@fentz26/envcp 1.1.0 → 1.2.0-exp.8d5b91b

package/dist/cli/index.js

@@ -1,21 +1,40 @@
 import { Command } from 'commander';
-import inquirer from 'inquirer';
 import chalk from 'chalk';
 import * as path from 'path';
 import * as os from 'os';
 import * as fs from 'fs/promises';
+import { promptPassword, promptInput, promptConfirm, promptList } from '../utils/prompt.js';
 import { ensureDir, pathExists } from '../utils/fs.js';
 import { loadConfig, initConfig, saveConfig, parseEnvFile, registerMcpConfig, isBlacklisted, canAccess } from '../config/manager.js';
 import { ConfigGuard } from '../config/config-guard.js';
-import { StorageManager } from '../storage/index.js';
+import { StorageManager, LogManager, resolveLogPath } from '../storage/index.js';
+import { VERSION } from '../version.js';
 import { SessionManager } from '../utils/session.js';
 import { maskValue, validatePassword, encrypt, decrypt, generateRecoveryKey, createRecoveryData, recoverPassword } from '../utils/crypto.js';
 import { KeychainManager } from '../utils/keychain.js';
+import { HsmManager } from '../utils/hsm.js';
 import { checkForUpdate, formatUpdateMessage, logUpdateCheck } from '../utils/update-checker.js';
-import { getGlobalVaultPath, getProjectVaultPath, resolveVaultPath, setActiveVault, listVaults, initNamedVault, } from '../vault/index.js';
-async function withSession(fn, vaultOverride) {
+import { LockoutManager } from '../utils/lockout.js';
+import { initMemoryProtection } from '../utils/secure-memory.js';
+import { getGlobalVaultPath, getProjectVaultPath, resolveVaultPath, resolveSessionPath, setActiveVault, listVaults, initNamedVault, } from '../vault/index.js';
+import { findProjectRoot } from '../utils/fs.js';
+initMemoryProtection();
+async function resolveCliContext(vaultOverride) {
+    if (vaultOverride === 'global') {
+        const home = process.env.HOME || process.env.USERPROFILE || os.homedir();
+        const config = await loadConfig(home);
+        config.vault = { ...config.vault, mode: 'global' };
+        return { projectPath: home, config };
+    }
     const projectPath = process.cwd();
     const config = await loadConfig(projectPath);
+    if (vaultOverride === 'project') {
+        config.vault = { ...config.vault, mode: 'project' };
+    }
+    return { projectPath, config };
+}
+async function withSession(fn, vaultOverride) {
+    const { projectPath, config } = await resolveCliContext(vaultOverride);
     const vaultPath = vaultOverride
         ? vaultOverride === 'global'
             ? getGlobalVaultPath(config)
@@ -23,27 +42,81 @@ async function withSession(fn, vaultOverride) {
         : await resolveVaultPath(projectPath, config);
     if (config.encryption?.enabled === false) {
         const storage = new StorageManager(vaultPath, false);
-        await fn(storage, '', config, projectPath);
+        const logManager = new LogManager(resolveLogPath(config.audit, projectPath), config.audit);
+        await logManager.init();
+        await fn(storage, '', config, projectPath, logManager);
         return;
     }
-    const sessionManager = new SessionManager(path.join(projectPath, config.session?.path || '.envcp/.session'), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
+    const sessionManager = new SessionManager(resolveSessionPath(projectPath, config), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
     await sessionManager.init();
+    // Initialize audit logging
+    const logManager = new LogManager(resolveLogPath(config.audit, projectPath), config.audit);
+    await logManager.init();
     let session = await sessionManager.load();
     let password = '';
     if (!session) {
-        if (config.keychain?.enabled) {
-            const keychain = new KeychainManager(config.keychain.service || 'envcp');
+        const authMethod = config.auth?.method ?? 'password';
+        // --- HSM-only or multi-factor auth ---
+        if (authMethod === 'hsm' || authMethod === 'multi') {
+            const hsm = HsmManager.fromConfig(config, projectPath);
+            const hsmAvailable = await hsm.isAvailable();
+            if (hsmAvailable) {
+                try {
+                    const hsmSecret = await hsm.retrieveVaultPassword();
+                    if (authMethod === 'multi') {
+                        const factors = config.auth?.multi_factors ?? ['password', 'hsm'];
+                        let userPassword = '';
+                        if (factors.includes('password')) {
+                            userPassword = await promptPassword('Enter password (multi-factor):');
+                        }
+                        else if (factors.includes('keychain')) {
+                            const keychain = new KeychainManager(config.keychain?.service || 'envcp');
+                            const stored = await keychain.retrievePassword(projectPath);
+                            if (stored) {
+                                userPassword = stored;
+                                console.log(chalk.gray('Password retrieved from OS keychain (multi-factor)'));
+                            }
+                        }
+                        password = HsmManager.combineSecrets(hsmSecret, userPassword);
+                        console.log(chalk.gray(`Authenticated via ${hsm.backendName} + password`));
+                    }
+                    else {
+                        password = hsmSecret;
+                        console.log(chalk.gray(`Authenticated via ${hsm.backendName}`));
+                    }
+                }
+                catch (err) {
+                    const msg = err instanceof Error ? err.message : String(err);
+                    const fallback = config.auth?.fallback ?? 'password';
+                    if (fallback === 'none') {
+                        console.log(chalk.red(`HSM authentication failed: ${msg}`));
+                        return;
+                    }
+                    console.log(chalk.yellow(`HSM unavailable: ${msg}`));
+                    console.log(chalk.gray('Falling back to password...'));
+                }
+            }
+            else {
+                const fallback = config.auth?.fallback ?? 'password';
+                if (fallback === 'none') {
+                    console.log(chalk.red(`HSM device (${hsm.backendName}) not found. No fallback configured.`));
+                    return;
+                }
+                console.log(chalk.yellow(`HSM device (${hsm.backendName}) not available. Falling back to password...`));
+            }
+        }
+        // --- OS keychain ---
+        if (!password && (authMethod === 'keychain' || config.keychain?.enabled)) {
+            const keychain = new KeychainManager(config.keychain?.service || 'envcp');
             const stored = await keychain.retrievePassword(projectPath);
             if (stored) {
                 password = stored;
                 console.log(chalk.gray('Password retrieved from OS keychain'));
             }
         }
+        // --- Password prompt fallback ---
         if (!password) {
-            const answer = await inquirer.prompt([
-                { type: 'password', name: 'password', message: 'Enter password:', mask: '*' }
-            ]);
