@seekrit/cli 1.5.0 → 1.6.1

package/dist/index.js

@@ -5053,7 +5053,7 @@ async function createAgentTaskToken() {
 }
 //#endregion
 //#region package.json
-var version = "1.5.0";
+var version = "1.6.1";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 var SeekritApiError = class extends Error {
@@ -7524,7 +7524,7 @@ function registerEnvDiff(env) {
 //#endregion
 //#region src/kms.ts
 /** Collect a repeatable option into a list. */
-function collect$7(value, acc = []) {
+function collect$8(value, acc = []) {
 	acc.push(value);
 	return acc;
 }
@@ -7592,7 +7592,7 @@ async function kmsRecoverMaterial(ctx, orgId, keyId, version) {
 }
 function registerKmsCommands(program) {
 	const kms = program.command("kms").description("managed keys for application-layer encryption & signing (client-side)");
-	kms.command("create").description("create a managed key (material is generated locally and wrapped, never sent)").requiredOption("--name <name>", "org-unique key name").requiredOption("--purpose <purpose>", "encrypt | sign").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--app <slug>", "scope the key to an application").option("--group <slug>", "scope the key to a group").option("--grant-user <email>", "also grant an org member (repeatable)", collect$7, []).option("--grant-token <tokenId>", "also grant a service token (repeatable)", collect$7, []).action(async (options) => {
+	kms.command("create").description("create a managed key (material is generated locally and wrapped, never sent)").requiredOption("--name <name>", "org-unique key name").requiredOption("--purpose <purpose>", "encrypt | sign").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--app <slug>", "scope the key to an application").option("--group <slug>", "scope the key to a group").option("--grant-user <email>", "also grant an org member (repeatable)", collect$8, []).option("--grant-token <tokenId>", "also grant a service token (repeatable)", collect$8, []).action(async (options) => {
 		if (options.purpose !== "encrypt" && options.purpose !== "sign") fail("--purpose must be encrypt or sign");
 		if (options.app && options.group) fail("pass at most one of --app or --group");
 		const ctx = buildContext();
@@ -7814,7 +7814,7 @@ function registerKmsCommands(program) {
 //#endregion
 //#region src/recovery.ts
 /** Collect a repeatable option into a list. */
-function collect$6(value, acc = []) {
+function collect$7(value, acc = []) {
 	acc.push(value);
 	return acc;
 }
@@ -7911,7 +7911,7 @@ function registerRecoveryCommands(program) {
 		for (const cst of status.custodians) console.log(`  - ${cst.label ?? cst.principalId} (${cst.principalType}, share #${cst.shareIndex})`);
 		if (status.coverage.unprotectedEnvIds.length > 0) console.log(`${status.coverage.unprotectedEnvIds.length} environment(s) not yet protected — run \`seekrit recovery sync\``);
 	});
-	recovery.command("setup").description("enable recovery: split a fresh recovery key across custodians").requiredOption("--threshold <M>", "custodians required to recover (M in M-of-N)").option("--custodian <email|skt_id>", "a recovery custodian (repeatable)", collect$6, []).option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
+	recovery.command("setup").description("enable recovery: split a fresh recovery key across custodians").requiredOption("--threshold <M>", "custodians required to recover (M in M-of-N)").option("--custodian <email|skt_id>", "a recovery custodian (repeatable)", collect$7, []).option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const config = await buildRecoveryConfig(ctx, org.id, options.threshold, options.custodian);
@@ -7929,7 +7929,7 @@ function registerRecoveryCommands(program) {
 		const { wrapped, skipped } = await syncRecoveryGrants(ctx, (await resolveOrg(ctx, options.org)).id);
 		console.error(`recovery-protected ${wrapped} environment(s); skipped ${skipped} you cannot decrypt`);
 	});
-	recovery.command("rotate").description("rotate the recovery key (new keypair, custodians, and env re-wraps)").requiredOption("--threshold <M>", "custodians required to recover (M in M-of-N)").option("--custodian <email|skt_id>", "a recovery custodian (repeatable)", collect$6, []).option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
+	recovery.command("rotate").description("rotate the recovery key (new keypair, custodians, and env re-wraps)").requiredOption("--threshold <M>", "custodians required to recover (M in M-of-N)").option("--custodian <email|skt_id>", "a recovery custodian (repeatable)", collect$7, []).option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const config = await buildRecoveryConfig(ctx, org.id, options.threshold, options.custodian);
@@ -9070,7 +9070,7 @@ function formatSecrets(values, format) {
 * `buildContext()` in any of them silently breaks the promise the feature makes.
