@indigoai-us/hq-cli 5.75.0 → 5.77.0

package/dist/commands/pack-install.d.ts

@@ -305,26 +305,21 @@ export declare function renderMcpServerLine(payloadDir: string, item: string): s
  */
 export declare function confirmMcp(pkg: PackManifest, payloadDir: string, allowMcp: boolean): Promise<boolean>;
 /**
- * Build the install-time {@link SecretResolver} bound to the HQ vault's local
- * secrets-cache (`~/.hq/secrets-cache/<scope>/<NAME>`, AES-256-GCM, 0600, TTL'd).
+ * Build an install-time {@link SecretResolver} from a fresh server authorization
+ * decision. The encrypted cache may identify one unambiguous scope, but its
+ * plaintext is never trusted or read to register an MCP server.
  *
- * Active-company resolution at install time is INDIRECT by design: `hq install`
- * has no `--company` flag and runs OFFLINE (no token), so we cannot resolve a
- * single active company UID the way `hq run` / `hq secrets` do (via
- * `getEntityUid` over the network). Instead we probe EVERY cached scope
- * (`cmp_*`/`prs_*` — whichever has minted secrets locally) for the requested
- * name and return the first hit. This naturally resolves to whichever company
- * context just provisioned the secret (e.g. the one `/connect-shopify` minted
- * `VYG_API_KEY` under), without guessing, and works whether the vault scoped the
- * key under a company or person entity.
+ * With `--company`, the caller-selected company is resolved normally. Without
+ * it, exactly one cache scope may identify the intended company/person context;
+ * multiple scopes are ambiguous and fail closed. The requested names are then
+ * loaded through the same server-authorized endpoint as exec/env/run. Offline,
+ * expired-session, forbidden, not-found, script-lock, and malformed-response
+ * outcomes all produce an empty resolver, so MCP registration is deferred.
  *
- * On MISS across all scopes (no cache, expired TTL, or key never minted) it
- * returns `null` — which is exactly what {@link registerMcpServers}'s
- * unresolvable-secret path keys off to defer that server gracefully. With no
- * cached scopes at all (`listSecretCacheScopes()` → `[]`) it simply returns
- * `null` for every name, the desired graceful-deferral behavior.
+ * The returned synchronous resolver contains only values from that fresh
+ * authorization response. No cached value is a fallback.
  */
-export declare function makeInstallSecretResolver(): SecretResolver;
+export declare function makeInstallSecretResolver(secretNames: string[], company?: string): Promise<SecretResolver>;
 /**
  * Install the fetched payload to `<hqRoot>/core/packages/<pkg.name>/` (HQ
  * v12+ layout). The HQ template (`hq-core` / `hq-core-staging`) ships
@@ -381,6 +376,8 @@ export declare function runScanPackages(hqRoot: string, opts?: {
 }): void;
 export interface InstallPackOptions {
     allowHooks?: boolean;
+    /** Company context for online authorization of install-time MCP secret refs. */
+    company?: string;
     /**
      * US-010 install-time MCP trust prompt bypass (CI/ambient-trust). Mirrors
      * `allowHooks`: when set, `confirmMcp` skips the prompt and prints a yellow

package/dist/commands/pack-install.js

@@ -49,9 +49,11 @@ import { findHqRoot } from '../utils/manifest.js';
 import { readHqVersion, routeContribution, listInstalledPacks } from '../utils/pack-contributions.js';
 import { CONTRIBUTION_TABLE, payloadFor } from '../utils/contribution-table.js';
 import { safeExtractTarball } from './safe-extract.js';
-import { vaultApiFetchPublic } from '../utils/vault-api.js';
+import { getCompanyUid, vaultApiFetchPublic } from '../utils/vault-api.js';
+import { ensureCognitoToken } from '../utils/cognito-session.js';
 import { redactSecrets, SECRET_REDACTION, registerMcpServers, McpManifestError, } from './mcp-registration.js';
-import { readCache, listSecretCacheScopes } from '../utils/secrets-cache.js';
+import { listSecretCacheScopes } from '../utils/secrets-cache.js';
+import { loadRevealedSecrets } from './secrets.js';
 const PACK_UPDATE_CACHE_TTL_MS = 12 * 60 * 60 * 1000;
 const PACK_UPDATE_FETCH_TIMEOUT_MS = 3_000;
 const gitLsRemoteMemo = new Map();
@@ -1349,34 +1351,56 @@ function evalConditional(expr) {
 // key) still SUCCEEDS, skipping only the server whose secret is not yet present.
