@fentz26/envcp 1.1.0 → 1.2.0-exp.1

package/dist/cli/index.js

@@ -1,18 +1,23 @@
 import { Command } from 'commander';
-import inquirer from 'inquirer';
 import chalk from 'chalk';
 import * as path from 'path';
 import * as os from 'os';
 import * as fs from 'fs/promises';
+import { promptPassword, promptInput, promptConfirm, promptList } from '../utils/prompt.js';
 import { ensureDir, pathExists } from '../utils/fs.js';
 import { loadConfig, initConfig, saveConfig, parseEnvFile, registerMcpConfig, isBlacklisted, canAccess } from '../config/manager.js';
 import { ConfigGuard } from '../config/config-guard.js';
-import { StorageManager } from '../storage/index.js';
+import { StorageManager, LogManager } from '../storage/index.js';
+import { VERSION } from '../version.js';
 import { SessionManager } from '../utils/session.js';
 import { maskValue, validatePassword, encrypt, decrypt, generateRecoveryKey, createRecoveryData, recoverPassword } from '../utils/crypto.js';
 import { KeychainManager } from '../utils/keychain.js';
+import { HsmManager } from '../utils/hsm.js';
 import { checkForUpdate, formatUpdateMessage, logUpdateCheck } from '../utils/update-checker.js';
+import { LockoutManager } from '../utils/lockout.js';
+import { initMemoryProtection } from '../utils/secure-memory.js';
 import { getGlobalVaultPath, getProjectVaultPath, resolveVaultPath, setActiveVault, listVaults, initNamedVault, } from '../vault/index.js';
+initMemoryProtection();
 async function withSession(fn, vaultOverride) {
     const projectPath = process.cwd();
     const config = await loadConfig(projectPath);
@@ -23,27 +28,81 @@ async function withSession(fn, vaultOverride) {
         : await resolveVaultPath(projectPath, config);
     if (config.encryption?.enabled === false) {
         const storage = new StorageManager(vaultPath, false);
-        await fn(storage, '', config, projectPath);
+        const logManager = new LogManager(path.join(projectPath, '.envcp', 'logs'), config.audit);
+        await logManager.init();
+        await fn(storage, '', config, projectPath, logManager);
         return;
     }
     const sessionManager = new SessionManager(path.join(projectPath, config.session?.path || '.envcp/.session'), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
     await sessionManager.init();
+    // Initialize audit logging
+    const logManager = new LogManager(path.join(projectPath, '.envcp', 'logs'), config.audit);
+    await logManager.init();
     let session = await sessionManager.load();
     let password = '';
     if (!session) {
-        if (config.keychain?.enabled) {
-            const keychain = new KeychainManager(config.keychain.service || 'envcp');
+        const authMethod = config.auth?.method ?? 'password';
+        // --- HSM-only or multi-factor auth ---
+        if (authMethod === 'hsm' || authMethod === 'multi') {
+            const hsm = HsmManager.fromConfig(config, projectPath);
+            const hsmAvailable = await hsm.isAvailable();
+            if (hsmAvailable) {
+                try {
+                    const hsmSecret = await hsm.retrieveVaultPassword();
+                    if (authMethod === 'multi') {
+                        const factors = config.auth?.multi_factors ?? ['password', 'hsm'];
+                        let userPassword = '';
+                        if (factors.includes('password')) {
+                            userPassword = await promptPassword('Enter password (multi-factor):');
+                        }
+                        else if (factors.includes('keychain')) {
+                            const keychain = new KeychainManager(config.keychain?.service || 'envcp');
+                            const stored = await keychain.retrievePassword(projectPath);
+                            if (stored) {
+                                userPassword = stored;
+                                console.log(chalk.gray('Password retrieved from OS keychain (multi-factor)'));
+                            }
+                        }
+                        password = HsmManager.combineSecrets(hsmSecret, userPassword);
+                        console.log(chalk.gray(`Authenticated via ${hsm.backendName} + password`));
+                    }
+                    else {
+                        password = hsmSecret;
+                        console.log(chalk.gray(`Authenticated via ${hsm.backendName}`));
+                    }
+                }
+                catch (err) {
+                    const msg = err instanceof Error ? err.message : String(err);
+                    const fallback = config.auth?.fallback ?? 'password';
+                    if (fallback === 'none') {
+                        console.log(chalk.red(`HSM authentication failed: ${msg}`));
+                        return;
+                    }
+                    console.log(chalk.yellow(`HSM unavailable: ${msg}`));
+                    console.log(chalk.gray('Falling back to password...'));
+                }
+            }
+            else {
+                const fallback = config.auth?.fallback ?? 'password';
+                if (fallback === 'none') {
+                    console.log(chalk.red(`HSM device (${hsm.backendName}) not found. No fallback configured.`));
+                    return;
+                }
+                console.log(chalk.yellow(`HSM device (${hsm.backendName}) not available. Falling back to password...`));
+            }
+        }
