secrets/CHANGELOG.md

# Changelog

All notable changes to this project will be documented in this file.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
and this project adheres to a four-digit MAJOR.MINOR.PATCH.MICRO version scheme.

## [0.7.6.0] - 2026-09-08

### Added

- **`secrets sync` — reconcile a diverged store (EGB-1231)** — the store is a
  git repo, and once a clone was both ahead and behind its remote the CLI had
  no way out: `push` demanded a fast-forward and pointed at `pull`, which
  could not fast-forward either, so the advice looped and recovery meant
  hand-running git next to a directory of encrypted blobs. `secrets sync`
  fetches, stashes uncommitted blob edits, rebases local commits onto the
  remote, restores the stash, and then asks before publishing local commits to
  the shared store. `--yes` skips the prompt (scripts/CI); `--dry-run` reports
  ahead/behind/dirty and what would happen, changing nothing. Deliberately
  non-destructive: no merge, no force-push, no `reset --hard`, no `stash
  drop`. A rebase conflict aborts, restores the stash, names the conflicting
  files, and leaves the store exactly as found.
- **Store state in `secrets which` (EGB-1231)** — a new `remote:` line reports
  the store's `ahead N, behind N, N modified` (or `up to date`) against its
  upstream, with a `(run: secrets sync)` hint when there is anything to
  reconcile. Offline-safe (reports against the last fetch, never reaches the
  network) and silent for a local-only store or one with no upstream.

### Fixed

- **`secrets pull` no longer fails silently when the store can't sync
  (EGB-1230)** — the store sync was `git pull >/dev/null 2>&1` under `set -euo
  pipefail`, so a store that could not fast-forward killed the script at that
  line with git's exit 128 and *nothing* on stdout or stderr. The user saw a
  banner, no restored files, and no reason — indistinguishable from a project
  with nothing to pull, and easy to lose entirely in a pipeline. The sync is
  now guarded, git's output is captured and surfaced as the diagnosis, and the
  error names the store path and points at `secrets sync`.

### Changed

- **`secrets pull`'s store sync is now fast-forward only**, matching the push
  path. A plain `git pull` could quietly manufacture a merge commit in the
  store; divergence is now resolved in exactly one place — `secrets sync`.
- **The push path's dead-end advice** ("Run 'secrets pull' first, then retry
  push") now points at `secrets sync` and includes git's own output.

## [0.7.5.0] - 2026-06-24

### Added

- **Multi-recipient age encryption (EGB-283)** — a store-scoped, committed
  `recipients.txt` (age `-R` format, with `# name` comment lines) lets one
  store encrypt every blob to N age public keys — one per team member.
  `secrets recipients add <age1…> [--name N]` adds a key and immediately
  re-encrypts the whole store; `secrets recipients rm <key|name> [--yes]`
  removes one and re-encrypts; `secrets recipients list` shows the current
  set (or a note that the store is still single-key). A new `secrets
  reencrypt` command re-encrypts every blob to the current recipients without
  changing the set (idempotent heal / backfill after a manual edit). Absence
  of `recipients.txt` preserves exact legacy single-key behavior; the first
  `recipients add` on a legacy store bootstraps the file seeded with the
  local pubkey plus the new key. `init` now seeds `recipients.txt` born-multi
  with the freshly generated pubkey.

### Changed

- **`secrets rekey` on a multi-recipient store** no longer generates a new
  keypair — instead it re-encrypts all blobs to the current `recipients.txt`
  set (the shared `_reencrypt_all` engine). On a legacy store (no
  `recipients.txt`) `rekey` keeps today's generate-new-keypair behavior.
- **`secrets which`** now prints a `recipients: N (name, …)` line, or
  `recipients: single-key (no recipients.txt)` for a legacy store.
- **`secrets verify` / `verify --all`** assert that each blob's age
  recipient-stanza count equals the number of entries in `recipients.txt`
  (skipped on legacy stores). Exits non-zero on any count mismatch so it can
  gate CI or a migration.