-            password = answer.password;
+            password = await promptPassword('Enter password:');
             const { valid: passwordValid, warning: passwordWarning } = validatePassword(password, config.password || {});
             if (!passwordValid) {
                 console.log(chalk.red("Invalid password"));
@@ -59,13 +132,13 @@ async function withSession(fn, vaultOverride) {
     const storage = new StorageManager(vaultPath, config.storage.encrypted);
     if (password)
         storage.setPassword(password);
-    await fn(storage, password, config, projectPath);
+    await fn(storage, password, config, projectPath, logManager);
 }
 const program = new Command();
 program
     .name('envcp')
     .description('Secure environment variable management for AI-assisted coding')
-    .version('1.0.0');
+    .version(VERSION);
 program
     .command('init')
     .description('Initialize EnvCP in the current project')
@@ -73,60 +146,98 @@ program
     .option('--no-encrypt', 'Skip encryption (passwordless mode)')
     .option('--skip-env', 'Skip .env auto-import')
     .option('--skip-mcp', 'Skip MCP auto-registration')
+    .option('--auth-method <method>', 'Authentication method: password | keychain | hsm | multi (default: password)')
+    .option('--hsm-type <type>', 'HSM type for --auth-method hsm|multi: yubikey | gpg | pkcs11')
+    .option('--key-id <id>', 'GPG key ID or PKCS#11 key label for HSM auth')
+    .option('--pkcs11-lib <path>', 'Path to PKCS#11 shared library for --hsm-type pkcs11')
+    .option('--global', 'Initialize a global vault at ~/.envcp/ (config + store live in $HOME)')
+    .option('--force', 'Overwrite existing envcp.yaml (DESTRUCTIVE: existing vault may become inaccessible)')
     .action(async (options) => {
-    const projectPath = process.cwd();
-    const projectName = options.project || path.basename(projectPath);
-    console.log(chalk.blue('Initializing EnvCP...'));
+    const useGlobal = !!options.global;
+    const home = process.env.HOME || process.env.USERPROFILE || os.homedir();
+    const projectPath = useGlobal ? home : process.cwd();
+    const projectName = options.project || (useGlobal ? 'global' : path.basename(projectPath));
+    const configPath = path.join(projectPath, 'envcp.yaml');
+    if (await pathExists(configPath) && !options.force) {
+        const vaultRelPath = path.join('.envcp', 'store.enc');
+        console.log(chalk.yellow('EnvCP is already initialized here.'));
+        console.log(chalk.gray(`  Config: ${configPath}`));
+        if (await pathExists(path.join(projectPath, vaultRelPath))) {
+            console.log(chalk.gray(`  Vault:  ${path.join(projectPath, vaultRelPath)}`));
+        }
+        console.log('');
+        console.log(chalk.gray('Running init again would overwrite your config and may make'));
+        console.log(chalk.gray('existing encrypted variables permanently inaccessible.'));
+        console.log('');
+        console.log(chalk.gray('To reconfigure: edit envcp.yaml directly'));
+        console.log(chalk.gray('To force re-init (DESTRUCTIVE): envcp init --force'));
+        process.exit(1);
+    }
+    console.log(chalk.blue(useGlobal ? 'Initializing EnvCP (global vault)...' : 'Initializing EnvCP...'));
     console.log('');
-    const config = await initConfig(projectPath, projectName);
+    const config = await initConfig(projectPath, projectName, { global: useGlobal });
     // Single security question (or skip if --no-encrypt)
     let securityChoice;
     if (options.encrypt === false) {
         securityChoice = 'none';
     }
     else {
-        const { mode } = await inquirer.prompt([
-            {
-                type: 'list',
-                name: 'mode',
-                message: 'How would you like to secure your variables?',
-                choices: [
-                    { name: 'No encryption (fastest setup, for local dev)', value: 'none' },
-                    { name: 'Encrypted with recovery key (recommended)', value: 'recoverable' },
-                    { name: 'Encrypted hard-lock (max security, no recovery)', value: 'hard-lock' },
-                ],
-                default: 'recoverable',
-            }
-        ]);
-        securityChoice = mode;
+        securityChoice = await promptList('How would you like to secure your variables?', [
+            { name: 'No encryption (fastest setup, for local dev)', value: 'none' },
+            { name: 'Encrypted with recovery key (recommended)', value: 'recoverable' },
+            { name: 'Encrypted hard-lock (max security, no recovery)', value: 'hard-lock' },
+        ], 'recoverable');
     }
     // Apply security choice to config
     if (securityChoice === 'none') {
         config.encryption = { enabled: false };
         config.storage.encrypted = false;
-        config.security = { mode: 'recoverable', recovery_file: '.envcp/.recovery' };
+        config.security = {
+            mode: 'recoverable',
+            recovery_file: '.envcp/.recovery',
+            brute_force_protection: {
+                enabled: true,
+                max_attempts: 5,
+                lockout_duration: 300,
+                progressive_delay: true,
+                max_delay: 60,
+                permanent_lockout_threshold: 50,
+                permanent_lockout_action: 'require_recovery_key',
+                notifications: {}
+            }
+        };
     }
     else {
         config.encryption = { enabled: true };
         config.storage.encrypted = true;
-        config.security = { mode: securityChoice, recovery_file: '.envcp/.recovery' };
+        config.security = {
+            mode: securityChoice,
+            recovery_file: '.envcp/.recovery',
+            brute_force_protection: {
+                enabled: true,
+                max_attempts: 5,
+                lockout_duration: 300,
+                progressive_delay: true,
+                max_delay: 60,
+                permanent_lockout_threshold: 50,
+                permanent_lockout_action: 'require_recovery_key',
+                notifications: {},
+            }
+        };
     }
     // For encrypted modes: get password now
     let pwd = '';
     if (securityChoice !== 'none') {
-        const { password } = await inquirer.prompt([
-            { type: 'password', name: 'password', message: 'Set encryption password:', mask: '*' }
-        ]);
-        const { confirm } = await inquirer.prompt([
-            { type: 'password', name: 'confirm', message: 'Confirm password:', mask: '*' }
-        ]);
-        if (password !== confirm) {
+        const password = await promptPassword('Set encryption password:');
+        const confirmPwd = await promptPassword('Confirm password:');
+        // eslint-disable-next-line security/detect-possible-timing-attacks -- comparing two user-typed confirm fields, not a secret-vs-known value
+        if (password !== confirmPwd) {
             console.log(chalk.red('Passwords do not match. Aborting.'));
             return;
         }
         pwd = password;
     }
-    await saveConfig(config, projectPath);
+    await saveConfig(config, projectPath, { global: useGlobal });
     const modeLabel = securityChoice === 'none' ? 'no encryption' : securityChoice;
     console.log(chalk.green('EnvCP initialized!'));