+        // --- OS keychain ---
+        if (!password && (authMethod === 'keychain' || config.keychain?.enabled)) {
+            const keychain = new KeychainManager(config.keychain?.service || 'envcp');
             const stored = await keychain.retrievePassword(projectPath);
             if (stored) {
                 password = stored;
                 console.log(chalk.gray('Password retrieved from OS keychain'));
             }
         }
+        // --- Password prompt fallback ---
         if (!password) {
-            const answer = await inquirer.prompt([
-                { type: 'password', name: 'password', message: 'Enter password:', mask: '*' }
-            ]);
-            password = answer.password;
+            password = await promptPassword('Enter password:');
             const { valid: passwordValid, warning: passwordWarning } = validatePassword(password, config.password || {});
             if (!passwordValid) {
                 console.log(chalk.red("Invalid password"));
@@ -59,13 +118,13 @@ async function withSession(fn, vaultOverride) {
     const storage = new StorageManager(vaultPath, config.storage.encrypted);
     if (password)
         storage.setPassword(password);
-    await fn(storage, password, config, projectPath);
+    await fn(storage, password, config, projectPath, logManager);
 }
 const program = new Command();
 program
     .name('envcp')
     .description('Secure environment variable management for AI-assisted coding')
-    .version('1.0.0');
+    .version(VERSION);
 program
     .command('init')
     .description('Initialize EnvCP in the current project')
@@ -73,6 +132,10 @@ program
     .option('--no-encrypt', 'Skip encryption (passwordless mode)')
     .option('--skip-env', 'Skip .env auto-import')
     .option('--skip-mcp', 'Skip MCP auto-registration')
+    .option('--auth-method <method>', 'Authentication method: password | keychain | hsm | multi (default: password)')
+    .option('--hsm-type <type>', 'HSM type for --auth-method hsm|multi: yubikey | gpg | pkcs11')
+    .option('--key-id <id>', 'GPG key ID or PKCS#11 key label for HSM auth')
+    .option('--pkcs11-lib <path>', 'Path to PKCS#11 shared library for --hsm-type pkcs11')
     .action(async (options) => {
     const projectPath = process.cwd();
     const projectName = options.project || path.basename(projectPath);
@@ -85,42 +148,56 @@ program
         securityChoice = 'none';
     }
     else {
-        const { mode } = await inquirer.prompt([
-            {
-                type: 'list',
-                name: 'mode',
-                message: 'How would you like to secure your variables?',
-                choices: [
-                    { name: 'No encryption (fastest setup, for local dev)', value: 'none' },
-                    { name: 'Encrypted with recovery key (recommended)', value: 'recoverable' },
-                    { name: 'Encrypted hard-lock (max security, no recovery)', value: 'hard-lock' },
-                ],
-                default: 'recoverable',
-            }
-        ]);
-        securityChoice = mode;
+        securityChoice = await promptList('How would you like to secure your variables?', [
+            { name: 'No encryption (fastest setup, for local dev)', value: 'none' },
+            { name: 'Encrypted with recovery key (recommended)', value: 'recoverable' },
+            { name: 'Encrypted hard-lock (max security, no recovery)', value: 'hard-lock' },
+        ], 'recoverable');
     }
     // Apply security choice to config
     if (securityChoice === 'none') {
         config.encryption = { enabled: false };
         config.storage.encrypted = false;
-        config.security = { mode: 'recoverable', recovery_file: '.envcp/.recovery' };
+        config.security = {
+            mode: 'recoverable',
+            recovery_file: '.envcp/.recovery',
+            brute_force_protection: {
+                enabled: true,
+                max_attempts: 5,
+                lockout_duration: 300,
+                progressive_delay: true,
+                max_delay: 60,
+                permanent_lockout_threshold: 50,
+                permanent_lockout_action: 'require_recovery_key',
+                notifications: {}
+            }
+        };
     }
     else {
         config.encryption = { enabled: true };
         config.storage.encrypted = true;
-        config.security = { mode: securityChoice, recovery_file: '.envcp/.recovery' };
+        config.security = {
+            mode: securityChoice,
+            recovery_file: '.envcp/.recovery',
+            brute_force_protection: {
+                enabled: true,
+                max_attempts: 5,
+                lockout_duration: 300,
+                progressive_delay: true,
+                max_delay: 60,
+                permanent_lockout_threshold: 50,
+                permanent_lockout_action: 'require_recovery_key',
+                notifications: {},
+            }
+        };
     }
     // For encrypted modes: get password now
     let pwd = '';
     if (securityChoice !== 'none') {
-        const { password } = await inquirer.prompt([
-            { type: 'password', name: 'password', message: 'Set encryption password:', mask: '*' }
-        ]);
-        const { confirm } = await inquirer.prompt([
-            { type: 'password', name: 'confirm', message: 'Confirm password:', mask: '*' }
-        ]);
-        if (password !== confirm) {
+        const password = await promptPassword('Set encryption password:');
