@indigoai-us/hq-cli 5.77.14 → 5.78.0

package/src/commands/secrets.ts

@@ -1,2249 +0,0 @@
-import { Command } from "commander";
-import chalk from "chalk";
-import * as readline from "node:readline";
-import { spawn } from "node:child_process";
-import * as nodePath from "node:path";
-import { ensureCognitoToken } from "../utils/cognito-session.js";
-import {
-  DEFAULT_SECRETS_CACHE_TTL_MS,
-  writeCache,
-  removeCacheEntry,
-  clearAllCache,
-} from "../utils/secrets-cache.js";
-import { computeSha256 } from "../utils/integrity.js";
-import { SECRET_NAME_PATTERN, GROUP_ID_PATTERN, EMAIL_PATTERN } from "./_patterns.js";
-import {
-  describeSecretsScope,
-  formatSecretSaved,
-  formatSecretsListEmpty,
-  formatSecretsListHeader,
-} from "./secrets-scope.js";
-import {
-  vaultApiFetch,
-  getCompanyUid,
-  getEntityUid,
-} from "../utils/vault-api.js";
-import {
-  HQ_API_KEY_PREFIX,
-  assertCognitoOnlyCommand,
-  resolveVaultCredential,
-} from "../utils/resolve-vault-credential.js";
-import {
-  SandboxRunnerClient,
-  type SandboxRunnerJob,
-} from "../utils/sandbox-runner-client.js";
-export type { VaultApiOptions } from "../utils/vault-api.js";
-export { vaultApiFetch, getCompanyUid, getEntityUid };
-
-/** Cognito session for secrets commands that do not support HQ_API_KEY. */
-async function requireCognitoTokenForSecrets(
-  commandLabel: string,
-): Promise<string> {
-  assertCognitoOnlyCommand(commandLabel);
-  return ensureCognitoToken();
-}
-
-interface SecretsScopeOpts {
-  company?: string;
-  personal?: boolean;
-}
-
-function scopeOpts(opts: SecretsScopeOpts): {
-  personal: boolean;
-  companySlug: string | undefined;
-} {
-  if (opts.personal && opts.company) {
-    console.error(
-      chalk.red("Error: --personal cannot be combined with --company."),
-    );
-    process.exit(1);
-  }
-  return { personal: !!opts.personal, companySlug: opts.company };
-}
-
-function rejectIfPersonal(opts: SecretsScopeOpts, action: string): void {
-  if (opts.personal) {
-    console.error(
-      chalk.red(`Error: ${action} is not supported with --personal.`),
-    );
-    process.exit(1);
-  }
-}
-
-function shellSingleQuote(value: string): string {
-  return "'" + value.replace(/'/g, "'\\''") + "'";
-}
-
-// API Gateway v2 URL-decodes `%2F` before route matching, so a full-name
-// `encodeURIComponent` would collapse structural `/` separators into a single
-// segment the `/name/{proxy+}` route can't match.
-function buildSecretNamePath(companyUid: string, name: string): string {
-  const encodedName = name
-    .split("/")
-    .map(encodeURIComponent)
-    .join("/");
-  return `/secrets/${encodeURIComponent(companyUid)}/name/${encodedName}`;
-}
-
-function parseDuration(input: string): number | null {
-  const match = input.match(/^(\d+)(m|h|d)$/);
-  if (!match) return null;
-  const value = parseInt(match[1], 10);
-  const unit = match[2];
-  if (unit === "m") return value * 60 * 1000;
-  if (unit === "h") return value * 60 * 60 * 1000;
-  if (unit === "d") return value * 24 * 60 * 60 * 1000;
-  return null;
-}
-
-function confirmPrompt(message: string): Promise<boolean> {
-  const rl = readline.createInterface({
-    input: process.stdin,
-    output: process.stdout,
-  });
-  return new Promise((resolve) => {
-    rl.question(`${message} [y/N] `, (answer) => {
-      rl.close();
-      resolve(answer.trim().toLowerCase() === "y");
-    });
-  });
-}
-
-function readFromPipedStdin(): Promise<string> {
-  return new Promise((resolve, reject) => {
-    let data = "";
-    process.stdin.setEncoding("utf8");
-    process.stdin.on("data", (chunk) => {
-      data += chunk;
-    });
-    process.stdin.on("end", () => resolve(data.replace(/\n$/, "")));
-    process.stdin.on("error", reject);
-  });
-}
-
-function promptSecretInteractively(): Promise<string> {
-  return new Promise((resolve, reject) => {
-    process.stdout.write("Enter secret value: ");
-
-    if (process.stdin.isTTY) {
-      process.stdin.setRawMode(true);
-    }
-
-    let value = "";
-    process.stdin.setEncoding("utf8");
-
-    const cleanup = () => {
-      if (process.stdin.isTTY) {
-        process.stdin.setRawMode(false);
-      }
-      process.stdin.removeListener("data", onData);
-      process.stdin.removeListener("end", onEnd);
-      process.stdin.pause();
-    };
-
-    const onEnd = () => {
-      cleanup();
-      process.stdout.write("\n");
-      resolve(value);
-    };
-
-    const onData = (ch: string) => {
-      for (const c of ch) {
-        const code = c.codePointAt(0)!;
-        if (c === "\n" || c === "\r" || code === 4) {
-          cleanup();
-          process.stdout.write("\n");
-          resolve(value);
-          return;
-        } else if (code === 3) {
-          cleanup();
-          reject(new Error("Aborted"));
-          return;
-        } else if (code === 0x1b) {
-          return;
-        } else if (code === 127) {
-          if (value.length > 0) {
-            value = value.slice(0, -1);
-          }
-        } else if (code >= 0x20) {
-          value += c;
-        }
-      }
-    };
-
-    process.stdin.on("data", onData);
-    process.stdin.on("end", onEnd);
-    process.stdin.resume();
-  });
-}
-
-// Maximum names per batch-load request. Mirrors hq-pro's MAX_BATCH_NAMES so a
-// large --only list is chunked client-side rather than 400'd whole by the
-// server (the legacy per-key GET path had no such cap).
-const MAX_BATCH_NAMES = 100;
-const SECRET_LOAD_TIMEOUT_MS = 30_000;
-
-export type SecretTier = "standard" | "sensitive" | "nuclear";
-export type SecretScriptLockMode = "off" | "enforced";
-export type SecretUsageChannel =
-  | "run"
-  | "exec"
-  | "env"
-  | "sandbox"
-  | "reveal"
-  | "submit-link";
-
-export interface SecretScriptUsage {
-  scriptId: string;
-  path: string;
-  sha256: string;
-  attestationLevel: string;
-}
-
-export interface SecretUsage {
-  channel: SecretUsageChannel;
-  reason?: string;
-  script?: SecretScriptUsage;
-}
-
-export interface SecretMetadata {
-  tier?: SecretTier;
-  scriptLock?: {
-    mode?: SecretScriptLockMode;
-    requiredAttestation?: string;
-  };
-  cacheTtlMs?: number;
-}
-
-export interface SecretLoadSuccessRow extends SecretMetadata {
-  name: string;
-  value?: string;
-}
-
-export interface SecretLoadResponse {
-  secrets: SecretLoadSuccessRow[];
-  errors: Array<{ name: string; code: string; message?: string }>;
-}
-
-function highSecuritySandboxOnlyMessage(secretName?: string): string {
-  const sandboxExample = secretName
-    ? `hq secrets sandbox --only ${secretName} -- <command>`
-    : "hq secrets sandbox --only <secret> -- <command>";
-  return `High-security secrets can run only in the sandbox (use \`${sandboxExample}\`) or through the HQ secret proxy. Local injection and script locks (\`--script\`) are not supported.`;
-}
-
-interface SecretGetResponse {
-  secret: {
-    name: string;
-    companyUid: string;
-    type?: string;
-    lastModifiedDate?: string;
-    version?: number;
-    value?: string;
-  } & SecretMetadata;
-}
-
-interface SecretPolicyScript {
-  scriptId: string;
-  scriptPath: string;
-  sha256: string;
-  attestationLevel: string;
-}
-
-interface SecretPolicyApprovedScript {
-  scriptId: string;
-  path: string;
-  sha256?: string;
-  attestationLevel: string;
-  revokedAt?: string;
-}
-
-interface SecretPolicyRecord {
-  path: string;
-  tier?: SecretTier;
-  scriptLock?: {
-    mode?: SecretScriptLockMode;
-    requiredAttestation?: string;
-    approvedScripts?: SecretPolicyApprovedScript[];
-  };
-  scripts?: SecretPolicyScript[];
-}
-
-interface SecretPolicyResponse {
-  policy?: SecretPolicyRecord;
-  scripts?: SecretPolicyScript[];
-}
-
-interface SecretAclPrincipal {
-  granteeType: "email" | "group" | "company-wide";
-  granteeId: string;
-}
-
-function parseSecretAclPrincipal(
-  principal: string,
-): SecretAclPrincipal | null {
-  const p = principal.trim();
-  if (p === "@all") {
-    // Company-wide grant: every active member of the company. The server
-    // carries no specific grantee id for this axis, so granteeId is empty.
-    return { granteeType: "company-wide", granteeId: "" };
-  }
-  if (EMAIL_PATTERN.test(p)) {
-    return { granteeType: "email", granteeId: p.toLowerCase() };
-  }
-  if (GROUP_ID_PATTERN.test(p)) {
-    return { granteeType: "group", granteeId: p };
-  }
-  console.error(
-    chalk.red(
-      `Invalid principal '${principal}': must be '@all', an email address, or a group id matching grp_<alphanumeric, underscore, hyphen>`,
-    ),
-  );
-  return null;
-}
-
-function describeSecretAclPrincipal(principal: SecretAclPrincipal): string {
-  return principal.granteeType === "company-wide"
-    ? "@all (entire company)"
-    : principal.granteeId;
-}
-
-// secrets-proxy-per-secret-destination US-006: an InjectionRecipe as sent on
-// the create/update POST body. Mirrors hq-pro's `InjectionRecipe`
-// (src/vault-service/handlers/secrets.ts) — kept as a local shape (not
-// imported) since the CLI does not depend on the hq-pro package.
