veil-proxy 0.1.2__tar.gz → 0.2.0__tar.gz

{veil_proxy-0.1.2 → veil_proxy-0.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: veil-proxy
-Version: 0.1.2
+Version: 0.2.0
 Summary: Privacy middleware for AI coding agents: the model sees consistent pseudonyms, your machine keeps the real values
 Keywords: privacy,pii,llm,proxy,pseudonymization,claude-code,coding-agent
 Requires-Python: >=3.11
@@ -18,6 +18,7 @@ Requires-Dist: pyahocorasick>=2.3.1
 Requires-Dist: veil-proxy[postgres, mysql, mongo, redis, bedrock] ; extra == "all"
 Requires-Dist: botocore>=1.43.115 ; extra == "bedrock"
 Requires-Dist: pymongo>=4.19.0 ; extra == "mongo"
+Requires-Dist: pymssql>=2.3 ; extra == "mssql"
 Requires-Dist: pymysql>=1.2.3 ; extra == "mysql"
 Requires-Dist: gliner>=0.2.29 ; extra == "ner"
 Requires-Dist: onnxruntime>=1.31.0 ; extra == "ner"
@@ -29,6 +30,7 @@ Project-URL: Repository, https://github.com/lemonadesaltbagel/veil
 Provides-Extra: all
 Provides-Extra: bedrock
 Provides-Extra: mongo
+Provides-Extra: mssql
 Provides-Extra: mysql
 Provides-Extra: ner
 Provides-Extra: postgres
@@ -41,7 +43,7 @@ Privacy middleware for AI coding agents. The model sees consistent pseudonyms
 and commands the agent runs locally get the real values back (shell- and SQL-safe).
 
 ```sh
-pip install "veil-proxy[postgres]"    # extras: postgres, mysql, mongo, redis, bedrock, ner, all
+pip install "veil-proxy[postgres]"    # extras: postgres, mysql, mongo, redis, bedrock, ner, mssql, all
                                       # (installs the `veil` and `veil-hook` commands; import name `veil`)
 veil init ~/code/myapp                # seed from .env DB URLs, SQLite, fixtures; wire Claude Code
 veil service install                  # proxy as a LaunchAgent (macOS) / systemd user unit (Linux)
@@ -55,15 +57,26 @@ https://github.com/lemonadesaltbagel/veil):
   a scanner that also decodes escaped and transformed text), and every session still found the bug.
 - Seeding from your own data lets **1.8%** of names and contact details through, versus 80.4% for
   pattern matching (1,000 labelled records).
-- **20/20** one-command bypass transforms are contained, and restored values are escaped for their
-  shell/SQL context (35/35 injection tests).
+- **21/21** one-command bypass transforms are contained. Restored values are escaped for every
+  language layer they pass through (shell, heredocs, `python -c`, `node -e`, SQL, `bash -c`...):
+  35/35 injection tests, and 55,000 fuzzed nested commands executed with 0 code executions.
 - Prompt caching keeps working (74–89% cache hits); about 19 ms overhead per request at 40k seeded
-  values.
+  values, and 37 + 68 ms per 234 KB request at 1.2 million seeded values (1.1 GB).
 
 One local proxy (default `127.0.0.1:8787`) serves every client, routed by path:
 Anthropic Messages (Claude Code, Agent SDK), Amazon Bedrock InvokeModel (binary eventstream),
-Google Vertex rawPredict, OpenAI Chat Completions (Aider, Continue, OpenAI SDK) and
-OpenAI Responses (Codex CLI).
+Google Vertex rawPredict, Microsoft Foundry (`/foundry`), Claude Platform on AWS (`/anthropic-aws`),
+OpenAI Chat Completions (Aider, Continue, OpenAI SDK) and OpenAI Responses (Codex CLI).
+
+Seeds from Postgres, MySQL/MariaDB, SQLite, SQL Server (native sensitivity labels), MongoDB, Redis,
+Elasticsearch/OpenSearch and fixture files, plus personal fields declared in code (Prisma, Django,
+Rails, SQLAlchemy, OpenAPI, protobuf), and re-seeds automatically when the data changes.
+
+```sh
+veil display tokens        # screen sharing: answers keep pseudonyms (veil display real to undo)
+veil quasi redact          # also pseudonymise rare cities, postal codes, birth dates, employers
+veil keys rotate           # re-encrypt the vault; --token-secret for new pseudonyms
+```
 
 Teams: `veil team export | join` shares the pseudonym secret (never the vault key);
 `veil team managed-settings` writes a Claude Code `managed-settings.d/` drop-in that pins the
@@ -71,6 +84,6 @@ proxy with `allowedProviders: ["customEndpoint"]`.
 
 Optional NER for free text: `pip install "veil-proxy[ner]"` then `veil ner-model fetch`.
 
-Status: alpha. Keys: macOS Keychain / Linux Secret Service (`secret-tool`), or `VEIL_VAULT_KEY` /
-`VEIL_TOKEN_SECRET` (base64). State: `~/.veil` (encrypted vault).
+Status: alpha. Keys: macOS Keychain / Linux Secret Service (`secret-tool`) / Windows Credential
+Manager, or `VEIL_VAULT_KEY` / `VEIL_TOKEN_SECRET` (base64). State: `~/.veil` (encrypted vault).
 

{veil_proxy-0.1.2 → veil_proxy-0.2.0}/README.md

@@ -5,7 +5,7 @@ Privacy middleware for AI coding agents. The model sees consistent pseudonyms
 and commands the agent runs locally get the real values back (shell- and SQL-safe).
 
