@indigoai-us/hq-cli 5.75.0 → 5.76.0

package/src/commands/secrets.ts

@@ -6,7 +6,6 @@ import * as nodePath from "node:path";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
 import {
   DEFAULT_SECRETS_CACHE_TTL_MS,
-  readCache,
   writeCache,
   removeCacheEntry,
   clearAllCache,
@@ -169,6 +168,7 @@ function promptSecretInteractively(): Promise<string> {
 // large --only list is chunked client-side rather than 400'd whole by the
 // server (the legacy per-key GET path had no such cap).
 const MAX_BATCH_NAMES = 100;
+const SECRET_LOAD_TIMEOUT_MS = 30_000;
 
 export type SecretTier = "standard" | "sensitive" | "nuclear";
 export type SecretScriptLockMode = "off" | "enforced";
@@ -230,12 +230,21 @@ interface SecretPolicyScript {
   attestationLevel: string;
 }
 
+interface SecretPolicyApprovedScript {
+  scriptId: string;
+  path: string;
+  sha256?: string;
+  attestationLevel: string;
+  revokedAt?: string;
+}
+
 interface SecretPolicyRecord {
   path: string;
   tier?: SecretTier;
   scriptLock?: {
     mode?: SecretScriptLockMode;
     requiredAttestation?: string;
+    approvedScripts?: SecretPolicyApprovedScript[];
   };
   scripts?: SecretPolicyScript[];
 }
@@ -402,10 +411,25 @@ function normalizeScriptLockMode(mode?: string): SecretScriptLockMode {
   return mode === "enforced" ? "enforced" : "off";
 }
 
-function normalizeCacheTtlMs(cacheTtlMs?: number): number {
-  return typeof cacheTtlMs === "number"
-    ? cacheTtlMs
-    : DEFAULT_SECRETS_CACHE_TTL_MS;
+function normalizeCacheTtlMs(metadata: SecretMetadata): number {
+  // Controlled rows must never reach the offline cache even if a mixed-version
+  // or malformed response carries a positive TTL. The server is authoritative
+  // for access, but the client still has enough policy metadata to fail safe.
+  if (
+    metadata.tier === "sensitive" ||
+    metadata.tier === "nuclear" ||
+    metadata.scriptLock?.mode === "enforced"
+  ) {
+    return 0;
+  }
+  if (metadata.cacheTtlMs === undefined) {
+    return DEFAULT_SECRETS_CACHE_TTL_MS;
+  }
+  return typeof metadata.cacheTtlMs === "number" &&
+    Number.isFinite(metadata.cacheTtlMs) &&
+    metadata.cacheTtlMs > 0
+    ? metadata.cacheTtlMs
+    : 0;
 }
 
 function extractApiMessage(
@@ -423,6 +447,9 @@ async function buildSecretUsage(
   scriptId?: string,
   attestationLevel = "self-asserted-hash",
 ): Promise<SecretUsage> {
+  if (scriptId && !scriptPath) {
+    throw new Error("--script-id requires --script");
+  }
   if (!scriptPath) {
     return { channel };
   }
@@ -506,11 +533,28 @@ function normalizePolicyRecord(
   data: SecretPolicyResponse,
 ): SecretPolicyRecord & { scripts: SecretPolicyScript[] } {
   const policy = data.policy ?? { path: secretPath };
-  const scripts = Array.isArray(policy.scripts)
-    ? policy.scripts
-    : Array.isArray(data.scripts)
-      ? data.scripts
-      : [];
+  const scripts = Array.isArray(policy.scriptLock?.approvedScripts)
+    ? policy.scriptLock.approvedScripts
+        .filter(
+          (script) =>
+            script !== null &&
+            typeof script === "object" &&
+            typeof script.scriptId === "string" &&
+            typeof script.path === "string" &&
+            typeof script.attestationLevel === "string" &&
+            !script.revokedAt,
+        )
+        .map((script) => ({
+          scriptId: script.scriptId,
+          scriptPath: script.path,
+          sha256: typeof script.sha256 === "string" ? script.sha256 : "",
+          attestationLevel: script.attestationLevel,
+        }))
+    : Array.isArray(policy.scripts)
+      ? policy.scripts.filter(isSecretPolicyScript)
+      : Array.isArray(data.scripts)
+        ? data.scripts.filter(isSecretPolicyScript)
+        : [];
   return {
     path: policy.path ?? secretPath,
     tier: normalizeSecretTier(policy.tier),
@@ -522,6 +566,17 @@ function normalizePolicyRecord(
   };
 }
 