     console.log(chalk.gray(`  Project: ${config.project}`));
@@ -146,18 +257,20 @@ program
                 if (pwd)
                     storage.setPassword(pwd);
                 const now = new Date().toISOString();
+                const existing = await storage.load();
                 for (const [name, value] of Object.entries(vars)) {
-                    await storage.set(name, {
+                    existing[name] = {
                         name, value,
                         encrypted: config.storage.encrypted,
                         created: now, updated: now,
                         sync_to_env: true,
                         protected: false,
-                    });
+                    };
                 }
+                await storage.save(existing);
                 // Create session for encrypted mode
                 if (pwd) {
-                    const sessionManager = new SessionManager(path.join(projectPath, config.session?.path || '.envcp/.session'), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
+                    const sessionManager = new SessionManager(resolveSessionPath(projectPath, config), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
                     await sessionManager.init();
                     await sessionManager.create(pwd);
                 }
@@ -202,6 +315,45 @@ program
             console.log(chalk.gray('  No AI tools detected for auto-registration'));
         }
     }
+    // Setup HSM authentication if --auth-method hsm|multi provided
+    const authMethod = options.authMethod;
+    if (pwd && (authMethod === 'hsm' || authMethod === 'multi')) {
+        const hsmType = options.hsmType || 'yubikey';
+        config.hsm = {
+            ...config.hsm,
+            enabled: true,
+            type: hsmType,
+            key_id: options.keyId ?? config.hsm?.key_id,
+            pkcs11_lib: options.pkcs11Lib ?? config.hsm?.pkcs11_lib,
+            require_touch: config.hsm?.require_touch ?? true,
+            protected_key_path: config.hsm?.protected_key_path ?? '.envcp/.hsm-key',
+        };
+        config.auth = {
+            method: authMethod,
+            multi_factors: authMethod === 'multi' ? ['password', 'hsm'] : ['hsm'],
+            fallback: 'password',
+        };
+        const hsm = HsmManager.fromConfig(config, projectPath);
+        if (await hsm.isAvailable()) {
+            try {
+                await hsm.protectVaultPassword(pwd);
+                await saveConfig(config, projectPath, { global: useGlobal });
+                console.log('');
+                console.log(chalk.green(`  Vault password protected by ${hsm.backendName}`));
+                console.log(chalk.gray(`  Future sessions will authenticate via hardware`));
+            }
+            catch (err) {
+                console.log(chalk.yellow(`  HSM setup warning: ${err instanceof Error ? err.message : String(err)}`));
+                console.log(chalk.gray('  Falling back to password authentication'));
+            }
+        }
+        else {
+            console.log(chalk.yellow(`  HSM device (${hsm.backendName}) not available at init time.`));
+            console.log(chalk.gray('  Run "envcp unlock --setup-hsm" later to enable hardware authentication.'));
+            config.auth = { method: authMethod, multi_factors: ['password', 'hsm'], fallback: 'password' };
+            await saveConfig(config, projectPath, { global: useGlobal });
+        }
+    }
     console.log('');
     console.log(chalk.green('Done! Your AI tools can now use EnvCP.'));
 });
@@ -209,21 +361,18 @@ program
     .command('unlock')
     .description('Unlock EnvCP session with password')
     .option('-p, --password <password>', 'Password (will prompt if not provided)')
+    .option('--recovery-key <key>', 'Recovery key to clear permanent lockout')
     .option('--save-to-keychain', 'Save password to OS keychain for auto-unlock')
+    .option('--setup-hsm', 'Protect vault password with hardware security module')
+    .option('--hsm-type <type>', 'HSM type: yubikey | gpg | pkcs11 (default: yubikey)')
+    .option('--key-id <id>', 'GPG key ID or PKCS#11 key label')
+    .option('--pkcs11-lib <path>', 'Path to PKCS#11 shared library (.so / .dll)')
+    .option('--global', 'Unlock the global vault at ~/.envcp')
     .action(async (options) => {
-    const projectPath = process.cwd();
-    const config = await loadConfig(projectPath);
+    const { projectPath, config } = await resolveCliContext(options.global ? 'global' : undefined);
     let password = options.password;
     if (!password) {
-        const answer = await inquirer.prompt([
-            {
-                type: 'password',
-                name: 'password',
-                message: 'Enter password:',
-                mask: '*'
-            }
-        ]);
-        password = answer.password;
+        password = await promptPassword('Enter password:');
     }
     const { valid: passwordValid, warning: passwordWarning } = validatePassword(password, config.password || {});
     if (!passwordValid) {
@@ -234,16 +383,116 @@ program
     if (passwordValid && passwordWarning) {
         console.log(chalk.yellow('⚠ Weak password detected'));
     }
-    const sessionManager = new SessionManager(path.join(projectPath, config.session?.path || '.envcp/.session'), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
+    const sessionDir = path.dirname(resolveSessionPath(projectPath, config));
+    let lockoutManager = new LockoutManager(path.join(sessionDir, '.lockout'));
+    // Handle recovery key if provided
+    if (options.recoveryKey) {
+        const recoveryPath = path.join(projectPath, config.security?.recovery_file || '.envcp/.recovery');
+        if (!await pathExists(recoveryPath)) {
+            console.log(chalk.red('No recovery file found.'));
+            return;
+        }
+        const recoveryData = await fs.readFile(recoveryPath, 'utf8');
+        try {
+            await recoverPassword(recoveryData, options.recoveryKey);
+            // Recovery key is valid - clear permanent lockout
+            await lockoutManager.clearPermanentLockout();
+            console.log(chalk.green('Permanent lockout cleared.'));
+            // Log recovery event
+            const logManager = new LogManager(resolveLogPath(config.audit, projectPath), config.audit);
+            await logManager.init();
+            await logManager.log({
+                timestamp: new Date().toISOString(),
+                operation: 'unlock',
+                variable: '',
+                source: 'cli',
+                success: true,
+                message: 'Permanent lockout cleared with recovery key (via --recovery-key flag)',
+                session_id: '',
+                client_id: 'cli',
+                client_type: 'terminal',
+                ip: '127.0.0.1'
+            });
+            console.log(chalk.yellow('Note: You still need to enter the correct password.'));
+            // Continue with password prompt
+        }
+        catch {
+            console.log(chalk.red('Invalid recovery key.'));
+            return;
+        }
+    }
+    // Use new brute_force_protection config if available, fall back to session config