 ```sh
-pip install "veil-proxy[postgres]"    # extras: postgres, mysql, mongo, redis, bedrock, ner, all
+pip install "veil-proxy[postgres]"    # extras: postgres, mysql, mongo, redis, bedrock, ner, mssql, all
                                       # (installs the `veil` and `veil-hook` commands; import name `veil`)
 veil init ~/code/myapp                # seed from .env DB URLs, SQLite, fixtures; wire Claude Code
 veil service install                  # proxy as a LaunchAgent (macOS) / systemd user unit (Linux)
@@ -19,15 +19,26 @@ https://github.com/lemonadesaltbagel/veil):
   a scanner that also decodes escaped and transformed text), and every session still found the bug.
 - Seeding from your own data lets **1.8%** of names and contact details through, versus 80.4% for
   pattern matching (1,000 labelled records).
-- **20/20** one-command bypass transforms are contained, and restored values are escaped for their
-  shell/SQL context (35/35 injection tests).
+- **21/21** one-command bypass transforms are contained. Restored values are escaped for every
+  language layer they pass through (shell, heredocs, `python -c`, `node -e`, SQL, `bash -c`...):
+  35/35 injection tests, and 55,000 fuzzed nested commands executed with 0 code executions.
 - Prompt caching keeps working (74–89% cache hits); about 19 ms overhead per request at 40k seeded
-  values.
+  values, and 37 + 68 ms per 234 KB request at 1.2 million seeded values (1.1 GB).
 
 One local proxy (default `127.0.0.1:8787`) serves every client, routed by path:
 Anthropic Messages (Claude Code, Agent SDK), Amazon Bedrock InvokeModel (binary eventstream),
-Google Vertex rawPredict, OpenAI Chat Completions (Aider, Continue, OpenAI SDK) and
-OpenAI Responses (Codex CLI).
+Google Vertex rawPredict, Microsoft Foundry (`/foundry`), Claude Platform on AWS (`/anthropic-aws`),
+OpenAI Chat Completions (Aider, Continue, OpenAI SDK) and OpenAI Responses (Codex CLI).
+
+Seeds from Postgres, MySQL/MariaDB, SQLite, SQL Server (native sensitivity labels), MongoDB, Redis,
+Elasticsearch/OpenSearch and fixture files, plus personal fields declared in code (Prisma, Django,
+Rails, SQLAlchemy, OpenAPI, protobuf), and re-seeds automatically when the data changes.
+
+```sh
+veil display tokens        # screen sharing: answers keep pseudonyms (veil display real to undo)
+veil quasi redact          # also pseudonymise rare cities, postal codes, birth dates, employers
+veil keys rotate           # re-encrypt the vault; --token-secret for new pseudonyms
+```
 
 Teams: `veil team export | join` shares the pseudonym secret (never the vault key);
 `veil team managed-settings` writes a Claude Code `managed-settings.d/` drop-in that pins the
@@ -35,5 +46,5 @@ proxy with `allowedProviders: ["customEndpoint"]`.
 
 Optional NER for free text: `pip install "veil-proxy[ner]"` then `veil ner-model fetch`.
 
