
+		routes,
+		policy: {
+			agent: args.agent,
+			agents: args.agents,
+			refreshInterval: args.refreshInterval,
+			signers: args.signers
+		},
+		unmatched: options.unmatched,
+		caCert: options.caCert,
+		caKey: options.caKey,
+		...options.cacheMaxAge ? { cache: { maxAge: options.cacheMaxAge } } : {},
+		...options.control ? { control: options.control } : {},
+		...options.tasks ? { tasks: options.tasks } : {},
+		...options.activity ? { activity: options.activity } : {},
+		envHints,
+		notes
+	};
+}
+/** Host → preset, for naming routes generated from published policy. */
+const PRESET_BY_HOST = /* @__PURE__ */ new Map();
+for (const id of [
+	"openai",
+	"anthropic",
+	"openrouter",
+	"github"
+]) {
+	const preset = findPreset(id);
+	if (preset?.host) PRESET_BY_HOST.set(preset.host, preset);
+}
+/** YAML double-quoted scalar. Compose values here are hostnames and URLs. */
+function yamlString(value) {
+	return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
+}
+const COMPOSE_DEFAULTS = {
+	service: "seekrit-proxy",
+	workload: "agent",
+	publish: false
+};
+/**
+* A `docker compose` sidecar snippet for a generated config.
+*
+* The container case differs from the local one in exactly the ways that break a
+* copied-from-the-docs compose file: the proxy has to bind `0.0.0.0` to be
+* reachable from a sibling container, the workload dials it by *service name*
+* rather than loopback, and in forward mode the CA has to live on a shared
+* volume or the workload trusts a certificate the proxy no longer has.
+*/
+function renderComposeSnippet(plan, options) {
+	const reverse = plan.mode === "reverse" || plan.mode === "both";
+	const forward = plan.mode === "forward" || plan.mode === "both";
+	const [, listenPort = "8080"] = splitHostPort(plan.listen);
+	const [, forwardPort = "8081"] = splitHostPort(plan.forwardListen);
+	const host = options.service;
+	const out = [
+		"# seekrit-proxy sidecar — generated by `seekrit proxy compose`.",
+		"#",
+		"# The proxy holds the decrypted secrets; the workload holds only placeholders.",
+		"# Keeping them in separate containers is what makes that boundary real: the",
+		"# service token is in the proxy's environment, where the workload cannot read it.",
+		"services:",
+		`  ${host}:`,
+		`    image: ${options.image}`
+	];
+	const command = [];
+	if (reverse) command.push("--listen", `0.0.0.0:${listenPort}`);
+	if (command.length > 0) out.push(`    command: [${command.map(yamlString).join(", ")}]`);
+	if (forward) {
+		out.push(`    # Forward mode: set \`[forward] listen = "0.0.0.0:${forwardPort}"\` in the`);
+		out.push("    # config too — there is no flag for the forward plane's address.");
+	}
+	out.push("    environment:");
+	out.push("      # Never inline the token. Compose reads it from your shell or a .env file.");
+	out.push("      SEEKRIT_TOKEN: ${SEEKRIT_TOKEN:?SEEKRIT_TOKEN is required}");
+	out.push("    volumes:");
+	out.push("      - ./seekrit-proxy.toml:/seekrit-proxy.toml:ro");
+	if (forward) {
+		out.push("      # The interception CA must survive restarts, or the certificate the");
+		out.push("      # workload trusts stops matching the one the proxy mints leaves from.");
+		out.push("      - seekrit-proxy-ca:/ca");
+	}
+	if (options.publish) {
+		out.push("    ports:");
+		if (reverse) out.push(`      - ${yamlString(`127.0.0.1:${listenPort}:${listenPort}`)}`);
+		if (forward) out.push(`      - ${yamlString(`127.0.0.1:${forwardPort}:${forwardPort}`)}`);
+	} else {
+		out.push("    # No `ports`: reachable on the compose network only, which is what you");
+		out.push("    # want — nothing outside this project can ask the proxy to inject a key.");
+	}
+	out.push("    restart: unless-stopped");
+	out.push("");
+	out.push(`  ${options.workload}:`);
+	out.push("    # ← your workload. It never holds a real credential.");
+	out.push("    image: your-agent:latest");
+	out.push("    depends_on:");
+	out.push(`      - ${host}`);
+	out.push("    environment:");
+	if (forward) {
+		out.push(`      HTTPS_PROXY: ${yamlString(`http://${host}:${forwardPort}`)}`);
+		out.push(`      HTTP_PROXY: ${yamlString(`http://${host}:${forwardPort}`)}`);
+		out.push("      NODE_EXTRA_CA_CERTS: \"/ca/seekrit-proxy-ca.pem\"");
+		out.push("      # …or SSL_CERT_FILE / REQUESTS_CA_BUNDLE, depending on the runtime.");
+	}
+	for (const hint of plan.envHints) {
+		if (hint.name === "HTTPS_PROXY" || hint.name === "NODE_EXTRA_CA_CERTS") continue;
+		const value = hint.value.replace(/http:\/\/[^/]+/, `http://${host}:${listenPort}`);
+		out.push(`      ${hint.name}: ${yamlString(value)}`);
+	}
+	out.push("");
+	if (forward) {
+		out.push("volumes:");
+		out.push("  seekrit-proxy-ca:");
+		out.push("");
+	}
+	out.push(forward ? "# The workload can unset HTTPS_PROXY, so in a threat model where the workload" : "# The workload can ignore the base URL above, so in a threat model where the");
+	out.push(forward ? "# is the adversary, make the proxy the only route out: put the workload on an" : "# workload is the adversary, make the proxy the only route out: put the workload");
+	out.push(forward ? "# `internal: true` network with the proxy as its only peer." : "# on an `internal: true` network with the proxy as its only peer.");
+	return `${out.join("\n").replace(/\n{3,}/g, "\n\n").trimEnd()}\n`;
+}
+//#endregion
+//#region src/paperclip.ts
+/**
+* `seekrit paperclip` — wire seekrit into a [Paperclip](https://docs.paperclip.ing)
+* agent.