+    const bfpConfig = config.security?.brute_force_protection;
+    const lockoutThreshold = bfpConfig?.max_attempts ?? config.session?.lockout_threshold ?? 5;
+    const lockoutBaseSeconds = bfpConfig?.lockout_duration ?? config.session?.lockout_base_seconds ?? 60;
+    const progressiveDelay = bfpConfig?.progressive_delay ?? true;
+    const maxDelay = bfpConfig?.max_delay ?? 60;
+    const permanentThreshold = bfpConfig?.permanent_lockout_threshold ?? 0;
+    const sessionManager = new SessionManager(resolveSessionPath(projectPath, config), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
     await sessionManager.init();
-    const storage = new StorageManager(path.join(projectPath, config.storage.path), config.storage.encrypted);
+    // Initialize audit logging
+    const logManager = new LogManager(resolveLogPath(config.audit, projectPath), config.audit);
+    await logManager.init();
+    const vaultPathForUnlock = await resolveVaultPath(projectPath, config);
+    const storage = new StorageManager(vaultPathForUnlock, config.storage.encrypted);
     storage.setPassword(password);
     const storeExists = await storage.exists();
+    // Check lockout before attempting password verification on existing stores
+    if (storeExists) {
+        const lockoutStatus = await lockoutManager.check();
+        if (lockoutStatus.locked) {
+            if (lockoutStatus.permanent_locked) {
+                console.log(chalk.red.bold('PERMANENT LOCKOUT: Too many failed attempts.'));
+                console.log(chalk.red('Recovery key or administrator intervention required.'));
+                const useRecovery = await promptConfirm('Use recovery key to clear lockout?', true);
+                if (useRecovery) {
+                    const recoveryKey = await promptPassword('Enter recovery key:');
+                    const recoveryPath = path.join(projectPath, config.security?.recovery_file || '.envcp/.recovery');
+                    if (!await pathExists(recoveryPath)) {
+                        console.log(chalk.red('No recovery file found.'));
+                        return;
+                    }
+                    const recoveryData = await fs.readFile(recoveryPath, 'utf8');
+                    try {
+                        await recoverPassword(recoveryData, recoveryKey);
+                        // Recovery key is valid - clear permanent lockout
+                        await lockoutManager.clearPermanentLockout();
+                        console.log(chalk.green('Permanent lockout cleared. You can now attempt to unlock.'));
+                        console.log(chalk.yellow('Note: You still need to enter the correct password.'));
+                        // Log recovery event
+                        await logManager.log({
+                            timestamp: new Date().toISOString(),
+                            operation: 'unlock',
+                            variable: '',
+                            source: 'cli',
+                            success: true,
+                            message: 'Permanent lockout cleared with recovery key',
+                            session_id: '',
+                            client_id: 'cli',
+                            client_type: 'terminal',
+                            ip: '127.0.0.1'
+                        });
+                        // Continue with password prompt
+                    }
+                    catch {
+                        console.log(chalk.red('Invalid recovery key.'));
+                        return;
+                    }
+                }
+                else {
+                    return;
+                }
+            }
+            else {
+                console.log(chalk.red(`Too many failed attempts. Try again in ${lockoutStatus.remaining_seconds} second(s).`));
+                return;
+            }
+        }
+    }
     if (!storeExists) {
-        const confirm = await inquirer.prompt([
-            { type: 'password', name: 'password', message: 'Confirm password:', mask: '*' }
-        ]);
-        if (confirm.password !== password) {
+        const confirmPasswordValue = await promptPassword('Confirm password:');
+        // eslint-disable-next-line security/detect-possible-timing-attacks -- comparing two user-typed confirm fields, not a secret-vs-known value
+        if (confirmPasswordValue !== password) {
             console.log(chalk.red('Passwords do not match'));
             return;
         }
@@ -267,10 +516,85 @@ program
         await storage.load();
     }
     catch (error) {
-        console.log(chalk.red('Invalid password'));
+        if (storeExists) {
+            const status = await lockoutManager.recordFailure(lockoutThreshold, lockoutBaseSeconds, progressiveDelay, maxDelay, permanentThreshold);
+            // Log the failed attempt
+            await logManager.log({
+                timestamp: new Date().toISOString(),
+                operation: 'auth_failure',
+                variable: '',
+                source: 'cli',
+                success: false,
+                message: `Failed unlock attempt (attempt ${status.attempts})`,
+                session_id: '',
+                client_id: 'cli',
+                client_type: 'terminal',
+                ip: '127.0.0.1'
+            });
+            if (status.permanent_locked) {
+                console.log(chalk.red.bold('PERMANENT LOCKOUT TRIGGERED: Too many failed attempts.'));
+                console.log(chalk.red('Recovery key or administrator intervention required.'));
+                // Log permanent lockout event
+                await logManager.log({
+                    timestamp: new Date().toISOString(),
+                    operation: 'permanent_lockout',
+                    variable: '',
+                    source: 'cli',
+                    success: false,
+                    message: `Permanent lockout triggered after ${status.permanent_lockout_count} lockouts`,
+                    session_id: '',
+                    client_id: 'cli',
+                    client_type: 'terminal',
+                    ip: '127.0.0.1'
+                });
+            }
+            else if (status.locked) {
+                console.log(chalk.red(`Invalid password. Too many failed attempts — locked out for ${status.remaining_seconds} second(s).`));
+                // Log lockout event
+                await logManager.log({
+                    timestamp: new Date().toISOString(),
+                    operation: 'lockout_triggered',
+                    variable: '',
+                    source: 'cli',
+                    success: false,
+                    message: `Lockout triggered for ${status.remaining_seconds}s (lockout #${status.lockout_count})`,
+                    session_id: '',
+                    client_id: 'cli',
+                    client_type: 'terminal',
+                    ip: '127.0.0.1'
+                });
+            }
+            else {
+                const remaining = lockoutThreshold - status.attempts;
+                let message = `Invalid password. ${remaining} attempt(s) remaining before lockout.`;
+                // Show progressive delay if applied
+                if (status.delay_seconds && status.delay_seconds > 0) {
