@seekrit/cli 1.0.0 → 1.1.0

package/dist/index.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { spawn, spawnSync } from "node:child_process";
-import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { z } from "zod";
 import { Command } from "commander";
 import { arch, homedir, hostname, platform, tmpdir, userInfo } from "node:os";
@@ -8,6 +8,7 @@ import { dirname, join, parse, resolve } from "node:path";
 import { createInterface } from "node:readline";
 import { Writable } from "node:stream";
 import { createHash } from "node:crypto";
+import { fileURLToPath } from "node:url";
 /** Default lifetime of a published bundle (7 days), in seconds. */
 const POLICY_DEFAULT_TTL_SECONDS = 10080 * 60;
 /** Bounds on a bundle's lifetime: an hour at the short end, 90 days at the long. */
@@ -4986,7 +4987,7 @@ async function createAgentTaskToken() {
 }
 //#endregion
 //#region package.json
-var version = "1.0.0";
+var version = "1.1.0";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 var SeekritApiError = class extends Error {
@@ -9584,6 +9585,224 @@ function registerGroupCommands(program) {
 	});
 }
 //#endregion
+//#region src/hermes.ts
+/**
+* `seekrit hermes` — wire seekrit into [Hermes Agent](https://hermes-agent.nousresearch.com)
+* as a **secret source**.
+*
+* Hermes reads credentials from `~/.hermes/.env` and the process environment, and
+* a *secret source* is the documented way to fill that environment from
+* somewhere else at startup. Implementing one is Python, and it lives in the
+* Python SDK (`seekrit.hermes`) rather than here — a `SecretSource` subclass and
+* the `register(ctx)` hook Hermes calls. This command exists for the two parts
+* that are not Python: the `config.yaml` block, and the plugin directory for a
+* Hermes install that cannot see the SDK's entry point.
+*
+* **`config.yaml` is printed, not written.** It is YAML that belongs to
+* somebody's agent, with comments and anchors this CLI carries no parser for;
+* a rewrite through a JSON round trip would delete them. The plugin directory
+* *is* written, because those two files are entirely ours.
+*
+* There are two sources, and which one to use is a real choice rather than a
+* default. `seekrit` is **bulk**: one environment, whole, nothing to enumerate.
+* `seekrit_refs` is **mapped**: explicit `VAR: skt://NAME` bindings, which is
+* what you need to rename a secret, read more than one environment, or win a
+* contested variable — Hermes lets a mapped claim beat a bulk one.
+*/
+/** The two source names `seekrit.hermes` registers. */
+const BULK_SOURCE = "seekrit";
+const MAPPED_SOURCE = "seekrit_refs";
+/** Hermes' home: `$HERMES_HOME`, else `~/.hermes`. */
+function hermesHome(env = process.env) {
+	const home = env.HERMES_HOME?.trim();
+	return home && home.length > 0 ? resolve(home) : join(homedir(), ".hermes");
+}
+const NAME_RE$1 = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/**
+* Build an `skt://` reference.
+*
+* A service token is bound to one environment, so a reference names a *token*
+* (by the alias its `tokens:` map gives it) and a secret in that token's
+* environment — not an arbitrary app and env, which nothing on the read path
+* could resolve.
+*/
+function reference(name, tokenAlias) {
+	return `skt://${tokenAlias ? `${tokenAlias}/` : ""}${name}`;
+}
+/**
+* The `secrets:` block for `~/.hermes/config.yaml`.
+*
+* Hand-rolled rather than serialized, because the shape is fixed and small and
+* the output is meant to be *read* — a generic emitter would quote keys and
+* flow-fold lists in ways that make a config someone has to paste look foreign.
+*/
+function configBlock(options = {}) {
+	const source = options.mapped ? MAPPED_SOURCE : BULK_SOURCE;
+	const lines = [
+		"secrets:",
+		`  sources: [${source}]`,
+		`  ${source}:`,
+		"    enabled: true"
+	];
+	if (options.tokenEnv && options.tokenEnv !== "SEEKRIT_TOKEN") lines.push(`    token_env: ${options.tokenEnv}`);
+	if (options.mapped) {
+		const tokens = Object.entries(options.tokens ?? {});
+		if (tokens.length > 0) {
+			lines.push("    tokens:");
+			for (const [alias, variable] of tokens) lines.push(`      ${alias}: ${variable}`);
+		}
+		lines.push("    env:");
+		const bindings = options.bindings ?? [];
+		if (bindings.length === 0) lines.push(`      OPENAI_API_KEY: ${reference("OPENAI_API_KEY")}`);
+		else for (const b of bindings) lines.push(`      ${b.variable}: ${reference(b.name, b.tokenAlias)}`);
+	}
+	return `${lines.join("\n")}\n`;
+}
+/** `plugin.yaml` for the directory-install path. */
+function pluginYaml() {
+	return [
+		"name: seekrit",
+		"description: >-",
+		"  Resolve Hermes provider credentials from seekrit — end-to-end encrypted",
+		"  secrets, decrypted in this process by your own service token.",
+		""
+	].join("\n");
+}
+/**
+* `__init__.py` for the directory-install path.
+*
+* Re-exporting `register` is the whole file: the implementation lives in the
+* published SDK, so a plugin scaffolded once keeps up with SDK releases instead
+* of pinning a copy of the resolver into somebody's home directory.
+*/
+function pluginInit() {
+	return [
+		"\"\"\"seekrit secret sources for Hermes Agent.",
+		"",
+		"Hermes calls `register(ctx)` from this module. The implementation lives in",
+		"the `seekrit` package (`pip install seekrit`), so this file stays a re-export",
+		"and never has to be regenerated.",
+		"\"\"\"",
+		"",
+		"from seekrit.hermes import register  # noqa: F401",
+		""
+	].join("\n");
+}
+/**
+* Parse a `VAR=NAME` or `VAR=alias/NAME` binding for `--bind`.
+*
+* The left side is the environment variable Hermes will set; the right side is
+* the seekrit secret it comes from. They differ often enough — that is most of
+* why the mapped source exists — that inferring one from the other would be
+* wrong more than it was convenient.
