Local credential proxy for AI agents (proxy MVP)

.bumpy/encrypt-injected-blob-on-spawn.md

@@ -0,0 +1,7 @@
+---
+varlock: patch
+---
+
+`@encryptInjectedEnv` is now honored when `varlock run` / `varlock proxy run` inject the env blob.
+
+Previously the setting only applied to the library auto-load path and build-time integrations; the CLI spawn paths injected a plaintext `__VARLOCK_ENV` blob and merely forwarded a pre-existing key. In blob-only inject mode (`--inject blob`), the blob is now encrypted with an ephemeral key carried alongside it, so resolved values never sit in plaintext in the child's environment. This is leak resistance (crash reporters, env dumps, logs), not protection from an attacker who can read the full environment.

.bumpy/proxy.md

@@ -0,0 +1,7 @@
+---
+varlock: patch
+---
+
+Add `varlock proxy`: a local credential proxy for AI agents (preview).
+
+Run an agent (or any untrusted tool) through a local MITM proxy so it only ever sees placeholder secrets: real values are injected at the wire (bound to a verified upstream TLS identity), responses are scrubbed back to placeholders, and every request is policy-checked and audited. Mark a secret with `@proxy(domain="api.example.com")`; sensitive items are shown to the child as placeholders by default, with `@proxy=passthrough` / `@proxy=omit` escape hatches. Route with host/path/method rules (`block`, `approval`), set egress with `@proxyConfig={egress="strict"}`, and hot-reload live policy with `varlock proxy reload`. Sessions are durable and auditable (`varlock proxy status` / `rules` / `audit`); `proxy start` runs a daemon with a live request log that other `proxy run` invocations attach to. Preview: same-uid, not a sandbox. See the [proxy guide](https://varlock.dev/guides/proxy/).

.github/workflows/test.yaml

@@ -54,6 +54,11 @@ jobs:
         run: bun run build:libs
       - name: Run tests
         run: bun run test:ci
+      # The vitest suite runs under Node; this check runs the proxy's verified-TLS
+      # injection (Invariant #1) under Bun, the runtime the compiled binary uses —
+      # Node cannot catch the Bun-specific pre-write leak it guards against.
+      - name: Proxy verified-TLS injection (Bun)
+        run: bun run --filter varlock test:proxy:bun
 
       # Determine which packages will be preview-released (used to gate native builds)
       - name: Check release packages

AGENTS.md

@@ -62,5 +62,9 @@ This is a monorepo managed with bun workspaces and Turborepo:
 ## Linting
 
 - Run **`bun run lint:fix`** from the repo root after completing a significant chunk of work (new feature, refactor, bug fix, etc.)
-- The linter uses ESLint with `@stylistic` and other plugins — auto-fix handles most formatting issues
+- The linter uses ESLint with `@stylistic` and other plugins; auto-fix handles most formatting issues
 - Do not leave lint errors unresolved; fix any that `--fix` cannot handle automatically
+
+## Writing style
+
+- **Do not use em dashes (`—`) or en dashes (`–`)** in any prose you write: docs, code comments, commit messages, PR descriptions, changeset entries, or design notes. They read as an AI-writing tell. Rewrite with a colon, comma, semicolon, parentheses, two sentences, or a plain hyphen (`-`) where that reads naturally. Only the em/en dash characters are banned; a regular hyphen is fine.

packages/varlock-website/src/content/docs/guides/ai-tools.mdx

@@ -66,7 +66,7 @@ Varlock does not auto-load a global schema (that would make two developers' mach
   <TabItem label="Claude">
     [Claude Code](https://docs.claude.com/en/docs/claude-code/overview) is Anthropic's CLI tool for AI-assisted coding.
 
-    **Environment variable:** `ANTHROPIC_API_KEY` — see [supported env variables](https://docs.claude.com/en/docs/claude-code/settings#environment-variables).
+    **Environment variable:** `ANTHROPIC_API_KEY` (see [supported env variables](https://docs.claude.com/en/docs/claude-code/settings#environment-variables)). Use the API key, not `CLAUDE_CODE_OAUTH_TOKEN`: that (from `claude setup-token`) only works for headless `claude -p` requests, not the interactive TUI.
 
     **In a project** — add to `.env.schema`: