#compdef murk

autoload -U is-at-least

_murk() {
    typeset -A opt_args
    typeset -a _arguments_options
    local ret=1

    if is-at-least 5.2; then
        _arguments_options=(-s -S -C)
    else
        _arguments_options=(-s -C)
    fi

    local context curcontext="$curcontext" state line
    _arguments "${_arguments_options[@]}" : \
'-h[Print help]' \
'--help[Print help]' \
":: :_murk_commands" \
"*::: :->murk" \
&& ret=0
    case $state in
    (murk)
        words=($line[1] "${words[@]}")
        (( CURRENT += 1 ))
        curcontext="${curcontext%:*:*}:murk-command-$line[1]:"
        case $line[1] in
            (init)
_arguments "${_arguments_options[@]}" : \
'--vault=[Vault filename]:VAULT:_default' \
'-h[Print help]' \
'--help[Print help]' \
&& ret=0
;;
(env)
_arguments "${_arguments_options[@]}" : \
'--vault=[Vault filename]:VAULT:_default' \
'-h[Print help]' \
'--help[Print help]' \
&& ret=0
;;
(restore)
_arguments "${_arguments_options[@]}" : \
'--vault=[Vault filename, for the restored-identity recipient check]:VAULT:_default' \
'-h[Print help]' \
'--help[Print help]' \
&& ret=0
;;
(recover)
_arguments "${_arguments_options[@]}" : \
'-h[Print help]' \
'--help[Print help]' \
&& ret=0
;;
(add)
_arguments "${_arguments_options[@]}" : \
'--desc=[Description for this key]:DESC:_default' \
'--example=[Example value]:EXAMPLE:_default' \
'--group=[Who can read it\: a group name (experimental), \`everyone\`, or \`me\`. Omit to keep an existing key'\''s tier; a new key is shared with everyone]:GROUP:_default' \
'*--tag=[Tag for grouping (repeatable)]:TAG:_default' \
'--vault=[Vault filename]:VAULT:_default' \
'--scoped[Deprecated alias for \`--group me\`]' \
'-h[Print help]' \
'--help[Print help]' \
':key -- Secret key name:_default' \
&& ret=0
;;
(generate)
_arguments "${_arguments_options[@]}" : \
'--length=[Length in bytes]:LENGTH:_default' \
'--desc=[Description for this key]:DESC:_default' \
'--example=[Example value]:EXAMPLE:_default' \
'--group=[Who can read it\: a group name (experimental), \`everyone\`, or \`me\`. Omit to keep an existing key'\''s tier; a new key is shared with everyone]:GROUP:_default' \
'*--tag=[Tag for grouping (repeatable)]:TAG:_default' \
'--vault=[Vault filename]:VAULT:_default' \
'--hex[Encode the value as hex instead of URL-safe base64]' \
'-h[Print help]' \
'--help[Print help]' \
':key -- Secret key name:_default' \
&& ret=0
;;
(rotate)
_arguments "${_arguments_options[@]}" : \
'--length=[Length in bytes for generated values]:LENGTH:_default' \
'(--generate --list)--values-from=[Read new values from a dotenv file of KEY=value lines (\`-\` for stdin), matched by key name]:FILE:_default' \
'--vault=[Vault filename]:VAULT:_default' \
'--all[Rotate all secrets in the vault]' \
'--generate[Generate random values instead of prompting]' \
'--hex[Encode generated values as hex instead of URL-safe base64]' \
'(--all --generate --hex)--list[List keys needing rotation instead of rotating (exits 1 if any)]' \
'(--all --generate --hex)--json[Output the listing as JSON, an object with \`verified\` and \`issues\` (with --list, exits 0 even when keys need rotating)]' \
'-h[Print help]' \
'--help[Print help]' \
'::key -- Secret key name (omit for --all):_default' \
&& ret=0
;;
(rm)
_arguments "${_arguments_options[@]}" : \
'--vault=[Vault filename]:VAULT:_default' \
'-h[Print help]' \
'--help[Print help]' \
':key -- Secret key name:_default' \
&& ret=0
;;
(get)
_arguments "${_arguments_options[@]}" : \
'--vault=[Vault filename]:VAULT:_default' \
'-h[Print help]' \
'--help[Print help]' \
':key -- Secret key name:_default' \
&& ret=0
;;
(edit)
_arguments "${_arguments_options[@]}" : \
'--group=[Edit values for this group instead of shared secrets (experimental)]:GROUP:_default' \
'--vault=[Vault filename]:VAULT:_default' \
'--scoped[Edit scoped overrides instead of shared secrets]' \
'-h[Print help]' \
'--help[Print help]' \
'::key -- Edit a single key (omit to edit all):_default' \
&& ret=0
;;
(ls)
_arguments "${_arguments_options[@]}" : \
'*--tag=[Filter by tag (repeatable)]:TAG:_default' \
'--vault=[Vault filename]:VAULT:_default' \
'--json[Output as JSON]' \
'-h[Print help]' \
'--help[Print help]' \
&& ret=0
;;
(export)
_arguments "${_arguments_options[@]}" : \
'*--tag=[Filter by tag (repeatable)]:TAG:_default' \
'--vault=[Vault filename]:VAULT:_default' \
'--json[Output as JSON]' \
'--allow-reserved[Allow keys named like loader/shell/tool variables (PATH, LD_*, GIT_*, MURK_*, ...)]' \
'-h[Print help]' \
'--help[Print help]' \
&& ret=0
;;
(import)
_arguments "${_arguments_options[@]}" : \
'--group=[Assign imported secrets to this group (\`everyone\`, \`me\`, or a group name, which is experimental). Omit to keep each existing key'\''s tier; new keys are shared with everyone]:GROUP:_default' \
'--example=[Example value applied to every imported key]:EXAMPLE:_default' \
'--vault=[Vault filename]:VAULT:_default' \
'--force[Overwrite existing secrets. Without it, import stops if any key already exists]' \
'-h[Print help]' \
'--help[Print help]' \
'::file -- Path to the .env file to import:_default' \
&& ret=0
;;
(describe)
_arguments "${_arguments_options[@]}" : \
'--example=[Example value. Omitting it clears the current example]:EXAMPLE:_default' \
'*--tag=[Tag for grouping (repeatable, replaces existing tags)]:TAG:_default' \
'--rotate-every=[Rotation interval, e.g. \`90d\` or \`90\` (days). \`never\` clears it]:DAYS:_default' \
'--expires=[Hard expiry date, e.g. \`2026-09-01\`. \`never\` clears it]:DATE:_default' \
'--vault=[Vault filename]:VAULT:_default' \
'-h[Print help (see more with '\''--help'\'')]' \
'--help[Print help (see more with '\''--help'\'')]' \
':key -- Secret key name:_default' \
':description -- Description text (replaces the current one):_default' \
&& ret=0
;;
(info)
_arguments "${_arguments_options[@]}" : \
'*--tag=[Filter by tag (repeatable)]:TAG:_default' \
'--vault=[Vault filename]:VAULT:_default' \
'--json[Output as JSON]' \
'-h[Print help]' \
'--help[Print help]' \
&& ret=0
;;
(skeleton)
_arguments "${_arguments_options[@]}" : \
'-o+[New output file; refuses an existing path (prints to stdout if omitted)]:OUTPUT:_default' \
'--output=[New output file; refuses an existing path (prints to stdout if omitted)]:OUTPUT:_default' \
'--vault=[Vault filename]:VAULT:_default' \
'-h[Print help]' \
'--help[Print help]' \
&& ret=0
;;
(exec)
_arguments "${_arguments_options[@]}" : \
'*--only=[Only inject these specific keys (repeatable)]:ONLY:_default' \
'*--tag=[Filter by tag (repeatable)]:TAG:_default' \
'--vault=[Vault filename]:VAULT:_default' \
'--clean-env[Start the command with only murk secrets plus PATH, HOME and TERM on Unix (on Windows, PATH and a fixed set of system variables)]' \
'--allow-reserved[Allow keys named like loader/shell/tool variables (PATH, LD_*, GIT_*, MURK_*, ...)]' \
'-h[Print help]' \
'--help[Print help]' \
'*::command -- Command and arguments to execute:_default' \
&& ret=0
;;
(agent)
_arguments "${_arguments_options[@]}" : \
'-h[Print help]' \
'--help[Print help]' \
":: :_murk__subcmd__agent_commands" \
"*::: :->agent" \
&& ret=0

