@indigoai-us/hq-cli 5.77.14 → 5.79.0

package/src/commands/secrets.test.ts

@@ -1,2050 +0,0 @@
-import {
-  afterEach,
-  beforeEach,
-  describe,
-  expect,
-  it,
-  vi,
-  type MockInstance,
-} from "vitest";
-import { createHash } from "node:crypto";
-import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-
-vi.mock("../utils/cognito-session.js", async (importOriginal) => {
-  const original = (await importOriginal()) as Record<string, unknown>;
-  return {
-    ...original,
-    ensureCognitoToken: vi.fn(async () => "test-token"),
-  };
-});
-
-vi.mock("../utils/vault-api.js", async (importOriginal) => {
-  const original = (await importOriginal()) as Record<string, unknown>;
-  return {
-    ...original,
-    getEntityUid: vi.fn(async () => "prs_alice"),
-    vaultApiFetch: vi.fn(async () =>
-      new Response(
-        JSON.stringify({
-          url: "https://hq.example/secrets-input/tok_secret",
-          expiresAt: "2026-05-12T12:00:00.000Z",
-          secretName: "MY_KEY",
-        }),
-        { status: 200, headers: { "Content-Type": "application/json" } },
-      ),
-    ),
-  };
-});
-
-vi.mock("../utils/secrets-cache.js", async (importOriginal) => {
-  const original = (await importOriginal()) as Record<string, unknown>;
-  return {
-    ...original,
-    readCache: vi.fn(() => null),
-    writeCache: vi.fn(() => undefined),
-    removeCacheEntry: vi.fn(() => undefined),
-  };
-});
-
-vi.mock("node:child_process", () => ({
-  spawn: vi.fn(() => ({
-    on: vi.fn(),
-  })),
-}));
-
-import { Command } from "commander";
-import {
-  registerSecretsCommand,
-  loadRevealedSecrets,
-  type SecretUsageChannel,
-} from "./secrets.js";
-import { spawn } from "node:child_process";
-import { ensureCognitoToken } from "../utils/cognito-session.js";
-import { getEntityUid, vaultApiFetch } from "../utils/vault-api.js";
-import {
-  readCache,
-  removeCacheEntry,
-  writeCache,
-} from "../utils/secrets-cache.js";
-import { SandboxRunnerClient } from "../utils/sandbox-runner-client.js";
-
-let logSpy: MockInstance<typeof console.log>;
-let errSpy: MockInstance<typeof console.error>;
-let tempDir: string;
-
-beforeEach(() => {
-  vi.clearAllMocks();
-  tempDir = mkdtempSync(join(tmpdir(), "hq-secrets-test-"));
-  logSpy = vi.spyOn(console, "log").mockImplementation(() => undefined);
-  errSpy = vi.spyOn(console, "error").mockImplementation(() => undefined);
-});
-
-afterEach(() => {
-  rmSync(tempDir, { recursive: true, force: true });
-  vi.restoreAllMocks();
-});
-
-function buildProgram(): Command {
-  const program = new Command();
-  program.exitOverride();
-  program.configureOutput({
-    writeOut: () => undefined,
-    writeErr: () => undefined,
-  });
-  registerSecretsCommand(program);
-  return program;
-}
-
-function jsonRes(body: unknown, status = 200): Response {
-  return new Response(JSON.stringify(body), {
-    status,
-    headers: { "Content-Type": "application/json" },
-  });
-}
-
-describe("secrets sandbox", () => {
-  let stdoutSpy: MockInstance<typeof process.stdout.write>;
-  let stderrSpy: MockInstance<typeof process.stderr.write>;
-  let exitSpy: MockInstance<typeof process.exit>;
-  let startJobSpy: MockInstance<SandboxRunnerClient["startJob"]>;
-  let pollJobSpy: MockInstance<SandboxRunnerClient["pollJob"]>;
-  let getJobSpy: MockInstance<SandboxRunnerClient["getJob"]>;
-
-  beforeEach(() => {
-    stdoutSpy = vi.spyOn(process.stdout, "write").mockImplementation(() => true);
-    stderrSpy = vi.spyOn(process.stderr, "write").mockImplementation(() => true);
-    startJobSpy = vi
-      .spyOn(SandboxRunnerClient.prototype, "startJob")
-      .mockResolvedValue({ jobId: "job_123", status: "queued" });
-    pollJobSpy = vi
-      .spyOn(SandboxRunnerClient.prototype, "pollJob")
-      .mockResolvedValue({
-        jobId: "job_123",
-        status: "succeeded",
-        output: "done\n",
-        exitCode: 0,
-        success: true,
-      });
-    getJobSpy = vi.spyOn(SandboxRunnerClient.prototype, "getJob");
-    exitSpy = vi.spyOn(process, "exit").mockImplementation((() => {
-      throw new Error("__exit__");
-    }) as never);
-  });
-
-  it("registers the sandbox channel value", () => {
-    const channel: SecretUsageChannel = "sandbox";
-    expect(channel).toBe("sandbox");
-  });
-
-  it("runs a high-security secret in the sandbox without a local script attestation", async () => {
-    const program = buildProgram();
-    await program.parseAsync([
-      "node",
-      "hq",
-      "secrets",
-      "sandbox",
-      "--only",
-      "HIGH_SECURITY_KEY",
-      "--",
-      "env",
-    ]);
-
-    expect(startJobSpy).toHaveBeenCalledWith("test-token", {
-      companyUid: "prs_alice",
-      secretNames: ["HIGH_SECURITY_KEY"],
-      command: "env",
-    });
-    expect(vaultApiFetch).not.toHaveBeenCalledWith(
-      expect.objectContaining({ path: expect.stringContaining("/load") }),
-    );
-  });
-
-  it("parses --company, --only, and joins args after -- into a command", async () => {
-    const program = buildProgram();
-    await program.parseAsync([
-      "node",
-      "hq",
-      "secrets",
-      "sandbox",
-      "--company",
-      "acme",
-      "--only",
-      "API_KEY,OTHER_KEY",
-      "--",
-      "node",
-      "-e",
-      "console.log('hi')",
-      "--days",
-      "7",
-    ]);
-
-    expect(startJobSpy).toHaveBeenCalledWith("test-token", {
-      companyUid: "prs_alice",
-      secretNames: ["API_KEY", "OTHER_KEY"],
-      command: "node -e console.log('hi') --days 7",
-    });
-    expect(stdoutSpy).toHaveBeenCalledWith("done\n");
-  });
-
-  it("accumulates repeated --only flags instead of silently keeping only the last", async () => {
-    const program = buildProgram();
-    await program.parseAsync([
-      "node",
-      "hq",
-      "secrets",
-      "sandbox",
-      "--company",
-      "acme",
-      "--only",
-      "API_KEY,OTHER_KEY",
-      "--only",
-      "THIRD_KEY",
-      "--",
-      "env",
-    ]);
-
-    expect(startJobSpy).toHaveBeenCalledWith("test-token", {
-      companyUid: "prs_alice",
-      secretNames: ["API_KEY", "OTHER_KEY", "THIRD_KEY"],
-      command: "env",
-    });
-  });
-
-  it("requires --only", async () => {
-    const program = buildProgram();
-
-    await expect(
-      program.parseAsync([
-        "node",
-        "hq",
-        "secrets",
-        "sandbox",
-        "--",
-        "env",
-      ]),
-    ).rejects.toThrow("__exit__");
-
-    expect(exitSpy).toHaveBeenCalledWith(1);
-    expect(errSpy.mock.calls.flat().join(" ")).toMatch(/--only is required/i);
-    expect(startJobSpy).not.toHaveBeenCalled();
-  });
-
-  it("requires a command after --", async () => {
-    const program = buildProgram();
-
-    await expect(
-      program.parseAsync([
-        "node",
-        "hq",
-        "secrets",
-        "sandbox",
-        "--only",
-        "API_KEY",
-      ]),
-    ).rejects.toThrow("__exit__");
-
-    expect(exitSpy).toHaveBeenCalledWith(1);
-    expect(errSpy.mock.calls.flat().join(" ")).toMatch(/no command specified/i);
-    expect(startJobSpy).not.toHaveBeenCalled();
-  });
-
-  it("resolves identity before posting the runner job", async () => {
-    const program = buildProgram();
-    await program.parseAsync([
-      "node",
-      "hq",
-      "secrets",
-      "--company",
-      "parent-co",
-      "sandbox",
-      "--only",
-      "API_KEY",
-      "--",
-      "env",
-    ]);
-
-    expect(ensureCognitoToken).toHaveBeenCalled();
-    expect(getEntityUid).toHaveBeenCalledWith("test-token", {
-      personal: false,
-      companySlug: "parent-co",
-    });
-    expect(startJobSpy).toHaveBeenCalledWith("test-token", {
-      companyUid: "prs_alice",
-      secretNames: ["API_KEY"],
-      command: "env",
-    });
-  });
-
-  it("prints server-scrubbed output and never batch-loads secrets locally", async () => {
-    pollJobSpy.mockResolvedValueOnce({
-      jobId: "job_123",