-export interface SecretInjectionRecipe {
-  header: string;
-  scheme: "raw" | "bearer";
-  extraHeaders?: Record<string, string>;
-}
-
-// Mirrors hq-pro's server-authoritative KNOWN_DESTINATION_REGISTRY
-// (src/vault-service/handlers/destination-registry.ts) — a KNOWN host's
-// --auth-style is optional because the server resolves the recipe itself.
-// This client-side copy exists purely so an UNKNOWN host with no
-// --auth-style can be rejected immediately with a clear, actionable message
-// instead of a round trip; the server remains the authoritative validator
-// (this list drifting stale merely means one extra CLI round trip, not a
-// security gap — the server still 400s an unrecognized host with no recipe).
-const KNOWN_DESTINATION_HOSTS = new Set([
-  "api.anthropic.com",
-  "api.openai.com",
-  "api.stripe.com",
-]);
-
-// Parses `--auth-style` into the InjectionRecipe shape the server expects.
-// Returns `null` (with a printed error) for an unrecognized value.
-function parseAuthStyle(authStyle: string): SecretInjectionRecipe | null {
-  if (authStyle === "bearer") {
-    return { header: "authorization", scheme: "bearer" };
-  }
-  if (authStyle === "x-api-key") {
-    return { header: "x-api-key", scheme: "raw" };
-  }
-  const headerMatch = authStyle.match(/^header:(.+)$/);
-  if (headerMatch) {
-    const headerName = headerMatch[1].trim();
-    if (!headerName) {
-      console.error(
-        chalk.red(
-          `Invalid --auth-style 'header:': must name a header, e.g. header:X-Custom-Key`,
-        ),
-      );
-      return null;
-    }
-    return { header: headerName, scheme: "raw" };
-  }
-  console.error(
-    chalk.red(
-      `Invalid --auth-style '${authStyle}': must be one of bearer, x-api-key, or header:NAME`,
-    ),
-  );
-  return null;
-}
-
-// Validates `--destination` is a bare HTTPS scheme+host URL (no path, query,
-// port). Mirrors hq-pro's `validateDestinations` server-side check
-// (src/vault-service/handlers/secrets.ts) so a malformed URL is caught
-// locally with an actionable message rather than a round trip — the server
-// re-validates and remains authoritative.
-export function parseDestinationUrl(
-  raw: string,
-): { ok: true; url: string; hostname: string } | { ok: false } {
-  let parsed: URL;
-  try {
-    parsed = new URL(raw);
-  } catch {
-    console.error(
-      chalk.red(`Invalid --destination '${raw}': must be a valid URL`),
-    );
-    return { ok: false };
-  }
-  if (parsed.protocol !== "https:") {
-    console.error(
-      chalk.red(`Invalid --destination '${raw}': must use https://`),
-    );
-    return { ok: false };
-  }
-  if (!parsed.hostname) {
-    console.error(
-      chalk.red(`Invalid --destination '${raw}': missing hostname`),
-    );
-    return { ok: false };
-  }
-  // Reject an embedded `user:pass@host` credential segment explicitly rather
-  // than letting `new URL()` silently drop it (mirrors hq-pro's authoritative
-  // `validateDestinations`; the server re-validates and remains authoritative).
-  if (parsed.username !== "" || parsed.password !== "") {
-    console.error(
-      chalk.red(
-        `Invalid --destination '${raw}': must not contain embedded userinfo (user:pass@) credentials`,
-      ),
-    );
-    return { ok: false };
-  }
-  if (
-    (parsed.pathname !== "" && parsed.pathname !== "/") ||
-    parsed.search !== "" ||
-    parsed.hash !== ""
-  ) {
-    console.error(
-      chalk.red(
-        `Invalid --destination '${raw}': must be a bare scheme+host URL with no path, query, or fragment (e.g. https://api.openai.com)`,
-      ),
-    );
-    return { ok: false };
-  }
-  if (parsed.port !== "") {
-    console.error(
-      chalk.red(`Invalid --destination '${raw}': must not specify a port`),
-    );
-    return { ok: false };
-  }
-  return { ok: true, url: `https://${parsed.hostname}`, hostname: parsed.hostname };
-}
-
-function normalizeSecretTier(tier?: string): SecretTier {
-  return tier === "sensitive" || tier === "nuclear" ? tier : "standard";
-}
-
-function normalizeScriptLockMode(mode?: string): SecretScriptLockMode {
-  return mode === "enforced" ? "enforced" : "off";
-}
-
-function normalizeCacheTtlMs(metadata: SecretMetadata): number {
-  // Controlled rows must never reach the offline cache even if a mixed-version
-  // or malformed response carries a positive TTL. The server is authoritative
-  // for access, but the client still has enough policy metadata to fail safe.
-  if (
-    metadata.tier === "sensitive" ||
-    metadata.tier === "nuclear" ||
-    metadata.scriptLock?.mode === "enforced"
-  ) {
-    return 0;
-  }
-  if (metadata.cacheTtlMs === undefined) {
-    return DEFAULT_SECRETS_CACHE_TTL_MS;
-  }
-  return typeof metadata.cacheTtlMs === "number" &&
-    Number.isFinite(metadata.cacheTtlMs) &&
-    metadata.cacheTtlMs > 0
-    ? metadata.cacheTtlMs
-    : 0;
-}
-
-function extractApiMessage(
-  body: Record<string, unknown>,
-  fallback: string,
-): string {
-  const message = typeof body.message === "string" ? body.message : undefined;
-  const error = typeof body.error === "string" ? body.error : undefined;
-  return message ?? error ?? fallback;
-}
-
-async function buildSecretUsage(
-  channel: SecretUsageChannel,
-  scriptPath?: string,
-  scriptId?: string,
-  attestationLevel = "self-asserted-hash",
-): Promise<SecretUsage> {
-  if (scriptId && !scriptPath) {
-    throw new Error("--script-id requires --script");
-  }
-  if (!scriptPath) {
-    return { channel };
-  }
-  const resolvedPath = nodePath.resolve(scriptPath);
-  return {
-    channel,
-    script: {
-      scriptId: scriptId ?? resolvedPath,
-      path: resolvedPath,
-      sha256: await computeSha256(resolvedPath),
-      attestationLevel,
-    },
-  };
-}
-
-// Commander collector for `--only`: accumulates across REPEATED flags instead
-// of the last one silently winning, and each value may still be
-// comma-separated. So `--only A,B`, `--only A --only B`, and
-// `--only A,B --only C` all resolve to the full list.
-export function collectSecretNames(value: string, previous?: string[]): string[] {
-  const parsed = value.split(",").map((k) => k.trim()).filter(Boolean);
-  return (previous ?? []).concat(parsed);
-}
-
-function parseSecretNameList(input: string[] | undefined): string[] {
-  const keys = input ?? [];
-  if (keys.length === 0) {
-    console.error(chalk.red("Error: --only requires at least one secret name."));
-    process.exit(1);
-  }
-  for (const key of keys) {
-    if (!SECRET_NAME_PATTERN.test(key)) {
-      console.error(chalk.red(`Invalid secret name '${key}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$`));
-      process.exit(1);
-    }
-  }
-  return keys;
-}
-
-function mergeScopeOpts(
-  parent: SecretsScopeOpts,
-  child: SecretsScopeOpts,
-): SecretsScopeOpts {
-  return {
-    company: child.company ?? parent.company,
-    personal: child.personal ?? parent.personal,
-  };
-}
-
-export function scrubSandboxOutput(text: string, secretNames: string[] = []): string {
-  let scrubbed = text;
-  for (const name of secretNames) {
-    const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-    scrubbed = scrubbed.replace(
-      new RegExp(`\\b(${escaped})\\s*=\\s*([^\\s'"\\n]+|'[^'\\n]*'|"[^"\\n]*")`, "g"),
-      "$1=[REDACTED]",
-    );
-    scrubbed = scrubbed.replace(
-      new RegExp(`\\b(${escaped})\\s*:\\s*([^\\s'"\\n]+|'[^'\\n]*'|"[^"\\n]*")`, "g"),
-      "$1: [REDACTED]",
-    );
-  }
-  return scrubbed
-    .replace(/\bsk-[A-Za-z0-9_-]{8,}\b/g, "[REDACTED]")
-    .replace(/\bgh[pousr]_[A-Za-z0-9_]{16,}\b/g, "[REDACTED]")
-    .replace(/\b[A-Za-z0-9+/]{40,}={0,2}\b/g, "[REDACTED]");
-}
-
-function renderSandboxJobResult(job: SandboxRunnerJob, secretNames: string[]): void {
-  if (job.output) {
-    const output = scrubSandboxOutput(job.output, secretNames);
-    process.stdout.write(output);
-    if (output.length > 0 && !output.endsWith("\n")) {
-      process.stdout.write("\n");
-    }
-  }
-}
-
-function normalizePolicyRecord(
-  secretPath: string,
-  data: SecretPolicyResponse,
-): SecretPolicyRecord & { scripts: SecretPolicyScript[] } {
-  const policy = data.policy ?? { path: secretPath };
-  const scripts = Array.isArray(policy.scriptLock?.approvedScripts)
-    ? policy.scriptLock.approvedScripts
-        .filter(
-          (script) =>
-            script !== null &&
-            typeof script === "object" &&
-            typeof script.scriptId === "string" &&
-            typeof script.path === "string" &&
-            typeof script.attestationLevel === "string" &&
-            !script.revokedAt,
-        )
-        .map((script) => ({
-          scriptId: script.scriptId,
-          scriptPath: script.path,
-          sha256: typeof script.sha256 === "string" ? script.sha256 : "",
-          attestationLevel: script.attestationLevel,
-        }))
-    : Array.isArray(policy.scripts)
-      ? policy.scripts.filter(isSecretPolicyScript)
-      : Array.isArray(data.scripts)
-        ? data.scripts.filter(isSecretPolicyScript)
-        : [];
-  return {
-    path: policy.path ?? secretPath,
-    tier: normalizeSecretTier(policy.tier),
-    scriptLock: {
-      mode: normalizeScriptLockMode(policy.scriptLock?.mode),
-      requiredAttestation: policy.scriptLock?.requiredAttestation,
-    },
-    scripts,
-  };
-}
-
-function isSecretPolicyScript(value: unknown): value is SecretPolicyScript {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
-  const script = value as Partial<SecretPolicyScript>;
-  return (
-    typeof script.scriptId === "string" &&
-    typeof script.scriptPath === "string" &&
-    typeof script.sha256 === "string" &&
-    typeof script.attestationLevel === "string"
-  );
-}
-
-function renderPolicySummary(policy: SecretPolicyRecord): void {
-  console.log(chalk.bold(`Policy: ${policy.path}`));
-  console.log(`  Tier:          ${normalizeSecretTier(policy.tier)}`);
-  console.log(
-    `  Script Lock:   ${normalizeScriptLockMode(policy.scriptLock?.mode)}`,
-  );
-  if (policy.scriptLock?.requiredAttestation) {
-    console.log(
-      `  Attestation:   ${policy.scriptLock.requiredAttestation}`,
-    );
-  }
-}
-
-function renderPolicyScripts(scripts: SecretPolicyScript[]): void {
-  if (scripts.length === 0) {
-    console.log(chalk.dim("No approved scripts."));
-    return;
-  }
-
-  const idWidth = Math.max(2, ...scripts.map((script) => script.scriptId.length));
-  const pathWidth = Math.max(
-    6,
-    ...scripts.map((script) => script.scriptPath.length),
-  );
-  const attestationWidth = Math.max(
-    11,
-    ...scripts.map((script) => script.attestationLevel.length),
-  );
-  const header = [
-    "ID".padEnd(idWidth),
-    "SCRIPT".padEnd(pathWidth),
-    "ATTESTATION".padEnd(attestationWidth),
-    "SHA256",
-  ].join("  ");
-  console.log(chalk.bold(header));
-  for (const script of scripts) {
-    console.log(
-      [
-        script.scriptId.padEnd(idWidth),
-        script.scriptPath.padEnd(pathWidth),
-        script.attestationLevel.padEnd(attestationWidth),
-        script.sha256 || "-",
-      ].join("  "),
-    );
-  }
-}
-
-// HQ-4H — load + decrypt secrets through the BATCH-LOAD endpoint
-// (`POST /secrets/{companyUid}/load`) instead of one single-secret GET per key.