+*/
+function parseBinding(raw) {
+	const eq = raw.indexOf("=");
+	if (eq <= 0) return void 0;
+	const variable = raw.slice(0, eq).trim();
+	const target = raw.slice(eq + 1).trim();
+	if (!NAME_RE$1.test(variable) || target.length === 0) return void 0;
+	const slash = target.indexOf("/");
+	if (slash === -1) return NAME_RE$1.test(target) ? {
+		variable,
+		name: target
+	} : void 0;
+	const tokenAlias = target.slice(0, slash).trim();
+	const name = target.slice(slash + 1).trim();
+	if (tokenAlias.length === 0 || !NAME_RE$1.test(name)) return void 0;
+	return {
+		variable,
+		name,
+		tokenAlias
+	};
+}
+/** Parse a `--token alias=VAR` pair. */
+function parseTokenAlias(raw) {
+	const eq = raw.indexOf("=");
+	if (eq <= 0) return void 0;
+	const alias = raw.slice(0, eq).trim();
+	const variable = raw.slice(eq + 1).trim();
+	if (alias.length === 0 || !NAME_RE$1.test(variable)) return void 0;
+	return {
+		alias,
+		variable
+	};
+}
+function registerHermesCommands(program) {
+	const hermes = program.command("hermes").description("wire seekrit into a Hermes Agent as a secret source (`seekrit hermes --help`)");
+	hermes.command("init").description("print the Hermes config that resolves credentials from seekrit").option("--mapped", `use the ${MAPPED_SOURCE} source (explicit VAR -> secret bindings)`).option("--token-env <var>", "variable holding the service token", "SEEKRIT_TOKEN").option("--bind <VAR=NAME...>", "a mapped binding, e.g. OPENAI_API_KEY=OPENAI_KEY").option("--token <alias=VAR...>", "name a second token, e.g. billing=SEEKRIT_TOKEN_BILLING").option("--plugin-dir", "also scaffold $HERMES_HOME/plugins/seekrit (for a pip-less install)").option("--home <path>", "Hermes home (default: $HERMES_HOME or ~/.hermes)").option("--json", "machine-readable output").action((options) => {
+		const bindings = (options.bind ?? []).map((raw) => {
+			const parsed = parseBinding(raw);
+			if (!parsed) fail(`--bind must be VAR=NAME or VAR=alias/NAME (got "${raw}")`);
+			return parsed;
+		});
+		const tokens = {};
+		for (const raw of options.token ?? []) {
+			const parsed = parseTokenAlias(raw);
+			if (!parsed) fail(`--token must be alias=VARIABLE (got "${raw}")`);
+			tokens[parsed.alias] = parsed.variable;
+		}
+		for (const binding of bindings) if (binding.tokenAlias && !tokens[binding.tokenAlias]) fail(`--bind ${binding.variable} names token alias "${binding.tokenAlias}", so pass --token ${binding.tokenAlias}=<VARIABLE> too`);
+		if (!options.mapped && (bindings.length > 0 || Object.keys(tokens).length > 0)) fail("--bind and --token describe the mapped source: pass --mapped as well");
+		const source = options.mapped ? MAPPED_SOURCE : BULK_SOURCE;
+		const block = configBlock({
+			mapped: options.mapped,
+			tokenEnv: options.tokenEnv,
+			bindings,
+			tokens
+		});
+		const home = options.home ? resolve(options.home) : hermesHome();
+		const pluginDir = join(home, "plugins", "seekrit");
+		const written = [];
+		if (options.pluginDir) {
+			mkdirSync(pluginDir, { recursive: true });
+			const files = [["plugin.yaml", pluginYaml()], ["__init__.py", pluginInit()]];
+			for (const [name, contents] of files) {
+				const path = join(pluginDir, name);
+				writeFileSync(path, contents);
+				written.push(path);
+			}
+		}
+		emit(options, {
+			source,
+			configPath: join(home, "config.yaml"),
+			block,
+			written
+		}, () => {
+			section("hermes secret source");
+			printFields([
+				["source", source],
+				["shape", options.mapped ? "mapped (explicit bindings)" : "bulk (whole environment)"],
+				["config", join(home, "config.yaml")],
+				["plugin dir", options.pluginDir ? pluginDir : "not scaffolded"]
+			]);
+			console.log();
+			console.log("1. Install the SDK into the environment Hermes runs in:");
+			console.log("     pip install seekrit");
+			console.log();
+			console.log("2. Put the service token in ~/.hermes/.env (not config.yaml):");
+			console.log(`     ${options.tokenEnv ?? "SEEKRIT_TOKEN"}=skt_...`);
+			console.log();
+			console.log("3. Enable the plugin and merge this into ~/.hermes/config.yaml:");
+			console.log("     hermes plugins enable seekrit");
+			console.log();
+			console.log(block.trimEnd());
+			console.log();
+			if (written.length > 0) {
+				console.log("Scaffolded:");
+				for (const path of written) console.log(`  ${path}`);
+				console.log();
+			}
+			console.log("The source overrides values already in .env or your shell, so a rotation wins — list a variable under `preserve_existing` when a local override is the point.");
+		});
+	});
+	hermes.command("ref <name>").description("print the skt:// reference to bind a Hermes variable to").option("--token-alias <alias>", "resolve through a second token named in `tokens:`").option("--json", "machine-readable output").action((name, options) => {
+		if (!NAME_RE$1.test(name)) fail(`not a valid secret name: "${name}" (names are [A-Za-z_][A-Za-z0-9_]*)`);
+		const ref = reference(name, options.tokenAlias);
+		emit(options, { reference: ref }, () => console.log(ref));
+	});
+}
+//#endregion
 //#region src/honey.ts
 /**
 * Honey tokens — decoy credentials that unlock nothing and alert when used.