+        const confirmPwd = await promptPassword('Confirm password:');
+        // eslint-disable-next-line security/detect-possible-timing-attacks -- comparing two user-typed confirm fields, not a secret-vs-known value
+        if (password !== confirmPwd) {
             console.log(chalk.red('Passwords do not match. Aborting.'));
             return;
         }
@@ -146,15 +223,17 @@ program
                 if (pwd)
                     storage.setPassword(pwd);
                 const now = new Date().toISOString();
+                const existing = await storage.load();
                 for (const [name, value] of Object.entries(vars)) {
-                    await storage.set(name, {
+                    existing[name] = {
                         name, value,
                         encrypted: config.storage.encrypted,
                         created: now, updated: now,
                         sync_to_env: true,
                         protected: false,
-                    });
+                    };
                 }
+                await storage.save(existing);
                 // Create session for encrypted mode
                 if (pwd) {
                     const sessionManager = new SessionManager(path.join(projectPath, config.session?.path || '.envcp/.session'), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
@@ -202,6 +281,45 @@ program
             console.log(chalk.gray('  No AI tools detected for auto-registration'));
         }
     }
+    // Setup HSM authentication if --auth-method hsm|multi provided
+    const authMethod = options.authMethod;
+    if (pwd && (authMethod === 'hsm' || authMethod === 'multi')) {
+        const hsmType = options.hsmType || 'yubikey';
+        config.hsm = {
+            ...config.hsm,
+            enabled: true,
+            type: hsmType,
+            key_id: options.keyId ?? config.hsm?.key_id,
+            pkcs11_lib: options.pkcs11Lib ?? config.hsm?.pkcs11_lib,
+            require_touch: config.hsm?.require_touch ?? true,
+            protected_key_path: config.hsm?.protected_key_path ?? '.envcp/.hsm-key',
+        };
+        config.auth = {
+            method: authMethod,
+            multi_factors: authMethod === 'multi' ? ['password', 'hsm'] : ['hsm'],
+            fallback: 'password',
+        };
+        const hsm = HsmManager.fromConfig(config, projectPath);
+        if (await hsm.isAvailable()) {
+            try {
+                await hsm.protectVaultPassword(pwd);
+                await saveConfig(config, projectPath);
+                console.log('');
+                console.log(chalk.green(`  Vault password protected by ${hsm.backendName}`));
+                console.log(chalk.gray(`  Future sessions will authenticate via hardware`));
+            }
+            catch (err) {
+                console.log(chalk.yellow(`  HSM setup warning: ${err instanceof Error ? err.message : String(err)}`));
+                console.log(chalk.gray('  Falling back to password authentication'));
+            }
+        }
+        else {
+            console.log(chalk.yellow(`  HSM device (${hsm.backendName}) not available at init time.`));
+            console.log(chalk.gray('  Run "envcp unlock --setup-hsm" later to enable hardware authentication.'));
+            config.auth = { method: authMethod, multi_factors: ['password', 'hsm'], fallback: 'password' };
+            await saveConfig(config, projectPath);
+        }
+    }
     console.log('');
     console.log(chalk.green('Done! Your AI tools can now use EnvCP.'));
 });
@@ -209,21 +327,18 @@ program
     .command('unlock')
     .description('Unlock EnvCP session with password')
     .option('-p, --password <password>', 'Password (will prompt if not provided)')
+    .option('--recovery-key <key>', 'Recovery key to clear permanent lockout')
     .option('--save-to-keychain', 'Save password to OS keychain for auto-unlock')
+    .option('--setup-hsm', 'Protect vault password with hardware security module')
+    .option('--hsm-type <type>', 'HSM type: yubikey | gpg | pkcs11 (default: yubikey)')
+    .option('--key-id <id>', 'GPG key ID or PKCS#11 key label')
+    .option('--pkcs11-lib <path>', 'Path to PKCS#11 shared library (.so / .dll)')
     .action(async (options) => {
     const projectPath = process.cwd();
     const config = await loadConfig(projectPath);
     let password = options.password;
     if (!password) {
-        const answer = await inquirer.prompt([
-            {
-                type: 'password',
-                name: 'password',
-                message: 'Enter password:',
-                mask: '*'
-            }
-        ]);
-        password = answer.password;
+        password = await promptPassword('Enter password:');
     }
     const { valid: passwordValid, warning: passwordWarning } = validatePassword(password, config.password || {});
     if (!passwordValid) {
@@ -234,16 +349,115 @@ program
     if (passwordValid && passwordWarning) {
         console.log(chalk.yellow('⚠ Weak password detected'));
     }
+    const sessionDir = path.join(projectPath, path.dirname(config.session?.path || '.envcp/.session'));
+    let lockoutManager = new LockoutManager(path.join(sessionDir, '.lockout'));
+    // Handle recovery key if provided
+    if (options.recoveryKey) {
+        const recoveryPath = path.join(projectPath, config.security?.recovery_file || '.envcp/.recovery');
+        if (!await pathExists(recoveryPath)) {