-//
-// Every single-secret GET that 404s makes vault-service emit an unattributed
-// "Secret not found" Sentry *warning* — each `response(404, …)` is captured at
-// the response boundary (hq-pro `_error-response.ts`). That capture is the
-// right signal for `hq secrets get <name>` ("a caller genuinely needed THIS
-// secret and it was missing"), but it is pure noise for a multi-key load where
-// a missing / renamed / rotated key is a per-key outcome `exec`/`env` already
-// report cleanly to the user. The batch-load endpoint returns 200 with a
-// per-name `errors[]` array and never captures — the same path `hq run` uses,
-// which is exactly why `hq run` never contributed to HQ-4H. Routing `exec` and
-// `env` through it stops those callers from emitting the warning while keeping
-// identical UX and error text.
-//
-// Every value use through exec/env/reveal is server-authorized, including when
-// an encrypted disk-cache entry exists. The cache remains write-through for
-// explicitly offline install-time consumers; these commands never trust it as
-// an authorization decision. This means a policy, ACL, tier, or script-approval
-// change takes effect on their next use even though there is no push revocation.
-// Requests are chunked at MAX_BATCH_NAMES and throw on the FIRST unresolved key
-// with the same `Failed to fetch secret '<k>': <reason>` shape the per-key GET
-// path used — never swallows a failure.
-async function loadRevealedSecretsViaApiKey(
-  token: string,
-  keys: string[],
-): Promise<Map<string, string>> {
-  const resolved = new Map<string, string>();
-  const requested = [...new Set(keys)];
-  const cacheScope = "__api_key__";
-
-  for (const name of requested) {
-    const res = await vaultApiFetch({
-      token,
-      path: "/v1/keys/secrets/fetch",
-      method: "POST",
-      body: { name },
-      signal: AbortSignal.timeout(SECRET_LOAD_TIMEOUT_MS),
-    });
-    const body = (await res.json().catch(() => ({}))) as Record<string, unknown>;
-
-    if (!res.ok) {
-      if (res.status === 404) {
-        throw new Error(`Failed to fetch secret '${name}': Secret not found`);
-      }
-      if (res.status === 403) {
-        const message =
-          typeof body.error === "string"
-            ? body.error
-            : typeof body.message === "string"
-              ? body.message
-              : "No read permission";
-        if (body.highSecurity === true) {
-          throw new Error(highSecuritySandboxOnlyMessage(name));
-        }
-        throw new Error(`Failed to fetch secret '${name}': ${message}`);
-      }
-      if (res.status === 401) {
-        throw new Error(
-          `Failed to fetch secret '${name}': Invalid or missing API key`,
-        );
-      }
-      throw new Error(
-        `Failed to fetch secret '${name}': ${extractApiMessage(body, res.statusText)}`,
-      );
-    }
-
-    const secret =
-      typeof body.secret === "object" && body.secret !== null
-        ? (body.secret as { value?: unknown; name?: unknown })
-        : null;
-    if (typeof secret?.value !== "string") {
-      throw new Error(
-        `Failed to fetch secret '${name}': malformed fetch response`,
-      );
-    }
-    removeCacheEntry(cacheScope, name);
-    resolved.set(name, secret.value);
-  }
-
-  return resolved;
-}
-
-export async function loadRevealedSecrets(
-  token: string,
-  companyUid: string,
-  keys: string[],
-  usage?: SecretUsage,
-): Promise<Map<string, string>> {
-  if (token.startsWith(HQ_API_KEY_PREFIX)) {
-    return loadRevealedSecretsViaApiKey(token, keys);
-  }
-
-  const resolved = new Map<string, string>();
-  const requested = [...new Set(keys)];
-  try {
-    for (let i = 0; i < requested.length; i += MAX_BATCH_NAMES) {
-      const chunk = requested.slice(i, i + MAX_BATCH_NAMES);
-      const chunkNames = new Set(chunk);
-      const res = await vaultApiFetch({
-        token,
-        path: `/secrets/${encodeURIComponent(companyUid)}/load`,
-        method: "POST",
-        body: usage ? { names: chunk, usage } : { names: chunk },
-        signal: AbortSignal.timeout(SECRET_LOAD_TIMEOUT_MS),
-      });
-      if (!res.ok) {
-        const body = (await res.json().catch(() => ({}))) as Record<string, unknown>;
-        const message = extractApiMessage(body, res.statusText);
-        // High-security refusal surfaced at the batch level (rather than
-        // per-name): point the caller at the sandbox/proxy and never leak
-        // plaintext. A local script attestation is not an override.
-        if (
-          body.code === "high_security_denied" ||
-          body.code === "high_security_sandbox_only" ||
-          body.highSecurity === true
-        ) {
-          throw new Error(highSecuritySandboxOnlyMessage());
-        }
-        if (
-          res.status >= 400 &&
-          res.status < 500 &&
-          typeof body.code === "string"
-        ) {
-          throw new Error(message);
-        }
-        throw new Error(
-          `Failed to batch-load secrets: ${message}`,
-        );
-      }
-      const data = (await res.json()) as Partial<SecretLoadResponse>;
-      if (!Array.isArray(data.secrets) || !Array.isArray(data.errors)) {
-        throw new Error("Invalid secret load response from vault");
-      }
-      const errorsByName = new Map<string, { code: string; message?: string }>();
-      const seenNames = new Set<string>();
-
-      for (const rawSecret of data.secrets) {
-        if (!rawSecret || typeof rawSecret !== "object") {
-          throw new Error("Invalid secret load response from vault");
-        }
-        const s = rawSecret as SecretLoadSuccessRow;
-        if (
-          typeof s.name !== "string" ||
-          !chunkNames.has(s.name) ||
-          seenNames.has(s.name) ||
-          (s.value != null && typeof s.value !== "string")
-        ) {
-          throw new Error("Invalid secret load response from vault");
-        }
-        seenNames.add(s.name);
-        if (s.value == null) {
-          errorsByName.set(s.name, {
-            code: "not_returned",
-            message: `Secret '${s.name}' has no value (reveal may not be permitted).`,
-          });
-          removeCacheEntry(companyUid, s.name);
-          continue;
-        }
-        const cacheTtlMs = normalizeCacheTtlMs(s);
-        if (cacheTtlMs > 0) {
-          writeCache(companyUid, s.name, s.value, cacheTtlMs);
-        } else {
-          removeCacheEntry(companyUid, s.name);
-        }
-        resolved.set(s.name, s.value);
-      }
-
-      for (const rawError of data.errors) {
-        if (!rawError || typeof rawError !== "object") {
-          throw new Error("Invalid secret load response from vault");
-        }
-        const e = rawError as { name?: unknown; code?: unknown; message?: unknown };
-        if (
-          typeof e.name !== "string" ||
-          !chunkNames.has(e.name) ||
-          seenNames.has(e.name) ||
-          typeof e.code !== "string" ||
-          (e.message !== undefined && typeof e.message !== "string")
-        ) {
-          throw new Error("Invalid secret load response from vault");
-        }
-        seenNames.add(e.name);
-        errorsByName.set(e.name, { code: e.code, message: e.message });
-        resolved.delete(e.name);
-        removeCacheEntry(companyUid, e.name);
-      }
-      // Any requested key in this chunk the server did not return is a per-key
-      // failure — surface it with the same prefix the single-GET path used so
-      // callers (and scripts grepping stderr) see no behavior change.