## [0.7.4.0] - 2026-06-18

### Added

- **`secrets upgrade` verb (EGB-716)** — the fix path paired with the EGB-713
  version-skew *warning*. Until now the warning told you you were behind but not
  how to catch up; `secrets upgrade` closes that loop.
  - **`secrets upgrade`** — `git -C "$SCRIPT_DIR" pull --ff-only` on the tool's
    own checkout (fast-forward only — never merges or rewrites local commits),
    reports `vOLD -> vNEW`, then best-effort re-checks the store's recorded
    writer-version against the new version so you see whether the EGB-713 nudge
    is now cleared (the new code itself takes effect on your next command).
  - **`secrets upgrade --check`** — reports whether an update is available
    (`git fetch` + compare to upstream) and changes nothing.
  - Deliberately thin: no auto-update, no background polling (this is a security
    tool). Directed errors for not-a-git-checkout, no upstream, a diverged/dirty
    branch, or being offline.

## [0.7.3.1] - 2026-06-18

### Changed

- **EGB-677 stage-1 structural cleanups (EGB-701)** — tech-debt dedup with one
  new safety warning; no behavior change for the manifest-driven (v2) happy path.
  - **`secrets which` now reuses the one external-entry extractor** the push/pull
    path uses (`_json_external_entries`) instead of its own duplicated `jq` 
    projection. So `which` applies the same `properties`→`gradle-properties`
    normalization and skips (with a warning) the same malformed external entries
    the sync path drops — `which` shows exactly what will sync, not a stale raw
    projection that could drift from the real behavior.
  - **The two external-manifest read guards are factored into shared helpers** —
    `_json_readable` (plain regular file, silent) and `_legacy_readable` (warns
    and skips a symlinked `.secrets-files`) — so `_external_entries_for_push` and
    `_external_entries_for_pull` can't drift apart.

### Fixed

- **Legacy (manifest-less) `pull` no longer silently under-restores (EGB-701)** —
  the manifest-less pull path globs only top-level `*.age`/`.*.age`, so a nested
  dotenv blob (`<project>/<relpath>.age`) written by a manifest-driven push on
  another machine was invisible: restored nothing, counted nothing, said nothing.
  It now **warns** and names each nested blob it can't reach (external blobs are
  excluded — `pull_external_files` handles those), pointing at committing a
  `.secrets.json` as the fix. The manifest-driven pull already restored nesting
  correctly; this only closes the legacy path's blind spot.

## [0.7.3.0] - 2026-06-08

### Added

- **Real install / onboarding scripts (EGB-671)** — onboarding a machine is now
  (close to) one command, and a mis-copied key fails loudly instead of silently.
  - **`secrets join --remote <url> --key <path>`** — second-machine onboarding in
    one verb: clones the vault, installs the key at mode 600, and **verifies the
    key actually decrypts the store before declaring success**. An empty vault
    reports "nothing to verify yet" (it never prints a false `VERIFIED`); a wrong
    key fails loudly with the store left in place to fix. All security logic
    (store resolution, URL handling, path rails) is reused from the audited core,
    not re-implemented in a side script.
  - **`secrets init --remote <url>`** — wires the remote and pushes the initial
    store so the upstream branch exists, so your first project `push` doesn't trip
    the fast-forward-pull guard on a brand-new empty remote. Run interactively,
    `init` also offers to add your first project's secrets (default No, skipped
    under `--yes` / non-interactive, so it stays a clean primitive for CI).
  - **`install.sh`** — thin bootstrap that ships in the repo: checks `age` + `jq`
    + `git`, then prints the `PATH` line, the onboarding next-steps, the upgrade
    one-liner, and a key-transfer hint. It never edits your shell config and never
    runs `sudo` (it prints the command so you stay in control).
  - **First-manifest `options.autoAdd` prompt (EGB-677 contract #2)** — the first
    `push` that scaffolds a project's manifest now records an explicit, committed
    `options.autoAdd` value (asked once when interactive; the default ON, written
    explicitly, under automation).

### Fixed

- **Day-2 silent decrypt failure** — `secrets pull` now dies loudly when a blob
  fails to decrypt with the current key (all three decrypt paths), instead of
  emitting a warning and continuing with exit 0. A wrong key can no longer pass
  unnoticed after onboarding.
- The `secrets init` second-machine trap now points at `secrets join` (the real
  one-command path) instead of a manual `git clone`.