-Status: alpha. Keys: macOS Keychain / Linux Secret Service (`secret-tool`), or `VEIL_VAULT_KEY` /
-`VEIL_TOKEN_SECRET` (base64). State: `~/.veil` (encrypted vault).
+Status: alpha. Keys: macOS Keychain / Linux Secret Service (`secret-tool`) / Windows Credential
+Manager, or `VEIL_VAULT_KEY` / `VEIL_TOKEN_SECRET` (base64). State: `~/.veil` (encrypted vault).

{veil_proxy-0.1.2 → veil_proxy-0.2.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "veil-proxy"
-version = "0.1.2"
+version = "0.2.0"
 description = "Privacy middleware for AI coding agents: the model sees consistent pseudonyms, your machine keeps the real values"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -32,6 +32,7 @@ mongo = ["pymongo>=4.19.0"]
 redis = ["redis>=8.1.0"]
 bedrock = ["botocore>=1.43.115"]
 ner = ["gliner>=0.2.29", "onnxruntime>=1.31.0"]
+mssql = ["pymssql>=2.3"]  # not in `all`: building it from source needs FreeTDS
 all = ["veil-proxy[postgres,mysql,mongo,redis,bedrock]"]
 
 [project.scripts]

{veil_proxy-0.1.2 → veil_proxy-0.2.0}/veil/adopt.py

@@ -54,6 +54,17 @@ def redact_uri(uri: str) -> str:
     return re.sub(r"//([^:@/]+)(:[^@/]*)?@", r"//\1:***@", uri)
 
 
+def _q(arg: str) -> str:
+    """Quote for the hook shell (sh on macOS/Linux, Git Bash or cmd on Windows): double
+    quotes keep spaces and Windows backslashes (C:\\Users\\...) intact in all of them."""
+    return f'"{arg}"' if " " in arg or "\\" in arg else arg
+
+
+def state_home() -> str:
+    from .state import home
+    return home()
+
+
 def veil_command() -> list[str]:
     """How hooks and the service invoke veil (absolute; independent of cwd/venv activation)."""
     return [sys.executable, "-m", "veil.cli"]
@@ -79,9 +90,11 @@ def write_claude_settings(project: str, port: int, hooks: bool = True, deny_env:
         for event, kind in (("PreToolUse", "pre"), ("PostToolUse", "post")):
             entries = [e for e in all_hooks.get(event, [])
                        if "veil.cli hook" not in json.dumps(e) and "veil.hookclient" not in json.dumps(e)]
-            fast = " ".join(f'"{c}"' if " " in c else c for c in [sys.executable, "-m", "veil.hookclient"])
+            fast = " ".join(_q(c) for c in [sys.executable, "-m", "veil.hookclient"])
+            home = state_home()
+            home_arg = f" --home {_q(home)}"
             entries.append({"matcher": "*", "hooks": [{"type": "command",
-                                                       "command": f"{fast} {kind} --port {port}"}]})
+                                                       "command": f"{fast} {kind} --port {port}{home_arg}"}]})
             all_hooks[event] = entries
     if deny_env:
         deny = settings.setdefault("permissions", {}).setdefault("deny", [])
@@ -236,3 +249,71 @@ def systemd_uninstall() -> bool:
 def systemd_status() -> str:
     r = subprocess.run(["systemctl", "--user", "is-active", UNIT], capture_output=True, text=True)
     return r.stdout.strip() or "not loaded"
+
+
+# -- Windows: a launcher in the user's Startup folder (no admin rights needed) --------
+
+def startup_dir() -> str:
+    return os.environ.get("VEIL_STARTUP_DIR") or os.path.join(
+        os.environ.get("APPDATA", os.path.expanduser("~")), "Microsoft", "Windows", "Start Menu", "Programs", "Startup")
+
+
+def windows_launcher_path() -> str:
+    return os.path.join(startup_dir(), f"{LABEL}.vbs")
+
+
+def _windows_args(port: int, upstream: str, ner: bool, home: str, capture: str | None) -> list[str]:
+    exe = sys.executable
+    pyw = os.path.join(os.path.dirname(exe), "pythonw.exe")
+    exe = pyw if os.path.exists(pyw) else exe  # no console window
+    return [exe, "-m", "veil.cli", "proxy", "--port", str(port), "--upstream", upstream,
+            "--pid-file", os.path.join(home, "proxy.pid")] + (["--ner"] if ner else []) \
+        + (["--capture", capture] if capture else [])
+
+
+def windows_launcher(port: int, upstream: str, ner: bool, home: str, capture: str | None = None) -> str:
+    """VBScript: sets VEIL_HOME and starts the proxy hidden at logon. Keys come from the
+    Credential Manager; environment keys are deliberately not written into the script."""
+    vbs = lambda s: '"' + s.replace('"', '""') + '"'
+    cmdline = " ".join('"' + a + '"' for a in _windows_args(port, upstream, ner, home, capture))
+    return "\r\n".join([
+        "' veil proxy launcher (veil service install); remove with: veil service uninstall",
+        'Set sh = CreateObject("WScript.Shell")',
+        f'sh.Environment("Process")("VEIL_HOME") = {vbs(home)}',
+        'sh.Environment("Process")("NO_PROXY") = "127.0.0.1,localhost"',
+        f"sh.Run {vbs(cmdline)}, 0, False", ""])
+
+
+def windows_install(port: int, upstream: str, ner: bool, home: str, start: bool = True,
+                    capture: str | None = None) -> str:
+    os.makedirs(startup_dir(), exist_ok=True)
+    path = windows_launcher_path()
+    with open(path, "w", encoding="utf-8", newline="") as f:
+        f.write(windows_launcher(port, upstream, ner, home, capture))
+    if start and health(port) is None:
+        flags = getattr(subprocess, "DETACHED_PROCESS", 0) | getattr(subprocess, "CREATE_NO_WINDOW", 0)
+        subprocess.Popen(_windows_args(port, upstream, ner, home, capture), creationflags=flags, close_fds=True,
+                         env={**os.environ, "VEIL_HOME": home, "NO_PROXY": "127.0.0.1,localhost"},
+                         stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, stdin=subprocess.DEVNULL)
+    return path
+
+
+def windows_uninstall(home: str) -> bool:
+    import signal
+    path, found = windows_launcher_path(), False
+    if os.path.exists(path):
+        os.remove(path)
+        found = True
+    pid_file = os.path.join(home, "proxy.pid")
+    try:
+        os.kill(int(open(pid_file).read().strip()), signal.SIGTERM)  # TerminateProcess on Windows
+        found = True
+    except (OSError, ValueError):
+        pass
+    return found
+
+
+def windows_status(port: int = 8787) -> str:
+    installed = os.path.exists(windows_launcher_path())
+    running = health(port) is not None
+    return f"{'installed' if installed else 'not installed'} (Startup folder), {'running' if running else 'not running'}"