+function isSecretPolicyScript(value: unknown): value is SecretPolicyScript {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const script = value as Partial<SecretPolicyScript>;
+  return (
+    typeof script.scriptId === "string" &&
+    typeof script.scriptPath === "string" &&
+    typeof script.sha256 === "string" &&
+    typeof script.attestationLevel === "string"
+  );
+}
+
 function renderPolicySummary(policy: SecretPolicyRecord): void {
   console.log(chalk.bold(`Policy: ${policy.path}`));
   console.log(`  Tier:          ${normalizeSecretTier(policy.tier)}`);
@@ -563,7 +618,7 @@ function renderPolicyScripts(scripts: SecretPolicyScript[]): void {
         script.scriptId.padEnd(idWidth),
         script.scriptPath.padEnd(pathWidth),
         script.attestationLevel.padEnd(attestationWidth),
-        script.sha256,
+        script.sha256 || "-",
       ].join("  "),
     );
   }
@@ -584,9 +639,14 @@ function renderPolicyScripts(scripts: SecretPolicyScript[]): void {
 // `env` through it stops those callers from emitting the warning while keeping
 // identical UX and error text.
 //
-// Cache-first (so warm keys cost no request), chunked at MAX_BATCH_NAMES, and
-// throws on the FIRST unresolved key with the same `Failed to fetch secret
-// '<k>': <reason>` shape the per-key GET path used — never swallows a failure.
+// Every value use through exec/env/reveal is server-authorized, including when
+// an encrypted disk-cache entry exists. The cache remains write-through for
+// explicitly offline install-time consumers; these commands never trust it as
+// an authorization decision. This means a policy, ACL, tier, or script-approval
+// change takes effect on their next use even though there is no push revocation.
+// Requests are chunked at MAX_BATCH_NAMES and throw on the FIRST unresolved key
+// with the same `Failed to fetch secret '<k>': <reason>` shape the per-key GET
+// path used — never swallows a failure.
 export async function loadRevealedSecrets(
   token: string,
   companyUid: string,
@@ -594,92 +654,139 @@ export async function loadRevealedSecrets(
   usage?: SecretUsage,
 ): Promise<Map<string, string>> {
   const resolved = new Map<string, string>();
-  const missing: string[] = [];
-  for (const key of keys) {
-    const cached = readCache(companyUid, key);
-    if (cached !== null) {
-      resolved.set(key, cached);
-    } else if (!missing.includes(key)) {
-      missing.push(key);
-    }
-  }
-
-  for (let i = 0; i < missing.length; i += MAX_BATCH_NAMES) {
-    const chunk = missing.slice(i, i + MAX_BATCH_NAMES);
-    const res = await vaultApiFetch({
-      token,
-      path: `/secrets/${encodeURIComponent(companyUid)}/load`,
-      method: "POST",
-      body: usage ? { names: chunk, usage } : { names: chunk },
-    });
-    if (!res.ok) {
-      const body = (await res.json().catch(() => ({}))) as Record<string, unknown>;
-      const message = extractApiMessage(body, res.statusText);
-      // High-security ("nuclear") refusal surfaced at the batch level (rather
-      // than per-name): point the caller at the proxy and never leak plaintext.
-      if (body.code === "high_security_denied" || body.highSecurity === true) {
+  const requested = [...new Set(keys)];
+  try {
+    for (let i = 0; i < requested.length; i += MAX_BATCH_NAMES) {
+      const chunk = requested.slice(i, i + MAX_BATCH_NAMES);
+      const chunkNames = new Set(chunk);
+      const res = await vaultApiFetch({
+        token,
+        path: `/secrets/${encodeURIComponent(companyUid)}/load`,
+        method: "POST",
+        body: usage ? { names: chunk, usage } : { names: chunk },
+        signal: AbortSignal.timeout(SECRET_LOAD_TIMEOUT_MS),
+      });
+      if (!res.ok) {
+        const body = (await res.json().catch(() => ({}))) as Record<string, unknown>;
+        const message = extractApiMessage(body, res.statusText);
+        // High-security ("nuclear") refusal surfaced at the batch level (rather
+        // than per-name): point the caller at the proxy and never leak plaintext.
+        if (body.code === "high_security_denied" || body.highSecurity === true) {
+          throw new Error(
+            "A requested secret is high-security and cannot be injected locally — it can only be used through the HQ secret proxy, which keeps the plaintext server-side.",
+          );
+        }
+        if (
+          res.status >= 400 &&
+          res.status < 500 &&
+          typeof body.code === "string"
+        ) {
+          throw new Error(message);
+        }
         throw new Error(
-          "A requested secret is high-security and cannot be injected locally — it can only be used through the HQ secret proxy, which keeps the plaintext server-side.",
+          `Failed to batch-load secrets: ${message}`,
         );
       }
-      if (
-        res.status >= 400 &&
-        res.status < 500 &&
-        typeof body.code === "string"
-      ) {
-        throw new Error(message);
+      const data = (await res.json()) as Partial<SecretLoadResponse>;
+      if (!Array.isArray(data.secrets) || !Array.isArray(data.errors)) {
+        throw new Error("Invalid secret load response from vault");
       }
-      throw new Error(
-        `Failed to batch-load secrets: ${message}`,
-      );
-    }
-    const data = (await res.json()) as SecretLoadResponse;
+      const errorsByName = new Map<string, { code: string; message?: string }>();
+      const seenNames = new Set<string>();
 
-    for (const s of data.secrets ?? []) {
-      if (s.value == null) {
-        throw new Error(
-          `Secret '${s.name}' has no value (reveal may not be permitted).`,
-        );
+      for (const rawSecret of data.secrets) {
+        if (!rawSecret || typeof rawSecret !== "object") {
+          throw new Error("Invalid secret load response from vault");
+        }
+        const s = rawSecret as SecretLoadSuccessRow;
+        if (
+          typeof s.name !== "string" ||
+          !chunkNames.has(s.name) ||
+          seenNames.has(s.name) ||
+          (s.value != null && typeof s.value !== "string")
+        ) {
+          throw new Error("Invalid secret load response from vault");
+        }
+        seenNames.add(s.name);
+        if (s.value == null) {
+          errorsByName.set(s.name, {
+            code: "not_returned",
+            message: `Secret '${s.name}' has no value (reveal may not be permitted).`,
+          });
+          removeCacheEntry(companyUid, s.name);
+          continue;
+        }
+        const cacheTtlMs = normalizeCacheTtlMs(s);
+        if (cacheTtlMs > 0) {
+          writeCache(companyUid, s.name, s.value, cacheTtlMs);
+        } else {
+          removeCacheEntry(companyUid, s.name);
+        }
+        resolved.set(s.name, s.value);
+      }
+
+      for (const rawError of data.errors) {
+        if (!rawError || typeof rawError !== "object") {
+          throw new Error("Invalid secret load response from vault");
+        }
+        const e = rawError as { name?: unknown; code?: unknown; message?: unknown };
+        if (
+          typeof e.name !== "string" ||
+          !chunkNames.has(e.name) ||
+          seenNames.has(e.name) ||
+          typeof e.code !== "string" ||
+          (e.message !== undefined && typeof e.message !== "string")
+        ) {
+          throw new Error("Invalid secret load response from vault");
+        }
+        seenNames.add(e.name);
+        errorsByName.set(e.name, { code: e.code, message: e.message });
+        resolved.delete(e.name);
+        removeCacheEntry(companyUid, e.name);
+      }
+      // Any requested key in this chunk the server did not return is a per-key
+      // failure — surface it with the same prefix the single-GET path used so
+      // callers (and scripts grepping stderr) see no behavior change.
+      let firstFailure: Error | null = null;
+      for (const key of chunk) {
+        if (resolved.has(key)) continue;
+        removeCacheEntry(companyUid, key);
+        const err = errorsByName.get(key);
+        // High-security ("nuclear") secret: the server refuses to vend it on the
+        // local-injection (batch-load) path — per-name code `high_security_denied`,
+        // no plaintext returned. Every caller of loadRevealedSecrets injects or
+        // prints the plaintext locally (`secrets get --reveal`, `secrets exec`,
+        // `secrets env`), so a high-security secret can NEVER be used here. Surface
+        // a clear, actionable error pointing at the proxy instead of a raw failure.
+        if (err?.code === "high_security_denied") {
+          firstFailure ??= new Error(
+            `Secret '${key}' is high-security and cannot be injected locally — it can only be used through the HQ secret proxy, which keeps the plaintext server-side.`,
+          );
+          continue;
+        }
+        const reason =
+          err?.code === "not_found"
+            ? "Secret not found"
+            : err?.code === "forbidden"
+              ? err.message ?? "No read permission"
+              : err?.message ?? err?.code ?? "not returned by vault";
+        firstFailure ??= new Error(`Failed to fetch secret '${key}': ${reason}`);
       }
-      const cacheTtlMs = normalizeCacheTtlMs(s.cacheTtlMs);
-      if (cacheTtlMs > 0) {
-        writeCache(companyUid, s.name, s.value, cacheTtlMs);
+      if (firstFailure) {
+        throw firstFailure;
       }
-      resolved.set(s.name, s.value);
     }
 