+                    message += ` (Delayed ${status.delay_seconds}s)`;
+                }
+                console.log(chalk.red(message));
+            }
+        }
+        else {
+            console.log(chalk.red('Invalid password'));
+        }
         return;
     }
+    // Successful unlock — clear any lockout state
+    await lockoutManager.reset();
     const session = await sessionManager.create(password);
+    // Log successful unlock
+    await logManager.log({
+        timestamp: new Date().toISOString(),
+        operation: 'unlock',
+        variable: '',
+        source: 'cli',
+        success: true,
+        message: 'Session unlocked successfully',
+        session_id: session.id,
+        client_id: 'cli',
+        client_type: 'terminal',
+        ip: '127.0.0.1'
+    });
     console.log(chalk.green('Session unlocked!'));
     console.log(chalk.gray(`  Session ID: ${session.id}`));
     console.log(chalk.gray(`  Expires in: ${config.session?.timeout_minutes || 30} minutes`));
@@ -296,14 +620,43 @@ program
             console.log(chalk.red(`OS keychain not available (${keychain.backendName})`));
         }
     }
+    // Setup HSM if requested
+    if (options.setupHsm) {
+        const hsmType = options.hsmType || 'yubikey';
+        config.hsm = {
+            ...config.hsm,
+            enabled: true,
+            type: hsmType,
+            key_id: options.keyId ?? config.hsm?.key_id,
+            pkcs11_lib: options.pkcs11Lib ?? config.hsm?.pkcs11_lib,
+            require_touch: config.hsm?.require_touch ?? true,
+            protected_key_path: config.hsm?.protected_key_path ?? '.envcp/.hsm-key',
+        };
+        config.auth = { ...config.auth, method: 'hsm', fallback: config.auth?.fallback ?? 'password' };
+        const hsm = HsmManager.fromConfig(config, projectPath);
+        if (!await hsm.isAvailable()) {
+            console.log(chalk.red(`HSM device (${hsm.backendName}) not available. Aborting HSM setup.`));
+            return;
+        }
+        try {
+            await hsm.protectVaultPassword(password);
+            await saveConfig(config, projectPath);
+            console.log(chalk.green(`Vault password protected by ${hsm.backendName}`));
+            console.log(chalk.gray(`  Key file: ${config.hsm.protected_key_path}`));
+            console.log(chalk.gray('  Future sessions will authenticate via hardware'));
+        }
+        catch (err) {
+            console.log(chalk.red(`HSM setup failed: ${err instanceof Error ? err.message : String(err)}`));
+        }
+    }
 });
 program
     .command('lock')
     .description('Lock EnvCP session')
-    .action(async () => {
-    const projectPath = process.cwd();
-    const config = await loadConfig(projectPath);
-    const sessionManager = new SessionManager(path.join(projectPath, config.session?.path || '.envcp/.session'), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
+    .option('--global', 'Lock the global vault session at ~/.envcp/.session')
+    .action(async (options) => {
+    const { projectPath, config } = await resolveCliContext(options.global ? 'global' : undefined);
+    const sessionManager = new SessionManager(resolveSessionPath(projectPath, config), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
     await sessionManager.init();
     await sessionManager.destroy();
     console.log(chalk.green('Session locked'));
@@ -311,15 +664,13 @@ program
 program
     .command('status')
     .description('Check session status')
-    .action(async () => {
-    const projectPath = process.cwd();
-    const config = await loadConfig(projectPath);
-    const sessionManager = new SessionManager(path.join(projectPath, config.session?.path || '.envcp/.session'), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
+    .option('--global', 'Check status of the global vault session at ~/.envcp/.session')
+    .action(async (options) => {
+    const { projectPath, config } = await resolveCliContext(options.global ? 'global' : undefined);
+    const sessionManager = new SessionManager(resolveSessionPath(projectPath, config), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
     await sessionManager.init();
-    const answer = await inquirer.prompt([
-        { type: 'password', name: 'password', message: 'Enter password:', mask: '*' }
-    ]);
-    const session = await sessionManager.load(answer.password);
+    const password = await promptPassword('Enter password:');
+    const session = await sessionManager.load(password);
     if (!session) {
         console.log(chalk.yellow('No active session (expired, invalid password, or not unlocked)'));
         console.log(chalk.gray('Run: envcp unlock'));
@@ -340,9 +691,7 @@ program
     .action(async () => {
     const projectPath = process.cwd();
     const configGuard = new ConfigGuard(projectPath);
-    const { password } = await inquirer.prompt([
-        { type: 'password', name: 'password', message: 'Enter password to reload config:', mask: '*' }
-    ]);
+    const password = await promptPassword('Enter password to reload config:');
     const result = await configGuard.reload(password);
     if (result.success) {
         console.log(chalk.green('Config reloaded successfully'));
@@ -355,15 +704,13 @@ program
 program
     .command('extend')
     .description('Extend session timeout')
-    .action(async () => {
-    const projectPath = process.cwd();
-    const config = await loadConfig(projectPath);
-    const sessionManager = new SessionManager(path.join(projectPath, config.session?.path || '.envcp/.session'), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
+    .option('--global', 'Extend the global vault session at ~/.envcp/.session')
+    .action(async (options) => {
+    const { projectPath, config } = await resolveCliContext(options.global ? 'global' : undefined);
+    const sessionManager = new SessionManager(resolveSessionPath(projectPath, config), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
     await sessionManager.init();
-    const answer = await inquirer.prompt([
-        { type: 'password', name: 'password', message: 'Enter password:', mask: '*' }
-    ]);
-    const loaded = await sessionManager.load(answer.password);
+    const password = await promptPassword('Enter password:');
+    const loaded = await sessionManager.load(password);
     if (!loaded) {
         console.log(chalk.red('Cannot extend session. No active session or invalid password.'));
         return;
@@ -394,9 +741,7 @@ program
         console.log(chalk.red('No recovery file found. Recovery is not available.'));
         return;
     }
-    const { recoveryKey } = await inquirer.prompt([
-        { type: 'password', name: 'recoveryKey', message: 'Enter your recovery key:', mask: '*' }
-    ]);
+    const recoveryKey = await promptPassword('Enter your recovery key:');
     const recoveryData = await fs.readFile(recoveryPath, 'utf8');
     let oldPassword;
     try {
@@ -419,12 +764,8 @@ program
     }
     console.log(chalk.green('Recovery key verified. Store contains ' + Object.keys(variables).length + ' variables.'));
     // Set new password
-    const { newPassword } = await inquirer.prompt([
-        { type: 'password', name: 'newPassword', message: 'Set new password:', mask: '*' }