{veil_proxy-0.1.2 → veil_proxy-0.2.0}/veil/anthropic.py

@@ -82,10 +82,29 @@ def _fragment_notice(veil: Veil, codes: list[str]) -> str:
     return "echo " + "'" + msg.replace("'", "") + "'"
 
 
+def _texts(obj) -> str:
+    """Every string in a tool input, NUL-separated. (Scanning json.dumps() output glued
+    the `n` of an escaped newline onto a token after it, so the token went unseen.)"""
+    out: list[str] = []
+
+    def walk(o):
+        if isinstance(o, str):
+            out.append(o)
+        elif isinstance(o, dict):
+            for k, v in o.items():
+                walk(k)
+                walk(v)
+        elif isinstance(o, list):
+            for v in o:
+                walk(v)
+    walk(obj)
+    return "\0".join(out)
+
+
 def rehydrate_tool_input(veil: Veil, policy: Policy, tool: str, tool_input: dict) -> dict:
     mode = policy.mode(tool, tool_input)
     if mode == "full":
-        frags = veil.fragments(json.dumps(tool_input, ensure_ascii=False))
+        frags = veil.fragments(_texts(tool_input))
         if frags and tool == "Grep" and isinstance(tool_input.get("pattern"), str):
             # "lines about person mz5z": expand the fragment to that person's real values
             pat, codes = tool_input["pattern"], veil.codes()
@@ -117,7 +136,7 @@ def rehydrate_tool_input(veil: Veil, policy: Policy, tool: str, tool_input: dict
                 existing = f.read()
         except OSError:
             existing = ""
-        allowed = {t for t in veil.tokens_in(json.dumps(tool_input, ensure_ascii=False))
+        allowed = {t for t in veil.tokens_in(_texts(tool_input))
                    if (veil.vault.value_for(t) or "\0") in existing}
         for k in CONTENT_FIELDS & out.keys():
             out[k] = veil.rehydrate_json(out[k], only=allowed)