+            console.log(chalk.red('No recovery file found.'));
+            return;
+        }
+        const recoveryData = await fs.readFile(recoveryPath, 'utf8');
+        try {
+            await recoverPassword(recoveryData, options.recoveryKey);
+            // Recovery key is valid - clear permanent lockout
+            await lockoutManager.clearPermanentLockout();
+            console.log(chalk.green('Permanent lockout cleared.'));
+            // Log recovery event
+            const logManager = new LogManager(path.join(projectPath, '.envcp', 'logs'), config.audit);
+            await logManager.init();
+            await logManager.log({
+                timestamp: new Date().toISOString(),
+                operation: 'unlock',
+                variable: '',
+                source: 'cli',
+                success: true,
+                message: 'Permanent lockout cleared with recovery key (via --recovery-key flag)',
+                session_id: '',
+                client_id: 'cli',
+                client_type: 'terminal',
+                ip: '127.0.0.1'
+            });
+            console.log(chalk.yellow('Note: You still need to enter the correct password.'));
+            // Continue with password prompt
+        }
+        catch {
+            console.log(chalk.red('Invalid recovery key.'));
+            return;
+        }
+    }
+    // Use new brute_force_protection config if available, fall back to session config
+    const bfpConfig = config.security?.brute_force_protection;
+    const lockoutThreshold = bfpConfig?.max_attempts ?? config.session?.lockout_threshold ?? 5;
+    const lockoutBaseSeconds = bfpConfig?.lockout_duration ?? config.session?.lockout_base_seconds ?? 60;
+    const progressiveDelay = bfpConfig?.progressive_delay ?? true;
+    const maxDelay = bfpConfig?.max_delay ?? 60;
+    const permanentThreshold = bfpConfig?.permanent_lockout_threshold ?? 0;
     const sessionManager = new SessionManager(path.join(projectPath, config.session?.path || '.envcp/.session'), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
     await sessionManager.init();
+    // Initialize audit logging
+    const logManager = new LogManager(path.join(projectPath, '.envcp', 'logs'), config.audit);
+    await logManager.init();
     const storage = new StorageManager(path.join(projectPath, config.storage.path), config.storage.encrypted);
     storage.setPassword(password);
     const storeExists = await storage.exists();
+    // Check lockout before attempting password verification on existing stores
+    if (storeExists) {
+        const lockoutStatus = await lockoutManager.check();
+        if (lockoutStatus.locked) {
+            if (lockoutStatus.permanent_locked) {
+                console.log(chalk.red.bold('PERMANENT LOCKOUT: Too many failed attempts.'));
+                console.log(chalk.red('Recovery key or administrator intervention required.'));
+                const useRecovery = await promptConfirm('Use recovery key to clear lockout?', true);
+                if (useRecovery) {
+                    const recoveryKey = await promptPassword('Enter recovery key:');
+                    const recoveryPath = path.join(projectPath, config.security?.recovery_file || '.envcp/.recovery');
+                    if (!await pathExists(recoveryPath)) {
+                        console.log(chalk.red('No recovery file found.'));
+                        return;
+                    }
+                    const recoveryData = await fs.readFile(recoveryPath, 'utf8');
+                    try {
+                        await recoverPassword(recoveryData, recoveryKey);
+                        // Recovery key is valid - clear permanent lockout
+                        await lockoutManager.clearPermanentLockout();
+                        console.log(chalk.green('Permanent lockout cleared. You can now attempt to unlock.'));
+                        console.log(chalk.yellow('Note: You still need to enter the correct password.'));
+                        // Log recovery event
+                        await logManager.log({
+                            timestamp: new Date().toISOString(),
+                            operation: 'unlock',
+                            variable: '',
+                            source: 'cli',
+                            success: true,
+                            message: 'Permanent lockout cleared with recovery key',
+                            session_id: '',
+                            client_id: 'cli',
+                            client_type: 'terminal',
+                            ip: '127.0.0.1'
+                        });
+                        // Continue with password prompt
+                    }
+                    catch {
+                        console.log(chalk.red('Invalid recovery key.'));
+                        return;
+                    }
+                }
+                else {
+                    return;
+                }
+            }
+            else {
+                console.log(chalk.red(`Too many failed attempts. Try again in ${lockoutStatus.remaining_seconds} second(s).`));
+                return;
+            }
+        }
+    }
     if (!storeExists) {
-        const confirm = await inquirer.prompt([
-            { type: 'password', name: 'password', message: 'Confirm password:', mask: '*' }
-        ]);
-        if (confirm.password !== password) {
+        const confirmPasswordValue = await promptPassword('Confirm password:');