    case $state in
    (agent)
        words=($line[1] "${words[@]}")
        (( CURRENT += 1 ))
        curcontext="${curcontext%:*:*}:murk-agent-command-$line[1]:"
        case $line[1] in
            (plan)
_arguments "${_arguments_options[@]}" : \
'*--tag=[Filter by tag (repeatable)]:TAG:_default' \
'-o+[New output file; refuses an existing path (prints to stdout if omitted)]:OUTPUT:_default' \
'--output=[New output file; refuses an existing path (prints to stdout if omitted)]:OUTPUT:_default' \
'--vault=[Vault filename]:VAULT:_default' \
'--json[Output as JSON]' \
'-h[Print help]' \
'--help[Print help]' \
&& ret=0
;;
(exec)
_arguments "${_arguments_options[@]}" : \
'*--only=[Inject these specific keys (required — agent mode fails closed)]:ONLY:_default' \
'--vault=[Vault filename]:VAULT:_default' \
'--allow-operator-key[Decrypt with a key that is not an agent grant\: your own stored key from ~/.config/murk/keys, or a full recipient'\''s MURK_KEY or MURK_KEY_FILE. Without this, agent exec needs an agent grant key]' \
'--allow-reserved[Allow keys named like loader/shell/tool variables (PATH, LD_*, GIT_*, MURK_*, ...)]' \
'-h[Print help]' \
'--help[Print help]' \
'*::command -- Command and arguments to execute:_default' \
&& ret=0
;;
(grant)
_arguments "${_arguments_options[@]}" : \
'--name=[Grant name (used to revoke it later)]:NAME:_default' \
'*--only=[Keys this grant can read (required — fails closed)]:ONLY:_default' \
'--ttl=[Time to live, e.g. 30m, 2h, 7d; at most 365d (reads fail closed after expiry)]:TTL:_default' \
'--out=[Where to write the agent key\: a path, or \`-\` for stdout]:OUT:_default' \
'--vault=[Vault filename]:VAULT:_default' \
'--renew[Replace the grant with this name\: revoke its key, mint a fresh one. Without this, murk refuses a name that still has a grant record, and an expired grant keeps its record until the next vault write]' \
'--force[Replace a file already at --out (refused by default)]' \
'-h[Print help]' \
'--help[Print help]' \
&& ret=0
;;
(init)
_arguments "${_arguments_options[@]}" : \
'--name=[Grant name (used to revoke it later)]:NAME:_default' \
'*--only=[Keys the agent can read (required — fails closed)]:ONLY:_default' \
'*--allow-tag=[Set the agent allow-list to these tags before granting (repeatable)]:ALLOW_TAG:_default' \
'--ttl=[Time to live, e.g. 30m, 2h, 7d; at most 365d (reads fail closed after expiry)]:TTL:_default' \
'--out=[Where to write the agent key\: a path, or \`-\` for stdout]:OUT:_default' \
'--vault=[Vault filename]:VAULT:_default' \
'--force[Replace a file already at --out (refused by default)]' \
'-h[Print help]' \
'--help[Print help]' \
&& ret=0
;;
(ls)
_arguments "${_arguments_options[@]}" : \
'--vault=[Vault filename]:VAULT:_default' \
'--json[Output as JSON]' \
'-h[Print help]' \
'--help[Print help]' \
&& ret=0
;;
(revoke)
_arguments "${_arguments_options[@]}" : \
'--values-from=[With --rotate, read new values from a dotenv file of KEY=value lines (\`-\` for stdin)]:FILE:_default' \
'--vault=[Vault filename]:VAULT:_default' \
'--rotate[Rotate the secrets the grant could read, in the same run. murk stores a new value for each. It does not rotate them at the provider]' \
'-h[Print help (see more with '\''--help'\'')]' \
'--help[Print help (see more with '\''--help'\'')]' \
':name -- Grant name:_default' \
&& ret=0
;;
(connect)
_arguments "${_arguments_options[@]}" : \
'*--only=[Keys the agent may read (required — fails closed)]:ONLY:_default' \
'*--allow-tag=[Set the agent allow-list to these tags before granting (repeatable)]:ALLOW_TAG:_default' \
'--ttl=[Grant time to live, e.g. 30m, 2h, 7d; at most 365d (reads fail closed after expiry)]:TTL:_default' \
'--name=[Grant name (used to disconnect/revoke it later)]:NAME:_default' \
'--vault=[Vault filename]:VAULT:_default' \
'--allow-exec[Also enable the \`murk_exec\` tool in the MCP server (writes \`--allow-exec\` into the client config)]' \
'-h[Print help]' \
'--help[Print help]' \
'::client -- Client to configure\: claude, cursor, vscode, zed, gemini, omp or codex. Omit it to configure every client that already has a config file or marker directory (such as `.cursor/`) next to the vault:_default' \
&& ret=0
;;
(disconnect)
_arguments "${_arguments_options[@]}" : \
'--name=[Grant name to revoke with --rotate]:NAME:_default' \
'--vault=[Vault filename]:VAULT:_default' \
'--rotate[Revoke the grant and rotate the keys it could read]' \
'-h[Print help]' \
'--help[Print help]' \
'::client -- Editor to disconnect. Omit for every configured editor:_default' \
&& ret=0
;;
(help)
_arguments "${_arguments_options[@]}" : \
":: :_murk__subcmd__agent__subcmd__help_commands" \
"*::: :->help" \
&& ret=0

    case $state in
    (help)
        words=($line[1] "${words[@]}")
        (( CURRENT += 1 ))
        curcontext="${curcontext%:*:*}:murk-agent-help-command-$line[1]:"
        case $line[1] in
            (plan)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(exec)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(grant)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(init)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(ls)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(revoke)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(connect)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(disconnect)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(help)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
        esac
    ;;
esac
;;
        esac
    ;;
esac
;;
(mcp)
_arguments "${_arguments_options[@]}" : \
'--vault=[Vault filename]:VAULT:_default' \
'--allow-exec[Enable the murk_exec tool (run commands with scoped secrets injected). Off by default\: it runs arbitrary commands as this user — the injected secrets are grant-scoped, but the command itself is not sandboxed]' \
'-h[Print help]' \
'--help[Print help]' \
&& ret=0
;;
(policy)
_arguments "${_arguments_options[@]}" : \
'-h[Print help]' \
'--help[Print help]' \
":: :_murk__subcmd__policy_commands" \
"*::: :->policy" \
&& ret=0

    case $state in
    (policy)
        words=($line[1] "${words[@]}")
        (( CURRENT += 1 ))
        curcontext="${curcontext%:*:*}:murk-policy-command-$line[1]:"
        case $line[1] in
            (show)
_arguments "${_arguments_options[@]}" : \
'--vault=[Vault filename]:VAULT:_default' \
'--json[Output as JSON]' \
'-h[Print help]' \
'--help[Print help]' \
&& ret=0
;;
(set)
_arguments "${_arguments_options[@]}" : \
'*--allow-tag=[Tag agents are allowed to receive (repeatable, required)]:ALLOW_TAG:_default' \
'--vault=[Vault filename]:VAULT:_default' \
'-h[Print help]' \
'--help[Print help]' \
&& ret=0
;;
(clear)
_arguments "${_arguments_options[@]}" : \
'--vault=[Vault filename]:VAULT:_default' \
'-h[Print help]' \
'--help[Print help]' \
&& ret=0
;;
(help)
_arguments "${_arguments_options[@]}" : \
":: :_murk__subcmd__policy__subcmd__help_commands" \
"*::: :->help" \
&& ret=0

    case $state in
    (help)
        words=($line[1] "${words[@]}")
        (( CURRENT += 1 ))
        curcontext="${curcontext%:*:*}:murk-policy-help-command-$line[1]:"
        case $line[1] in
            (show)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(set)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(clear)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(help)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
        esac
    ;;
esac
;;
        esac
    ;;
esac
;;
(circle)
_arguments "${_arguments_options[@]}" : \
'--vault=[Vault filename]:VAULT:_default' \
'--json[Output as JSON]' \
'-h[Print help]' \
'--help[Print help]' \
":: :_murk__subcmd__circle_commands" \
"*::: :->circle" \
&& ret=0

    case $state in
    (circle)
        words=($line[1] "${words[@]}")
        (( CURRENT += 1 ))
        curcontext="${curcontext%:*:*}:murk-circle-command-$line[1]:"
        case $line[1] in
            (authorize)
_arguments "${_arguments_options[@]}" : \
'--name=[Display name for this recipient]:NAME:_default' \
'--group=[Also add the new recipient to this group (experimental)]:GROUP:_default' \
'--vault=[Vault filename]:VAULT:_default' \
'--force[Accept changed GitHub keys. Without it, authorize stops when a user'\''s keys differ from the pinned set]' \
'--allow-ssh-rsa[Allow ssh-rsa keys. They are refused or skipped by default, so prefer ed25519]' \
'-h[Print help]' \
'--help[Print help]' \
':pubkey -- Public key (age1...), ssh\:path, ssh\: (default ~/.ssh/id_ed25519.pub), or github\:username (experimental):_default' \
&& ret=0
;;
(revoke)
_arguments "${_arguments_options[@]}" : \
'--values-from=[With --rotate, read new values from a dotenv file of KEY=value lines (\`-\` for stdin)]:FILE:_default' \
'--vault=[Vault filename]:VAULT:_default' \
'--rotate[Rotate the secrets they had access to in the same session]' \
'--force[Revoke every key of a multi-key GitHub user without confirmation]' \
'-h[Print help]' \
'--help[Print help]' \
':recipient -- Recipient pubkey, display name, or github\:username:_default' \
&& ret=0
;;
(help)
_arguments "${_arguments_options[@]}" : \
":: :_murk__subcmd__circle__subcmd__help_commands" \
"*::: :->help" \
&& ret=0