-      status: "succeeded",
-      output: "token [REDACTED]\nAPI_KEY=[REDACTED]\n",
-      exitCode: 0,
-      success: true,
-    });
-
-    const program = buildProgram();
-    await program.parseAsync([
-      "node",
-      "hq",
-      "secrets",
-      "sandbox",
-      "--only",
-      "API_KEY",
-      "--",
-      "my-skill",
-    ]);
-
-    expect(vaultApiFetch).not.toHaveBeenCalledWith(
-      expect.objectContaining({ path: expect.stringContaining("/load") }),
-    );
-    expect(vaultApiFetch).not.toHaveBeenCalledWith(
-      expect.objectContaining({ path: expect.stringContaining("/name/") }),
-    );
-    const rendered = [
-      ...stdoutSpy.mock.calls.flat().map(String),
-      ...stderrSpy.mock.calls.flat().map(String),
-      ...logSpy.mock.calls.flat().map(String),
-      ...errSpy.mock.calls.flat().map(String),
-    ].join("\n");
-    expect(rendered).toContain("[REDACTED]");
-    expect(stdoutSpy).toHaveBeenCalledWith("token [REDACTED]\nAPI_KEY=[REDACTED]\n");
-  });
-
-  it("terminates sandbox output with exactly one newline when output is present", async () => {
-    pollJobSpy.mockResolvedValueOnce({
-      jobId: "job_123",
-      status: "succeeded",
-      output: "123",
-      exitCode: 0,
-      success: true,
-    });
-
-    const program = buildProgram();
-    await program.parseAsync([
-      "node",
-      "hq",
-      "secrets",
-      "sandbox",
-      "--only",
-      "API_KEY",
-      "--",
-      "my-skill",
-    ]);
-
-    expect(stdoutSpy.mock.calls.flat().join("")).toBe("123\n");
-
-    stdoutSpy.mockClear();
-    pollJobSpy.mockResolvedValueOnce({
-      jobId: "job_123",
-      status: "succeeded",
-      output: "123\n",
-      exitCode: 0,
-      success: true,
-    });
-
-    await buildProgram().parseAsync([
-      "node",
-      "hq",
-      "secrets",
-      "sandbox",
-      "--only",
-      "API_KEY",
-      "--",
-      "my-skill",
-    ]);
-
-    expect(stdoutSpy.mock.calls.flat().join("")).toBe("123\n");
-
-    stdoutSpy.mockClear();
-    pollJobSpy.mockResolvedValueOnce({
-      jobId: "job_123",
-      status: "succeeded",
-      output: "",
-      exitCode: 0,
-      success: true,
-    });
-
-    await buildProgram().parseAsync([
-      "node",
-      "hq",
-      "secrets",
-      "sandbox",
-      "--only",
-      "API_KEY",
-      "--",
-      "my-skill",
-    ]);
-
-    expect(stdoutSpy).not.toHaveBeenCalled();
-
-    stdoutSpy.mockClear();
-    pollJobSpy.mockResolvedValueOnce({
-      jobId: "job_123",
-      status: "succeeded",
-      exitCode: 0,
-      success: true,
-    });
-
-    await buildProgram().parseAsync([
-      "node",
-      "hq",
-      "secrets",
-      "sandbox",
-      "--only",
-      "API_KEY",
-      "--",
-      "my-skill",
-    ]);
-
-    expect(stdoutSpy).not.toHaveBeenCalled();
-  });
-
-  it("renders the server error without inventing an exit code when sandbox execution fails", async () => {
-    pollJobSpy.mockResolvedValueOnce({
-      jobId: "job_123",
-      status: "failed",
-      error: "Cloudflare worker timed out with API_KEY=secret-value",
-      success: false,
-    });
-
-    const program = buildProgram();
-    await expect(
-      program.parseAsync([
-        "node",
-        "hq",
-        "secrets",
-        "sandbox",
-        "--only",
-        "API_KEY",
-        "--",
-        "my-skill",
-      ]),
-    ).rejects.toThrow("__exit__");
-
-    const renderedError = errSpy.mock.calls.flat().join(" ");
-    expect(renderedError).toContain("Cloudflare worker timed out with API_KEY=[REDACTED]");
-    // The redacted form appearing is not enough — the raw value must be gone.
-    expect(renderedError).not.toContain("secret-value");
-    expect(renderedError).not.toMatch(/exit code 1/i);
-    expect(exitSpy).toHaveBeenCalledWith(1);
-  });
-
-  it("still explains a failure that carries neither an exit code nor a reason", async () => {
-    pollJobSpy.mockResolvedValueOnce({
-      jobId: "job_123",
-      status: "failed",
-      success: false,
-    });
-
-    const program = buildProgram();
-    await expect(
-      program.parseAsync([
-        "node",
-        "hq",
-        "secrets",
-        "sandbox",
-        "--only",
-        "API_KEY",
-        "--",
-        "my-skill",
-      ]),
-    ).rejects.toThrow("__exit__");
-
-    const renderedError = errSpy.mock.calls.flat().join(" ");
-    expect(renderedError).toMatch(/sandbox execution failed/i);
-    expect(renderedError).not.toMatch(/exit code 1/i);
-    expect(exitSpy).toHaveBeenCalledWith(1);
-  });
-
-  it("preserves the real exit code when the sandbox command exits non-zero", async () => {
-    pollJobSpy.mockResolvedValueOnce({
-      jobId: "job_123",
-      status: "failed",
-      output: "boom\n",
-      exitCode: 2,
-      success: false,
-    });
-
-    const program = buildProgram();
-    await expect(
-      program.parseAsync([
-        "node",
-        "hq",
-        "secrets",
-        "sandbox",
-        "--only",
-        "API_KEY",
-        "--",
-        "my-skill",
-      ]),
-    ).rejects.toThrow("__exit__");
-
-    expect(stdoutSpy).toHaveBeenCalledWith("boom\n");
-    expect(errSpy.mock.calls.flat().join(" ")).toMatch(/exit code 2/i);
-    expect(exitSpy).toHaveBeenCalledWith(2);
-    expect(getJobSpy).not.toHaveBeenCalled();
-  });
-});
-
-// HQ-4H: `hq secrets exists` — HEAD existence probe with shell-chaining exit
-// codes (0=present, 1=absent, 2=error). process.exit is spied so the command's
-// terminal exit doesn't kill the runner; we assert the code it requested.
-describe("secrets exists (HQ-4H HEAD probe)", () => {
-  let exitSpy: MockInstance<typeof process.exit>;
-
-  beforeEach(() => {
-    // Throw so the command stops at its first process.exit (the real runtime
-    // terminates there). The action's own try/catch re-invokes exit(2) on the
-    // thrown sentinel, so we assert on the FIRST recorded exit code — the one
-    // the command actually intended — not the last.
-    exitSpy = vi.spyOn(process, "exit").mockImplementation((() => {
-      throw new Error("__exit__");
-    }) as never);
-  });
-
-  async function firstExitCode(name: string): Promise<number | undefined> {
-    const program = buildProgram();
-    try {
-      await program.parseAsync(["node", "hq", "secrets", "exists", name]);
-    } catch {
-      // sentinel(s) from the exit spy
-    }
-    return exitSpy.mock.calls[0]?.[0] as number | undefined;
-  }
-
-  it("issues a HEAD and intends exit 0 when the secret exists (200)", async () => {
-    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
-      new Response(null, { status: 200 }),
-    );
-
-    const code = await firstExitCode("MY_KEY");
-
-    expect(vaultApiFetch).toHaveBeenCalledWith({
-      token: "test-token",
-      method: "HEAD",
-      path: "/secrets/prs_alice/name/MY_KEY",
-    });
-    expect(code).toBe(0);
-  });
-
-  it("intends exit 1 (absent, not an error) on 404", async () => {
-    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
-      new Response(
-        JSON.stringify({ error: "Secret not found", name: "MISSING" }),
-        { status: 404, headers: { "Content-Type": "application/json" } },
-      ),
-    );
-
-    const code = await firstExitCode("MISSING");
-
-    expect(code).toBe(1);
-  });
-
-  it("intends exit 2 (real failure, distinct from absence) on a 5xx", async () => {
-    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
-      new Response("boom", { status: 503 }),
-    );
-
-    const code = await firstExitCode("MY_KEY");
-
-    expect(code).toBe(2);
-  });
-});
-
-// US-003 (secrets-server-proxy): the CLI surfaces the SERVER's refusal of a
-// high-security ("nuclear") secret on the local-injection path as a clear,
-// actionable sandbox/proxy error — and never prints the value. The server-side
-// deny is the real control (it returns 403 + highSecurity:true and NO
-// plaintext); these tests assert the CLI's surfacing behavior.
