Read-path commands over the library. Credentials never come from flags or arguments; get prints the bare value for $(...) plumbing and nothing else ever touches stdout; stderr carries only redacted diagnostics. Exit codes mirror keyproxy (0 ok, 1 usage/config, 2 auth or resolution failure). CLI tests drive the fake server through a real 0600 env file.