    case $state in
    (help)
        words=($line[1] "${words[@]}")
        (( CURRENT += 1 ))
        curcontext="${curcontext%:*:*}:murk-circle-help-command-$line[1]:"
        case $line[1] in
            (authorize)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(revoke)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(help)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
        esac
    ;;
esac
;;
        esac
    ;;
esac
;;
(authorize)
_arguments "${_arguments_options[@]}" : \
'--name=[Display name for this recipient]:NAME:_default' \
'--vault=[Vault filename]:VAULT:_default' \
'--force[Accept changed GitHub keys. Without it, authorize stops when a user'\''s keys differ from the pinned set]' \
'--allow-ssh-rsa[Allow ssh-rsa keys. They are refused or skipped by default, so prefer ed25519]' \
'-h[Print help]' \
'--help[Print help]' \
':pubkey -- Public key (age1...), ssh\:path, ssh\: (default ~/.ssh/id_ed25519.pub), or github\:username (experimental):_default' \
&& ret=0
;;
(revoke)
_arguments "${_arguments_options[@]}" : \
'--values-from=[With --rotate, read new values from a dotenv file of KEY=value lines (\`-\` for stdin)]:FILE:_default' \
'--vault=[Vault filename]:VAULT:_default' \
'--rotate[Rotate the secrets they had access to in the same session]' \
'--force[Revoke every key of a multi-key GitHub user without confirmation]' \
'-h[Print help]' \
'--help[Print help]' \
':recipient -- Recipient pubkey, display name, or github\:username:_default' \
&& ret=0
;;
(group)
_arguments "${_arguments_options[@]}" : \
'-h[Print help]' \
'--help[Print help]' \
":: :_murk__subcmd__group_commands" \
"*::: :->group" \
&& ret=0

    case $state in
    (group)
        words=($line[1] "${words[@]}")
        (( CURRENT += 1 ))
        curcontext="${curcontext%:*:*}:murk-group-command-$line[1]:"
        case $line[1] in
            (create)
_arguments "${_arguments_options[@]}" : \
'--vault=[Vault filename]:VAULT:_default' \
'-h[Print help]' \
'--help[Print help]' \
':name -- Group name:_default' \
&& ret=0
;;
(ls)
_arguments "${_arguments_options[@]}" : \
'--vault=[Vault filename]:VAULT:_default' \
'--json[Output as JSON]' \
'-h[Print help]' \
'--help[Print help]' \
&& ret=0
;;
(add)
_arguments "${_arguments_options[@]}" : \
'--member=[Recipient pubkey or display name to add]:MEMBER:_default' \
'--vault=[Vault filename]:VAULT:_default' \
'-h[Print help]' \
'--help[Print help]' \
':name -- Group name:_default' \
&& ret=0
;;
(rm)
_arguments "${_arguments_options[@]}" : \
'--member=[Recipient pubkey or display name to remove (omit to delete the group)]:MEMBER:_default' \
'--vault=[Vault filename]:VAULT:_default' \
'-h[Print help]' \
'--help[Print help]' \
':name -- Group name:_default' \
&& ret=0
;;
(help)
_arguments "${_arguments_options[@]}" : \
":: :_murk__subcmd__group__subcmd__help_commands" \
"*::: :->help" \
&& ret=0

    case $state in
    (help)
        words=($line[1] "${words[@]}")
        (( CURRENT += 1 ))
        curcontext="${curcontext%:*:*}:murk-group-help-command-$line[1]:"
        case $line[1] in
            (create)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(ls)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(add)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(rm)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(help)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
        esac
    ;;
esac
;;
        esac
    ;;
esac
;;
(verify)
_arguments "${_arguments_options[@]}" : \
'--vault=[Vault filename]:VAULT:_default' \
'-h[Print help]' \
'--help[Print help]' \
&& ret=0
;;
(trust)
_arguments "${_arguments_options[@]}" : \
'(--print-key)*--re-add=[Trust a key this machine recorded as removed from the vault again (its public key, or its name in the vault). Repeat for each key; a vault signed by or listing a removed key is never trusted without it]:KEY:_default' \
'--vault=[Vault filename]:VAULT:_default' \
'--yes[Accept without asking (for scripts; review first)]' \
'(--yes)--print-key[Print your own trusted-signer entry (for MURK_TRUSTED_SIGNERS) and signing-key fingerprint (for teammates to confirm), then exit]' \
'-h[Print help (see more with '\''--help'\'')]' \
'--help[Print help (see more with '\''--help'\'')]' \
&& ret=0
;;
(doctor)
_arguments "${_arguments_options[@]}" : \
'--vault=[Vault filename]:VAULT:_default' \
'-h[Print help]' \
'--help[Print help]' \
&& ret=0
;;
(scan)
_arguments "${_arguments_options[@]}" : \
'--vault=[Vault filename]:VAULT:_default' \
'-h[Print help]' \
'--help[Print help]' \
'*::paths -- Files or directories to scan (defaults to current directory):_default' \
&& ret=0
;;
(diff)
_arguments "${_arguments_options[@]}" : \
'--vault=[Vault filename]:VAULT:_default' \
'--show-values[Show actual values (not just key names)]' \
'--json[Output JSON\: {"secrets"\: \[...\], "changes"\: \[...\]} (values only with --show-values)]' \
'-h[Print help (see more with '\''--help'\'')]' \
'--help[Print help (see more with '\''--help'\'')]' \
'::git_ref -- Git ref to compare against:_default' \
&& ret=0
;;
(setup-merge-driver)
_arguments "${_arguments_options[@]}" : \
'-h[Print help]' \
'--help[Print help]' \
&& ret=0
;;
(merge-driver)
_arguments "${_arguments_options[@]}" : \
'-h[Print help]' \
'--help[Print help]' \
':base -- Path to base version (%O):_default' \
':ours -- Path to ours version (%A) — result is written here:_default' \
':theirs -- Path to theirs version (%B):_default' \
'::path -- The vault'\''s path in the work tree (%P), whose trust pin both sides are checked against:_default' \
&& ret=0
;;
(completion)
_arguments "${_arguments_options[@]}" : \
'-h[Print help]' \
'--help[Print help]' \
":: :_murk__subcmd__completion_commands" \
"*::: :->completion" \
&& ret=0

    case $state in
    (completion)
        words=($line[1] "${words[@]}")
        (( CURRENT += 1 ))
        curcontext="${curcontext%:*:*}:murk-completion-command-$line[1]:"
        case $line[1] in
            (generate)
_arguments "${_arguments_options[@]}" : \
'-h[Print help]' \
'--help[Print help]' \
':shell -- Shell to generate completions for:(bash elvish fish powershell zsh)' \
&& ret=0
;;
(install)
_arguments "${_arguments_options[@]}" : \
'-h[Print help]' \
'--help[Print help]' \
':shell -- Shell to install completions for:(bash elvish fish powershell zsh)' \
&& ret=0
;;
(help)
_arguments "${_arguments_options[@]}" : \
":: :_murk__subcmd__completion__subcmd__help_commands" \
"*::: :->help" \
&& ret=0

    case $state in
    (help)
        words=($line[1] "${words[@]}")
        (( CURRENT += 1 ))
        curcontext="${curcontext%:*:*}:murk-completion-help-command-$line[1]:"
        case $line[1] in
            (generate)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(install)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(help)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
        esac
    ;;
esac
;;
        esac
    ;;
esac
;;
(help)
_arguments "${_arguments_options[@]}" : \
":: :_murk__subcmd__help_commands" \
"*::: :->help" \
&& ret=0

    case $state in
    (help)
        words=($line[1] "${words[@]}")
        (( CURRENT += 1 ))
        curcontext="${curcontext%:*:*}:murk-help-command-$line[1]:"
        case $line[1] in
            (init)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(env)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(restore)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(recover)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(add)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(generate)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(rotate)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(rm)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(get)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(edit)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(ls)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(export)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(import)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(describe)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(info)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(skeleton)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(exec)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(agent)
_arguments "${_arguments_options[@]}" : \
":: :_murk__subcmd__help__subcmd__agent_commands" \
"*::: :->agent" \
&& ret=0