-      let firstFailure: Error | null = null;
-      for (const key of chunk) {
-        if (resolved.has(key)) continue;
-        removeCacheEntry(companyUid, key);
-        const err = errorsByName.get(key);
-        // Every caller of loadRevealedSecrets injects or prints the plaintext
-        // locally (`secrets get --reveal`, `secrets exec`, `secrets env`). Both
-        // high-security denial shapes therefore receive the same explicit
-        // sandbox/proxy guidance, even if the caller supplied `--script`.
-        if (
-          err?.code === "high_security_denied" ||
-          err?.code === "high_security_sandbox_only"
-        ) {
-          firstFailure ??= new Error(highSecuritySandboxOnlyMessage(key));
-          continue;
-        }
-        const reason =
-          err?.code === "not_found"
-            ? "Secret not found"
-            : err?.code === "forbidden"
-              ? err.message ?? "No read permission"
-              : err?.message ?? err?.code ?? "not returned by vault";
-        firstFailure ??= new Error(`Failed to fetch secret '${key}': ${reason}`);
-      }
-      if (firstFailure) {
-        throw firstFailure;
-      }
-    }
-
-    return resolved;
-  } catch (err) {
-    // A transport failure, stale session, malformed response, or a later chunk
-    // failure must not leave values written by this attempted operation available
-    // to offline cache readers. Evict the whole request before failing closed.
-    for (const key of requested) {
-      removeCacheEntry(companyUid, key);
-    }
-    throw err;
-  }
-}
-
-export function registerSecretsCommand(program: Command): void {
-  const secrets = program
-    .command("secrets")
-    .description("Manage secrets in HQ vault (SSM Parameter Store)")
-    .option("--company <slug>", "Company slug (resolves to companyUid)")
-    .option(
-      "--personal",
-      "Operate on the caller's personal vault (no sharing)",
-    );
-
-  secrets
-    .command("set <name>")
-    .description("Create or update a secret")
-    .option("--from-stdin", "Read secret value from piped stdin")
-    .option(
-      "--high-security",
-      "Mark the secret high-security: it can never be revealed or injected locally, only used through the HQ secret proxy (requires --destination)",
-    )
-    .option(
-      "--destination <https-url>",
-      "Approved scheme+host HTTPS URL the proxy may forward this secret to (e.g. https://api.openai.com); required with --high-security",
-    )
-    .option(
-      "--auth-style <style>",
-      "How the proxy attaches the key upstream: bearer | x-api-key | header:NAME. Optional for known destinations (auto-resolved server-side); required for unknown ones",
-    )
-    .action(async (
-      name: string,
-      opts: {
-        fromStdin?: boolean;
-        highSecurity?: boolean;
-        destination?: string;
-        authStyle?: string;
-      },
-    ) => {
-      try {
-        if (!SECRET_NAME_PATTERN.test(name)) {
-          console.error(chalk.red(`Invalid secret name '${name}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. MY_API_KEY or DEV/MY_KEY)`));
-          process.exit(1);
-        }
-
-        // secrets-proxy-per-secret-destination US-006: --high-security marks
-        // the secret so it can only ever be used through the server-side
-        // proxy (never revealed/injected locally — that refusal is the
-        // pre-existing consumption-side behavior in `get`/`exec`/`env` above,
-        // unchanged by this story). It REQUIRES a --destination: the proxy
-        // (hq-pro US-002) fails closed with no destination configured, so
-        // catching the missing pin here is a clear, immediate CLI error
-        // rather than a deferred proxy-time failure.
-        let destinations: string[] | undefined;
-        let injection: SecretInjectionRecipe | undefined;
-        if (opts.highSecurity) {
-          if (!opts.destination) {
-            console.error(
-              chalk.red(
-                "Error: --high-security requires --destination <https-url> (e.g. --destination https://api.openai.com).",
-              ),
-            );
-            process.exit(1);
-          }
-
-          const destResult = parseDestinationUrl(opts.destination);
-          if (!destResult.ok) {
-            process.exit(1);
-          }
-          destinations = [destResult.url];
-
-          if (opts.authStyle) {
-            const recipe = parseAuthStyle(opts.authStyle);
-            if (!recipe) {
-              process.exit(1);
-            }
-            injection = recipe;
-          } else if (!KNOWN_DESTINATION_HOSTS.has(destResult.hostname)) {
-            // Unknown host + no explicit recipe: the server would reject this
-            // 400 anyway (US-004 registry lookup only, never guesses) — fail
-            // fast locally with an actionable message instead of a round trip.
-            console.error(
-              chalk.red(
-                `Error: unknown destination host '${destResult.hostname}' — provide --auth-style <bearer|x-api-key|header:NAME> (known hosts auto-resolve: ${[...KNOWN_DESTINATION_HOSTS].join(", ")}).`,
-              ),
-            );
-            process.exit(1);
-          }
-          // Known host + no --auth-style: leave `injection` undefined so the
-          // server (US-004) auto-resolves the recipe from its registry.
-        } else if (opts.destination || opts.authStyle) {
-          console.error(
-            chalk.red(
-              "Error: --destination/--auth-style require --high-security.",
-            ),
-          );
-          process.exit(1);
-        }
-
-        let value: string;
-        if (opts.fromStdin) {
-          if (process.stdin.isTTY) {
-            console.error(chalk.red("Error: --from-stdin requires piped input (e.g. echo 'val' | hq secrets set NAME --from-stdin)"));
-            process.exit(1);
-          }
-          value = await readFromPipedStdin();
-        } else {
-          if (!process.stdin.isTTY) {
-            console.error(chalk.red("Error: stdin is not a terminal. Use --from-stdin for piped input."));
-            process.exit(1);
-          }
-          value = await promptSecretInteractively();
-        }
-
-        if (!value) {
-          console.error(chalk.red("Error: secret value cannot be empty."));
-          process.exit(1);
-        }
-
-        if (Buffer.byteLength(value, "utf8") > 4096) {
-          console.error(chalk.red(`Secret value exceeds 4096-byte SSM limit (got ${Buffer.byteLength(value, "utf8")} bytes).`));
-          process.exit(1);
-        }
-
-        const token = await requireCognitoTokenForSecrets("secrets set");
-        const scope = scopeOpts(secrets.opts());
-        const companyUid = await getEntityUid(token, scope);
-        const scopeLabel = describeSecretsScope({
-          personal: scope.personal,
-          companySlug: scope.companySlug,
-          companyUid,
-        });
-
-        const res = await vaultApiFetch({
-          token,
-          path: `/secrets/${encodeURIComponent(companyUid)}`,
-          method: "POST",
-          body: {
-            name,
-            value,
-            // Only present when --high-security was passed — an ordinary
-            // `set` with no flags sends exactly `{ name, value }`, byte-for-
-            // byte unchanged from before this story.
-            ...(opts.highSecurity ? { highSecurity: true } : {}),
-            ...(destinations ? { destinations } : {}),
-            ...(injection ? { injection } : {}),
-          },
-        });
-
-        if (!res.ok) {
-          const body = (await res.json().catch(() => ({}))) as Record<string, unknown>;
-          console.error(
-            chalk.red(`Failed to set secret: ${extractApiMessage(body, res.statusText)}`),
-          );
-          process.exit(1);
-        }
-
-        removeCacheEntry(companyUid, name);
-        console.log(chalk.green(formatSecretSaved(name, scopeLabel)));
-        if (opts.highSecurity) {
-          console.log(
-            chalk.dim(
-              `  High-security: destination pinned to ${destinations?.[0]}. This value can run only in the sandbox (hq secrets sandbox) or through the HQ secret proxy; local injection and script locks are unsupported.`,
-            ),
-          );
-        }
-      } catch (err) {
-        console.error(
-          chalk.red("Error:"),
-          err instanceof Error ? err.message : String(err),
-        );
-        process.exit(1);
-      }
-    });
-
-  secrets
-    .command("get <name>")
-    .description("Get a secret's metadata (use --reveal for value)")
-    .option("--reveal", "Include the decrypted secret value")
-    .action(async (name: string, opts: { reveal?: boolean }) => {
-      try {
-        const cred = await resolveVaultCredential();
-
-        if (cred.kind === "api-key") {
-          if (!opts.reveal) {
-            console.error(
-              chalk.red(
-                "HQ_API_KEY is set; `hq secrets get` without --reveal is not supported for API keys. " +
-                  "Use --reveal to fetch the value, or unset HQ_API_KEY for metadata-only reads.",
-              ),
-            );
-            process.exit(1);
-          }
-          const res = await vaultApiFetch({
-            token: cred.token,
-            path: "/v1/keys/secrets/fetch",
-            method: "POST",
-            body: { name },
-          });
-          const body = (await res.json().catch(() => ({}))) as Record<
-            string,
-            unknown
-          >;
-          if (!res.ok) {
-            if (res.status === 403 && body.highSecurity === true) {
-              console.error(chalk.red(highSecuritySandboxOnlyMessage(name)));
-              process.exit(1);
-            }
-            console.error(
-              chalk.red(
-                `Failed to get secret: ${extractApiMessage(body, res.statusText)}`,
-              ),
-            );
-            process.exit(1);
-          }
-          const secret =
-            typeof body.secret === "object" && body.secret !== null
-              ? (body.secret as SecretGetResponse["secret"] & {
-                  value?: string;
-                })
-              : null;
-          if (!secret || typeof secret.name !== "string") {
-            console.error(chalk.red("Failed to get secret: malformed response"));
-            process.exit(1);
-          }
-          console.log(chalk.bold(`Secret: ${secret.name}`));
-          if (secret.lastModifiedDate) {
-            console.log(`  Last Modified: ${secret.lastModifiedDate}`);
-          }
-          if (secret.version != null) {
-            console.log(`  Version:       ${secret.version}`);
-          }
-          console.log(`  Tier:          ${normalizeSecretTier(secret.tier)}`);
-          console.log(
-            `  Script Lock:   ${normalizeScriptLockMode(secret.scriptLock?.mode)}`,
-          );
-          if (opts.reveal) {
-            if (typeof secret.value !== "string") {
-              console.error(
-                chalk.red(
-                  "Failed to get secret: reveal requested but response omitted secret.value",
-                ),
-              );
-              process.exit(1);
-            }
-            console.log(`  Value:         ${secret.value}`);
-          } else {
-            console.log(`  Value:         ${chalk.dim("[REDACTED]")}`);
-          }
-          return;
-        }
-
-        const token = cred.token;
-        const companyUid = await getEntityUid(
-          token,
-          scopeOpts(secrets.opts()),
-        );
-
-        const res = await vaultApiFetch({
-          token,
-          path: buildSecretNamePath(companyUid, name),
-        });
-
-        if (!res.ok) {
-          const body = (await res.json().catch(() => ({}))) as Record<string, unknown>;
-          // High-security secrets cannot be revealed locally. Surface the
-          // hosted execution path rather than a raw 4xx; `--script` never
-          // overrides this boundary.