@@ -10036,61 +10255,650 @@ function registerMysqlCommands(program) {
 			const cfg = t.config;
 			console.log(`${t.id}\t${t.name}\t${cfg.connection.host}:${cfg.connection.port}/${cfg.connection.database}\t${cfg.accessLevel ?? "custom"}\t${cfg.executor}`);
 		}
-	});
-	target.command("rm <targetId>").description("remove a provisioning target").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation").action(async (targetId, options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		await confirmDestructive(options.yes, `Remove target ${targetId}? New leases against it stop working.`);
-		await ctx.client.deleteLeaseTarget(org.id, targetId);
-		console.error(`removed ${targetId}`);
-	});
-	mysql.command("lease <target>").description("mint a temporary credential; prints a ready-to-use connection URL").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--user <name>", "user name to create (default: a random tmp_ name)").option("--ttl <duration>", "lifetime, e.g. 30m, 1h, 7d", "1h").option("--json", "print the full connection as JSON").action(async (targetRef, options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const { targets } = await ctx.client.listLeaseTargets(org.id);
-		const target = targets.find((t) => t.id === targetRef || t.name === targetRef);
-		if (!target) fail(`no target "${targetRef}" in ${org.slug}`);
-		if (target.provider !== "mysql") fail(`target "${targetRef}" is not a MySQL target`);
-		const userName = options.user ?? generateUserName$1();
-		const ttlSeconds = parseTtlSeconds$3(options.ttl);
-		const { password, verifier } = await generateMysqlCredential();
-		const { connection } = await ctx.client.mintLease(org.id, {
-			provider: "mysql",
-			targetId: target.id,
-			roleName: userName,
-			verifier,
-			ttlSeconds
+	});
+	target.command("rm <targetId>").description("remove a provisioning target").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation").action(async (targetId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		await confirmDestructive(options.yes, `Remove target ${targetId}? New leases against it stop working.`);
+		await ctx.client.deleteLeaseTarget(org.id, targetId);
+		console.error(`removed ${targetId}`);
+	});
+	mysql.command("lease <target>").description("mint a temporary credential; prints a ready-to-use connection URL").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--user <name>", "user name to create (default: a random tmp_ name)").option("--ttl <duration>", "lifetime, e.g. 30m, 1h, 7d", "1h").option("--json", "print the full connection as JSON").action(async (targetRef, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { targets } = await ctx.client.listLeaseTargets(org.id);
+		const target = targets.find((t) => t.id === targetRef || t.name === targetRef);
+		if (!target) fail(`no target "${targetRef}" in ${org.slug}`);
+		if (target.provider !== "mysql") fail(`target "${targetRef}" is not a MySQL target`);
+		const userName = options.user ?? generateUserName$1();
+		const ttlSeconds = parseTtlSeconds$3(options.ttl);
+		const { password, verifier } = await generateMysqlCredential();
+		const { connection } = await ctx.client.mintLease(org.id, {
+			provider: "mysql",
+			targetId: target.id,
+			roleName: userName,
+			verifier,
+			ttlSeconds
+		});
+		const url = `mysql://${userName}:${encodeURIComponent(password)}@${connection.host}:${connection.port}/${connection.database}`;
+		console.error(`leased ${userName} on ${connection.host}/${connection.database} — expires ${connection.expiresAt}`);
+		if (options.json) console.log(JSON.stringify({
+			...connection,
+			password,
+			url
+		}, null, 2));
+		else console.log(url);
+	});
+	mysql.command("leases").description("list leases (the ledger — never secret material)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { leases } = await ctx.client.listLeases(org.id);
+		for (const l of leases) {
+			if (l.provider !== "mysql") continue;
+			console.log(`${l.id}\t${l.status}\t${l.resourceRef}\texpires ${l.expiresAt}`);
+		}
+	});
+	mysql.command("revoke <leaseId>").description("revoke a lease now (drops the user immediately)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation").action(async (leaseId, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		await confirmDestructive(options.yes, `Revoke lease ${leaseId} now? Its MySQL user is dropped immediately.`);
+		await ctx.client.revokeLease(org.id, leaseId);
+		console.error(`revoked ${leaseId}`);
+	});
+}
+/** Collect a repeatable option into an array. */
+function collect$3(value, acc) {
+	acc.push(value);
+	return acc;
+}
+/**
+* Fetch + decrypt every secret in a single environment.
+*
+* `${OTHER_SECRET}` references are expanded (see `@seekrit/core`'s
+* `interpolate`) unless `raw` is set. Only this environment's own secrets are in
+* scope here — a reference to a secret inherited from a composed group is left
+* literal, because the group layers aren't fetched. `materializeEnv` is the
+* fully-layered view.
+*/
+async function fetchDecryptedSecrets(ctx, orgId, envId, opts = {}) {
+	const [dek, { secrets }] = await Promise.all([getDek(ctx, orgId, envId), ctx.client.listSecrets(orgId, envId)]);
+	const entries = await Promise.all(secrets.map(async (secret) => [secret.name, await decryptSecret(dek, secret.ciphertext, secretAad(envId, secret.name))]));
+	return interpolateValues(Object.fromEntries(entries), !opts.raw).values;
+}
+/**
+* Expand `${OTHER_SECRET}` references in a merged variable set. A cycle becomes
+* the CLI's standard fatal exit — it is a config bug with no correct value to
+* emit. Pass `enabled: false` (`--no-interpolate`) to hand the set back as-is.
+*/
+function interpolateValues(values, enabled = true) {
+	if (!enabled) return {
+		values,
+		interpolated: [],
+		unresolvedRefs: []
+	};
+	try {
+		const { values: expandedValues, expanded, unresolved } = interpolateSecrets(values);
+		return {
+			values: expandedValues,
+			interpolated: expanded,
+			unresolvedRefs: unresolved
+		};
+	} catch (err) {
+		return fail(err instanceof Error ? err.message : String(err));
+	}
+}
+/**
+* Decrypt one historical version of a secret. Ciphertext is bound to
+* `(envId, name)` as AAD and neither changes across versions, so an old blob
+* opens with the environment's current data key — no special handling needed.
+*/
+async function fetchDecryptedVersion(ctx, orgId, envId, name, version) {
+	const [dek, { versions }] = await Promise.all([getDek(ctx, orgId, envId), ctx.client.listSecretVersions(orgId, envId, name, { limit: 200 })]);
+	const row = versions.find((v) => v.version === version);
+	if (!row) fail(`${name} has no version ${version} in its ${versions.length} newest versions`);
+	return decryptSecret(dek, row.ciphertext, secretAad(envId, name));
+}
+async function encryptAndSetSecret(ctx, orgId, envId, name, value) {
+	const ciphertext = await encryptSecret(await getDek(ctx, orgId, envId), value, secretAad(envId, name));
+	await ctx.client.setSecret(orgId, envId, name, ciphertext);
+}
+/**
+* Encrypt and store many secrets into one environment. The DEK is fetched once
+* (so user auth prompts for the passphrase a single time, not per variable),
+* then each value is encrypted locally and written. Existing names are
+* overwritten; the result splits them into created vs. updated for a summary.
+* Callers validate the names first — a rejected name aborts before any write.
+*/
+async function importSecrets(ctx, orgId, envId, entries) {
+	const [dek, { secrets }] = await Promise.all([getDek(ctx, orgId, envId), ctx.client.listSecrets(orgId, envId)]);
+	const existing = new Set(secrets.map((s) => s.name));
+	const result = {
+		created: [],
+		updated: []
+	};
+	for (const [name, value] of Object.entries(entries)) {
+		const ciphertext = await encryptSecret(dek, value, secretAad(envId, name));
+		await ctx.client.setSecret(orgId, envId, name, ciphertext);
+		(existing.has(name) ? result.updated : result.created).push(name);
+	}
+	return result;
+}
+/**
+* Resolve the full, layered environment for a running app: composed group
+* secrets (lowest precedence) → the app env's own secrets → `.env` files.