+*
+* Paperclip is a control plane: it decides which agent runs, and its *adapter*
+* launches the runtime that does the work. Two consequences shape this command.
+*
+* First, **MCP config is per-runtime, not per-Paperclip-agent.** There is no
+* field in Paperclip's database that means "give this agent the seekrit tools" —
+* the adapter's runtime (Claude Code, Codex, Gemini CLI, OpenCode) reads its own
+* MCP config from the working directory Paperclip points it at. So attaching the
+* seekrit servers means writing a `.mcp.json` *there*, which is what this does.
+*
+* Second, **a seekrit secret cannot be a Paperclip `secret_ref`.** Paperclip's
+* provider list is closed (`local_encrypted`, `aws_secrets_manager`,
+* `gcp_secret_manager`, `vault`), so there is nothing to select. Values reach a
+* run through `seekrit run` / the `run_command` tool, or — better, for a run
+* whose output you cannot predict — through the egress proxy, where the adapter
+* env holds `{{seekrit:NAME}}` placeholders and never a key. The env block this
+* command prints is that second shape, ready to paste into the agent's
+* Configuration tab.
+*
+* The proxy's own config file stays with `seekrit proxy init`. That command
+* already owns the reviewable-security-artifact warnings, and a second
+* generator behind a different name is how the two drift apart.
+*/
+/** Claude Code and friends read this name from the runtime's working directory. */
+const MCP_FILE = ".mcp.json";
+/**
+* The two seekrit MCP servers, in the shape a *runtime's* `.mcp.json` wants.
+*
+* These are the same two servers `agent-plugin/mcp.json` declares, and a test
+* pins them to that file so a rename cannot land in one place only. The one
+* field that is deliberately **not** copied is the remote transport's spelling:
+* the Agent Plugins manifest says `streamable-http`, while Claude Code's own
+* `.mcp.json` says `http`. Writing the manifest's spelling into a runtime config
+* produces a server the runtime silently declines to load, which reads as "the
+* hosted server is down".
+*/
+const PAPERCLIP_MCP_SERVERS = {
+	seekrit: {
+		type: "stdio",
+		command: "npx",
+		args: ["-y", "@seekrit/mcp"]
+	},
+	"seekrit-cloud": {
+		type: "http",
+		url: "https://mcp.seekrit.dev/mcp"
+	}
+};
+/**
+* Merge the seekrit servers into an existing `.mcp.json` without disturbing it.
+*
+* An agent's working directory is usually a real repository, so this file may
+* already carry servers someone else depends on — replacing it wholesale is a
+* silent regression in whatever they were doing. Unknown top-level keys are
+* preserved for the same reason: runtimes keep growing new ones.
+*
+* A `seekrit` entry that already exists and *differs* is left alone unless
+* forced. Someone pinning a version or adding an `env` did it on purpose.
+*/
+function mergeMcpServers(existing, force) {
+	const servers = { ...existing.mcpServers ?? {} };
+	const added = [];
+	const kept = [];
+	for (const [name, entry] of Object.entries(PAPERCLIP_MCP_SERVERS)) {
+		const current = servers[name];
+		if (current && !force) {
+			if (JSON.stringify(current) === JSON.stringify(entry)) continue;
+			kept.push(name);
+			continue;
+		}
+		servers[name] = entry;
+		added.push(name);
+	}
+	return {
+		merged: {
+			...existing,
+			mcpServers: servers
+		},
+		added,
+		kept
+	};
+}
+function readMcpFile(path) {
+	if (!existsSync(path)) return {};
+	let raw;
+	try {
+		raw = readFileSync(path, "utf8");
+	} catch (err) {
+		fail(`could not read ${path}: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	try {
+		const parsed = JSON.parse(raw);
+		if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) fail(`${path} is not a JSON object — fix or move it before writing MCP servers there`);
+		return parsed;
+	} catch (err) {
+		if (err instanceof SyntaxError) fail(`${path} is not valid JSON (${err.message}) — fix or move it first`);
+		throw err;
+	}
+}
+/**
+* The env a Paperclip agent needs, given the upstreams it calls.