-describe("US-003 — CLI refuses high-security secrets on local injection", () => {
-  // The server's 403 refusal shape for a high-security secret.
-  function highSecurityDenied(): Response {
-    return new Response(
-      JSON.stringify({
-        error:
-          "Secret 'ANTHROPIC_API_KEY' is high-security and cannot be retrieved via local injection. Use the server-side proxy.",
-        highSecurity: true,
-      }),
-      { status: 403, headers: { "Content-Type": "application/json" } },
-    );
-  }
-
-  function highSecuritySandboxOnly(): Response {
-    return jsonRes({
-      secrets: [],
-      errors: [
-        {
-          name: "ANTHROPIC_API_KEY",
-          code: "high_security_sandbox_only",
-          message:
-            "High-security-tier secrets can run only in the sandbox (`hq secrets sandbox`) or through the secret proxy. Local injection and script locks (`--script`) are not supported.",
-        },
-      ],
-    });
-  }
-
-  let exitSpy: MockInstance<typeof process.exit>;
-  beforeEach(() => {
-    exitSpy = vi.spyOn(process, "exit").mockImplementation((() => {
-      throw new Error("__exit__");
-    }) as never);
-  });
-
-  it("E2E: `secrets get --reveal` is denied — clear proxy-pointing error, no value printed", async () => {
-    vi.mocked(vaultApiFetch).mockResolvedValueOnce(highSecurityDenied());
-
-    const program = buildProgram();
-    try {
-      await program.parseAsync([
-        "node",
-        "hq",
-        "secrets",
-        "get",
-        "ANTHROPIC_API_KEY",
-        "--reveal",
-      ]);
-    } catch {
-      // exit sentinel
-    }
-    const exitCode = exitSpy.mock.calls[0]?.[0] as number | undefined;
-
-    expect(exitCode).toBe(1);
-    // A clear, actionable error names the sandbox/proxy boundary and rules
-    // out script-lock bypasses.
-    const errText = errSpy.mock.calls.flat().join(" ");
-    expect(errText).toMatch(/high-security/i);
-    expect(errText).toMatch(/hq secrets sandbox/i);
-    expect(errText).toMatch(/proxy/i);
-    expect(errText).toMatch(/--script/);
-    // The value is NEVER printed — no "Value:" line carrying plaintext.
-    const logText = logSpy.mock.calls.flat().join(" ");
-    expect(logText).not.toMatch(/sk-ant/i);
-  });
-
-  it("E2E: `secrets exec --script <path>` is denied — sandbox guidance, command not run", async () => {
-    vi.mocked(vaultApiFetch).mockResolvedValueOnce(highSecuritySandboxOnly());
-    const scriptPath = join(tempDir, "deploy.sh");
-    writeFileSync(scriptPath, "#!/usr/bin/env bash\necho deploy\n");
-
-    const program = buildProgram();
-    try {
-      await program.parseAsync([
-        "node",
-        "hq",
-        "secrets",
-        "exec",
-        "--only",
-        "ANTHROPIC_API_KEY",
-        "--script",
-        scriptPath,
-        "--script-id",
-        "script.deploy",
-        "--",
-        "env",
-      ]);
-    } catch {
-      // exit sentinel
-    }
-    const exitCode = exitSpy.mock.calls[0]?.[0] as number | undefined;
-
-    expect(exitCode).toBe(1);
-    const errText = errSpy.mock.calls.flat().join(" ");
-    expect(errText).toMatch(/high-security/i);
-    expect(errText).toMatch(/hq secrets sandbox/i);
-    expect(errText).toMatch(/proxy/i);
-    expect(errText).toMatch(/--script/);
-    expect(spawn).not.toHaveBeenCalled();
-  });
-});
-
-// secrets-proxy-per-secret-destination US-006: hq-cli creation-side parity.
-// `hq secrets set NAME --high-security --destination <url> [--auth-style ...]`
-// POSTs `highSecurity`/`destinations`/`injection` to the vault API — the CLI
-// counterpart to the console create-form (US-005) and the server contract
-// (US-001/US-004). Value input is exercised via --from-stdin (unaffected by
-// this story) so these tests isolate the new flag-handling/validation.
-describe("US-006 — hq secrets set --high-security --destination parity", () => {
-  let exitSpy: MockInstance<typeof process.exit>;
-  let stdinIsTTYSpy: MockInstance<() => boolean> | undefined;
-
-  beforeEach(() => {
-    exitSpy = vi.spyOn(process, "exit").mockImplementation((() => {
-      throw new Error("__exit__");
-    }) as never);
-  });
-
-  afterEach(() => {
-    stdinIsTTYSpy?.mockRestore();
-    stdinIsTTYSpy = undefined;
-  });
-
-  // Drives the value through the existing --from-stdin path (unchanged by
-  // this story) by feeding a piped-stdin double: mocks isTTY=false and
-  // replaces the data/end listeners `readFromPipedStdin` attaches.
-  function stubPipedStdin(value: string): void {
-    Object.defineProperty(process.stdin, "isTTY", {
-      configurable: true,
-      value: false,
-    });
-    vi.spyOn(process.stdin, "on").mockImplementation(((
-      event: string,
-      cb: (...args: unknown[]) => void,
-    ) => {
-      if (event === "data") cb(value);
-      if (event === "end") cb();
-      return process.stdin;
-    }) as never);
-  }
-
-  it("with no flags, the POST body is byte-for-byte unchanged (just name+value)", async () => {
-    stubPipedStdin("plain-value");
-    vi.mocked(vaultApiFetch).mockResolvedValueOnce(jsonRes({ ok: true }));
-
-    const program = buildProgram();
-    await program.parseAsync([
-      "node",
-      "hq",
-      "secrets",
-      "set",
-      "MY_KEY",
-      "--from-stdin",
-    ]);
-
-    expect(vaultApiFetch).toHaveBeenCalledWith({
-      token: "test-token",
-      path: "/secrets/prs_alice",
-      method: "POST",
-      body: { name: "MY_KEY", value: "plain-value" },
-    });
-    expect(errSpy).not.toHaveBeenCalled();
-  });
-
-  it("--high-security with a KNOWN destination auto-resolves the recipe (no --auth-style needed)", async () => {
-    stubPipedStdin("sk-secret-value");
-    vi.mocked(vaultApiFetch).mockResolvedValueOnce(jsonRes({ ok: true }));
-
-    const program = buildProgram();
-    await program.parseAsync([
-      "node",
-      "hq",
-      "secrets",
-      "set",
-      "OPENAI_KEY",
-      "--from-stdin",
-      "--high-security",
-      "--destination",
-      "https://api.openai.com",
-    ]);
-
-    expect(vaultApiFetch).toHaveBeenCalledWith({
-      token: "test-token",
-      path: "/secrets/prs_alice",
-      method: "POST",
-      body: {
-        name: "OPENAI_KEY",
-        value: "sk-secret-value",
-        highSecurity: true,
-        destinations: ["https://api.openai.com"],
-      },
-    });
-    expect(errSpy).not.toHaveBeenCalled();
-    expect(logSpy.mock.calls.flat().join(" ")).toMatch(/high-security/i);
-  });
-
-  it("--auth-style bearer maps to {header: authorization, scheme: bearer}", async () => {
-    stubPipedStdin("bearer-token-value");
-    vi.mocked(vaultApiFetch).mockResolvedValueOnce(jsonRes({ ok: true }));
-
-    const program = buildProgram();
-    await program.parseAsync([
-      "node",
-      "hq",
-      "secrets",
-      "set",
-      "SOME_BEARER_KEY",
-      "--from-stdin",
-      "--high-security",
-      "--destination",
-      "https://api.example.com",
-      "--auth-style",
-      "bearer",
-    ]);
-
-    expect(vaultApiFetch).toHaveBeenCalledWith({
-      token: "test-token",
-      path: "/secrets/prs_alice",
-      method: "POST",
-      body: {
-        name: "SOME_BEARER_KEY",
-        value: "bearer-token-value",
-        highSecurity: true,
-        destinations: ["https://api.example.com"],
-        injection: { header: "authorization", scheme: "bearer" },
-      },
-    });
-  });
-
-  it("--auth-style x-api-key maps to {header: x-api-key, scheme: raw}", async () => {
-    stubPipedStdin("raw-key-value");
-    vi.mocked(vaultApiFetch).mockResolvedValueOnce(jsonRes({ ok: true }));
-
-    const program = buildProgram();
-    await program.parseAsync([
-      "node",
-      "hq",
-      "secrets",
-      "set",
-      "SOME_RAW_KEY",
-      "--from-stdin",
-      "--high-security",
-      "--destination",
-      "https://api.example.com",
-      "--auth-style",
-      "x-api-key",
-    ]);
-
-    expect(vaultApiFetch).toHaveBeenCalledWith({
-      token: "test-token",
-      path: "/secrets/prs_alice",
-      method: "POST",
-      body: {
-        name: "SOME_RAW_KEY",
-        value: "raw-key-value",
-        highSecurity: true,
-        destinations: ["https://api.example.com"],
-        injection: { header: "x-api-key", scheme: "raw" },
-      },