+* Each layer's DEK is unwrapped once with the principal's private key and its
+* ciphertext decrypted locally. `process.env` is NOT applied here — callers
+* that spawn a process layer it on top so the live shell always wins.
+*
+* `${OTHER_SECRET}` references are expanded last, against the merged set, so a
+* reference always resolves to whichever layer won the name.
+*/
+async function materializeEnv(ctx, opts) {
+	const query = {};
+	if (opts.with && Object.keys(opts.with).length > 0) query.with = opts.with;
+	if (opts.branch) query.branch = opts.branch;
+	if (!isTokenAuth(ctx)) {
+		if (!opts.envId) fail("specify --app and --env, or authenticate with a service token (SEEKRIT_TOKEN)");
+		query.env = opts.envId;
+	}
+	const { scope, layers } = await resolveWithCache(ctx, query, opts.cache);
+	const privateKey = await getPrivateKey(ctx);
+	const values = {};
+	const provenance = {};
+	for (const layer of layers) {
+		const dek = await unwrapDek(layer.wrappedDek, privateKey);
+		let label;
+		if (layer.source === "group") label = `group:${layer.groupSlug}@${layer.slug}`;
+		else if (layer.source === "branch") label = `branch:${scope.appSlug}#${layer.slug}`;
+		else label = `app:${scope.appSlug}/${layer.slug}`;
+		for (const secret of layer.secrets) {
+			values[secret.name] = await decryptSecret(dek, secret.ciphertext, secretAad(layer.environmentId, secret.name));
+			provenance[secret.name] = label;
+		}
+	}
+	const loadedEnvFiles = overlayEnvFiles(values, provenance, opts.envFiles);
+	return {
+		...interpolateValues(values, opts.interpolate !== false),
+		provenance,
+		scope,
+		loadedEnvFiles
+	};
+}
+/**
+* Resolve, going through the last-known-good cache when one is configured.
+*
+* Always live first: the cache exists for when the call cannot land, not to
+* save a round trip, so a recovered network is picked up on the very next
+* invocation. A *refused* resolve (401/403/…) drops the entry rather than
+* falling back to it — otherwise revoking a token would keep working offline
+* until the entry aged out.
+*/
+async function resolveWithCache(ctx, query, cache) {
+	if (!cache) return ctx.client.resolve(query);
+	try {
+		const response = await ctx.client.resolve(query);
+		try {
+			cache.write(JSON.stringify(response));
+		} catch (err) {
+			warn(`could not update the cache: ${errorMessage(err)}`);
+		}
+		return response;
+	} catch (err) {
+		if (!mayFallBack(err)) {
+			cache.invalidate();
+			throw err;
+		}
+		const found = cache.read();
+		if (found.kind === "hit") {
+			warn(`${errorMessage(err)} — using cached secrets fetched ${humanize(found.ageMs)} ago`);
+			return JSON.parse(found.body);
+		}
+		if (found.kind === "expired") warn(`cached secrets are ${humanize(found.ageMs)} old, past --cache-max-age`);
+		else if (found.kind === "unusable") warn(`ignoring the cached secrets: ${found.reason}`);
+		throw err;
+	}
+}
+function warn(text) {
+	process.stderr.write(`seekrit: ${text}\n`);
+}
+function errorMessage(err) {
+	return err instanceof Error ? err.message : String(err);
+}
+/**
+* Overlay `.env` files onto an existing value/provenance set (later files win).
+* Missing files are skipped. Returns the files that were actually loaded. Used
+* both by {@link materializeEnv} and by `seekrit run`'s degraded path, where
+* managed secrets are unavailable but `.env` should still apply.
+*/
+function overlayEnvFiles(values, provenance, envFiles) {
+	const loaded = [];
+	for (const file of envFiles) {
+		if (!existsSync(file)) continue;
+		loaded.push(file);
+		for (const [name, value] of Object.entries(parseDotenv(readFileSync(file, "utf8")))) {
+			values[name] = value;
+			provenance[name] = `dotenv:${file}`;
+		}
+	}
+	return loaded;
+}
+/**
+* Print a name → source table to stderr (never the secret values). Names whose
+* value had references expanded are marked, and dangling references are called
+* out afterwards — a typo'd `${NAME}` is otherwise invisible, since it is
+* deliberately passed through as literal text.
+*/
+function printExplain(provenance, refs = {}) {
+	const interpolated = new Set(refs.interpolated ?? []);
+	const names = Object.keys(provenance).sort();
+	const width = names.reduce((w, n) => Math.max(w, n.length), 0);
+	for (const name of names) {
+		const marker = interpolated.has(name) ? "  (interpolated)" : "";
+		process.stderr.write(`${name.padEnd(width)}  ${provenance[name]}${marker}\n`);
+	}
+	if (refs.unresolved?.length) process.stderr.write(`\nunresolved reference(s), left as literal text: ${refs.unresolved.join(", ")}\n`);
+}
+/** Plugin id and integration id declared by `@seekrit/openclaw-plugin`. */
+const PLUGIN_ID = "seekrit";
+const PLUGIN_INTEGRATION_ID = "seekrit";
+/** The provider alias written into `secrets.providers`. */
+const PROVIDER_ALIAS = "seekrit";
+/**
+* Environment the resolver needs, and nothing else.
+*
+* OpenClaw hands an exec provider an empty environment apart from this
+* allowlist, which is a feature: it is the difference between "the resolver can
+* read the credential it needs" and "the resolver inherits the whole gateway
+* environment". `PATH` is here because Node's own startup needs it, `HOME` for
+* the CLI's login session, and the `SEEKRIT_*` set is how a machine credential
+* reaches a process nobody gets to pass flags to.
+*/
+const PASS_ENV = [
+	"PATH",
+	"HOME",
+	"USERPROFILE",
+	"APPDATA",
+	"LOCALAPPDATA",
+	"TEMP",
+	"TMP",
+	"SYSTEMROOT",
+	"WINDIR",
+	"XDG_CONFIG_HOME",
+	"XDG_CACHE_HOME",
+	"NODE_EXTRA_CA_CERTS",
+	"SEEKRIT_TOKEN",
+	"SEEKRIT_CLIENT_ID",
+	"SEEKRIT_CLIENT_SECRET",
+	"SEEKRIT_API_URL",
+	"SEEKRIT_ORG",
+	"SEEKRIT_APP",
+	"SEEKRIT_ENV",
+	"SEEKRIT_BRANCH"
+];
+/**
+* Generous, because the first resolve of a cold start does real work — an M2M
+* token mint, a resolve, and a key unwrap — and OpenClaw fails startup rather
+* than degrading when this expires. The 1Password integration picks 90s for the
+* same reason (its CLI may prompt for biometrics); 30s is enough here because
+* nothing in this path is interactive.