 // ---------------------------------------------------------------------------
 /**
- * Build the install-time {@link SecretResolver} bound to the HQ vault's local
- * secrets-cache (`~/.hq/secrets-cache/<scope>/<NAME>`, AES-256-GCM, 0600, TTL'd).
+ * Build an install-time {@link SecretResolver} from a fresh server authorization
+ * decision. The encrypted cache may identify one unambiguous scope, but its
+ * plaintext is never trusted or read to register an MCP server.
  *
- * Active-company resolution at install time is INDIRECT by design: `hq install`
- * has no `--company` flag and runs OFFLINE (no token), so we cannot resolve a
- * single active company UID the way `hq run` / `hq secrets` do (via
- * `getEntityUid` over the network). Instead we probe EVERY cached scope
- * (`cmp_*`/`prs_*` — whichever has minted secrets locally) for the requested
- * name and return the first hit. This naturally resolves to whichever company
- * context just provisioned the secret (e.g. the one `/connect-shopify` minted
- * `VYG_API_KEY` under), without guessing, and works whether the vault scoped the
- * key under a company or person entity.
+ * With `--company`, the caller-selected company is resolved normally. Without
+ * it, exactly one cache scope may identify the intended company/person context;
+ * multiple scopes are ambiguous and fail closed. The requested names are then
+ * loaded through the same server-authorized endpoint as exec/env/run. Offline,
+ * expired-session, forbidden, not-found, script-lock, and malformed-response
+ * outcomes all produce an empty resolver, so MCP registration is deferred.
  *
- * On MISS across all scopes (no cache, expired TTL, or key never minted) it
- * returns `null` — which is exactly what {@link registerMcpServers}'s
- * unresolvable-secret path keys off to defer that server gracefully. With no
- * cached scopes at all (`listSecretCacheScopes()` → `[]`) it simply returns
- * `null` for every name, the desired graceful-deferral behavior.
+ * The returned synchronous resolver contains only values from that fresh
+ * authorization response. No cached value is a fallback.
  */
-export function makeInstallSecretResolver() {
-    return (name) => {
-        for (const scope of listSecretCacheScopes()) {
-            const value = readCache(scope, name);
-            if (value !== null)
-                return value;
+export async function makeInstallSecretResolver(secretNames, company) {
+    const names = [...new Set(secretNames)];
+    if (names.length === 0)
+        return () => null;
+    try {
+        const token = await ensureCognitoToken({ interactive: false });
+        let scopeUid;
+        if (company) {
+            scopeUid = await getCompanyUid(token, company);
         }
-        return null;
-    };
+        else {
+            const scopes = listSecretCacheScopes();
+            if (scopes.length !== 1)
+                return () => null;
+            [scopeUid] = scopes;
+        }
+        const authorized = await loadRevealedSecrets(token, scopeUid, names);
+        return (name) => authorized.get(name) ?? null;
+    }
+    catch {
+        return () => null;
+    }
+}
+const INSTALL_SECRET_REF_RE = /\$\{secret:([A-Z][A-Z0-9_]*(?:\/[A-Z][A-Z0-9_]+)*)\}/g;
+function collectManifestSecretNames(manifest) {
+    const names = new Set();
+    for (const value of [
+        ...Object.values(manifest.headers ?? {}),
+        ...Object.values(manifest.env ?? {}),
+    ]) {
+        INSTALL_SECRET_REF_RE.lastIndex = 0;
+        for (let match = INSTALL_SECRET_REF_RE.exec(value); match; match = INSTALL_SECRET_REF_RE.exec(value)) {
+            names.add(match[1]);
+        }
+    }
+    return [...names];
 }
 /**
  * Load + shape-validate + parse a pack's per-server MCP manifest from disk.
@@ -1424,13 +1448,13 @@ function extractDeferredSecretName(message) {
  *   - ANY OTHER error               → RE-THROW (abort install). Only the
  *     unresolvable-secret case is swallowed.