-    const errorsByName = new Map<string, { code: string; message?: string }>();
-    for (const e of data.errors ?? []) {
-      errorsByName.set(e.name, { code: e.code, message: e.message });
-    }
-    // Any requested key in this chunk the server did not return is a per-key
-    // failure — surface it with the same prefix the single-GET path used so
-    // callers (and scripts grepping stderr) see no behavior change.
-    for (const key of chunk) {
-      if (resolved.has(key)) continue;
-      const err = errorsByName.get(key);
-      // High-security ("nuclear") secret: the server refuses to vend it on the
-      // local-injection (batch-load) path — per-name code `high_security_denied`,
-      // no plaintext returned. Every caller of loadRevealedSecrets injects or
-      // prints the plaintext locally (`secrets get --reveal`, `secrets exec`,
-      // `secrets env`), so a high-security secret can NEVER be used here. Surface
-      // a clear, actionable error pointing at the proxy instead of a raw failure.
-      if (err?.code === "high_security_denied") {
-        throw new Error(
-          `Secret '${key}' is high-security and cannot be injected locally — it can only be used through the HQ secret proxy, which keeps the plaintext server-side.`,
-        );
-      }
-      const reason =
-        err?.code === "not_found"
-          ? "Secret not found"
-          : err?.code === "forbidden"
-            ? err.message ?? "No read permission"
-            : err?.message ?? err?.code ?? "not returned by vault";
-      throw new Error(`Failed to fetch secret '${key}': ${reason}`);
+    return resolved;
+  } catch (err) {
+    // A transport failure, stale session, malformed response, or a later chunk
+    // failure must not leave values written by this attempted operation available
+    // to offline cache readers. Evict the whole request before failing closed.
+    for (const key of requested) {
+      removeCacheEntry(companyUid, key);
     }
+    throw err;
   }
-
-  return resolved;
 }
 
 export function registerSecretsCommand(program: Command): void {
@@ -1228,6 +1335,7 @@ export function registerSecretsCommand(program: Command): void {
         }
 
         const data = (await res.json().catch(() => ({}))) as SecretPolicyResponse;
+        removeCacheEntry(companyUid, secretPath);
         console.log(chalk.green(`Policy updated for '${secretPath}'.`));
         renderPolicySummary(
           normalizePolicyRecord(
@@ -1302,6 +1410,7 @@ export function registerSecretsCommand(program: Command): void {
           process.exit(1);
         }
 
+        removeCacheEntry(companyUid, secretPath);
         console.log(chalk.green(`Approved script '${opts.id}' for '${secretPath}'.`));
       } catch (err) {
         console.error(
@@ -1345,6 +1454,7 @@ export function registerSecretsCommand(program: Command): void {
           process.exit(1);
         }
 