+*/
+const TIMEOUT_MS = 3e4;
+/** A seekrit secret name: what `seekrit secrets set` accepts. */
+const NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/** Slugs as the API spells them. */
+const SLUG_RE = /^[a-z0-9][a-z0-9-]*$/;
+/**
+* Parse an exec SecretRef id.
+*
+* Two shapes, mirroring 1Password's `op://vault/item/field` — a bare name for
+* the environment the credential already points at, and an explicit
+* `app/env/NAME` triple for a provider serving more than one environment:
+*
+*     OPENAI_API_KEY
+*     billing-api/production/STRIPE_SECRET_KEY
+*
+* A bare name is the common case and the one a service token wants, since the
+* token is already bound to an environment and there is nothing to disambiguate.
+*/
+function parseSecretId(id) {
+	const trimmed = id.trim();
+	if (trimmed.length === 0) return void 0;
+	const parts = trimmed.split("/");
+	if (parts.length === 1) {
+		const [name = ""] = parts;
+		return NAME_RE.test(name) ? { name } : void 0;
+	}
+	if (parts.length !== 3) return void 0;
+	const [app = "", env = "", name = ""] = parts;
+	if (!SLUG_RE.test(app) || !SLUG_RE.test(env) || !NAME_RE.test(name)) return void 0;
+	return {
+		app,
+		env,
+		name
+	};
+}
+/** The (app, env) pair an id resolves against — `""` for the credential's own. */
+function scopeKey(id) {
+	return id.app && id.env ? `${id.app}/${id.env}` : "";
+}
+/**
+* Parse a request, tolerantly in exactly one direction.
+*
+* Non-string and empty ids are dropped rather than rejected — a request whose
+* shape we do not recognize should still resolve the ids we do, because the
+* alternative fails OpenClaw's whole startup over one malformed entry. A body
+* that is not an object with an `ids` array is a different matter: there is
+* nothing to answer, so it throws.
+*/
+function parseExecRequest(input) {
+	const parsed = JSON.parse(input);
+	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("exec SecretRef request must be a JSON object");
+	const ids = parsed.ids;
+	if (!Array.isArray(ids)) throw new Error("exec SecretRef request must carry an `ids` array");
+	return { ids: ids.filter((id) => typeof id === "string" && id.trim().length > 0) };
+}
+/** Assemble a response, omitting `errors` entirely when everything resolved. */
+function buildExecResponse(values, errors) {
+	return {
+		protocolVersion: 1,
+		values,
+		...Object.keys(errors).length > 0 ? { errors } : {}
+	};
+}
+/**
+* Resolve every requested id, reading each distinct environment exactly once.
+*
+* A batch is normally one environment, but a provider may serve several, and
+* resolving per id would mean an unwrap per id. Grouping keeps a 40-variable
+* gateway to one round trip.
+*
+* `resolveScope` is injected so the protocol can be tested without a network,
+* an API, or a key.
+*/
+async function resolveIds(ids, resolveScope) {
+	const values = {};
+	const errors = {};
+	const byScope = /* @__PURE__ */ new Map();
+	for (const id of ids) {
+		const parsed = parseSecretId(id);
+		if (!parsed) {
+			errors[id] = { code: "INVALID_ID" };
+			continue;
+		}
+		const key = scopeKey(parsed);
+		const bucket = byScope.get(key) ?? {
+			scope: parsed,
+			ids: []
+		};
+		bucket.ids.push({
+			id,
+			name: parsed.name
+		});
+		byScope.set(key, bucket);
+	}
+	for (const { scope, ids: wanted } of byScope.values()) {
+		let resolved;
+		try {
+			resolved = await resolveScope(scope);
+		} catch (err) {
+			const code = classify(err);
+			for (const { id } of wanted) errors[id] = { code };
+			continue;
+		}
+		for (const { id, name } of wanted) {
+			const value = resolved[name];
+			if (value === void 0) errors[id] = { code: "NOT_FOUND" };
+			else values[id] = value;
+		}
+	}
+	return buildExecResponse(values, errors);
+}
+/**
+* Bucket a failure into a code an operator can act on.
+*
+* Deliberately coarse and deliberately message-free: it reads the error's own
+* text to pick a bucket and then throws that text away, because the text may
+* quote a token.
+*/
+function classify(err) {
+	const message = err instanceof Error ? err.message.toLowerCase() : String(err).toLowerCase();
+	if (/unauthor|forbidden|token|credential|passphrase|decrypt|sign in|log in|login/.test(message)) return "UNAUTHORIZED";
+	return "UNAVAILABLE";
+}
+/** OpenClaw's config directory: `$OPENCLAW_HOME`, else `~/.openclaw`. */
+function openclawHome(env = process.env) {
+	const home = env.OPENCLAW_HOME?.trim();
+	return home && home.length > 0 ? resolve(home) : join(homedir(), ".openclaw");
+}
+/**
+* The provider block for an installed `@seekrit/openclaw-plugin`.
+*
+* Preferred over the exec shape below for one reason that matters on upgrade:
+* OpenClaw reads the command out of the plugin's manifest at every startup, so
+* a plugin release that moves its resolver keeps working. A copied command is a
+* path pinned in someone's config forever.
+*/
+function pluginProvider() {
+	return {
+		source: "exec",
+		pluginIntegration: {
+			pluginId: PLUGIN_ID,
+			integrationId: PLUGIN_INTEGRATION_ID
+		}
+	};
+}
+/**
+* The provider block for a plain CLI install, with no plugin.
+*
+* `realpathSync` on both paths is not tidiness. OpenClaw's guard rejects a
+* symlinked command outright, and a Node installed by a version manager is
+* almost always reached through one — so resolving here is the difference
+* between a provider that works and a startup failure whose message points at
+* the config rather than at the shim.
