@seekrit/cli 2.3.0 → 2.5.0

package/dist/index.js

@@ -7,9 +7,9 @@ import { basename, dirname, join, parse, resolve } from "node:path";
 import { createInterface } from "node:readline";
 import { Writable } from "node:stream";
 import { createHash, randomBytes } from "node:crypto";
+import { spawn, spawnSync } from "node:child_process";
 import { connect } from "node:net";
 import { fileURLToPath } from "node:url";
-import { spawn, spawnSync } from "node:child_process";
 import { request } from "node:http";
 /** Default lifetime of a published bundle (7 days), in seconds. */
 const POLICY_DEFAULT_TTL_SECONDS = 604800;
@@ -441,6 +441,100 @@ z.object({
 	*/
 	entries: z.array(activityEntrySchema).min(1).max(500)
 });
+// ../../packages/core/src/agent-login.ts
+/** Where each kind of login is stored unless told otherwise. */
+const AGENT_LOGIN_SECRETS = {
+	/** Codex's `auth.json`, as an envelope. */
+	codex: "CODEX_LOGIN",
+	/** Claude Code's full `.credentials.json`, as an envelope. */
+	claude: "CLAUDE_LOGIN",
+	/** A `claude setup-token` token — a plain secret, the variable Claude Code reads. */
+	claudeToken: "CLAUDE_CODE_OAUTH_TOKEN"
+};
+const AGENT_LOGIN_KIND = "seekrit.agent-login/v1";
+/** The serialized prefix of every version of the envelope (`kind` is always first). */
+const ENVELOPE_PREFIX = "{\"kind\":\"seekrit.agent-login/";
+function encodeAgentLoginEnvelope(envelope) {
+	const { agent, content, savedAt, claim } = envelope;
+	return JSON.stringify({
+		kind: AGENT_LOGIN_KIND,
+		agent,
+		content,
+		savedAt,
+		claim
+	});
+}
+/**
+* Whether a decrypted secret value is a managed agent login. Such a value is a
+* *file*, never an environment variable: `seekrit run` keeps it out of the
+* child's environment.
+*/
+function isAgentLoginValue(value) {
+	return value.startsWith(ENVELOPE_PREFIX);
+}
+function decodeAgentLoginEnvelope(value) {
+	if (!isAgentLoginValue(value)) return null;
+	const parsed = parseObject$1(value);
+	if (!parsed || parsed.kind !== "seekrit.agent-login/v1") return null;
+	if (!(parsed.agent === "codex" || parsed.agent === "claude")) return null;
+	if (typeof parsed.content !== "string") return null;
+	const claim = parsed.claim;
+	return {
+		kind: AGENT_LOGIN_KIND,
+		agent: parsed.agent,
+		content: parsed.content,
+		savedAt: typeof parsed.savedAt === "string" ? parsed.savedAt : "",
+		claim: claim && typeof claim.holder === "string" && typeof claim.until === "string" ? claim : null
+	};
+}
+function parseObject$1(content) {
+	try {
+		const parsed = JSON.parse(content);
+		return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+	} catch {
+		return null;
+	}
+}
+function nonEmpty$1(value) {
+	return typeof value === "string" && value.length > 0;
+}
+/** Why `content` is not a usable Codex `auth.json`, or null when it is. */
+function codexLoginProblem(content) {
+	const auth = parseObject$1(content);
+	if (!auth) return "not a JSON object";
+	const tokens = auth.tokens;
+	if (tokens && nonEmpty$1(tokens.access_token) && nonEmpty$1(tokens.refresh_token)) return null;
+	if (nonEmpty$1(auth.OPENAI_API_KEY)) return null;
+	return "no ChatGPT tokens and no API key — is this a Codex auth.json?";
+}
+/** Why `content` is not a usable Claude Code `.credentials.json`, or null when it is. */
+function claudeLoginProblem(content) {
+	const creds = parseObject$1(content);
+	if (!creds) return "not a JSON object";
+	const oauth = creds.claudeAiOauth;
+	if (!oauth || !nonEmpty$1(oauth.accessToken)) return "no claudeAiOauth.accessToken — is this a Claude Code .credentials.json?";
+	return null;
+}
+/** A Claude Code long-lived token (`claude setup-token`) looks like `sk-ant-oat…`. */
+function claudeTokenProblem(token) {
+	if (!token) return "no token given";
+	if (/\s/.test(token)) return "the token contains whitespace — paste just the token";
+	if (!token.startsWith("sk-ant-")) return "that does not look like a Claude token (expected sk-ant-…)";
+	return null;
+}
+/** A JWT's payload, without verifying it — for scheduling and display only. */
+function jwtClaims(token) {
+	const payload = token.split(".")[1];
+	if (!payload) return null;
+	try {
+		const b64 = payload.replaceAll("-", "+").replaceAll("_", "/");
+		const padded = b64 + "=".repeat((4 - b64.length % 4) % 4);
+		const bytes = Uint8Array.from(atob(padded), (c) => c.charCodeAt(0));
+		return parseObject$1(new TextDecoder().decode(bytes));
+	} catch {
+		return null;
+	}
+}
 // ../../packages/core/src/agent-review.ts
 function emptyStats() {
 	return {
@@ -2158,6 +2252,7 @@ const AUDIT_ACTIONS = [
 	"org.member_added",
 	"org.member_role_changed",
 	"app.access_granted",
+	"app.access_revoked",
 	"org.member_removed",
 	"org.member_invited",
 	"org.invite_revoked",
@@ -2458,9 +2553,18 @@ z.object({
 	*/
 	recoveryWrappedDek: z.string().min(1).nullish()
 });
-z.object({ 
-/** Opaque versioned ciphertext blob from @seekrit/crypto. */
-ciphertext: z.string().min(1).max(65536) });
+z.object({
+	/** Opaque versioned ciphertext blob from @seekrit/crypto. */
+	ciphertext: z.string().min(1).max(65536),
+	/**
+	* Compare-and-swap: write only if the secret is currently at this version
+	* (`0` = only if it does not exist yet), else 412 `precondition_failed`.
+	* Omit for an unconditional write. This is what lets a writer that read,
+	* changed, and wrote back — a refreshed agent login, say — find out that
+	* someone else wrote in between instead of silently erasing their value.
+	*/
+	expectedVersion: z.number().int().min(0).optional()
+});
 z.object({ version: z.number().int().positive() });
 z.object({ limit: z.coerce.number().int().min(1).max(200).default(50) });
 z.object({
@@ -5783,7 +5887,7 @@ async function createAgentTaskToken() {
 	};
 }
 // package.json
-var version = "2.3.0";
+var version = "2.5.0";
 // ../../packages/api-client/src/index.ts
 /**
 * The proposer's note travels as a header, not a body field: an unprotected
@@ -5919,6 +6023,9 @@ var SeekritClient = class {
 	listMembers(orgId) {
 		return this.request("GET", `/v1/orgs/${orgId}/members`);
 	}
+	getMemberAccess(orgId) {
+		return this.request("GET", `/v1/orgs/${orgId}/members/access`);
+	}
 	updateMemberRole(orgId, userId, role) {
 		return this.request("PATCH", `/v1/orgs/${orgId}/members/${userId}`, { role });
 	}
@@ -5931,6 +6038,13 @@ var SeekritClient = class {
 			grants
 		});
 	}
+	/**
+	* Stop auto-granting this app's future environments to a member. Keys they
+	* already hold stay; revoke those per environment with `revokeEnvKey`.
+	*/
+	revokeAppAccess(orgId, appId, userId) {
+		return this.request("DELETE", `/v1/orgs/${orgId}/apps/${appId}/access/${userId}`);
+	}
 	accessRecipients(orgId, target) {
 		const path = "appId" in target ? `apps/${target.appId}` : `groups/${target.groupId}`;
 		return this.request("GET", `/v1/orgs/${orgId}/${path}/access-recipients`);
@@ -6094,9 +6208,17 @@ var SeekritClient = class {
 	*
 	* `note` is the proposer's explanation, carried as a header so it is simply
 	* ignored by an unprotected environment.
+	*
+	* `expectedVersion` makes the write a compare-and-swap: it lands only if the
+	* secret is still at that version (`0` = does not exist yet), and otherwise
+	* fails with a 412 `precondition_failed` {@link SeekritApiError}.
 	*/
-	setSecret(orgId, envId, name, ciphertext, note) {
-		return this.request("PUT", `/v1/orgs/${orgId}/envs/${envId}/secrets/${name}`, { ciphertext }, changeNoteHeader(note));
+	setSecret(orgId, envId, name, ciphertext, note, options = {}) {
+		const body = options.expectedVersion === void 0 ? { ciphertext } : {
+			ciphertext,
+			expectedVersion: options.expectedVersion
+		};
+		return this.request("PUT", `/v1/orgs/${orgId}/envs/${envId}/secrets/${name}`, body, changeNoteHeader(note));
 	}
 	/** Queued for review in a protected environment — see {@link setSecret}. */
 	deleteSecret(orgId, envId, name, note) {
@@ -7407,835 +7529,785 @@ function registerAccountCommands(program) {
 		console.error(`${type} emails ${state}`);
 	});
 }
-// src/agents.ts
-/**
-* Agent access governance from the CLI.
-*
-* Policy lived only in the dashboard until now, which was backwards: the people
-* deploying agents work in a terminal and a repo, and a rule set is exactly the
-* kind of thing that wants review and version control. So the loop this module
-* exists for is:
-*
-*   seekrit agents policy pull nova -o nova.policy.json   # current rules
-*   $EDITOR nova.policy.json                              # commit it, review it
-*   seekrit agents policy publish nova -f nova.policy.json
-*
-* **Signing still happens here, on this machine, with the operator's own key**
-* (`getPolicySigner` in `context.ts`), so nothing about the trust argument in
-* `docs/agent-access-governance.md` §1 changes: the API receives an opaque
-* envelope it cannot forge, and a proxy verifies it against thumbprints pinned in
-* its own local file. A service token is refused — an agent that can publish its
-* own policy is not governed by it.
-*
-* Everything else here is read-only, and two commands are deliberately *local*
-* evaluations rather than API calls:
-*
-* - `simulate` runs `evaluatePolicy` from `@seekrit/core`, the mirror of
-*   `RuleSet::decide` in the proxy — so a dry run and a real refusal give the
-*   same verdict in the same words.
-* - `fetch` asks for the bytes a proxy would get (`GET /v1/agents/:ref/policy`)
-*   and re-derives the signer thumbprint from the bundle itself, rather than
-*   trusting the field the API echoes beside it.
-*/
-/** How many published versions the API returns per page. */
-const POLICY_PAGE = 50;
-/** The `-` sentinel every other seekrit command uses to mean stdin. */
-const STDIN = "-";
-/**
-* Resolve `nova`, or `agt_…`, to an identity.
-*
-* The org-scoped API routes take an id, but nobody types ids — so a slug is
-* resolved from the list. The list is small (agents are a per-deployment thing,
-* not a per-request one), which is why this costs one request rather than
-* needing a lookup route.
-*/
-async function resolveAgent(ctx, orgId, ref) {
-	const { agents } = await ctx.client.listAgents(orgId);
-	const found = agents.find((a) => a.slug === ref || a.id === ref);
-	if (!found) {
-		const known = agents.map((a) => a.slug).join(", ");
-		fail(`no agent "${ref}"${known ? ` — this org has: ${known}` : " in this org"}`);
+// src/agent-login.ts
+/**
+* Managed agent logins: keep a coding agent's *own* sign-in — Codex's
+* `auth.json`, Claude Code's `.credentials.json` — in seekrit, so any sandbox
+* started through `seekrit run --agent-login <agent>` is already signed in, and
+* stays signed in from one sandbox to the next.
+*
+* Storing the file is the easy half. The hard half is that both files carry an
+* OAuth **refresh token that rotates**: every refresh consumes it and issues a
+* new one. Copy the file into an ephemeral sandbox and the first refresh there
+* burns the token seekrit is holding, so the *next* sandbox's refresh is
+* rejected as a reuse and the login is gone. Two sandboxes refreshing at once
+* end the same way. So this module does three things around the agent:
+*
+* - **Write-back.** The local file is watched while the agent runs, and a
+*   refresh is encrypted and stored the moment it lands — compare-and-swap on
+*   the secret's version, so two sandboxes can never silently overwrite each
+*   other's rotation.
+* - **Pick-up.** A sandbox that is already running polls for a newer copy near
+*   its token's refresh time and writes it to disk. Both agents re-read their
+*   file before refreshing (Codex does a guarded reload and only refreshes if
+*   the file is unchanged; Claude Code invalidates its cache on a new mtime),
+*   so a running agent adopts a sibling's refresh instead of reusing a dead
+*   token.
+* - **One refresher per launch storm.** A sandbox that starts when the token is
+*   due to refresh takes a short *claim* first, so twenty sandboxes spun up at
+*   once produce one refresh and nineteen waits, not twenty races.
+*
+* Nothing here calls a provider's token endpoint: the agent CLI does its own
+* refresh, exactly as it would on a laptop, and seekrit only moves the file.
+* The claim lives *inside* the encrypted value, so the API coordinates without
+* seeing anything but ciphertext and version numbers.
+*
+* The residual risk, said plainly: two sandboxes that are both *already
+* running* when the token comes due can still refresh in the same few seconds,
+* before either sees the other's copy. A long-lived token (`claude
+* setup-token`) or an API key has no refresh to race, and is the right choice
+* for a large parallel fleet.
+*/
+/**
+* How long before expiry an agent refreshes on its own. Codex refreshes when
+* the access token is within five minutes of expiring
+* (`CHATGPT_ACCESS_TOKEN_REFRESH_WINDOW_MINUTES`); Claude Code uses the same
+* margin. A login is *due* from that point on.
+*/
+const REFRESH_LEAD_MS = 3e5;
+/** Codex's fallback when an access token carries no `exp`: refresh every eight days. */
+const CODEX_REFRESH_INTERVAL_MS = 6912e5;
+function parseObject(content) {
+	try {
+		const parsed = JSON.parse(content);
+		return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+	} catch {
+		return null;
 	}
-	return found;
 }
-/**
-* One published version: the newest by default, or an explicit `--version`.
-*
-* An agent with no published policy is a real state, not an error — a proxy for
-* it fails closed — so the caller decides how to report it.
-*/
-async function loadVersion(ctx, orgId, agent, version) {
-	const { policies } = await ctx.client.listAgentPolicies(orgId, agent.id);
-	if (version === void 0) return policies[0] ?? null;
-	const found = policies.find((p) => p.version === version);
-	if (!found) fail(policies.length >= POLICY_PAGE ? `no version ${version} in the last ${POLICY_PAGE} published` : `no version ${version} — published: ${policies.map((p) => p.version).join(", ") || "none"}`);
-	return found;
+function nonEmpty(value) {
+	return typeof value === "string" && value.length > 0;
 }
-/**
-* Read a rule file: either a bare array or `{ "rules": [...] }`, from a path or
-* stdin. Both shapes are accepted because `policy pull` writes the second and
-* hand-written files tend to be the first.
-*
-* Validation is the same zod schema the API and the dashboard use, so a file
-* rejected here would have been rejected there — before anything is signed.
-*
-* Exported for its own test: this is the one place a hand-written file meets the
-* schema, and its error messages are the whole user experience of a typo.
-*/
-function parseRuleFile(raw, source) {
-	let parsed;
+/** The `exp` claim of a JWT, in ms — without verifying it (we only schedule by it). */
+function jwtExpiryMs(token) {
+	const exp = jwtClaims(token)?.exp;
+	return typeof exp === "number" ? exp * 1e3 : null;
+}
+const codexAdapter = {
+	id: "codex",
+	label: "Codex",
+	defaultSecret: AGENT_LOGIN_SECRETS.codex,
+	loginPath(env) {
+		const home = env.CODEX_HOME?.trim() || join(homedir(), ".codex");
+		return join(home, "auth.json");
+	},
+	problem: codexLoginProblem,
+	expiresAt(content) {
+		const auth = parseObject(content);
+		const tokens = auth?.tokens;
+		if (!tokens || !nonEmpty(tokens.access_token)) return null;
+		const exp = jwtExpiryMs(tokens.access_token);
+		if (exp !== null) return exp;
+		const last = nonEmpty(auth?.last_refresh) ? Date.parse(auth.last_refresh) : NaN;
+		return Number.isNaN(last) ? null : last + CODEX_REFRESH_INTERVAL_MS;
+	}
+};
+const claudeAdapter = {
+	id: "claude",
+	label: "Claude Code",
+	defaultSecret: AGENT_LOGIN_SECRETS.claude,
+	loginPath(env) {
+		const home = env.CLAUDE_CONFIG_DIR?.trim() || join(homedir(), ".claude");
+		return join(home, ".credentials.json");
+	},
+	problem: claudeLoginProblem,
+	expiresAt(content) {
+		const oauth = parseObject(content)?.claudeAiOauth;
+		if (!oauth || !nonEmpty(oauth.refreshToken)) return null;
+		return typeof oauth.expiresAt === "number" ? oauth.expiresAt : null;
+	}
+};
+const ADAPTERS = {
+	codex: codexAdapter,
+	claude: claudeAdapter
+};
+function adapterFor(name) {
+	const adapter = ADAPTERS[name];
+	if (!adapter) throw new Error(`unknown agent "${name}" — expected one of: ${Object.keys(ADAPTERS).join(", ")}`);
+	return adapter;
+}
+/** The file beside the login that marks it as ours, and who is using it. */
+const MARKER = ".seekrit-agent-login.json";
+const DEFAULTS = {
+	claimTtlMs: 9e4,
+	maxWaitMs: 12e4,
+	localPollMs: 1e3,
+	idleRemotePollMs: 9e5,
+	hotRemotePollMs: 5e3,
+	waitPollMs: 2e3
+};
+/** The window around a token's refresh time when siblings poll each other hard. */
+const HOT_BEFORE_MS = 12e4;
+const HOT_AFTER_MS = 3e5;
+function defaultIsAlive(pid) {
 	try {
-		parsed = JSON.parse(raw);
+		process.kill(pid, 0);
+		return true;
 	} catch (err) {
-		fail(`${source} is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
+		return err.code === "EPERM";
 	}
-	const list = Array.isArray(parsed) ? parsed : parsed?.rules === void 0 ? fail(`${source} must be a JSON array of rules, or an object with a "rules" array`) : parsed.rules;
-	if (!Array.isArray(list)) fail(`${source}: "rules" must be an array`);
-	if (list.length === 0) console.error(`note: ${source} has no rules — publishing it denies every request`);
-	return list.map((rule, i) => {
-		const result = agentPolicyRuleSchema.safeParse(rule);
-		if (!result.success) {
-			const first = result.error.issues[0];
-			fail(`${source}: rule ${i + 1} is invalid — ${first?.path.join(".") || "rule"}: ${first?.message ?? "unknown error"}`);
-		}
-		return result.data;
+}
+/** Write a file so a reader sees the old bytes or the new ones, never half of each. */
+function writeAtomic(path, content) {
+	mkdirSync(dirname(path), {
+		recursive: true,
+		mode: 448
 	});
+	const tmp = `${path}.seekrit-${process.pid}-${randomBytes(4).toString("hex")}`;
+	writeFileSync(tmp, content, { mode: 384 });
+	chmodSync(tmp, 384);
+	renameSync(tmp, path);
 }
-/** `--file path` or `--file -`. */
-async function readRuleSource(file) {
-	if (file === STDIN) return {
-		raw: await readStdin(),
-		label: "stdin"
-	};
+function readIfExists(path) {
 	try {
-		return {
-			raw: readFileSync(file, "utf8"),
-			label: file
-		};
+		return readFileSync(path, "utf8");
 	} catch (err) {
-		return fail(`cannot read ${file}: ${err instanceof Error ? err.message : String(err)}`);
+		if (err.code === "ENOENT") return null;
+		throw err;
 	}
 }
-/**
-* An empty `methods` or `paths` list means *any*: those fields narrow a rule that
-* already matched its host, so absent means unconstrained. A blank column would
-* read as the opposite, so it renders as `any`.