{veil_proxy-0.1.2 → veil_proxy-0.2.0}/veil/cli.py

@@ -5,6 +5,9 @@
   veil seed-env                    learn the developer's own identity (OS user, git author)
   veil redact  < file              print the LLM's view of a file
   veil rehydrate < file            map tokens back to real values
+  veil display [real|tokens]       what you see in answers (default real; tokens for screen shares)
+  veil reveal [FILE]               pseudonyms -> real values (alias of rehydrate)
+  veil share [FILE]                real values -> pseudonyms, safe to paste into tickets/chat
   veil proxy [--port 8787]         run the ANTHROPIC_BASE_URL proxy
   veil hook pre|post               Claude Code PreToolUse/PostToolUse hook
   veil audit [--driver ...]        run an agent session through veil, report what the LLM received
@@ -34,6 +37,26 @@ def _hook(veil, kind: str) -> int:
     return 0
 
 
+def _learn_schema(project: str, save: bool = True) -> dict:
+    """Field hints from the project's ORM schema / annotations, remembered in config.json
+    (names only) so every later seed and re-seed applies them."""
+    from .sources import core, schema
+    hints = schema.scan(project)
+    if hints and not save:
+        print(f"  schema  {sum(map(len, hints.values()))} personal field(s) declared in code", file=sys.stderr)
+    elif hints:
+        cfg = state.config()
+        merged = cfg.get("schema_hints", {})
+        for table, fields in hints.items():
+            merged.setdefault(table, {}).update(fields)
+        cfg["schema_hints"] = merged
+        state.save_config(cfg)
+        core.set_hints(merged)
+        n = sum(map(len, hints.values()))
+        print(f"  schema  {n} personal field(s) declared in code across {len(hints)} model(s)", file=sys.stderr)
+    return hints
+
+
 def _init(veil, args) -> int:
     import os
     from . import adopt
@@ -44,6 +67,8 @@ def _init(veil, args) -> int:
     for src, where in sources:
         print(f"  source  {adopt.redact_uri(src) if '://' in src else os.path.relpath(src, project)}   ({where})",
               file=sys.stderr)
+    if not args.no_detect:
+        _learn_schema(project, save=not args.dry_run)
     if args.dry_run:
         print("  (dry run: nothing seeded or written)", file=sys.stderr)
         return 0
@@ -56,6 +81,8 @@ def _init(veil, args) -> int:
             print(f"  skipped {adopt.redact_uri(src)}: {type(e).__name__}: {str(e)[:120]}", file=sys.stderr)
     seed_environment(veil.known)
     state.save_known(veil.known, veil.vault.cipher)
+    if sources:
+        state.remember_sources([src for src, _ in sources], veil.vault.cipher)
     path = adopt.write_claude_settings(project, args.port, hooks=not args.no_hooks, deny_env=args.deny_env)
     print(f"  wrote   {os.path.relpath(path, project)} (ANTHROPIC_BASE_URL=http://127.0.0.1:{args.port})",
           file=sys.stderr)
@@ -71,7 +98,9 @@ def _status(veil, args) -> int:
     from . import adopt
     h = adopt.health(args.port)
     print(f"proxy    {'up ' + json.dumps(h) if h else 'DOWN on :' + str(args.port)}")
-    print(f"service  {adopt.systemd_status() if sys.platform.startswith('linux') else adopt.service_status()}")
+    print(f"service  {_service_status(args.port)}")
+    from . import display
+    print(f"display  {display.configured_mode(state.home())} (answers show {'real values' if display.configured_mode(state.home()) == 'real' else 'pseudonyms'})")
     print(f"keys     {'env' if os.environ.get('VEIL_VAULT_KEY') else 'keychain/file'}; vault {len(veil.vault.tokens())} tokens, "
           f"{len(veil.known)} known values")
     path = os.path.join(os.path.abspath(args.project), ".claude", "settings.local.json")
@@ -80,6 +109,32 @@ def _status(veil, args) -> int:
     return 0 if h and wired else 1
 