-    });
-  });
-
-  it("--auth-style header:NAME maps to a custom raw header", async () => {
-    stubPipedStdin("custom-header-value");
-    vi.mocked(vaultApiFetch).mockResolvedValueOnce(jsonRes({ ok: true }));
-
-    const program = buildProgram();
-    await program.parseAsync([
-      "node",
-      "hq",
-      "secrets",
-      "set",
-      "CUSTOM_HEADER_KEY",
-      "--from-stdin",
-      "--high-security",
-      "--destination",
-      "https://api.example.com",
-      "--auth-style",
-      "header:X-Custom-Key",
-    ]);
-
-    expect(vaultApiFetch).toHaveBeenCalledWith({
-      token: "test-token",
-      path: "/secrets/prs_alice",
-      method: "POST",
-      body: {
-        name: "CUSTOM_HEADER_KEY",
-        value: "custom-header-value",
-        highSecurity: true,
-        destinations: ["https://api.example.com"],
-        injection: { header: "X-Custom-Key", scheme: "raw" },
-      },
-    });
-  });
-
-  it("--high-security with an UNKNOWN host and no --auth-style errors clearly, client-side (no request sent)", async () => {
-    const program = buildProgram();
-    await expect(
-      program.parseAsync([
-        "node",
-        "hq",
-        "secrets",
-        "set",
-        "UNKNOWN_HOST_KEY",
-        "--from-stdin",
-        "--high-security",
-        "--destination",
-        "https://api.unknown-vendor.example",
-      ]),
-    ).rejects.toThrow("__exit__");
-
-    expect(exitSpy.mock.calls[0]?.[0]).toBe(1);
-    const errText = errSpy.mock.calls.flat().join(" ");
-    expect(errText).toMatch(/unknown destination host/i);
-    expect(errText).toMatch(/--auth-style/);
-    // Client-side rejection — never reaches the network.
-    expect(vaultApiFetch).not.toHaveBeenCalled();
-  });
-
-  it("--high-security with no --destination errors clearly (non-zero exit, no request sent)", async () => {
-    const program = buildProgram();
-    await expect(
-      program.parseAsync([
-        "node",
-        "hq",
-        "secrets",
-        "set",
-        "MISSING_DEST_KEY",
-        "--from-stdin",
-        "--high-security",
-      ]),
-    ).rejects.toThrow("__exit__");
-
-    expect(exitSpy.mock.calls[0]?.[0]).toBe(1);
-    const errText = errSpy.mock.calls.flat().join(" ");
-    expect(errText).toMatch(/--high-security/);
-    expect(errText).toMatch(/--destination/);
-    expect(vaultApiFetch).not.toHaveBeenCalled();
-  });
-
-  it("--destination without --high-security errors clearly (non-zero exit, no request sent)", async () => {
-    const program = buildProgram();
-    await expect(
-      program.parseAsync([
-        "node",
-        "hq",
-        "secrets",
-        "set",
-        "STRAY_DEST_KEY",
-        "--from-stdin",
-        "--destination",
-        "https://api.openai.com",
-      ]),
-    ).rejects.toThrow("__exit__");
-
-    expect(exitSpy.mock.calls[0]?.[0]).toBe(1);
-    expect(vaultApiFetch).not.toHaveBeenCalled();
-  });
-
-  it("an invalid --destination URL (path segment) errors clearly, client-side", async () => {
-    const program = buildProgram();
-    await expect(
-      program.parseAsync([
-        "node",
-        "hq",
-        "secrets",
-        "set",
-        "BAD_URL_KEY",
-        "--from-stdin",
-        "--high-security",
-        "--destination",
-        "https://api.openai.com/v1",
-      ]),
-    ).rejects.toThrow("__exit__");
-
-    expect(exitSpy.mock.calls[0]?.[0]).toBe(1);
-    const errText = errSpy.mock.calls.flat().join(" ");
-    expect(errText).toMatch(/no path, query, or fragment/i);
-    expect(vaultApiFetch).not.toHaveBeenCalled();
-  });
-
-  it("surfaces the server's rejection message when the backend 400s (e.g. unknown host drift)", async () => {
-    stubPipedStdin("value");
-    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
-      jsonRes(
-        {
-          error:
-            "unknown destination host api.newer-vendor.com: provide an injection recipe (header + scheme)",
-        },
-        400,
-      ),
-    );
-
-    const program = buildProgram();
-    // A host absent from the CLI's own known-set copy but WOULD be flagged
-    // client-side too (this asserts the server-error surfacing path itself
-    // stays intact, using --auth-style to bypass the client-side check and
-    // reach the network).
-    await expect(
-      program.parseAsync([
-        "node",
-        "hq",
-        "secrets",
-        "set",
-        "DRIFT_KEY",
-        "--from-stdin",
-        "--high-security",
-        "--destination",
-        "https://api.newer-vendor.com",
-        "--auth-style",
-        "bearer",
-      ]),
-    ).rejects.toThrow("__exit__");
-
-    expect(exitSpy.mock.calls[0]?.[0]).toBe(1);
-    const errText = errSpy.mock.calls.flat().join(" ");
-    expect(errText).toMatch(/unknown destination host/i);
-  });
-});
-
-describe("secrets generate-link", () => {
-  it("mints one-time submission links for personal secrets", async () => {
-    const program = buildProgram();
-
-    await program.parseAsync([
-      "node",
-      "hq",
-      "secrets",
-      "--personal",
-      "generate-link",
-      "MY_KEY",
-      "--expires",
-      "30m",
-    ]);
-
-    expect(getEntityUid).toHaveBeenCalledWith("test-token", {
-      personal: true,
-      companySlug: undefined,
-    });
-    expect(vaultApiFetch).toHaveBeenCalledWith({
-      token: "test-token",
-      path: "/secrets/prs_alice/name/MY_KEY",
-      method: "POST",
-      body: { expiresInMs: 30 * 60 * 1000 },
-      query: { action: "generate-token" },
-    });
-    expect(logSpy).toHaveBeenCalledWith(
-      expect.stringContaining("Secret input link generated"),
-    );
-    expect(errSpy).not.toHaveBeenCalled();
-  });
-});
-
-describe("secrets share ACL principals", () => {
-  it("grants a secret to a group principal", async () => {
-    vi.mocked(vaultApiFetch).mockResolvedValueOnce(jsonRes({ ok: true }));
-
-    const program = buildProgram();
-    await program.parseAsync([
-      "node",
-      "hq",
-      "secrets",
-      "share",
-      "MY_KEY",
-      "--with",
-      "grp_ops",
-      "--permission",
-      "read",
-    ]);
-
-    expect(vaultApiFetch).toHaveBeenCalledWith({
-      token: "test-token",
-      path: "/secrets/prs_alice/acl/grant",
-      method: "POST",
-      body: {
-        path: "MY_KEY",
-        granteeType: "group",
-        granteeId: "grp_ops",
-        permission: "read",
-      },
-    });
-  });
-
-  it("grants a secret company-wide with @all", async () => {
-    vi.mocked(vaultApiFetch).mockResolvedValueOnce(jsonRes({ ok: true }));
-
-    const program = buildProgram();
-    await program.parseAsync([
-      "node",
-      "hq",
-      "secrets",
-      "share",
-      "MY_KEY",
-      "--with",
-      "@all",
-      "--permission",
-      "read",
-    ]);
-
-    expect(vaultApiFetch).toHaveBeenCalledWith({
-      token: "test-token",
-      path: "/secrets/prs_alice/acl/grant",
-      method: "POST",
-      body: {
-        path: "MY_KEY",
-        granteeType: "company-wide",
-        granteeId: "",
-        permission: "read",
-      },
-    });
-  });
-
-  it("revokes a company-wide grant with @all", async () => {
-    vi.mocked(vaultApiFetch).mockResolvedValueOnce(jsonRes({ ok: true }));
-
-    const program = buildProgram();
-    await program.parseAsync([
-      "node",
-      "hq",
-      "secrets",
-      "unshare",
-      "MY_KEY",
-      "--from",
-      "@all",
-    ]);
-
-    expect(vaultApiFetch).toHaveBeenCalledWith({
-      token: "test-token",
-      path: "/secrets/prs_alice/acl/revoke",
-      method: "POST",
-      body: {
-        path: "MY_KEY",
-        granteeType: "company-wide",
-        granteeId: "",
-      },
-    });
-  });
-});
-
-// HQ-4H — `hq secrets exec`/`env` load secrets through the BATCH-LOAD endpoint
-// (`POST /secrets/{uid}/load`), which returns 200 + per-name `errors[]` and
-// never fires the server's "Secret not found" Sentry warning. The old per-key
-// path single-GET'd `/secrets/{uid}/name/{name}?reveal=true`, and EVERY such
-// 404 made vault-service capture an (unattributable) warning. These tests pin
-// that the caller no longer touches the capturing GET route — the differential
-// at the client boundary that "stops the caller from emitting the error event".
