Enum AgentCommand 

pub enum AgentCommand {
    Plan {
        tag: Vec<String>,
        json: bool,
        output: Option<String>,
        vault: String,
    },
    Exec {
        only: Vec<String>,
        vault: String,
        command: Vec<String>,
    },
    Grant {
        name: String,
        only: Vec<String>,
        ttl: String,
        out: Option<String>,
        vault: String,
    },
    Init {
        name: String,
        only: Vec<String>,
        allow_tag: Vec<String>,
        ttl: String,
        out: Option<String>,
        vault: String,
    },
    Ls {
        json: bool,
        vault: String,
    },
    Revoke {
        name: String,
        rotate: bool,
        vault: String,
    },
}

Variants

Plan

Emit schema-only context safe to paste into an AI agent prompt

Fields

tag: Vec<String>

Filter by tag (repeatable)

json: bool

Output as JSON

output: Option<String>

Output file (prints to stdout if omitted)

vault: String

Vault filename

Exec

Run a command with strict agent-safe defaults (clears the inherited environment, strips MURK_KEY, requires –only)

Fields

only: Vec<String>

Inject these specific keys (required — agent mode fails closed)

vault: String

Vault filename

command: Vec<String>

Command and arguments to execute

Grant

Mint a short-lived ephemeral key that can read only the named secrets

Fields

name: String

Grant name (used to revoke it later)

only: Vec<String>

Keys this grant can read (required — fails closed)

ttl: String

Time to live, e.g. 30m, 2h, 7d (advisory — see agent revoke)

out: Option<String>

Where to write the agent key: a path, or - for stdout

vault: String

Vault filename

Init

One-shot onboarding: optionally set the agent allow-list, mint a scoped grant, and print how to run the agent safely

Fields

name: String

Grant name (used to revoke it later)

only: Vec<String>

Keys the agent can read (required — fails closed)

allow_tag: Vec<String>

Set the agent allow-list to these tags before granting (repeatable)

ttl: String

Time to live, e.g. 30m, 2h, 7d (advisory — see agent revoke)

out: Option<String>

Where to write the agent key: a path, or - for stdout

vault: String

Vault filename

Ls

List active agent grants and their TTLs

Fields

json: bool

Output as JSON

vault: String

Vault filename

Revoke

Revoke an agent grant and rotate the keys it could read

Fields

name: String

Grant name

rotate: bool

Rotate the keys it could read in the same session

vault: String

Vault filename

Trait Implementations

impl FromArgMatches for AgentCommand

fn from_arg_matches(__clap_arg_matches: &ArgMatches) -> Result<Self, Error>

Instantiate Self from ArgMatches, parsing the arguments as needed.

fn from_arg_matches_mut( __clap_arg_matches: &mut ArgMatches, ) -> Result<Self, Error>

Instantiate Self from ArgMatches, parsing the arguments as needed.

fn update_from_arg_matches( &mut self, __clap_arg_matches: &ArgMatches, ) -> Result<(), Error>

Assign values from ArgMatches to self.

fn update_from_arg_matches_mut<'b>( &mut self, __clap_arg_matches: &mut ArgMatches, ) -> Result<(), Error>

Assign values from ArgMatches to self.

impl Subcommand for AgentCommand

fn augment_subcommands<'b>(__clap_app: Command) -> Command

Append to Command so it can instantiate Self via FromArgMatches::from_arg_matches_mut

fn augment_subcommands_for_update<'b>(__clap_app: Command) -> Command

Append to Command so it can instantiate self via FromArgMatches::update_from_arg_matches_mut

fn has_subcommand(__clap_name: &str) -> bool

Test whether Self can parse a specific subcommand