-          if (res.status === 403 && body.highSecurity === true) {
-            console.error(chalk.red(highSecuritySandboxOnlyMessage(name)));
-            process.exit(1);
-          }
-          console.error(
-            chalk.red(`Failed to get secret: ${extractApiMessage(body, res.statusText)}`),
-          );
-          process.exit(1);
-        }
-
-        const data = (await res.json()) as SecretGetResponse;
-
-        let revealedValue: string | undefined;
-        let revealError: string | null = null;
-        if (opts.reveal) {
-          try {
-            revealedValue = (
-              await loadRevealedSecrets(token, companyUid, [name], await buildSecretUsage("reveal"))
-            ).get(name);
-          } catch (err) {
-            revealError = err instanceof Error ? err.message : String(err);
-          }
-        }
-
-        const s = data.secret;
-        console.log(chalk.bold(`Secret: ${s.name}`));
-        if (s.lastModifiedDate) {
-          console.log(`  Last Modified: ${s.lastModifiedDate}`);
-        }
-        if (s.version != null) {
-          console.log(`  Version:       ${s.version}`);
-        }
-        console.log(`  Tier:          ${normalizeSecretTier(s.tier)}`);
-        console.log(
-          `  Script Lock:   ${normalizeScriptLockMode(s.scriptLock?.mode)}`,
-        );
-        if (opts.reveal && revealedValue != null) {
-          console.log(`  Value:         ${revealedValue}`);
-        } else {
-          console.log(`  Value:         ${chalk.dim("[REDACTED]")}`);
-        }
-        if (revealError) {
-          console.error(chalk.red(revealError));
-          process.exit(1);
-        }
-      } catch (err) {
-        console.error(
-          chalk.red("Error:"),
-          err instanceof Error ? err.message : String(err),
-        );
-        process.exit(1);
-      }
-    });
-
-  // HQ-4H: existence probe via the HEAD route. Optional-credential readers
-  // should HEAD-first so a missing secret no longer fires a spurious GET-404
-  // Sentry warning server-side: `hq secrets exists FOO && hq secrets get FOO …`.
-  // A HEAD never decrypts or reveals the value.
-  //
-  // Exit codes are designed for shell chaining:
-  //   0 → secret exists (200)
-  //   1 → secret is absent (404) — the normal "no" answer, NOT an error
-  //   2 → a real failure (auth/network/permission) — distinct from absence so
-  //       `&&` chains don't mistake an outage for "absent and proceed"
-  secrets
-    .command("exists <name>")
-    .description("Check whether a secret exists (HEAD; exit 0=present, 1=absent, 2=error)")
-    .option("--quiet", "Suppress the present/absent line (use the exit code only)")
-    .action(async (name: string, opts: { quiet?: boolean }) => {
-      try {
-        const token = await requireCognitoTokenForSecrets("secrets exists");
-        const companyUid = await getEntityUid(
-          token,
-          scopeOpts(secrets.opts()),
-        );
-
-        const res = await vaultApiFetch({
-          token,
-          method: "HEAD",
-          path: buildSecretNamePath(companyUid, name),
-        });
-
-        if (res.status === 200) {
-          if (!opts.quiet) console.log(chalk.green(`exists: ${name}`));
-          process.exit(0);
-        }
-        if (res.status === 404) {
-          if (!opts.quiet) console.log(chalk.dim(`absent: ${name}`));
-          process.exit(1);
-        }
-        // Any other status (401/403/5xx) is a real failure, not an absence.
-        console.error(
-          chalk.red(
-            `Failed to check secret '${name}': HTTP ${res.status} ${res.statusText}`,
-          ),
-        );
-        process.exit(2);
-      } catch (err) {
-        console.error(
-          chalk.red("Error:"),
-          err instanceof Error ? err.message : String(err),
-        );
-        process.exit(2);
-      }
-    });
-
-  secrets
-    .command("list")
-    .description("List all secrets for the company (including nested path-based names)")
-    .option(
-      "--prefix <path>",
-      "Filter by path prefix (e.g. DEV or DEV/SUB); omit or pass empty string for all secrets",
-    )
-    .action(async (opts: { prefix?: string }) => {
-      try {
-        // MUST match SECRET_PREFIX_PATTERN in hq-pro/src/vault-service/handlers/secrets.ts
-        let normalizedPrefix: string | undefined;
-        if (opts.prefix) {
-          const normalized = opts.prefix.replace(/^\/+|\/+$/g, "");
-          if (
-            normalized.length === 0 ||
-            !SECRET_NAME_PATTERN.test(normalized)
-          ) {
-            console.error(
-              chalk.red(
-                `Invalid prefix '${opts.prefix}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. DEV or DEV/SUB)`,
-              ),
-            );
-            process.exit(1);
-          }
-          normalizedPrefix = normalized;
-        }
-
-        const token = await requireCognitoTokenForSecrets("secrets list");
-        const scope = scopeOpts(secrets.opts());
-        const companyUid = await getEntityUid(token, scope);
-        const scopeLabel = describeSecretsScope({
-          personal: scope.personal,
-          companySlug: scope.companySlug,
-          companyUid,
-        });
-
-        const query: Record<string, string> = {};
-        if (normalizedPrefix) {
-          query.prefix = normalizedPrefix;
-        }
-
-        const res = await vaultApiFetch({
-          token,
-          path: `/secrets/${encodeURIComponent(companyUid)}`,
-          query: Object.keys(query).length > 0 ? query : undefined,
-        });
-
-        if (!res.ok) {
-          const body = await res.json().catch(() => ({}));
-          console.error(
-            chalk.red(`Failed to list secrets: ${(body as Record<string, string>).error ?? res.statusText}`),
-          );
-          process.exit(1);
-        }
-
-        const data = (await res.json()) as {
-          secrets: Array<
-            {
-              name: string;
-              lastModifiedDate?: string;
-              version?: number;
-              permission?: "admin" | "write" | "read";
-            } & SecretMetadata
-          >;
-        };
-
-        if (data.secrets.length === 0) {
-          console.log(chalk.dim(formatSecretsListEmpty(scopeLabel)));
-          return;
-        }
-
-        const nameWidth = Math.max(4, ...data.secrets.map((s) => s.name.length));
-        const hasPermission = data.secrets.some((s) => s.permission !== undefined);
-        const tierWidth = Math.max(
-          4,
-          ...data.secrets.map((s) => normalizeSecretTier(s.tier).length),
-        );
-        const scriptLockWidth = Math.max(
-          11,
-          ...data.secrets.map((s) => normalizeScriptLockMode(s.scriptLock?.mode).length),
-        );
-        if (hasPermission) {
-          const accessWidth = Math.max(6, ...data.secrets.map((s) => (s.permission ?? "-").length));
-          const header = `${"NAME".padEnd(nameWidth)}  ${"ACCESS".padEnd(accessWidth)}  ${"TIER".padEnd(tierWidth)}  ${"SCRIPT LOCK".padEnd(scriptLockWidth)}  LAST MODIFIED`;
-          console.log(chalk.dim(formatSecretsListHeader(scopeLabel)));
-          console.log(chalk.bold(header));
-          for (const s of data.secrets) {
-            const access = s.permission ?? "-";
-            const tier = normalizeSecretTier(s.tier);
-            const scriptLock = normalizeScriptLockMode(s.scriptLock?.mode);
-            const modified = s.lastModifiedDate ?? "-";
-            console.log(`${s.name.padEnd(nameWidth)}  ${access.padEnd(accessWidth)}  ${tier.padEnd(tierWidth)}  ${scriptLock.padEnd(scriptLockWidth)}  ${modified}`);
-          }
-        } else {
-          const header = `${"NAME".padEnd(nameWidth)}  ${"TIER".padEnd(tierWidth)}  ${"SCRIPT LOCK".padEnd(scriptLockWidth)}  LAST MODIFIED`;
-          console.log(chalk.dim(formatSecretsListHeader(scopeLabel)));
-          console.log(chalk.bold(header));
-          for (const s of data.secrets) {
-            const tier = normalizeSecretTier(s.tier);
-            const scriptLock = normalizeScriptLockMode(s.scriptLock?.mode);
-            const modified = s.lastModifiedDate ?? "-";
-            console.log(`${s.name.padEnd(nameWidth)}  ${tier.padEnd(tierWidth)}  ${scriptLock.padEnd(scriptLockWidth)}  ${modified}`);
-          }
-        }
-      } catch (err) {
-        console.error(
-          chalk.red("Error:"),
-          err instanceof Error ? err.message : String(err),
-        );
-        process.exit(1);
-      }
-    });
-
-  const policy = secrets
-    .command("policy")
-    .description("View or update secret access policy");
-
-  policy
-    .command("get <path>")
-    .description("Show the policy for a secret path")
-    .action(async (secretPath: string) => {
-      try {
-        rejectIfPersonal(secrets.opts(), "policy get");
-
-        if (!SECRET_NAME_PATTERN.test(secretPath)) {
-          console.error(chalk.red(`Invalid secret path '${secretPath}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. MY_KEY or PROD/DB_PASSWORD)`));
-          process.exit(1);
-        }
-
-        const token = await requireCognitoTokenForSecrets("secrets");
-        const companyUid = await getEntityUid(
-          token,
-          scopeOpts(secrets.opts()),
-        );
-        const res = await vaultApiFetch({
-          token,
-          path: `/secrets/${encodeURIComponent(companyUid)}/policy`,
-          query: { path: secretPath },
-        });
-
-        if (res.status === 404) {