+*
+* Every value here is a plain string: a placeholder is not a secret, so none of
+* it needs a `secret_ref` and none of it trips
+* `PAPERCLIP_SECRETS_STRICT_MODE` — which is exactly why this is the path to
+* recommend. The env is derived from the same preset catalogue and the same
+* plan builder `seekrit proxy init` uses, so what gets pasted into Paperclip and
+* what the proxy enforces cannot disagree.
+*
+* One hint has to be rewritten on the way through. The shared generator writes
+* the CA path as `$PWD/seekrit-proxy-ca.pem`, which is correct for the `export`
+* lines it normally produces — a shell expands it. **Paperclip's env map is not a
+* shell.** Pasted verbatim it becomes a literal `$PWD/…`, the runtime cannot find
+* the CA, and every HTTPS call fails with a certificate error that looks like a
+* proxy bug. So it is replaced with a marker that cannot be mistaken for a
+* working value.
+*/
+const ABSOLUTE_PATH_MARKER = "<absolute path to>";
+function adapterEnv(presets, options) {
+	if (presets.length === 0) return [];
+	return planFromPresets(presets, {
+		...PLAN_DEFAULTS,
 		mode: options.mode,
 		listen: options.listen,
-		forwardListen: options.forwardListen,
-		routes,
-		unmatched: options.unmatched,
-		caCert: options.caCert,
-		caKey: options.caKey,
-		...options.cacheMaxAge ? { cache: { maxAge: options.cacheMaxAge } } : {},
-		...options.secretsRefresh ? { secretsRefresh: options.secretsRefresh } : {},
-		...options.control ? { control: options.control } : {},
-		...options.tasks ? { tasks: options.tasks } : {},
-		...options.activity ? { activity: options.activity } : {},
-		envHints,
-		notes
-	};
+		forwardListen: options.forwardListen
+	}).envHints.map((hint) => {
+		if (!hint.value.includes("$PWD/")) return { ...hint };
+		return {
+			...hint,
+			value: hint.value.replace("$PWD/", `${ABSOLUTE_PATH_MARKER} `),
+			note: `${hint.note ? `${hint.note} ` : ""}Paperclip does not expand shell variables — paste the real path the proxy wrote this to.`
+		};
+	});
+}
+function registerPaperclipCommands(program) {
+	program.command("paperclip").description("wire seekrit into a Paperclip agent (`seekrit paperclip --help`)").command("init").description("attach the seekrit MCP servers to a Paperclip agent's working directory").option("-d, --dir <path>", "the agent's working directory", ".").option("--preset <id...>", `upstreams the agent calls, for the printed adapter env (${presetIds().join(", ")})`).option("--mode <mode>", "proxy mode the printed env assumes: forward or reverse", "forward").option("--listen <addr>", "reverse-mode proxy address", PLAN_DEFAULTS.listen).option("--forward-listen <addr>", "forward-mode proxy address", PLAN_DEFAULTS.forwardListen).option("--no-mcp", "print the adapter env only, without writing .mcp.json").option("--force", "overwrite a seekrit entry that already differs").option("--json", "machine-readable output").action((options) => {
+		if (options.mode !== "forward" && options.mode !== "reverse") fail(`--mode must be forward or reverse (got "${options.mode}")`);
+		const presets = [];
+		for (const id of options.preset ?? []) {
+			const preset = findPreset(id);
+			if (!preset) fail(`unknown preset "${id}" — try one of: ${presetIds().join(", ")}`);
+			if (preset.requiresBaseUrl) fail(`preset "${id}" needs a base URL, which this command does not take —\n  generate its env with: seekrit proxy init --preset ${id} --base-url https://…`);
+			presets.push(preset);
+		}
+		const dir = resolve(options.dir);
+		const mcpPath = join(dir, MCP_FILE);
+		let added = [];
+		let kept = [];
+		if (options.mcp) {
+			if (!existsSync(dir)) fail(`no such directory: ${options.dir}\n  Pass --dir with the agent's working directory (its Configuration tab shows it).`);
+			const result = mergeMcpServers(readMcpFile(mcpPath), Boolean(options.force));
+			added = result.added;
+			kept = result.kept;
+			writeFileSync(mcpPath, `${JSON.stringify(result.merged, null, 2)}\n`, { mode: 420 });
+		}
+		const env = adapterEnv(presets, {
+			mode: options.mode,
+			listen: options.listen,
+			forwardListen: options.forwardListen
+		});
+		emit(options, {
+			mcpFile: options.mcp ? mcpPath : null,
+			added,
+			kept,
+			env
+		}, () => {
+			if (options.mcp) {
+				process.stderr.write(added.length > 0 ? `Wrote ${mcpPath} (${added.join(", ")})\n` : `${mcpPath} already had both seekrit servers\n`);
+				for (const name of kept) process.stderr.write(`seekrit: left the existing "${name}" entry alone — pass --force to replace it\n`);
+			}
+			if (env.length > 0) {
+				process.stderr.write("\nAdapter environment variables (Agent → Configuration → Environment variables).\nEvery value is a plain string — a placeholder is not a secret, so none of\nthese needs a Paperclip secret_ref:\n\n");
+				printTable(env, [col("VARIABLE", (h) => h.name), col("VALUE", (h) => h.value)], "no env for these presets");
+				const notes = env.filter((h) => h.note);
+				if (notes.length > 0) {
+					process.stderr.write("\n");
+					for (const hint of notes) process.stderr.write(`  ${hint.name}: ${hint.note}\n`);
+				}
+				const presetFlags = presets.map((p) => `--preset ${p.id}`).join(" ");
+				process.stderr.write(`\nThose values only resolve behind a running proxy. Write its config with:\n  seekrit proxy init --mode ${options.mode} ${presetFlags}\n`);
+			} else process.stderr.write("\nNo --preset given, so no adapter env was printed. Pass the upstreams this\nagent calls to get the placeholder env for them, e.g.\n  seekrit paperclip init --preset anthropic --preset openai\n");
+			process.stderr.write("\nAlso worth doing once per company:\n  npx paperclipai plugin install @seekrit/paperclip-plugin   # tools, skills, panel\n  Skills page → https://github.com/seekritdev/agent-plugin   # skills alone\n");
+		});
+	});
 }
+//#endregion
+//#region src/pg.ts
 /**
-* Build a server-policy plan from an agent's published rules.