## [0.7.2.0] - 2026-06-08

### Added

- **`secrets list --json` (EGB-699)** — machine-readable listing for tooling and
  CI. Emits a single JSON object on stdout: `{"store", "projects": [{"name",
  "entries": [...]}]}`, where each entry self-describes via a `type`
  discriminator — `{"type":"dotenv","path":<relpath>}` or
  `{"type":"external","subtype":"properties"|"file","path":<slug>}`. Reflects the
  same recursive store walk as the human `list` (nested `<project>/<relpath>.age`
  + `external/<slug>.age`). jq does the assembly so paths escape correctly; the
  human store hint is suppressed so stdout stays pure JSON (notices → stderr).
  jq is required only for `--json`. Feeds the EGB-671 install scripts, which need
  to enumerate a cloned store programmatically instead of scraping the table.

## [0.7.1.0] - 2026-06-08

### Added

- **Version-skew nudge (EGB-713)** — the store now records the highest `secrets`
  version that has written to it (`.secrets-writer-version`, committed,
  monotonic). When you run a command against a store last written by a *newer*
  `secrets` than your own, you get a one-line non-fatal stderr nudge to update
  your tool; `secrets which` shows the store's `written-by:` version (and flags
  when you're behind). Stores written by older builds carry no stamp and stay
  silent — no false alarms. The loud counterpart to EGB-712's quiet
  forcing function.

## [0.7.0.0] - 2026-06-08

### Changed

- **Additive store-format v2 (EGB-712)** — upgraded `secrets` clients now read
  either external blob suffix (`.properties.age` or the legacy
  `.gradle-properties.age`) and **dual-write** a `properties` external whenever a
  v1 twin already exists in the store. Existing externals keep working for
  teammates on an older `secrets`; only a brand-new `properties` external is
  written v2-only (a gentle "upgrade to see it" forcing function). dotenv and
  whole-`file` externals are unchanged across formats and always propagate.
- **`secrets migrate --finalize` is now optional GC**, not a required milestone.
  Because clients dual-write and read-fall-back, no teammate is ever cut off by
  *not* finalizing; finalize only reclaims the duplicate v1 blobs, and stays
  deferrable indefinitely. Its safety gates are unchanged. This defuses the
  cross-machine "all clients must be v2 before finalize" coordination gate.

### Added

- **`secrets migrate --status`** now reports `v2-only` externals per project
  (the ones an un-upgraded client cannot read), so you can see the forcing
  function's footprint at a glance.

## [0.6.1.0] - 2026-06-08

### Changed

- **`secrets migrate` copy-forward is now manifest-free (EGB-710)** — the
  per-project step enumerates the store's `*.gradle-properties.age` blobs
  directly (the same source of truth `--finalize` uses) instead of reading
  `.secrets.json`. A legacy `.secrets-files`-only project now migrates cleanly
  instead of dead-ending with "No .secrets.json", and a store blob the manifest
  no longer declares still gets a v2 twin (so `--finalize` won't refuse it).
  Running migrate in a project with no v1 properties blobs is a clean no-op.

### Added

- **`secrets migrate --status`** — a read-only survey that walks every project
  in the store and reports its v2 readiness (v2-ready / migrated / NEEDS
  MIGRATE), then whether the store as a whole is finalize-ready. Exits non-zero
  while any v1 blob is un-twinned, so it can gate the path to `--finalize`.

## [0.6.0.1] - 2026-06-08

### Added

- **`secrets which` now prints the manifest version (EGB-700)** — the manifest
  header line shows `version N` alongside the store format, so a single
  `secrets which` tells you both the on-disk store format and the `.secrets.json`
  schema version at a glance.