+        // eslint-disable-next-line security/detect-possible-timing-attacks -- comparing two user-typed confirm fields, not a secret-vs-known value
+        if (confirmPasswordValue !== password) {
             console.log(chalk.red('Passwords do not match'));
             return;
         }
@@ -267,10 +481,85 @@ program
         await storage.load();
     }
     catch (error) {
-        console.log(chalk.red('Invalid password'));
+        if (storeExists) {
+            const status = await lockoutManager.recordFailure(lockoutThreshold, lockoutBaseSeconds, progressiveDelay, maxDelay, permanentThreshold);
+            // Log the failed attempt
+            await logManager.log({
+                timestamp: new Date().toISOString(),
+                operation: 'auth_failure',
+                variable: '',
+                source: 'cli',
+                success: false,
+                message: `Failed unlock attempt (attempt ${status.attempts})`,
+                session_id: '',
+                client_id: 'cli',
+                client_type: 'terminal',
+                ip: '127.0.0.1'
+            });
+            if (status.permanent_locked) {
+                console.log(chalk.red.bold('PERMANENT LOCKOUT TRIGGERED: Too many failed attempts.'));
+                console.log(chalk.red('Recovery key or administrator intervention required.'));
+                // Log permanent lockout event
+                await logManager.log({
+                    timestamp: new Date().toISOString(),
+                    operation: 'permanent_lockout',
+                    variable: '',
+                    source: 'cli',
+                    success: false,
+                    message: `Permanent lockout triggered after ${status.permanent_lockout_count} lockouts`,
+                    session_id: '',
+                    client_id: 'cli',
+                    client_type: 'terminal',
+                    ip: '127.0.0.1'
+                });
+            }
+            else if (status.locked) {
+                console.log(chalk.red(`Invalid password. Too many failed attempts — locked out for ${status.remaining_seconds} second(s).`));
+                // Log lockout event
+                await logManager.log({
+                    timestamp: new Date().toISOString(),
+                    operation: 'lockout_triggered',
+                    variable: '',
+                    source: 'cli',
+                    success: false,
+                    message: `Lockout triggered for ${status.remaining_seconds}s (lockout #${status.lockout_count})`,
+                    session_id: '',
+                    client_id: 'cli',
+                    client_type: 'terminal',
+                    ip: '127.0.0.1'
+                });
+            }
+            else {
+                const remaining = lockoutThreshold - status.attempts;
+                let message = `Invalid password. ${remaining} attempt(s) remaining before lockout.`;
+                // Show progressive delay if applied
+                if (status.delay_seconds && status.delay_seconds > 0) {
+                    message += ` (Delayed ${status.delay_seconds}s)`;
+                }
+                console.log(chalk.red(message));
+            }
+        }
+        else {
+            console.log(chalk.red('Invalid password'));
+        }
         return;
     }
+    // Successful unlock — clear any lockout state
+    await lockoutManager.reset();
     const session = await sessionManager.create(password);
+    // Log successful unlock
+    await logManager.log({
+        timestamp: new Date().toISOString(),
+        operation: 'unlock',
+        variable: '',
+        source: 'cli',
+        success: true,
+        message: 'Session unlocked successfully',
+        session_id: session.id,
+        client_id: 'cli',
+        client_type: 'terminal',
+        ip: '127.0.0.1'
+    });
     console.log(chalk.green('Session unlocked!'));
     console.log(chalk.gray(`  Session ID: ${session.id}`));
     console.log(chalk.gray(`  Expires in: ${config.session?.timeout_minutes || 30} minutes`));
@@ -296,6 +585,35 @@ program
             console.log(chalk.red(`OS keychain not available (${keychain.backendName})`));
         }
     }
+    // Setup HSM if requested
+    if (options.setupHsm) {
+        const hsmType = options.hsmType || 'yubikey';
+        config.hsm = {
+            ...config.hsm,
+            enabled: true,
+            type: hsmType,
+            key_id: options.keyId ?? config.hsm?.key_id,
+            pkcs11_lib: options.pkcs11Lib ?? config.hsm?.pkcs11_lib,
+            require_touch: config.hsm?.require_touch ?? true,
+            protected_key_path: config.hsm?.protected_key_path ?? '.envcp/.hsm-key',
+        };
+        config.auth = { ...config.auth, method: 'hsm', fallback: config.auth?.fallback ?? 'password' };
+        const hsm = HsmManager.fromConfig(config, projectPath);
+        if (!await hsm.isAvailable()) {
+            console.log(chalk.red(`HSM device (${hsm.backendName}) not available. Aborting HSM setup.`));
+            return;
+        }
+        try {
+            await hsm.protectVaultPassword(password);
+            await saveConfig(config, projectPath);
+            console.log(chalk.green(`Vault password protected by ${hsm.backendName}`));
+            console.log(chalk.gray(`  Key file: ${config.hsm.protected_key_path}`));
+            console.log(chalk.gray('  Future sessions will authenticate via hardware'));