+* `seekrit pg` — temporary Postgres credentials (Vault-style dynamic secrets).
 *
-* The rules are used for **routing only** — one `[[route]]` per distinct host,
-* so the workload has a base URL to point at — and never copied into the file as
-* authorization. That is the whole trade of server mode: adding an upstream
-* becomes a dashboard change, and a rule this file also stated would be a
-* startup error rather than a belt-and-braces duplicate.
+* Zero-knowledge: minting generates the password and its SCRAM verifier on THIS
+* machine and sends only the verifier; the plaintext password never reaches the
+* API or gets stored. Registering a target wraps the admin connection string to
+* the broker's public key locally, so the control plane only ever stores
+* ciphertext.
 */
-function planFromPolicy(args, options) {
-	const taken = /* @__PURE__ */ new Set();
-	const routes = [];
-	const envHints = [];
-	const notes = [];
-	const hintMode = options.mode === "forward" ? "forward" : "reverse";
-	const seen = /* @__PURE__ */ new Set();
-	for (const rule of args.rules) {
-		if (!rule.host || seen.has(rule.host)) continue;
-		seen.add(rule.host);
-		const preset = PRESET_BY_HOST.get(rule.host);
-		const prefix = claimPrefix(preset?.prefix, rule.host, taken);
-		const baseUrl = baseUrlFor(options.listen, prefix, preset?.baseUrlSuffix ?? "");
-		routes.push({
-			prefix,
-			upstream: `https://${rule.host}`,
-			host: rule.host,
-			allow: [],
-			methods: [],
-			paths: [],
-			baseUrl
+/** Parse a duration like `30m`, `1h`, `7d`, or a bare seconds count. */
+function parseTtlSeconds$2(input) {
+	const m = /^(\d+)\s*([smhd]?)$/.exec(input.trim());
+	if (!m) fail(`invalid --ttl "${input}" (try 30m, 1h, 7d)`);
+	return Number(m[1]) * ({
+		s: 1,
+		m: 60,
+		h: 3600,
+		d: 86400
+	}[m[2] || "s"] ?? 1);
+}
+/** A fresh, valid Postgres role name: `tmp_` + lowercase alphanumerics. */
+function generateRoleName(prefix = "tmp") {
+	const alphabet = "abcdefghijklmnopqrstuvwxyz0123456789";
+	let out = "";
+	const bytes = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(12));
+	for (const b of bytes) out += alphabet[b % 36];
+	return `${prefix}_${out}`;
+}
+function registerPgCommands(program) {
+	const pg = program.command("pg").description("temporary Postgres credentials (short-lived, zero-knowledge)");
+	const target = pg.command("target").description("manage provisioning targets");
+	target.command("add").description("register a Postgres cluster to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-db").option("--org <slug>").requiredOption("--host <host>", "database host").option("--port <port>", "database port", "5432").requiredOption("--database <name>", "database to connect to").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--schema <name>", "schema for preset grants", "public").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--hmac-key <base64>", "shared HMAC key for the remote executor (or set SEEKRIT_PROVISIONER_HMAC_KEY); `seekrit provisioner keygen` mints one").option("--admin-url <url>", "in_do: admin postgres:// connection string (or set SEEKRIT_PG_ADMIN_URL); wrapped locally").option("--create-statement <sql>", "custom CREATE template (repeatable)", collect$2, []).option("--revoke-statement <sql>", "custom REVOKE template (repeatable)", collect$2, []).action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const executor = options.executor === "remote" ? "remote" : "in_do";
+		if (executor === "remote" && !options.provisionerUrl) fail("--provisioner-url is required for the remote executor");
+		if (![
+			"readonly",
+			"readwrite",
+			"custom"
+		].includes(options.access)) fail("--access must be readonly, readwrite, or custom");
+		const accessLevel = options.access;
+		const adminSecret = resolveLeaseAdminSecret({
+			executor,
+			hmacKey: options.hmacKey,
+			adminUrl: options.adminUrl,
+			adminUrlEnv: "SEEKRIT_PG_ADMIN_URL"
 		});
-		if (preset) for (const hint of preset.env(hintMode)) envHints.push({
-			...hint,
-			value: hint.value.replace("{{base}}", baseUrl)
+		const config = {
+			provider: "postgres",
+			executor,
+			accessLevel,
+			connection: {
+				host: options.host,
+				port: Number.parseInt(options.port, 10),
+				database: options.database
+			},
+			...accessLevel === "custom" ? {
+				...options.createStatement.length ? { createStatements: options.createStatement } : {},