-    ]);
-    const { confirmPassword } = await inquirer.prompt([
-        { type: 'password', name: 'confirmPassword', message: 'Confirm new password:', mask: '*' }
-    ]);
+    const newPassword = await promptPassword('Set new password:');
+    const confirmPassword = await promptPassword('Confirm new password:');
     if (newPassword !== confirmPassword) {
         console.log(chalk.red('Passwords do not match'));
         return;
@@ -443,7 +784,7 @@ program
     console.log(chalk.yellow.bold(`  ${newRecoveryKey}`));
     console.log(chalk.gray('Your old recovery key no longer works.'));
     // Create a session with new password
-    const sessionManager = new SessionManager(path.join(projectPath, config.session?.path || '.envcp/.session'), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
+    const sessionManager = new SessionManager(resolveSessionPath(projectPath, config), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
     await sessionManager.init();
     await sessionManager.create(newPassword);
     console.log(chalk.green('Session unlocked with new password.'));
@@ -480,27 +821,82 @@ program
 program
     .command('add <name>')
     .description('Add a new environment variable')
-    .option('-v, --value <value>', 'Variable value')
+    .option('-v, --value <value>', 'Variable value (WARNING: leaks in shell history; prefer --from-env/--from-file/--stdin)')
+    .option('--from-env <envVar>', 'Read value from the named environment variable')
+    .option('--from-file <path>', 'Read value from a file (trailing newline trimmed)')
+    .option('--stdin', 'Read value from piped stdin')
     .option('-t, --tags <tags>', 'Tags (comma-separated)')
     .option('-d, --description <desc>', 'Description')
     .action(async (name, options) => {
+    const sourceFlags = [
+        options.value !== undefined ? '--value' : null,
+        options.fromEnv !== undefined ? '--from-env' : null,
+        options.fromFile !== undefined ? '--from-file' : null,
+        options.stdin ? '--stdin' : null,
+    ].filter(Boolean);
+    if (sourceFlags.length > 1) {
+        console.error(chalk.red(`Error: ${sourceFlags.join(', ')} are mutually exclusive — pick one`));
+        process.exit(1);
+    }
+    let value;
+    let sourced = false;
+    if (options.value !== undefined) {
+        value = options.value;
+        sourced = true;
+        if (process.stdout.isTTY) {
+            console.warn(chalk.yellow('⚠  --value is visible in shell history and process list. Use --from-env, --from-file, or --stdin for secrets.'));
+        }
+    }
+    else if (options.fromEnv) {
+        const envValue = process.env[options.fromEnv];
+        if (envValue === undefined) {
+            console.error(chalk.red(`Error: environment variable '${options.fromEnv}' is not set`));
+            process.exit(1);
+        }
+        value = envValue;
+        sourced = true;
+    }
+    else if (options.fromFile) {
+        try {
+            const raw = await fs.readFile(options.fromFile, 'utf-8');
+            value = raw.replace(/\r?\n$/, '');
+            sourced = true;
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            console.error(chalk.red(`Error: cannot read '${options.fromFile}': ${msg}`));
+            process.exit(1);
+        }
+    }
+    else if (options.stdin) {
+        if (process.stdin.isTTY) {
+            console.error(chalk.red('Error: --stdin requires piped input (e.g., `echo "$SECRET" | envcp add NAME --stdin`)'));
+            process.exit(1);
+        }
+        value = await new Promise((resolve, reject) => {
+            const chunks = [];
+            process.stdin.on('data', (c) => chunks.push(typeof c === 'string' ? Buffer.from(c) : c));
+            process.stdin.on('end', () => resolve(Buffer.concat(chunks).toString('utf-8').replace(/\r?\n$/, '')));
+            process.stdin.on('error', reject);
+        });
+        sourced = true;
+    }
     await withSession(async (storage, _password, config) => {
-        let value = options.value;
         let tags = [];
         let description = options.description;
-        if (!value) {
-            const answers = await inquirer.prompt([
-                { type: 'password', name: 'value', message: 'Enter value:', mask: '*' },
-                { type: 'input', name: 'tags', message: 'Tags (comma-separated):' },
-                { type: 'input', name: 'description', message: 'Description:' },
-            ]);
-            value = answers.value;
-            tags = answers.tags.split(',').map((t) => t.trim()).filter(Boolean);
-            description = answers.description;
+        if (!sourced) {
+            value = await promptPassword('Enter value:');
+            const tagsInput = await promptInput('Tags (comma-separated):');
+            tags = tagsInput.split(',').map((t) => t.trim()).filter(Boolean);
+            description = await promptInput('Description:');
         }
         else if (options.tags) {
             tags = options.tags.split(',').map((t) => t.trim()).filter(Boolean);
         }
+        if (value === undefined) {
+            console.error(chalk.red('Error: no value provided'));
+            process.exit(1);
+        }
         const now = new Date().toISOString();
         const variable = {
             name,
@@ -606,7 +1002,8 @@ program
             if (!variable.sync_to_env)
                 continue;
             const excluded = config.sync.exclude?.some((pattern) => {
-                const regex = new RegExp('^' + pattern.replace(/\*/g, '.*') + '$');
+                // eslint-disable-next-line security/detect-non-literal-regexp -- glob pattern from config; metacharacters escaped above
+                const regex = new RegExp('^' + pattern.replace(/[.+?^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '.*') + '$');
                 return regex.test(name);
             });
             if (excluded)
@@ -631,7 +1028,8 @@ program
                 if (!variable.sync_to_env)
                     continue;
                 const excluded = config.sync.exclude?.some((pattern) => {
-                    const regex = new RegExp('^' + pattern.replace(/\*/g, '.*') + '$');
+                    // eslint-disable-next-line security/detect-non-literal-regexp -- glob pattern from config; metacharacters escaped above
+                    const regex = new RegExp('^' + pattern.replace(/[.+?^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '.*') + '$');
                     return regex.test(name);
                 });
                 if (excluded)
@@ -680,10 +1078,40 @@ program
     .option('--port <port>', 'HTTP port (for non-MCP modes)', '3456')
     .option('--host <host>', 'HTTP host', '127.0.0.1')
     .option('-k, --api-key <key>', 'API key for HTTP authentication')
+    .option('--global', 'Force the global vault at ~/.envcp (skip project lookup)')
     .action(async (options) => {
-    const projectPath = process.cwd();
+    const home = process.env.HOME || process.env.USERPROFILE || os.homedir();
+    const globalConfigPath = path.join(home, '.envcp', 'config.yaml');
+    // Resolve where the vault lives: --global forces home; otherwise walk up
+    // from cwd looking for envcp.yaml; otherwise fall back to a global install.