## [0.6.0.0] - 2026-06-07

### Added

- **Self-describing store format (v2) + `secrets migrate` (EGB-703)** — the
  store now records its format in a committed `.secrets-format` file, and
  `secrets which` prints it (`format: v2`). A fresh `secrets init` creates a
  v2 store; existing stores read as v1 until migrated.
- **`secrets migrate`** — copy-forward a project's encrypted blobs to the v2
  layout. It is non-destructive: the old blobs are kept until you finalize, so
  a half-migrated store stays fully readable and recoverable. `secrets migrate
  --dry-run` previews exactly what would change without writing anything.
- **`secrets migrate --finalize`** — the one destructive step, run once
  store-wide. It refuses unless `secrets verify` passes and every blob has its
  new-format twin, cuts a `pre-v2-migrate-*` recovery tag first, then drops the
  old blobs. It asks for confirmation (or `--yes`) because a machine still on
  an older `secrets` will stop seeing migrated external files until it updates.

### Changed

- The external `properties` blob is stored as `<name>.properties.age` in a v2
  store (was `<name>.gradle-properties.age`), matching the manifest `type`.
  `push`, `pull`, and `verify` pick the right name automatically from the store
  format, so v1 and v2 stores both keep working during a migration.

## [0.5.0.0] - 2026-06-07

### Added

- **`secrets verify` (EGB-698)** — a read-only integrity check. Run it in a
  project to cross-check the committed `.secrets.json` against the store both
  ways (entries declared but missing from the store, and stored blobs with no
  manifest entry) and decrypt-test every blob with your current key. Catches a
  partially-synced store, a stale key, or a manifest that has drifted from the
  store. Plaintext is streamed to `/dev/null` and never written to disk.
- **`secrets verify --all`** — decrypt-tests every blob in every project in the
  store: a fast store-wide integrity sweep. (The store carries no manifests, so
  `--all` checks decryptability only, not manifest consistency.)
- Both modes recurse the whole project tree, so nested entries and external
  files are covered. `secrets verify` exits non-zero on any problem, so it can
  gate CI or a future store migration.

## [0.4.0.0] - 2026-06-07

### Added

- **`.secrets.json` manifest (EGB-677 stage 1)** — a committed, project-root
  manifest is now the source of truth for what syncs. List the env files you
  want under `dotenv[]` (project-relative, nested paths and `@`-scoped
  workspaces allowed; `..`, absolute, and symlink paths are rejected) and
  out-of-project files under `external[]` (`properties` or `file`). The
  manifest is shared across machines, so a teammate who clones the project
  sees exactly what to pull.
- **`secrets add <path>`** — declare an env file in the manifest without
  pushing. Bootstraps `.secrets.json` on first use, dedupes, and writes a
  stable canonical form.
- **Auto-add on push** — `secrets push` discovers new `.env*` / `.dev.vars`
  files and adds them to the manifest (prints what it added and reminds you to
  commit). Gated by `options.autoAdd` in the manifest (default on);
  `push --frozen` syncs only declared files, and `push --dry-run` previews
  what would change without writing anything.
- **Manifest-driven pull** — restores every declared file, recreating nested
  directories as needed, with the same path-safety rail applied at restore
  time so a malicious committed manifest can't write outside the project. An
  empty manifest is a safe no-op.
- **Legacy `.secrets-files` absorb** — an existing `.secrets-files` is folded
  into `.secrets.json` on first push (gradle-properties entries become
  `properties`); on pull the legacy file is superseded with a warning.
- **Platform-aware install hints** — missing-dependency errors now print the
  right install command for your platform (brew / apt-get / dnf).

### Changed

- `jq` is required only when a manifest is present or being written;
  manifest-less projects keep working without `jq` (manifest features are
  skipped with a notice).

### Fixed

- **Key rotation no longer orphans nested or external blobs.** `secrets rekey`
  and `secrets list` now walk the entire project tree, so nested manifest
  entries (`<project>/<relpath>.age`) and `external/` blobs are re-encrypted
  and listed correctly. Previously a rekey could leave nested blobs encrypted
  under the discarded old key, making them permanently undecryptable.
- Test assertions now fail correctly under system bash 3.2 (standalone
  `[[ ]]` checks no longer pass silently).