    case $state in
    (agent)
        words=($line[1] "${words[@]}")
        (( CURRENT += 1 ))
        curcontext="${curcontext%:*:*}:murk-help-agent-command-$line[1]:"
        case $line[1] in
            (plan)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(exec)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(grant)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(init)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(ls)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(revoke)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(connect)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(disconnect)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
        esac
    ;;
esac
;;
(mcp)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(policy)
_arguments "${_arguments_options[@]}" : \
":: :_murk__subcmd__help__subcmd__policy_commands" \
"*::: :->policy" \
&& ret=0

    case $state in
    (policy)
        words=($line[1] "${words[@]}")
        (( CURRENT += 1 ))
        curcontext="${curcontext%:*:*}:murk-help-policy-command-$line[1]:"
        case $line[1] in
            (show)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(set)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(clear)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
        esac
    ;;
esac
;;
(circle)
_arguments "${_arguments_options[@]}" : \
":: :_murk__subcmd__help__subcmd__circle_commands" \
"*::: :->circle" \
&& ret=0

    case $state in
    (circle)
        words=($line[1] "${words[@]}")
        (( CURRENT += 1 ))
        curcontext="${curcontext%:*:*}:murk-help-circle-command-$line[1]:"
        case $line[1] in
            (authorize)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(revoke)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
        esac
    ;;
esac
;;
(authorize)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(revoke)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(group)
_arguments "${_arguments_options[@]}" : \
":: :_murk__subcmd__help__subcmd__group_commands" \
"*::: :->group" \
&& ret=0

    case $state in
    (group)
        words=($line[1] "${words[@]}")
        (( CURRENT += 1 ))
        curcontext="${curcontext%:*:*}:murk-help-group-command-$line[1]:"
        case $line[1] in
            (create)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(ls)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(add)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(rm)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
        esac
    ;;
esac
;;
(verify)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(trust)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(doctor)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(scan)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(diff)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(setup-merge-driver)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(merge-driver)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(completion)
_arguments "${_arguments_options[@]}" : \
":: :_murk__subcmd__help__subcmd__completion_commands" \
"*::: :->completion" \
&& ret=0

    case $state in
    (completion)
        words=($line[1] "${words[@]}")
        (( CURRENT += 1 ))
        curcontext="${curcontext%:*:*}:murk-help-completion-command-$line[1]:"
        case $line[1] in
            (generate)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
(install)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
        esac
    ;;
esac
;;
(help)
_arguments "${_arguments_options[@]}" : \
&& ret=0
;;
        esac
    ;;
esac
;;
        esac
    ;;
esac
}