+				...options.revokeStatement.length ? { revokeStatements: options.revokeStatement } : {}
+			} : { schema: options.schema },
+			...options.provisionerUrl ? { provisionerUrl: options.provisionerUrl } : {}
+		};
+		const { publicKeyJwk } = await ctx.client.getLeaseBrokerKey(org.id);
+		const wrappedAdminSecret = await wrapDek(new TextEncoder().encode(adminSecret), publicKeyJwk);
+		const { target: created } = await ctx.client.registerLeaseTarget(org.id, {
+			name: options.name,
+			config,
+			wrappedAdminSecret
+		});
+		console.error(`registered ${accessLevel} target ${created.name} (${created.id})`);
+		const bootstrap = postgresGroupBootstrapSql(config);
+		if (bootstrap) {
+			console.error("\nRun this once in your database as an admin (safe to re-run):\n");
+			console.log(bootstrap);
+		}
+	});
+	target.command("list").description("list provisioning targets").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		for (const t of targets) {
+			const cfg = t.config;
+			if (cfg.provider !== "postgres") continue;
+			console.log(`${t.id}\t${t.name}\t${cfg.connection.host}:${cfg.connection.port}/${cfg.connection.database}\t${cfg.accessLevel ?? "custom"}\t${cfg.executor}`);
+		}
+	});
+	target.command("setup-sql <targetId>").description("print the one-time group-role setup SQL for a preset target").option("--org <slug>").action(async (targetId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		const t = targets.find((x) => x.id === targetId || x.name === targetId);
+		if (!t) fail(`no target "${targetId}" in ${org.slug}`);
+		const cfg = t.config;
+		if (cfg.provider !== "postgres") fail("not a postgres target (see `seekrit ssh`)");
+		const bootstrap = postgresGroupBootstrapSql(cfg);
+		if (!bootstrap) fail("this is a custom target — it has no generated setup SQL");
+		console.log(bootstrap);
+	});
+	target.command("rm <targetId>").description("remove a provisioning target").option("--org <slug>").action(async (targetId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		await ctx.client.deleteLeaseTarget(org.id, targetId);
+		console.error(`removed ${targetId}`);
+	});
+	pg.command("lease <target>").description("mint a temporary credential; prints a ready-to-use connection URL").option("--org <slug>").option("--role <name>", "role name to create (default: a random tmp_ name)").option("--ttl <duration>", "lifetime, e.g. 30m, 1h, 7d", "1h").option("--json", "print the full connection as JSON").action(async (targetRef, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		const target = targets.find((t) => t.id === targetRef || t.name === targetRef);
+		if (!target) fail(`no target "${targetRef}" in ${org.slug}`);
+		if (target.config.provider !== "postgres") fail(`"${target.name}" is not a postgres target (see \`seekrit ssh\`)`);
+		const roleName = options.role ?? generateRoleName();
+		const ttlSeconds = parseTtlSeconds$2(options.ttl);
+		const { password, verifier } = await generatePostgresCredential();
+		const { connection } = await ctx.client.mintLease(org.id, {
+			provider: "postgres",
+			targetId: target.id,
+			roleName,
+			verifier,
+			ttlSeconds
 		});
+		const url = `postgres://${roleName}:${encodeURIComponent(password)}@${connection.host}:${connection.port}/${connection.database}`;
+		console.error(`leased ${roleName} on ${connection.host}/${connection.database} — expires ${connection.expiresAt}`);
+		if (options.json) console.log(JSON.stringify({
+			...connection,
+			password,
+			url
+		}, null, 2));
+		else console.log(url);
+	});
+	pg.command("leases").description("list leases (the ledger — never secret material)").option("--org <slug>").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { leases } = await ctx.client.listLeases(org.id);
+		for (const l of leases) console.log(`${l.id}\t${l.status}\t${l.resourceRef}\texpires ${l.expiresAt}`);
+	});
+	pg.command("revoke <leaseId>").description("revoke a lease now (drops the role immediately)").option("--org <slug>").action(async (leaseId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		await ctx.client.revokeLease(org.id, leaseId);
+		console.error(`revoked ${leaseId}`);
+	});
+}
+/** Collect a repeatable option into an array. */
+function collect$2(value, acc) {
+	acc.push(value);
+	return acc;
+}
+//#endregion
+//#region src/proxy-binary.ts
+/**
+* Fetch and run the `seekrit-proxy` binary without a Rust toolchain.