+        removeCacheEntry(companyUid, secretPath);
         console.log(chalk.green(`Revoked script '${opts.id}' for '${secretPath}'.`));
       } catch (err) {
         console.error(
@@ -1505,9 +1615,18 @@ export function registerSecretsCommand(program: Command): void {
         renderSandboxJobResult(job, keys);
         const exitCode = typeof job.exitCode === "number" ? job.exitCode : undefined;
         if (job.success === false || (exitCode !== undefined && exitCode !== 0) || job.status === "failed") {
-          const code = exitCode && exitCode !== 0 ? exitCode : 1;
-          console.error(chalk.red(`Sandbox command failed with exit code ${code}.`));
-          process.exit(code);
+          if (exitCode !== undefined && exitCode !== 0) {
+            console.error(chalk.red(`Sandbox command failed with exit code ${exitCode}.`));
+            process.exit(exitCode);
+          }
+          console.error(
+            chalk.red(
+              job.error !== undefined
+                ? scrubSandboxOutput(job.error, keys)
+                : "Sandbox execution failed before the command produced an exit code.",
+            ),
+          );
+          process.exit(1);
         }
       } catch (err) {
         console.error(
@@ -1523,8 +1642,12 @@ export function registerSecretsCommand(program: Command): void {
     .description("Run a command with secrets injected as env vars")
     .requiredOption("--only <keys>", "Secret names to inject (comma-separated; may be repeated) (required)", collectSecretNames)
     .option("--script <path>", "Attach local script identity for script-locked secrets")
+    .option("--script-id <id>", "Stable script identifier approved by policy")
     .allowUnknownOption(true)
-    .action(async (_opts: { only: string[]; script?: string }, cmd: Command) => {
+    .action(async (
+      _opts: { only: string[]; script?: string; scriptId?: string },
+      cmd: Command,
+    ) => {
       try {
         const rawArgs = cmd.args;
         const dashIndex = process.argv.indexOf("--");
@@ -1552,7 +1675,7 @@ export function registerSecretsCommand(program: Command): void {
           token,
           companyUid,
           keys,
-          await buildSecretUsage("exec", _opts.script),
+          await buildSecretUsage("exec", _opts.script, _opts.scriptId),
         );
 
         const secretEnv: Record<string, string> = {};
@@ -1597,7 +1720,10 @@ export function registerSecretsCommand(program: Command): void {
     .description("Print 'export KEY=VALUE' lines suitable for: source <(hq secrets env --only K1,K2)")
     .requiredOption("--only <keys>", "Secret names to print (comma-separated; may be repeated) (required)", collectSecretNames)
     .option("--script <path>", "Attach local script identity for script-locked secrets")
-    .action(async (opts: { only: string[]; script?: string }) => {
+    .option("--script-id <id>", "Stable script identifier approved by policy")
+    .action(async (
+      opts: { only: string[]; script?: string; scriptId?: string },
+    ) => {
       try {
         const redact = process.stdout.isTTY;
         if (redact) {
@@ -1620,7 +1746,7 @@ export function registerSecretsCommand(program: Command): void {
           token,
           companyUid,
           keys,
-          await buildSecretUsage("env", opts.script),
+          await buildSecretUsage("env", opts.script, opts.scriptId),
         );
 
         for (const key of keys) {

package/src/run/hq-plugin.test.ts

@@ -9,20 +9,14 @@ import {
   type InstallHqPluginOpts,
   type PluginState,
 } from './hq-plugin.js';
+import { removeCacheEntry, writeCache } from '../utils/secrets-cache.js';
 
-// Prevent any test run from writing to ~/.hq/secrets-cache/. Each test uses a
-// unique uid (random suffix) so cross-test contamination in the in-memory store
-// is not possible even without clearing between tests.
+// Prevent any test run from writing to ~/.hq/secrets-cache/.
 vi.mock('../utils/secrets-cache.js', () => {
-  const store = new Map<string, string>();
   return {
     DEFAULT_SECRETS_CACHE_TTL_MS: 300000,
-    readCache: (uid: string, name: string): string | null =>
-      store.get(`${uid}\0${name}`) ?? null,
-    writeCache: (uid: string, name: string, value: string): void => {
-      store.set(`${uid}\0${name}`, value);
-    },
-    removeCacheEntry: (): void => {},
+    writeCache: vi.fn((): void => {}),
+    removeCacheEntry: vi.fn((): void => {}),
     clearAllCache: (): { removed: number } => ({ removed: 0 }),
   };
 });
@@ -30,6 +24,7 @@ vi.mock('../utils/secrets-cache.js', () => {
 let tmpDir: string;
 
 beforeEach(() => {
+  vi.clearAllMocks();
   tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'hq-plugin-test-'));
 });
 