+    let projectPath;
+    let forceGlobalMode = false;
+    if (options.global) {
+        projectPath = home;
+        forceGlobalMode = true;
+    }
+    else {
+        const found = await findProjectRoot(process.cwd());
+        if (found) {
+            projectPath = found;
+        }
+        else if (await pathExists(globalConfigPath)) {
+            projectPath = home;
+            forceGlobalMode = true;
+        }
+        else {
+            process.stderr.write('Error: No envcp.yaml found in cwd or any ancestor, and no global config at ~/.envcp/config.yaml.\n' +
+                'Run `envcp init` (project) or `envcp init --global` first.\n');
+            process.exit(1);
+        }
+    }
     const configGuard = new ConfigGuard(projectPath);
     const config = await configGuard.loadAndLock();
+    if (forceGlobalMode) {
+        config.vault = { ...config.vault, mode: 'global' };
+    }
+    const vaultPath = await resolveVaultPath(projectPath, config);
+    const sessionPath = resolveSessionPath(projectPath, config);
     const mode = options.mode;
     const port = parseInt(options.port, 10);
     const host = options.host;
@@ -693,26 +1121,23 @@ program
     if (config.encryption?.enabled === false) {
         if (mode === 'mcp') {
             const { EnvCPServer } = await import('../mcp/server.js');
-            const server = new EnvCPServer(config, projectPath);
+            const server = new EnvCPServer(config, projectPath, undefined, vaultPath, sessionPath);
             await server.start();
             return;
         }
     }
     else {
         // Encrypted mode: need password
-        const sessionManager = new SessionManager(path.join(projectPath, config.session?.path || '.envcp/.session'), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
+        const sessionManager = new SessionManager(sessionPath, config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
         await sessionManager.init();
         let session = await sessionManager.load();
         if (!session && !password) {
             // MCP mode uses stdio — can't prompt interactively
             if (mode === 'mcp') {
-                process.stderr.write('Error: No active session. Run `envcp unlock` first, or use --password flag.\n');
+                process.stderr.write(`Error: No active session at ${sessionPath}. Run \`envcp unlock${forceGlobalMode ? ' --global' : ''}\` first, or use --password flag.\n`);
                 process.exit(1);
             }
-            const answer = await inquirer.prompt([
-                { type: 'password', name: 'password', message: 'Enter password:', mask: '*' }
-            ]);
-            password = answer.password;
+            password = await promptPassword('Enter password:');
             const { valid: passwordValid, warning: passwordWarning } = validatePassword(password, config.password || {});
             if (!passwordValid) {
                 // nosem: no tainted data flows to log
@@ -728,7 +1153,7 @@ program
         // MCP mode uses stdio
         if (mode === 'mcp') {
             const { EnvCPServer } = await import('../mcp/server.js');
-            const server = new EnvCPServer(config, projectPath, password);
+            const server = new EnvCPServer(config, projectPath, password, vaultPath, sessionPath);
             await server.start();
             return;
         }
@@ -804,12 +1229,8 @@ program
                 console.log(chalk.red('--output <path> is required with --encrypted'));
                 return;
             }
-            const { exportPassword } = await inquirer.prompt([
-                { type: 'password', name: 'exportPassword', message: 'Set export password:', mask: '*' }
-            ]);
-            const { confirmExport } = await inquirer.prompt([
-                { type: 'password', name: 'confirmExport', message: 'Confirm export password:', mask: '*' }
-            ]);
+            const exportPassword = await promptPassword('Set export password:');
+            const confirmExport = await promptPassword('Confirm export password:');
             if (exportPassword !== confirmExport) {
                 console.log(chalk.red('Passwords do not match'));
                 return;
@@ -857,9 +1278,7 @@ program
             console.log(chalk.red(`File not found: ${file}`));
             return;
         }
-        const { importPassword } = await inquirer.prompt([
-            { type: 'password', name: 'importPassword', message: 'Enter export file password:', mask: '*' }
-        ]);
+        const importPassword = await promptPassword('Enter export file password:');
         const fileContent = await fs.readFile(file, 'utf8');
         let importData;
         try {
@@ -920,9 +1339,7 @@ program
             console.log(chalk.gray('\nNo files were modified.'));
             return;
         }
-        const { confirm } = await inquirer.prompt([
-            { type: 'confirm', name: 'confirm', message: options.merge ? 'Merge into current store?' : 'Replace current store?', default: false }
-        ]);
+        const confirm = await promptConfirm(options.merge ? 'Merge into current store?' : 'Replace current store?', false);
         if (!confirm) {
             console.log(chalk.yellow('Import cancelled'));
             return;
@@ -1004,9 +1421,7 @@ program
                 console.log(chalk.gray(`  Created: ${meta.timestamp}`));
             console.log(chalk.gray(`  Variables: ${meta.count || Object.keys(variables).length}`));
         }
-        const { confirm } = await inquirer.prompt([
-            { type: 'confirm', name: 'confirm', message: options.merge ? 'Merge backup into current store?' : 'Replace current store with backup?', default: false }
-        ]);
+        const confirm = await promptConfirm(options.merge ? 'Merge backup into current store?' : 'Replace current store with backup?', false);
         if (!confirm) {
             console.log(chalk.yellow('Restore cancelled'));
             return;
@@ -1049,7 +1464,7 @@ program
         }
         // 5. Session status
         if (encrypted) {
-            const sessionManager = new SessionManager(path.join(projectPath, config.session?.path || '.envcp/.session'), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
+            const sessionManager = new SessionManager(resolveSessionPath(projectPath, config), config.session?.timeout_minutes || 30, config.session?.max_extensions || 5);
             await sessionManager.init();
             const session = await sessionManager.load();
             if (session) {
@@ -1168,7 +1583,7 @@ program
     .option('--name <name>', 'Operate on a named vault')
     .addCommand(new Command('init')
     .description('Initialize a vault')
-    .action(async (options, cmd) => {
+    .action(async (_options, cmd) => {
     const parentOpts = cmd.parent.opts();
     const projectPath = process.cwd();
     const config = await loadConfig(projectPath);
@@ -1199,7 +1614,7 @@ program