-          renderPolicySummary(
-            normalizePolicyRecord(secretPath, { policy: { path: secretPath } }),
-          );
-          return;
-        }
-        if (!res.ok) {
-          const body = (await res.json().catch(() => ({}))) as Record<string, unknown>;
-          console.error(
-            chalk.red(`Failed to get policy: ${extractApiMessage(body, res.statusText)}`),
-          );
-          process.exit(1);
-        }
-
-        const data = (await res.json()) as SecretPolicyResponse;
-        renderPolicySummary(normalizePolicyRecord(secretPath, data));
-      } catch (err) {
-        console.error(
-          chalk.red("Error:"),
-          err instanceof Error ? err.message : String(err),
-        );
-        process.exit(1);
-      }
-    });
-
-  policy
-    .command("set <path>")
-    .description("Set the policy for a secret path")
-    .option("--tier <tier>", "Secret tier: standard | sensitive | nuclear")
-    .option("--lock-script <mode>", "Script-lock mode: off | enforce")
-    .action(async (
-      secretPath: string,
-      opts: { tier?: string; lockScript?: string },
-    ) => {
-      try {
-        rejectIfPersonal(secrets.opts(), "policy set");
-
-        if (!SECRET_NAME_PATTERN.test(secretPath)) {
-          console.error(chalk.red(`Invalid secret path '${secretPath}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. MY_KEY or PROD/DB_PASSWORD)`));
-          process.exit(1);
-        }
-
-        const tier = opts.tier;
-        if (
-          tier !== undefined &&
-          tier !== "standard" &&
-          tier !== "sensitive" &&
-          tier !== "nuclear"
-        ) {
-          console.error(chalk.red(`Invalid tier '${tier}': must be one of standard, sensitive, nuclear`));
-          process.exit(1);
-        }
-
-        let scriptLock:
-          | { mode: SecretScriptLockMode }
-          | undefined;
-        if (opts.lockScript !== undefined) {
-          if (opts.lockScript === "off") {
-            scriptLock = { mode: "off" };
-          } else if (opts.lockScript === "enforce") {
-            scriptLock = { mode: "enforced" };
-          } else {
-            console.error(chalk.red(`Invalid script lock mode '${opts.lockScript}': must be one of off, enforce`));
-            process.exit(1);
-          }
-        }
-
-        if (tier === undefined && scriptLock === undefined) {
-          console.error(chalk.red("Error: provide at least one of --tier or --lock-script."));
-          process.exit(1);
-        }
-
-        const token = await requireCognitoTokenForSecrets("secrets");
-        const companyUid = await getEntityUid(
-          token,
-          scopeOpts(secrets.opts()),
-        );
-        const res = await vaultApiFetch({
-          token,
-          path: `/secrets/${encodeURIComponent(companyUid)}/policy`,
-          method: "PUT",
-          body: {
-            path: secretPath,
-            ...(tier !== undefined ? { tier } : {}),
-            ...(scriptLock ? { scriptLock } : {}),
-          },
-        });
-
-        if (!res.ok) {
-          const body = (await res.json().catch(() => ({}))) as Record<string, unknown>;
-          console.error(
-            chalk.red(`Failed to set policy: ${extractApiMessage(body, res.statusText)}`),
-          );
-          process.exit(1);
-        }
-
-        const data = (await res.json().catch(() => ({}))) as SecretPolicyResponse;
-        removeCacheEntry(companyUid, secretPath);
-        console.log(chalk.green(`Policy updated for '${secretPath}'.`));
-        renderPolicySummary(
-          normalizePolicyRecord(
-            secretPath,
-            data.policy ? data : { policy: { path: secretPath, tier, scriptLock } },
-          ),
-        );
-      } catch (err) {
-        console.error(
-          chalk.red("Error:"),
-          err instanceof Error ? err.message : String(err),
-        );
-        process.exit(1);
-      }
-    });
-
-  const script = secrets
-    .command("script")
-    .description("Manage approved scripts for script-locked secrets");
-
-  script
-    .command("approve <path>")
-    .description("Approve a script for a secret path")
-    .requiredOption("--id <scriptId>", "Stable script identifier")
-    .requiredOption("--script <path>", "Path to the local script file")
-    .option(
-      "--remote-path <path>",
-      "Script path reported by the target runtime (defaults to the local path)",
-    )
-    .option(
-      "--attestation <level>",
-      "Attestation level",
-      "self-asserted-hash",
-    )
-    .action(async (
-      secretPath: string,
-      opts: {
-        id: string;
-        script: string;
-        remotePath?: string;
-        attestation: string;
-      },
-    ) => {
-      try {
-        rejectIfPersonal(secrets.opts(), "script approve");
-
-        if (!SECRET_NAME_PATTERN.test(secretPath)) {
-          console.error(chalk.red(`Invalid secret path '${secretPath}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. MY_KEY or PROD/DB_PASSWORD)`));
-          process.exit(1);
-        }
-
-        const usage = await buildSecretUsage(
-          "exec",
-          opts.script,
-          opts.id,
-          opts.attestation,
-        );
-        const token = await requireCognitoTokenForSecrets("secrets");
-        const companyUid = await getEntityUid(
-          token,
-          scopeOpts(secrets.opts()),
-        );
-        const res = await vaultApiFetch({
-          token,
-          path: `/secrets/${encodeURIComponent(companyUid)}/policy/scripts`,
-          method: "POST",
-          body: {
-            path: secretPath,
-            scriptId: usage.script?.scriptId,
-            scriptPath: opts.remotePath ?? usage.script?.path,
-            sha256: usage.script?.sha256,
-            attestationLevel: usage.script?.attestationLevel,
-          },
-        });
-
-        if (!res.ok) {
-          const body = (await res.json().catch(() => ({}))) as Record<string, unknown>;
-          console.error(
-            chalk.red(`Failed to approve script: ${extractApiMessage(body, res.statusText)}`),
-          );
-          process.exit(1);
-        }
-
-        removeCacheEntry(companyUid, secretPath);
-        console.log(chalk.green(`Approved script '${opts.id}' for '${secretPath}'.`));
-      } catch (err) {
-        console.error(
-          chalk.red("Error:"),
-          err instanceof Error ? err.message : String(err),
-        );
-        process.exit(1);
-      }
-    });
-
-  script
-    .command("revoke <path>")
-    .description("Revoke an approved script from a secret path")
-    .requiredOption("--id <scriptId>", "Stable script identifier")
-    .action(async (secretPath: string, opts: { id: string }) => {
-      try {
-        rejectIfPersonal(secrets.opts(), "script revoke");
-
-        if (!SECRET_NAME_PATTERN.test(secretPath)) {
-          console.error(chalk.red(`Invalid secret path '${secretPath}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. MY_KEY or PROD/DB_PASSWORD)`));
-          process.exit(1);
-        }
-
-        const token = await requireCognitoTokenForSecrets("secrets");
-        const companyUid = await getEntityUid(
-          token,
-          scopeOpts(secrets.opts()),
-        );
-        const res = await vaultApiFetch({
-          token,
-          path: `/secrets/${encodeURIComponent(companyUid)}/policy/scripts`,
-          method: "DELETE",
-          body: { path: secretPath, scriptId: opts.id },
-        });
-
-        if (!res.ok) {
-          const body = (await res.json().catch(() => ({}))) as Record<string, unknown>;
-          console.error(
-            chalk.red(`Failed to revoke script: ${extractApiMessage(body, res.statusText)}`),
-          );
-          process.exit(1);
-        }
-
-        removeCacheEntry(companyUid, secretPath);
-        console.log(chalk.green(`Revoked script '${opts.id}' for '${secretPath}'.`));
-      } catch (err) {
-        console.error(
-          chalk.red("Error:"),
-          err instanceof Error ? err.message : String(err),
-        );
-        process.exit(1);
-      }
-    });
-
-  script
-    .command("list <path>")
-    .description("List approved scripts for a secret path")
-    .action(async (secretPath: string) => {
-      try {
-        rejectIfPersonal(secrets.opts(), "script list");
-
-        if (!SECRET_NAME_PATTERN.test(secretPath)) {
-          console.error(chalk.red(`Invalid secret path '${secretPath}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. MY_KEY or PROD/DB_PASSWORD)`));
-          process.exit(1);
-        }
-
-        const token = await requireCognitoTokenForSecrets("secrets");
-        const companyUid = await getEntityUid(
-          token,
-          scopeOpts(secrets.opts()),
-        );
-        const res = await vaultApiFetch({
-          token,
-          path: `/secrets/${encodeURIComponent(companyUid)}/policy`,
-          query: { path: secretPath },
-        });
-
-        if (res.status === 404) {
-          const policyRecord = normalizePolicyRecord(secretPath, {
-            policy: { path: secretPath },
-          });
-          renderPolicySummary(policyRecord);
-          renderPolicyScripts(policyRecord.scripts);
-          return;
-        }
-        if (!res.ok) {
-          const body = (await res.json().catch(() => ({}))) as Record<string, unknown>;
-          console.error(
-            chalk.red(`Failed to list scripts: ${extractApiMessage(body, res.statusText)}`),
-          );
-          process.exit(1);