  */
-function wireMcpServers(pkg, destDir) {
-    const resolveSecret = makeInstallSecretResolver();
+async function wireMcpServers(pkg, destDir, company) {
     const loadManifest = (name) => loadMcpManifestFrom(destDir, name);
     const registered = [];
     const skipped = [];
     for (const name of pkg.contributes.mcp ?? []) {
         try {
+            const resolveSecret = await makeInstallSecretResolver(collectManifestSecretNames(loadManifest(name)), company);
             // Per-server call: registerMcpServers throws on the FIRST unresolvable
             // secret, so calling it one name at a time lets us catch + continue.
             registerMcpServers(pkg.name, [name], { loadManifest, resolveSecret });
@@ -1676,7 +1700,7 @@ export async function installPack(source, opts = {}) {
         // Per-server secret-deferral keeps a fresh install (key not yet minted) at
         // exit 0, deferring only the unresolvable server (see wireMcpServers).
         if (Array.isArray(pkg.contributes.mcp) && pkg.contributes.mcp.length > 0) {
-            const { registered, skipped } = wireMcpServers(pkg, destDir);
+            const { registered, skipped } = await wireMcpServers(pkg, destDir, opts.company);
             // One-line summary (server NAMES only — never resolved secret VALUES).
             say(chalk.dim(`  MCP servers: registered [${registered.join(', ')}]; ` +
                 `skipped [${skipped.join(', ')}].`));

package/dist/commands/pkg-install.js

@@ -29,7 +29,7 @@ export function registerPackageInstallCommand(parent) {
         .command('install <source>')
         .description('Install a package. Sources: bare slug (registry, Cognito-gated), ' +
         '@scope/name[@ver] (npm pack), git URL[#ref], or local path.')
-        .option('--company <co>', 'Scope the package to a specific company (registry flow only)')
+        .option('--company <co>', 'Scope package secret authorization to a specific company')
         .option('--allow-hooks', 'Skip the hooks confirmation prompt (content-pack flow)')
         .option('--allow-mcp', 'Skip the MCP server confirmation prompt (content-pack flow)')
         .option('--branch', 'Follow a ref instead of SHA-pinning (git content-pack flow)')
@@ -37,6 +37,7 @@ export function registerPackageInstallCommand(parent) {
         try {
             if (sourceMatchesPackPattern(source)) {
                 await installPack(source, {
+                    company: opts.company,
                     allowHooks: opts.allowHooks,
                     allowMcp: opts.allowMcp,
                     followBranch: opts.branch,
@@ -48,6 +49,7 @@ export function registerPackageInstallCommand(parent) {
                 // would fail at registry setup. Resolve it through the marketplace
                 // listings transport — the live install path — instead.
                 await installPack(`${MARKETPLACE_PREFIX}${source}`, {
+                    company: opts.company,
                     allowHooks: opts.allowHooks,
                     allowMcp: opts.allowMcp,
                     followBranch: opts.branch,

package/dist/commands/run.d.ts

@@ -1,3 +1,5 @@
 import { Command } from 'commander';
+import type { SecretUsage } from './secrets.js';
+export declare function buildRunUsage(scriptPath?: string, scriptId?: string): Promise<SecretUsage | undefined>;
 export declare function registerRunCommand(program: Command): void;
 //# sourceMappingURL=run.d.ts.map

package/dist/commands/run.js

@@ -7,7 +7,11 @@ import { computeSha256 } from '../utils/integrity.js';
 import { vaultApiFetch, getCompanyUid } from '../utils/vault-api.js';
 import { discoverSchemas } from '../run/discover-schemas.js';
 import { installHqPlugin, prewarmHqSecrets } from '../run/hq-plugin.js';
-async function buildRunUsage(scriptPath) {