-*
-* Exported for its own test — this is a real invariant of the format, not a
-* cosmetic choice.
-*/
-function describeList(values) {
-	return values.length === 0 ? "any" : values.join(" ");
+var AgentLoginSession = class {
+	o;
+	/** The secret version our view of it came from — the CAS precondition. */
+	version = 0;
+	/** The stored envelope at `version`. */
+	envelope = null;
+	/** The login content known to be in seekrit (and, unless the agent moved it, on disk). */
+	synced = "";
+	claimUntil = null;
+	lastRemotePoll = 0;
+	timer;
+	/** One tick at a time: a slow network must not stack overlapping syncs. */
+	busy = null;
+	placed = false;
+	warnedMissing = false;
+	/** The last write-back failure, kept so `stop` can report a refresh it could not save. */
+	pendingError = null;
+	constructor(options) {
+		this.o = {
+			adapter: options.adapter,
+			store: options.store,
+			secretName: options.secretName,
+			path: options.path,
+			now: options.now ?? Date.now,
+			sleep: options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms))),
+			log: options.log ?? ((line) => process.stderr.write(`seekrit: ${line}\n`)),
+			holder: options.holder ?? `${hostname()}:${process.pid}:${randomBytes(4).toString("hex")}`,
+			pid: options.pid ?? process.pid,
+			isAlive: options.isAlive ?? defaultIsAlive,
+			claimTtlMs: options.claimTtlMs ?? DEFAULTS.claimTtlMs,
+			maxWaitMs: options.maxWaitMs ?? DEFAULTS.maxWaitMs,
+			localPollMs: options.localPollMs ?? DEFAULTS.localPollMs,
+			idleRemotePollMs: options.idleRemotePollMs ?? DEFAULTS.idleRemotePollMs,
+			hotRemotePollMs: options.hotRemotePollMs ?? DEFAULTS.hotRemotePollMs
+		};
+	}
+	get markerPath() {
+		return join(dirname(this.o.path), MARKER);
+	}
+	/**
+	* Fetch the login (claiming it first if it is due to refresh), put it on
+	* disk, and start watching. Throws — before touching the disk — if the path
+	* already holds a login seekrit did not put there.
+	*/
+	async start() {
+		this.guardUnmanaged();
+		await this.recoverLeftover();
+		await this.acquire();
+		this.registerHolder();
+		writeAtomic(this.o.path, this.synced);
+		this.placed = true;
+		this.lastRemotePoll = this.o.now();
+		this.timer = setInterval(() => void this.tick(), this.o.localPollMs);
+		this.timer.unref?.();
+	}
+	/**
+	* Stop watching, save anything the agent changed since the last tick, drop
+	* our claim, and — if no other run on this machine still uses it — remove
+	* the file. Returns false when a refresh could not be saved: that login now
+	* exists only on this disk, which the caller must say out loud.
+	*/
+	async stop() {
+		if (this.timer) clearInterval(this.timer);
+		this.timer = void 0;
+		if (this.busy) await this.busy.catch(() => {});
+		let saved = true;
+		if (this.placed) {
+			try {
+				await this.syncUp();
+				this.pendingError = null;
+			} catch (err) {
+				this.pendingError = err;
+			}
+			if (this.pendingError) {
+				saved = false;
+				this.o.log(`could not save the refreshed ${this.o.adapter.label} login to seekrit (${message$1(this.pendingError)}). It is still at ${this.o.path}: the next \`seekrit run --agent-login ${this.o.adapter.id}\` on this machine saves it, or run \`seekrit agent-login ${this.o.adapter.id} --from ${this.o.path} --move\` once seekrit is reachable. Until then, other sandboxes will be signed out.`);
+			}
+		}
+		await this.releaseClaim().catch(() => {});
+		if (this.placed && saved) this.unregisterHolder();
+		return saved;
+	}
+	/** One watch cycle: push a local refresh, and (on schedule) pull a remote one. */
+	async tick() {
+		if (this.busy) return;
+		this.busy = (async () => {
+			try {
+				await this.syncUp();
+				this.pendingError = null;
+			} catch (err) {
+				if (!this.pendingError) this.o.log(`could not save the refreshed login yet: ${message$1(err)}`);
+				this.pendingError = err;
+			}
+			try {
+				if (this.remotePollDue()) {
+					this.lastRemotePoll = this.o.now();
+					await this.syncDown();
+				}
+				await this.expireClaim();
+			} catch {}
+		})().finally(() => {
+			this.busy = null;
+		});
+		await this.busy;
+	}
+	/**
+	* An earlier run that could not save its refresh (seekrit unreachable at
+	* exit, or the wrapper killed outright) leaves the login on disk, marked as
+	* ours. If that copy is newer than the stored one it is the only live token,
+	* so it goes back to seekrit before anything replaces it.
+	*/
+	async recoverLeftover() {
+		if (!existsSync(this.markerPath)) return;
+		const leftover = readIfExists(this.o.path);
+		if (leftover === null || this.o.adapter.problem(leftover) !== null) return;
+		const snapshot = await this.o.store.read();
+		if (!snapshot) return;
+		const stored = this.decode(snapshot.value);
+		if (!this.fresher(leftover, stored.content)) return;
+		const recovered = {
+			kind: AGENT_LOGIN_KIND,
+			agent: this.o.adapter.id,
+			content: leftover,
+			savedAt: new Date(this.o.now()).toISOString(),
+			claim: null
+		};
+		const written = await this.o.store.write(encodeAgentLoginEnvelope(recovered), snapshot.version);
+		if (written.ok) this.o.log(`saved a refreshed ${this.o.adapter.label} login an earlier run left at ${this.o.path} (v${written.version})`);
+	}
+	async acquire() {
+		const deadline = this.o.now() + this.o.maxWaitMs;
+		let announced = false;
+		for (;;) {
+			const snapshot = await this.o.store.read();
+			if (!snapshot) throw new Error(`no ${this.o.adapter.label} login in ${this.o.secretName} — sign in once with \`seekrit agent-login ${this.o.adapter.id}\``);
+			const envelope = this.decode(snapshot.value);
+			const now = this.o.now();
+			if (!this.isDue(envelope.content, now)) return this.adopt(snapshot, envelope);
+			const claim = envelope.claim;
+			if (claim && claim.holder !== this.o.holder && Date.parse(claim.until) > now) {
+				if (now >= deadline) {
+					this.o.log(`another sandbox has been refreshing the ${this.o.adapter.label} login for too long; starting with the current copy`);
+					return this.adopt(snapshot, envelope);
+				}
+				if (!announced) {
+					this.o.log(`waiting for another sandbox to finish refreshing the ${this.o.adapter.label} login…`);
+					announced = true;
+				}
+				await this.o.sleep(DEFAULTS.waitPollMs);
+				continue;
+			}
+			const until = now + this.o.claimTtlMs;
+			const claimed = {
+				...envelope,
+				claim: {
+					holder: this.o.holder,
+					until: new Date(until).toISOString()
+				}
+			};
+			const written = await this.o.store.write(encodeAgentLoginEnvelope(claimed), snapshot.version);
+			if (!written.ok) continue;
+			this.claimUntil = until;
+			return this.adopt({
+				version: written.version,
+				value: encodeAgentLoginEnvelope(claimed)
+			}, claimed);
+		}
+	}
+	adopt(snapshot, envelope) {
+		this.version = snapshot.version;
+		this.envelope = envelope;
+		this.synced = envelope.content;
+	}
+	decode(value) {
+		const envelope = decodeAgentLoginEnvelope(value);
+		if (!envelope) throw new Error(`${this.o.secretName} is not a managed agent login — store one with \`seekrit agent-login ${this.o.adapter.id}\``);
+		if (envelope.agent !== this.o.adapter.id) throw new Error(`${this.o.secretName} holds a ${ADAPTERS[envelope.agent].label} login, not ${this.o.adapter.label}`);
+		return envelope;
+	}
+	isDue(content, now) {
+		const expiresAt = this.o.adapter.expiresAt(content);
+		return expiresAt !== null && now >= expiresAt - 3e5;
+	}
+	/** Push the local file to seekrit if the agent changed it. */
+	async syncUp() {
+		const local = readIfExists(this.o.path);
+		if (local === null) {
+			if (!this.warnedMissing) {
+				this.o.log(`${this.o.path} was removed; the login in seekrit is left as it is`);
+				this.warnedMissing = true;
+			}
+			return;
+		}
+		if (local === this.synced) return;
+		if (this.o.adapter.problem(local) !== null) return;
+		for (let attempt = 0; attempt < 5; attempt++) {
+			const next = {
+				kind: AGENT_LOGIN_KIND,
+				agent: this.o.adapter.id,
+				content: local,
+				savedAt: new Date(this.o.now()).toISOString(),
+				claim: null
+			};
+			const written = await this.o.store.write(encodeAgentLoginEnvelope(next), this.version);
+			if (written.ok) {
+				this.version = written.version;
+				this.envelope = next;
+				this.synced = local;
+				this.claimUntil = null;
+				this.o.log(`saved the refreshed ${this.o.adapter.label} login to seekrit (v${written.version})`);
+				return;
+			}
+			const snapshot = await this.o.store.read();
+			if (!snapshot) throw new Error(`${this.o.secretName} was deleted while the agent was running`);
+			const remote = this.decode(snapshot.value);
+			if (remote.content === local) {
+				this.adopt(snapshot, remote);
+				return;
+			}
+			if (this.fresher(local, remote.content)) {
+				this.version = snapshot.version;
+				continue;
+			}
+			writeAtomic(this.o.path, remote.content);
+			this.adopt(snapshot, remote);
+			this.o.log(`another sandbox refreshed the ${this.o.adapter.label} login at the same moment; switched to its copy. If ${this.o.adapter.label} reports a sign-in error, run \`seekrit agent-login ${this.o.adapter.id}\` again.`);
+			return;
+		}
+		throw new Error("the stored login kept changing under us");
+	}
+	/** Whether login `a` was refreshed after `b` (later expiry wins; unknown loses). */
+	fresher(a, b) {
+		return (this.o.adapter.expiresAt(a) ?? Number.NEGATIVE_INFINITY) > (this.o.adapter.expiresAt(b) ?? Number.NEGATIVE_INFINITY);
+	}
+	remotePollDue() {
+		const now = this.o.now();
+		const expiresAt = this.o.adapter.expiresAt(this.synced);
+		const dueAt = expiresAt === null ? null : expiresAt - REFRESH_LEAD_MS;
+		const every = dueAt !== null && now >= dueAt - HOT_BEFORE_MS && now <= dueAt + HOT_AFTER_MS ? this.o.hotRemotePollMs : this.o.idleRemotePollMs;
+		return now - this.lastRemotePoll >= every;
+	}
+	/** Bring a newer copy from seekrit onto disk, so the agent adopts it before refreshing. */
+	async syncDown() {
+		const snapshot = await this.o.store.read();
+		if (!snapshot || snapshot.version === this.version) return;
+		const remote = this.decode(snapshot.value);
+		const local = readIfExists(this.o.path);
+		if (local !== null && local !== this.synced) return;
+		if (remote.content !== this.synced && !this.fresher(this.synced, remote.content)) {
+			writeAtomic(this.o.path, remote.content);
+			this.o.log(`picked up a ${this.o.adapter.label} login another sandbox refreshed`);
+		}
+		if (remote.claim?.holder !== this.o.holder) this.claimUntil = null;
+		this.adopt(snapshot, remote);
+	}
+	/** A claim whose agent never refreshed is let go, so waiting siblings stop waiting. */
+	async expireClaim() {
+		if (this.claimUntil === null || this.o.now() < this.claimUntil) return;
+		await this.releaseClaim();
+		this.o.log(`${this.o.adapter.label} did not refresh its login yet. If it reports a sign-in error, run \`seekrit agent-login ${this.o.adapter.id}\` again.`);
+	}
+	async releaseClaim() {
+		if (this.claimUntil === null || !this.envelope) return;
+		this.claimUntil = null;
+		if (this.envelope.claim?.holder !== this.o.holder) return;
+		const released = {
+			...this.envelope,
+			claim: null
+		};
+		const written = await this.o.store.write(encodeAgentLoginEnvelope(released), this.version);
+		if (written.ok) {
+			this.version = written.version;
+			this.envelope = released;
+		}
+	}
+	/**
+	* Refuse to replace a login seekrit did not put there. On a laptop that is
+	* somebody's personal sign-in, and on a sandbox image it is a decision
+	* someone else made; either way overwriting it is not ours to do.
+	*/
+	guardUnmanaged() {
+		if (existsSync(this.o.path) && !existsSync(this.markerPath)) throw new Error(`${this.o.path} already holds a ${this.o.adapter.label} login that seekrit did not put there — move it aside (or sign out) and run again; seekrit will not overwrite a login it does not manage`);
+	}
+	readMarker() {
+		const raw = readIfExists(this.markerPath);
+		if (raw === null) return null;
+		const parsed = parseObject(raw);
+		const holders = Array.isArray(parsed?.holders) ? parsed.holders.filter((pid) => Number.isInteger(pid)) : [];
+		return {
+			agent: this.o.adapter.id,
+			secret: this.o.secretName,
+			holders
+		};
+	}
+	writeMarker(holders) {
+		const marker = {
+			agent: this.o.adapter.id,
+			secret: this.o.secretName,
+			holders
+		};
+		writeAtomic(this.markerPath, `${JSON.stringify(marker, null, 2)}\n`);
+	}
+	/** Several runs on one machine can share a home; the last one out cleans up. */
+	registerHolder() {
+		const live = (this.readMarker()?.holders ?? []).filter((pid) => pid !== this.o.pid && this.o.isAlive(pid));
+		this.writeMarker([...live, this.o.pid]);
+	}
+	unregisterHolder() {
+		const others = (this.readMarker()?.holders ?? []).filter((pid) => pid !== this.o.pid && this.o.isAlive(pid));
+		if (others.length > 0) {
+			this.writeMarker(others);
+			return;
+		}
+		rmSync(this.o.path, { force: true });
+		rmSync(this.markerPath, { force: true });
+	}
+};
+function message$1(err) {
+	return err instanceof Error ? err.message : String(err);
 }
-/**
-* `allow` is the field where empty means the **opposite** — no secret may be
-* injected toward this host at all (`Decision::SecretNotAllowed` for every name;
-* see `crates/seekrit-core/src/policy.rs`). Such a rule is useful and
-* intentional: it permits the *request* while granting no credential, which is
-* how you let an agent read a public API through the proxy without handing it a
-* key. Rendering that as `any` would invert the meaning of the one column an
-* operator reviews most carefully, so it gets its own function.
-*/
-function describeSecrets(values) {
-	return values.length === 0 ? "none" : values.join(" ");
+/** Parse `--agent-login codex` / `--agent-login claude=MY_SECRET`. */
+function parseAgentLoginFlag(raw) {
+	const eq = raw.indexOf("=");
+	const adapter = adapterFor((eq === -1 ? raw : raw.slice(0, eq)).trim());
+	const secretName = eq === -1 ? adapter.defaultSecret : raw.slice(eq + 1).trim();
+	if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(secretName)) throw new Error(`--agent-login ${raw}: "${secretName}" is not a valid secret name`);
+	return {
+		adapter,
+		secretName
+	};
 }
+// src/changes.ts
 /**
-* The third convention, and the one most likely to be misread: **no ports means
-* HTTPS on 443**, not any port. A blank or `any` here would say the opposite of
-* what the proxy enforces, so the default is spelled out.
+* Change requests: the review queue in front of protected environments, and the
+* protection settings that create it.
+*
+* Reviewing here is keyless by construction — a change request carries
+* ciphertext, so the CLI can show a reviewer *what* is changing and who
+* proposed it without ever holding a DEK. `seekrit changes show` therefore
+* prints no value, and deliberately does not offer to.
 */
-function describePorts(rule) {
-	return describePolicyPorts(rule) ?? "https:443";
-}
-function printRules(rules) {
-	printTable(rules.map((rule, i) => ({
-		n: i + 1,
-		rule
-	})), [
-		col("#", (r) => r.n),
-		col("host", (r) => r.rule.host),
-		col("ports", (r) => describePorts(r.rule)),
-		col("methods", (r) => describeList(r.rule.methods)),
-		col("paths", (r) => describeList(r.rule.paths)),
-		col("secrets", (r) => describeSecrets(r.rule.allow)),
-		col("label", (r) => r.rule.label ?? "-")
-	], "no rules — this policy denies every request");
-}
-/** One rule as a single line, for the publish diff. */
-function ruleLine(rule) {
-	const ports = describePolicyPorts(rule);
-	const parts = [
-		ports ? `${rule.host} [${ports}]` : rule.host,
-		describeList(rule.methods),
-		describeList(rule.paths),
-		`secrets=${describeSecrets(rule.allow)}`
-	];
-	return rule.label ? `${parts.join(" ")}  (${rule.label})` : parts.join(" ");
-}
-/**
-* The change a publish would make. Rules are compared by *position* because
-* order decides — first match wins — so a reordering is a real change and shows
-* up as one.