## [0.3.0.0] - 2026-06-07

### Added

- **`file` external type (EGB-652)** — `.secrets-files` can now sync whole
  files outside the project root (binary-safe; built for the Beacon Android
  upload keystore): `file ~/keystores/beacon-upload.keystore`. Push encrypts
  the file verbatim into `<project>/external/`; pull restores it with mode
  600, backing up a divergent existing target to `<name>.secrets-bak`. Same
  path safety rails as `gradle-properties` (inside `$HOME`, no `..`, no
  symlinks) minus the basename restriction. 7 new bats tests.

## [0.2.1.0] - 2026-06-05

### Fixed

- **`secrets rekey` no longer bricks dotenv stores.** The re-encrypt loop used a bare `"$dir"*` glob, which never matches dotfiles — so `.env` blobs were decrypted to the temp dir but never re-encrypted, leaving them on the **old** key while the new key overwrote `key.txt`. After a rotation, every dotenv file in the store was undecryptable. The glob now mirrors the decrypt loop (`"$dir"* "$dir".*`), and a round-trip test (push → rekey → pull) pins it. If you ran `rekey` on an earlier version and `pull` now fails with `no identity matched any of the recipients`, your blobs are on a pre-rotation key — recover with an old `key.txt` from another machine.
- **`secrets init` on a second machine now fails helpfully instead of half-initializing.** Copying `key.txt` into `~/.secrets` and then running `init` (instead of cloning your secrets repo) used to run `git init`, crash on the existing key, and leave a store with no `.gitignore` — a state where a later `push` would commit the private key. The guard now fires *before* `git init`, leaves the key untouched, and prints the exact `git clone` command to run — using the real remote URL when your `.secrets-store` file declares one.

### Security

- **The private key can no longer be committed by a store missing its `.gitignore`.** `push`, `pull`, and `rekey` now self-heal store protections immediately before any `git add -A`: a missing *or corrupted* `.gitignore` (one without the `key.txt` line) is rewritten, and the pre-commit hook is reinstalled if absent. The heal runs *after* the fast-forward pull, closing a window where remote history without a `.gitignore` could strip protection mid-push.
- **An already-tracked `key.txt` is now untracked automatically.** `.gitignore` can't untrack a file that was committed in the past; the heal now removes a tracked key from the index with a warning that history may need scrubbing and the key may warrant rotation.

### Changed

- Project `CLAUDE.md` gained agent skill-routing guidance and an updated test-suite count (126 bats tests, up from 113).

## [0.2.0.0] - 2026-05-26

### Added

- **Sync designated keys from external files (Gradle properties).** A new committed `.secrets-files` manifest lets `secrets` track specific keys from files that live *outside* the project root — the motivating case being `~/.gradle/gradle.properties`, where Android builds read Clerk publishable keys (`beaconClerkPkTest`, `beaconClerkPkLive`) that Android Studio's GUI builds can only get from that persistent global file, not from terminal env vars. One entry per line: `gradle-properties  ~/.gradle/gradle.properties  beaconClerkPkTest beaconClerkPkLive`. (EGB-531)
  - **push** extracts only the named keys and encrypts them under `<project>/external/` in the store.
  - **pull** *merges* those keys into the target file, preserving every unrelated key, comment, and line order. An existing managed key is updated in place; the target is backed up to `gradle.properties.secrets-bak` before each merge.
  - `secrets which` reads back the parsed manifest; `secrets list` shows `[external]` entries; `secrets rekey` re-encrypts external blobs alongside dotenv ones.
  - Backward compatible: no `.secrets-files` → identical behavior to before.

### Security

- **The merge is pure bash with exact-string key matching — no `sed`/regex.** This is deliberate: a `sed`-based substitution would corrupt values containing `&`, `\`, or `/` (common in API keys) and would false-match substring keys (`beaconClerkPk` vs `beaconClerkPkTest`). Values are treated as opaque literals and round-trip byte-exact.
- **External write targets are validated against an attacker-controlled path.** Because the target path comes from a *committed* manifest, the writable target is locked down: basename must be `gradle.properties`, the path must resolve inside `$HOME`, `..` traversal is rejected, and symlinked targets (file or parent dir) are refused — blocking a malicious manifest from appending decrypted keys to `~/.gitconfig`, `~/.bashrc`, etc. Manifest parsing rejects shell metacharacters and control characters in paths and keys, mirroring the `.secrets-store` posture. Writes are atomic (temp-in-same-dir + rename), mode-preserving, and default to `600` on create.
- **Storage isolation.** External blobs live in a `<project>/external/` subdir so the existing broad `*.age` globs (pull, list, rekey) structurally never decrypt them into the working directory or orphan them.
- **Note on plaintext.** Merged Gradle keys are written as permanent plaintext into the target file (`secrets clear` does not remove them) — appropriate for publishable/low-secrecy values like Clerk publishable keys, by design.

