Found during a vault hygiene pass (2026-08-19). Two secrets shared the key RESEND_API_KEY: one in the API Keys project, one with no project.
hush get/edit/delete --key RESEND_API_KEY → ambiguous, errors (correct).--project <name> can select the project-scoped copy, but there is no way to express "the copy with no project" — find_by_key/index::resolve only filter on a Some(project) match.
Workaround used: raw bws secret get/delete <uuid> (which then hit a separate BWS machine-token permission wall on writes — not hush's problem).
Possible fixes (pick one):
- accept a sentinel like
--project none to filter project_id == None;
- or add
--id <uuid> selection to get/edit/delete, since list --json already exposes ids.
--id is probably the smaller, more agent-native fix: ids are already the discovery surface's primary key.
Found during a vault hygiene pass (2026-08-19). Two secrets shared the key
RESEND_API_KEY: one in the API Keys project, one with no project.hush get/edit/delete --key RESEND_API_KEY→ ambiguous, errors (correct).--project <name>can select the project-scoped copy, but there is no way to express "the copy with no project" —find_by_key/index::resolveonly filter on a Some(project) match.Workaround used: raw
bws secret get/delete <uuid>(which then hit a separate BWS machine-token permission wall on writes — not hush's problem).Possible fixes (pick one):
--project noneto filterproject_id == None;--id <uuid>selection to get/edit/delete, sincelist --jsonalready exposes ids.--idis probably the smaller, more agent-native fix: ids are already the discovery surface's primary key.