(( $+functions[_murk_commands] )) ||
_murk_commands() {
    local commands; commands=(
'init:Initialize a vault or reuse its existing key' \
'env:Write a .envrc for direnv integration' \
'restore:Print the key encoded by a BIP39 recovery phrase (saves nothing)' \
'recover:Print the BIP39 recovery phrase for the key murk resolves (MURK_KEY, MURK_KEY_FILE or the stored key for .murk)' \
'add:Add or update a secret' \
'generate:Generate a random secret and store it' \
'rotate:Rotate secrets with new values' \
'rm:Remove a secret' \
'get:Get a single decrypted value' \
'edit:Edit secrets in \$EDITOR (experimental)' \
'ls:List all key names' \
'export:Export all secrets as shell export statements' \
'import:Import secrets from a .env file' \
'describe:Set a key'\''s description, example, tags and rotation or expiry policy' \
'info:Show public schema and key info' \
'skeleton:Export schema-only vault with no secrets or recipients' \
'exec:Run a command with secrets injected as environment variables' \
'agent:Give AI agents scoped, time-limited access to secrets (experimental)' \
'mcp:Run an MCP (Model Context Protocol) stdio server for AI agents (experimental)' \
'policy:Manage the agent access policy (experimental)' \
'circle:Manage recipients' \
'authorize:Add a recipient to the vault' \
'revoke:Remove a recipient from the vault' \
'group:Manage recipient groups (experimental)' \
'verify:Verify vault integrity without exporting secrets' \
'trust:Review who signed the vault and what changed, then trust it on this machine' \
'doctor:Check the surrounding repo for hygiene issues' \
'scan:Scan files for leaked secret values' \
'diff:Show secret and access changes vs a git ref (experimental)' \
'setup-merge-driver:Configure git to use murk'\''s merge driver for .murk files (experimental)' \
'merge-driver:Git merge driver for .murk vault files (called by git; experimental)' \
'completion:Generate or install shell completions' \
'help:Print this message or the help of the given subcommand(s)' \
    )
    _describe -t commands 'murk commands' commands "$@"
}
(( $+functions[_murk__subcmd__add_commands] )) ||
_murk__subcmd__add_commands() {
    local commands; commands=()
    _describe -t commands 'murk add commands' commands "$@"
}
(( $+functions[_murk__subcmd__agent_commands] )) ||
_murk__subcmd__agent_commands() {
    local commands; commands=(
'plan:Emit schema-only context safe to paste into an AI agent prompt (experimental)' \
'exec:Run a command with strict agent-safe defaults (experimental; keeps only PATH, HOME and TERM from the inherited environment on Unix, or PATH and a fixed set of system variables on Windows, strips MURK_KEY, requires --only, masks injected values in the output)' \
'grant:Mint a scoped ephemeral key that can read only the named secrets (experimental)' \
'init:One-shot onboarding (experimental)\: optionally set the agent allow-list, mint a scoped grant, and print how to run the agent safely' \
'ls:List active agent grants and their TTLs (experimental)' \
'revoke:Revoke an agent grant (experimental)' \
'connect:Add \`murk mcp\` to an AI client'\''s MCP config and mint a scoped grant for it (experimental)' \
'disconnect:Remove murk'\''s entry from an AI editor'\''s MCP config (experimental). No CLIENT clears every configured editor. \`--rotate\` also revokes the grant and rotates its keys' \
'help:Print this message or the help of the given subcommand(s)' \
    )
    _describe -t commands 'murk agent commands' commands "$@"
}
(( $+functions[_murk__subcmd__agent__subcmd__connect_commands] )) ||
_murk__subcmd__agent__subcmd__connect_commands() {
    local commands; commands=()
    _describe -t commands 'murk agent connect commands' commands "$@"
}
(( $+functions[_murk__subcmd__agent__subcmd__disconnect_commands] )) ||
_murk__subcmd__agent__subcmd__disconnect_commands() {
    local commands; commands=()
    _describe -t commands 'murk agent disconnect commands' commands "$@"
}
(( $+functions[_murk__subcmd__agent__subcmd__exec_commands] )) ||
_murk__subcmd__agent__subcmd__exec_commands() {
    local commands; commands=()
    _describe -t commands 'murk agent exec commands' commands "$@"
}
(( $+functions[_murk__subcmd__agent__subcmd__grant_commands] )) ||
_murk__subcmd__agent__subcmd__grant_commands() {
    local commands; commands=()
    _describe -t commands 'murk agent grant commands' commands "$@"
}
(( $+functions[_murk__subcmd__agent__subcmd__help_commands] )) ||
_murk__subcmd__agent__subcmd__help_commands() {
    local commands; commands=(
'plan:Emit schema-only context safe to paste into an AI agent prompt (experimental)' \
'exec:Run a command with strict agent-safe defaults (experimental; keeps only PATH, HOME and TERM from the inherited environment on Unix, or PATH and a fixed set of system variables on Windows, strips MURK_KEY, requires --only, masks injected values in the output)' \
'grant:Mint a scoped ephemeral key that can read only the named secrets (experimental)' \
'init:One-shot onboarding (experimental)\: optionally set the agent allow-list, mint a scoped grant, and print how to run the agent safely' \
'ls:List active agent grants and their TTLs (experimental)' \
'revoke:Revoke an agent grant (experimental)' \
'connect:Add \`murk mcp\` to an AI client'\''s MCP config and mint a scoped grant for it (experimental)' \
'disconnect:Remove murk'\''s entry from an AI editor'\''s MCP config (experimental). No CLIENT clears every configured editor. \`--rotate\` also revokes the grant and rotates its keys' \
'help:Print this message or the help of the given subcommand(s)' \
    )
    _describe -t commands 'murk agent help commands' commands "$@"
}
(( $+functions[_murk__subcmd__agent__subcmd__help__subcmd__connect_commands] )) ||
_murk__subcmd__agent__subcmd__help__subcmd__connect_commands() {
    local commands; commands=()
    _describe -t commands 'murk agent help connect commands' commands "$@"
}
(( $+functions[_murk__subcmd__agent__subcmd__help__subcmd__disconnect_commands] )) ||
_murk__subcmd__agent__subcmd__help__subcmd__disconnect_commands() {
    local commands; commands=()
    _describe -t commands 'murk agent help disconnect commands' commands "$@"
}
(( $+functions[_murk__subcmd__agent__subcmd__help__subcmd__exec_commands] )) ||
_murk__subcmd__agent__subcmd__help__subcmd__exec_commands() {
    local commands; commands=()
    _describe -t commands 'murk agent help exec commands' commands "$@"
}
(( $+functions[_murk__subcmd__agent__subcmd__help__subcmd__grant_commands] )) ||
_murk__subcmd__agent__subcmd__help__subcmd__grant_commands() {
    local commands; commands=()
    _describe -t commands 'murk agent help grant commands' commands "$@"
}
(( $+functions[_murk__subcmd__agent__subcmd__help__subcmd__help_commands] )) ||
_murk__subcmd__agent__subcmd__help__subcmd__help_commands() {
    local commands; commands=()
    _describe -t commands 'murk agent help help commands' commands "$@"
}
(( $+functions[_murk__subcmd__agent__subcmd__help__subcmd__init_commands] )) ||
_murk__subcmd__agent__subcmd__help__subcmd__init_commands() {
    local commands; commands=()
    _describe -t commands 'murk agent help init commands' commands "$@"
}
(( $+functions[_murk__subcmd__agent__subcmd__help__subcmd__ls_commands] )) ||
_murk__subcmd__agent__subcmd__help__subcmd__ls_commands() {
    local commands; commands=()
    _describe -t commands 'murk agent help ls commands' commands "$@"
}
(( $+functions[_murk__subcmd__agent__subcmd__help__subcmd__plan_commands] )) ||
_murk__subcmd__agent__subcmd__help__subcmd__plan_commands() {
    local commands; commands=()
    _describe -t commands 'murk agent help plan commands' commands "$@"
}
(( $+functions[_murk__subcmd__agent__subcmd__help__subcmd__revoke_commands] )) ||
_murk__subcmd__agent__subcmd__help__subcmd__revoke_commands() {
    local commands; commands=()
    _describe -t commands 'murk agent help revoke commands' commands "$@"
}
(( $+functions[_murk__subcmd__agent__subcmd__init_commands] )) ||
_murk__subcmd__agent__subcmd__init_commands() {
    local commands; commands=()
    _describe -t commands 'murk agent init commands' commands "$@"
}
(( $+functions[_murk__subcmd__agent__subcmd__ls_commands] )) ||
_murk__subcmd__agent__subcmd__ls_commands() {
    local commands; commands=()
    _describe -t commands 'murk agent ls commands' commands "$@"
}
(( $+functions[_murk__subcmd__agent__subcmd__plan_commands] )) ||
_murk__subcmd__agent__subcmd__plan_commands() {
    local commands; commands=()
    _describe -t commands 'murk agent plan commands' commands "$@"
}
(( $+functions[_murk__subcmd__agent__subcmd__revoke_commands] )) ||
_murk__subcmd__agent__subcmd__revoke_commands() {
    local commands; commands=()
    _describe -t commands 'murk agent revoke commands' commands "$@"
}
(( $+functions[_murk__subcmd__authorize_commands] )) ||
_murk__subcmd__authorize_commands() {
    local commands; commands=()
    _describe -t commands 'murk authorize commands' commands "$@"
}
(( $+functions[_murk__subcmd__circle_commands] )) ||
_murk__subcmd__circle_commands() {
    local commands; commands=(
'authorize:Add a recipient to the vault' \
'revoke:Remove a recipient from the vault' \
'help:Print this message or the help of the given subcommand(s)' \
    )
    _describe -t commands 'murk circle commands' commands "$@"
}
(( $+functions[_murk__subcmd__circle__subcmd__authorize_commands] )) ||
_murk__subcmd__circle__subcmd__authorize_commands() {
    local commands; commands=()
    _describe -t commands 'murk circle authorize commands' commands "$@"
}
(( $+functions[_murk__subcmd__circle__subcmd__help_commands] )) ||
_murk__subcmd__circle__subcmd__help_commands() {
    local commands; commands=(
'authorize:Add a recipient to the vault' \
'revoke:Remove a recipient from the vault' \