-describe("secrets exec/env batch-load (HQ-4H)", () => {
-  function jsonRes(body: unknown, status = 200): Response {
-    return new Response(JSON.stringify(body), {
-      status,
-      headers: { "Content-Type": "application/json" },
-    });
-  }
-
-  // A path that contains the single-secret GET segment — the route whose 404
-  // fires the capture. The whole fix is that we never call it from exec/env.
-  const CAPTURING_GET = expect.objectContaining({
-    path: expect.stringContaining("/name/"),
-  });
-
-  beforeEach(() => {
-    vi.mocked(readCache).mockReturnValue(null);
-  });
-
-  it("loads via /load (POST) and never the capturing single-secret GET", async () => {
-    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
-      jsonRes({
-        secrets: [
-          { name: "MY_KEY", value: "v1", cacheTtlMs: 300000 },
-          { name: "OTHER", value: "v2", cacheTtlMs: 300000 },
-        ],
-        errors: [],
-      }),
-    );
-
-    const out = await loadRevealedSecrets("test-token", "prs_alice", [
-      "MY_KEY",
-      "OTHER",
-    ]);
-
-    expect(out.get("MY_KEY")).toBe("v1");
-    expect(out.get("OTHER")).toBe("v2");
-    expect(vaultApiFetch).toHaveBeenCalledTimes(1);
-    expect(vaultApiFetch).toHaveBeenCalledWith({
-      token: "test-token",
-      path: "/secrets/prs_alice/load",
-      method: "POST",
-      body: { names: ["MY_KEY", "OTHER"] },
-      signal: expect.any(AbortSignal),
-    });
-    // The crux: the capturing GET route is never touched.
-    expect(vaultApiFetch).not.toHaveBeenCalledWith(CAPTURING_GET);
-    expect(writeCache).toHaveBeenCalledWith("prs_alice", "MY_KEY", "v1", 300000);
-    expect(writeCache).toHaveBeenCalledWith("prs_alice", "OTHER", "v2", 300000);
-  });
-
-  it("controlled policy metadata overrides a malformed positive cache TTL", async () => {
-    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
-      jsonRes({
-        secrets: [
-          {
-            name: "LOCKED",
-            value: "v1",
-            tier: "sensitive",
-            scriptLock: { mode: "enforced" },
-            cacheTtlMs: 300000,
-          },
-        ],
-        errors: [],
-      }),
-    );
-
-    const out = await loadRevealedSecrets("test-token", "prs_alice", [
-      "LOCKED",
-    ]);
-
-    expect(out.get("LOCKED")).toBe("v1");
-    expect(writeCache).not.toHaveBeenCalled();
-    expect(removeCacheEntry).toHaveBeenCalledWith("prs_alice", "LOCKED");
-  });
-
-  it("treats a malformed cache TTL as zero instead of defaulting to a warm cache", async () => {
-    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
-      jsonRes({
-        secrets: [{ name: "LOCKED", value: "v1", cacheTtlMs: "300000" }],
-        errors: [],
-      }),
-    );
-
-    const out = await loadRevealedSecrets("test-token", "prs_alice", [
-      "LOCKED",
-    ]);
-
-    expect(out.get("LOCKED")).toBe("v1");
-    expect(writeCache).not.toHaveBeenCalled();
-    expect(removeCacheEntry).toHaveBeenCalledWith("prs_alice", "LOCKED");
-  });
-
-  it("evicts a stale cache entry when the server returns metadata without plaintext", async () => {
-    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
-      jsonRes({
-        secrets: [{ name: "LOCKED", cacheTtlMs: 0 }],
-        errors: [],
-      }),
-    );
-
-    await expect(
-      loadRevealedSecrets("test-token", "prs_alice", ["LOCKED"]),
-    ).rejects.toThrow("Secret 'LOCKED' has no value");
-
-    expect(removeCacheEntry).toHaveBeenCalledWith("prs_alice", "LOCKED");
-  });
-
-  it("evicts every unresolved cache entry before reporting the first batch failure", async () => {
-    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
-      jsonRes({
-        secrets: [{ name: "VALUELESS", cacheTtlMs: 0 }],
-        errors: [
-          { name: "DENIED", code: "forbidden", message: "No read permission" },
-        ],
-      }),
-    );
-
-    await expect(
-      loadRevealedSecrets("test-token", "prs_alice", [
-        "VALUELESS",
-        "DENIED",
-        "OMITTED",
-      ]),
-    ).rejects.toThrow("Secret 'VALUELESS' has no value");
-
-    expect(removeCacheEntry).toHaveBeenCalledWith("prs_alice", "VALUELESS");
-    expect(removeCacheEntry).toHaveBeenCalledWith("prs_alice", "DENIED");
-    expect(removeCacheEntry).toHaveBeenCalledWith("prs_alice", "OMITTED");
-  });
-
-  it("a missing key fails cleanly WITHOUT hitting the GET-404 capture path", async () => {
-    // Batch-load reports absence as a 200 body `errors[]` entry — no 404, no
-    // server capture. The old code GET'd `/name/MISSING` → 404 → warning.
-    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
-      jsonRes({
-        secrets: [],
-        errors: [{ name: "MISSING", code: "not_found" }],
-      }),
-    );
-
-    await expect(
-      loadRevealedSecrets("test-token", "prs_alice", ["MISSING"]),
-    ).rejects.toThrow("Failed to fetch secret 'MISSING': Secret not found");
-
-    expect(vaultApiFetch).toHaveBeenCalledTimes(1);
-    expect(vaultApiFetch).toHaveBeenCalledWith(
-      expect.objectContaining({ path: "/secrets/prs_alice/load", method: "POST" }),
-    );
-    expect(vaultApiFetch).not.toHaveBeenCalledWith(CAPTURING_GET);
-  });
-
-  it("a forbidden key surfaces as a clean per-key error", async () => {
-    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
-      jsonRes({
-        secrets: [],
-        errors: [
-          { name: "LOCKED", code: "forbidden", message: "No read permission" },
-        ],
-      }),
-    );
-
-    await expect(
-      loadRevealedSecrets("test-token", "prs_alice", ["LOCKED"]),
-    ).rejects.toThrow("Failed to fetch secret 'LOCKED': No read permission");
-    expect(vaultApiFetch).not.toHaveBeenCalledWith(CAPTURING_GET);
-  });
-
-  it("revalidates a previously cached secret and evicts it after remote ACL revocation", async () => {
-    vi.mocked(vaultApiFetch)
-      .mockResolvedValueOnce(
-        jsonRes({
-          secrets: [
-            { name: "CACHED", value: "cached-value", cacheTtlMs: 300000 },
-          ],
-          errors: [],
-        }),
-      )
-      .mockResolvedValueOnce(
-        jsonRes({
-          secrets: [],
-          errors: [
-            {
-              name: "CACHED",
-              code: "forbidden",
-              message: "No read permission",
-            },
-          ],
-        }),
-      );
-
-    const first = await loadRevealedSecrets("test-token", "prs_alice", [
-      "CACHED",
-    ]);
-    expect(first.get("CACHED")).toBe("cached-value");
-    expect(writeCache).toHaveBeenCalledWith(
-      "prs_alice",
-      "CACHED",
-      "cached-value",
-      300000,
-    );
-
-    // Model the encrypted disk entry left by the first call. A pre-fix warm
-    // lookup would return this value without contacting the server.