+*/
+function execProvider(cliEntry, nodeBinary = process.execPath) {
+	const command = realTo(nodeBinary);
+	const entry = realTo(cliEntry);
+	return {
+		source: "exec",
+		command,
+		args: [
+			entry,
+			"openclaw",
+			"resolve"
+		],
+		passEnv: [...PASS_ENV],
+		jsonOnly: true,
+		timeoutMs: TIMEOUT_MS,
+		noOutputTimeoutMs: TIMEOUT_MS,
+		trustedDirs: [.../* @__PURE__ */ new Set([dirname(command), dirname(entry)])]
+	};
+}
+function realTo(path) {
+	try {
+		return realpathSync(path);
+	} catch {
+		return resolve(path);
+	}
+}
+/** This CLI's own entry file — what `execProvider` hands to Node. */
+function cliEntryPath() {
+	return fileURLToPath(new URL("index.js", import.meta.url));
+}
+/**
+* Add the seekrit provider to a parsed config without disturbing anything else.
+*
+* An existing `seekrit` entry that differs is left alone unless forced, for the
+* same reason `seekrit paperclip init` leaves an existing MCP server alone:
+* someone who pinned a timeout or narrowed `passEnv` did it deliberately, and
+* silently reverting a security narrowing is the worst kind of helpful.
+*/
+function mergeProvider(existing, provider, force) {
+	const secrets = { ...existing.secrets ?? {} };
+	const providers = { ...secrets.providers ?? {} };
+	const current = providers[PROVIDER_ALIAS];
+	if (current && !force && JSON.stringify(current) !== JSON.stringify(provider)) return {
+		merged: existing,
+		changed: false
+	};
+	if (current && JSON.stringify(current) === JSON.stringify(provider)) return {
+		merged: existing,
+		changed: false
+	};
+	providers[PROVIDER_ALIAS] = provider;
+	return {
+		merged: {
+			...existing,
+			secrets: {
+				...secrets,
+				providers
+			}
+		},
+		changed: true
+	};
+}
+/** A SecretRef pointing at this provider — what replaces a plaintext key. */
+function secretRef(id) {
+	return {
+		source: "exec",
+		provider: PROVIDER_ALIAS,
+		id
+	};
+}
+/**
+* Read `openclaw.json`, or decline to.
+*
+* The file is JSON5: comments and trailing commas are legal, and a parse/write
+* round trip through `JSON` would delete every comment in someone's gateway
+* config. So a file that is not also valid strict JSON is not edited at all —
+* the caller prints the block to paste instead. Losing a config's comments to
+* be helpful is worse than asking for one paste.
+*/
+function readOpenclawConfig(path) {
+	if (!existsSync(path)) return { config: {} };
+	let raw;
+	try {
+		raw = readFileSync(path, "utf8");
+	} catch (err) {
+		fail(`could not read ${path}: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	if (raw.trim().length === 0) return { config: {} };
+	try {
+		const parsed = JSON.parse(raw);
+		if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return { json5: true };
+		return { config: parsed };
+	} catch {
+		return { json5: true };
+	}
+}
+function registerOpenclawCommands(program) {
+	const openclaw = program.command("openclaw").description("wire seekrit into OpenClaw as a SecretRef provider (`seekrit openclaw --help`)");
+	openclaw.command("init").description("add the seekrit exec SecretRef provider to openclaw.json").option("--config <path>", "path to openclaw.json (default: $OPENCLAW_HOME/openclaw.json)").option("--plugin", "point at an installed @seekrit/openclaw-plugin (recommended)").option("--exec", "point directly at this CLI, with no plugin installed").option("--write", "write the file instead of printing the block to paste").option("--force", "replace a seekrit provider entry that already differs").option("--json", "machine-readable output").action((options) => {
+		if (options.plugin && options.exec) fail("--plugin and --exec are mutually exclusive");
+		const usePlugin = options.exec !== true;
+		let provider;
+		if (usePlugin) provider = pluginProvider();
+		else {
+			const entry = cliEntryPath();
+			if (!existsSync(entry)) fail(`cannot find this CLI's entry file at ${entry} — --exec needs an installed seekrit (npm i -g @seekrit/cli), or use --plugin`);
+			provider = execProvider(entry);
+		}
+		const path = options.config ? resolve(options.config) : join(openclawHome(), "openclaw.json");
+		const read = readOpenclawConfig(path);
+		const json5 = "json5" in read;
+		const merged = json5 ? void 0 : mergeProvider(read.config, provider, options.force === true);
+		const wrote = Boolean(options.write) && merged?.changed === true;
+		if (wrote && merged) writeFileSync(path, `${JSON.stringify(merged.merged, null, 2)}\n`, { mode: 384 });
+		emit(options, {
+			path,
+			provider,
+			wrote,
+			json5
+		}, () => {
+			section("openclaw secret provider");
+			printFields([
+				["config", path],
+				["provider", PROVIDER_ALIAS],
+				["shape", usePlugin ? "plugin integration" : "exec (this CLI)"],
+				["written", wrote ? "yes" : "no"]
+			]);
+			console.log();
+			if (json5) {
+				console.log(`${path} is JSON5 (comments or trailing commas), which a rewrite here would delete.`);
+				console.log("Merge this into it by hand:");
+			} else if (!options.write) console.log("Merge this into your config, or re-run with --write:");
+			else if (!wrote) console.log(`A different \`${PROVIDER_ALIAS}\` provider is already configured — left as it is. Re-run with --force to replace it.`);
+			else console.log("Written. The block now in your config:");
+			console.log();
+			console.log(JSON.stringify({ secrets: { providers: { [PROVIDER_ALIAS]: provider } } }, null, 2));
+			console.log();
+			if (usePlugin) {
+				console.log("Install the plugin, if you have not already:");
+				console.log("  openclaw plugins install npm:@seekrit/openclaw-plugin");
+				console.log("  openclaw plugins enable seekrit");
+				console.log();
+			}
+			console.log("Then replace a plaintext credential with a ref, e.g.:");
+			console.log(`  ${JSON.stringify(secretRef("OPENAI_API_KEY"))}`);
+			console.log();
+			console.log("And check your work:");
+			console.log("  openclaw secrets audit --check --allow-exec");
+			console.log();
+			console.log("Resolution is eager: OpenClaw reads every ref once at startup. After a rotation, run `openclaw secrets reload`.");
 		});
-		const url = `mysql://${userName}:${encodeURIComponent(password)}@${connection.host}:${connection.port}/${connection.database}`;
-		console.error(`leased ${userName} on ${connection.host}/${connection.database} — expires ${connection.expiresAt}`);
-		if (options.json) console.log(JSON.stringify({
-			...connection,