-*/
-function printPolicyDiff(before, after) {
-	const changes = diffPolicyRules(before, after).filter((c) => c.kind !== "unchanged");
-	if (changes.length === 0) {
-		console.error(after.length === 0 ? "no rules — this policy denies every request" : "no rule changes — publishing would only extend the expiry");
-		return;
-	}
-	for (const change of changes) {
-		const n = change.index + 1;
-		if (change.kind === "added") console.log(`+ ${n}  ${ruleLine(change.after)}`);
-		else if (change.kind === "removed") console.log(`- ${n}  ${ruleLine(change.before)}`);
-		else {
-			console.log(`- ${n}  ${ruleLine(change.before)}`);
-			console.log(`+ ${n}  ${ruleLine(change.after)}`);
-		}
-	}
-}
-/** Seconds until an ISO instant, or a negative number when it has passed. */
-function secondsUntil(iso) {
-	return Math.round((new Date(iso).getTime() - Date.now()) / 1e3);
-}
-/** Collect a repeated `--scope NAME` into a list. */
-function collectScope(value, acc = []) {
-	acc.push(value);
-	return acc;
-}
-/**
-* A task's state, derived rather than stored: `revoked` beats `expired`, so a run
-* somebody killed does not read as one that merely lapsed.
-*
-* Exported for its own test — it mirrors `taskState` in
-* `apps/api/src/lib/agent-tasks.ts`, and the two disagreeing would mean the list
-* screen and the enforcement point describe the same run differently.
-*/
-function taskStateOf(task, now) {
-	if (task.revokedAt) return "revoked";
-	return Date.parse(task.expiresAt) <= now ? "expired" : "active";
-}
-/**
-* A detail view on **stderr**, so a command whose stdout is a credential can
-* still explain itself to a person without corrupting `$(…)`.
-*/
-function printFieldsToStderr(fields) {
-	const present = fields.filter(([, value]) => value !== null && value !== void 0);
-	const width = Math.max(...present.map(([label]) => label.length));
-	for (const [label, value] of present) console.error(`${label.padEnd(width)}  ${value}`);
-}
-/**
-* Exported for its own test: the expired branch is the one that must be loud.
-*
-* The granularity has to span both users of this — a policy bundle lasting a
-* week and a task lasting fifteen minutes. Rounding a task to the nearest hour
-* printed "in 0h", which is worse than no estimate at all.
-*/
-function describeExpiry(iso) {
-	const seconds = secondsUntil(iso);
-	if (seconds <= 0) return `${iso} (EXPIRED — proxies for this agent fail closed)`;
-	const days = Math.floor(seconds / 86400);
-	const hours = Math.floor(seconds % 86400 / 3600);
-	const minutes = Math.floor(seconds % 3600 / 60);
-	if (days > 0) return `${iso} (in ${days}d ${hours}h)`;
-	if (hours > 0) return `${iso} (in ${hours}h ${minutes}m)`;
-	if (minutes > 0) return `${iso} (in ${minutes}m)`;
-	return `${iso} (in ${seconds}s)`;
-}
-function registerAgentCommands(program) {
-	const agents = program.command("agents").description("agent access policy — which agent may reach which upstream with which secret");
-	agents.command("list", { isDefault: true }).description("list agent identities").option("--org <slug>", "organization").option("--json", "machine-readable output").action(async (options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const { agents: rows } = await ctx.client.listAgents(org.id);
-		emit(options, { agents: rows }, () => printTable(rows, [
-			col("slug", (a) => a.slug),
-			col("name", (a) => a.name),
-			col("policy", (a) => a.currentPolicyVersion === 0 ? "none" : `v${a.currentPolicyVersion}`),
-			col("enabled", (a) => a.enabled ? "yes" : "no"),
-			col("last fetch", (a) => a.lastPolicyFetchAt ?? "never")
-		], "no agent identities — create one with `seekrit agents create`"));
-	});
-	agents.command("create <name>").description("create an agent identity (a policy subject; it holds no key material)").requiredOption("--slug <slug>", "short name a proxy config and a ticket refer to").option("--org <slug>", "organization").option("--app <slug>", "application, when scoping the agent to one environment").option("--env <slug>", "environment whose secret names its rules may reference").option("--json", "machine-readable output").action(async (name, options) => {
+function registerChangeCommands(program) {
+	const changes = program.command("changes").description("review changes queued for protected environments");
+	changes.command("list", { isDefault: true }).alias("ls").description("list change requests awaiting review").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--status <status>", `filter by status (${CHANGE_REQUEST_STATUSES.join(", ")})`, "open").option("--all", "every status, not just open").option("--limit <n>", "entries to show (max 200)", "50").option("--json", "print the raw API response").action(async (options) => {
 		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const environmentId = options.env ? (await resolveAppEnv(ctx, {
-			org: options.org,
-			app: options.app,
-			env: options.env
-		})).envId : void 0;
-		const { agent } = await ctx.client.createAgent(org.id, {
-			name,
-			slug: options.slug,
-			...environmentId ? { environmentId } : {}
+		const ref = await resolveOrg(ctx, options.org);
+		const status = options.all ? void 0 : parseStatus(options.status);
+		const limit = Number(options.limit);
+		if (!Number.isInteger(limit) || limit < 1) fail("--limit must be a positive whole number");
+		const { changeRequests } = await ctx.client.listChangeRequests(ref.id, {
+			status,
+			limit: Math.min(limit, 200)
 		});
-		emit(options, { agent }, () => {
-			console.error(`created ${agent.slug} — no policy published yet, so any proxy for it fails closed`);
-			console.error(`next: seekrit agents policy publish ${agent.slug} -f rules.json`);
+		emit(options, { changeRequests }, () => {
+			printTable(changeRequests, [
+				col("id", (r) => r.id),
+				col("change", (r) => describeChange(r.kind, r.secretName, r.restoreFromVersion)),
+				col("status", (r) => r.status),
+				col("proposed by", (r) => `${r.requestedByType}:${r.requestedById}`),
+				col("when", (r) => r.createdAt)
+			], options.all ? "no change requests" : "nothing waiting for review");
 		});
 	});
-	agents.command("show <ref>").description("an identity and its live rules").option("--org <slug>", "organization").option("--json", "machine-readable output").action(async (ref, options) => {
+	changes.command("show <id>").description("show one change request and its reviews (never its value)").option("--org <slug>", "organization slug").option("--json", "print the raw API response").action(async (id, options) => {
 		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const agent = await resolveAgent(ctx, org.id, ref);
-		const { environment } = await ctx.client.getAgent(org.id, agent.id);
-		const live = await loadVersion(ctx, org.id, agent);
+		const ref = await resolveOrg(ctx, options.org);
+		const { changeRequest, reviews } = await ctx.client.getChangeRequest(ref.id, id);
 		emit(options, {
-			agent,
-			environment,
-			policy: live
+			changeRequest,
+			reviews
 		}, () => {
 			printFields([
-				["name", agent.name],
-				["slug", agent.slug],
-				["id", agent.id],
-				["environment", environment ? environment.slug : "any in the org"],
-				["enabled", agent.enabled ? "yes" : "no"],
-				["policy", live ? `v${live.version}` : "none published"],
-				["signer", live?.signerThumbprint],
-				["expires", live ? describeExpiry(live.expiresAt) : void 0],
-				["last fetch", agent.lastPolicyFetchAt ?? "never"]
+				["id", changeRequest.id],
+				["change", describeChange(changeRequest.kind, changeRequest.secretName, changeRequest.restoreFromVersion)],
+				["environment", changeRequest.environmentId],
+				["status", changeRequest.status],
+				["base version", changeRequest.baseVersion ?? "(new secret)"],
+				["approvals needed", changeRequest.requiredApprovals],
+				["proposed by", `${changeRequest.requestedByType}:${changeRequest.requestedById}`],
+				["note", changeRequest.note ?? "-"]
 			]);
-			if (live) {
-				section(`rules (v${live.version})`);
-				printRules(live.rules);
-				section("hosts a forward proxy would intercept");
-				console.log(policyHosts(live.rules).join("\n") || "none");
-			}
+			section("reviews");
+			printTable(reviews, [
+				col("decision", (r) => r.decision),
+				col("reviewer", (r) => r.reviewerId ?? "(removed)"),
+				col("comment", (r) => r.comment ?? "-"),
+				col("when", (r) => r.createdAt)
+			], "no reviews yet");
 		});
 	});
-	agents.command("disable <ref>").description("stop serving this identity's policy (the revocation path)").option("--org <slug>", "organization").option("-y, --yes", "skip the confirmation").action(async (ref, options) => {
+	changes.command("approve <id>").description("approve a queued change (applies it once it has enough approvals)").option("--org <slug>", "organization slug").option("-m, --comment <text>", "note recorded with your approval").option("--json", "print the raw API response").action(async (id, options) => {
 		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const agent = await resolveAgent(ctx, org.id, ref);
-		await confirmDestructive(options.yes, `Disable ${agent.slug}? Running proxies keep their current bundle until it expires.`);
-		await ctx.client.updateAgent(org.id, agent.id, { enabled: false });
-		console.error(`${agent.slug} disabled — its next policy refresh is refused`);
+		const ref = await resolveOrg(ctx, options.org);
+		const result = await ctx.client.approveChangeRequest(ref.id, id, options.comment);
+		emit(options, result, () => {
+			if (result.status === "applied") console.error(`approved and applied${result.version ? ` as v${result.version}` : ""}`);
+			else if (result.status === "superseded") console.error(`not applied: ${result.reason ?? "the secret has changed since"}`);
+			else console.error(`approved — ${result.approvals ?? 0}/${result.required ?? "?"} approvals`);
+		});
 	});
-	agents.command("enable <ref>").description("serve this identity's policy again").option("--org <slug>", "organization").action(async (ref, options) => {
+	changes.command("reject <id>").description("reject a queued change").option("--org <slug>", "organization slug").option("-m, --comment <text>", "note recorded with your rejection").option("--json", "print the raw API response").action(async (id, options) => {
 		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const agent = await resolveAgent(ctx, org.id, ref);
-		await ctx.client.updateAgent(org.id, agent.id, { enabled: true });
-		console.error(`${agent.slug} enabled`);
+		const ref = await resolveOrg(ctx, options.org);
+		emit(options, await ctx.client.rejectChangeRequest(ref.id, id, options.comment), () => console.error("rejected"));
 	});
-	agents.command("rm <ref>").description("delete an identity and its published history").option("--org <slug>", "organization").option("-y, --yes", "skip the confirmation").action(async (ref, options) => {
+	changes.command("withdraw <id>").description("take your own queued change off the review queue").option("--org <slug>", "organization slug").option("--json", "print the raw API response").action(async (id, options) => {
 		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const agent = await resolveAgent(ctx, org.id, ref);
-		await confirmDestructive(options.yes, `Delete ${agent.slug} and all ${agent.currentPolicyVersion} published version(s)? The audit_log rows survive.`);
-		await ctx.client.deleteAgent(org.id, agent.id);
-		console.error(`${agent.slug} deleted`);
+		const ref = await resolveOrg(ctx, options.org);
+		emit(options, await ctx.client.withdrawChangeRequest(ref.id, id), () => console.error("withdrawn"));
 	});
-	/**
-	* The trust anchor. This prints a *public* key fingerprint — the security of
-	* pinning comes from the operator putting it in a local file the API cannot
-	* reach, not from this command being honest. Which is why it prints the TOML
-	* line to paste rather than offering to write the config.
-	*/
-	agents.command("signer").description("your policy signing thumbprint, to pin in a proxy config").option("--org <slug>", "organization").option("--json", "machine-readable output").action(async (options) => {
+	const protection = changes.command("protection").description("require review before an environment's secrets change");
+	protection.command("show", { isDefault: true }).description("show whether an environment is protected").option("--org <slug>", "organization slug").option("--app <slug>", "application slug").option("--group <slug>", "group slug (instead of --app)").option("--env <slug>", "environment slug").option("--json", "print the raw API response").action(async (options) => {
 		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const { signer } = await ctx.client.getMyPolicySigner(org.id);
-		if (!signer) fail("your account has no keypair yet — run `seekrit keys setup`");
-		emit(options, { signer }, () => {
-			printFields([["thumbprint", signer.thumbprint], ["user", signer.userId]]);
-			section("pin it in seekrit-proxy.toml");
-			console.log("[policy]");
-			console.log(`signers = ["${signer.thumbprint}"]`);
-			console.error("");
-			console.error("pin a second admin's key too — one pinned signer means one lost passphrase leaves nobody able to publish");
+		const { orgId, envId, label } = await resolveEnvTarget(ctx, options);
+		const result = await ctx.client.getEnvironmentProtection(orgId, envId);
+		emit(options, result, () => {
+			if (!result.protection) {
+				console.log(`${label}: unprotected — writes land immediately`);
+				return;
+			}
+			printFields([
+				["environment", label],
+				["approvals required", result.protection.requiredApprovals],
+				["self-approval", result.protection.allowSelfApproval ? "allowed" : "not allowed"],
+				["waiting for review", result.openChangeRequests]
+			]);
 		});
 	});
-	/**
-	* The token is printed to **stdout** and everything else to stderr, so the
-	* common thing works without parsing:
-	*
-	*   TASK=$(seekrit agents dispatch nova --scope GITHUB_TOKEN --ttl 15m)
-	*
-	* It is shown exactly once. The API stores only a hash, so a lost token cannot
-	* be recovered — dispatch another and revoke the first.
-	*/
-	agents.command("dispatch <ref>").description("mint task-scoped authority for one agent run").option("--scope <NAME>", "narrow this run to one secret (repeatable)", collectScope).option("--ttl <duration>", "how long the run stays authorized (e.g. 15m, 2h)").option("--label <text>", "what this run is for — recorded in the audit trail").option("--json", "machine-readable output (includes the token)").action(async (ref, options) => {
+	protection.command("on").description("require approval before secrets in this environment change").option("--org <slug>", "organization slug").option("--app <slug>", "application slug").option("--group <slug>", "group slug (instead of --app)").option("--env <slug>", "environment slug").option("--approvals <n>", "approvals a change needs", "1").option("--allow-self-approval", "let the proposer's own approval count").option("--json", "print the raw API response").action(async (options) => {
 		const ctx = buildContext();
-		const ttlSeconds = options.ttl ? parseDurationSeconds(options.ttl, "--ttl") : 900;
-		if (ttlSeconds < 60 || ttlSeconds > 43200) fail(`--ttl must be between 60s and ${TASK_MAX_TTL_SECONDS / 3600}h`);
-		const minted = await createAgentTaskToken();
-		const { task, header } = await ctx.client.dispatchAgentTask(ref, {
-			taskRef: minted.taskRef,
-			tokenHash: minted.tokenHash,
-			ttlSeconds,
-			...options.scope ? { scopes: options.scope } : {},
-			...options.label ? { label: options.label } : {}
-		});
-		if (options.json) {
-			console.log(JSON.stringify({
-				task,
-				header,
-				token: minted.token
-			}, null, 2));
-			return;
-		}
-		console.log(minted.token);
-		printFieldsToStderr([
-			["task", task.id],
-			["agent", ref],
-			["scopes", task.scopes ? describeSecrets(task.scopes) : "the agent's full policy"],
-			["policy", `v${task.policyVersion}`],
-			["expires", describeExpiry(task.expiresAt)],
-			["header", header]
-		]);
-	});
-	agents.command("tasks <ref>").description("runs dispatched for an agent identity, newest first").option("--org <slug>", "organization").option("--all", "include expired and revoked runs").option("--json", "machine-readable output").action(async (ref, options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const agent = await resolveAgent(ctx, org.id, ref);
-		const { tasks } = await ctx.client.listAgentTasks(org.id, agent.id);
-		const now = Date.now();
-		const rows = options.all ? tasks : tasks.filter((t) => taskStateOf(t, now) === "active");
-		emit(options, { tasks: rows }, () => printTable(rows, [
-			col("task", (t) => t.id),
-			col("state", (t) => taskStateOf(t, now)),
-			col("scopes", (t) => t.scopes ? describeSecrets(t.scopes) : "policy"),
-			col("policy", (t) => `v${t.policyVersion}`),
-			col("expires", (t) => t.expiresAt),
-			col("last seen", (t) => t.lastSeenAt ?? "never"),
-			col("label", (t) => t.label ?? "-")
-		], options.all ? "no runs dispatched yet" : "no live runs (try --all)"));
-	});
-	agents.command("revoke <taskId>").description("end a run's authority now").action(async (taskId) => {
-		const { task } = await buildContext().client.revokeAgentTask(taskId);
-		console.error(`${task.id} revoked — enforcement points refuse it at their next introspection`);
+		const { orgId, envId, label } = await resolveEnvTarget(ctx, options);
+		const requiredApprovals = Number(options.approvals);
+		if (!Number.isInteger(requiredApprovals) || requiredApprovals < 1) fail("--approvals must be a positive whole number");
+		emit(options, await ctx.client.setEnvironmentProtection(orgId, envId, {
+			requiredApprovals,
+			allowSelfApproval: options.allowSelfApproval ?? false
+		}), () => console.error(`${label} now requires ${requiredApprovals} approval${requiredApprovals === 1 ? "" : "s"} before a secret changes`));
 	});
-	registerPolicyCommands(agents.command("policy").description("published policy versions (`seekrit agents policy --help`)"));
-	agents.command("activity <ref>").description("what this agent actually did — aggregate decisions, not a request log").option("--days <n>", "how far back to look (1–90)", "14").option("--org <slug>", "organization").option("--json", "machine-readable output").action(async (ref, options) => {
+	protection.command("off").description("stop requiring approval (queued changes stay queued)").option("--org <slug>", "organization slug").option("--app <slug>", "application slug").option("--group <slug>", "group slug (instead of --app)").option("--env <slug>", "environment slug").option("--json", "print the raw API response").action(async (options) => {
 		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const agent = await resolveAgent(ctx, org.id, ref);
-		const days = Number(options.days ?? 14);
-		if (!Number.isInteger(days) || days < 1 || days > 90) fail("--days must be 1–90");
-		const { activity, summary } = await ctx.client.getAgentActivity(org.id, agent.id, days);
-		emit(options, {
-			activity,
-			summary
-		}, () => {
-			printFields([
-				["window", `${days}d`],
-				["allowed", summary.allowed],
-				["denied", summary.denied],
-				["hosts", summary.hosts],
-				["earliest", summary.from ?? "no activity reported"]
-			]);
-			if (activity.length === 0) {
-				console.error("");
-				console.error("nothing reported — add an [activity] block to the proxy (`seekrit proxy init --activity`)");
-				return;
-			}
-			section("decisions");
-			printTable(activity, [
-				col("host", (a) => a.host),
-				col("method", (a) => a.method),
-				col("decision", (a) => a.decision),
-				col("rule", (a) => a.ruleIndex === null ? "-" : String(a.ruleIndex + 1)),
-				col("count", (a) => a.count),
-				col("secrets", (a) => a.secrets ? Object.entries(a.secrets).map(([name, n]) => `${name}×${n}`).join(" ") : "-")
-			]);
-		});
+		const { orgId, envId, label } = await resolveEnvTarget(ctx, options);
+		emit(options, await ctx.client.deleteEnvironmentProtection(orgId, envId), () => console.error(`${label} no longer requires approval — writes land immediately`));
 	});
+}
+function parseStatus(raw) {
+	if (!raw) return void 0;
+	if (!CHANGE_REQUEST_STATUSES.includes(raw)) fail(`unknown status "${raw}" — one of ${CHANGE_REQUEST_STATUSES.join(", ")}`);
+	return raw;
+}
+/**
+* Report a write that was queued instead of performed. Every write path calls
+* this: a CLI that printed "set FOO" for a change nobody has approved would be
+* telling the operator the deploy is ready when it is not.