 */
 /** Collect a repeatable option into a list. */
-function collect$5(value, acc = []) {
+function collect$6(value, acc = []) {
 	acc.push(value);
 	return acc;
 }
@@ -9343,7 +9343,7 @@ function registerArchiveCommands(program) {
 		} catch {}
 		fail("none of the recovery shares in this archive unwrap with that key");
 	});
-	archive.command("decrypt <file>").description("decrypt an archive's secrets with your own key (offline)").option("-o, --out <dir>", "write one file per environment into this directory").option("--stdout", "print plaintext to stdout instead of writing files").option("--env <label>", "only this environment (app/env, group@env, slug, or id)").option("--format <format>", "dotenv | json | shell", "dotenv").option("--token <skt_…>", "decrypt as a service token instead of a passphrase").option("--key-file <path>", "decrypt with a private key JWK file").option("--share <file>", "custodian share for an offline quorum (repeatable)", collect$5).option("-y, --yes", "skip the confirmation when printing plaintext to stdout").action(async (file, options) => {
+	archive.command("decrypt <file>").description("decrypt an archive's secrets with your own key (offline)").option("-o, --out <dir>", "write one file per environment into this directory").option("--stdout", "print plaintext to stdout instead of writing files").option("--env <label>", "only this environment (app/env, group@env, slug, or id)").option("--format <format>", "dotenv | json | shell", "dotenv").option("--token <skt_…>", "decrypt as a service token instead of a passphrase").option("--key-file <path>", "decrypt with a private key JWK file").option("--share <file>", "custodian share for an offline quorum (repeatable)", collect$6).option("-y, --yes", "skip the confirmation when printing plaintext to stdout").action(async (file, options) => {
 		if (!options.out && !options.stdout) fail("choose a destination: --out <dir> to write files, or --stdout to print plaintext");
 		if (![
 			"dotenv",
@@ -11263,7 +11263,7 @@ function parseTtlSeconds$4(input) {
 	}[m[2] || "s"] ?? 1);
 }
 /** Collect a repeatable option into an array. */
-function collect$4(value, previous) {
+function collect$5(value, previous) {
 	return [...previous, value];
 }
 /** Parse `readWrite@app` → { role, db } for a custom target. */
@@ -11288,7 +11288,7 @@ function resolveAdminUri(uri) {
 function registerMongoCommands(program) {
 	const mongo = program.command("mongodb").description("temporary MongoDB credentials (createUser, zero-knowledge delivery)");
 	const target = mongo.command("target").description("manage MongoDB targets");
-	target.command("add").description("register a MongoDB cluster to issue temporary credentials from").requiredOption("--name <name>", "display name, e.g. prod-app").requiredOption("--database <db>", "the database leased users get access to, e.g. app").option("--uri <uri>", "admin connection string (else SEEKRIT_MONGODB_ADMIN_URL)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--role <role@db>", "grant for a custom target (repeatable)", collect$4, []).option("--auth-source <db>", "authentication database (default admin)").option("--max-ttl <duration>", "clamp requested credential lifetime, e.g. 8h").option("--no-tls", "disable TLS to the cluster (TLS is on by default)").action(async (options) => {
+	target.command("add").description("register a MongoDB cluster to issue temporary credentials from").requiredOption("--name <name>", "display name, e.g. prod-app").requiredOption("--database <db>", "the database leased users get access to, e.g. app").option("--uri <uri>", "admin connection string (else SEEKRIT_MONGODB_ADMIN_URL)").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--role <role@db>", "grant for a custom target (repeatable)", collect$5, []).option("--auth-source <db>", "authentication database (default admin)").option("--max-ttl <duration>", "clamp requested credential lifetime, e.g. 8h").option("--no-tls", "disable TLS to the cluster (TLS is on by default)").action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const adminUri = resolveAdminUri(options.uri);
@@ -11450,7 +11450,7 @@ function generateUserName$1(prefix = "tmp") {
 function registerMysqlCommands(program) {
 	const mysql = program.command("mysql").description("temporary MySQL/MariaDB credentials (short-lived, zero-knowledge)");
 	const target = mysql.command("target").description("manage provisioning targets");
-	target.command("add").description("register a MySQL/MariaDB server to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-db").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").requiredOption("--host <host>", "database host").option("--port <port>", "database port", "3306").requiredOption("--database <name>", "database to grant access to").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--user-host <host>", "host part of created accounts ('name'@'<host>')", "%").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--hmac-key <base64>", "shared HMAC key for the remote executor (or set SEEKRIT_PROVISIONER_HMAC_KEY); `seekrit provisioner keygen` mints one").option("--admin-url <url>", "in_do: admin mysql:// connection string (or set SEEKRIT_MYSQL_ADMIN_URL); wrapped locally").option("--create-statement <sql>", "custom CREATE template (repeatable)", collect$3, []).option("--revoke-statement <sql>", "custom REVOKE template (repeatable)", collect$3, []).action(async (options) => {
+	target.command("add").description("register a MySQL/MariaDB server to lease credentials from").requiredOption("--name <name>", "display name, e.g. prod-db").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").requiredOption("--host <host>", "database host").option("--port <port>", "database port", "3306").requiredOption("--database <name>", "database to grant access to").option("--access <level>", "readonly | readwrite | custom", "readonly").option("--user-host <host>", "host part of created accounts ('name'@'<host>')", "%").option("--executor <mode>", "in_do | remote", "in_do").option("--provisioner-url <url>", "customer provisioner URL (remote executor)").option("--hmac-key <base64>", "shared HMAC key for the remote executor (or set SEEKRIT_PROVISIONER_HMAC_KEY); `seekrit provisioner keygen` mints one").option("--admin-url <url>", "in_do: admin mysql:// connection string (or set SEEKRIT_MYSQL_ADMIN_URL); wrapped locally").option("--create-statement <sql>", "custom CREATE template (repeatable)", collect$4, []).option("--revoke-statement <sql>", "custom REVOKE template (repeatable)", collect$4, []).action(async (options) => {
 		const ctx = buildContext();
 		const org = await resolveOrg(ctx, options.org);
 		const executor = options.executor === "remote" ? "remote" : "in_do";
@@ -11553,11 +11553,577 @@ function registerMysqlCommands(program) {
 	});
 }
 /** Collect a repeatable option into an array. */
-function collect$3(value, acc) {
+function collect$4(value, acc) {
 	acc.push(value);
 	return acc;
 }
 //#endregion
+//#region src/proxy-binary.ts
+/**
+* Fetch and run the `seekrit-proxy` binary without a Rust toolchain.
+*
+* The proxy is the strongest answer seekrit has for an untrusted workload — the
+* agent holds `{{seekrit:NAME}}` and never the key — and it was also the hardest
+* thing here to *try*, because trying it meant `cargo` and a TOML file. This
+* module removes the first half: it resolves a prebuilt, checksum-verified
+* binary for the host platform and execs it, so `npx @seekrit/proxy` and
+* `seekrit proxy run` behave like the proxy was already installed.
+*
+* The logic lives in the CLI (and is re-exported as `@seekrit/cli/proxy-launcher`)
+* for the same reason the MCP server does: `@seekrit/proxy` is a thin npx
+* entrypoint over it, and the two must not drift.
+*
+* Three properties worth stating, since this downloads and executes code:
+*
+* - **The checksum is verified before anything is executed**, against a
+*   `.sha256` fetched from the same release. That is integrity, not provenance —
+*   it proves the bytes match what the release published, which is exactly the
+*   guarantee `install.sh` gives and no more.
