Proxy command

`varlock proxy`

Manages credential proxy sessions: running an untrusted child process so it only sees placeholder secrets while real values are injected at the network boundary. Route secrets by adding @proxy(domain=...) to the items you want to protect.

varlock proxy <subcommand> [options]

Every subcommand operates on a session. Target one with --session <id>, or let it auto-resolve: run attaches to the daemon for the current directory (else starts its own), and the other subcommands use the single active session (asking for --session if more than one is running).

Subcommands:

run -- <command>: Start a proxy, run <command> through it, and tear down on exit. Attaches to a running proxy start session for this directory if one exists; otherwise runs self-contained.
start: Start a long-lived proxy session that owns the terminal (a live request log appears here). Stop with Ctrl+C.
rules: Print a static summary of the effective @proxy configuration: the rules (host/path/method, block) and each secret’s mode (proxied / placeholder / passthrough / omit), without starting a proxy.
env: Print the proxy + CA environment for a session, to source into another shell (eval "$(varlock proxy env)").
status: List active proxy sessions.
audit: Print a session’s request audit log (no secret values).
reload: Re-resolve the schema and swap a running proxy’s live policy without restarting, after an intentional schema edit. Must be run from a trusted terminal: a reload requested from inside the proxied agent is refused and logged. Requires the proxy’s reload posture to allow it (see --allow-reload / @proxyConfig={reload=...}); otherwise restart the proxy to apply schema changes.
stop: Stop a session.

Options:

--session <id>: Target a specific session by id.
--new: For run, force a fresh proxy instead of attaching to a running one.
--port <n>: For start/run (when it starts a proxy), bind a fixed loopback port instead of a random one, so you can point tools at a known HTTP_PROXY before the proxy starts. Refuses to start if the port is already in use.
--cert-dir <dir>: For start/run (when it starts a proxy), write the CA cert (ca-cert.pem + combined-ca.pem) into a known directory instead of a temp one, so tools can trust it at a fixed path. Created if missing; only the cert files are removed on stop.
--all: For status/stop, include all sessions (status also shows ended sessions).
--allow-reload / --no-allow-reload: For start/run, override the reload posture. --allow-reload forces manual (human-applied from a trusted terminal; agent-context reloads refused), --no-allow-reload forces off. Otherwise @proxyConfig={reload=...} applies, defaulting to auto (manual for an interactive proxy start, off for headless or one-shot proxy run). On a shared uid this is a bar-raiser, not a hard boundary, so prefer a sandbox.
--inject <all｜vars｜blob>: For run, control what is injected into the child env (default all).
--redact-stdout / --no-redact-stdout: For run, override the automatic per-stream redaction. By default output is redacted only when piped or redirected; streams attached to an interactive terminal pass through as a raw TTY, so interactive tools like claude work. --no-redact-stdout disables redaction entirely; --redact-stdout forces it for piped output (and errors on a TTY). Also settable via _VARLOCK_REDACT_STDOUT.
--watch: For status, continuously refresh.
--format <text｜json>: Output format for audit (text/json) and env (shell/json).

Examples:

# Run an agent through the proxy
varlock proxy run -- claude

# Daemon in one terminal, attach from another
varlock proxy start
varlock proxy run -- node agent.js

# Inspect activity
varlock proxy status
varlock proxy audit --format json

See the credential proxy guide for the full workflow.