+*
+* The proxy is the strongest answer seekrit has for an untrusted workload — the
+* agent holds `{{seekrit:NAME}}` and never the key — and it was also the hardest
+* thing here to *try*, because trying it meant `cargo` and a TOML file. This
+* module removes the first half: it resolves a prebuilt, checksum-verified
+* binary for the host platform and execs it, so `npx @seekrit/proxy` and
+* `seekrit proxy run` behave like the proxy was already installed.
+*
+* The logic lives in the CLI (and is re-exported as `@seekrit/cli/proxy-launcher`)
+* for the same reason the MCP server does: `@seekrit/proxy` is a thin npx
+* entrypoint over it, and the two must not drift.
+*
+* Three properties worth stating, since this downloads and executes code:
+*
+* - **The checksum is verified before anything is executed**, against a
+*   `.sha256` fetched from the same release. That is integrity, not provenance —
+*   it proves the bytes match what the release published, which is exactly the
+*   guarantee `install.sh` gives and no more.
+* - **Nothing is fetched when a binary is already available.** `SEEKRIT_PROXY_BIN`
+*   short-circuits entirely, and a cached download for the same version+target is
+*   reused, so this is a one-time cost per version.
+* - **Version is pinned, not floating.** A default of `latest` would make two
+*   machines run different proxies from the same command; the pinned constant is
+*   what this CLI was built against, overridable when you want otherwise.
+*/
+/**
+* The proxy version this CLI was built against.
+*
+* Bumped by release-please when `apps/proxy` releases (an `extra-files` entry in
+* release-please-config.json), so the pin follows the crate without anyone
+* remembering to move it.
+*/
+const PROXY_VERSION = "0.10.0";
+const BIN = "seekrit-proxy";
+/**
+* Host → Rust target triple.
+*
+* Linux always resolves to **musl**: that build is statically linked, so one
+* artifact covers glibc, musl, alpine, and distroless, and there is no libc
+* detection to get wrong on a machine where `ldd` says something unexpected.
+*/
+function detectTarget(os = platform(), cpu = arch()) {
+	const machine = cpu === "x64" ? "x86_64" : cpu === "arm64" ? "aarch64" : null;
+	if (!machine) throw new Error(`unsupported architecture "${cpu}" — build from source (apps/proxy) or set SEEKRIT_PROXY_BIN`);
+	switch (os) {
+		case "linux": return {
+			target: `${machine}-unknown-linux-musl`,
+			exe: ""
+		};
+		case "darwin": return {
+			target: `${machine}-apple-darwin`,
+			exe: ""
+		};
+		case "win32":
+			if (machine !== "x86_64") throw new Error(`no prebuilt seekrit-proxy for ${machine} Windows — set SEEKRIT_PROXY_BIN to a binary you built`);
+			return {
+				target: "x86_64-pc-windows-msvc",
+				exe: ".exe"
+			};
+		default: throw new Error(`unsupported platform "${os}" — build from source (apps/proxy) or set SEEKRIT_PROXY_BIN`);
 	}
-	if (hintMode === "forward") envHints.unshift({
-		name: "HTTPS_PROXY",
-		value: `http://${options.forwardListen}`
-	}, {
-		name: "NODE_EXTRA_CA_CERTS",
-		value: `$PWD/${options.caCert}`,
-		note: "or SSL_CERT_FILE / REQUESTS_CA_BUNDLE, depending on the runtime."
-	});
-	if (args.rules.length === 0) notes.push("The published policy has no rules yet, so this proxy permits nothing until one is published.");
-	return {
-		mode: options.mode,
-		listen: options.listen,
-		forwardListen: options.forwardListen,
-		routes,
-		policy: {
-			agent: args.agent,
-			agents: args.agents,
-			refreshInterval: args.refreshInterval,
-			signers: args.signers
-		},
-		unmatched: options.unmatched,
-		caCert: options.caCert,
-		caKey: options.caKey,
-		...options.cacheMaxAge ? { cache: { maxAge: options.cacheMaxAge } } : {},
-		...options.control ? { control: options.control } : {},
-		...options.tasks ? { tasks: options.tasks } : {},
-		...options.activity ? { activity: options.activity } : {},
-		envHints,
-		notes
-	};
 }
-/** Host → preset, for naming routes generated from published policy. */
-const PRESET_BY_HOST = /* @__PURE__ */ new Map();
-for (const id of [
-	"openai",
-	"anthropic",
-	"openrouter",
-	"github"
-]) {
-	const preset = findPreset(id);
-	if (preset?.host) PRESET_BY_HOST.set(preset.host, preset);
+/** `latest` stays `latest`; everything else is normalized to `v<x.y.z>`. */
+function versionPrefix(version) {
+	if (version === "latest") return "latest";
+	return version.startsWith("v") ? version : `v${version}`;
 }
-/** YAML double-quoted scalar. Compose values here are hostnames and URLs. */
-function yamlString(value) {
-	return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
+function resolveVersion(explicit) {
+	return explicit ?? process.env.SEEKRIT_PROXY_VERSION ?? "0.10.0";
+}
+function resolveBaseUrl(explicit) {
+	return (explicit ?? process.env.SEEKRIT_PROXY_BASE_URL ?? "https://proxy.seekrit.dev").replace(/\/+$/, "");
+}
+/** Where a resolved binary is kept, keyed so versions and targets never collide. */
+function proxyBinaryPath(version, target, exe) {
+	return join(defaultCacheDir(), "proxy", versionPrefix(version), target, `${BIN}${exe}`);
+}
+async function fetchBytes(url) {
+	const res = await fetch(url);
+	if (!res.ok) throw new Error(`GET ${url} → ${res.status} ${res.statusText}`);
+	return new Uint8Array(await res.arrayBuffer());
 }
-const COMPOSE_DEFAULTS = {
-	service: "seekrit-proxy",
-	workload: "agent",
-	publish: false
-};
 /**
-* A `docker compose` sidecar snippet for a generated config.