+* - **Nothing is fetched when a binary is already available.** `SEEKRIT_PROXY_BIN`
+*   short-circuits entirely, and a cached download for the same version+target is
+*   reused, so this is a one-time cost per version.
+* - **Version is pinned, not floating.** A default of `latest` would make two
+*   machines run different proxies from the same command; the pinned constant is
+*   what this CLI was built against, overridable when you want otherwise.
+*/
+/**
+* The proxy version this CLI was built against.
+*
+* Bumped by release-please when `apps/proxy` releases (an `extra-files` entry in
+* release-please-config.json), so the pin follows the crate without anyone
+* remembering to move it.
+*/
+const PROXY_VERSION = "0.12.1";
+const BIN = "seekrit-proxy";
+/**
+* Host → Rust target triple.
+*
+* Linux always resolves to **musl**: that build is statically linked, so one
+* artifact covers glibc, musl, alpine, and distroless, and there is no libc
+* detection to get wrong on a machine where `ldd` says something unexpected.
+*/
+function detectTarget(os = platform(), cpu = arch()) {
+	const machine = cpu === "x64" ? "x86_64" : cpu === "arm64" ? "aarch64" : null;
+	if (!machine) throw new Error(`unsupported architecture "${cpu}" — build from source (apps/proxy) or set SEEKRIT_PROXY_BIN`);
+	switch (os) {
+		case "linux": return {
+			target: `${machine}-unknown-linux-musl`,
+			exe: ""
+		};
+		case "darwin": return {
+			target: `${machine}-apple-darwin`,
+			exe: ""
+		};
+		case "win32":
+			if (machine !== "x86_64") throw new Error(`no prebuilt seekrit-proxy for ${machine} Windows — set SEEKRIT_PROXY_BIN to a binary you built`);
+			return {
+				target: "x86_64-pc-windows-msvc",
+				exe: ".exe"
+			};
+		default: throw new Error(`unsupported platform "${os}" — build from source (apps/proxy) or set SEEKRIT_PROXY_BIN`);
+	}
+}
+/** `latest` stays `latest`; everything else is normalized to `v<x.y.z>`. */
+function versionPrefix(version) {
+	if (version === "latest") return "latest";
+	return version.startsWith("v") ? version : `v${version}`;
+}
+function resolveVersion(explicit) {
+	return explicit ?? process.env.SEEKRIT_PROXY_VERSION ?? "0.12.1";
+}
+function resolveBaseUrl(explicit) {
+	return (explicit ?? process.env.SEEKRIT_PROXY_BASE_URL ?? "https://proxy.seekrit.dev").replace(/\/+$/, "");
+}
+/** Where a resolved binary is kept, keyed so versions and targets never collide. */
+function proxyBinaryPath(version, target, exe) {
+	return join(defaultCacheDir(), "proxy", versionPrefix(version), target, `${BIN}${exe}`);
+}
+async function fetchBytes$1(url) {
+	const res = await fetch(url);
+	if (!res.ok) throw new Error(`GET ${url} → ${res.status} ${res.statusText}`);
+	return new Uint8Array(await res.arrayBuffer());
+}
+/**
+* Ensure a `seekrit-proxy` binary exists locally and return its path.
+*
+* Order: an explicit `SEEKRIT_PROXY_BIN`, then a cached download for this
+* version+target, then a fresh download. A binary already on `PATH` is
+* deliberately *not* used — silently running a different version than the one
+* this CLI pins is the kind of surprise that costs an afternoon.
+*/
+async function resolveProxyBinary(options = {}) {
+	const override = process.env.SEEKRIT_PROXY_BIN;
+	if (override) {
+		if (!existsSync(override)) throw new Error(`SEEKRIT_PROXY_BIN points at ${override}, which does not exist`);
+		return override;
+	}
+	const version = resolveVersion(options.version);
+	const { target, exe } = detectTarget();
+	const dest = proxyBinaryPath(version, target, exe);
+	if (!options.force && version !== "latest" && existsSync(dest)) return dest;
+	const baseUrl = resolveBaseUrl(options.baseUrl);
+	const prefix = versionPrefix(version);
+	const name = `${BIN}-${target}${exe}`;
+	const binUrl = `${baseUrl}/${prefix}/bin/${name}`;
+	const sumUrl = `${binUrl}.sha256`;
+	if (!options.quiet) process.stderr.write(`seekrit: fetching ${BIN} ${prefix} (${target})…\n`);
+	let bytes;
+	let expected;
+	try {
+		[bytes, expected] = await Promise.all([fetchBytes$1(binUrl), fetchBytes$1(sumUrl).then((b) => Buffer.from(b).toString("utf8").trim().split(/\s+/)[0] ?? "")]);
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		throw new Error(`could not download ${BIN} ${prefix} for ${target}: ${message}\n  Set SEEKRIT_PROXY_BIN to a binary you already have, or build it from apps/proxy.`);
+	}
+	const actual = createHash("sha256").update(bytes).digest("hex");
+	if (!expected || actual !== expected.toLowerCase()) throw new Error(`checksum mismatch for ${name}: expected ${expected || "(none published)"}, got ${actual}. Refusing to run it.`);
+	const dir = dirname(dest);
+	mkdirSync(dir, { recursive: true });
+	const staging = join(dir, `.${BIN}-${process.pid}-${actual.slice(0, 12)}${exe}`);
+	try {
+		writeFileSync(staging, bytes, { mode: 493 });
+		renameSync(staging, dest);
+	} catch (err) {
+		rmSync(staging, { force: true });
+		throw err;
+	}
+	chmodSync(dest, 493);
+	return dest;
+}
+/**
+* Run the proxy, forwarding stdio, signals, and its exit status.
+*
+* The proxy is a long-lived foreground process, so this wrapper has to be
+* transparent: Node cannot exec-replace itself, and without relaying signals
+* Node's default SIGINT handler would kill *this* process on Ctrl-C and leave
+* the proxy running, holding decrypted secrets, with the shell prompt back.