+*/
+function reportQueued(cr) {
+	console.error(`queued for review: ${describeChange(cr.kind, cr.secretName, cr.restoreFromVersion)} — needs ${cr.requiredApprovals} approval${cr.requiredApprovals === 1 ? "" : "s"} (${cr.id})`);
+}
+/** Domain separators — must match `crates/seekrit-cache`. */
+const KEY_DOMAIN = "seekrit-lkg-cache-v1";
+const TOKEN_DOMAIN = "seekrit-token-fp-v1";
+/** 24h: long enough to ride out an outage, short enough to bound the tail. */
+const DEFAULT_MAX_AGE_MS = 864e5;
+/**
+* Derive the key for one resolve request. Overrides are sorted, so flag order
+* never splits the cache. Byte-for-byte identical to `CacheKey::new` in
+* `crates/seekrit-cache`.
+*/
+function cacheKey(apiUrl, token, branch, overrides = {}) {
+	const pairs = Object.entries(overrides).map(([group, env]) => `${group}:${env}`).sort();
+	return {
+		key: createHash("sha256").update([
+			KEY_DOMAIN,
+			apiUrl.replace(/\/+$/, ""),
+			token,
+			branch ?? "",
+			pairs.join(",")
+		].join("\n")).digest("hex"),
+		tokenFingerprint: tokenFingerprint(token)
+	};
+}
+/** The hex SHA-256 identifying a token without storing it. */
+function tokenFingerprint(token) {
+	return createHash("sha256").update(`${TOKEN_DOMAIN}\n${token}`).digest("hex");
+}
+/**
+* `$XDG_CACHE_HOME/seekrit`, else `~/.cache/seekrit` — beside the config
+* directory holding the credential, never a shared temp directory.
+*/
+function defaultCacheDir() {
+	return join(process.env.XDG_CACHE_HOME || join(homedir(), ".cache"), "seekrit");
+}
+/** Render an age for a log line, rounded to its largest whole unit. */
+function humanize(ms) {
+	const secs = Math.floor(ms / 1e3);
+	if (secs < 60) return `${secs}s`;
+	if (secs < 3600) return `${Math.floor(secs / 60)}m`;
+	if (secs < 86400) return `${Math.floor(secs / 3600)}h`;
+	return `${Math.floor(secs / 86400)}d`;
+}
+/**
+* Whether a failed resolve means the API was *unreachable* (the cache may stand
+* in) rather than *refusing us* (it must not). A refusal is an answer, and
+* revocation is supposed to take effect the moment it arrives.
+*/
+function mayFallBack(err) {
+	if (err instanceof SeekritApiError) return err.status >= 500 || err.status === 429;
+	return true;
+}
+/** An opened cache, bound to one resolve request. */
+var LkgCache = class {
+	dir;
+	maxAgeMs;
+	id;
+	constructor(id, options = {}) {
+		this.id = id;
+		this.dir = options.dir ?? defaultCacheDir();
+		this.maxAgeMs = options.maxAgeMs ?? 864e5;
+	}
+	path() {
+		return join(this.dir, `${this.id.key}.json`);
+	}
+	read() {
+		const path = this.path();
+		if (!existsSync(path)) return { kind: "missing" };
+		let envelope;
+		try {
+			envelope = JSON.parse(readFileSync(path, "utf8"));
+		} catch (err) {
+			return {
+				kind: "unusable",
+				reason: `corrupt cache entry: ${message(err)}`
+			};
+		}
+		if (envelope.version !== 1) return {
+			kind: "unusable",
+			reason: `cache entry is format v${envelope.version}, this build reads v1`
+		};
+		if (envelope.tokenFingerprint !== this.id.tokenFingerprint) return {
+			kind: "unusable",
+			reason: "cache entry belongs to a different token"
+		};
+		if (typeof envelope.body !== "string") return {
+			kind: "unusable",
+			reason: "cache entry has no body"
+		};
+		const ageMs = Math.max(0, Date.now() - envelope.fetchedAt * 1e3);
+		if (ageMs >= this.maxAgeMs) return {
+			kind: "expired",
+			ageMs
+		};
+		return {
+			kind: "hit",
+			body: envelope.body,
+			ageMs
+		};
+	}
 	/**
-	* The grant review loop. Proposals are computed *here*, from activity the API
-	* served — the API is deliberately not in the business of saying what a policy
-	* should be. And `--out` writes a rule file rather than publishing: the change
-	* still goes through `policy publish`, which still needs a human's key.
+	* Record a freshly-fetched response. Written to a temporary file and renamed,
+	* so a concurrent reader sees either the old entry or the new one — never a
+	* half-written file. Throws only on genuinely unexpected I/O; callers treat a
+	* failed write as a warning, never as a failed resolve.
 	*/
-	agents.command("review <ref>").description("compare published policy against observed activity, and propose changes").option("--days <n>", "how far back to look (1–90)", "14").option("-o, --out <path>", "write the narrowed rules to a file, ready to publish").option("--org <slug>", "organization").option("--json", "machine-readable output").action(async (ref, options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const agent = await resolveAgent(ctx, org.id, ref);
-		const days = Number(options.days ?? 14);
-		if (!Number.isInteger(days) || days < 1 || days > 90) fail("--days must be 1–90");
-		const live = await loadVersion(ctx, org.id, agent);
-		if (!live) fail(`${agent.slug} has no published policy to review`);
-		const { activity, summary } = await ctx.client.getAgentActivity(org.id, agent.id, days);
-		const proposals = reviewPolicy({
-			rules: live.rules,
-			activity
-		});
-		emit(options, {
-			proposals,
-			summary,
-			version: live.version
-		}, () => {
-			console.error(`${agent.slug} — policy v${live.version}, ${summary.allowed + summary.denied} decision(s) over ${days}d`);
-			if (activity.length === 0) {
-				console.error("");
-				console.error("no activity reported yet — nothing to review against");
-				return;
-			}
-			if (proposals.length === 0) {
-				console.error("");
-				console.error("no changes proposed: every rule is in use and nothing was refused");
-				return;
-			}
-			section("proposals");
-			for (const p of proposals) {
-				const marker = p.applicable ? "-" : "?";
-				console.log(`${marker} ${p.rationale}`);
-			}
-			const applicable = countApplicable(proposals);
-			console.error("");
-			console.error(`${applicable} narrowing change(s) can be applied; ${proposals.length - applicable} need a human decision`);
+	write(body) {
+		mkdirSync(this.dir, {
+			recursive: true,
+			mode: 448
 		});
-		if (options.out) {
-			const narrowed = applyProposals(live.rules, proposals);
-			writeFileSync(options.out, `${JSON.stringify({ rules: narrowed }, null, 2)}\n`);
-			console.error(`wrote ${narrowed.length} rule(s) to ${options.out} — review the diff, then: seekrit agents policy publish ${agent.slug} -f ${options.out}`);
-			console.error("widening proposals are never applied: an agent must not earn permissions by retrying");
-		}
-	});
-	agents.command("simulate <ref>").description("ask what a policy would decide, without sending a request").requiredOption("--host <host>", "upstream hostname").requiredOption("--path <path>", "request path").option("--method <method>", "HTTP method", "GET").option("--scheme <scheme>", "https or http, as the agent dials it (forward proxy)", "https").option("--port <n>", "port the agent dials (forward proxy; default 443 for https, 80 for http)").option("--secret <NAME>", "the secret the request would inject").option("--version <n>", "evaluate a specific published version").option("--org <slug>", "organization").option("--json", "machine-readable output").action(async (ref, options) => {
-		const scheme = options.scheme.toLowerCase();
-		if (scheme !== "https" && scheme !== "http") fail("--scheme must be https or http");
-		const port = options.port === void 0 ? scheme === "https" ? 443 : 80 : Number(options.port);
-		if (!Number.isInteger(port) || port < 1 || port > 65535) fail("--port must be 1-65535");
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const agent = await resolveAgent(ctx, org.id, ref);
-		const version = options.version === void 0 ? void 0 : Number(options.version);
-		if (version !== void 0 && !Number.isInteger(version)) fail("--version must be an integer");
-		const published = await loadVersion(ctx, org.id, agent, version);
-		if (!published) fail(`${agent.slug} has no published policy — every request is denied`);
-		const verdict = evaluatePolicy(published.rules, {
-			host: options.host,
-			transport: {
-				scheme,
-				port
-			},
-			method: options.method,
-			path: options.path,
-			...options.secret === void 0 ? {} : { secret: options.secret }
-		});
-		const reason = describePolicyVerdict(verdict, published.rules);
-		emit(options, {
-			version: published.version,
-			verdict,
-			reason
-		}, () => {
-			const target = `${options.method.toUpperCase()} ${scheme}://${options.host}:${port}${options.path}`;
-			console.log(`${verdict.decision === "allow" ? "allow" : "DENY"}  ${target}${options.secret ? ` [${options.secret}]` : ""}`);
-			console.log(`  v${published.version}: ${reason}`);
-		});
-		if (verdict.decision !== "allow") process.exitCode = 1;
-	});
-}
-function registerPolicyCommands(policy) {
-	policy.command("list <ref>").description("published versions, newest first").option("--org <slug>", "organization").option("--json", "machine-readable output").action(async (ref, options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const agent = await resolveAgent(ctx, org.id, ref);
-		const { policies } = await ctx.client.listAgentPolicies(org.id, agent.id);
-		emit(options, { policies }, () => printTable(policies, [
-			col("version", (p) => `v${p.version}`),
-			col("rules", (p) => p.ruleCount),
-			col("signer", (p) => p.signerThumbprint.slice(0, 12)),
-			col("published", (p) => p.publishedAt),
-			col("expires", (p) => secondsUntil(p.expiresAt) <= 0 ? `${p.expiresAt} (expired)` : p.expiresAt),
-			col("note", (p) => p.rolledBackFromVersion ? `restored v${p.rolledBackFromVersion}` : "-")
-		], "nothing published yet"));
-	});
-	policy.command("show <ref>").description("the rules in a published version (live by default)").option("--version <n>", "a specific version").option("--org <slug>", "organization").option("--json", "machine-readable output").action(async (ref, options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const agent = await resolveAgent(ctx, org.id, ref);
-		const version = options.version === void 0 ? void 0 : Number(options.version);
-		if (version !== void 0 && !Number.isInteger(version)) fail("--version must be an integer");
-		const published = await loadVersion(ctx, org.id, agent, version);
-		if (!published) fail(`${agent.slug} has no published policy`);
-		emit(options, { policy: published }, () => {
-			printFields([
-				["version", `v${published.version}`],
-				["signer", published.signerThumbprint],
-				["published", published.publishedAt],
-				["expires", describeExpiry(published.expiresAt)]
-			]);
-			section("rules");
-			printRules(published.rules);
-		});
-	});
-	/**
-	* Write the live rules out as the editable source for the next publish. This
-	* is the half that makes policy-as-code work: what comes back out is exactly
-	* the shape `publish` takes in, so a round trip is a no-op diff.
-	*/
-	policy.command("pull <ref>").description("write a version's rules to a JSON file you can edit and publish").option("-o, --out <path>", "where to write it (default: stdout)").option("--version <n>", "a specific version").option("--org <slug>", "organization").action(async (ref, options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const agent = await resolveAgent(ctx, org.id, ref);
-		const version = options.version === void 0 ? void 0 : Number(options.version);
-		if (version !== void 0 && !Number.isInteger(version)) fail("--version must be an integer");
-		const published = await loadVersion(ctx, org.id, agent, version);
-		const rules = published?.rules ?? [];
-		const body = `${JSON.stringify({ rules }, null, 2)}\n`;
-		if (options.out) {
-			writeFileSync(options.out, body);
-			console.error(published ? `wrote ${rules.length} rule(s) from v${published.version} to ${options.out}` : `wrote an empty rule set to ${options.out} (nothing published yet)`);
-			return;
+		const envelope = {
+			version: 1,
+			fetchedAt: Math.floor(Date.now() / 1e3),
+			tokenFingerprint: this.id.tokenFingerprint,
+			body
+		};
+		const tmp = join(this.dir, `${this.id.key}.${process.pid}.tmp`);
+		try {
+			writeFileSync(tmp, JSON.stringify(envelope), { mode: 384 });
+			renameSync(tmp, this.path());
+		} catch (err) {
+			rmSync(tmp, { force: true });
+			throw err;
 		}
-		process.stdout.write(body);
-	});
-	policy.command("publish <ref>").description("sign a rule file with your own key and publish it").requiredOption("-f, --file <path>", `rule file, or ${STDIN} for stdin`).option("--ttl <duration>", "how long the bundle stays valid (e.g. 7d, 12h)").option("--org <slug>", "organization").option("-y, --yes", "skip the confirmation").option("--json", "machine-readable output").action(async (ref, options) => {
-		const ctx = buildContext();
-		if (isTokenAuth(ctx)) fail("publishing agent policy needs a human's signing key — sign in with `seekrit login`. A service token cannot publish, so an agent cannot widen its own policy.");
-		const org = await resolveOrg(ctx, options.org);
-		const agent = await resolveAgent(ctx, org.id, ref);
-		const ttlSeconds = options.ttl ? parseDurationSeconds(options.ttl, "--ttl") : POLICY_DEFAULT_TTL_SECONDS;
-		if (ttlSeconds < 3600 || ttlSeconds > 7776e3) fail(`--ttl must be between ${POLICY_MIN_TTL_SECONDS / 3600}h and ${POLICY_MAX_TTL_SECONDS / 86400}d`);
-		const { raw, label } = await readRuleSource(options.file);
-		const rules = parseRuleFile(raw, label);
-		const live = await loadVersion(ctx, org.id, agent);
-		const nextVersion = agent.currentPolicyVersion + 1;
-		const from = agent.currentPolicyVersion === 0 ? "nothing" : `v${agent.currentPolicyVersion}`;
-		console.error(`${agent.slug}: ${from} → v${nextVersion}`);
-		printPolicyDiff(live?.rules ?? [], rules);
-		await confirmDestructive(options.yes, `Publish v${nextVersion} for ${agent.slug} (${rules.length} rule(s), valid ${options.ttl ?? "7d"})?`);
-		const { signingKey, jwk } = await getPolicySigner(ctx);
-		const issuedAt = Math.floor(Date.now() / 1e3);
-		const bundle = await signAgentPolicy(signingKey, jwk, {
-			v: policyBundleVersionFor(rules),
-			org: org.id,
-			agent: agent.id,
-			agent_slug: agent.slug,
-			policy_version: nextVersion,
-			issued_at: issuedAt,
-			expires_at: issuedAt + ttlSeconds,
-			rules
-		});
-		const { policy: published } = await ctx.client.publishAgentPolicy(org.id, agent.id, bundle);
-		emit(options, { policy: published }, () => {
-			console.error(`published v${published.version} — signed with ${published.signerThumbprint.slice(0, 12)}…, expires ${published.expiresAt}`);
-			console.error("proxies pick it up at their next refresh");
-		});
-	});
-	policy.command("rollback <ref> <version>").description("republish an earlier version's bundle as the newest one").option("--org <slug>", "organization").option("-y, --yes", "skip the confirmation").action(async (ref, versionArg, options) => {
-		const ctx = buildContext();
-		const org = await resolveOrg(ctx, options.org);
-		const agent = await resolveAgent(ctx, org.id, ref);
-		const version = Number(versionArg);
-		if (!Number.isInteger(version) || version < 1) fail("version must be a positive integer");
-		const source = await loadVersion(ctx, org.id, agent, version);
-		if (!source) fail(`no version ${version}`);
-		if (secondsUntil(source.expiresAt) <= 0) fail(`v${version} expired at ${source.expiresAt} — a rollback keeps the original expiry, so it would be inert. Publish the rules again instead: seekrit agents policy pull ${agent.slug} --version ${version} -o rules.json`);
-		await confirmDestructive(options.yes, `Roll ${agent.slug} back to v${version} (${source.ruleCount} rule(s))?`);
-		const { policy: published } = await ctx.client.rollbackAgentPolicy(org.id, agent.id, version);
-		console.error(`published v${published.version} carrying v${version}'s bundle`);
-	});
+		this.pruneExpired();
+	}
+	/** Drop this entry — used when the API refuses the token. */
+	invalidate() {
+		rmSync(this.path(), { force: true });
+	}
 	/**
-	* What a proxy actually gets. Useful when a deployment misbehaves and the
-	* question is whether the API, the pin, or the rules are at fault — so it
-	* re-derives the thumbprint from the bundle rather than reporting the one the
-	* API sends beside it, and says plainly when the two disagree.
+	* Delete entries past their usefulness (a rotated token or a changed
+	* `--with` leaves one nothing will read again). Best-effort and silent, and
+	* it only ever touches files this cache named: `<64 hex>.json`.