-			password,
-			url
-		}, null, 2));
-		else console.log(url);
 	});
-	mysql.command("leases").description("list leases (the ledger — never secret material)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const { leases } = await ctx.client.listLeases(org.id);
-		for (const l of leases) {
-			if (l.provider !== "mysql") continue;
-			console.log(`${l.id}\t${l.status}\t${l.resourceRef}\texpires ${l.expiresAt}`);
-		}
+	openclaw.command("ref <name>").description("print the SecretRef object to paste in place of a plaintext credential").option("--app <slug>", "address a specific application (with --env)").option("--env <slug>", "address a specific environment (with --app)").option("--json", "machine-readable output").action((name, options) => {
+		if (Boolean(options.app) !== Boolean(options.env)) fail("--app and --env go together (an id names both, or neither)");
+		const id = options.app && options.env ? `${options.app}/${options.env}/${name}` : name;
+		if (!parseSecretId(id)) fail(`not a valid SecretRef id: "${id}" (names are [A-Za-z_][A-Za-z0-9_]*)`);
+		const ref = secretRef(id);
+		emit(options, ref, () => console.log(JSON.stringify(ref)));
 	});
-	mysql.command("revoke <leaseId>").description("revoke a lease now (drops the user immediately)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("-y, --yes", "skip the confirmation").action(async (leaseId, options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		await confirmDestructive(options.yes, `Revoke lease ${leaseId} now? Its MySQL user is dropped immediately.`);
-		await ctx.client.revokeLease(org.id, leaseId);
-		console.error(`revoked ${leaseId}`);
+	openclaw.command("resolve").description("resolve exec SecretRef ids from stdin (OpenClaw calls this; not for humans)").action(async () => {
+		setFailThrows(true);
+		let request;
+		try {
+			request = parseExecRequest(await readStdin());
+		} catch (err) {
+			process.stderr.write(`seekrit: ${err instanceof Error ? err.message : String(err)}\n`);
+			process.exitCode = 2;
+			return;
+		}
+		const scopes = /* @__PURE__ */ new Map();
+		let ctx;
+		const response = await resolveIds(request.ids, (scope) => {
+			const key = scopeKey(scope);
+			const cached = scopes.get(key);
+			if (cached) return cached;
+			ctx ??= buildContext();
+			const pending = resolveEnvironment(ctx, scope);
+			scopes.set(key, pending);
+			return pending;
+		});
+		process.stdout.write(`${JSON.stringify(response)}\n`);
 	});
 }
-/** Collect a repeatable option into an array. */
-function collect$3(value, acc) {
-	acc.push(value);
-	return acc;
+/**
+* Resolve one environment's full variable set.
+*
+* `.env` overlays are deliberately switched off (`envFiles: []`). Everywhere
+* else in this CLI they are a convenience for a developer's shell; here the
+* working directory belongs to the OpenClaw gateway, and letting a file in it
+* override a gateway credential would make a stray `.env` a privilege
+* escalation. Reference expansion stays on — a `${OTHER_SECRET}` reference is
+* stored data, not a local override.
+*/
+async function resolveEnvironment(ctx, scope) {
+	let envId;
+	if (!isTokenAuth(ctx)) envId = (await resolveAppEnv(ctx, {
+		app: scope.app,
+		env: scope.env
+	})).envId;
+	const { values } = await materializeEnv(ctx, {
+		envId,
+		envFiles: []
+	});
+	return values;
 }
 //#endregion
 //#region src/orgs.ts
@@ -11968,193 +12776,6 @@ function registerRotationCommands(program) {
 		console.error(`disabled rotation of ${r.secretName}${rotatorRevoked ? " — rotator key access revoked for this environment" : ""}`);
 	});
 }
-/**
-* Fetch + decrypt every secret in a single environment.
-*
-* `${OTHER_SECRET}` references are expanded (see `@seekrit/core`'s
-* `interpolate`) unless `raw` is set. Only this environment's own secrets are in
-* scope here — a reference to a secret inherited from a composed group is left
-* literal, because the group layers aren't fetched. `materializeEnv` is the
-* fully-layered view.
-*/
-async function fetchDecryptedSecrets(ctx, orgId, envId, opts = {}) {
-	const [dek, { secrets }] = await Promise.all([getDek(ctx, orgId, envId), ctx.client.listSecrets(orgId, envId)]);
-	const entries = await Promise.all(secrets.map(async (secret) => [secret.name, await decryptSecret(dek, secret.ciphertext, secretAad(envId, secret.name))]));
-	return interpolateValues(Object.fromEntries(entries), !opts.raw).values;
-}
-/**
-* Expand `${OTHER_SECRET}` references in a merged variable set. A cycle becomes
-* the CLI's standard fatal exit — it is a config bug with no correct value to
-* emit. Pass `enabled: false` (`--no-interpolate`) to hand the set back as-is.
-*/
-function interpolateValues(values, enabled = true) {
-	if (!enabled) return {
-		values,
-		interpolated: [],
-		unresolvedRefs: []
-	};
-	try {
-		const { values: expandedValues, expanded, unresolved } = interpolateSecrets(values);
-		return {
-			values: expandedValues,
-			interpolated: expanded,
-			unresolvedRefs: unresolved
-		};
-	} catch (err) {
-		return fail(err instanceof Error ? err.message : String(err));
-	}
-}
-/**
-* Decrypt one historical version of a secret. Ciphertext is bound to
-* `(envId, name)` as AAD and neither changes across versions, so an old blob
-* opens with the environment's current data key — no special handling needed.
-*/
-async function fetchDecryptedVersion(ctx, orgId, envId, name, version) {
-	const [dek, { versions }] = await Promise.all([getDek(ctx, orgId, envId), ctx.client.listSecretVersions(orgId, envId, name, { limit: 200 })]);
-	const row = versions.find((v) => v.version === version);
-	if (!row) fail(`${name} has no version ${version} in its ${versions.length} newest versions`);
-	return decryptSecret(dek, row.ciphertext, secretAad(envId, name));
-}
-async function encryptAndSetSecret(ctx, orgId, envId, name, value) {
-	const ciphertext = await encryptSecret(await getDek(ctx, orgId, envId), value, secretAad(envId, name));
-	await ctx.client.setSecret(orgId, envId, name, ciphertext);
-}
-/**
-* Encrypt and store many secrets into one environment. The DEK is fetched once
-* (so user auth prompts for the passphrase a single time, not per variable),
-* then each value is encrypted locally and written. Existing names are
-* overwritten; the result splits them into created vs. updated for a summary.
-* Callers validate the names first — a rejected name aborts before any write.