+const SECRET_LOAD_TIMEOUT_MS = 30_000;
+export async function buildRunUsage(scriptPath, scriptId) {
+    if (scriptId && !scriptPath) {
+        throw new Error('--script-id requires --script');
+    }
     if (!scriptPath) {
         return undefined;
     }
@@ -15,7 +19,7 @@ async function buildRunUsage(scriptPath) {
     return {
         channel: 'run',
         script: {
-            scriptId: resolvedPath,
+            scriptId: scriptId ?? resolvedPath,
             path: resolvedPath,
             sha256: await computeSha256(resolvedPath),
             attestationLevel: 'self-asserted-hash',
@@ -29,6 +33,7 @@ export function registerRunCommand(program) {
         .option('--company <slug>', 'Company slug (overrides @hqCompany in schema)')
         .option('--schema <path>', 'Explicit schema path (skips walk-up discovery)')
         .option('--script <path>', 'Attach local script identity for script-locked secrets')
+        .option('--script-id <id>', 'Stable script identifier approved by policy')
         .option('--check', 'Resolve schema and validate vars without executing the command')
         .allowUnknownOption(true)
         .action(async (opts) => {
@@ -68,13 +73,14 @@ export function registerRunCommand(program) {
             }
             const token = await ensureCognitoToken();
             const uid = await getCompanyUid(token, slug);
-            const usage = await buildRunUsage(opts.script);
+            const usage = await buildRunUsage(opts.script, opts.scriptId);
             const fetchBatch = async (companyUid, names, requestUsage) => {
                 const res = await vaultApiFetch({
                     token,
                     path: `/secrets/${encodeURIComponent(companyUid)}/load`,
                     method: 'POST',
                     body: requestUsage ? { names, usage: requestUsage } : { names },
+                    signal: AbortSignal.timeout(SECRET_LOAD_TIMEOUT_MS),
                 });
                 if (!res.ok) {
                     const body = await res.json().catch(() => ({}));

package/dist/commands/secrets.js

@@ -3,7 +3,7 @@ import * as readline from "node:readline";
 import { spawn } from "node:child_process";
 import * as nodePath from "node:path";
 import { ensureCognitoToken } from "../utils/cognito-session.js";
-import { DEFAULT_SECRETS_CACHE_TTL_MS, readCache, writeCache, removeCacheEntry, clearAllCache, } from "../utils/secrets-cache.js";
+import { DEFAULT_SECRETS_CACHE_TTL_MS, writeCache, removeCacheEntry, clearAllCache, } from "../utils/secrets-cache.js";
 import { computeSha256 } from "../utils/integrity.js";
 import { SECRET_NAME_PATTERN, GROUP_ID_PATTERN, EMAIL_PATTERN } from "./_patterns.js";
 import { describeSecretsScope, formatSecretSaved, formatSecretsListEmpty, formatSecretsListHeader, } from "./secrets-scope.js";
@@ -130,6 +130,7 @@ function promptSecretInteractively() {
 // large --only list is chunked client-side rather than 400'd whole by the
 // server (the legacy per-key GET path had no such cap).
 const MAX_BATCH_NAMES = 100;
+const SECRET_LOAD_TIMEOUT_MS = 30_000;
 function parseSecretAclPrincipal(principal) {
     const p = principal.trim();
     if (p === "@all") {
@@ -232,10 +233,23 @@ function normalizeSecretTier(tier) {
 function normalizeScriptLockMode(mode) {
     return mode === "enforced" ? "enforced" : "off";
 }
-function normalizeCacheTtlMs(cacheTtlMs) {
-    return typeof cacheTtlMs === "number"
-        ? cacheTtlMs
-        : DEFAULT_SECRETS_CACHE_TTL_MS;
+function normalizeCacheTtlMs(metadata) {
+    // Controlled rows must never reach the offline cache even if a mixed-version
+    // or malformed response carries a positive TTL. The server is authoritative
+    // for access, but the client still has enough policy metadata to fail safe.