'help:Print this message or the help of the given subcommand(s)' \
    )
    _describe -t commands 'murk circle help commands' commands "$@"
}
(( $+functions[_murk__subcmd__circle__subcmd__help__subcmd__authorize_commands] )) ||
_murk__subcmd__circle__subcmd__help__subcmd__authorize_commands() {
    local commands; commands=()
    _describe -t commands 'murk circle help authorize commands' commands "$@"
}
(( $+functions[_murk__subcmd__circle__subcmd__help__subcmd__help_commands] )) ||
_murk__subcmd__circle__subcmd__help__subcmd__help_commands() {
    local commands; commands=()
    _describe -t commands 'murk circle help help commands' commands "$@"
}
(( $+functions[_murk__subcmd__circle__subcmd__help__subcmd__revoke_commands] )) ||
_murk__subcmd__circle__subcmd__help__subcmd__revoke_commands() {
    local commands; commands=()
    _describe -t commands 'murk circle help revoke commands' commands "$@"
}
(( $+functions[_murk__subcmd__circle__subcmd__revoke_commands] )) ||
_murk__subcmd__circle__subcmd__revoke_commands() {
    local commands; commands=()
    _describe -t commands 'murk circle revoke commands' commands "$@"
}
(( $+functions[_murk__subcmd__completion_commands] )) ||
_murk__subcmd__completion_commands() {
    local commands; commands=(
'generate:Print completions to stdout' \
'install:Install completions to the standard path' \
'help:Print this message or the help of the given subcommand(s)' \
    )
    _describe -t commands 'murk completion commands' commands "$@"
}
(( $+functions[_murk__subcmd__completion__subcmd__generate_commands] )) ||
_murk__subcmd__completion__subcmd__generate_commands() {
    local commands; commands=()
    _describe -t commands 'murk completion generate commands' commands "$@"
}
(( $+functions[_murk__subcmd__completion__subcmd__help_commands] )) ||
_murk__subcmd__completion__subcmd__help_commands() {
    local commands; commands=(
'generate:Print completions to stdout' \
'install:Install completions to the standard path' \
'help:Print this message or the help of the given subcommand(s)' \
    )
    _describe -t commands 'murk completion help commands' commands "$@"
}
(( $+functions[_murk__subcmd__completion__subcmd__help__subcmd__generate_commands] )) ||
_murk__subcmd__completion__subcmd__help__subcmd__generate_commands() {
    local commands; commands=()
    _describe -t commands 'murk completion help generate commands' commands "$@"
}
(( $+functions[_murk__subcmd__completion__subcmd__help__subcmd__help_commands] )) ||
_murk__subcmd__completion__subcmd__help__subcmd__help_commands() {
    local commands; commands=()
    _describe -t commands 'murk completion help help commands' commands "$@"
}
(( $+functions[_murk__subcmd__completion__subcmd__help__subcmd__install_commands] )) ||
_murk__subcmd__completion__subcmd__help__subcmd__install_commands() {
    local commands; commands=()
    _describe -t commands 'murk completion help install commands' commands "$@"
}
(( $+functions[_murk__subcmd__completion__subcmd__install_commands] )) ||
_murk__subcmd__completion__subcmd__install_commands() {
    local commands; commands=()
    _describe -t commands 'murk completion install commands' commands "$@"
}
(( $+functions[_murk__subcmd__describe_commands] )) ||
_murk__subcmd__describe_commands() {
    local commands; commands=()
    _describe -t commands 'murk describe commands' commands "$@"
}
(( $+functions[_murk__subcmd__diff_commands] )) ||
_murk__subcmd__diff_commands() {
    local commands; commands=()
    _describe -t commands 'murk diff commands' commands "$@"
}
(( $+functions[_murk__subcmd__doctor_commands] )) ||
_murk__subcmd__doctor_commands() {
    local commands; commands=()
    _describe -t commands 'murk doctor commands' commands "$@"
}
(( $+functions[_murk__subcmd__edit_commands] )) ||
_murk__subcmd__edit_commands() {
    local commands; commands=()
    _describe -t commands 'murk edit commands' commands "$@"
}
(( $+functions[_murk__subcmd__env_commands] )) ||
_murk__subcmd__env_commands() {
    local commands; commands=()
    _describe -t commands 'murk env commands' commands "$@"
}
(( $+functions[_murk__subcmd__exec_commands] )) ||
_murk__subcmd__exec_commands() {
    local commands; commands=()
    _describe -t commands 'murk exec commands' commands "$@"
}
(( $+functions[_murk__subcmd__export_commands] )) ||
_murk__subcmd__export_commands() {
    local commands; commands=()
    _describe -t commands 'murk export commands' commands "$@"
}
(( $+functions[_murk__subcmd__generate_commands] )) ||
_murk__subcmd__generate_commands() {
    local commands; commands=()
    _describe -t commands 'murk generate commands' commands "$@"
}
(( $+functions[_murk__subcmd__get_commands] )) ||
_murk__subcmd__get_commands() {
    local commands; commands=()
    _describe -t commands 'murk get commands' commands "$@"
}
(( $+functions[_murk__subcmd__group_commands] )) ||
_murk__subcmd__group_commands() {
    local commands; commands=(
'create:Create a new recipient group (you become its first member)' \
'ls:List groups and their members' \
'add:Add a member to a group' \
'rm:Remove a member from a group, or delete the group entirely' \
'help:Print this message or the help of the given subcommand(s)' \
    )
    _describe -t commands 'murk group commands' commands "$@"
}
(( $+functions[_murk__subcmd__group__subcmd__add_commands] )) ||
_murk__subcmd__group__subcmd__add_commands() {
    local commands; commands=()
    _describe -t commands 'murk group add commands' commands "$@"
}
(( $+functions[_murk__subcmd__group__subcmd__create_commands] )) ||
_murk__subcmd__group__subcmd__create_commands() {
    local commands; commands=()
    _describe -t commands 'murk group create commands' commands "$@"
}
(( $+functions[_murk__subcmd__group__subcmd__help_commands] )) ||
_murk__subcmd__group__subcmd__help_commands() {
    local commands; commands=(
'create:Create a new recipient group (you become its first member)' \
'ls:List groups and their members' \
'add:Add a member to a group' \
'rm:Remove a member from a group, or delete the group entirely' \
'help:Print this message or the help of the given subcommand(s)' \
    )
    _describe -t commands 'murk group help commands' commands "$@"
}
(( $+functions[_murk__subcmd__group__subcmd__help__subcmd__add_commands] )) ||
_murk__subcmd__group__subcmd__help__subcmd__add_commands() {
    local commands; commands=()
    _describe -t commands 'murk group help add commands' commands "$@"
}
(( $+functions[_murk__subcmd__group__subcmd__help__subcmd__create_commands] )) ||
_murk__subcmd__group__subcmd__help__subcmd__create_commands() {
    local commands; commands=()
    _describe -t commands 'murk group help create commands' commands "$@"
}
(( $+functions[_murk__subcmd__group__subcmd__help__subcmd__help_commands] )) ||
_murk__subcmd__group__subcmd__help__subcmd__help_commands() {
    local commands; commands=()
    _describe -t commands 'murk group help help commands' commands "$@"
}
(( $+functions[_murk__subcmd__group__subcmd__help__subcmd__ls_commands] )) ||
_murk__subcmd__group__subcmd__help__subcmd__ls_commands() {
    local commands; commands=()
    _describe -t commands 'murk group help ls commands' commands "$@"
}
(( $+functions[_murk__subcmd__group__subcmd__help__subcmd__rm_commands] )) ||
_murk__subcmd__group__subcmd__help__subcmd__rm_commands() {
    local commands; commands=()
    _describe -t commands 'murk group help rm commands' commands "$@"
}
(( $+functions[_murk__subcmd__group__subcmd__ls_commands] )) ||
_murk__subcmd__group__subcmd__ls_commands() {
    local commands; commands=()
    _describe -t commands 'murk group ls commands' commands "$@"
}
(( $+functions[_murk__subcmd__group__subcmd__rm_commands] )) ||
_murk__subcmd__group__subcmd__rm_commands() {
    local commands; commands=()
    _describe -t commands 'murk group rm commands' commands "$@"
}
(( $+functions[_murk__subcmd__help_commands] )) ||
_murk__subcmd__help_commands() {
    local commands; commands=(
'init:Initialize a vault or reuse its existing key' \
'env:Write a .envrc for direnv integration' \
'restore:Print the key encoded by a BIP39 recovery phrase (saves nothing)' \
'recover:Print the BIP39 recovery phrase for the key murk resolves (MURK_KEY, MURK_KEY_FILE or the stored key for .murk)' \
'add:Add or update a secret' \
'generate:Generate a random secret and store it' \
'rotate:Rotate secrets with new values' \
'rm:Remove a secret' \
'get:Get a single decrypted value' \
'edit:Edit secrets in \$EDITOR (experimental)' \
'ls:List all key names' \
'export:Export all secrets as shell export statements' \
'import:Import secrets from a .env file' \
'describe:Set a key'\''s description, example, tags and rotation or expiry policy' \
'info:Show public schema and key info' \
'skeleton:Export schema-only vault with no secrets or recipients' \
'exec:Run a command with secrets injected as environment variables' \
'agent:Give AI agents scoped, time-limited access to secrets (experimental)' \
'mcp:Run an MCP (Model Context Protocol) stdio server for AI agents (experimental)' \
'policy:Manage the agent access policy (experimental)' \
'circle:Manage recipients' \
'authorize:Add a recipient to the vault' \
'revoke:Remove a recipient from the vault' \
'group:Manage recipient groups (experimental)' \
'verify:Verify vault integrity without exporting secrets' \
'trust:Review who signed the vault and what changed, then trust it on this machine' \
'doctor:Check the surrounding repo for hygiene issues' \
'scan:Scan files for leaked secret values' \
'diff:Show secret and access changes vs a git ref (experimental)' \
'setup-merge-driver:Configure git to use murk'\''s merge driver for .murk files (experimental)' \
'merge-driver:Git merge driver for .murk vault files (called by git; experimental)' \