 	*/
-	policy.command("fetch <ref>").description("the bundle a proxy would fetch, with its signer re-derived locally").option("--bundle", "print the raw ap1. envelope and nothing else").option("--json", "machine-readable output").action(async (ref, options) => {
-		const fetched = await buildContext().client.getAgentPolicyBundle(ref);
-		if (options.bundle) {
-			process.stdout.write(`${fetched.bundle}\n`);
+	pruneExpired() {
+		let names;
+		try {
+			names = readdirSync(this.dir);
+		} catch {
 			return;
 		}
-		const body = parseAgentPolicyUnverified(fetched.bundle);
-		const derived = await policySignerThumbprint(body.signer.jwk);
-		emit(options, {
-			...fetched,
-			derivedThumbprint: derived,
-			rules: body.rules
-		}, () => {
-			printFields([
-				["agent", `${fetched.agent.slug} (${fetched.agent.name})`],
-				["version", `v${fetched.version}`],
-				["expires", describeExpiry(fetched.expiresAt)],
-				["signer (in bundle)", derived],
-				["signer (reported)", fetched.signerThumbprint === derived ? "matches" : `${fetched.signerThumbprint} — DOES NOT MATCH the bundle; a proxy would refuse this`]
-			]);
-			section("rules");
-			printRules(body.rules);
-			console.error("");
-			console.error("this command does not verify the signature — only a pinned signer list can, which lives in the proxy's own config");
-		});
-	});
+		for (const name of names) {
+			if (!/^[0-9a-f]{64}\.json$/.test(name)) continue;
+			const path = join(this.dir, name);
+			let expired = true;
+			try {
+				const envelope = JSON.parse(readFileSync(path, "utf8"));
+				expired = Math.max(0, Date.now() - envelope.fetchedAt * 1e3) >= this.maxAgeMs;
+			} catch {}
+			if (expired) rmSync(path, { force: true });
+		}
+	}
+};
+function message(err) {
+	return err instanceof Error ? err.message : String(err);
 }
-/** Domain separators — must match `crates/seekrit-cache`. */
-const KEY_DOMAIN = "seekrit-lkg-cache-v1";
-const TOKEN_DOMAIN = "seekrit-token-fp-v1";
-/** 24h: long enough to ride out an outage, short enough to bound the tail. */
-const DEFAULT_MAX_AGE_MS = 864e5;
 /**
-* Derive the key for one resolve request. Overrides are sorted, so flag order
-* never splits the cache. Byte-for-byte identical to `CacheKey::new` in
-* `crates/seekrit-cache`.
+* Fetch + decrypt every secret in a single environment.
+*
+* `${OTHER_SECRET}` references are expanded (see `@seekrit/core`'s
+* `interpolate`) unless `raw` is set. Only this environment's own secrets are in
+* scope here — a reference to a secret inherited from a composed group is left
+* literal, because the group layers aren't fetched. `materializeEnv` is the
+* fully-layered view.
 */
-function cacheKey(apiUrl, token, branch, overrides = {}) {
-	const pairs = Object.entries(overrides).map(([group, env]) => `${group}:${env}`).sort();
-	return {
-		key: createHash("sha256").update([
-			KEY_DOMAIN,
-			apiUrl.replace(/\/+$/, ""),
-			token,
-			branch ?? "",
-			pairs.join(",")
-		].join("\n")).digest("hex"),
-		tokenFingerprint: tokenFingerprint(token)
-	};
-}
-/** The hex SHA-256 identifying a token without storing it. */
-function tokenFingerprint(token) {
-	return createHash("sha256").update(`${TOKEN_DOMAIN}\n${token}`).digest("hex");
+async function fetchDecryptedSecrets(ctx, orgId, envId, opts = {}) {
+	const [dek, { secrets }] = await Promise.all([getDek(ctx, orgId, envId), ctx.client.listSecrets(orgId, envId)]);
+	const entries = await Promise.all(secrets.map(async (secret) => [secret.name, await decryptSecret(dek, secret.ciphertext, secretAad(envId, secret.name))]));
+	return interpolateValues(Object.fromEntries(entries), !opts.raw).values;
 }
 /**
-* `$XDG_CACHE_HOME/seekrit`, else `~/.cache/seekrit` — beside the config
-* directory holding the credential, never a shared temp directory.
-*/
-function defaultCacheDir() {
-	return join(process.env.XDG_CACHE_HOME || join(homedir(), ".cache"), "seekrit");
-}
-/** Render an age for a log line, rounded to its largest whole unit. */
-function humanize(ms) {
-	const secs = Math.floor(ms / 1e3);
-	if (secs < 60) return `${secs}s`;
-	if (secs < 3600) return `${Math.floor(secs / 60)}m`;
-	if (secs < 86400) return `${Math.floor(secs / 3600)}h`;
-	return `${Math.floor(secs / 86400)}d`;
-}
-/**
-* Whether a failed resolve means the API was *unreachable* (the cache may stand
-* in) rather than *refusing us* (it must not). A refusal is an answer, and
-* revocation is supposed to take effect the moment it arrives.
-*/
-function mayFallBack(err) {
-	if (err instanceof SeekritApiError) return err.status >= 500 || err.status === 429;
-	return true;
-}
-/** An opened cache, bound to one resolve request. */
-var LkgCache = class {
-	dir;
-	maxAgeMs;
-	id;
-	constructor(id, options = {}) {
-		this.id = id;
-		this.dir = options.dir ?? defaultCacheDir();
-		this.maxAgeMs = options.maxAgeMs ?? 864e5;
-	}
-	path() {
-		return join(this.dir, `${this.id.key}.json`);
-	}
-	read() {
-		const path = this.path();
-		if (!existsSync(path)) return { kind: "missing" };
-		let envelope;
-		try {
-			envelope = JSON.parse(readFileSync(path, "utf8"));
-		} catch (err) {
-			return {
-				kind: "unusable",
-				reason: `corrupt cache entry: ${message(err)}`
-			};
-		}
-		if (envelope.version !== 1) return {
-			kind: "unusable",
-			reason: `cache entry is format v${envelope.version}, this build reads v1`
-		};
-		if (envelope.tokenFingerprint !== this.id.tokenFingerprint) return {
-			kind: "unusable",
-			reason: "cache entry belongs to a different token"
-		};
-		if (typeof envelope.body !== "string") return {
-			kind: "unusable",
-			reason: "cache entry has no body"
-		};
-		const ageMs = Math.max(0, Date.now() - envelope.fetchedAt * 1e3);
-		if (ageMs >= this.maxAgeMs) return {
-			kind: "expired",
-			ageMs
-		};
-		return {
-			kind: "hit",
-			body: envelope.body,
-			ageMs
-		};
-	}
-	/**
-	* Record a freshly-fetched response. Written to a temporary file and renamed,
-	* so a concurrent reader sees either the old entry or the new one — never a
-	* half-written file. Throws only on genuinely unexpected I/O; callers treat a
-	* failed write as a warning, never as a failed resolve.
-	*/
-	write(body) {
-		mkdirSync(this.dir, {
-			recursive: true,
-			mode: 448
-		});
-		const envelope = {
-			version: 1,
-			fetchedAt: Math.floor(Date.now() / 1e3),
-			tokenFingerprint: this.id.tokenFingerprint,
-			body
-		};
-		const tmp = join(this.dir, `${this.id.key}.${process.pid}.tmp`);
-		try {
-			writeFileSync(tmp, JSON.stringify(envelope), { mode: 384 });
-			renameSync(tmp, this.path());
-		} catch (err) {
-			rmSync(tmp, { force: true });
-			throw err;
-		}
-		this.pruneExpired();
-	}
-	/** Drop this entry — used when the API refuses the token. */
-	invalidate() {
-		rmSync(this.path(), { force: true });
-	}
-	/**
-	* Delete entries past their usefulness (a rotated token or a changed
-	* `--with` leaves one nothing will read again). Best-effort and silent, and
-	* it only ever touches files this cache named: `<64 hex>.json`.
-	*/
-	pruneExpired() {
-		let names;
-		try {
-			names = readdirSync(this.dir);
-		} catch {
-			return;
-		}
-		for (const name of names) {
-			if (!/^[0-9a-f]{64}\.json$/.test(name)) continue;
-			const path = join(this.dir, name);
-			let expired = true;
-			try {
-				const envelope = JSON.parse(readFileSync(path, "utf8"));
-				expired = Math.max(0, Date.now() - envelope.fetchedAt * 1e3) >= this.maxAgeMs;
-			} catch {}
-			if (expired) rmSync(path, { force: true });
-		}
-	}
-};
-function message(err) {
-	return err instanceof Error ? err.message : String(err);
-}
-/**
-* Fetch + decrypt every secret in a single environment.
-*
-* `${OTHER_SECRET}` references are expanded (see `@seekrit/core`'s
-* `interpolate`) unless `raw` is set. Only this environment's own secrets are in
-* scope here — a reference to a secret inherited from a composed group is left
-* literal, because the group layers aren't fetched. `materializeEnv` is the
-* fully-layered view.
-*/
-async function fetchDecryptedSecrets(ctx, orgId, envId, opts = {}) {
-	const [dek, { secrets }] = await Promise.all([getDek(ctx, orgId, envId), ctx.client.listSecrets(orgId, envId)]);
-	const entries = await Promise.all(secrets.map(async (secret) => [secret.name, await decryptSecret(dek, secret.ciphertext, secretAad(envId, secret.name))]));
-	return interpolateValues(Object.fromEntries(entries), !opts.raw).values;
-}
-/**
-* Expand `${OTHER_SECRET}` references in a merged variable set. A cycle becomes
-* the CLI's standard fatal exit — it is a config bug with no correct value to
-* emit. Pass `enabled: false` (`--no-interpolate`) to hand the set back as-is.
+* Expand `${OTHER_SECRET}` references in a merged variable set. A cycle becomes
+* the CLI's standard fatal exit — it is a config bug with no correct value to
+* emit. Pass `enabled: false` (`--no-interpolate`) to hand the set back as-is.
 */
 function interpolateValues(values, enabled = true) {
 	if (!enabled) return {
@@ -8320,6 +8392,7 @@ async function materializeEnv(ctx, opts) {
 	const privateKey = await getPrivateKey(ctx);
 	const values = {};
 	const provenance = {};
+	const origin = {};
 	for (const layer of layers) {
 		const dek = await unwrapDek(layer.wrappedDek, privateKey);
 		let label;
@@ -8329,14 +8402,32 @@ async function materializeEnv(ctx, opts) {
 		for (const secret of layer.secrets) {
 			values[secret.name] = await decryptSecret(dek, secret.ciphertext, secretAad(layer.environmentId, secret.name));
 			provenance[secret.name] = label;
+			origin[secret.name] = {
+				envId: layer.environmentId,
+				dek
+			};
 		}
 	}
+	const agentLogins = {};
+	for (const [name, value] of Object.entries(values)) {
+		const from = origin[name];
+		if (!from || !isAgentLoginValue(value)) continue;
+		agentLogins[name] = {
+			orgId: scope.orgId,
+			envId: from.envId,
+			dek: from.dek,
+			value
+		};
+		delete values[name];
+		delete provenance[name];
+	}
 	const loadedEnvFiles = overlayEnvFiles(values, provenance, opts.envFiles);
 	return {
 		...interpolateValues(values, opts.interpolate !== false),
 		provenance,
 		scope,
-		loadedEnvFiles
+		loadedEnvFiles,
+		agentLogins
 	};
 }
 /**
@@ -8368,50 +8459,962 @@ async function resolveWithCache(ctx, query, cache) {
 			warn(`${errorMessage(err)} — using cached secrets fetched ${humanize(found.ageMs)} ago`);
 			return JSON.parse(found.body);
 		}
-		if (found.kind === "expired") warn(`cached secrets are ${humanize(found.ageMs)} old, past --cache-max-age`);
-		else if (found.kind === "unusable") warn(`ignoring the cached secrets: ${found.reason}`);
-		throw err;
-	}
-}
-function warn(text) {
-	process.stderr.write(`seekrit: ${text}\n`);
-}
-function errorMessage(err) {
-	return err instanceof Error ? err.message : String(err);
-}
-/**
-* Overlay `.env` files onto an existing value/provenance set (later files win).
-* Missing files are skipped. Returns the files that were actually loaded. Used
-* both by {@link materializeEnv} and by `seekrit run`'s degraded path, where
-* managed secrets are unavailable but `.env` should still apply.
-*/
-function overlayEnvFiles(values, provenance, envFiles) {
-	const loaded = [];
-	for (const file of envFiles) {
-		if (!existsSync(file)) continue;
-		loaded.push(file);
-		for (const [name, value] of Object.entries(parseDotenv(readFileSync(file, "utf8")))) {
-			values[name] = value;
-			provenance[name] = `dotenv:${file}`;
+		if (found.kind === "expired") warn(`cached secrets are ${humanize(found.ageMs)} old, past --cache-max-age`);
+		else if (found.kind === "unusable") warn(`ignoring the cached secrets: ${found.reason}`);
+		throw err;
+	}
+}
+function warn(text) {
+	process.stderr.write(`seekrit: ${text}\n`);
+}
+function errorMessage(err) {
+	return err instanceof Error ? err.message : String(err);
+}
+/**
+* Overlay `.env` files onto an existing value/provenance set (later files win).
+* Missing files are skipped. Returns the files that were actually loaded. Used
+* both by {@link materializeEnv} and by `seekrit run`'s degraded path, where
+* managed secrets are unavailable but `.env` should still apply.
+*/
+function overlayEnvFiles(values, provenance, envFiles) {
+	const loaded = [];
+	for (const file of envFiles) {
+		if (!existsSync(file)) continue;
+		loaded.push(file);
+		for (const [name, value] of Object.entries(parseDotenv(readFileSync(file, "utf8")))) {
+			values[name] = value;
+			provenance[name] = `dotenv:${file}`;
+		}
+	}
+	return loaded;
+}
+/**
+* Print a name → source table to stderr (never the secret values). Names whose
+* value had references expanded are marked, and dangling references are called
+* out afterwards — a typo'd `${NAME}` is otherwise invisible, since it is
+* deliberately passed through as literal text.
+*/
+function printExplain(provenance, refs = {}) {
+	const interpolated = new Set(refs.interpolated ?? []);
+	const names = Object.keys(provenance).sort();
+	const width = names.reduce((w, n) => Math.max(w, n.length), 0);
+	for (const name of names) {
+		const marker = interpolated.has(name) ? "  (interpolated)" : "";
+		process.stderr.write(`${name.padEnd(width)}  ${provenance[name]}${marker}\n`);
+	}
+	if (refs.unresolved?.length) process.stderr.write(`\nunresolved reference(s), left as literal text: ${refs.unresolved.join(", ")}\n`);
+}
+// src/agent-login-command.ts
+/**
+* `seekrit agent-login …` and the `seekrit run --agent-login` wiring: the CLI
+* and network half of managed agent logins. The coordination logic — claims,
+* write-back, pick-up — is transport-free in `agent-login.ts`; this file gives
+* it a seekrit secret to work against and a command line to be driven from.
+*/
+/** The variable Claude Code reads a `claude setup-token` token from. */
+const CLAUDE_TOKEN_VAR = AGENT_LOGIN_SECRETS.claudeToken;
+/**
+* One secret, read and written through the API with the environment's data key
+* held in memory. `read` takes the newest version from the history endpoint,
+* which is the only read that names a version — and the version is what a
+* compare-and-swap is conditioned on.
+*/
+var SecretLoginStore = class {
+	ctx;
+	orgId;
+	envId;
+	name;
+	dek;
+	constructor(ctx, orgId, envId, name, dek) {
+		this.ctx = ctx;
+		this.orgId = orgId;
+		this.envId = envId;
+		this.name = name;
+		this.dek = dek;
+	}
+	async read() {
+		try {
+			const { versions } = await this.ctx.client.listSecretVersions(this.orgId, this.envId, this.name, { limit: 1 });
+			const newest = versions[0];
+			if (!newest) return null;
+			const value = await decryptSecret(this.dek, newest.ciphertext, secretAad(this.envId, this.name));
+			return {
+				version: newest.version,
+				value
+			};
+		} catch (err) {
+			if (err instanceof SeekritApiError && err.status === 404) return null;
+			throw err;
+		}
+	}
+	async write(value, expectedVersion) {
+		const ciphertext = await encryptSecret(this.dek, value, secretAad(this.envId, this.name));
+		try {
+			const result = await this.ctx.client.setSecret(this.orgId, this.envId, this.name, ciphertext, void 0, { expectedVersion });
+			if (result.queued) throw new Error(`${this.name} is in an environment that requires review for every write`);
+			return {
+				ok: true,
+				version: result.secret.version
+			};
+		} catch (err) {
+			if (err instanceof SeekritApiError && err.status === 412) return { ok: false };
+			throw err;
+		}
+	}
+};
+/**
+* A login has to be written back the moment it refreshes, so it cannot live in
+* an environment where every write waits for a reviewer: the refresh would sit
+* in a change request while the old token is already spent. Refuse up front,
+* rather than opening a change request per refresh.
+*/
+async function assertWritable(ctx, orgId, envId, label) {
+	let protectedEnv = false;
+	try {
+		protectedEnv = (await ctx.client.getEnvironmentProtection(orgId, envId)).protection !== null;
+	} catch {}
+	if (protectedEnv) fail(`${label} requires review for every write, so a refreshed login could never be saved back — keep agent logins in an environment without approvals`);
+}
+/**
+* Turn the `--agent-login` flags of one `seekrit run` into sessions, against
+* the logins the resolve found. Fails before anything is launched when a login
+* is missing, so an agent never starts half signed in.