+    if (metadata.tier === "sensitive" ||
+        metadata.tier === "nuclear" ||
+        metadata.scriptLock?.mode === "enforced") {
+        return 0;
+    }
+    if (metadata.cacheTtlMs === undefined) {
+        return DEFAULT_SECRETS_CACHE_TTL_MS;
+    }
+    return typeof metadata.cacheTtlMs === "number" &&
+        Number.isFinite(metadata.cacheTtlMs) &&
+        metadata.cacheTtlMs > 0
+        ? metadata.cacheTtlMs
+        : 0;
 }
 function extractApiMessage(body, fallback) {
     const message = typeof body.message === "string" ? body.message : undefined;
@@ -243,6 +257,9 @@ function extractApiMessage(body, fallback) {
     return message ?? error ?? fallback;
 }
 async function buildSecretUsage(channel, scriptPath, scriptId, attestationLevel = "self-asserted-hash") {
+    if (scriptId && !scriptPath) {
+        throw new Error("--script-id requires --script");
+    }
     if (!scriptPath) {
         return { channel };
     }
@@ -308,11 +325,25 @@ function renderSandboxJobResult(job, secretNames) {
 }
 function normalizePolicyRecord(secretPath, data) {
     const policy = data.policy ?? { path: secretPath };
-    const scripts = Array.isArray(policy.scripts)
-        ? policy.scripts
-        : Array.isArray(data.scripts)
-            ? data.scripts
-            : [];
+    const scripts = Array.isArray(policy.scriptLock?.approvedScripts)
+        ? policy.scriptLock.approvedScripts
+            .filter((script) => script !== null &&
+            typeof script === "object" &&
+            typeof script.scriptId === "string" &&
+            typeof script.path === "string" &&
+            typeof script.attestationLevel === "string" &&
+            !script.revokedAt)
+            .map((script) => ({
+            scriptId: script.scriptId,
+            scriptPath: script.path,
+            sha256: typeof script.sha256 === "string" ? script.sha256 : "",
+            attestationLevel: script.attestationLevel,
+        }))
+        : Array.isArray(policy.scripts)
+            ? policy.scripts.filter(isSecretPolicyScript)
+            : Array.isArray(data.scripts)
+                ? data.scripts.filter(isSecretPolicyScript)
+                : [];
     return {
         path: policy.path ?? secretPath,
         tier: normalizeSecretTier(policy.tier),
@@ -323,6 +354,15 @@ function normalizePolicyRecord(secretPath, data) {
         scripts,
     };
 }
+function isSecretPolicyScript(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const script = value;
+    return (typeof script.scriptId === "string" &&
+        typeof script.scriptPath === "string" &&
+        typeof script.sha256 === "string" &&
+        typeof script.attestationLevel === "string");
+}
 function renderPolicySummary(policy) {
     console.log(chalk.bold(`Policy: ${policy.path}`));
     console.log(`  Tier:          ${normalizeSecretTier(policy.tier)}`);
@@ -351,7 +391,7 @@ function renderPolicyScripts(scripts) {
             script.scriptId.padEnd(idWidth),
             script.scriptPath.padEnd(pathWidth),
             script.attestationLevel.padEnd(attestationWidth),
-            script.sha256,
+            script.sha256 || "-",
         ].join("  "));
     }
 }
@@ -370,84 +410,136 @@ function renderPolicyScripts(scripts) {
 // `env` through it stops those callers from emitting the warning while keeping
 // identical UX and error text.
 //
-// Cache-first (so warm keys cost no request), chunked at MAX_BATCH_NAMES, and
-// throws on the FIRST unresolved key with the same `Failed to fetch secret
-// '<k>': <reason>` shape the per-key GET path used — never swallows a failure.
+// Every value use through exec/env/reveal is server-authorized, including when
+// an encrypted disk-cache entry exists. The cache remains write-through for
+// explicitly offline install-time consumers; these commands never trust it as
+// an authorization decision. This means a policy, ACL, tier, or script-approval
+// change takes effect on their next use even though there is no push revocation.
+// Requests are chunked at MAX_BATCH_NAMES and throw on the FIRST unresolved key
+// with the same `Failed to fetch secret '<k>': <reason>` shape the per-key GET
+// path used — never swallows a failure.
 export async function loadRevealedSecrets(token, companyUid, keys, usage) {
     const resolved = new Map();
-    const missing = [];
-    for (const key of keys) {
-        const cached = readCache(companyUid, key);
-        if (cached !== null) {
-            resolved.set(key, cached);
-        }
-        else if (!missing.includes(key)) {
-            missing.push(key);
-        }
-    }
-    for (let i = 0; i < missing.length; i += MAX_BATCH_NAMES) {
-        const chunk = missing.slice(i, i + MAX_BATCH_NAMES);
-        const res = await vaultApiFetch({
-            token,
-            path: `/secrets/${encodeURIComponent(companyUid)}/load`,
-            method: "POST",
-            body: usage ? { names: chunk, usage } : { names: chunk },
-        });
-        if (!res.ok) {
-            const body = (await res.json().catch(() => ({})));
-            const message = extractApiMessage(body, res.statusText);
-            // High-security ("nuclear") refusal surfaced at the batch level (rather
-            // than per-name): point the caller at the proxy and never leak plaintext.