     const parentOpts = cmd.parent.opts();
     const vaultOverride = parentOpts.global ? 'global' : parentOpts.project ? 'project' : undefined;
     await withSession(async (storage) => {
-        const value = options.value || (await inquirer.prompt([{ type: 'input', name: 'value', message: 'Value:' }])).value;
+        const value = options.value || await promptInput('Value:');
         const tags = options.tags ? options.tags.split(',').map((t) => t.trim()) : [];
         const now = new Date().toISOString();
         await storage.set(name, {
@@ -1275,7 +1690,6 @@ program
     .argument('<name>', 'Vault name (global, project, or named vault)')
     .action(async (name) => {
     const projectPath = process.cwd();
-    const config = await loadConfig(projectPath);
     if (name !== 'global' && name !== 'project') {
         const vaultDir = path.join(projectPath, '.envcp/vaults', name);
         if (!await pathExists(vaultDir)) {
@@ -1334,7 +1748,7 @@ program
     .addCommand(new Command('save')
     .description('Save current password to OS keychain')
     .action(async () => {
-    await withSession(async (storage, password, config, projectPath) => {
+    await withSession(async (_storage, password, config, projectPath) => {
         if (!password) {
             console.log(chalk.red('No password available (encryption disabled?)'));
             return;
@@ -1422,5 +1836,131 @@ if (!await pathExists(firstRunMarker)) {
    Docs: https://github.com/fentz26/EnvCP
 `);
 }
+program
+    .command('logs')
+    .description('View audit logs')
+    .option('--date <date>', 'Log date (YYYY-MM-DD, default: today)')
+    .option('--operation <op>', 'Filter by operation (add, get, update, delete, list, sync, export, unlock, lock, check_access, run, auth_failure)')
+    .option('--variable <name>', 'Filter by variable name')
+    .option('--source <source>', 'Filter by source (cli, mcp, api)')
+    .option('--success', 'Show only successful operations')
+    .option('--failure', 'Show only failed operations')
+    .option('--tail <n>', 'Show last N entries', parseInt)
+    .option('--dates', 'List all available log dates')
+    .option('--verify', 'Verify HMAC integrity of log entries')
+    .action(async (options) => {
+    const projectPath = process.cwd();
+    const config = await loadConfig(projectPath);
+    const logDir = resolveLogPath(config.audit, projectPath);
+    const logs = new LogManager(logDir, config.audit);
+    await logs.init();
+    if (options.dates) {
+        const dates = await logs.getLogDates();
+        if (dates.length === 0) {
+            console.log(chalk.gray('No log files found.'));
+        }
+        else {
+            console.log(chalk.bold('Available log dates:'));
+            dates.forEach(d => console.log(chalk.gray(`  ${d}`)));
+        }
+        return;
+    }
+    const filter = {};
+    if (options.date)
+        filter.date = options.date;
+    if (options.operation)
+        filter.operation = options.operation;
+    if (options.variable)
+        filter.variable = options.variable;
+    if (options.source)
+        filter.source = options.source;
+    if (options.success)
+        filter.success = true;
+    if (options.failure)
+        filter.success = false;
+    if (options.tail)
+        filter.tail = options.tail;
+    const entries = await logs.getLogs(filter);
+    if (entries.length === 0) {
+        console.log(chalk.gray('No log entries found.'));
+        return;
+    }
+    let failed = 0;
+    entries.forEach(entry => {
+        const ts = chalk.gray(entry.timestamp);
+        const op = entry.success ? chalk.green(entry.operation) : chalk.red(entry.operation);
+        const src = chalk.blue(entry.source);
+        const varName = entry.variable ? chalk.yellow(` [${entry.variable}]`) : '';
+        const msg = entry.message ? chalk.gray(` — ${entry.message}`) : '';
+        if (options.verify && entry.hmac !== undefined) {
+            const valid = logs.verifyEntry(entry);
+            if (!valid) {
+                failed++;
+                console.log(`${ts} ${chalk.red('[TAMPERED]')} ${op} ${src}${varName}${msg}`);
+                return;
+            }
+        }
+        console.log(`${ts} ${op} ${src}${varName}${msg}`);
+    });
+    if (options.verify) {
+        if (failed === 0) {
+            console.log(chalk.green(`\nAll ${entries.length} entries verified OK.`));
+        }
+        else {
+            console.log(chalk.red(`\n${failed}/${entries.length} entries failed HMAC verification.`));
+        }
+    }
+});
+program
+    .command('verify-logs')
+    .description('Verify HMAC chain integrity of audit logs')
+    .option('--date <date>', 'Verify specific date (YYYY-MM-DD, default: all dates)')
+    .action(async (options) => {
+    const projectPath = process.cwd();
+    const config = await loadConfig(projectPath);
+    const logDir = resolveLogPath(config.audit, projectPath);
+    const logs = new LogManager(logDir, config.audit);
+    await logs.init();
+    if (!config.audit.hmac_chain) {
+        console.log(chalk.yellow('HMAC chain is not enabled in audit config.'));
+        return;
+    }
+    console.log(chalk.bold('Verifying log chain integrity...'));
+    const result = await logs.verifyLogChain(options.date);
+    if (result.valid) {
+        console.log(chalk.green(`✓ Chain integrity verified: ${result.entries} entries OK`));
+    }
+    else {
+        console.log(chalk.red(`✗ Chain integrity FAILED: ${result.tampered.length}/${result.entries} entries tampered`));
+        console.log(chalk.red(`  Tampered indices: ${result.tampered.join(', ')}`));
+    }
+});
+program
+    .command('protect-logs')
+    .description('Apply OS-level protection to audit log files (Linux only)')
+    .action(async () => {
+    const projectPath = process.cwd();
+    const config = await loadConfig(projectPath);
+    const logDir = resolveLogPath(config.audit, projectPath);
+    const logs = new LogManager(logDir, config.audit);
+    await logs.init();
+    if (config.audit.protection === 'none') {
+        console.log(chalk.yellow('Log protection is disabled in config (protection: none).'));
+        return;
+    }
+    console.log(chalk.bold(`Applying ${config.audit.protection} protection to log files...`));
+    const result = await logs.protectLogFiles();
+    if (result.protected.length > 0) {
+        console.log(chalk.green(`✓ Protected ${result.protected.length} files:`));
+        result.protected.forEach((f) => console.log(chalk.gray(`  ${f}`)));
+    }
+    if (result.failed.length > 0) {
+        console.log(chalk.red(`✗ Failed to protect ${result.failed.length} files:`));
+        result.failed.forEach((f) => console.log(chalk.gray(`  ${f}`)));
+    }
+    if (result.protected.length === 0 && result.failed.length === 0) {
+        console.log(chalk.gray('No log files to protect.'));
+    }
+});
 program.parse();
 //# sourceMappingURL=index.js.map