+        }
+        catch (err) {
+            console.log(chalk.red(`HSM setup failed: ${err instanceof Error ? err.message : String(err)}`));
+        }
+    }
 });
 program
     .command('lock')
@@ -316,10 +634,8 @@ program
     const config = await loadConfig(projectPath);
     const sessionManager = new SessionManager(path.join(projectPath, config.session?.path || '.envcp/.session'), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
     await sessionManager.init();
-    const answer = await inquirer.prompt([
-        { type: 'password', name: 'password', message: 'Enter password:', mask: '*' }
-    ]);
-    const session = await sessionManager.load(answer.password);
+    const password = await promptPassword('Enter password:');
+    const session = await sessionManager.load(password);
     if (!session) {
         console.log(chalk.yellow('No active session (expired, invalid password, or not unlocked)'));
         console.log(chalk.gray('Run: envcp unlock'));
@@ -340,9 +656,7 @@ program
     .action(async () => {
     const projectPath = process.cwd();
     const configGuard = new ConfigGuard(projectPath);
-    const { password } = await inquirer.prompt([
-        { type: 'password', name: 'password', message: 'Enter password to reload config:', mask: '*' }
-    ]);
+    const password = await promptPassword('Enter password to reload config:');
     const result = await configGuard.reload(password);
     if (result.success) {
         console.log(chalk.green('Config reloaded successfully'));
@@ -360,10 +674,8 @@ program
     const config = await loadConfig(projectPath);
     const sessionManager = new SessionManager(path.join(projectPath, config.session?.path || '.envcp/.session'), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
     await sessionManager.init();
-    const answer = await inquirer.prompt([
-        { type: 'password', name: 'password', message: 'Enter password:', mask: '*' }
-    ]);
-    const loaded = await sessionManager.load(answer.password);
+    const password = await promptPassword('Enter password:');
+    const loaded = await sessionManager.load(password);
     if (!loaded) {
         console.log(chalk.red('Cannot extend session. No active session or invalid password.'));
         return;
@@ -394,9 +706,7 @@ program
         console.log(chalk.red('No recovery file found. Recovery is not available.'));
         return;
     }
-    const { recoveryKey } = await inquirer.prompt([
-        { type: 'password', name: 'recoveryKey', message: 'Enter your recovery key:', mask: '*' }
-    ]);
+    const recoveryKey = await promptPassword('Enter your recovery key:');
     const recoveryData = await fs.readFile(recoveryPath, 'utf8');
     let oldPassword;
     try {
@@ -419,12 +729,8 @@ program
     }
     console.log(chalk.green('Recovery key verified. Store contains ' + Object.keys(variables).length + ' variables.'));
     // Set new password
-    const { newPassword } = await inquirer.prompt([
-        { type: 'password', name: 'newPassword', message: 'Set new password:', mask: '*' }
-    ]);
-    const { confirmPassword } = await inquirer.prompt([
-        { type: 'password', name: 'confirmPassword', message: 'Confirm new password:', mask: '*' }
-    ]);
+    const newPassword = await promptPassword('Set new password:');
+    const confirmPassword = await promptPassword('Confirm new password:');
     if (newPassword !== confirmPassword) {
         console.log(chalk.red('Passwords do not match'));
         return;
@@ -489,14 +795,10 @@ program
         let tags = [];
         let description = options.description;
         if (!value) {
-            const answers = await inquirer.prompt([
-                { type: 'password', name: 'value', message: 'Enter value:', mask: '*' },
-                { type: 'input', name: 'tags', message: 'Tags (comma-separated):' },
-                { type: 'input', name: 'description', message: 'Description:' },
-            ]);
-            value = answers.value;
-            tags = answers.tags.split(',').map((t) => t.trim()).filter(Boolean);
-            description = answers.description;
+            value = await promptPassword('Enter value:');
+            const tagsInput = await promptInput('Tags (comma-separated):');
+            tags = tagsInput.split(',').map((t) => t.trim()).filter(Boolean);
+            description = await promptInput('Description:');
         }
         else if (options.tags) {
             tags = options.tags.split(',').map((t) => t.trim()).filter(Boolean);
@@ -606,7 +908,8 @@ program
             if (!variable.sync_to_env)
                 continue;
             const excluded = config.sync.exclude?.some((pattern) => {
-                const regex = new RegExp('^' + pattern.replace(/\*/g, '.*') + '$');
+                // eslint-disable-next-line security/detect-non-literal-regexp -- glob pattern from config; metacharacters escaped above
+                const regex = new RegExp('^' + pattern.replace(/[.+?^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '.*') + '$');
                 return regex.test(name);
             });
             if (excluded)
@@ -631,7 +934,8 @@ program
                 if (!variable.sync_to_env)
                     continue;
                 const excluded = config.sync.exclude?.some((pattern) => {
-                    const regex = new RegExp('^' + pattern.replace(/\*/g, '.*') + '$');