-            if (body.code === "high_security_denied" || body.highSecurity === true) {
-                throw new Error("A requested secret is high-security and cannot be injected locally — it can only be used through the HQ secret proxy, which keeps the plaintext server-side.");
-            }
-            if (res.status >= 400 &&
-                res.status < 500 &&
-                typeof body.code === "string") {
-                throw new Error(message);
-            }
-            throw new Error(`Failed to batch-load secrets: ${message}`);
-        }
-        const data = (await res.json());
-        for (const s of data.secrets ?? []) {
-            if (s.value == null) {
-                throw new Error(`Secret '${s.name}' has no value (reveal may not be permitted).`);
+    const requested = [...new Set(keys)];
+    try {
+        for (let i = 0; i < requested.length; i += MAX_BATCH_NAMES) {
+            const chunk = requested.slice(i, i + MAX_BATCH_NAMES);
+            const chunkNames = new Set(chunk);
+            const res = await vaultApiFetch({
+                token,
+                path: `/secrets/${encodeURIComponent(companyUid)}/load`,
+                method: "POST",
+                body: usage ? { names: chunk, usage } : { names: chunk },
+                signal: AbortSignal.timeout(SECRET_LOAD_TIMEOUT_MS),
+            });
+            if (!res.ok) {
+                const body = (await res.json().catch(() => ({})));
+                const message = extractApiMessage(body, res.statusText);
+                // High-security ("nuclear") refusal surfaced at the batch level (rather
+                // than per-name): point the caller at the proxy and never leak plaintext.
+                if (body.code === "high_security_denied" || body.highSecurity === true) {
+                    throw new Error("A requested secret is high-security and cannot be injected locally — it can only be used through the HQ secret proxy, which keeps the plaintext server-side.");
+                }
+                if (res.status >= 400 &&
+                    res.status < 500 &&
+                    typeof body.code === "string") {
+                    throw new Error(message);
+                }
+                throw new Error(`Failed to batch-load secrets: ${message}`);
             }
-            const cacheTtlMs = normalizeCacheTtlMs(s.cacheTtlMs);
-            if (cacheTtlMs > 0) {
-                writeCache(companyUid, s.name, s.value, cacheTtlMs);
+            const data = (await res.json());
+            if (!Array.isArray(data.secrets) || !Array.isArray(data.errors)) {
+                throw new Error("Invalid secret load response from vault");
+            }
+            const errorsByName = new Map();
+            const seenNames = new Set();
+            for (const rawSecret of data.secrets) {
+                if (!rawSecret || typeof rawSecret !== "object") {
+                    throw new Error("Invalid secret load response from vault");
+                }
+                const s = rawSecret;
+                if (typeof s.name !== "string" ||
+                    !chunkNames.has(s.name) ||
+                    seenNames.has(s.name) ||
+                    (s.value != null && typeof s.value !== "string")) {
+                    throw new Error("Invalid secret load response from vault");
+                }
+                seenNames.add(s.name);
+                if (s.value == null) {
+                    errorsByName.set(s.name, {
+                        code: "not_returned",
+                        message: `Secret '${s.name}' has no value (reveal may not be permitted).`,
+                    });
+                    removeCacheEntry(companyUid, s.name);
+                    continue;
+                }
+                const cacheTtlMs = normalizeCacheTtlMs(s);
+                if (cacheTtlMs > 0) {
+                    writeCache(companyUid, s.name, s.value, cacheTtlMs);
+                }
+                else {
+                    removeCacheEntry(companyUid, s.name);
+                }
+                resolved.set(s.name, s.value);
+            }
+            for (const rawError of data.errors) {
+                if (!rawError || typeof rawError !== "object") {
+                    throw new Error("Invalid secret load response from vault");
+                }
+                const e = rawError;
+                if (typeof e.name !== "string" ||
+                    !chunkNames.has(e.name) ||
+                    seenNames.has(e.name) ||
+                    typeof e.code !== "string" ||
+                    (e.message !== undefined && typeof e.message !== "string")) {
+                    throw new Error("Invalid secret load response from vault");
+                }
+                seenNames.add(e.name);
+                errorsByName.set(e.name, { code: e.code, message: e.message });
+                resolved.delete(e.name);
+                removeCacheEntry(companyUid, e.name);
+            }
+            // Any requested key in this chunk the server did not return is a per-key
+            // failure — surface it with the same prefix the single-GET path used so
+            // callers (and scripts grepping stderr) see no behavior change.