'completion:Generate or install shell completions' \
'help:Print this message or the help of the given subcommand(s)' \
    )
    _describe -t commands 'murk help commands' commands "$@"
}
(( $+functions[_murk__subcmd__help__subcmd__add_commands] )) ||
_murk__subcmd__help__subcmd__add_commands() {
    local commands; commands=()
    _describe -t commands 'murk help add commands' commands "$@"
}
(( $+functions[_murk__subcmd__help__subcmd__agent_commands] )) ||
_murk__subcmd__help__subcmd__agent_commands() {
    local commands; commands=(
'plan:Emit schema-only context safe to paste into an AI agent prompt (experimental)' \
'exec:Run a command with strict agent-safe defaults (experimental; keeps only PATH, HOME and TERM from the inherited environment on Unix, or PATH and a fixed set of system variables on Windows, strips MURK_KEY, requires --only, masks injected values in the output)' \
'grant:Mint a scoped ephemeral key that can read only the named secrets (experimental)' \
'init:One-shot onboarding (experimental)\: optionally set the agent allow-list, mint a scoped grant, and print how to run the agent safely' \
'ls:List active agent grants and their TTLs (experimental)' \
'revoke:Revoke an agent grant (experimental)' \
'connect:Add \`murk mcp\` to an AI client'\''s MCP config and mint a scoped grant for it (experimental)' \
'disconnect:Remove murk'\''s entry from an AI editor'\''s MCP config (experimental). No CLIENT clears every configured editor. \`--rotate\` also revokes the grant and rotates its keys' \
    )
    _describe -t commands 'murk help agent commands' commands "$@"
}
(( $+functions[_murk__subcmd__help__subcmd__agent__subcmd__connect_commands] )) ||
_murk__subcmd__help__subcmd__agent__subcmd__connect_commands() {
    local commands; commands=()
    _describe -t commands 'murk help agent connect commands' commands "$@"
}
(( $+functions[_murk__subcmd__help__subcmd__agent__subcmd__disconnect_commands] )) ||
_murk__subcmd__help__subcmd__agent__subcmd__disconnect_commands() {
    local commands; commands=()
    _describe -t commands 'murk help agent disconnect commands' commands "$@"
}
(( $+functions[_murk__subcmd__help__subcmd__agent__subcmd__exec_commands] )) ||
_murk__subcmd__help__subcmd__agent__subcmd__exec_commands() {
    local commands; commands=()
    _describe -t commands 'murk help agent exec commands' commands "$@"
}
(( $+functions[_murk__subcmd__help__subcmd__agent__subcmd__grant_commands] )) ||
_murk__subcmd__help__subcmd__agent__subcmd__grant_commands() {
    local commands; commands=()
    _describe -t commands 'murk help agent grant commands' commands "$@"
}
(( $+functions[_murk__subcmd__help__subcmd__agent__subcmd__init_commands] )) ||
_murk__subcmd__help__subcmd__agent__subcmd__init_commands() {
    local commands; commands=()
    _describe -t commands 'murk help agent init commands' commands "$@"
}
(( $+functions[_murk__subcmd__help__subcmd__agent__subcmd__ls_commands] )) ||
_murk__subcmd__help__subcmd__agent__subcmd__ls_commands() {
    local commands; commands=()
    _describe -t commands 'murk help agent ls commands' commands "$@"
}
(( $+functions[_murk__subcmd__help__subcmd__agent__subcmd__plan_commands] )) ||
_murk__subcmd__help__subcmd__agent__subcmd__plan_commands() {
    local commands; commands=()
    _describe -t commands 'murk help agent plan commands' commands "$@"
}
(( $+functions[_murk__subcmd__help__subcmd__agent__subcmd__revoke_commands] )) ||
_murk__subcmd__help__subcmd__agent__subcmd__revoke_commands() {
    local commands; commands=()
    _describe -t commands 'murk help agent revoke commands' commands "$@"
}
(( $+functions[_murk__subcmd__help__subcmd__authorize_commands] )) ||
_murk__subcmd__help__subcmd__authorize_commands() {
    local commands; commands=()
    _describe -t commands 'murk help authorize commands' commands "$@"
}
(( $+functions[_murk__subcmd__help__subcmd__circle_commands] )) ||
_murk__subcmd__help__subcmd__circle_commands() {
    local commands; commands=(
'authorize:Add a recipient to the vault' \
'revoke:Remove a recipient from the vault' \
    )
    _describe -t commands 'murk help circle commands' commands "$@"
}
(( $+functions[_murk__subcmd__help__subcmd__circle__subcmd__authorize_commands] )) ||
_murk__subcmd__help__subcmd__circle__subcmd__authorize_commands() {
    local commands; commands=()
    _describe -t commands 'murk help circle authorize commands' commands "$@"
}
(( $+functions[_murk__subcmd__help__subcmd__circle__subcmd__revoke_commands] )) ||
_murk__subcmd__help__subcmd__circle__subcmd__revoke_commands() {
    local commands; commands=()
    _describe -t commands 'murk help circle revoke commands' commands "$@"
}
(( $+functions[_murk__subcmd__help__subcmd__completion_commands] )) ||
_murk__subcmd__help__subcmd__completion_commands() {
    local commands; commands=(
'generate:Print completions to stdout' \
'install:Install completions to the standard path' \
    )
    _describe -t commands 'murk help completion commands' commands "$@"
}
(( $+functions[_murk__subcmd__help__subcmd__completion__subcmd__generate_commands] )) ||
_murk__subcmd__help__subcmd__completion__subcmd__generate_commands() {
    local commands; commands=()
    _describe -t commands 'murk help completion generate commands' commands "$@"
}
(( $+functions[_murk__subcmd__help__subcmd__completion__subcmd__install_commands] )) ||
_murk__subcmd__help__subcmd__completion__subcmd__install_commands() {
    local commands; commands=()
    _describe -t commands 'murk help completion install commands' commands "$@"
}
(( $+functions[_murk__subcmd__help__subcmd__describe_commands] )) ||
_murk__subcmd__help__subcmd__describe_commands() {
    local commands; commands=()
    _describe -t commands 'murk help describe commands' commands "$@"
}
(( $+functions[_murk__subcmd__help__subcmd__diff_commands] )) ||
_murk__subcmd__help__subcmd__diff_commands() {
    local commands; commands=()
    _describe -t commands 'murk help diff commands' commands "$@"
}
(( $+functions[_murk__subcmd__help__subcmd__doctor_commands] )) ||
_murk__subcmd__help__subcmd__doctor_commands() {
    local commands; commands=()
    _describe -t commands 'murk help doctor commands' commands "$@"
}
(( $+functions[_murk__subcmd__help__subcmd__edit_commands] )) ||
_murk__subcmd__help__subcmd__edit_commands() {
    local commands; commands=()
    _describe -t commands 'murk help edit commands' commands "$@"
}
(( $+functions[_murk__subcmd__help__subcmd__env_commands] )) ||
_murk__subcmd__help__subcmd__env_commands() {
    local commands; commands=()
    _describe -t commands 'murk help env commands' commands "$@"
}
(( $+functions[_murk__subcmd__help__subcmd__exec_commands] )) ||
_murk__subcmd__help__subcmd__exec_commands() {
    local commands; commands=()
    _describe -t commands 'murk help exec commands' commands "$@"
}
(( $+functions[_murk__subcmd__help__subcmd__export_commands] )) ||
_murk__subcmd__help__subcmd__export_commands() {
    local commands; commands=()
    _describe -t commands 'murk help export commands' commands "$@"
}
(( $+functions[_murk__subcmd__help__subcmd__generate_commands] )) ||
_murk__subcmd__help__subcmd__generate_commands() {
    local commands; commands=()
    _describe -t commands 'murk help generate commands' commands "$@"
}
(( $+functions[_murk__subcmd__help__subcmd__get_commands] )) ||
_murk__subcmd__help__subcmd__get_commands() {
    local commands; commands=()
    _describe -t commands 'murk help get commands' commands "$@"
}
(( $+functions[_murk__subcmd__help__subcmd__group_commands] )) ||
_murk__subcmd__help__subcmd__group_commands() {
    local commands; commands=(
'create:Create a new recipient group (you become its first member)' \
'ls:List groups and their members' \
'add:Add a member to a group' \
'rm:Remove a member from a group, or delete the group entirely' \
    )
    _describe -t commands 'murk help group commands' commands "$@"
}
(( $+functions[_murk__subcmd__help__subcmd__group__subcmd__add_commands] )) ||
_murk__subcmd__help__subcmd__group__subcmd__add_commands() {
    local commands; commands=()
    _describe -t commands 'murk help group add commands' commands "$@"
}
(( $+functions[_murk__subcmd__help__subcmd__group__subcmd__create_commands] )) ||
_murk__subcmd__help__subcmd__group__subcmd__create_commands() {
    local commands; commands=()
    _describe -t commands 'murk help group create commands' commands "$@"
}
(( $+functions[_murk__subcmd__help__subcmd__group__subcmd__ls_commands] )) ||
_murk__subcmd__help__subcmd__group__subcmd__ls_commands() {
    local commands; commands=()
    _describe -t commands 'murk help group ls commands' commands "$@"
}
(( $+functions[_murk__subcmd__help__subcmd__group__subcmd__rm_commands] )) ||
_murk__subcmd__help__subcmd__group__subcmd__rm_commands() {
    local commands; commands=()
    _describe -t commands 'murk help group rm commands' commands "$@"
}
(( $+functions[_murk__subcmd__help__subcmd__help_commands] )) ||
_murk__subcmd__help__subcmd__help_commands() {
    local commands; commands=()
    _describe -t commands 'murk help help commands' commands "$@"
}
(( $+functions[_murk__subcmd__help__subcmd__import_commands] )) ||
_murk__subcmd__help__subcmd__import_commands() {
    local commands; commands=()
    _describe -t commands 'murk help import commands' commands "$@"
}
(( $+functions[_murk__subcmd__help__subcmd__info_commands] )) ||
_murk__subcmd__help__subcmd__info_commands() {
    local commands; commands=()
    _describe -t commands 'murk help info commands' commands "$@"
}
(( $+functions[_murk__subcmd__help__subcmd__init_commands] )) ||
_murk__subcmd__help__subcmd__init_commands() {
    local commands; commands=()
    _describe -t commands 'murk help init commands' commands "$@"