+                    // eslint-disable-next-line security/detect-non-literal-regexp -- glob pattern from config; metacharacters escaped above
+                    const regex = new RegExp('^' + pattern.replace(/[.+?^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '.*') + '$');
                     return regex.test(name);
                 });
                 if (excluded)
@@ -709,10 +1013,7 @@ program
                 process.stderr.write('Error: No active session. Run `envcp unlock` first, or use --password flag.\n');
                 process.exit(1);
             }
-            const answer = await inquirer.prompt([
-                { type: 'password', name: 'password', message: 'Enter password:', mask: '*' }
-            ]);
-            password = answer.password;
+            password = await promptPassword('Enter password:');
             const { valid: passwordValid, warning: passwordWarning } = validatePassword(password, config.password || {});
             if (!passwordValid) {
                 // nosem: no tainted data flows to log
@@ -804,12 +1105,8 @@ program
                 console.log(chalk.red('--output <path> is required with --encrypted'));
                 return;
             }
-            const { exportPassword } = await inquirer.prompt([
-                { type: 'password', name: 'exportPassword', message: 'Set export password:', mask: '*' }
-            ]);
-            const { confirmExport } = await inquirer.prompt([
-                { type: 'password', name: 'confirmExport', message: 'Confirm export password:', mask: '*' }
-            ]);
+            const exportPassword = await promptPassword('Set export password:');
+            const confirmExport = await promptPassword('Confirm export password:');
             if (exportPassword !== confirmExport) {
                 console.log(chalk.red('Passwords do not match'));
                 return;
@@ -857,9 +1154,7 @@ program
             console.log(chalk.red(`File not found: ${file}`));
             return;
         }
-        const { importPassword } = await inquirer.prompt([
-            { type: 'password', name: 'importPassword', message: 'Enter export file password:', mask: '*' }
-        ]);
+        const importPassword = await promptPassword('Enter export file password:');
         const fileContent = await fs.readFile(file, 'utf8');
         let importData;
         try {
@@ -920,9 +1215,7 @@ program
             console.log(chalk.gray('\nNo files were modified.'));
             return;
         }
-        const { confirm } = await inquirer.prompt([
-            { type: 'confirm', name: 'confirm', message: options.merge ? 'Merge into current store?' : 'Replace current store?', default: false }
-        ]);
+        const confirm = await promptConfirm(options.merge ? 'Merge into current store?' : 'Replace current store?', false);
         if (!confirm) {
             console.log(chalk.yellow('Import cancelled'));
             return;
@@ -1004,9 +1297,7 @@ program
                 console.log(chalk.gray(`  Created: ${meta.timestamp}`));
             console.log(chalk.gray(`  Variables: ${meta.count || Object.keys(variables).length}`));
         }
-        const { confirm } = await inquirer.prompt([
-            { type: 'confirm', name: 'confirm', message: options.merge ? 'Merge backup into current store?' : 'Replace current store with backup?', default: false }
-        ]);
+        const confirm = await promptConfirm(options.merge ? 'Merge backup into current store?' : 'Replace current store with backup?', false);
         if (!confirm) {
             console.log(chalk.yellow('Restore cancelled'));
             return;
@@ -1168,7 +1459,7 @@ program
     .option('--name <name>', 'Operate on a named vault')
     .addCommand(new Command('init')
     .description('Initialize a vault')
-    .action(async (options, cmd) => {
+    .action(async (_options, cmd) => {
     const parentOpts = cmd.parent.opts();
     const projectPath = process.cwd();
     const config = await loadConfig(projectPath);
@@ -1199,7 +1490,7 @@ program
     const parentOpts = cmd.parent.opts();
     const vaultOverride = parentOpts.global ? 'global' : parentOpts.project ? 'project' : undefined;
     await withSession(async (storage) => {
-        const value = options.value || (await inquirer.prompt([{ type: 'input', name: 'value', message: 'Value:' }])).value;
+        const value = options.value || await promptInput('Value:');
         const tags = options.tags ? options.tags.split(',').map((t) => t.trim()) : [];
         const now = new Date().toISOString();
         await storage.set(name, {
@@ -1275,7 +1566,6 @@ program
     .argument('<name>', 'Vault name (global, project, or named vault)')
     .action(async (name) => {
     const projectPath = process.cwd();
-    const config = await loadConfig(projectPath);
     if (name !== 'global' && name !== 'project') {
         const vaultDir = path.join(projectPath, '.envcp/vaults', name);
         if (!await pathExists(vaultDir)) {
@@ -1334,7 +1624,7 @@ program
     .addCommand(new Command('save')
     .description('Save current password to OS keychain')
     .action(async () => {
-    await withSession(async (storage, password, config, projectPath) => {
+    await withSession(async (_storage, password, config, projectPath) => {
         if (!password) {
             console.log(chalk.red('No password available (encryption disabled?)'));
             return;
@@ -1422,5 +1712,131 @@ if (!await pathExists(firstRunMarker)) {