+            let firstFailure = null;
+            for (const key of chunk) {
+                if (resolved.has(key))
+                    continue;
+                removeCacheEntry(companyUid, key);
+                const err = errorsByName.get(key);
+                // High-security ("nuclear") secret: the server refuses to vend it on the
+                // local-injection (batch-load) path — per-name code `high_security_denied`,
+                // no plaintext returned. Every caller of loadRevealedSecrets injects or
+                // prints the plaintext locally (`secrets get --reveal`, `secrets exec`,
+                // `secrets env`), so a high-security secret can NEVER be used here. Surface
+                // a clear, actionable error pointing at the proxy instead of a raw failure.
+                if (err?.code === "high_security_denied") {
+                    firstFailure ??= new Error(`Secret '${key}' is high-security and cannot be injected locally — it can only be used through the HQ secret proxy, which keeps the plaintext server-side.`);
+                    continue;
+                }
+                const reason = err?.code === "not_found"
+                    ? "Secret not found"
+                    : err?.code === "forbidden"
+                        ? err.message ?? "No read permission"
+                        : err?.message ?? err?.code ?? "not returned by vault";
+                firstFailure ??= new Error(`Failed to fetch secret '${key}': ${reason}`);
+            }
+            if (firstFailure) {
+                throw firstFailure;
             }
-            resolved.set(s.name, s.value);
-        }
-        const errorsByName = new Map();
-        for (const e of data.errors ?? []) {
-            errorsByName.set(e.name, { code: e.code, message: e.message });
         }
-        // Any requested key in this chunk the server did not return is a per-key
-        // failure — surface it with the same prefix the single-GET path used so
-        // callers (and scripts grepping stderr) see no behavior change.
-        for (const key of chunk) {
-            if (resolved.has(key))
-                continue;
-            const err = errorsByName.get(key);
-            // High-security ("nuclear") secret: the server refuses to vend it on the
-            // local-injection (batch-load) path — per-name code `high_security_denied`,
-            // no plaintext returned. Every caller of loadRevealedSecrets injects or
-            // prints the plaintext locally (`secrets get --reveal`, `secrets exec`,
-            // `secrets env`), so a high-security secret can NEVER be used here. Surface
-            // a clear, actionable error pointing at the proxy instead of a raw failure.
-            if (err?.code === "high_security_denied") {
-                throw new Error(`Secret '${key}' is high-security and cannot be injected locally — it can only be used through the HQ secret proxy, which keeps the plaintext server-side.`);
-            }
-            const reason = err?.code === "not_found"
-                ? "Secret not found"
-                : err?.code === "forbidden"
-                    ? err.message ?? "No read permission"
-                    : err?.message ?? err?.code ?? "not returned by vault";
-            throw new Error(`Failed to fetch secret '${key}': ${reason}`);
+        return resolved;
+    }
+    catch (err) {
+        // A transport failure, stale session, malformed response, or a later chunk
+        // failure must not leave values written by this attempted operation available
+        // to offline cache readers. Evict the whole request before failing closed.