+*/
+async function runProxyBinary(argv, options = {}) {
+	const bin = await resolveProxyBinary(options);
+	const child = spawn(bin, argv, {
+		stdio: "inherit",
+		env: {
+			...process.env,
+			...options.env
+		}
+	});
+	const signals = [
+		"SIGINT",
+		"SIGTERM",
+		"SIGHUP",
+		"SIGQUIT"
+	];
+	const forward = (signal) => {
+		if (child.exitCode !== null || child.signalCode !== null) return;
+		child.kill(signal);
+	};
+	for (const signal of signals) process.on(signal, forward);
+	return new Promise((resolve, reject) => {
+		child.on("error", (err) => {
+			for (const s of signals) process.off(s, forward);
+			reject(/* @__PURE__ */ new Error(`could not start ${bin}: ${err.message}\n  If this is a fresh download, the platform may not match — set SEEKRIT_PROXY_BIN.`));
+		});
+		child.on("exit", (code, signal) => {
+			for (const s of signals) process.off(s, forward);
+			resolve(signal ? 128 + signalNumber(signal) : code ?? 0);
+		});
+	});
+}
+/** Signal name → number, for the 128+n exit convention. */
+function signalNumber(signal) {
+	return {
+		SIGHUP: 1,
+		SIGINT: 2,
+		SIGQUIT: 3,
+		SIGKILL: 9,
+		SIGTERM: 15
+	}[signal] ?? 0;
+}
+//#endregion
+//#region src/nomad.ts
+/**
+* `seekrit nomad` — wire seekrit into [HashiCorp Nomad](https://developer.hashicorp.com/nomad)
+* as a **secret provider plugin**.
+*
+* Nomad 1.11 grew a `secret` block in the job specification plus an external
+* plugin framework: drop an executable in `client.common_plugin_dir/secrets/`,
+* answer `fingerprint` and `fetch` with JSON on stdout, and jobs name
+* credentials instead of holding them. Two built-in providers ship (Nomad
+* Variables and Vault); everything else is a community binary.
+*
+* The plugin itself is Rust (`apps/nomad-plugin`), not this CLI, because it runs
+* as the Nomad agent's user on every client node — bare Linux hosts where
+* requiring a Node runtime would be a real adoption tax. This command covers the
+* three things around it that are not the protocol: putting the binary in the
+* right place, printing the configuration, and proving the install works.
+*
+* Three facts about Nomad shaped this file, and **all three fail silently**:
+*
+* **The `provider` value is the executable's filename.** Nomad looks for an
+* executable named exactly what the job's `provider` says. So the binary is
+* installed as `secrets/seekrit`, not as its artifact name — get it wrong and
+* the plugin is not registered, with no error and no log line pointing here.
+*
+* **Plugins are fingerprinted once, at client startup.** Installing a plugin
+* into a running agent does nothing until it restarts. So every path here says
+* so, rather than letting someone conclude the plugin is broken.
+*
+* **`common_plugin_dir` is opt-in.** An agent with no `common_plugin_dir` set
+* scans nothing. `init` prints the stanza because the most likely reason a
+* correct install does not work is that the agent was never told where to look.
+*/
+/**
+* The name a job's `secret` block puts in `provider`, **and** the filename the
+* binary must have on disk. Nomad ties the two together; they are one constant
+* here so they cannot drift.
+*/
+const PROVIDER_NAME = "seekrit";
+/** The artifact's own name — what the release publishes and install.sh fetches. */
+const PLUGIN_BIN = "seekrit-nomad-secrets";
+/**
+* The plugin version this CLI installs by default.
+*
+* Bumped by release-please when `apps/nomad-plugin` releases (an `extra-files`
+* entry in release-please-config.json), so the pin follows the crate without
+* anyone remembering to move it — the same arrangement `PROXY_VERSION` has.
+*/
+const NOMAD_PLUGIN_VERSION = "0.2.0";
+/** Public artifact host. Mirrors GitHub Releases; public, no egress fees. */
+const DEFAULT_BASE_URL = "https://nomad.seekrit.dev";
+/** Where the plugin reads its node config, matching `config::DEFAULT_CONFIG_PATH`. */
+const DEFAULT_CONFIG_PATH = "/etc/seekrit/nomad.json";
+/**
+* Plugin directories to look in when `--plugin-dir` is not given.
+*
+* Deliberately a short list of conventional paths rather than a guess: an agent
+* can put `common_plugin_dir` anywhere, and installing into the wrong directory
+* produces a plugin that does not exist as far as Nomad is concerned.
+*/
+const PLUGIN_DIR_CANDIDATES = ["/opt/nomad/plugins", "/var/lib/nomad/plugins"];
+/** The first candidate that exists, or undefined — never a blind default. */
+function detectPluginDir(candidates = PLUGIN_DIR_CANDIDATES) {
+	return candidates.find((dir) => existsSync(dir));
+}
+/** Where the executable has to end up for `provider = "seekrit"` to find it. */
+function pluginPath(pluginDir) {
+	return join(pluginDir, "secrets", PROVIDER_NAME);
+}
+/** The agent stanza that makes Nomad scan for plugins at all. */
+function agentStanza(pluginDir) {
+	return [
+		"client {",
+		"  enabled           = true",
+		`  common_plugin_dir = ${JSON.stringify(pluginDir)}`,
+		"}"
+	].join("\n");
+}
+/** The node-side config file: which credential, and who may use it. */
+function pluginConfig(opts) {
+	const profile = { token_file: opts.tokenFile };
+	if (opts.namespaces?.length) profile.namespaces = opts.namespaces;
+	if (opts.jobs?.length) profile.jobs = opts.jobs;
+	return `${JSON.stringify({ profiles: { [opts.profile]: profile } }, null, 2)}\n`;
+}
+/**
+* A job snippet.
+*
+* `path` is the profile name, because the first segment of a path is always a
+* profile — never a secret name. seekrit names and slugs overlap (`api_key` is
+* a legal spelling of both), so a single-segment path that could mean either
+* would resolve differently depending on what a node happened to have
+* configured, which is the worst possible failure mode for an access decision.