 
+def _keys(args) -> int:
+    from . import rotate
+    try:
+        import httpx
+        httpx.get(f"http://127.0.0.1:{args.port}/veil/health", timeout=1, trust_env=False)
+        raise SystemExit(f"a veil proxy is running on :{args.port}; stop it first "
+                         "(`veil service uninstall` or Ctrl-C), rotate, then start it again")
+    except httpx.HTTPError:
+        pass
+    h = state.home()
+    if args.token_secret:
+        vault = state.load().vault
+        r = rotate.rotate_token_secret(h, vault, drop_old=args.drop_old)
+        vault.close()
+        print(f"token secret rotated: new pseudonyms from now on; "
+              + (f"{r['dropped']} old pseudonyms forgotten" if args.drop_old else
+                 f"{r['retired']} old pseudonyms retired (still restored in existing conversations)")
+              + ". Teams: `veil team export` again and have everyone join.")
+    else:
+        state.load().vault.close()  # finishes an interrupted rotation, checks the current key works
+        r = rotate.rotate_vault_key(h)
+        print(f"vault key rotated: re-encrypted {r['vault_rows']} vault rows, {r['retired']} retired, "
+              f"{r['files']} files; pseudonyms unchanged")
+    return 0
+
+
 def _team(args) -> int:
     import os
     from . import team
@@ -114,7 +169,8 @@ def _team(args) -> int:
         state.save_config(cfg)
         print(f"allowlist: {cfg['allow']}", file=sys.stderr)
     else:
-        doc = team.managed_settings(args.port, hooks=not args.no_hooks, lock_hooks=args.lock_hooks)
+        doc = team.managed_settings(args.port, hooks=not args.no_hooks, lock_hooks=args.lock_hooks,
+                                    display=args.display)
         with open(args.out, "w") as f:
             json.dump(doc, f, indent=2)
             f.write("\n")
@@ -122,9 +178,25 @@ def _team(args) -> int:
     return 0
 