}
(( $+functions[_murk__subcmd__help__subcmd__ls_commands] )) ||
_murk__subcmd__help__subcmd__ls_commands() {
    local commands; commands=()
    _describe -t commands 'murk help ls commands' commands "$@"
}
(( $+functions[_murk__subcmd__help__subcmd__mcp_commands] )) ||
_murk__subcmd__help__subcmd__mcp_commands() {
    local commands; commands=()
    _describe -t commands 'murk help mcp commands' commands "$@"
}
(( $+functions[_murk__subcmd__help__subcmd__merge-driver_commands] )) ||
_murk__subcmd__help__subcmd__merge-driver_commands() {
    local commands; commands=()
    _describe -t commands 'murk help merge-driver commands' commands "$@"
}
(( $+functions[_murk__subcmd__help__subcmd__policy_commands] )) ||
_murk__subcmd__help__subcmd__policy_commands() {
    local commands; commands=(
'show:Show the agent access policy (works without a key)' \
'set:Set the agent allow-list\: agents may only receive secrets carrying one of these tags' \
'clear:Remove the policy — agent mode becomes unrestricted again' \
    )
    _describe -t commands 'murk help policy commands' commands "$@"
}
(( $+functions[_murk__subcmd__help__subcmd__policy__subcmd__clear_commands] )) ||
_murk__subcmd__help__subcmd__policy__subcmd__clear_commands() {
    local commands; commands=()
    _describe -t commands 'murk help policy clear commands' commands "$@"
}
(( $+functions[_murk__subcmd__help__subcmd__policy__subcmd__set_commands] )) ||
_murk__subcmd__help__subcmd__policy__subcmd__set_commands() {
    local commands; commands=()
    _describe -t commands 'murk help policy set commands' commands "$@"
}
(( $+functions[_murk__subcmd__help__subcmd__policy__subcmd__show_commands] )) ||
_murk__subcmd__help__subcmd__policy__subcmd__show_commands() {
    local commands; commands=()
    _describe -t commands 'murk help policy show commands' commands "$@"
}
(( $+functions[_murk__subcmd__help__subcmd__recover_commands] )) ||
_murk__subcmd__help__subcmd__recover_commands() {
    local commands; commands=()
    _describe -t commands 'murk help recover commands' commands "$@"
}
(( $+functions[_murk__subcmd__help__subcmd__restore_commands] )) ||
_murk__subcmd__help__subcmd__restore_commands() {
    local commands; commands=()
    _describe -t commands 'murk help restore commands' commands "$@"
}
(( $+functions[_murk__subcmd__help__subcmd__revoke_commands] )) ||
_murk__subcmd__help__subcmd__revoke_commands() {
    local commands; commands=()
    _describe -t commands 'murk help revoke commands' commands "$@"
}
(( $+functions[_murk__subcmd__help__subcmd__rm_commands] )) ||
_murk__subcmd__help__subcmd__rm_commands() {
    local commands; commands=()
    _describe -t commands 'murk help rm commands' commands "$@"
}
(( $+functions[_murk__subcmd__help__subcmd__rotate_commands] )) ||
_murk__subcmd__help__subcmd__rotate_commands() {
    local commands; commands=()
    _describe -t commands 'murk help rotate commands' commands "$@"
}
(( $+functions[_murk__subcmd__help__subcmd__scan_commands] )) ||
_murk__subcmd__help__subcmd__scan_commands() {
    local commands; commands=()
    _describe -t commands 'murk help scan commands' commands "$@"
}
(( $+functions[_murk__subcmd__help__subcmd__setup-merge-driver_commands] )) ||
_murk__subcmd__help__subcmd__setup-merge-driver_commands() {
    local commands; commands=()
    _describe -t commands 'murk help setup-merge-driver commands' commands "$@"
}
(( $+functions[_murk__subcmd__help__subcmd__skeleton_commands] )) ||
_murk__subcmd__help__subcmd__skeleton_commands() {
    local commands; commands=()
    _describe -t commands 'murk help skeleton commands' commands "$@"
}
(( $+functions[_murk__subcmd__help__subcmd__trust_commands] )) ||
_murk__subcmd__help__subcmd__trust_commands() {
    local commands; commands=()
    _describe -t commands 'murk help trust commands' commands "$@"
}
(( $+functions[_murk__subcmd__help__subcmd__verify_commands] )) ||
_murk__subcmd__help__subcmd__verify_commands() {
    local commands; commands=()
    _describe -t commands 'murk help verify commands' commands "$@"
}
(( $+functions[_murk__subcmd__import_commands] )) ||
_murk__subcmd__import_commands() {
    local commands; commands=()
    _describe -t commands 'murk import commands' commands "$@"
}
(( $+functions[_murk__subcmd__info_commands] )) ||
_murk__subcmd__info_commands() {
    local commands; commands=()
    _describe -t commands 'murk info commands' commands "$@"
}
(( $+functions[_murk__subcmd__init_commands] )) ||
_murk__subcmd__init_commands() {
    local commands; commands=()
    _describe -t commands 'murk init commands' commands "$@"
}
(( $+functions[_murk__subcmd__ls_commands] )) ||
_murk__subcmd__ls_commands() {
    local commands; commands=()
    _describe -t commands 'murk ls commands' commands "$@"
}
(( $+functions[_murk__subcmd__mcp_commands] )) ||
_murk__subcmd__mcp_commands() {
    local commands; commands=()
    _describe -t commands 'murk mcp commands' commands "$@"
}
(( $+functions[_murk__subcmd__merge-driver_commands] )) ||
_murk__subcmd__merge-driver_commands() {
    local commands; commands=()
    _describe -t commands 'murk merge-driver commands' commands "$@"
}
(( $+functions[_murk__subcmd__policy_commands] )) ||
_murk__subcmd__policy_commands() {
    local commands; commands=(
'show:Show the agent access policy (works without a key)' \
'set:Set the agent allow-list\: agents may only receive secrets carrying one of these tags' \
'clear:Remove the policy — agent mode becomes unrestricted again' \
'help:Print this message or the help of the given subcommand(s)' \
    )
    _describe -t commands 'murk policy commands' commands "$@"
}
(( $+functions[_murk__subcmd__policy__subcmd__clear_commands] )) ||
_murk__subcmd__policy__subcmd__clear_commands() {
    local commands; commands=()
    _describe -t commands 'murk policy clear commands' commands "$@"
}
(( $+functions[_murk__subcmd__policy__subcmd__help_commands] )) ||
_murk__subcmd__policy__subcmd__help_commands() {
    local commands; commands=(
'show:Show the agent access policy (works without a key)' \
'set:Set the agent allow-list\: agents may only receive secrets carrying one of these tags' \
'clear:Remove the policy — agent mode becomes unrestricted again' \
'help:Print this message or the help of the given subcommand(s)' \
    )
    _describe -t commands 'murk policy help commands' commands "$@"
}
(( $+functions[_murk__subcmd__policy__subcmd__help__subcmd__clear_commands] )) ||
_murk__subcmd__policy__subcmd__help__subcmd__clear_commands() {
    local commands; commands=()
    _describe -t commands 'murk policy help clear commands' commands "$@"
}
(( $+functions[_murk__subcmd__policy__subcmd__help__subcmd__help_commands] )) ||
_murk__subcmd__policy__subcmd__help__subcmd__help_commands() {
    local commands; commands=()
    _describe -t commands 'murk policy help help commands' commands "$@"
}
(( $+functions[_murk__subcmd__policy__subcmd__help__subcmd__set_commands] )) ||
_murk__subcmd__policy__subcmd__help__subcmd__set_commands() {
    local commands; commands=()
    _describe -t commands 'murk policy help set commands' commands "$@"
}
(( $+functions[_murk__subcmd__policy__subcmd__help__subcmd__show_commands] )) ||
_murk__subcmd__policy__subcmd__help__subcmd__show_commands() {
    local commands; commands=()
    _describe -t commands 'murk policy help show commands' commands "$@"
}
(( $+functions[_murk__subcmd__policy__subcmd__set_commands] )) ||
_murk__subcmd__policy__subcmd__set_commands() {
    local commands; commands=()
    _describe -t commands 'murk policy set commands' commands "$@"
}
(( $+functions[_murk__subcmd__policy__subcmd__show_commands] )) ||
_murk__subcmd__policy__subcmd__show_commands() {
    local commands; commands=()
    _describe -t commands 'murk policy show commands' commands "$@"
}
(( $+functions[_murk__subcmd__recover_commands] )) ||
_murk__subcmd__recover_commands() {
    local commands; commands=()
    _describe -t commands 'murk recover commands' commands "$@"
}
(( $+functions[_murk__subcmd__restore_commands] )) ||
_murk__subcmd__restore_commands() {
    local commands; commands=()
    _describe -t commands 'murk restore commands' commands "$@"
}
(( $+functions[_murk__subcmd__revoke_commands] )) ||
_murk__subcmd__revoke_commands() {
    local commands; commands=()
    _describe -t commands 'murk revoke commands' commands "$@"
}
(( $+functions[_murk__subcmd__rm_commands] )) ||
_murk__subcmd__rm_commands() {
    local commands; commands=()
    _describe -t commands 'murk rm commands' commands "$@"
}
(( $+functions[_murk__subcmd__rotate_commands] )) ||
_murk__subcmd__rotate_commands() {
    local commands; commands=()
    _describe -t commands 'murk rotate commands' commands "$@"
}
(( $+functions[_murk__subcmd__scan_commands] )) ||
_murk__subcmd__scan_commands() {
    local commands; commands=()
    _describe -t commands 'murk scan commands' commands "$@"
}
(( $+functions[_murk__subcmd__setup-merge-driver_commands] )) ||
_murk__subcmd__setup-merge-driver_commands() {
    local commands; commands=()
    _describe -t commands 'murk setup-merge-driver commands' commands "$@"
}
(( $+functions[_murk__subcmd__skeleton_commands] )) ||
_murk__subcmd__skeleton_commands() {
    local commands; commands=()
    _describe -t commands 'murk skeleton commands' commands "$@"
}
(( $+functions[_murk__subcmd__trust_commands] )) ||
_murk__subcmd__trust_commands() {
    local commands; commands=()
    _describe -t commands 'murk trust commands' commands "$@"
}
(( $+functions[_murk__subcmd__verify_commands] )) ||
_murk__subcmd__verify_commands() {
    local commands; commands=()
    _describe -t commands 'murk verify commands' commands "$@"
}

if [ "$funcstack[1]" = "_murk" ]; then
    _murk "$@"
else
    compdef _murk murk
fi