### Fixed

- **`secrets rekey` was broken and never completed.** Two latent bugs, exposed by the new rekey test: (1) `age-keygen -o key.txt` aborts because age-keygen refuses to overwrite an existing file — the new key is now generated into a temp dir and moved into place only on success, so the old key survives a failed rotation; (2) the `EXIT` trap referenced the function-local `$tmpdir` after the function returned, erroring under `set -u` and leaking the plaintext temp dir — the temp dir is now removed explicitly and the trap cleared on normal completion.

### Tests

- 80 → 113 (+33). New coverage: manifest parse/read-back, key extraction across `=`/`:`/space separators, merge (preserve unrelated/comments/order, substring-key isolation, sed-metachar value round-trip, duplicate-key collapse, continuation-line safety, idempotency), path validation (wrong basename, outside `$HOME`, symlinked target, symlinked parent dir), first-create mode `600`, manifest injection/symlink/unsafe-key rejection, rekey round-trip of external blobs, glob isolation (blob not leaked to cwd), `list` surfacing, pre-commit blocking plaintext `gradle.properties`, workspace (`push -w`/`pull -w`) external sync, multi-entry manifests, partial-key push warnings, missing-blob pull warnings, source-side comment/continuation skipping, and backward compatibility.

## [0.1.1.0] - 2026-05-09

### Added

- **Optional git remote URL in `.secrets-store`.** Add a second whitespace-separated token after the store name to give teammates a copy-paste-ready clone command:
  ```
  work git@github.com:acme/work-secrets.git
  ```
  When a teammate clones a project bound to a store they don't have on their machine yet, the directed error now fills in the actual `git clone <url> <path>` line — they no longer have to ask the original setter for the URL. The URL is optional; existing single-token `.secrets-store` files continue to work and show the `<their-store-remote>` placeholder as before. (EGB-282)

### Security

- **Hardened `.secrets-store` URL parser against copy-paste shell injection.** The URL is rendered into a `git clone` line that a teammate is likely to copy-paste from the directed error. Without sanitization, a malicious `.secrets-store` containing `work evil.git;rm -rf ~` would render verbatim and execute `rm -rf ~` on paste. The parser now rejects URLs containing shell metacharacters (`;&|<>$\`(){}*?!"'\\`), control characters (including ANSI escape sequences that could spoof terminal output), and embedded whitespace. Rejected URLs are dropped with a stderr warning; the directed error falls back to the safe placeholder. Found by adversarial review during /ship; verified with regression tests for every named attack vector.
- **Switched URL parsing from `set -- $line` to `read -r spec rest`.** The previous form word-split *and* glob-expanded — `work *` from a populated directory would have leaked filenames into the URL field. The new form preserves the rest of the line verbatim into a single variable, so glob characters and internal whitespace are noticed by the sanitizer instead of silently expanded.

### Tests

- 72 → 80 (+8). New coverage: backward-compat single-token form, two-token URL form (SSH, HTTPS, `~/`-prefixed), comment-and-URL form, copy-paste injection (rm -rf payload), backtick injection, `$()` injection, ANSI escape injection, multi-token URL, glob-character URL, and a positive test asserting standard git URL chars (`-`, `+`, `_`, `:`, `/`, `@`, `.`) round-trip unchanged.

## [0.1.0.1] - 2026-05-09

### Fixed

- `secrets which` now prints the full path of the `.secrets-store` file that won resolution. Before this fix, `_find_secrets_store_file` set `_LAST_FOUND_AT` inside a `$(...)` subshell, so the parent shell never saw it; the source line read `.secrets-store file ()` with empty parens. The function now returns a tab-separated `<dir>\t<source-file-path>` tuple that `resolve_store` splits in the parent shell. Caught by the `/land-and-deploy` post-merge fresh-clone check; the existing test was too lenient and matched the truncated form. Test tightened to assert the full path appears in the parenthetical.