 
+def _service_status(port: int) -> str:
+    from . import adopt
+    if sys.platform == "win32":
+        return adopt.windows_status(port)
+    return adopt.systemd_status() if sys.platform.startswith("linux") else adopt.service_status()
+
+
 def _service(args) -> int:
     from . import adopt
     linux = sys.platform.startswith("linux")
+    if sys.platform == "win32":
+        if args.action == "install":
+            path = adopt.windows_install(args.port, args.upstream, args.ner, state.home(), capture=args.capture)
+            print(f"installed {path}; status: {adopt.windows_status(args.port)}")
+        elif args.action == "uninstall":
+            print("removed" if adopt.windows_uninstall(state.home()) else "not installed")
+        else:
+            print(adopt.windows_status(args.port))
+        return 0
     if args.action == "install":
         if linux:
             path = adopt.systemd_install(args.port, args.upstream, args.ner, state.home(), capture=args.capture)
@@ -157,10 +229,25 @@ def main(argv: list[str] | None = None) -> int:
         return 0
     p = argparse.ArgumentParser(prog="veil")
     sub = p.add_subparsers(dest="cmd", required=True)
-    s = sub.add_parser("seed"); s.add_argument("sources", nargs="+")
+    s = sub.add_parser("seed"); s.add_argument("sources", nargs="*")
+    s.add_argument("--no-remember", action="store_true", help="don't re-seed this source automatically")
+    s.add_argument("--refresh", action="store_true", help="re-seed every remembered source now")
+    s.add_argument("--schema", metavar="DIR", help="learn personal fields from ORM schemas / annotations in DIR first")
+    s = sub.add_parser("sources"); s.add_argument("action", nargs="?", choices=["list", "remove"], default="list")
+    s.add_argument("which", nargs="?", help="index (from `veil sources`) or the source itself")
     s = sub.add_parser("seed-sqlite"); s.add_argument("path")  # back-compat alias
     sub.add_parser("seed-env")
     sub.add_parser("redact"); sub.add_parser("rehydrate")
+    s = sub.add_parser("display"); s.add_argument("mode", nargs="?", choices=["real", "tokens"])
+    s = sub.add_parser("keys", help="rotate the vault key (re-encrypt) or the token secret (new pseudonyms)")
+    s.add_argument("action", choices=["rotate"])
+    s.add_argument("--token-secret", action="store_true", help="new pseudonyms instead of a new vault key")
+    s.add_argument("--drop-old", action="store_true", help="with --token-secret: forget old pseudonyms")
+    s.add_argument("--port", type=int, default=8787, help="refuse while a proxy listens here")
+    s = sub.add_parser("quasi", help="quasi-identifiers (city, zip, birth date, company, job title): warn|redact|off")
+    s.add_argument("mode", nargs="?", choices=["warn", "redact", "off"])
+    for name in ("reveal", "share"):
+        s = sub.add_parser(name); s.add_argument("file", nargs="?", default="-")
     s = sub.add_parser("proxy"); s.add_argument("--port", type=int, default=8787)
     s.add_argument("--upstream", default="https://api.anthropic.com")
     s.add_argument("--show-tokens", action="store_true", help="don't rehydrate assistant text")
@@ -169,7 +256,14 @@ def main(argv: list[str] | None = None) -> int:
     s.add_argument("--openai-upstream", metavar="URL",
                    help="OpenAI-format upstream for /chat/completions (e.g. https://api.deepseek.com)")
     s.add_argument("--bedrock-upstream", metavar="URL", help="e.g. https://bedrock-runtime.us-east-1.amazonaws.com")
+    s.add_argument("--pid-file", metavar="PATH", help="write the process id here (removed on exit)")
+    s.add_argument("--reseed-interval", type=float, default=30,
+                   help="seconds between change checks of remembered sources (0 = off)")
     s.add_argument("--vertex-upstream", metavar="URL", help="e.g. https://us-east5-aiplatform.googleapis.com")
+    s.add_argument("--foundry-upstream", metavar="URL",
+                   help="Microsoft Foundry, served at /foundry: e.g. https://RESOURCE.services.ai.azure.com/anthropic")
+    s.add_argument("--anthropic-aws-upstream", metavar="URL",
+                   help="Claude Platform on AWS, served at /anthropic-aws: e.g. https://aws-external-anthropic.us-east-1.api.aws")
     s = sub.add_parser("hook"); s.add_argument("kind", choices=["pre", "post"])
     s = sub.add_parser("init"); s.add_argument("project", nargs="?", default=".")
     s.add_argument("--port", type=int, default=8787); s.add_argument("--source", action="append", default=[])
@@ -181,6 +275,7 @@ def main(argv: list[str] | None = None) -> int:
     s.add_argument("value", nargs="*"); s.add_argument("--passphrase-env", metavar="VAR")
     s.add_argument("--reset-vault", action="store_true"); s.add_argument("--port", type=int, default=8787)
     s.add_argument("--no-hooks", action="store_true"); s.add_argument("--lock-hooks", action="store_true")
+    s.add_argument("--display", choices=["real", "tokens"], help="managed-settings: enforce pseudonyms in answers")
     s.add_argument("--out", default="50-veil.json")
     s = sub.add_parser("service"); s.add_argument("action", choices=["install", "uninstall", "status"])
     s.add_argument("--port", type=int, default=8787); s.add_argument("--upstream", default="https://api.anthropic.com")
@@ -189,6 +284,28 @@ def main(argv: list[str] | None = None) -> int:
 