@@ -102,6 +97,187 @@ describe('hq-plugin', () => {
     await graph.resolveEnvValues();
 
     expect(graph.getResolvedEnvObject().FOO).toBe('memory-only-value');
+    expect(removeCacheEntry).toHaveBeenCalledWith(uid, 'FOO');
+  });
+
+  it('controlled policy metadata overrides a malformed positive cache TTL', async () => {
+    const schemaPath = path.join(tmpDir, '.env.schema');
+    fs.writeFileSync(schemaPath, `# @hqCompany("test")\n\nFOO=hq()\n`);
+
+    const uid = `test-uid-${Math.random().toString(36).slice(2)}`;
+    const mocks = makeMocks({
+      resolveCompanyUid: async () => uid,
+      fetchBatch: async () => ({
+        secrets: [{
+          name: 'FOO',
+          value: 'memory-only-value',
+          tier: 'sensitive',
+          scriptLock: { mode: 'enforced' },
+          cacheTtlMs: 300000,
+        }],
+        errors: [],
+      }),
+    });
+
+    let state!: PluginState;
+    const graph = await internal.loadEnvGraph({
+      entryFilePaths: [schemaPath],
+      afterInit: async (g) => {
+        state = installHqPlugin(g, mocks);
+      },
+    });
+    await prewarmHqSecrets(graph, mocks, state);
+    await graph.resolveEnvValues();
+
+    expect(graph.getResolvedEnvObject().FOO).toBe('memory-only-value');
+    expect(writeCache).not.toHaveBeenCalled();
+    expect(removeCacheEntry).toHaveBeenCalledWith(uid, 'FOO');
+  });
+
+  it('fails closed and evicts cache when the server omits a requested secret', async () => {
+    const schemaPath = path.join(tmpDir, '.env.schema');
+    fs.writeFileSync(schemaPath, `# @hqCompany("test")\n\nFOO=hq()\n`);
+
+    const uid = `test-uid-${Math.random().toString(36).slice(2)}`;
+    const mocks = makeMocks({
+      resolveCompanyUid: async () => uid,
+      fetchBatch: async () => ({ secrets: [], errors: [] }),
+    });
+
+    let state!: PluginState;
+    const graph = await internal.loadEnvGraph({
+      entryFilePaths: [schemaPath],
+      afterInit: async (g) => {
+        state = installHqPlugin(g, mocks);
+      },
+    });
+    await prewarmHqSecrets(graph, mocks, state);
+    await graph.resolveEnvValues();
+
+    const fooErrors = (graph as any).configSchema.FOO.errors as Array<{
+      message: string;
+    }>;
+    expect(fooErrors.some((e) => e.message.includes('not returned by vault'))).toBe(true);
+    expect(removeCacheEntry).toHaveBeenCalledWith(uid, 'FOO');
+  });
+
+  it('fails closed and evicts cache when the server returns metadata without plaintext', async () => {
+    const schemaPath = path.join(tmpDir, '.env.schema');
+    fs.writeFileSync(schemaPath, `# @hqCompany("test")\n\nFOO=hq()\n`);
+
+    const uid = `test-uid-${Math.random().toString(36).slice(2)}`;
+    const mocks = makeMocks({
+      resolveCompanyUid: async () => uid,
+      fetchBatch: async () => ({
+        secrets: [{ name: 'FOO', cacheTtlMs: 0 }],
+        errors: [],
+      }),
+    });
+
+    let state!: PluginState;
+    const graph = await internal.loadEnvGraph({
+      entryFilePaths: [schemaPath],
+      afterInit: async (g) => {
+        state = installHqPlugin(g, mocks);
+      },
+    });
+    await prewarmHqSecrets(graph, mocks, state);
+    await graph.resolveEnvValues();
+
+    const fooErrors = (graph as any).configSchema.FOO.errors as Array<{
+      message: string;
+    }>;