+        for (const key of requested) {
+            removeCacheEntry(companyUid, key);
         }
+        throw err;
     }
-    return resolved;
 }
 export function registerSecretsCommand(program) {
     const secrets = program
@@ -846,6 +938,7 @@ export function registerSecretsCommand(program) {
                 process.exit(1);
             }
             const data = (await res.json().catch(() => ({})));
+            removeCacheEntry(companyUid, secretPath);
             console.log(chalk.green(`Policy updated for '${secretPath}'.`));
             renderPolicySummary(normalizePolicyRecord(secretPath, data.policy ? data : { policy: { path: secretPath, tier, scriptLock } }));
         }
@@ -890,6 +983,7 @@ export function registerSecretsCommand(program) {
                 console.error(chalk.red(`Failed to approve script: ${extractApiMessage(body, res.statusText)}`));
                 process.exit(1);
             }
+            removeCacheEntry(companyUid, secretPath);
             console.log(chalk.green(`Approved script '${opts.id}' for '${secretPath}'.`));
         }
         catch (err) {
@@ -921,6 +1015,7 @@ export function registerSecretsCommand(program) {
                 console.error(chalk.red(`Failed to revoke script: ${extractApiMessage(body, res.statusText)}`));
                 process.exit(1);
             }
+            removeCacheEntry(companyUid, secretPath);
             console.log(chalk.green(`Revoked script '${opts.id}' for '${secretPath}'.`));
         }
         catch (err) {
@@ -1044,9 +1139,14 @@ export function registerSecretsCommand(program) {
             renderSandboxJobResult(job, keys);
             const exitCode = typeof job.exitCode === "number" ? job.exitCode : undefined;
             if (job.success === false || (exitCode !== undefined && exitCode !== 0) || job.status === "failed") {
-                const code = exitCode && exitCode !== 0 ? exitCode : 1;
-                console.error(chalk.red(`Sandbox command failed with exit code ${code}.`));
-                process.exit(code);
+                if (exitCode !== undefined && exitCode !== 0) {
+                    console.error(chalk.red(`Sandbox command failed with exit code ${exitCode}.`));
+                    process.exit(exitCode);
+                }
+                console.error(chalk.red(job.error !== undefined
+                    ? scrubSandboxOutput(job.error, keys)
+                    : "Sandbox execution failed before the command produced an exit code."));
+                process.exit(1);
             }
         }
         catch (err) {
@@ -1059,6 +1159,7 @@ export function registerSecretsCommand(program) {
         .description("Run a command with secrets injected as env vars")
         .requiredOption("--only <keys>", "Secret names to inject (comma-separated; may be repeated) (required)", collectSecretNames)
         .option("--script <path>", "Attach local script identity for script-locked secrets")
+        .option("--script-id <id>", "Stable script identifier approved by policy")
         .allowUnknownOption(true)
         .action(async (_opts, cmd) => {
         try {
@@ -1078,7 +1179,7 @@ export function registerSecretsCommand(program) {
             const keys = parseSecretNameList(_opts.only);
             const token = await ensureCognitoToken();
             const companyUid = await getEntityUid(token, scopeOpts(secrets.opts()));
-            const revealed = await loadRevealedSecrets(token, companyUid, keys, await buildSecretUsage("exec", _opts.script));
+            const revealed = await loadRevealedSecrets(token, companyUid, keys, await buildSecretUsage("exec", _opts.script, _opts.scriptId));
             const secretEnv = {};
             for (const key of keys) {
                 const value = revealed.get(key);
@@ -1115,6 +1216,7 @@ export function registerSecretsCommand(program) {
         .description("Print 'export KEY=VALUE' lines suitable for: source <(hq secrets env --only K1,K2)")
         .requiredOption("--only <keys>", "Secret names to print (comma-separated; may be repeated) (required)", collectSecretNames)
         .option("--script <path>", "Attach local script identity for script-locked secrets")
+        .option("--script-id <id>", "Stable script identifier approved by policy")
         .action(async (opts) => {
         try {
             const redact = process.stdout.isTTY;
@@ -1124,7 +1226,7 @@ export function registerSecretsCommand(program) {
             const keys = parseSecretNameList(opts.only);
             const token = await ensureCognitoToken();
             const companyUid = await getEntityUid(token, scopeOpts(secrets.opts()));
-            const revealed = await loadRevealedSecrets(token, companyUid, keys, await buildSecretUsage("env", opts.script));
+            const revealed = await loadRevealedSecrets(token, companyUid, keys, await buildSecretUsage("env", opts.script, opts.scriptId));
             for (const key of keys) {
                 const value = revealed.get(key);
                 // loadRevealedSecrets throws on any unresolved key, so a miss here is