-        }
-
-        const data = (await res.json()) as SecretPolicyResponse;
-        const policyRecord = normalizePolicyRecord(secretPath, data);
-        renderPolicySummary(policyRecord);
-        renderPolicyScripts(policyRecord.scripts);
-      } catch (err) {
-        console.error(
-          chalk.red("Error:"),
-          err instanceof Error ? err.message : String(err),
-        );
-        process.exit(1);
-      }
-    });
-
-  secrets
-    .command("delete <name>")
-    .description("Delete a secret")
-    .option("--force", "Skip confirmation prompt")
-    .action(async (name: string, opts: { force?: boolean }) => {
-      try {
-        if (!SECRET_NAME_PATTERN.test(name)) {
-          console.error(chalk.red(`Invalid secret name '${name}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. MY_API_KEY or DEV/MY_KEY)`));
-          process.exit(1);
-        }
-
-        if (!opts.force) {
-          const confirmed = await confirmPrompt(
-            `Delete secret '${name}'? This cannot be undone.`,
-          );
-          if (!confirmed) {
-            console.log(chalk.dim("Aborted."));
-            return;
-          }
-        }
-
-        const token = await requireCognitoTokenForSecrets("secrets");
-        const companyUid = await getEntityUid(
-          token,
-          scopeOpts(secrets.opts()),
-        );
-
-        const res = await vaultApiFetch({
-          token,
-          path: buildSecretNamePath(companyUid, name),
-          method: "DELETE",
-        });
-
-        if (!res.ok) {
-          const body = await res.json().catch(() => ({}));
-          console.error(
-            chalk.red(`Failed to delete secret: ${(body as Record<string, string>).error ?? res.statusText}`),
-          );
-          process.exit(1);
-        }
-
-        removeCacheEntry(companyUid, name);
-        console.log(chalk.green(`Secret '${name}' deleted.`));
-      } catch (err) {
-        console.error(
-          chalk.red("Error:"),
-          err instanceof Error ? err.message : String(err),
-        );
-        process.exit(1);
-      }
-    });
-
-  secrets
-    .command("sandbox")
-    .description("Run a command in the hosted sandbox with named secrets injected as env vars; open egress, secrets never touch this machine")
-    .option("--company <slug>", "Company slug (resolves to companyUid)")
-    .option(
-      "--personal",
-      "Operate on the caller's personal vault (no sharing)",
-    )
-    .option("--only <keys>", "Secret names to inject (comma-separated; may be repeated) (required)", collectSecretNames)
-    .allowUnknownOption(true)
-    .action(async (opts: { company?: string; personal?: boolean; only?: string[] }, cmd: Command) => {
-      try {
-        if (!opts.only || opts.only.length === 0) {
-          console.error(chalk.red("Error: --only is required and must name at least one secret."));
-          process.exit(1);
-        }
-
-        const rawArgs = cmd.args;
-        const command = rawArgs.join(" ").trim();
-        if (command.length === 0) {
-          console.error(chalk.red("Error: no command specified. Usage: hq secrets sandbox --company <slug> --only KEY1,KEY2 -- <command>"));
-          process.exit(1);
-        }
-        if (command.length > 8192) {
-          console.error(chalk.red("Error: sandbox command exceeds the 8192 character limit."));
-          process.exit(1);
-        }
-
-        const keys = parseSecretNameList(opts.only);
-        const token = await requireCognitoTokenForSecrets("secrets");
-        const scope = scopeOpts(mergeScopeOpts(secrets.opts(), opts));
-        const companyUid = await getEntityUid(token, scope);
-        const client = new SandboxRunnerClient();
-        const started = await client.startJob(token, {
-          companyUid,
-          secretNames: keys,
-          command,
-        });
-        const job =
-          started.status === "succeeded" || started.status === "failed"
-            ? await client.getJob(token, started.jobId)
-            : await client.pollJob(token, started.jobId);
-
-        renderSandboxJobResult(job, keys);
-        const exitCode = typeof job.exitCode === "number" ? job.exitCode : undefined;
-        if (job.success === false || (exitCode !== undefined && exitCode !== 0) || job.status === "failed") {
-          if (exitCode !== undefined && exitCode !== 0) {
-            console.error(chalk.red(`Sandbox command failed with exit code ${exitCode}.`));
-            process.exit(exitCode);
-          }
-          console.error(
-            chalk.red(
-              job.error !== undefined
-                ? scrubSandboxOutput(job.error, keys)
-                : "Sandbox execution failed before the command produced an exit code.",
-            ),
-          );
-          process.exit(1);
-        }
-      } catch (err) {
-        console.error(
-          chalk.red("Error:"),
-          err instanceof Error ? scrubSandboxOutput(err.message) : scrubSandboxOutput(String(err)),
-        );
-        process.exit(1);
-      }
-    });
-
-  secrets
-    .command("exec")
-    .description("Run a command with secrets injected as env vars")
-    .requiredOption("--only <keys>", "Secret names to inject (comma-separated; may be repeated) (required)", collectSecretNames)
-    .option("--script <path>", "Attach local script identity for script-locked secrets")
-    .option("--script-id <id>", "Stable script identifier approved by policy")
-    .allowUnknownOption(true)
-    .action(async (
-      _opts: { only: string[]; script?: string; scriptId?: string },
-      cmd: Command,
-    ) => {
-      try {
-        const rawArgs = cmd.args;
-        const dashIndex = process.argv.indexOf("--");
-        let childArgs: string[];
-        if (dashIndex !== -1) {
-          childArgs = process.argv.slice(dashIndex + 1);
-        } else {
-          childArgs = rawArgs;
-        }
-
-        if (childArgs.length === 0) {
-          console.error(chalk.red("Error: no command specified. Usage: hq secrets exec --only KEY1,KEY2 -- <command>"));
-          process.exit(1);
-        }
-
-        const keys = parseSecretNameList(_opts.only);
-
-        const cred = await resolveVaultCredential();
-        const companyUid =
-          cred.kind === "api-key"
-            ? "__api_key__"
-            : await getEntityUid(cred.token, scopeOpts(secrets.opts()));
-
-        const revealed = await loadRevealedSecrets(
-          cred.token,
-          companyUid,
-          keys,
-          cred.kind === "cognito"
-            ? await buildSecretUsage("exec", _opts.script, _opts.scriptId)
-            : undefined,
-        );
-
-        const secretEnv: Record<string, string> = {};
-        for (const key of keys) {
-          const value = revealed.get(key);
-          // loadRevealedSecrets throws on any unresolved key, so a miss here is
-          // unreachable — guard rather than inject an `undefined` into the env.
-          if (value === undefined) {
-            throw new Error(`Failed to fetch secret '${key}': not returned by vault`);
-          }
-          secretEnv[key] = value;
-        }
-
-        const [childCmd, ...childCmdArgs] = childArgs;
-        const child = spawn(childCmd, childCmdArgs, {
-          stdio: "inherit",
-          env: { ...process.env, ...secretEnv },
-        });
-
-        child.on("error", (err) => {
-          console.error(chalk.red(`Failed to start command '${childCmd}': ${err.message}`));
-          process.exit(1);
-        });
-
-        child.on("close", (code, signal) => {
-          if (signal) {
-            process.kill(process.pid, signal);
-          }
-          process.exit(code ?? 1);
-        });
-      } catch (err) {
-        console.error(
-          chalk.red("Error:"),
-          err instanceof Error ? err.message : String(err),
-        );
-        process.exit(1);
-      }
-    });
-
-  secrets
-    .command("env")
-    .description("Print 'export KEY=VALUE' lines suitable for: source <(hq secrets env --only K1,K2)")
-    .requiredOption("--only <keys>", "Secret names to print (comma-separated; may be repeated) (required)", collectSecretNames)
-    .option("--script <path>", "Attach local script identity for script-locked secrets")
-    .option("--script-id <id>", "Stable script identifier approved by policy")
-    .action(async (
-      opts: { only: string[]; script?: string; scriptId?: string },
-    ) => {
-      try {
-        const redact = process.stdout.isTTY;
-        if (redact) {
-          console.error(
-            chalk.yellow(
-              "stdout is a terminal — values redacted. Use: source <(hq secrets env --only KEY1,KEY2)",
-            ),
-          );
-        }
-
-        const keys = parseSecretNameList(opts.only);
-
-        const cred = await resolveVaultCredential();
-        const companyUid =
-          cred.kind === "api-key"
-            ? "__api_key__"
-            : await getEntityUid(cred.token, scopeOpts(secrets.opts()));
-
-        const revealed = await loadRevealedSecrets(
-          cred.token,
-          companyUid,
-          keys,
-          cred.kind === "cognito"
-            ? await buildSecretUsage("env", opts.script, opts.scriptId)
-            : undefined,
-        );
-
-        for (const key of keys) {
-          const value = revealed.get(key);
-          // loadRevealedSecrets throws on any unresolved key, so a miss here is
-          // unreachable — guard rather than print an `undefined` export line.