## [0.1.0.0] - 2026-05-09

### Added

- **Multiple stores per user.** Run `secrets push` and `secrets pull` against any encrypted store directory you choose, not just `~/.secrets/`. Use cases: keep work secrets isolated from personal, run a separate store per client, or onboard a teammate to one project without giving them every other project's keys.
- **`.secrets-store` file** for per-project bindings. Drop a one-line file at the project root (e.g. `echo work > .secrets-store && git add .secrets-store && git commit`) and every machine that clones the project automatically uses `~/.secrets-work/` for that repo. No env var to remember, no per-machine setup.
- **`--store <dir>` flag** for one-shot overrides on any subcommand. `secrets --store ~/.secrets-clientA pull myapp` works without touching files. Bare names like `--store work` expand to `$HOME/.secrets-work`. `--store default` is sugar for `~/.secrets`.
- **`secrets which`** prints the active store path and which rule chose it (flag, `.secrets-store` file, env var, or default). Aliases: `secrets where`, `secrets status`.
- **Directed errors for teammate onboarding.** When `.secrets-store` resolves to an uninitialized store or one missing `key.txt`, the error message names both recovery paths: `git clone <remote>` to join an existing store, or `secrets --store <name> init` to start fresh.
- **Active-store echo.** `secrets push` and `secrets pull` print `==> Store: <path> (from <source>)` whenever a non-default store is active, so wrong-store mistakes surface immediately.

### Changed

- `secrets list` now hints at `secrets which` when a non-default store is active.
- `cmd_help` documents the four-rule resolution order (`--store` > `.secrets-store` file > `SECRETS_DIR` > default).
- Error messages for missing init / missing key file are now context-aware: they distinguish between "default store on a fresh machine" and "non-default store referenced by `.secrets-store`."

### Security

- **Path expansion in `.secrets-store` is literal-only.** No `eval`, no `$VAR` interpolation, no `$(...)` execution. A committed `.secrets-store` containing `$(rm -rf ~)` reads as plain text, not as a command.
- **Walk-up bounded by `$HOME`.** `secrets` never reads `$HOME/.secrets-store`, never walks past `$HOME` to `/`, and never follows symlinked `.secrets-store` files. Symlinks (potential supply-chain attack via committed link to `~/.aws/credentials` or similar) are ignored.
- **`KEY_FILE` re-derives after `--store` switches stores.** Previously, calling `secrets pull --store other` would have decrypted ciphertext from the new store using the default store's key. Now `secrets` updates both `SECRETS_DIR` and `KEY_FILE` together inside `resolve_store()`.
- **`secrets run` cleanup survives paths with apostrophes.** The EXIT trap is now a named function rather than a string-interpolated command, so projects at e.g. `/Users/you/Mom's Mac/code` still get plaintext cleared after the wrapped command exits.
- **Test isolation:** the bats suite now sets `HOME=$TEST_TMPDIR` so `.secrets-store` walk-up cannot wander into the developer's real home directory.
- **`--store` flag value validation.** Empty values (`--store=`) and flag-shaped values (`--store --workspaces`) are rejected with directed errors instead of silently mapping to `~/.secrets-`-something.
- **Unset `HOME` is detected** with a directed error before the script tries to expand it. Helps cron, sudo without `-H`, and minimal CI runners.

### Tests

- 37 → 66 tests. New coverage: store resolution rules and precedence, walk-up boundaries, command-injection prevention, key-file re-derivation across stores, teammate-onboarding error path, monorepo workspace binding, F1–F5 adversarial regressions.

[0.1.1.0]: https://codeberg.org/egbt/secrets/releases/tag/v0.1.1.0
[0.1.0.1]: https://codeberg.org/egbt/secrets/releases/tag/v0.1.0.1
[0.1.0.0]: https://codeberg.org/egbt/secrets/releases/tag/v0.1.0.0