+*/
+async function prepareAgentLogins(requests, found, ctx, scopeLabel) {
+	const seen = /* @__PURE__ */ new Set();
+	const ready = [];
+	for (const request of requests) {
+		if (seen.has(request.adapter.id)) fail(`--agent-login ${request.adapter.id} given twice`);
+		seen.add(request.adapter.id);
+		if (!ctx) fail(`--agent-login ${request.adapter.id} needs seekrit, which could not be reached (see above)`);
+		const login = found[request.secretName];
+		if (!login) fail(`no ${request.adapter.label} login named ${request.secretName} in ${scopeLabel} — sign in once with \`seekrit agent-login ${request.adapter.id}\``);
+		const envelope = decodeAgentLoginEnvelope(login.value);
+		if (envelope && envelope.agent !== request.adapter.id) fail(`${request.secretName} holds a ${envelope.agent} login, not ${request.adapter.id}`);
+		await assertWritable(ctx, login.orgId, login.envId, request.secretName);
+		if (request.adapter.id === "claude" && process.platform === "darwin") process.stderr.write("seekrit: Claude Code on macOS reads its login from the Keychain, not ~/.claude/.credentials.json — --agent-login claude takes effect on Linux (sandboxes, containers, CI)\n");
+		ready.push({
+			...request,
+			login
+		});
+	}
+	return (env) => ready.map(({ adapter, secretName, login }) => new AgentLoginSession({
+		adapter,
+		secretName,
+		path: adapter.loginPath(env),
+		store: new SecretLoginStore(ctx, login.orgId, login.envId, secretName, login.dek)
+	}));
+}
+function withTargetFlags(cmd) {
+	return cmd.option("--org <slug>", "organization slug").option("--app <slug>", "application slug (defaults to seekrit.json)").option("--group <slug>", "target a group environment instead of an app").option("--env <slug>", "environment slug (a service token infers its own)");
+}
+/** Fail with the reason a file is not a login this agent can use. */
+function readLoginFile(adapter, path) {
+	if (!existsSync(path)) fail(`no such file: ${path}`);
+	const content = readFileSync(path, "utf8");
+	const problem = adapter.problem(content);
+	if (problem) fail(`${path} is not a usable ${adapter.label} login: ${problem}`);
+	return content;
+}
+/** Encrypt a login file into its envelope and store it in the target environment. */
+async function storeLoginFile(ctx, target, adapter, name, content) {
+	await assertWritable(ctx, target.orgId, target.envId, target.label);
+	const envelope = encodeAgentLoginEnvelope({
+		agent: adapter.id,
+		content,
+		savedAt: (/* @__PURE__ */ new Date()).toISOString(),
+		claim: null
+	});
+	const queued = await encryptAndSetSecret(ctx, target.orgId, target.envId, name, envelope);
+	if (queued) {
+		reportQueued(queued);
+		fail(`${target.label} requires review for every write — keep agent logins elsewhere`);
+	}
+	console.error(`stored the ${adapter.label} login in ${target.label} as ${name}`);
+}
+/** After `--from`: the source and the stored copy share one refresh token. */
+function finishFrom(adapter, from, move) {
+	if (move) {
+		rmSync(from, { force: true });
+		console.error(`removed ${from}`);
+		return;
+	}
+	console.error(`warning: ${from} and the copy in seekrit share one refresh token — whichever refreshes first signs the other out. Delete it (or re-run with --move), or sign in fresh with \`seekrit agent-login ${adapter.id}\`.`);
+}
+function requireBinary(bin, install) {
+	if (spawnSync(bin, ["--version"], { stdio: "ignore" }).error) fail(`\`${bin}\` is not installed (${install})`);
+}
+function usage(adapter, name) {
+	return `run it anywhere with: seekrit run --agent-login ${name === adapter.defaultSecret ? adapter.id : `${adapter.id}=${name}`} -- ${adapter.id === "codex" ? "codex exec \"…\"" : "claude -p \"…\""}`;
+}
+function registerAgentLoginCommands(program) {
+	const group = program.command("agent-login").description("keep a coding agent's own sign-in (Codex, Claude Code) in seekrit, so every sandbox starts signed in");
+	withTargetFlags(group.command("codex").description("sign Codex in once and store the login (refreshes are saved back on every run)").option("--name <secret>", "secret to store it under", codexAdapter.defaultSecret).option("--device-auth", "sign in with a device code (on a machine with no browser)").option("--from <path>", "store an existing auth.json instead of signing in").option("--move", "with --from: delete the file once it is stored")).action(async (options) => {
+		const adapter = codexAdapter;
+		const name = options.name ?? adapter.defaultSecret;
+		const ctx = buildContext();
+		const target = await resolveEnvTarget(ctx, options);
+		await assertWritable(ctx, target.orgId, target.envId, target.label);
+		let content;
+		if (options.from) content = readLoginFile(adapter, options.from);
+		else {
+			requireBinary("codex", "npm i -g @openai/codex");
+			const home = mkdtempSync(join(tmpdir(), "seekrit-codex-"));
+			try {
+				const args = [
+					"login",
+					"-c",
+					"cli_auth_credentials_store=\"file\""
+				];
+				if (options.deviceAuth) args.push("--device-auth");
+				if (spawnSync("codex", args, {
+					stdio: "inherit",
+					env: {
+						...process.env,
+						CODEX_HOME: home
+					}
+				}).status !== 0) fail("`codex login` did not complete — nothing was stored");
+				content = readLoginFile(adapter, join(home, "auth.json"));
+			} finally {
+				rmSync(home, {
+					recursive: true,
+					force: true
+				});
+			}
+		}
+		await storeLoginFile(ctx, target, adapter, name, content);
+		if (options.from) finishFrom(adapter, options.from, options.move);
+		console.error(usage(adapter, name));
+	});
+	withTargetFlags(group.command("claude").description("store a long-lived Claude Code token (`claude setup-token`), or a full login with --from").option("--name <secret>", `secret to store it under (default ${CLAUDE_TOKEN_VAR}, or ${claudeAdapter.defaultSecret} with --from)`).option("--token-stdin", "read the token from stdin instead of running `claude setup-token`").option("--from <path>", "store a full login (.credentials.json) instead — refreshes are saved back on every run").option("--move", "with --from: delete the file once it is stored")).action(async (options) => {
+		const ctx = buildContext();
+		const target = await resolveEnvTarget(ctx, options);
+		if (options.from) {
+			const adapter = claudeAdapter;
+			const name = options.name ?? adapter.defaultSecret;
+			await storeLoginFile(ctx, target, adapter, name, readLoginFile(adapter, options.from));
+			finishFrom(adapter, options.from, options.move);
+			console.error(usage(adapter, name));
+			return;
+		}
+		const name = options.name ?? CLAUDE_TOKEN_VAR;
+		let token;
+		if (options.tokenStdin) token = (await readStdin()).trim();
+		else {
+			requireBinary("claude", "https://claude.com/claude-code");
+			if (!process.stdin.isTTY) fail("pasting the token needs a terminal — pipe it in with --token-stdin instead");
+			if (spawnSync("claude", ["setup-token"], { stdio: "inherit" }).status !== 0) fail("`claude setup-token` did not complete — nothing was stored");
+			token = (await promptHidden("Paste the token `claude setup-token` printed: ")).trim();
+		}
+		const problem = claudeTokenProblem(token);
+		if (problem) fail(`${problem} — nothing was stored`);
+		const queued = await encryptAndSetSecret(ctx, target.orgId, target.envId, name, token);
+		if (queued) {
+			reportQueued(queued);
+			return;
+		}
+		console.error(`stored the Claude Code token in ${target.label} as ${name}`);
+		console.error(name === CLAUDE_TOKEN_VAR ? "run it anywhere with: seekrit run -- claude -p \"…\"" : `Claude Code reads ${CLAUDE_TOKEN_VAR}; name the secret that, or map it in your environment`);
+	});
+	withTargetFlags(group.command("status").description("show the agent logins stored in an environment and when each next refreshes").option("--json", "print as JSON (metadata only — never tokens)")).action(async (options) => {
+		const ctx = buildContext();
+		const target = await resolveEnvTarget(ctx, options);
+		const [{ secrets }, dek] = await Promise.all([ctx.client.listSecrets(target.orgId, target.envId), getDek(ctx, target.orgId, target.envId)]);
+		const now = Date.now();
+		const rows = [];
+		for (const secret of secrets) {
+			if (secret.name === CLAUDE_TOKEN_VAR) {
+				rows.push({
+					name: secret.name,
+					agent: "claude",
+					kind: "long-lived token",
+					version: secret.version,
+					accessExpires: null,
+					refreshing: false,
+					updatedAt: secret.updatedAt
+				});
+				continue;
+			}
+			const envelope = decodeAgentLoginEnvelope(await decryptSecret(dek, secret.ciphertext, secretAad(target.envId, secret.name)));
+			if (!envelope) continue;
+			const expires = (envelope.agent === "codex" ? codexAdapter : claudeAdapter).expiresAt(envelope.content);
+			rows.push({
+				name: secret.name,
+				agent: envelope.agent,
+				kind: "login file",
+				version: secret.version,
+				accessExpires: expires === null ? null : new Date(expires).toISOString(),
+				refreshing: envelope.claim !== null && Date.parse(envelope.claim.until) > now,
+				updatedAt: secret.updatedAt
+			});
+		}
+		emit(options, { logins: rows }, () => printTable(rows, [
+			col("name", (r) => r.name),
+			col("agent", (r) => r.agent),
+			col("kind", (r) => r.kind),
+			col("version", (r) => `v${r.version}`),
+			col("next refresh", (r) => {
+				if (r.refreshing) return "refreshing now";
+				if (r.accessExpires === null) return "never";
+				const due = Date.parse(r.accessExpires) - REFRESH_LEAD_MS;
+				return due <= now ? "on next run" : new Date(due).toISOString();
+			})
+		], `no agent logins in ${target.label} — add one with \`seekrit agent-login codex\` or \`seekrit agent-login claude\``));
+	});
+}
+// src/agents.ts
+/**
+* Agent access governance from the CLI.
+*
+* Policy lived only in the dashboard until now, which was backwards: the people
+* deploying agents work in a terminal and a repo, and a rule set is exactly the
+* kind of thing that wants review and version control. So the loop this module
+* exists for is:
+*
+*   seekrit agents policy pull nova -o nova.policy.json   # current rules
+*   $EDITOR nova.policy.json                              # commit it, review it
+*   seekrit agents policy publish nova -f nova.policy.json
+*
+* **Signing still happens here, on this machine, with the operator's own key**
+* (`getPolicySigner` in `context.ts`), so nothing about the trust argument in
+* `docs/agent-access-governance.md` §1 changes: the API receives an opaque
+* envelope it cannot forge, and a proxy verifies it against thumbprints pinned in
+* its own local file. A service token is refused — an agent that can publish its
+* own policy is not governed by it.
+*
+* Everything else here is read-only, and two commands are deliberately *local*
+* evaluations rather than API calls:
+*
+* - `simulate` runs `evaluatePolicy` from `@seekrit/core`, the mirror of
+*   `RuleSet::decide` in the proxy — so a dry run and a real refusal give the
+*   same verdict in the same words.
+* - `fetch` asks for the bytes a proxy would get (`GET /v1/agents/:ref/policy`)
+*   and re-derives the signer thumbprint from the bundle itself, rather than
+*   trusting the field the API echoes beside it.
+*/
+/** How many published versions the API returns per page. */
+const POLICY_PAGE = 50;
+/** The `-` sentinel every other seekrit command uses to mean stdin. */
+const STDIN = "-";
+/**
+* Resolve `nova`, or `agt_…`, to an identity.
+*
+* The org-scoped API routes take an id, but nobody types ids — so a slug is
+* resolved from the list. The list is small (agents are a per-deployment thing,
+* not a per-request one), which is why this costs one request rather than
+* needing a lookup route.
+*/
+async function resolveAgent(ctx, orgId, ref) {
+	const { agents } = await ctx.client.listAgents(orgId);
+	const found = agents.find((a) => a.slug === ref || a.id === ref);
+	if (!found) {
+		const known = agents.map((a) => a.slug).join(", ");
+		fail(`no agent "${ref}"${known ? ` — this org has: ${known}` : " in this org"}`);
+	}
+	return found;
+}
+/**
+* One published version: the newest by default, or an explicit `--version`.
+*
+* An agent with no published policy is a real state, not an error — a proxy for
+* it fails closed — so the caller decides how to report it.
+*/
+async function loadVersion(ctx, orgId, agent, version) {
+	const { policies } = await ctx.client.listAgentPolicies(orgId, agent.id);
+	if (version === void 0) return policies[0] ?? null;
+	const found = policies.find((p) => p.version === version);
+	if (!found) fail(policies.length >= POLICY_PAGE ? `no version ${version} in the last ${POLICY_PAGE} published` : `no version ${version} — published: ${policies.map((p) => p.version).join(", ") || "none"}`);
+	return found;
+}
+/**
+* Read a rule file: either a bare array or `{ "rules": [...] }`, from a path or
+* stdin. Both shapes are accepted because `policy pull` writes the second and
+* hand-written files tend to be the first.
+*
+* Validation is the same zod schema the API and the dashboard use, so a file
+* rejected here would have been rejected there — before anything is signed.
+*
+* Exported for its own test: this is the one place a hand-written file meets the
+* schema, and its error messages are the whole user experience of a typo.
+*/
+function parseRuleFile(raw, source) {
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch (err) {
+		fail(`${source} is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	const list = Array.isArray(parsed) ? parsed : parsed?.rules === void 0 ? fail(`${source} must be a JSON array of rules, or an object with a "rules" array`) : parsed.rules;
+	if (!Array.isArray(list)) fail(`${source}: "rules" must be an array`);
+	if (list.length === 0) console.error(`note: ${source} has no rules — publishing it denies every request`);
+	return list.map((rule, i) => {
+		const result = agentPolicyRuleSchema.safeParse(rule);
+		if (!result.success) {
+			const first = result.error.issues[0];
+			fail(`${source}: rule ${i + 1} is invalid — ${first?.path.join(".") || "rule"}: ${first?.message ?? "unknown error"}`);
+		}
+		return result.data;
+	});
+}
+/** `--file path` or `--file -`. */
+async function readRuleSource(file) {
+	if (file === STDIN) return {
+		raw: await readStdin(),
+		label: "stdin"
+	};
+	try {
+		return {
+			raw: readFileSync(file, "utf8"),
+			label: file
+		};
+	} catch (err) {
+		return fail(`cannot read ${file}: ${err instanceof Error ? err.message : String(err)}`);
+	}
+}
+/**
+* An empty `methods` or `paths` list means *any*: those fields narrow a rule that
+* already matched its host, so absent means unconstrained. A blank column would
+* read as the opposite, so it renders as `any`.
+*
+* Exported for its own test — this is a real invariant of the format, not a
+* cosmetic choice.
+*/
+function describeList(values) {
+	return values.length === 0 ? "any" : values.join(" ");
+}
+/**
+* `allow` is the field where empty means the **opposite** — no secret may be
+* injected toward this host at all (`Decision::SecretNotAllowed` for every name;
+* see `crates/seekrit-core/src/policy.rs`). Such a rule is useful and
+* intentional: it permits the *request* while granting no credential, which is
+* how you let an agent read a public API through the proxy without handing it a
+* key. Rendering that as `any` would invert the meaning of the one column an
+* operator reviews most carefully, so it gets its own function.
+*/
+function describeSecrets(values) {
+	return values.length === 0 ? "none" : values.join(" ");
+}
+/**
+* The third convention, and the one most likely to be misread: **no ports means
+* HTTPS on 443**, not any port. A blank or `any` here would say the opposite of
+* what the proxy enforces, so the default is spelled out.
+*/
+function describePorts(rule) {
+	return describePolicyPorts(rule) ?? "https:443";
+}
+function printRules(rules) {
+	printTable(rules.map((rule, i) => ({
+		n: i + 1,
+		rule
+	})), [
+		col("#", (r) => r.n),
+		col("host", (r) => r.rule.host),
+		col("ports", (r) => describePorts(r.rule)),
+		col("methods", (r) => describeList(r.rule.methods)),
+		col("paths", (r) => describeList(r.rule.paths)),
+		col("secrets", (r) => describeSecrets(r.rule.allow)),
+		col("label", (r) => r.rule.label ?? "-")
+	], "no rules — this policy denies every request");
+}
+/** One rule as a single line, for the publish diff. */
+function ruleLine(rule) {
+	const ports = describePolicyPorts(rule);
+	const parts = [
+		ports ? `${rule.host} [${ports}]` : rule.host,
+		describeList(rule.methods),
+		describeList(rule.paths),
+		`secrets=${describeSecrets(rule.allow)}`
+	];
+	return rule.label ? `${parts.join(" ")}  (${rule.label})` : parts.join(" ");
+}
+/**
+* The change a publish would make. Rules are compared by *position* because
+* order decides — first match wins — so a reordering is a real change and shows
+* up as one.
+*/
+function printPolicyDiff(before, after) {
+	const changes = diffPolicyRules(before, after).filter((c) => c.kind !== "unchanged");
+	if (changes.length === 0) {
+		console.error(after.length === 0 ? "no rules — this policy denies every request" : "no rule changes — publishing would only extend the expiry");
+		return;
+	}
+	for (const change of changes) {
+		const n = change.index + 1;
+		if (change.kind === "added") console.log(`+ ${n}  ${ruleLine(change.after)}`);
+		else if (change.kind === "removed") console.log(`- ${n}  ${ruleLine(change.before)}`);
+		else {
+			console.log(`- ${n}  ${ruleLine(change.before)}`);
+			console.log(`+ ${n}  ${ruleLine(change.after)}`);
+		}
+	}
+}
+/** Seconds until an ISO instant, or a negative number when it has passed. */
+function secondsUntil(iso) {
+	return Math.round((new Date(iso).getTime() - Date.now()) / 1e3);
+}
+/** Collect a repeated `--scope NAME` into a list. */
+function collectScope(value, acc = []) {
+	acc.push(value);
+	return acc;
+}
+/**
+* A task's state, derived rather than stored: `revoked` beats `expired`, so a run
+* somebody killed does not read as one that merely lapsed.
+*
+* Exported for its own test — it mirrors `taskState` in
+* `apps/api/src/lib/agent-tasks.ts`, and the two disagreeing would mean the list
+* screen and the enforcement point describe the same run differently.
+*/
+function taskStateOf(task, now) {
+	if (task.revokedAt) return "revoked";
+	return Date.parse(task.expiresAt) <= now ? "expired" : "active";
+}
+/**
+* A detail view on **stderr**, so a command whose stdout is a credential can
+* still explain itself to a person without corrupting `$(…)`.
+*/
+function printFieldsToStderr(fields) {
+	const present = fields.filter(([, value]) => value !== null && value !== void 0);
+	const width = Math.max(...present.map(([label]) => label.length));
+	for (const [label, value] of present) console.error(`${label.padEnd(width)}  ${value}`);
+}
+/**
+* Exported for its own test: the expired branch is the one that must be loud.
+*
+* The granularity has to span both users of this — a policy bundle lasting a
+* week and a task lasting fifteen minutes. Rounding a task to the nearest hour
+* printed "in 0h", which is worse than no estimate at all.