+*/
+function jobSnippet(profile, names) {
+	const vars = names.length > 0 ? names : ["DATABASE_URL", "STRIPE_SECRET_KEY"];
+	const width = Math.max(...vars.map((n) => n.length));
+	const INTERP = "${secret.seekrit.";
+	const env = vars.map((n) => `        ${n.padEnd(width)} = "${INTERP}${n}}"`).join("\n");
+	return [
+		"job \"example\" {",
+		"  secret \"seekrit\" {",
+		`    provider = ${JSON.stringify(PROVIDER_NAME)}`,
+		`    path     = ${JSON.stringify(profile)}`,
+		"  }",
+		"",
+		"  group \"app\" {",
+		"    task \"server\" {",
+		"      driver = \"docker\"",
+		"      env {",
+		env,
+		"      }",
+		"    }",
+		"  }",
+		"}"
+	].join("\n");
+}
+async function fetchBytes(url) {
+	const res = await fetch(url);
+	if (!res.ok) throw new Error(`GET ${url} → ${res.status} ${res.statusText}`);
+	return new Uint8Array(await res.arrayBuffer());
+}
+/**
+* Download, verify, and place the plugin.
+*
+* Same integrity story as the proxy launcher: the SHA-256 is checked against a
+* `.sha256` published beside the binary *before* anything is written to the
+* plugin directory. That proves the bytes match what the release published —
+* integrity, not provenance.
+*
+* The staging file lives in the destination directory rather than `TMPDIR` so
+* the rename is atomic: a cross-device rename degrades to a copy, which would
+* let Nomad fingerprint a half-written executable.
+*/
+async function installPlugin(pluginDir, options = {}) {
+	const version = options.version ?? "0.2.0";
+	const baseUrl = (options.baseUrl ?? "https://nomad.seekrit.dev").replace(/\/+$/, "");
+	const { target, exe } = detectTarget();
+	if (exe !== "") fail("Nomad secret provider plugins are not supported on Windows clients");
+	const prefix = versionPrefix(version);
+	const name = `${PLUGIN_BIN}-${target}`;
+	const binUrl = `${baseUrl}/${prefix}/bin/${name}`;
+	if (!options.quiet) process.stderr.write(`seekrit: fetching ${PLUGIN_BIN} ${prefix} (${target})…\n`);
+	let bytes;
+	let expected;
+	try {
+		[bytes, expected] = await Promise.all([fetchBytes(binUrl), fetchBytes(`${binUrl}.sha256`).then((b) => Buffer.from(b).toString("utf8").trim().split(/\s+/)[0] ?? "")]);
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		fail(`could not download ${PLUGIN_BIN} ${prefix} for ${target}: ${message}\n  Build it from apps/nomad-plugin, or use https://nomad.seekrit.dev/install.sh`);
+	}
+	const actual = createHash("sha256").update(bytes).digest("hex");
+	if (!expected || actual !== expected.toLowerCase()) fail(`checksum mismatch for ${name}: expected ${expected || "(none published)"}, got ${actual}. Refusing to install it.`);
+	const dest = pluginPath(pluginDir);
+	const dir = dirname(dest);
+	try {
+		mkdirSync(dir, { recursive: true });
+	} catch (err) {
+		fail(`could not create ${dir}: ${err instanceof Error ? err.message : String(err)}\n  The plugin directory usually belongs to root — try again with sudo.`);
+	}
+	const staging = join(dir, `.${PROVIDER_NAME}-${process.pid}-${actual.slice(0, 12)}`);
+	try {
+		writeFileSync(staging, bytes, { mode: 493 });
+		renameSync(staging, dest);
+	} catch (err) {
+		rmSync(staging, { force: true });
+		fail(`could not install to ${dest}: ${err instanceof Error ? err.message : String(err)}\n  The plugin directory usually belongs to root — try again with sudo.`);
+	}
+	chmodSync(dest, 493);
+	return {
+		path: dest,
+		version: prefix,
+		target,
+		sha256: actual
+	};
+}
+/**
+* Exercise an installed plugin exactly the way Nomad will.
+*
+* This exists because every way to get a Nomad plugin wrong fails *silently* —
+* a misnamed file, an unset `common_plugin_dir`, a plugin installed but never
+* fingerprinted because the agent was not restarted. None of those produce a
+* diagnostic, so the only reliable check is to run the thing yourself.
+*/
+function checkPlugin(pluginDir, opts = {}) {
+	const steps = [];
+	const bin = pluginPath(pluginDir);
+	if (!existsSync(bin)) {
+		steps.push({
+			name: "installed",
+			ok: false,
+			detail: `${bin} is missing — run \`seekrit nomad install\``
+		});
+		return steps;
+	}
+	steps.push({
+		name: "installed",
+		ok: true,
+		detail: bin
+	});
+	const fingerprint = spawnSync(bin, ["fingerprint"], {
+		encoding: "utf8",
+		timeout: 6e4
+	});
+	const fingerprintBody = safeJson(fingerprint.stdout);
+	const fingerprintOk = fingerprint.status === 0 && fingerprintBody?.type === "secrets";
+	steps.push({
+		name: "fingerprint",
+		ok: fingerprintOk,
+		detail: fingerprintOk ? String(fingerprintBody?.version ?? "") : (fingerprint.stderr || fingerprint.stdout || "no output").trim()
+	});
+	if (!fingerprintOk) return steps;
+	const fetch = spawnSync(bin, [...opts.config ? [
+		"--config",
+		opts.config,
+		"fetch"
+	] : ["fetch"], opts.path ?? ""], {
+		encoding: "utf8",
+		timeout: 6e4,
+		env: {
+			...process.env,
+			...opts.namespace ? { NOMAD_NAMESPACE: opts.namespace } : {},
+			...opts.job ? { NOMAD_JOB_ID: opts.job } : {}
+		}
+	});
+	const body = safeJson(fetch.stdout);
+	if (!body) {
+		steps.push({
+			name: "fetch",
+			ok: false,
+			detail: (fetch.stderr || "no JSON on stdout").trim()
+		});
+		return steps;
+	}
+	if (typeof body.error === "string") {
+		steps.push({
+			name: "fetch",
+			ok: false,
+			detail: body.error
+		});
+		return steps;
+	}
+	const count = Object.keys(body.result ?? {}).length;
+	steps.push({
+		name: "fetch",
+		ok: true,
+		detail: `${count} ${count === 1 ? "secret" : "secrets"}`
+	});
+	return steps;
+}
+function safeJson(text) {
+	if (!text) return void 0;
+	try {
+		const parsed = JSON.parse(text.trim());
+		return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : void 0;
+	} catch {
+		return;
+	}
+}
+function requirePluginDir(explicit) {
+	if (explicit) return resolve(explicit);
+	const found = detectPluginDir();
+	if (found) return found;
+	fail("could not find the Nomad plugin directory — pass --plugin-dir <path> matching your agent's client.common_plugin_dir");
+}
+function collect$3(value, previous = []) {
+	return [...previous, value];
+}
+function registerNomadCommands(program) {
+	const nomad = program.command("nomad").description("wire seekrit into Nomad as a secret provider (`seekrit nomad --help`)");