    Docs: https://github.com/fentz26/EnvCP
 `);
 }
+program
+    .command('logs')
+    .description('View audit logs')
+    .option('--date <date>', 'Log date (YYYY-MM-DD, default: today)')
+    .option('--operation <op>', 'Filter by operation (add, get, update, delete, list, sync, export, unlock, lock, check_access, run, auth_failure)')
+    .option('--variable <name>', 'Filter by variable name')
+    .option('--source <source>', 'Filter by source (cli, mcp, api)')
+    .option('--success', 'Show only successful operations')
+    .option('--failure', 'Show only failed operations')
+    .option('--tail <n>', 'Show last N entries', parseInt)
+    .option('--dates', 'List all available log dates')
+    .option('--verify', 'Verify HMAC integrity of log entries')
+    .action(async (options) => {
+    const projectPath = process.cwd();
+    const config = await loadConfig(projectPath);
+    const logDir = path.join(projectPath, '.envcp', 'logs');
+    const logs = new LogManager(logDir, config.audit);
+    await logs.init();
+    if (options.dates) {
+        const dates = await logs.getLogDates();
+        if (dates.length === 0) {
+            console.log(chalk.gray('No log files found.'));
+        }
+        else {
+            console.log(chalk.bold('Available log dates:'));
+            dates.forEach(d => console.log(chalk.gray(`  ${d}`)));
+        }
+        return;
+    }
+    const filter = {};
+    if (options.date)
+        filter.date = options.date;
+    if (options.operation)
+        filter.operation = options.operation;
+    if (options.variable)
+        filter.variable = options.variable;
+    if (options.source)
+        filter.source = options.source;
+    if (options.success)
+        filter.success = true;
+    if (options.failure)
+        filter.success = false;
+    if (options.tail)
+        filter.tail = options.tail;
+    const entries = await logs.getLogs(filter);
+    if (entries.length === 0) {
+        console.log(chalk.gray('No log entries found.'));
+        return;
+    }
+    let failed = 0;
+    entries.forEach(entry => {
+        const ts = chalk.gray(entry.timestamp);
+        const op = entry.success ? chalk.green(entry.operation) : chalk.red(entry.operation);
+        const src = chalk.blue(entry.source);
+        const varName = entry.variable ? chalk.yellow(` [${entry.variable}]`) : '';
+        const msg = entry.message ? chalk.gray(` — ${entry.message}`) : '';
+        if (options.verify && entry.hmac !== undefined) {
+            const valid = logs.verifyEntry(entry);
+            if (!valid) {
+                failed++;
+                console.log(`${ts} ${chalk.red('[TAMPERED]')} ${op} ${src}${varName}${msg}`);
+                return;
+            }
+        }
+        console.log(`${ts} ${op} ${src}${varName}${msg}`);
+    });
+    if (options.verify) {
+        if (failed === 0) {
+            console.log(chalk.green(`\nAll ${entries.length} entries verified OK.`));
+        }
+        else {
+            console.log(chalk.red(`\n${failed}/${entries.length} entries failed HMAC verification.`));
+        }
+    }
+});
+program
+    .command('verify-logs')
+    .description('Verify HMAC chain integrity of audit logs')
+    .option('--date <date>', 'Verify specific date (YYYY-MM-DD, default: all dates)')
+    .action(async (options) => {
+    const projectPath = process.cwd();
+    const config = await loadConfig(projectPath);
+    const logDir = path.join(projectPath, '.envcp', 'logs');
+    const logs = new LogManager(logDir, config.audit);
+    await logs.init();
+    if (!config.audit.hmac_chain) {
+        console.log(chalk.yellow('HMAC chain is not enabled in audit config.'));
+        return;
+    }
+    console.log(chalk.bold('Verifying log chain integrity...'));
+    const result = await logs.verifyLogChain(options.date);
+    if (result.valid) {
+        console.log(chalk.green(`✓ Chain integrity verified: ${result.entries} entries OK`));
+    }
+    else {
+        console.log(chalk.red(`✗ Chain integrity FAILED: ${result.tampered.length}/${result.entries} entries tampered`));
+        console.log(chalk.red(`  Tampered indices: ${result.tampered.join(', ')}`));
+    }
+});
+program
+    .command('protect-logs')
+    .description('Apply OS-level protection to audit log files (Linux only)')
+    .action(async () => {
+    const projectPath = process.cwd();
+    const config = await loadConfig(projectPath);
+    const logDir = path.join(projectPath, '.envcp', 'logs');
+    const logs = new LogManager(logDir, config.audit);
+    await logs.init();
+    if (config.audit.protection === 'none') {
+        console.log(chalk.yellow('Log protection is disabled in config (protection: none).'));
+        return;
+    }
+    console.log(chalk.bold(`Applying ${config.audit.protection} protection to log files...`));
+    const result = await logs.protectLogFiles();
+    if (result.protected.length > 0) {
+        console.log(chalk.green(`✓ Protected ${result.protected.length} files:`));
+        result.protected.forEach((f) => console.log(chalk.gray(`  ${f}`)));
+    }
+    if (result.failed.length > 0) {
+        console.log(chalk.red(`✗ Failed to protect ${result.failed.length} files:`));
+        result.failed.forEach((f) => console.log(chalk.gray(`  ${f}`)));
+    }
+    if (result.protected.length === 0 && result.failed.length === 0) {
+        console.log(chalk.gray('No log files to protect.'));
+    }
+});
 program.parse();
 //# sourceMappingURL=index.js.map