-          if (value === undefined) {
-            throw new Error(`Failed to fetch secret '${key}': not returned by vault`);
-          }
-          const out = redact ? "[REDACTED]" : value;
-          process.stdout.write(`export ${key}=${shellSingleQuote(out)}\n`);
-        }
-      } catch (err) {
-        console.error(
-          chalk.red("Error:"),
-          err instanceof Error ? err.message : String(err),
-        );
-        process.exit(1);
-      }
-    });
-
-  secrets
-    .command("generate-link <name>")
-    .description("Generate a one-time link for someone to submit a secret value")
-    .option("--expires <duration>", "Token expiry duration (e.g. 24h, 2d, 30m)", "24h")
-    .action(async (name: string, opts: { expires: string }) => {
-      try {
-        if (!SECRET_NAME_PATTERN.test(name)) {
-          console.error(chalk.red(`Invalid secret name '${name}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. MY_API_KEY or DEV/MY_KEY)`));
-          process.exit(1);
-        }
-
-        const expiresInMs = parseDuration(opts.expires);
-        if (expiresInMs === null) {
-          console.error(chalk.red(`Invalid duration '${opts.expires}'. Use formats like 30m, 12h, 2d.`));
-          process.exit(1);
-        }
-
-        const MAX_EXPIRY_MS = 7 * 24 * 60 * 60 * 1000;
-        if (expiresInMs > MAX_EXPIRY_MS) {
-          console.error(chalk.red("Maximum expiry is 7 days (7d)."));
-          process.exit(1);
-        }
-
-        const token = await requireCognitoTokenForSecrets("secrets");
-        const companyUid = await getEntityUid(
-          token,
-          scopeOpts(secrets.opts()),
-        );
-
-        const res = await vaultApiFetch({
-          token,
-          path: buildSecretNamePath(companyUid, name),
-          method: "POST",
-          body: { expiresInMs },
-          query: { action: "generate-token" },
-        });
-
-        if (!res.ok) {
-          const body = await res.json().catch(() => ({}));
-          console.error(
-            chalk.red(`Failed to generate link: ${(body as Record<string, string>).error ?? res.statusText}`),
-          );
-          process.exit(1);
-        }
-
-        const data = (await res.json()) as {
-          url: string;
-          expiresAt: string;
-          secretName: string;
-        };
-
-        console.log(chalk.green("Secret input link generated:"));
-        console.log(`\n  ${data.url}\n`);
-        console.log(chalk.dim(`  Secret:  ${data.secretName}`));
-        console.log(chalk.dim(`  Expires: ${data.expiresAt}`));
-        console.log(chalk.dim("  One-time use — link is invalidated after first submission."));
-      } catch (err) {
-        console.error(
-          chalk.red("Error:"),
-          err instanceof Error ? err.message : String(err),
-        );
-        process.exit(1);
-      }
-    });
-
-  secrets
-    .command("share <path>")
-    .description("Share a secret with an email address, group, or the entire company (@all)")
-    .requiredOption("--with <principal>", "Email address, group id, or @all (entire company) to share with")
-    .requiredOption("--permission <level>", "Permission level: read | write | admin")
-    .action(async (path: string, opts: { with: string; permission: string }) => {
-      try {
-        rejectIfPersonal(secrets.opts(), "share");
-
-        if (!SECRET_NAME_PATTERN.test(path)) {
-          console.error(chalk.red(`Invalid secret path '${path}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. MY_KEY or PROD/DB_PASSWORD)`));
-          process.exit(1);
-        }
-
-        if (!["read", "write", "admin"].includes(opts.permission)) {
-          console.error(chalk.red(`Invalid permission '${opts.permission}': must be one of read, write, admin`));
-          process.exit(1);
-        }
-
-        const principal = parseSecretAclPrincipal(opts.with);
-        if (!principal) {
-          process.exit(1);
-        }
-
-        const token = await requireCognitoTokenForSecrets("secrets");
-        const companyUid = await getEntityUid(
-          token,
-          scopeOpts(secrets.opts()),
-        );
-
-        const res = await vaultApiFetch({
-          token,
-          path: `/secrets/${encodeURIComponent(companyUid)}/acl/grant`,
-          method: "POST",
-          body: {
-            path,
-            granteeType: principal.granteeType,
-            granteeId: principal.granteeId,
-            permission: opts.permission,
-          },
-        });
-
-        if (!res.ok) {
-          const body = await res.json().catch(() => ({})) as Record<string, string>;
-          if (res.status === 401) {
-            console.error(chalk.red("Not authenticated — please run `hq login`"));
-          } else if (res.status === 403) {
-            console.error(chalk.red("Not authorized to share this secret"));
-          } else if (res.status === 404) {
-            console.error(chalk.red("ACL record not found for this path — has the secret been created?"));
-          } else if (res.status === 409) {
-            console.error(chalk.red("Concurrent modification — please retry"));
-          } else if (res.status >= 500) {
-            console.error(chalk.red(`Server error: ${body.error ?? res.statusText}`));
-          } else {
-            console.error(chalk.red(body.message ?? body.error ?? "Invalid request"));
-          }
-          process.exit(1);
-        }
-
-        console.log(chalk.green(`Shared '${path}' with ${describeSecretAclPrincipal(principal)} (${opts.permission})`));
-      } catch (err) {
-        console.error(
-          chalk.red("Error:"),
-          err instanceof Error ? err.message : String(err),
-        );
-        process.exit(1);
-      }
-    });
-
-  secrets
-    .command("unshare <path>")
-    .description("Remove a grant from a secret")
-    .requiredOption("--from <principal>", "Email address, group id, or @all (entire company) to remove")
-    .action(async (path: string, opts: { from: string }) => {
-      try {
-        rejectIfPersonal(secrets.opts(), "unshare");
-
-        if (!SECRET_NAME_PATTERN.test(path)) {
-          console.error(chalk.red(`Invalid secret path '${path}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. MY_KEY or PROD/DB_PASSWORD)`));
-          process.exit(1);
-        }
-
-        const principal = parseSecretAclPrincipal(opts.from);
-        if (!principal) {
-          process.exit(1);
-        }
-
-        const token = await requireCognitoTokenForSecrets("secrets");
-        const companyUid = await getEntityUid(
-          token,
-          scopeOpts(secrets.opts()),
-        );
-
-        const res = await vaultApiFetch({
-          token,
-          path: `/secrets/${encodeURIComponent(companyUid)}/acl/revoke`,
-          method: "POST",
-          body: {
-            path,
-            granteeType: principal.granteeType,
-            granteeId: principal.granteeId,
-          },
-        });
-
-        if (!res.ok) {
-          const body = await res.json().catch(() => ({})) as Record<string, string>;
-          if (res.status === 401) {
-            console.error(chalk.red("Not authenticated — please run `hq login`"));
-          } else if (res.status === 403) {
-            console.error(chalk.red("Not authorized to modify this secret's ACL"));
-          } else if (res.status === 404) {
-            console.log(chalk.green(`Grant already absent for '${path}' / ${describeSecretAclPrincipal(principal)}`));
-            return;
-          } else if (res.status >= 500) {
-            console.error(chalk.red(`Server error: ${body.error ?? res.statusText}`));
-          } else {
-            console.error(chalk.red(body.message ?? body.error ?? "Invalid request"));
-          }
-          process.exit(1);
-        }
-
-        console.log(chalk.green(`Removed grant for ${describeSecretAclPrincipal(principal)} on '${path}'`));
-      } catch (err) {
-        console.error(
-          chalk.red("Error:"),
-          err instanceof Error ? err.message : String(err),
-        );
-        process.exit(1);
-      }
-    });
-
-  secrets
-    .command("acl <path>")
-    .description("Show the ACL (access control list) for a secret path")
-    .action(async (path: string) => {
-      try {
-        rejectIfPersonal(secrets.opts(), "acl");
-
-        if (!SECRET_NAME_PATTERN.test(path)) {
-          console.error(chalk.red(`Invalid secret path '${path}': must match ^[A-Z][A-Z0-9_]*(/[A-Z][A-Z0-9_]+)*$ (e.g. MY_KEY or PROD/DB_PASSWORD)`));
-          process.exit(1);
-        }
-
-        const token = await requireCognitoTokenForSecrets("secrets");
-        const companyUid = await getEntityUid(
-          token,
-          scopeOpts(secrets.opts()),
-        );
-
-        const secretPath = path;
-        const res = await vaultApiFetch({
-          token,
-          path: `/secrets/${encodeURIComponent(companyUid)}/acl`,
-          query: { path: secretPath },
-        });
-
-        if (!res.ok) {
-          const body = await res.json().catch(() => ({})) as Record<string, string>;
-          if (res.status === 401) {
-            console.error(chalk.red("Not authenticated — please run `hq login`"));
-          } else if (res.status === 403) {
-            console.error(chalk.red("Not authorized to view this secret's ACL"));
-          } else if (res.status === 404) {
-            console.error(chalk.red(`No ACL record exists for '${path}'`));
-          } else if (res.status >= 500) {
-            console.error(chalk.red(`Server error: ${body.error ?? res.statusText}`));
-          } else {
-            console.error(chalk.red(body.message ?? body.error ?? "Invalid request"));
-          }
-          process.exit(1);
-        }
-
-        const data = (await res.json()) as {
-          acl: {
-            itemType: "ACL";
-            companyUid: string;
-            path: string;
-            creatorUid: string;
-            open?: boolean;
-            entries: Array<{
-              granteeType: string;
-              granteeId: string;
-              permission: string;
-              grantedBy: string;
-              grantedAt: string;
-            }>;
-            createdAt: string;
-            updatedAt: string;
-            schemaVersion: number;
-          };
-        };
-
-        const acl = data.acl;
-        const aclStatus = acl.open ? "open" : "restricted";
-
-        console.log(chalk.green(`ACL for ${acl.path} (${aclStatus})`));
-        console.log(`Creator: ${acl.creatorUid}`);
-
-        if (acl.entries.length === 0) {
-          if (acl.open) {
-            console.log(chalk.gray("Open ACL — all active members have read access."));
-          } else {
-            console.log(chalk.gray("No explicit grants — only creator has access."));
-          }
-          return;
-        }
-
-        console.log("Entries:");
-        const TYPE_W = Math.max(4, ...acl.entries.map((e) => e.granteeType.length));
-        const GRANTEE_W = Math.max(7, ...acl.entries.map((e) => e.granteeId.length));
-        const PERM_W = Math.max(10, ...acl.entries.map((e) => e.permission.length));
-        const BY_W = Math.max(10, ...acl.entries.map((e) => e.grantedBy.length));
-        const tableHeader = [
-          "TYPE".padEnd(TYPE_W),
-          "GRANTEE".padEnd(GRANTEE_W),
-          "PERMISSION".padEnd(PERM_W),
-          "GRANTED_BY".padEnd(BY_W),
-          "GRANTED_AT",
-        ].join("  ");
-        console.log(chalk.bold(tableHeader));
-        for (const e of acl.entries) {
-          const grantedAt = e.grantedAt.slice(0, 10);
-          console.log(
-            [
-              e.granteeType.padEnd(TYPE_W),
-              e.granteeId.padEnd(GRANTEE_W),
-              e.permission.padEnd(PERM_W),
-              e.grantedBy.padEnd(BY_W),
-              grantedAt,
-            ].join("  "),
-          );
-        }
-      } catch (err) {
-        console.error(
-          chalk.red("Error:"),
-          err instanceof Error ? err.message : String(err),
-        );
-        process.exit(1);
-      }
-    });
-
-  const cache = secrets
-    .command("cache")
-    .description("Manage the local secrets cache");
-
-  cache
-    .command("clear")
-    .description("Clear all cached secrets")
-    .action(async () => {
-      clearAllCache();
-      console.log(chalk.green("Secrets cache cleared."));
-    });
-}