+*/
+function describeExpiry(iso) {
+	const seconds = secondsUntil(iso);
+	if (seconds <= 0) return `${iso} (EXPIRED — proxies for this agent fail closed)`;
+	const days = Math.floor(seconds / 86400);
+	const hours = Math.floor(seconds % 86400 / 3600);
+	const minutes = Math.floor(seconds % 3600 / 60);
+	if (days > 0) return `${iso} (in ${days}d ${hours}h)`;
+	if (hours > 0) return `${iso} (in ${hours}h ${minutes}m)`;
+	if (minutes > 0) return `${iso} (in ${minutes}m)`;
+	return `${iso} (in ${seconds}s)`;
+}
+function registerAgentCommands(program) {
+	const agents = program.command("agents").description("agent access policy — which agent may reach which upstream with which secret");
+	agents.command("list", { isDefault: true }).description("list agent identities").option("--org <slug>", "organization").option("--json", "machine-readable output").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { agents: rows } = await ctx.client.listAgents(org.id);
+		emit(options, { agents: rows }, () => printTable(rows, [
+			col("slug", (a) => a.slug),
+			col("name", (a) => a.name),
+			col("policy", (a) => a.currentPolicyVersion === 0 ? "none" : `v${a.currentPolicyVersion}`),
+			col("enabled", (a) => a.enabled ? "yes" : "no"),
+			col("last fetch", (a) => a.lastPolicyFetchAt ?? "never")
+		], "no agent identities — create one with `seekrit agents create`"));
+	});
+	agents.command("create <name>").description("create an agent identity (a policy subject; it holds no key material)").requiredOption("--slug <slug>", "short name a proxy config and a ticket refer to").option("--org <slug>", "organization").option("--app <slug>", "application, when scoping the agent to one environment").option("--env <slug>", "environment whose secret names its rules may reference").option("--json", "machine-readable output").action(async (name, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const environmentId = options.env ? (await resolveAppEnv(ctx, {
+			org: options.org,
+			app: options.app,
+			env: options.env
+		})).envId : void 0;
+		const { agent } = await ctx.client.createAgent(org.id, {
+			name,
+			slug: options.slug,
+			...environmentId ? { environmentId } : {}
+		});
+		emit(options, { agent }, () => {
+			console.error(`created ${agent.slug} — no policy published yet, so any proxy for it fails closed`);
+			console.error(`next: seekrit agents policy publish ${agent.slug} -f rules.json`);
+		});
+	});
+	agents.command("show <ref>").description("an identity and its live rules").option("--org <slug>", "organization").option("--json", "machine-readable output").action(async (ref, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const agent = await resolveAgent(ctx, org.id, ref);
+		const { environment } = await ctx.client.getAgent(org.id, agent.id);
+		const live = await loadVersion(ctx, org.id, agent);
+		emit(options, {
+			agent,
+			environment,
+			policy: live
+		}, () => {
+			printFields([
+				["name", agent.name],
+				["slug", agent.slug],
+				["id", agent.id],
+				["environment", environment ? environment.slug : "any in the org"],
+				["enabled", agent.enabled ? "yes" : "no"],
+				["policy", live ? `v${live.version}` : "none published"],
+				["signer", live?.signerThumbprint],
+				["expires", live ? describeExpiry(live.expiresAt) : void 0],
+				["last fetch", agent.lastPolicyFetchAt ?? "never"]
+			]);
+			if (live) {
+				section(`rules (v${live.version})`);
+				printRules(live.rules);
+				section("hosts a forward proxy would intercept");
+				console.log(policyHosts(live.rules).join("\n") || "none");
+			}
+		});
+	});
+	agents.command("disable <ref>").description("stop serving this identity's policy (the revocation path)").option("--org <slug>", "organization").option("-y, --yes", "skip the confirmation").action(async (ref, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const agent = await resolveAgent(ctx, org.id, ref);
+		await confirmDestructive(options.yes, `Disable ${agent.slug}? Running proxies keep their current bundle until it expires.`);
+		await ctx.client.updateAgent(org.id, agent.id, { enabled: false });
+		console.error(`${agent.slug} disabled — its next policy refresh is refused`);
+	});
+	agents.command("enable <ref>").description("serve this identity's policy again").option("--org <slug>", "organization").action(async (ref, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const agent = await resolveAgent(ctx, org.id, ref);
+		await ctx.client.updateAgent(org.id, agent.id, { enabled: true });
+		console.error(`${agent.slug} enabled`);
+	});
+	agents.command("rm <ref>").description("delete an identity and its published history").option("--org <slug>", "organization").option("-y, --yes", "skip the confirmation").action(async (ref, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const agent = await resolveAgent(ctx, org.id, ref);
+		await confirmDestructive(options.yes, `Delete ${agent.slug} and all ${agent.currentPolicyVersion} published version(s)? The audit_log rows survive.`);
+		await ctx.client.deleteAgent(org.id, agent.id);
+		console.error(`${agent.slug} deleted`);
+	});
+	/**
+	* The trust anchor. This prints a *public* key fingerprint — the security of
+	* pinning comes from the operator putting it in a local file the API cannot
+	* reach, not from this command being honest. Which is why it prints the TOML
+	* line to paste rather than offering to write the config.
+	*/
+	agents.command("signer").description("your policy signing thumbprint, to pin in a proxy config").option("--org <slug>", "organization").option("--json", "machine-readable output").action(async (options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const { signer } = await ctx.client.getMyPolicySigner(org.id);
+		if (!signer) fail("your account has no keypair yet — run `seekrit keys setup`");
+		emit(options, { signer }, () => {
+			printFields([["thumbprint", signer.thumbprint], ["user", signer.userId]]);
+			section("pin it in seekrit-proxy.toml");
+			console.log("[policy]");
+			console.log(`signers = ["${signer.thumbprint}"]`);
+			console.error("");
+			console.error("pin a second admin's key too — one pinned signer means one lost passphrase leaves nobody able to publish");
+		});
+	});
+	/**
+	* The token is printed to **stdout** and everything else to stderr, so the
+	* common thing works without parsing:
+	*
+	*   TASK=$(seekrit agents dispatch nova --scope GITHUB_TOKEN --ttl 15m)
+	*
+	* It is shown exactly once. The API stores only a hash, so a lost token cannot
+	* be recovered — dispatch another and revoke the first.
+	*/
+	agents.command("dispatch <ref>").description("mint task-scoped authority for one agent run").option("--scope <NAME>", "narrow this run to one secret (repeatable)", collectScope).option("--ttl <duration>", "how long the run stays authorized (e.g. 15m, 2h)").option("--label <text>", "what this run is for — recorded in the audit trail").option("--json", "machine-readable output (includes the token)").action(async (ref, options) => {
+		const ctx = buildContext();
+		const ttlSeconds = options.ttl ? parseDurationSeconds(options.ttl, "--ttl") : 900;
+		if (ttlSeconds < 60 || ttlSeconds > 43200) fail(`--ttl must be between 60s and ${TASK_MAX_TTL_SECONDS / 3600}h`);
+		const minted = await createAgentTaskToken();
+		const { task, header } = await ctx.client.dispatchAgentTask(ref, {
+			taskRef: minted.taskRef,
+			tokenHash: minted.tokenHash,
+			ttlSeconds,
+			...options.scope ? { scopes: options.scope } : {},
+			...options.label ? { label: options.label } : {}
+		});
+		if (options.json) {
+			console.log(JSON.stringify({
+				task,
+				header,
+				token: minted.token
+			}, null, 2));
+			return;
+		}
+		console.log(minted.token);
+		printFieldsToStderr([
+			["task", task.id],
+			["agent", ref],
+			["scopes", task.scopes ? describeSecrets(task.scopes) : "the agent's full policy"],
+			["policy", `v${task.policyVersion}`],
+			["expires", describeExpiry(task.expiresAt)],
+			["header", header]
+		]);
+	});
+	agents.command("tasks <ref>").description("runs dispatched for an agent identity, newest first").option("--org <slug>", "organization").option("--all", "include expired and revoked runs").option("--json", "machine-readable output").action(async (ref, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const agent = await resolveAgent(ctx, org.id, ref);
+		const { tasks } = await ctx.client.listAgentTasks(org.id, agent.id);
+		const now = Date.now();
+		const rows = options.all ? tasks : tasks.filter((t) => taskStateOf(t, now) === "active");
+		emit(options, { tasks: rows }, () => printTable(rows, [
+			col("task", (t) => t.id),
+			col("state", (t) => taskStateOf(t, now)),
+			col("scopes", (t) => t.scopes ? describeSecrets(t.scopes) : "policy"),
+			col("policy", (t) => `v${t.policyVersion}`),
+			col("expires", (t) => t.expiresAt),
+			col("last seen", (t) => t.lastSeenAt ?? "never"),
+			col("label", (t) => t.label ?? "-")
+		], options.all ? "no runs dispatched yet" : "no live runs (try --all)"));
+	});
+	agents.command("revoke <taskId>").description("end a run's authority now").action(async (taskId) => {
+		const { task } = await buildContext().client.revokeAgentTask(taskId);
+		console.error(`${task.id} revoked — enforcement points refuse it at their next introspection`);
+	});
+	registerPolicyCommands(agents.command("policy").description("published policy versions (`seekrit agents policy --help`)"));
+	agents.command("activity <ref>").description("what this agent actually did — aggregate decisions, not a request log").option("--days <n>", "how far back to look (1–90)", "14").option("--org <slug>", "organization").option("--json", "machine-readable output").action(async (ref, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const agent = await resolveAgent(ctx, org.id, ref);
+		const days = Number(options.days ?? 14);
+		if (!Number.isInteger(days) || days < 1 || days > 90) fail("--days must be 1–90");
+		const { activity, summary } = await ctx.client.getAgentActivity(org.id, agent.id, days);
+		emit(options, {
+			activity,
+			summary
+		}, () => {
+			printFields([
+				["window", `${days}d`],
+				["allowed", summary.allowed],
+				["denied", summary.denied],
+				["hosts", summary.hosts],
+				["earliest", summary.from ?? "no activity reported"]
+			]);
+			if (activity.length === 0) {
+				console.error("");
+				console.error("nothing reported — add an [activity] block to the proxy (`seekrit proxy init --activity`)");
+				return;
+			}
+			section("decisions");
+			printTable(activity, [
+				col("host", (a) => a.host),
+				col("method", (a) => a.method),
+				col("decision", (a) => a.decision),
+				col("rule", (a) => a.ruleIndex === null ? "-" : String(a.ruleIndex + 1)),
+				col("count", (a) => a.count),
+				col("secrets", (a) => a.secrets ? Object.entries(a.secrets).map(([name, n]) => `${name}×${n}`).join(" ") : "-")
+			]);
+		});
+	});
+	/**
+	* The grant review loop. Proposals are computed *here*, from activity the API
+	* served — the API is deliberately not in the business of saying what a policy
+	* should be. And `--out` writes a rule file rather than publishing: the change
+	* still goes through `policy publish`, which still needs a human's key.
+	*/
+	agents.command("review <ref>").description("compare published policy against observed activity, and propose changes").option("--days <n>", "how far back to look (1–90)", "14").option("-o, --out <path>", "write the narrowed rules to a file, ready to publish").option("--org <slug>", "organization").option("--json", "machine-readable output").action(async (ref, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const agent = await resolveAgent(ctx, org.id, ref);
+		const days = Number(options.days ?? 14);
+		if (!Number.isInteger(days) || days < 1 || days > 90) fail("--days must be 1–90");
+		const live = await loadVersion(ctx, org.id, agent);
+		if (!live) fail(`${agent.slug} has no published policy to review`);
+		const { activity, summary } = await ctx.client.getAgentActivity(org.id, agent.id, days);
+		const proposals = reviewPolicy({
+			rules: live.rules,
+			activity
+		});
+		emit(options, {
+			proposals,
+			summary,
+			version: live.version
+		}, () => {
+			console.error(`${agent.slug} — policy v${live.version}, ${summary.allowed + summary.denied} decision(s) over ${days}d`);
+			if (activity.length === 0) {
+				console.error("");
+				console.error("no activity reported yet — nothing to review against");
+				return;
+			}
+			if (proposals.length === 0) {
+				console.error("");
+				console.error("no changes proposed: every rule is in use and nothing was refused");
+				return;
+			}
+			section("proposals");
+			for (const p of proposals) {
+				const marker = p.applicable ? "-" : "?";
+				console.log(`${marker} ${p.rationale}`);
+			}
+			const applicable = countApplicable(proposals);
+			console.error("");
+			console.error(`${applicable} narrowing change(s) can be applied; ${proposals.length - applicable} need a human decision`);
+		});
+		if (options.out) {
+			const narrowed = applyProposals(live.rules, proposals);
+			writeFileSync(options.out, `${JSON.stringify({ rules: narrowed }, null, 2)}\n`);
+			console.error(`wrote ${narrowed.length} rule(s) to ${options.out} — review the diff, then: seekrit agents policy publish ${agent.slug} -f ${options.out}`);
+			console.error("widening proposals are never applied: an agent must not earn permissions by retrying");
+		}
+	});
+	agents.command("simulate <ref>").description("ask what a policy would decide, without sending a request").requiredOption("--host <host>", "upstream hostname").requiredOption("--path <path>", "request path").option("--method <method>", "HTTP method", "GET").option("--scheme <scheme>", "https or http, as the agent dials it (forward proxy)", "https").option("--port <n>", "port the agent dials (forward proxy; default 443 for https, 80 for http)").option("--secret <NAME>", "the secret the request would inject").option("--version <n>", "evaluate a specific published version").option("--org <slug>", "organization").option("--json", "machine-readable output").action(async (ref, options) => {
+		const scheme = options.scheme.toLowerCase();
+		if (scheme !== "https" && scheme !== "http") fail("--scheme must be https or http");
+		const port = options.port === void 0 ? scheme === "https" ? 443 : 80 : Number(options.port);
+		if (!Number.isInteger(port) || port < 1 || port > 65535) fail("--port must be 1-65535");
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const agent = await resolveAgent(ctx, org.id, ref);
+		const version = options.version === void 0 ? void 0 : Number(options.version);
+		if (version !== void 0 && !Number.isInteger(version)) fail("--version must be an integer");
+		const published = await loadVersion(ctx, org.id, agent, version);
+		if (!published) fail(`${agent.slug} has no published policy — every request is denied`);
+		const verdict = evaluatePolicy(published.rules, {
+			host: options.host,
+			transport: {
+				scheme,
+				port
+			},
+			method: options.method,
+			path: options.path,
+			...options.secret === void 0 ? {} : { secret: options.secret }
+		});
+		const reason = describePolicyVerdict(verdict, published.rules);
+		emit(options, {
+			version: published.version,
+			verdict,
+			reason
+		}, () => {
+			const target = `${options.method.toUpperCase()} ${scheme}://${options.host}:${port}${options.path}`;
+			console.log(`${verdict.decision === "allow" ? "allow" : "DENY"}  ${target}${options.secret ? ` [${options.secret}]` : ""}`);
+			console.log(`  v${published.version}: ${reason}`);
+		});
+		if (verdict.decision !== "allow") process.exitCode = 1;
+	});
+}
+function registerPolicyCommands(policy) {
+	policy.command("list <ref>").description("published versions, newest first").option("--org <slug>", "organization").option("--json", "machine-readable output").action(async (ref, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const agent = await resolveAgent(ctx, org.id, ref);
+		const { policies } = await ctx.client.listAgentPolicies(org.id, agent.id);
+		emit(options, { policies }, () => printTable(policies, [
+			col("version", (p) => `v${p.version}`),
+			col("rules", (p) => p.ruleCount),
+			col("signer", (p) => p.signerThumbprint.slice(0, 12)),
+			col("published", (p) => p.publishedAt),
+			col("expires", (p) => secondsUntil(p.expiresAt) <= 0 ? `${p.expiresAt} (expired)` : p.expiresAt),
+			col("note", (p) => p.rolledBackFromVersion ? `restored v${p.rolledBackFromVersion}` : "-")
+		], "nothing published yet"));
+	});
+	policy.command("show <ref>").description("the rules in a published version (live by default)").option("--version <n>", "a specific version").option("--org <slug>", "organization").option("--json", "machine-readable output").action(async (ref, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const agent = await resolveAgent(ctx, org.id, ref);
+		const version = options.version === void 0 ? void 0 : Number(options.version);
+		if (version !== void 0 && !Number.isInteger(version)) fail("--version must be an integer");
+		const published = await loadVersion(ctx, org.id, agent, version);
+		if (!published) fail(`${agent.slug} has no published policy`);
+		emit(options, { policy: published }, () => {
+			printFields([
+				["version", `v${published.version}`],
+				["signer", published.signerThumbprint],
+				["published", published.publishedAt],
+				["expires", describeExpiry(published.expiresAt)]
+			]);
+			section("rules");
+			printRules(published.rules);
+		});
+	});
+	/**
+	* Write the live rules out as the editable source for the next publish. This
+	* is the half that makes policy-as-code work: what comes back out is exactly
+	* the shape `publish` takes in, so a round trip is a no-op diff.
+	*/
+	policy.command("pull <ref>").description("write a version's rules to a JSON file you can edit and publish").option("-o, --out <path>", "where to write it (default: stdout)").option("--version <n>", "a specific version").option("--org <slug>", "organization").action(async (ref, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const agent = await resolveAgent(ctx, org.id, ref);
+		const version = options.version === void 0 ? void 0 : Number(options.version);
+		if (version !== void 0 && !Number.isInteger(version)) fail("--version must be an integer");
+		const published = await loadVersion(ctx, org.id, agent, version);
+		const rules = published?.rules ?? [];
+		const body = `${JSON.stringify({ rules }, null, 2)}\n`;
+		if (options.out) {
+			writeFileSync(options.out, body);
+			console.error(published ? `wrote ${rules.length} rule(s) from v${published.version} to ${options.out}` : `wrote an empty rule set to ${options.out} (nothing published yet)`);
+			return;
+		}
+		process.stdout.write(body);
+	});
+	policy.command("publish <ref>").description("sign a rule file with your own key and publish it").requiredOption("-f, --file <path>", `rule file, or ${STDIN} for stdin`).option("--ttl <duration>", "how long the bundle stays valid (e.g. 7d, 12h)").option("--org <slug>", "organization").option("-y, --yes", "skip the confirmation").option("--json", "machine-readable output").action(async (ref, options) => {
+		const ctx = buildContext();
+		if (isTokenAuth(ctx)) fail("publishing agent policy needs a human's signing key — sign in with `seekrit login`. A service token cannot publish, so an agent cannot widen its own policy.");
+		const org = await resolveOrg(ctx, options.org);
+		const agent = await resolveAgent(ctx, org.id, ref);
+		const ttlSeconds = options.ttl ? parseDurationSeconds(options.ttl, "--ttl") : POLICY_DEFAULT_TTL_SECONDS;
+		if (ttlSeconds < 3600 || ttlSeconds > 7776e3) fail(`--ttl must be between ${POLICY_MIN_TTL_SECONDS / 3600}h and ${POLICY_MAX_TTL_SECONDS / 86400}d`);
+		const { raw, label } = await readRuleSource(options.file);
+		const rules = parseRuleFile(raw, label);
+		const live = await loadVersion(ctx, org.id, agent);
+		const nextVersion = agent.currentPolicyVersion + 1;
+		const from = agent.currentPolicyVersion === 0 ? "nothing" : `v${agent.currentPolicyVersion}`;
+		console.error(`${agent.slug}: ${from} → v${nextVersion}`);
+		printPolicyDiff(live?.rules ?? [], rules);
+		await confirmDestructive(options.yes, `Publish v${nextVersion} for ${agent.slug} (${rules.length} rule(s), valid ${options.ttl ?? "7d"})?`);
+		const { signingKey, jwk } = await getPolicySigner(ctx);
+		const issuedAt = Math.floor(Date.now() / 1e3);
+		const bundle = await signAgentPolicy(signingKey, jwk, {
+			v: policyBundleVersionFor(rules),
+			org: org.id,
+			agent: agent.id,
+			agent_slug: agent.slug,
+			policy_version: nextVersion,
+			issued_at: issuedAt,
+			expires_at: issuedAt + ttlSeconds,
+			rules
+		});
+		const { policy: published } = await ctx.client.publishAgentPolicy(org.id, agent.id, bundle);
+		emit(options, { policy: published }, () => {
+			console.error(`published v${published.version} — signed with ${published.signerThumbprint.slice(0, 12)}…, expires ${published.expiresAt}`);
+			console.error("proxies pick it up at their next refresh");
+		});
+	});
+	policy.command("rollback <ref> <version>").description("republish an earlier version's bundle as the newest one").option("--org <slug>", "organization").option("-y, --yes", "skip the confirmation").action(async (ref, versionArg, options) => {
+		const ctx = buildContext();
+		const org = await resolveOrg(ctx, options.org);
+		const agent = await resolveAgent(ctx, org.id, ref);
+		const version = Number(versionArg);
+		if (!Number.isInteger(version) || version < 1) fail("version must be a positive integer");
+		const source = await loadVersion(ctx, org.id, agent, version);
+		if (!source) fail(`no version ${version}`);
+		if (secondsUntil(source.expiresAt) <= 0) fail(`v${version} expired at ${source.expiresAt} — a rollback keeps the original expiry, so it would be inert. Publish the rules again instead: seekrit agents policy pull ${agent.slug} --version ${version} -o rules.json`);
+		await confirmDestructive(options.yes, `Roll ${agent.slug} back to v${version} (${source.ruleCount} rule(s))?`);
+		const { policy: published } = await ctx.client.rollbackAgentPolicy(org.id, agent.id, version);
+		console.error(`published v${published.version} carrying v${version}'s bundle`);
+	});
+	/**
+	* What a proxy actually gets. Useful when a deployment misbehaves and the
+	* question is whether the API, the pin, or the rules are at fault — so it
+	* re-derives the thumbprint from the bundle rather than reporting the one the
+	* API sends beside it, and says plainly when the two disagree.