+* Ensure a `seekrit-proxy` binary exists locally and return its path.
 *
-* The container case differs from the local one in exactly the ways that break a
-* copied-from-the-docs compose file: the proxy has to bind `0.0.0.0` to be
-* reachable from a sibling container, the workload dials it by *service name*
-* rather than loopback, and in forward mode the CA has to live on a shared
-* volume or the workload trusts a certificate the proxy no longer has.
+* Order: an explicit `SEEKRIT_PROXY_BIN`, then a cached download for this
+* version+target, then a fresh download. A binary already on `PATH` is
+* deliberately *not* used — silently running a different version than the one
+* this CLI pins is the kind of surprise that costs an afternoon.
 */
-function renderComposeSnippet(plan, options) {
-	const reverse = plan.mode === "reverse" || plan.mode === "both";
-	const forward = plan.mode === "forward" || plan.mode === "both";
-	const [, listenPort = "8080"] = splitHostPort(plan.listen);
-	const [, forwardPort = "8081"] = splitHostPort(plan.forwardListen);
-	const host = options.service;
-	const out = [
-		"# seekrit-proxy sidecar — generated by `seekrit proxy compose`.",
-		"#",
-		"# The proxy holds the decrypted secrets; the workload holds only placeholders.",
-		"# Keeping them in separate containers is what makes that boundary real: the",
-		"# service token is in the proxy's environment, where the workload cannot read it.",
-		"services:",
-		`  ${host}:`,
-		`    image: ${options.image}`
-	];
-	const command = [];
-	if (reverse) command.push("--listen", `0.0.0.0:${listenPort}`);
-	if (command.length > 0) out.push(`    command: [${command.map(yamlString).join(", ")}]`);
-	if (forward) {
-		out.push(`    # Forward mode: set \`[forward] listen = "0.0.0.0:${forwardPort}"\` in the`);
-		out.push("    # config too — there is no flag for the forward plane's address.");
-	}
-	out.push("    environment:");
-	out.push("      # Never inline the token. Compose reads it from your shell or a .env file.");
-	out.push("      SEEKRIT_TOKEN: ${SEEKRIT_TOKEN:?SEEKRIT_TOKEN is required}");
-	out.push("    volumes:");
-	out.push("      - ./seekrit-proxy.toml:/seekrit-proxy.toml:ro");
-	if (forward) {
-		out.push("      # The interception CA must survive restarts, or the certificate the");
-		out.push("      # workload trusts stops matching the one the proxy mints leaves from.");
-		out.push("      - seekrit-proxy-ca:/ca");
-	}
-	if (options.publish) {
-		out.push("    ports:");
-		if (reverse) out.push(`      - ${yamlString(`127.0.0.1:${listenPort}:${listenPort}`)}`);
-		if (forward) out.push(`      - ${yamlString(`127.0.0.1:${forwardPort}:${forwardPort}`)}`);
-	} else {
-		out.push("    # No `ports`: reachable on the compose network only, which is what you");
-		out.push("    # want — nothing outside this project can ask the proxy to inject a key.");
-	}
-	out.push("    restart: unless-stopped");
-	out.push("");
-	out.push(`  ${options.workload}:`);
-	out.push("    # ← your workload. It never holds a real credential.");
-	out.push("    image: your-agent:latest");
-	out.push("    depends_on:");
-	out.push(`      - ${host}`);
-	out.push("    environment:");
-	if (forward) {
-		out.push(`      HTTPS_PROXY: ${yamlString(`http://${host}:${forwardPort}`)}`);
-		out.push(`      HTTP_PROXY: ${yamlString(`http://${host}:${forwardPort}`)}`);
-		out.push("      NODE_EXTRA_CA_CERTS: \"/ca/seekrit-proxy-ca.pem\"");
-		out.push("      # …or SSL_CERT_FILE / REQUESTS_CA_BUNDLE, depending on the runtime.");
+async function resolveProxyBinary(options = {}) {
+	const override = process.env.SEEKRIT_PROXY_BIN;
+	if (override) {
+		if (!existsSync(override)) throw new Error(`SEEKRIT_PROXY_BIN points at ${override}, which does not exist`);
+		return override;
 	}
-	for (const hint of plan.envHints) {
-		if (hint.name === "HTTPS_PROXY" || hint.name === "NODE_EXTRA_CA_CERTS") continue;
-		const value = hint.value.replace(/http:\/\/[^/]+/, `http://${host}:${listenPort}`);
-		out.push(`      ${hint.name}: ${yamlString(value)}`);
+	const version = resolveVersion(options.version);