-    vi.mocked(readCache).mockReturnValue("cached-value");
-
-    await expect(
-      loadRevealedSecrets("test-token", "prs_alice", ["CACHED"]),
-    ).rejects.toThrow("Failed to fetch secret 'CACHED': No read permission");
-
-    expect(vaultApiFetch).toHaveBeenCalledTimes(2);
-    expect(readCache).not.toHaveBeenCalled();
-    expect(removeCacheEntry).toHaveBeenCalledWith("prs_alice", "CACHED");
-  });
-
-  it("evicts every requested entry when a stale session is rejected", async () => {
-    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
-      jsonRes({ error: "Unauthorized", code: "session_expired" }, 401),
-    );
-
-    await expect(
-      loadRevealedSecrets("stale-token", "prs_alice", ["FIRST", "SECOND"]),
-    ).rejects.toThrow("Unauthorized");
-
-    expect(removeCacheEntry).toHaveBeenCalledWith("prs_alice", "FIRST");
-    expect(removeCacheEntry).toHaveBeenCalledWith("prs_alice", "SECOND");
-  });
-
-  it("fails closed and evicts every entry on an offline network failure", async () => {
-    vi.mocked(vaultApiFetch).mockRejectedValueOnce(
-      new TypeError("fetch failed: ENETUNREACH"),
-    );
-
-    await expect(
-      loadRevealedSecrets("test-token", "prs_alice", ["FIRST", "SECOND"]),
-    ).rejects.toThrow("ENETUNREACH");
-
-    expect(removeCacheEntry).toHaveBeenCalledWith("prs_alice", "FIRST");
-    expect(removeCacheEntry).toHaveBeenCalledWith("prs_alice", "SECOND");
-  });
-
-  it("fails closed and evicts every entry when authorization times out", async () => {
-    vi.mocked(vaultApiFetch).mockRejectedValueOnce(
-      new DOMException("The operation was aborted due to timeout", "TimeoutError"),
-    );
-
-    await expect(
-      loadRevealedSecrets("test-token", "prs_alice", ["FIRST", "SECOND"]),
-    ).rejects.toThrow("timeout");
-
-    expect(removeCacheEntry).toHaveBeenCalledWith("prs_alice", "FIRST");
-    expect(removeCacheEntry).toHaveBeenCalledWith("prs_alice", "SECOND");
-  });
-
-  it("evicts earlier successful chunks when a later authorization chunk fails", async () => {
-    const keys = Array.from({ length: 101 }, (_, i) => `KEY_${i}`);
-    vi.mocked(vaultApiFetch)
-      .mockResolvedValueOnce(
-        jsonRes({
-          secrets: keys.slice(0, 100).map((name) => ({
-            name,
-            value: `value-for-${name}`,
-            cacheTtlMs: 300000,
-          })),
-          errors: [],
-        }),
-      )
-      .mockResolvedValueOnce(
-        jsonRes({ error: "No read permission", code: "forbidden" }, 403),
-      );
-
-    await expect(
-      loadRevealedSecrets("test-token", "prs_alice", keys),
-    ).rejects.toThrow("No read permission");
-
-    expect(writeCache).toHaveBeenCalledWith(
-      "prs_alice",
-      "KEY_0",
-      "value-for-KEY_0",
-      300000,
-    );
-    expect(removeCacheEntry).toHaveBeenCalledWith("prs_alice", "KEY_0");
-    expect(removeCacheEntry).toHaveBeenCalledWith("prs_alice", "KEY_100");
-  });
-
-  it("rejects mixed success/error rows and evicts without exposing the value", async () => {
-    const secretValue = "sentinel-secret-value";
-    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
-      jsonRes({
-        secrets: [{ name: "MIXED", value: secretValue, cacheTtlMs: 300000 }],
-        errors: [{ name: "MIXED", code: "forbidden", message: "Denied" }],
-      }),
-    );
-
-    let failure: Error | undefined;
-    try {
-      await loadRevealedSecrets("test-token", "prs_alice", ["MIXED"]);
-    } catch (err) {
-      failure = err as Error;
-    }
-
-    expect(failure?.message).toBe("Invalid secret load response from vault");
-    expect(failure?.message).not.toContain(secretValue);
-    expect(removeCacheEntry).toHaveBeenCalledWith("prs_alice", "MIXED");
-  });
-
-  it("rejects malformed response envelopes and evicts every requested entry", async () => {
-    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
-      jsonRes({ secrets: { name: "FIRST", value: "hidden" }, errors: [] }),
-    );
-
-    await expect(
-      loadRevealedSecrets("test-token", "prs_alice", ["FIRST", "SECOND"]),
-    ).rejects.toThrow("Invalid secret load response from vault");
-
-    expect(removeCacheEntry).toHaveBeenCalledWith("prs_alice", "FIRST");
-    expect(removeCacheEntry).toHaveBeenCalledWith("prs_alice", "SECOND");
-  });
-
-  it("a non-2xx batch response throws the batch-load error", async () => {
-    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
-      jsonRes({ error: "Internal server error" }, 500),
-    );
-
-    await expect(
-      loadRevealedSecrets("test-token", "prs_alice", ["K"]),
-    ).rejects.toThrow("Failed to batch-load secrets: Internal server error");
-  });
-});
-
-describe("secrets script usage", () => {
-  it("exec hashes the script and sends usage metadata on /load", async () => {
-    const scriptPath = join(tempDir, "exec-script.sh");
-    const scriptBody = "#!/usr/bin/env bash\necho exec\n";
-    writeFileSync(scriptPath, scriptBody);
-    const expectedSha = createHash("sha256").update(scriptBody).digest("hex");
-    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
-      jsonRes({
-        secrets: [{ name: "MY_KEY", value: "v1", cacheTtlMs: 300000 }],
-        errors: [],
-      }),
-    );
-
-    const program = buildProgram();
-    await program.parseAsync([
-      "node",
-      "hq",
-      "secrets",
-      "exec",
-      "--only",
-      "MY_KEY",
-      "--script",
-      scriptPath,
-      "--script-id",
-      "scripts/exec-script.sh",
-      "--",
-      "env",
-    ]);
-
-    expect(vaultApiFetch).toHaveBeenCalledWith({
-      token: "test-token",
-      path: "/secrets/prs_alice/load",
-      method: "POST",
-      body: {
-        names: ["MY_KEY"],
-        usage: {
-          channel: "exec",
-          script: {
-            scriptId: "scripts/exec-script.sh",
-            path: scriptPath,
-            sha256: expectedSha,
-            attestationLevel: "self-asserted-hash",
-          },
-        },
-      },
-      signal: expect.any(AbortSignal),
-    });
-    expect(spawn).toHaveBeenCalledWith(
-      "env",
-      [],
-      expect.objectContaining({
-        stdio: "inherit",
-        env: expect.objectContaining({ MY_KEY: "v1" }),
-      }),
-    );
-  });
-
-  it("env hashes the script and sends usage metadata on /load", async () => {
-    const scriptPath = join(tempDir, "env-script.sh");
-    const scriptBody = "#!/usr/bin/env bash\necho env\n";
-    writeFileSync(scriptPath, scriptBody);
-    const expectedSha = createHash("sha256").update(scriptBody).digest("hex");
-    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
-      jsonRes({
-        secrets: [{ name: "MY_KEY", value: "v1", cacheTtlMs: 300000 }],
-        errors: [],
-      }),
-    );
-
-    const stdoutWriteSpy = vi
-      .spyOn(process.stdout, "write")
-      .mockImplementation(() => true);
-
-    const program = buildProgram();
-    await program.parseAsync([
-      "node",
-      "hq",
-      "secrets",
-      "env",
-      "--only",
-      "MY_KEY",
-      "--script",
-      scriptPath,
-    ]);
-
-    expect(vaultApiFetch).toHaveBeenCalledWith({
-      token: "test-token",
-      path: "/secrets/prs_alice/load",
-      method: "POST",
-      body: {
-        names: ["MY_KEY"],
-        usage: {
-          channel: "env",
-          script: {
-            scriptId: scriptPath,
-            path: scriptPath,
-            sha256: expectedSha,
-            attestationLevel: "self-asserted-hash",
-          },
-        },
-      },
-      signal: expect.any(AbortSignal),