-*/
-async function importSecrets(ctx, orgId, envId, entries) {
-	const [dek, { secrets }] = await Promise.all([getDek(ctx, orgId, envId), ctx.client.listSecrets(orgId, envId)]);
-	const existing = new Set(secrets.map((s) => s.name));
-	const result = {
-		created: [],
-		updated: []
-	};
-	for (const [name, value] of Object.entries(entries)) {
-		const ciphertext = await encryptSecret(dek, value, secretAad(envId, name));
-		await ctx.client.setSecret(orgId, envId, name, ciphertext);
-		(existing.has(name) ? result.updated : result.created).push(name);
-	}
-	return result;
-}
-/**
-* Resolve the full, layered environment for a running app: composed group
-* secrets (lowest precedence) → the app env's own secrets → `.env` files.
-* Each layer's DEK is unwrapped once with the principal's private key and its
-* ciphertext decrypted locally. `process.env` is NOT applied here — callers
-* that spawn a process layer it on top so the live shell always wins.
-*
-* `${OTHER_SECRET}` references are expanded last, against the merged set, so a
-* reference always resolves to whichever layer won the name.
-*/
-async function materializeEnv(ctx, opts) {
-	const query = {};
-	if (opts.with && Object.keys(opts.with).length > 0) query.with = opts.with;
-	if (opts.branch) query.branch = opts.branch;
-	if (!isTokenAuth(ctx)) {
-		if (!opts.envId) fail("specify --app and --env, or authenticate with a service token (SEEKRIT_TOKEN)");
-		query.env = opts.envId;
-	}
-	const { scope, layers } = await resolveWithCache(ctx, query, opts.cache);
-	const privateKey = await getPrivateKey(ctx);
-	const values = {};
-	const provenance = {};
-	for (const layer of layers) {
-		const dek = await unwrapDek(layer.wrappedDek, privateKey);
-		let label;
-		if (layer.source === "group") label = `group:${layer.groupSlug}@${layer.slug}`;
-		else if (layer.source === "branch") label = `branch:${scope.appSlug}#${layer.slug}`;
-		else label = `app:${scope.appSlug}/${layer.slug}`;
-		for (const secret of layer.secrets) {
-			values[secret.name] = await decryptSecret(dek, secret.ciphertext, secretAad(layer.environmentId, secret.name));
-			provenance[secret.name] = label;
-		}
-	}
-	const loadedEnvFiles = overlayEnvFiles(values, provenance, opts.envFiles);
-	return {
-		...interpolateValues(values, opts.interpolate !== false),
-		provenance,
-		scope,
-		loadedEnvFiles
-	};
-}
-/**
-* Resolve, going through the last-known-good cache when one is configured.
-*
-* Always live first: the cache exists for when the call cannot land, not to
-* save a round trip, so a recovered network is picked up on the very next
-* invocation. A *refused* resolve (401/403/…) drops the entry rather than
-* falling back to it — otherwise revoking a token would keep working offline
-* until the entry aged out.
-*/
-async function resolveWithCache(ctx, query, cache) {
-	if (!cache) return ctx.client.resolve(query);
-	try {
-		const response = await ctx.client.resolve(query);
-		try {
-			cache.write(JSON.stringify(response));
-		} catch (err) {
-			warn(`could not update the cache: ${errorMessage(err)}`);
-		}
-		return response;
-	} catch (err) {
-		if (!mayFallBack(err)) {
-			cache.invalidate();
-			throw err;
-		}
-		const found = cache.read();
-		if (found.kind === "hit") {
-			warn(`${errorMessage(err)} — using cached secrets fetched ${humanize(found.ageMs)} ago`);
-			return JSON.parse(found.body);
-		}
-		if (found.kind === "expired") warn(`cached secrets are ${humanize(found.ageMs)} old, past --cache-max-age`);
-		else if (found.kind === "unusable") warn(`ignoring the cached secrets: ${found.reason}`);
-		throw err;
-	}
-}
-function warn(text) {
-	process.stderr.write(`seekrit: ${text}\n`);
-}
-function errorMessage(err) {
-	return err instanceof Error ? err.message : String(err);
-}
-/**
-* Overlay `.env` files onto an existing value/provenance set (later files win).
-* Missing files are skipped. Returns the files that were actually loaded. Used
-* both by {@link materializeEnv} and by `seekrit run`'s degraded path, where
-* managed secrets are unavailable but `.env` should still apply.
-*/
-function overlayEnvFiles(values, provenance, envFiles) {
-	const loaded = [];
-	for (const file of envFiles) {
-		if (!existsSync(file)) continue;
-		loaded.push(file);
-		for (const [name, value] of Object.entries(parseDotenv(readFileSync(file, "utf8")))) {
-			values[name] = value;
-			provenance[name] = `dotenv:${file}`;
-		}
-	}
-	return loaded;
-}
-/**
-* Print a name → source table to stderr (never the secret values). Names whose
-* value had references expanded are marked, and dangling references are called
-* out afterwards — a typo'd `${NAME}` is otherwise invisible, since it is
-* deliberately passed through as literal text.
-*/
-function printExplain(provenance, refs = {}) {
-	const interpolated = new Set(refs.interpolated ?? []);
-	const names = Object.keys(provenance).sort();
-	const width = names.reduce((w, n) => Math.max(w, n.length), 0);
-	for (const name of names) {
-		const marker = interpolated.has(name) ? "  (interpolated)" : "";
-		process.stderr.write(`${name.padEnd(width)}  ${provenance[name]}${marker}\n`);
-	}
-	if (refs.unresolved?.length) process.stderr.write(`\nunresolved reference(s), left as literal text: ${refs.unresolved.join(", ")}\n`);
-}
 //#endregion
 //#region src/ssh.ts
 /**
@@ -13689,6 +14310,8 @@ registerProvisionerCommands(program);
 registerProxyCommands(program);
 registerAgentCommands(program);
 registerPaperclipCommands(program);
+registerOpenclawCommands(program);
+registerHermesCommands(program);
 registerSshCommands(program);
 registerAwsCommands(program);
 registerGcpCommands(program);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/cli",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
   "type": "module",
   "publishConfig": {
@@ -10,7 +10,9 @@
     "seekrit": "./dist/index.js"
   },
   "exports": {
+    "./cli-entry": "./dist/index.js",
     "./mcp": "./src/mcp.ts",
+    "./openclaw": "./src/openclaw.ts",
     "./proxy-launcher": "./src/proxy-binary.ts"
   },
   "files": [
@@ -29,8 +31,8 @@
     "tsdown": "^0.22.3",
     "vitest": "^4.1.9",
     "@seekrit/api-client": "0.0.1",
-    "@seekrit/core": "0.0.1",
-    "@seekrit/crypto": "0.0.1"
+    "@seekrit/crypto": "0.0.1",
+    "@seekrit/core": "0.0.1"
   },
   "scripts": {
     "build": "tsdown",