+	const { target, exe } = detectTarget();
+	const dest = proxyBinaryPath(version, target, exe);
+	if (!options.force && version !== "latest" && existsSync(dest)) return dest;
+	const baseUrl = resolveBaseUrl(options.baseUrl);
+	const prefix = versionPrefix(version);
+	const name = `${BIN}-${target}${exe}`;
+	const binUrl = `${baseUrl}/${prefix}/bin/${name}`;
+	const sumUrl = `${binUrl}.sha256`;
+	if (!options.quiet) process.stderr.write(`seekrit: fetching ${BIN} ${prefix} (${target})…\n`);
+	let bytes;
+	let expected;
+	try {
+		[bytes, expected] = await Promise.all([fetchBytes(binUrl), fetchBytes(sumUrl).then((b) => Buffer.from(b).toString("utf8").trim().split(/\s+/)[0] ?? "")]);
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		throw new Error(`could not download ${BIN} ${prefix} for ${target}: ${message}\n  Set SEEKRIT_PROXY_BIN to a binary you already have, or build it from apps/proxy.`);
 	}
-	out.push("");
-	if (forward) {
-		out.push("volumes:");
-		out.push("  seekrit-proxy-ca:");
-		out.push("");
+	const actual = createHash("sha256").update(bytes).digest("hex");
+	if (!expected || actual !== expected.toLowerCase()) throw new Error(`checksum mismatch for ${name}: expected ${expected || "(none published)"}, got ${actual}. Refusing to run it.`);
+	const dir = dirname(dest);
+	mkdirSync(dir, { recursive: true });
+	const staging = join(dir, `.${BIN}-${process.pid}-${actual.slice(0, 12)}${exe}`);
+	try {
+		writeFileSync(staging, bytes, { mode: 493 });
+		renameSync(staging, dest);
+	} catch (err) {
+		rmSync(staging, { force: true });
+		throw err;
 	}
-	out.push(forward ? "# The workload can unset HTTPS_PROXY, so in a threat model where the workload" : "# The workload can ignore the base URL above, so in a threat model where the");
-	out.push(forward ? "# is the adversary, make the proxy the only route out: put the workload on an" : "# workload is the adversary, make the proxy the only route out: put the workload");
-	out.push(forward ? "# `internal: true` network with the proxy as its only peer." : "# on an `internal: true` network with the proxy as its only peer.");
-	return `${out.join("\n").replace(/\n{3,}/g, "\n\n").trimEnd()}\n`;
+	chmodSync(dest, 493);
+	return dest;
+}
+/**
+* Run the proxy, forwarding stdio, signals, and its exit status.
+*
+* The proxy is a long-lived foreground process, so this wrapper has to be
+* transparent: Node cannot exec-replace itself, and without relaying signals
+* Node's default SIGINT handler would kill *this* process on Ctrl-C and leave
+* the proxy running, holding decrypted secrets, with the shell prompt back.
+*/
+async function runProxyBinary(argv, options = {}) {
+	const bin = await resolveProxyBinary(options);
+	const child = spawn(bin, argv, {
+		stdio: "inherit",
+		env: {
+			...process.env,
+			...options.env
+		}
+	});
+	const signals = [
+		"SIGINT",
+		"SIGTERM",
+		"SIGHUP",
+		"SIGQUIT"
+	];
+	const forward = (signal) => {
+		if (child.exitCode !== null || child.signalCode !== null) return;
+		child.kill(signal);
+	};
+	for (const signal of signals) process.on(signal, forward);
+	return new Promise((resolve, reject) => {
+		child.on("error", (err) => {
+			for (const s of signals) process.off(s, forward);
+			reject(/* @__PURE__ */ new Error(`could not start ${bin}: ${err.message}\n  If this is a fresh download, the platform may not match — set SEEKRIT_PROXY_BIN.`));
+		});
+		child.on("exit", (code, signal) => {
+			for (const s of signals) process.off(s, forward);
+			resolve(signal ? 128 + signalNumber(signal) : code ?? 0);
+		});
+	});
+}
+/** Signal name → number, for the 128+n exit convention. */
+function signalNumber(signal) {
+	return {
+		SIGHUP: 1,
+		SIGINT: 2,
+		SIGQUIT: 3,
+		SIGKILL: 9,
+		SIGTERM: 15
+	}[signal] ?? 0;
 }
 //#endregion
 //#region src/proxy.ts
@@ -13247,6 +13469,7 @@ registerRedisCommands(program);
 registerProvisionerCommands(program);
 registerProxyCommands(program);
 registerAgentCommands(program);
+registerPaperclipCommands(program);
 registerSshCommands(program);
 registerAwsCommands(program);
 registerGcpCommands(program);