-    });
-    expect(stdoutWriteSpy).toHaveBeenCalledWith("export MY_KEY='v1'\n");
-  });
-});
-
-describe("secrets reveal and policy controls", () => {
-  it("get --reveal prints the backend denial message from a controlled secret", async () => {
-    const exitSpy = vi.spyOn(process, "exit").mockImplementation((() => {
-      throw new Error("__exit__");
-    }) as never);
-    vi.mocked(vaultApiFetch)
-      .mockResolvedValueOnce(
-        jsonRes({
-          secret: {
-            name: "LOCKED",
-            companyUid: "prs_alice",
-            tier: "nuclear",
-            scriptLock: { mode: "enforced" },
-          },
-        }),
-      )
-      .mockResolvedValueOnce(
-        jsonRes(
-          {
-            code: "reveal_disabled",
-            message: "Reveal is disabled for this secret.",
-          },
-          403,
-        ),
-      );
-
-    const program = buildProgram();
-    await expect(
-      program.parseAsync([
-        "node",
-        "hq",
-        "secrets",
-        "get",
-        "LOCKED",
-        "--reveal",
-      ]),
-    ).rejects.toThrow("__exit__");
-
-    expect(exitSpy.mock.calls[0]?.[0]).toBe(1);
-    expect(logSpy).toHaveBeenCalledWith("  Tier:          nuclear");
-    expect(logSpy).toHaveBeenCalledWith("  Script Lock:   enforced");
-    expect(errSpy.mock.calls.some((call) =>
-      call.some((arg) => String(arg).includes("Reveal is disabled for this secret.")),
-    )).toBe(true);
-  });
-
-  it("policy get hits the policy endpoint and renders tier/lock", async () => {
-    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
-      jsonRes({
-        policy: {
-          path: "LOCKED",
-          tier: "nuclear",
-          scriptLock: { mode: "enforced" },
-        },
-      }),
-    );
-
-    const program = buildProgram();
-    await program.parseAsync([
-      "node",
-      "hq",
-      "secrets",
-      "policy",
-      "get",
-      "LOCKED",
-    ]);
-
-    expect(vaultApiFetch).toHaveBeenCalledWith({
-      token: "test-token",
-      path: "/secrets/prs_alice/policy",
-      query: { path: "LOCKED" },
-    });
-    expect(logSpy).toHaveBeenCalledWith(expect.stringContaining("Policy: LOCKED"));
-    expect(logSpy).toHaveBeenCalledWith("  Tier:          nuclear");
-    expect(logSpy).toHaveBeenCalledWith("  Script Lock:   enforced");
-  });
-
-  it("list renders tier and script lock columns", async () => {
-    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
-      jsonRes({
-        secrets: [
-          {
-            name: "LOCKED",
-            permission: "read",
-            tier: "nuclear",
-            scriptLock: { mode: "enforced" },
-            lastModifiedDate: "2026-06-18T00:00:00.000Z",
-          },
-        ],
-      }),
-    );
-
-    const program = buildProgram();
-    await program.parseAsync(["node", "hq", "secrets", "list"]);
-
-    expect(logSpy).toHaveBeenCalledWith(
-      expect.stringContaining("SCRIPT LOCK"),
-    );
-    expect(logSpy).toHaveBeenCalledWith(
-      expect.stringContaining("nuclear"),
-    );
-    expect(logSpy).toHaveBeenCalledWith(
-      expect.stringContaining("enforced"),
-    );
-  });
-
-  it("policy set hits the policy endpoint with tier and script lock", async () => {
-    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
-      jsonRes({
-        policy: {
-          path: "LOCKED",
-          tier: "nuclear",
-          scriptLock: { mode: "enforced" },
-        },
-      }),
-    );
-
-    const program = buildProgram();
-    await program.parseAsync([
-      "node",
-      "hq",
-      "secrets",
-      "policy",
-      "set",
-      "LOCKED",
-      "--tier",
-      "nuclear",
-      "--lock-script",
-      "enforce",
-    ]);
-
-    expect(vaultApiFetch).toHaveBeenCalledWith({
-      token: "test-token",
-      path: "/secrets/prs_alice/policy",
-      method: "PUT",
-      body: {
-        path: "LOCKED",
-        tier: "nuclear",
-        scriptLock: { mode: "enforced" },
-      },
-    });
-    expect(logSpy).toHaveBeenCalledWith("  Tier:          nuclear");
-    expect(logSpy).toHaveBeenCalledWith("  Script Lock:   enforced");
-    expect(removeCacheEntry).toHaveBeenCalledWith("prs_alice", "LOCKED");
-  });
-
-  it("script approve hashes the local file and hits the approval endpoint", async () => {
-    const scriptPath = join(tempDir, "approved.sh");
-    const scriptBody = "#!/usr/bin/env bash\necho approved\n";
-    writeFileSync(scriptPath, scriptBody);
-    const expectedSha = createHash("sha256").update(scriptBody).digest("hex");
-    vi.mocked(vaultApiFetch).mockResolvedValueOnce(jsonRes({ ok: true }));
-
-    const program = buildProgram();
-    await program.parseAsync([
-      "node",
-      "hq",
-      "secrets",
-      "script",
-      "approve",
-      "LOCKED",
-      "--id",
-      "deploy-script",
-      "--script",
-      scriptPath,
-    ]);
-
-    expect(vaultApiFetch).toHaveBeenCalledWith({
-      token: "test-token",
-      path: "/secrets/prs_alice/policy/scripts",
-      method: "POST",
-      body: {
-        path: "LOCKED",
-        scriptId: "deploy-script",
-        scriptPath,
-        sha256: expectedSha,
-        attestationLevel: "self-asserted-hash",
-      },
-    });
-    expect(removeCacheEntry).toHaveBeenCalledWith("prs_alice", "LOCKED");
-  });
-
-  it("script approve hashes the local file while approving a remote runtime path", async () => {
-    const scriptPath = join(tempDir, "approved.sh");
-    const remotePath =
-      "/home/ec2-user/hq-agent/companies/acme/scripts/approved.sh";
-    const scriptBody = "#!/usr/bin/env bash\necho approved remotely\n";
-    writeFileSync(scriptPath, scriptBody);
-    const expectedSha = createHash("sha256").update(scriptBody).digest("hex");
-    vi.mocked(vaultApiFetch).mockResolvedValueOnce(jsonRes({ ok: true }));
-
-    const program = buildProgram();
-    await program.parseAsync([
-      "node",
-      "hq",
-      "secrets",
-      "script",
-      "approve",
-      "LOCKED",
-      "--id",
-      "deploy-script",
-      "--script",
-      scriptPath,
-      "--remote-path",
-      remotePath,
-    ]);
-
-    expect(vaultApiFetch).toHaveBeenCalledWith({
-      token: "test-token",
-      path: "/secrets/prs_alice/policy/scripts",
-      method: "POST",
-      body: {
-        path: "LOCKED",
-        scriptId: "deploy-script",
-        scriptPath: remotePath,
-        sha256: expectedSha,
-        attestationLevel: "self-asserted-hash",
-      },
-    });
-    expect(removeCacheEntry).toHaveBeenCalledWith("prs_alice", "LOCKED");
-  });
-
-  it("script revoke hits the revoke endpoint", async () => {
-    vi.mocked(vaultApiFetch).mockResolvedValueOnce(jsonRes({ ok: true }));
-
-    const program = buildProgram();
-    await program.parseAsync([
-      "node",
-      "hq",
-      "secrets",
-      "script",
-      "revoke",
-      "LOCKED",
-      "--id",
-      "deploy-script",
-    ]);
-
-    expect(vaultApiFetch).toHaveBeenCalledWith({
-      token: "test-token",
-      path: "/secrets/prs_alice/policy/scripts",
-      method: "DELETE",
-      body: {
-        path: "LOCKED",
-        scriptId: "deploy-script",
-      },
-    });
-    expect(removeCacheEntry).toHaveBeenCalledWith("prs_alice", "LOCKED");
-  });
-
-  it("script list maps the server's scriptLock.approvedScripts response shape", async () => {
-    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
-      jsonRes({
-        policy: {
-          path: "LOCKED",
-          tier: "nuclear",
-          scriptLock: {
-            mode: "enforced",