+	nomad.command("init").description("print the agent stanza, plugin config, and job snippet for this client").option("--plugin-dir <path>", "the agent's client.common_plugin_dir").option("--profile <name>", "profile name jobs will reference in `path`", "default").option("--token-file <path>", "where the profile's service token lives").option("--namespace <ns>", "restrict the profile to a Nomad namespace (repeatable)", collect$3).option("--job <id>", "restrict the profile to a Nomad job id (repeatable)", collect$3).option("--config <path>", "plugin config path", DEFAULT_CONFIG_PATH).option("--write", "write the plugin config file instead of printing it").option("--json", "machine-readable output").action((options) => {
+		const pluginDir = options.pluginDir ? resolve(options.pluginDir) : detectPluginDir() ?? PLUGIN_DIR_CANDIDATES[0];
+		const profile = options.profile ?? "default";
+		const tokenFile = options.tokenFile ?? `/etc/seekrit/tokens/${profile}`;
+		const configPath = resolve(options.config ?? "/etc/seekrit/nomad.json");
+		const config = pluginConfig({
+			profile,
+			tokenFile,
+			namespaces: options.namespace,
+			jobs: options.job
+		});
+		let wrote = false;
+		if (options.write) try {
+			mkdirSync(dirname(configPath), { recursive: true });
+			writeFileSync(configPath, config, { mode: 384 });
+			wrote = true;
+		} catch (err) {
+			fail(`could not write ${configPath}: ${err instanceof Error ? err.message : String(err)}\n  This path usually belongs to root — try again with sudo.`);
+		}
+		emit(options, {
+			pluginDir,
+			pluginPath: pluginPath(pluginDir),
+			configPath,
+			profile,
+			wrote
+		}, () => {
+			section("nomad secret provider");
+			printFields([
+				["plugin dir", pluginDir],
+				["plugin path", pluginPath(pluginDir)],
+				["provider", PROVIDER_NAME],
+				["config", configPath],
+				["profile", profile],
+				["config written", wrote ? "yes" : "no"]
+			]);
+			console.log();
+			console.log("1. Install the plugin on every Nomad client:");
+			console.log("     seekrit nomad install");
+			console.log();
+			console.log("   The file must be named `seekrit` — Nomad matches a job's `provider`");
+			console.log("   against the executable's filename, and a mismatch registers nothing.");
+			console.log();
+			console.log("2. Point the agent at the plugin directory (/etc/nomad.d/client.hcl):");
+			console.log();
+			console.log(indent(agentStanza(pluginDir)));
+			console.log();
+			console.log(`3. ${wrote ? `Written to ${configPath}:` : `Put this in ${configPath} (mode 0600):`}`);
+			console.log();
+			console.log(indent(config.trimEnd()));
+			console.log();
+			console.log(`   Then write the token itself to ${tokenFile} (mode 0600):`);
+			console.log(`     seekrit token create --name nomad-${profile} --app <app> --env <env>`);
+			console.log(`     # then: echo "skt_…" | sudo tee ${tokenFile} && sudo chmod 600 ${tokenFile}`);
+			console.log();
+			console.log("4. Restart the agent — plugins are fingerprinted at client startup:");
+			console.log("     sudo systemctl restart nomad");
+			console.log();
+			console.log("5. Reference it from a job:");
+			console.log();
+			console.log(indent(jobSnippet(profile, [])));
+			console.log();
+			console.log("Check your work with:  seekrit nomad check");
+		});
+	});
+	nomad.command("install").description("download the secret provider plugin onto this Nomad client").option("--plugin-dir <path>", "the agent's client.common_plugin_dir").option("--version <version>", "plugin version to install", NOMAD_PLUGIN_VERSION).option("--base-url <url>", "artifact host", DEFAULT_BASE_URL).option("--json", "machine-readable output").action(async (options) => {
+		const result = await installPlugin(requirePluginDir(options.pluginDir), {
+			version: options.version,
+			baseUrl: options.baseUrl,
+			quiet: options.json === true
+		});
+		emit(options, result, () => {
+			section("nomad plugin installed");
+			printFields([
+				["path", result.path],
+				["version", result.version],
+				["target", result.target],
+				["sha256", result.sha256],
+				["provider", PROVIDER_NAME]
+			]);
+			console.log();
+			console.log("Nomad fingerprints plugins at client startup — restart the agent:");
+			console.log("  sudo systemctl restart nomad");
+			console.log();
+			console.log("Then:  seekrit nomad check");
+		});
+	});
+	nomad.command("check").description("run the installed plugin the way Nomad does, and report what happened").option("--plugin-dir <path>", "the agent's client.common_plugin_dir").option("--path <path>", "the `path` a job would use (profile, or profile/NAME)", "").option("--namespace <ns>", "pretend to be a job in this Nomad namespace").option("--job <id>", "pretend to be this Nomad job id").option("--config <path>", "check against this plugin config instead of the installed one").option("--json", "machine-readable output").action((options) => {
+		const pluginDir = requirePluginDir(options.pluginDir);
+		const steps = checkPlugin(pluginDir, {
+			path: options.path,
+			namespace: options.namespace,
+			job: options.job,
+			config: options.config
+		});
+		const ok = steps.every((s) => s.ok);
+		emit(options, {
+			pluginDir,
+			ok,
+			steps
+		}, () => {
+			section("nomad plugin check");
+			printFields(steps.map((s) => [s.name, `${s.ok ? "ok" : "FAILED"} — ${s.detail}`]));
+			console.log();
+			if (ok) {
+				console.log("The plugin resolves. If a job still cannot, the agent has not been");
+				console.log("restarted since the install, or client.common_plugin_dir is unset.");
+			} else console.log("See `seekrit nomad init` for the configuration this expects.");
+		});
+		if (!ok) process.exitCode = 1;
+	});
+}
+function indent(text) {
+	return text.split("\n").map((line) => line.length > 0 ? `     ${line}` : line).join("\n");
+}
+//#endregion
 //#region src/orgs.ts
 /**
 * Counts for `org show`. Each list is admin-gated to a different degree, so a
@@ -12683,188 +13249,6 @@ function collect$2(value, acc) {
 	return acc;
 }
 //#endregion
-//#region src/proxy-binary.ts
-/**
-* Fetch and run the `seekrit-proxy` binary without a Rust toolchain.