+    expect(fooErrors.some((e) => e.message.includes('not returned by vault'))).toBe(true);
+    expect(removeCacheEntry).toHaveBeenCalledWith(uid, 'FOO');
+  });
+
+  it('evicts every requested cache entry when batch authorization throws', async () => {
+    const schemaPath = path.join(tmpDir, '.env.schema');
+    fs.writeFileSync(
+      schemaPath,
+      `# @hqCompany("test")\n\nFOO=hq()\nBAR=hq()\n`,
+    );
+
+    const uid = `test-uid-${Math.random().toString(36).slice(2)}`;
+    const mocks = makeMocks({
+      resolveCompanyUid: async () => uid,
+      fetchBatch: async () => {
+        throw new Error('Forbidden: batch authorization denied');
+      },
+    });
+
+    let state!: PluginState;
+    const graph = await internal.loadEnvGraph({
+      entryFilePaths: [schemaPath],
+      afterInit: async (g) => {
+        state = installHqPlugin(g, mocks);
+      },
+    });
+
+    await expect(prewarmHqSecrets(graph, mocks, state)).rejects.toThrow(
+      'Forbidden: batch authorization denied',
+    );
+    expect(removeCacheEntry).toHaveBeenCalledWith(uid, 'FOO');
+    expect(removeCacheEntry).toHaveBeenCalledWith(uid, 'BAR');
+  });
+
+  it('rejects mixed success/error rows, clears memory, and evicts cache', async () => {
+    const schemaPath = path.join(tmpDir, '.env.schema');
+    fs.writeFileSync(schemaPath, `# @hqCompany("test")\n\nFOO=hq()\n`);
+
+    const uid = `test-uid-${Math.random().toString(36).slice(2)}`;
+    const mocks = makeMocks({
+      resolveCompanyUid: async () => uid,
+      fetchBatch: async () => ({
+        secrets: [{ name: 'FOO', value: 'sentinel-secret-value' }],
+        errors: [{ name: 'FOO', code: 'forbidden', message: 'Denied' }],
+      }),
+    });
+
+    let state!: PluginState;
+    const graph = await internal.loadEnvGraph({
+      entryFilePaths: [schemaPath],
+      afterInit: async (g) => {
+        state = installHqPlugin(g, mocks);
+      },
+    });
+
+    await expect(prewarmHqSecrets(graph, mocks, state)).rejects.toThrow(
+      'Invalid secret load response from vault',
+    );
+    expect(state.loadedSecretsByName.size).toBe(0);
+    expect(removeCacheEntry).toHaveBeenCalledWith(uid, 'FOO');
+  });
+
+  it('rejects malformed response envelopes and evicts every requested entry', async () => {
+    const schemaPath = path.join(tmpDir, '.env.schema');
+    fs.writeFileSync(
+      schemaPath,
+      `# @hqCompany("test")\n\nFOO=hq()\nBAR=hq()\n`,
+    );
+
+    const uid = `test-uid-${Math.random().toString(36).slice(2)}`;
+    const mocks = makeMocks({
+      resolveCompanyUid: async () => uid,
+      fetchBatch: async () => ({
+        secrets: [],
+        errors: undefined as unknown as [],
+      }),
+    });
+
+    let state!: PluginState;
+    const graph = await internal.loadEnvGraph({
+      entryFilePaths: [schemaPath],
+      afterInit: async (g) => {
+        state = installHqPlugin(g, mocks);
+      },
+    });
+
+    await expect(prewarmHqSecrets(graph, mocks, state)).rejects.toThrow(
+      'Invalid secret load response from vault',
+    );
+    expect(removeCacheEntry).toHaveBeenCalledWith(uid, 'FOO');
+    expect(removeCacheEntry).toHaveBeenCalledWith(uid, 'BAR');
   });
 
   it('missing-company-error: throws when no @hqCompany and no companyOverride', async () => {