+	*/
+	policy.command("fetch <ref>").description("the bundle a proxy would fetch, with its signer re-derived locally").option("--bundle", "print the raw ap1. envelope and nothing else").option("--json", "machine-readable output").action(async (ref, options) => {
+		const fetched = await buildContext().client.getAgentPolicyBundle(ref);
+		if (options.bundle) {
+			process.stdout.write(`${fetched.bundle}\n`);
+			return;
 		}
-	}
-	return loaded;
-}
-/**
-* Print a name → source table to stderr (never the secret values). Names whose
-* value had references expanded are marked, and dangling references are called
-* out afterwards — a typo'd `${NAME}` is otherwise invisible, since it is
-* deliberately passed through as literal text.
-*/
-function printExplain(provenance, refs = {}) {
-	const interpolated = new Set(refs.interpolated ?? []);
-	const names = Object.keys(provenance).sort();
-	const width = names.reduce((w, n) => Math.max(w, n.length), 0);
-	for (const name of names) {
-		const marker = interpolated.has(name) ? "  (interpolated)" : "";
-		process.stderr.write(`${name.padEnd(width)}  ${provenance[name]}${marker}\n`);
-	}
-	if (refs.unresolved?.length) process.stderr.write(`\nunresolved reference(s), left as literal text: ${refs.unresolved.join(", ")}\n`);
+		const body = parseAgentPolicyUnverified(fetched.bundle);
+		const derived = await policySignerThumbprint(body.signer.jwk);
+		emit(options, {
+			...fetched,
+			derivedThumbprint: derived,
+			rules: body.rules
+		}, () => {
+			printFields([
+				["agent", `${fetched.agent.slug} (${fetched.agent.name})`],
+				["version", `v${fetched.version}`],
+				["expires", describeExpiry(fetched.expiresAt)],
+				["signer (in bundle)", derived],
+				["signer (reported)", fetched.signerThumbprint === derived ? "matches" : `${fetched.signerThumbprint} — DOES NOT MATCH the bundle; a proxy would refuse this`]
+			]);
+			section("rules");
+			printRules(body.rules);
+			console.error("");
+			console.error("this command does not verify the signature — only a pinned signer list can, which lives in the proxy's own config");
+		});
+	});
 }
 // src/env-diff.ts
 /**
@@ -10787,132 +11790,6 @@ function registerBranchCommands(program) {
 		console.error(`deleted branch ${app.slug}#${target.slug}`);
 	});
 }
-// src/changes.ts
-/**
-* Change requests: the review queue in front of protected environments, and the
-* protection settings that create it.
-*
-* Reviewing here is keyless by construction — a change request carries
-* ciphertext, so the CLI can show a reviewer *what* is changing and who
-* proposed it without ever holding a DEK. `seekrit changes show` therefore
-* prints no value, and deliberately does not offer to.
-*/
-function registerChangeCommands(program) {
-	const changes = program.command("changes").description("review changes queued for protected environments");
-	changes.command("list", { isDefault: true }).alias("ls").description("list change requests awaiting review").option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--status <status>", `filter by status (${CHANGE_REQUEST_STATUSES.join(", ")})`, "open").option("--all", "every status, not just open").option("--limit <n>", "entries to show (max 200)", "50").option("--json", "print the raw API response").action(async (options) => {
-		const ctx = buildContext();
-		const ref = await resolveOrg(ctx, options.org);
-		const status = options.all ? void 0 : parseStatus(options.status);
-		const limit = Number(options.limit);
-		if (!Number.isInteger(limit) || limit < 1) fail("--limit must be a positive whole number");
-		const { changeRequests } = await ctx.client.listChangeRequests(ref.id, {
-			status,
-			limit: Math.min(limit, 200)
-		});
-		emit(options, { changeRequests }, () => {
-			printTable(changeRequests, [
-				col("id", (r) => r.id),
-				col("change", (r) => describeChange(r.kind, r.secretName, r.restoreFromVersion)),
-				col("status", (r) => r.status),
-				col("proposed by", (r) => `${r.requestedByType}:${r.requestedById}`),
-				col("when", (r) => r.createdAt)
-			], options.all ? "no change requests" : "nothing waiting for review");
-		});
-	});
-	changes.command("show <id>").description("show one change request and its reviews (never its value)").option("--org <slug>", "organization slug").option("--json", "print the raw API response").action(async (id, options) => {
-		const ctx = buildContext();
-		const ref = await resolveOrg(ctx, options.org);
-		const { changeRequest, reviews } = await ctx.client.getChangeRequest(ref.id, id);
-		emit(options, {
-			changeRequest,
-			reviews
-		}, () => {
-			printFields([
-				["id", changeRequest.id],
-				["change", describeChange(changeRequest.kind, changeRequest.secretName, changeRequest.restoreFromVersion)],
-				["environment", changeRequest.environmentId],
-				["status", changeRequest.status],
-				["base version", changeRequest.baseVersion ?? "(new secret)"],
-				["approvals needed", changeRequest.requiredApprovals],
-				["proposed by", `${changeRequest.requestedByType}:${changeRequest.requestedById}`],
-				["note", changeRequest.note ?? "-"]
-			]);
-			section("reviews");
-			printTable(reviews, [
-				col("decision", (r) => r.decision),
-				col("reviewer", (r) => r.reviewerId ?? "(removed)"),
-				col("comment", (r) => r.comment ?? "-"),
-				col("when", (r) => r.createdAt)
-			], "no reviews yet");
-		});
-	});
-	changes.command("approve <id>").description("approve a queued change (applies it once it has enough approvals)").option("--org <slug>", "organization slug").option("-m, --comment <text>", "note recorded with your approval").option("--json", "print the raw API response").action(async (id, options) => {
-		const ctx = buildContext();
-		const ref = await resolveOrg(ctx, options.org);
-		const result = await ctx.client.approveChangeRequest(ref.id, id, options.comment);
-		emit(options, result, () => {
-			if (result.status === "applied") console.error(`approved and applied${result.version ? ` as v${result.version}` : ""}`);
-			else if (result.status === "superseded") console.error(`not applied: ${result.reason ?? "the secret has changed since"}`);
-			else console.error(`approved — ${result.approvals ?? 0}/${result.required ?? "?"} approvals`);
-		});
-	});
-	changes.command("reject <id>").description("reject a queued change").option("--org <slug>", "organization slug").option("-m, --comment <text>", "note recorded with your rejection").option("--json", "print the raw API response").action(async (id, options) => {
-		const ctx = buildContext();
-		const ref = await resolveOrg(ctx, options.org);
-		emit(options, await ctx.client.rejectChangeRequest(ref.id, id, options.comment), () => console.error("rejected"));
-	});
-	changes.command("withdraw <id>").description("take your own queued change off the review queue").option("--org <slug>", "organization slug").option("--json", "print the raw API response").action(async (id, options) => {
-		const ctx = buildContext();
-		const ref = await resolveOrg(ctx, options.org);
-		emit(options, await ctx.client.withdrawChangeRequest(ref.id, id), () => console.error("withdrawn"));
-	});
-	const protection = changes.command("protection").description("require review before an environment's secrets change");
-	protection.command("show", { isDefault: true }).description("show whether an environment is protected").option("--org <slug>", "organization slug").option("--app <slug>", "application slug").option("--group <slug>", "group slug (instead of --app)").option("--env <slug>", "environment slug").option("--json", "print the raw API response").action(async (options) => {
-		const ctx = buildContext();
-		const { orgId, envId, label } = await resolveEnvTarget(ctx, options);
-		const result = await ctx.client.getEnvironmentProtection(orgId, envId);
-		emit(options, result, () => {
-			if (!result.protection) {
-				console.log(`${label}: unprotected — writes land immediately`);
-				return;
-			}
-			printFields([
-				["environment", label],
-				["approvals required", result.protection.requiredApprovals],
-				["self-approval", result.protection.allowSelfApproval ? "allowed" : "not allowed"],
-				["waiting for review", result.openChangeRequests]
-			]);
-		});
-	});
-	protection.command("on").description("require approval before secrets in this environment change").option("--org <slug>", "organization slug").option("--app <slug>", "application slug").option("--group <slug>", "group slug (instead of --app)").option("--env <slug>", "environment slug").option("--approvals <n>", "approvals a change needs", "1").option("--allow-self-approval", "let the proposer's own approval count").option("--json", "print the raw API response").action(async (options) => {
-		const ctx = buildContext();
-		const { orgId, envId, label } = await resolveEnvTarget(ctx, options);
-		const requiredApprovals = Number(options.approvals);
-		if (!Number.isInteger(requiredApprovals) || requiredApprovals < 1) fail("--approvals must be a positive whole number");
-		emit(options, await ctx.client.setEnvironmentProtection(orgId, envId, {
-			requiredApprovals,
-			allowSelfApproval: options.allowSelfApproval ?? false
-		}), () => console.error(`${label} now requires ${requiredApprovals} approval${requiredApprovals === 1 ? "" : "s"} before a secret changes`));
-	});
-	protection.command("off").description("stop requiring approval (queued changes stay queued)").option("--org <slug>", "organization slug").option("--app <slug>", "application slug").option("--group <slug>", "group slug (instead of --app)").option("--env <slug>", "environment slug").option("--json", "print the raw API response").action(async (options) => {
-		const ctx = buildContext();
-		const { orgId, envId, label } = await resolveEnvTarget(ctx, options);
-		emit(options, await ctx.client.deleteEnvironmentProtection(orgId, envId), () => console.error(`${label} no longer requires approval — writes land immediately`));
-	});
-}
-function parseStatus(raw) {
-	if (!raw) return void 0;
-	if (!CHANGE_REQUEST_STATUSES.includes(raw)) fail(`unknown status "${raw}" — one of ${CHANGE_REQUEST_STATUSES.join(", ")}`);
-	return raw;
-}
-/**
-* Report a write that was queued instead of performed. Every write path calls
-* this: a CLI that printed "set FOO" for a change nobody has approved would be
-* telling the operator the deploy is ready when it is not.
-*/
-function reportQueued(cr) {
-	console.error(`queued for review: ${describeChange(cr.kind, cr.secretName, cr.restoreFromVersion)} — needs ${cr.requiredApprovals} approval${cr.requiredApprovals === 1 ? "" : "s"} (${cr.id})`);
-}
 /** Plugin id and integration id declared by `@seekrit/openclaw-plugin`. */
 const PLUGIN_ID = "seekrit";
 const PLUGIN_INTEGRATION_ID = "seekrit";
@@ -16937,10 +17814,13 @@ async function materializeForRun(options) {
 		const ctx = tryBuildContext(dotenvVars);
 		if (!ctx) throw new Error("no credentials found (set SEEKRIT_TOKEN / SEEKRIT_DEV_USER or run `seekrit login`)");
 		const branch = options.branch ?? process.env.SEEKRIT_BRANCH ?? dotenvVars.SEEKRIT_BRANCH;
-		return await materialize(ctx, {
-			...options,
-			branch
-		}, dotenvVars);
+		return {
+			...await materialize(ctx, {
+				...options,
+				branch
+			}, dotenvVars),
+			ctx
+		};
 	} catch (err) {
 		console.error(`seekrit: continuing without seekrit-managed secrets: ${describeError(err)}`);
 		const values = {};
@@ -16948,17 +17828,35 @@ async function materializeForRun(options) {
 		overlayEnvFiles(values, provenance, envFiles);
 		return {
 			...interpolateValues(values, options.interpolate !== false),
-			provenance
+			provenance,
+			agentLogins: {},
+			scope: void 0,
+			ctx: void 0
 		};
 	}
 }
-program.command("run").description("run a command with decrypted secrets injected (process env > .env > app > group)").passThroughOptions().option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--app <slug>", "application slug (token path infers this)").option("--env <slug>", "environment slug (token path infers this)").option("--branch <slug>", "read a branch of that environment (or $SEEKRIT_BRANCH)").option("--with <group=env>", "override one group’s slice for this run", collectKv).option("--lease <VAR=target>", "inject a temporary Postgres connection URL (repeatable)", collectList).option("--lease-ttl <duration>", "maximum lease lifetime, 1m–7d (default: 30m)").option("--env-file <path>", "a .env file to overlay (repeatable; default .env)", collectList).option("--explain", "print where each variable resolved from (to stderr)").option("--no-interpolate", "leave ${OTHER_SECRET} references as literal text").option("--cache", "keep a last-known-good copy of the encrypted response and fall back to it when the API is unreachable (off by default; SEEKRIT_CACHE=1)").option("--cache-dir <path>", "where to keep it (default: $XDG_CACHE_HOME/seekrit)").option("--cache-max-age <duration>", "how stale a cached copy may be and still be used, e.g. 15m, 24h, 7d (default: 24h)").argument("<command...>", "command to run (prefix with -- to pass flags)").action(async (commandParts, options) => {
+program.command("run").description("run a command with decrypted secrets injected (process env > .env > app > group)").passThroughOptions().option("--org <slug>", "organization slug (defaults to seekrit.json, or your only org)").option("--app <slug>", "application slug (token path infers this)").option("--env <slug>", "environment slug (token path infers this)").option("--branch <slug>", "read a branch of that environment (or $SEEKRIT_BRANCH)").option("--with <group=env>", "override one group’s slice for this run", collectKv).option("--lease <VAR=target>", "inject a temporary Postgres connection URL (repeatable)", collectList).option("--lease-ttl <duration>", "maximum lease lifetime, 1m–7d (default: 30m)").option("--agent-login <agent[=SECRET]>", "sign codex or claude in from a login stored with `seekrit agent-login`, and save its refreshes back (repeatable)", collectList).option("--env-file <path>", "a .env file to overlay (repeatable; default .env)", collectList).option("--explain", "print where each variable resolved from (to stderr)").option("--no-interpolate", "leave ${OTHER_SECRET} references as literal text").option("--cache", "keep a last-known-good copy of the encrypted response and fall back to it when the API is unreachable (off by default; SEEKRIT_CACHE=1)").option("--cache-dir <path>", "where to keep it (default: $XDG_CACHE_HOME/seekrit)").option("--cache-max-age <duration>", "how stale a cached copy may be and still be used, e.g. 15m, 24h, 7d (default: 24h)").argument("<command...>", "command to run (prefix with -- to pass flags)").action(async (commandParts, options) => {
 	const [cmd, ...args] = commandParts;
 	if (!cmd) fail("no command given");
 	const leaseOptions = parseRunLeaseOptions(options.lease, options.leaseTtl);
-	const { values, provenance, interpolated, unresolvedRefs } = await materializeForRun(options);
+	let loginRequests = [];
+	try {
+		loginRequests = (options.agentLogin ?? []).map(parseAgentLoginFlag);
+	} catch (err) {
+		fail(err instanceof Error ? err.message : String(err));
+	}
+	const { values, provenance, interpolated, unresolvedRefs, agentLogins, scope, ctx } = await materializeForRun(options);
+	const loginSessionsFor = loginRequests.length > 0 ? await prepareAgentLogins(loginRequests, agentLogins, ctx, scope ? `${scope.appSlug}/${scope.envSlug}` : "this environment") : void 0;
+	let loginSessions = [];
 	const leases = leaseOptions ? await prepareRunLeases(leaseOptions, options.org, options.envFile) : void 0;
 	const result = await runCommand(cmd, args, async (interrupted) => {
+		if (loginSessionsFor) {
+			loginSessions = loginSessionsFor({
+				...values,
+				...process.env
+			});
+			for (const session of loginSessions) await session.start();
+		}
 		const leased = await leases?.mint(interrupted) ?? {};
 		if (options.explain) {
 			for (const name of Object.keys(values)) if (process.env[name] !== void 0 && process.env[name] !== values[name]) provenance[name] = "env";
@@ -16980,7 +17878,10 @@ program.command("run").description("run a command with decrypted secrets injecte
 			...env,
 			...leased
 		};
-	}, () => leases?.revoke() ?? Promise.resolve(true));
+	}, async () => {
+		const [saved, revoked] = await Promise.all([Promise.all(loginSessions.map((session) => session.stop())).then((all) => all.every(Boolean)), leases?.revoke() ?? Promise.resolve(true)]);
+		return saved && revoked;
+	});
 	if (result.signal) process.kill(process.pid, result.signal);
 	else process.exit(result.code);
 });
@@ -17091,6 +17992,7 @@ registerRedisCommands(program);
 registerProvisionerCommands(program);
 registerProxyCommands(program);
 registerAgentCommands(program);
+registerAgentLoginCommands(program);
 registerPaperclipCommands(program);
 registerNomadCommands(program);
 registerOpenclawCommands(program);