-*
-* The proxy is the strongest answer seekrit has for an untrusted workload — the
-* agent holds `{{seekrit:NAME}}` and never the key — and it was also the hardest
-* thing here to *try*, because trying it meant `cargo` and a TOML file. This
-* module removes the first half: it resolves a prebuilt, checksum-verified
-* binary for the host platform and execs it, so `npx @seekrit/proxy` and
-* `seekrit proxy run` behave like the proxy was already installed.
-*
-* The logic lives in the CLI (and is re-exported as `@seekrit/cli/proxy-launcher`)
-* for the same reason the MCP server does: `@seekrit/proxy` is a thin npx
-* entrypoint over it, and the two must not drift.
-*
-* Three properties worth stating, since this downloads and executes code:
-*
-* - **The checksum is verified before anything is executed**, against a
-*   `.sha256` fetched from the same release. That is integrity, not provenance —
-*   it proves the bytes match what the release published, which is exactly the
-*   guarantee `install.sh` gives and no more.
-* - **Nothing is fetched when a binary is already available.** `SEEKRIT_PROXY_BIN`
-*   short-circuits entirely, and a cached download for the same version+target is
-*   reused, so this is a one-time cost per version.
-* - **Version is pinned, not floating.** A default of `latest` would make two
-*   machines run different proxies from the same command; the pinned constant is
-*   what this CLI was built against, overridable when you want otherwise.
-*/
-/**
-* The proxy version this CLI was built against.
-*
-* Bumped by release-please when `apps/proxy` releases (an `extra-files` entry in
-* release-please-config.json), so the pin follows the crate without anyone
-* remembering to move it.
-*/
-const PROXY_VERSION = "0.12.0";
-const BIN = "seekrit-proxy";
-/**
-* Host → Rust target triple.
-*
-* Linux always resolves to **musl**: that build is statically linked, so one
-* artifact covers glibc, musl, alpine, and distroless, and there is no libc
-* detection to get wrong on a machine where `ldd` says something unexpected.
-*/
-function detectTarget(os = platform(), cpu = arch()) {
-	const machine = cpu === "x64" ? "x86_64" : cpu === "arm64" ? "aarch64" : null;
-	if (!machine) throw new Error(`unsupported architecture "${cpu}" — build from source (apps/proxy) or set SEEKRIT_PROXY_BIN`);
-	switch (os) {
-		case "linux": return {
-			target: `${machine}-unknown-linux-musl`,
-			exe: ""
-		};
-		case "darwin": return {
-			target: `${machine}-apple-darwin`,
-			exe: ""
-		};
-		case "win32":
-			if (machine !== "x86_64") throw new Error(`no prebuilt seekrit-proxy for ${machine} Windows — set SEEKRIT_PROXY_BIN to a binary you built`);
-			return {
-				target: "x86_64-pc-windows-msvc",
-				exe: ".exe"
-			};
-		default: throw new Error(`unsupported platform "${os}" — build from source (apps/proxy) or set SEEKRIT_PROXY_BIN`);
-	}
-}
-/** `latest` stays `latest`; everything else is normalized to `v<x.y.z>`. */
-function versionPrefix(version) {
-	if (version === "latest") return "latest";
-	return version.startsWith("v") ? version : `v${version}`;
-}
-function resolveVersion(explicit) {
-	return explicit ?? process.env.SEEKRIT_PROXY_VERSION ?? "0.12.0";
-}
-function resolveBaseUrl(explicit) {
-	return (explicit ?? process.env.SEEKRIT_PROXY_BASE_URL ?? "https://proxy.seekrit.dev").replace(/\/+$/, "");
-}
-/** Where a resolved binary is kept, keyed so versions and targets never collide. */
-function proxyBinaryPath(version, target, exe) {
-	return join(defaultCacheDir(), "proxy", versionPrefix(version), target, `${BIN}${exe}`);
-}
-async function fetchBytes(url) {
-	const res = await fetch(url);
-	if (!res.ok) throw new Error(`GET ${url} → ${res.status} ${res.statusText}`);
-	return new Uint8Array(await res.arrayBuffer());
-}
-/**
-* Ensure a `seekrit-proxy` binary exists locally and return its path.
-*
-* Order: an explicit `SEEKRIT_PROXY_BIN`, then a cached download for this
-* version+target, then a fresh download. A binary already on `PATH` is
-* deliberately *not* used — silently running a different version than the one
-* this CLI pins is the kind of surprise that costs an afternoon.
