Scan a local file for secrets and return tokenized text plus local handles. Raw values are not returned.

Scan supplied text and return tokenized text. Persist=false previews handles without enrolling secrets.

List known local secret handles and non-secret metadata.

Show non-secret metadata for one local secret handle.

Create a pending local manifest for a command that needs one secret injected as an environment variable.

Create a local approval request for an SSH command that s-gw will run over its own persistent ControlMaster session.

Execute a previously approved local request and return sanitized output.