-            requiredAttestation: "self-asserted-hash",
-            approvedScripts: [
-              {
-                scriptId: "deploy-script",
-                path: "/tmp/deploy.sh",
-                sha256: "abc123",
-                attestationLevel: "self-asserted-hash",
-                approvedAt: "2026-01-01T00:00:00.000Z",
-                approvedBy: "prs_owner",
-              },
-              {
-                scriptId: "revoked-script",
-                path: "/tmp/old.sh",
-                sha256: "def456",
-                attestationLevel: "self-asserted-hash",
-                approvedAt: "2025-12-01T00:00:00.000Z",
-                approvedBy: "prs_owner",
-                revokedAt: "2026-01-02T00:00:00.000Z",
-              },
-            ],
-          },
-        },
-      }),
-    );
-
-    const program = buildProgram();
-    await program.parseAsync([
-      "node",
-      "hq",
-      "secrets",
-      "script",
-      "list",
-      "LOCKED",
-    ]);
-
-    expect(vaultApiFetch).toHaveBeenCalledWith({
-      token: "test-token",
-      path: "/secrets/prs_alice/policy",
-      query: { path: "LOCKED" },
-    });
-    expect(logSpy).toHaveBeenCalledWith("  Tier:          nuclear");
-    expect(logSpy).toHaveBeenCalledWith("  Script Lock:   enforced");
-    expect(logSpy).toHaveBeenCalledWith(
-      expect.stringContaining("deploy-script"),
-    );
-    expect(logSpy).toHaveBeenCalledWith(
-      expect.stringContaining("/tmp/deploy.sh"),
-    );
-    expect(logSpy).not.toHaveBeenCalledWith(
-      expect.stringContaining("revoked-script"),
-    );
-  });
-
-  it("script list ignores malformed modern rows without falling back to stale legacy rows", async () => {
-    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
-      jsonRes({
-        policy: {
-          path: "LOCKED",
-          tier: "sensitive",
-          scriptLock: {
-            mode: "enforced",
-            approvedScripts: [
-              null,
-              { scriptId: "missing-path", attestationLevel: "self-asserted-hash" },
-              {
-                scriptId: "active-modern",
-                path: "/tmp/active.sh",
-                attestationLevel: "self-asserted-hash",
-              },
-            ],
-          },
-          scripts: [
-            {
-              scriptId: "stale-legacy",
-              scriptPath: "/tmp/stale.sh",
-              sha256: "stale",
-              attestationLevel: "self-asserted-hash",
-            },
-          ],
-        },
-      }),
-    );
-
-    const program = buildProgram();
-    await program.parseAsync([
-      "node",
-      "hq",
-      "secrets",
-      "script",
-      "list",
-      "LOCKED",
-    ]);
-
-    expect(logSpy).toHaveBeenCalledWith(
-      expect.stringContaining("active-modern"),
-    );
-    expect(logSpy).not.toHaveBeenCalledWith(
-      expect.stringContaining("missing-path"),
-    );
-    expect(logSpy).not.toHaveBeenCalledWith(
-      expect.stringContaining("stale-legacy"),
-    );
-  });
-});
-
-describe("HQ_API_KEY consume path", () => {
-  let exitSpy: MockInstance<typeof process.exit>;
-
-  beforeEach(() => {
-    exitSpy = vi
-      .spyOn(process, "exit")
-      .mockImplementation(((code?: number) => {
-        throw new Error(`__EXIT__:${code ?? 0}`);
-      }) as never);
-  });
-
-  afterEach(() => {
-    delete process.env.HQ_API_KEY;
-  });
-
-  it("rejects secrets list when HQ_API_KEY is set (no Cognito fallback)", async () => {
-    process.env.HQ_API_KEY = "hqk_probe";
-    const program = buildProgram();
-    await expect(
-      program.parseAsync(["node", "hq", "secrets", "list"]),
-    ).rejects.toThrow(/__EXIT__:1/);
-    expect(ensureCognitoToken).not.toHaveBeenCalled();
-    expect(vaultApiFetch).not.toHaveBeenCalled();
-    const errText = errSpy.mock.calls
-      .map((call) => call.map(String).join(" "))
-      .join("\n");
-    expect(errText).toMatch(/not supported for API keys/);
-  });
-
-  it("rejects invalid HQ_API_KEY prefix without Cognito fallback", async () => {
-    process.env.HQ_API_KEY = "hqd_not_a_vault_key";
-    const program = buildProgram();
-    await expect(
-      program.parseAsync(["node", "hq", "secrets", "get", "FOO"]),
-    ).rejects.toThrow(/__EXIT__:1/);
-    expect(ensureCognitoToken).not.toHaveBeenCalled();
-    const errText = errSpy.mock.calls
-      .map((call) => call.map(String).join(" "))
-      .join("\n");
-    expect(errText).toMatch(/must start with 'hqk_'/);
-  });
-
-  it("rejects secrets get without --reveal when HQ_API_KEY is set", async () => {
-    process.env.HQ_API_KEY = "hqk_valid_key";
-    const program = buildProgram();
-    await expect(
-      program.parseAsync(["node", "hq", "secrets", "get", "FOO"]),
-    ).rejects.toThrow(/__EXIT__:1/);
-    expect(vaultApiFetch).not.toHaveBeenCalled();
-    const errText = errSpy.mock.calls
-      .map((call) => call.map(String).join(" "))
-      .join("\n");
-    expect(errText).toMatch(/without --reveal is not supported/);
-  });
-
-  it("gets a secret via /v1/keys/secrets/fetch when HQ_API_KEY is set", async () => {
-    process.env.HQ_API_KEY = "hqk_valid_key";
-    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
-      jsonRes({
-        secret: {
-          name: "FOO",
-          value: "secret-value",
-          version: 1,
-          tier: "standard",
-        },
-      }),
-    );
-
-    const program = buildProgram();
-    await program.parseAsync([
-      "node",
-      "hq",
-      "secrets",
-      "get",
-      "FOO",
-      "--reveal",
-    ]);
-
-    expect(ensureCognitoToken).not.toHaveBeenCalled();
-    expect(vaultApiFetch).toHaveBeenCalledWith(
-      expect.objectContaining({
-        token: "hqk_valid_key",
-        path: "/v1/keys/secrets/fetch",
-        method: "POST",
-        body: { name: "FOO" },
-      }),
-    );
-    const printed = logSpy.mock.calls
-      .map((call) => call.map(String).join(" "))
-      .join("\n");
-    expect(printed).toContain("FOO");
-    expect(printed).toContain("secret-value");
-    expect(exitSpy).not.toHaveBeenCalled();
-  });
-
-  it("fails --reveal when API-key fetch omits secret.value", async () => {
-    process.env.HQ_API_KEY = "hqk_valid_key";
-    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
-      jsonRes({
-        secret: {
-          name: "FOO",
-          version: 1,
-          tier: "standard",
-        },
-      }),
-    );
-
-    const program = buildProgram();
-    await expect(
-      program.parseAsync([
-        "node",
-        "hq",
-        "secrets",
-        "get",
-        "FOO",
-        "--reveal",
-      ]),
-    ).rejects.toThrow(/__EXIT__:1/);
-    const errText = errSpy.mock.calls
-      .map((call) => call.map(String).join(" "))
-      .join("\n");
-    expect(errText).toMatch(/omitted secret\.value/);
-    const printed = logSpy.mock.calls
-      .map((call) => call.map(String).join(" "))
-      .join("\n");
-    expect(printed).not.toContain("[REDACTED]");
-  });
-
-  it("loadRevealedSecrets uses fetch endpoint for hqk_ tokens", async () => {
-    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
-      jsonRes({
-        secret: { name: "A", value: "va" },
-      }),
-    );
-    const out = await loadRevealedSecrets("hqk_tok", "cmp_x", ["A"]);
-    expect(out.get("A")).toBe("va");
-    expect(vaultApiFetch).toHaveBeenCalledWith(
-      expect.objectContaining({
-        path: "/v1/keys/secrets/fetch",
-        method: "POST",
-        body: { name: "A" },
-      }),
-    );
-  });
-});