-*/
-async function resolveProxyBinary(options = {}) {
-	const override = process.env.SEEKRIT_PROXY_BIN;
-	if (override) {
-		if (!existsSync(override)) throw new Error(`SEEKRIT_PROXY_BIN points at ${override}, which does not exist`);
-		return override;
-	}
-	const version = resolveVersion(options.version);
-	const { target, exe } = detectTarget();
-	const dest = proxyBinaryPath(version, target, exe);
-	if (!options.force && version !== "latest" && existsSync(dest)) return dest;
-	const baseUrl = resolveBaseUrl(options.baseUrl);
-	const prefix = versionPrefix(version);
-	const name = `${BIN}-${target}${exe}`;
-	const binUrl = `${baseUrl}/${prefix}/bin/${name}`;
-	const sumUrl = `${binUrl}.sha256`;
-	if (!options.quiet) process.stderr.write(`seekrit: fetching ${BIN} ${prefix} (${target})…\n`);
-	let bytes;
-	let expected;
-	try {
-		[bytes, expected] = await Promise.all([fetchBytes(binUrl), fetchBytes(sumUrl).then((b) => Buffer.from(b).toString("utf8").trim().split(/\s+/)[0] ?? "")]);
-	} catch (err) {
-		const message = err instanceof Error ? err.message : String(err);
-		throw new Error(`could not download ${BIN} ${prefix} for ${target}: ${message}\n  Set SEEKRIT_PROXY_BIN to a binary you already have, or build it from apps/proxy.`);
-	}
-	const actual = createHash("sha256").update(bytes).digest("hex");
-	if (!expected || actual !== expected.toLowerCase()) throw new Error(`checksum mismatch for ${name}: expected ${expected || "(none published)"}, got ${actual}. Refusing to run it.`);
-	const dir = dirname(dest);
-	mkdirSync(dir, { recursive: true });
-	const staging = join(dir, `.${BIN}-${process.pid}-${actual.slice(0, 12)}${exe}`);
-	try {
-		writeFileSync(staging, bytes, { mode: 493 });
-		renameSync(staging, dest);
-	} catch (err) {
-		rmSync(staging, { force: true });
-		throw err;
-	}
-	chmodSync(dest, 493);
-	return dest;
-}
-/**
-* Run the proxy, forwarding stdio, signals, and its exit status.
-*
-* The proxy is a long-lived foreground process, so this wrapper has to be
-* transparent: Node cannot exec-replace itself, and without relaying signals
-* Node's default SIGINT handler would kill *this* process on Ctrl-C and leave
-* the proxy running, holding decrypted secrets, with the shell prompt back.
-*/
-async function runProxyBinary(argv, options = {}) {
-	const bin = await resolveProxyBinary(options);
-	const child = spawn(bin, argv, {
-		stdio: "inherit",
-		env: {
-			...process.env,
-			...options.env
-		}
-	});
-	const signals = [
-		"SIGINT",
-		"SIGTERM",
-		"SIGHUP",
-		"SIGQUIT"
-	];
-	const forward = (signal) => {
-		if (child.exitCode !== null || child.signalCode !== null) return;
-		child.kill(signal);
-	};
-	for (const signal of signals) process.on(signal, forward);
-	return new Promise((resolve, reject) => {
-		child.on("error", (err) => {
-			for (const s of signals) process.off(s, forward);
-			reject(/* @__PURE__ */ new Error(`could not start ${bin}: ${err.message}\n  If this is a fresh download, the platform may not match — set SEEKRIT_PROXY_BIN.`));
-		});
-		child.on("exit", (code, signal) => {
-			for (const s of signals) process.off(s, forward);
-			resolve(signal ? 128 + signalNumber(signal) : code ?? 0);
-		});
-	});
-}
-/** Signal name → number, for the 128+n exit convention. */
-function signalNumber(signal) {
-	return {
-		SIGHUP: 1,
-		SIGINT: 2,
-		SIGQUIT: 3,
-		SIGKILL: 9,
-		SIGTERM: 15
-	}[signal] ?? 0;
-}
-//#endregion
 //#region src/proxy.ts
 /**
 * `seekrit proxy` — get `seekrit-proxy` running without a Rust toolchain or a
@@ -13194,10 +13578,10 @@ Next:
 		});
 		console.log(path);
 		const { target } = detectTarget();
-		process.stderr.write(`seekrit-proxy ${versionPrefix(options.proxyVersion ?? "0.12.0")} (${target})\n`);
+		process.stderr.write(`seekrit-proxy ${versionPrefix(options.proxyVersion ?? "0.12.1")} (${target})\n`);
 	});
 	proxy.command("where").description("show which binary `seekrit proxy run` would use, without fetching it").option("--proxy-version <version>", `version to report (default: ${PROXY_VERSION})`).option("--json", "machine-readable output").action((options) => {
-		const version = options.proxyVersion ?? process.env.SEEKRIT_PROXY_VERSION ?? "0.12.0";
+		const version = options.proxyVersion ?? process.env.SEEKRIT_PROXY_VERSION ?? "0.12.1";
 		const override = process.env.SEEKRIT_PROXY_BIN;
 		const { target, exe } = detectTarget();
 		const path = override ?? proxyBinaryPath(version, target, exe);
@@ -13256,7 +13640,7 @@ Next:
 		process.stdout.write(renderComposeSnippet(plan, {
 			service: options.service,
 			workload: options.workload,
-			image: options.image ?? `seekritdev/proxy:0.12.0`,
+			image: options.image ?? `seekritdev/proxy:0.12.1`,
 			publish: Boolean(options.publish)
 		}));
 	});
@@ -15130,6 +15514,7 @@ registerProvisionerCommands(program);
 registerProxyCommands(program);
 registerAgentCommands(program);
 registerPaperclipCommands(program);
+registerNomadCommands(program);
 registerOpenclawCommands(program);
 registerHermesCommands(program);
 registerSshCommands(program);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/cli",
-  "version": "1.5.0",
+  "version": "1.6.1",
   "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
   "type": "module",
   "publishConfig": {
@@ -31,8 +31,8 @@
     "tsdown": "^0.22.3",
     "vitest": "^4.1.11",
     "@seekrit/api-client": "0.0.1",
-    "@seekrit/crypto": "0.0.1",
-    "@seekrit/core": "0.0.1"
+    "@seekrit/core": "0.0.1",
+    "@seekrit/crypto": "0.0.1"
   },
   "scripts": {
     "build": "tsdown",