     if args.cmd == "service":
         return _service(args)
+    if args.cmd == "display":
+        from . import display
+        if args.mode:
+            cfg = state.config(); cfg["display"] = args.mode; state.save_config(cfg)
+        mode = display.configured_mode(state.home())
+        print(f"display: {mode}" + ("  (VEIL_DISPLAY overrides config)" if __import__("os").environ.get("VEIL_DISPLAY") else "")
+              + ("\nnote: a managed `x-veil-display: tokens` header still forces pseudonyms" if mode == "real" else ""))
+        return 0
+    if args.cmd == "keys":
+        return _keys(args)
+    if args.cmd == "quasi":
+        from . import quasi
+        if args.mode:
+            cfg = state.config(); cfg["quasi"] = args.mode; state.save_config(cfg)
+        known = state.load().known
+        rare = known.rare_quasi()
+        by_kind: dict[str, int] = {}
+        for kind, _, _ in rare.values():
+            by_kind[kind] = by_kind.get(kind, 0) + 1
+        print(f"quasi-identifiers: {quasi.mode(state.home())}  ({len(rare)} rare of {len(known._quasi)} seeded"
+              + (": " + ", ".join(f"{k} {n}" for k, n in sorted(by_kind.items())) if by_kind else "") + ")")
+        return 0
     if args.cmd == "team":
         return _team(args)
     if args.cmd == "init" and args.dry_run:
@@ -199,31 +316,79 @@ def main(argv: list[str] | None = None) -> int:
     if args.cmd == "status":
         return _status(veil, args)
     if args.cmd in ("seed", "seed-sqlite"):
-        for source in (args.sources if args.cmd == "seed" else [args.path]):
+        from .adopt import redact_uri
+        given = (args.sources if args.cmd == "seed" else [args.path])
+        if getattr(args, "schema", None):
+            _learn_schema(args.schema)
+        todo = given + (state.load_sources(veil.vault.cipher) if getattr(args, "refresh", False) else [])
+        if not todo:
+            raise SystemExit("usage: veil seed SOURCE... | veil seed --refresh")
+        for source in dict.fromkeys(todo):
             report = seed(veil.known, source)
-            print(f"# {source.split('@')[-1]}", file=sys.stderr)  # never echo credentials
+            print(f"# {redact_uri(source) if '://' in source else source}", file=sys.stderr)  # never echo credentials
             print(report.table(), file=sys.stderr)
         state.save_known(veil.known, veil.vault.cipher)
+        if given and not getattr(args, "no_remember", False):
+            n = len(state.remember_sources(given, veil.vault.cipher))
+            print(f"{n} source(s) remembered: the proxy re-seeds them when they change", file=sys.stderr)
         print(f"{len(veil.known)} known values in total", file=sys.stderr)
+    elif args.cmd == "sources":
+        from .adopt import redact_uri
+        current = state.load_sources(veil.vault.cipher)
+        if args.action == "remove":
+            if args.which is None:
+                raise SystemExit("usage: veil sources remove INDEX|SOURCE")
+            drop = current[int(args.which)] if args.which.isdigit() and int(args.which) < len(current) else args.which
+            current = [c for c in current if c != drop]
+            state.save_sources(current, veil.vault.cipher)
+        for i, src in enumerate(current):
+            print(f"{i}  {redact_uri(src) if '://' in src else src}")
+        if not current:
+            print("(no remembered sources: `veil seed SOURCE` adds one)")
     elif args.cmd == "seed-env":
         found = seed_environment(veil.known)
         state.save_known(veil.known, veil.vault.cipher)
         print(f"{len(found)} identity values learned", file=sys.stderr)
+    elif args.cmd in ("reveal", "share"):
+        text = sys.stdin.read() if args.file == "-" else open(args.file, encoding="utf-8").read()
+        sys.stdout.write(veil.rehydrate(text) if args.cmd == "reveal" else veil.redact(text, free_text=True))
     elif args.cmd == "redact":
         sys.stdout.write(veil.redact(sys.stdin.read()))
     elif args.cmd == "rehydrate":
         sys.stdout.write(veil.rehydrate(sys.stdin.read()))
     elif args.cmd == "proxy":
         from .proxy import serve
+        from .reseed import warm
         if args.ner:
             from .ner import GlinerDetector
             veil.ner = GlinerDetector()
+        warm(veil.known)
         server = serve(veil, Policy(display_real=not args.show_tokens), args.port, args.upstream, args.capture,
-                       args.openai_upstream, args.bedrock_upstream, args.vertex_upstream)
+                       args.openai_upstream, args.bedrock_upstream, args.vertex_upstream,
+                       args.foundry_upstream, args.anthropic_aws_upstream)
+        sources = state.load_sources(veil.vault.cipher)
+        if sources and args.reseed_interval > 0:
+            from .reseed import Reseeder
+            veil.reseeder = Reseeder(veil, sources, interval=args.reseed_interval,
+                                     save=lambda known: state.save_known(known, veil.vault.cipher))
+            veil.reseeder.start()
+            print(f"[veil] re-seeding {len(sources)} source(s) on change (checked every {args.reseed_interval:g}s)",
+                  file=sys.stderr)
+        if args.pid_file:
+            import os
+            with open(args.pid_file, "w") as f:
+                f.write(str(os.getpid()))
         try:
             server.serve_forever()
         except KeyboardInterrupt:
             pass
+        finally:
+            if args.pid_file:
+                import os
+                try:
+                    os.remove(args.pid_file)
+                except OSError:
+                    pass
     elif args.cmd == "hook":
         return _hook(veil, args.kind)
     return 0