@logictan/dsh-config-manager 0.1.61 → 0.1.62

package/lib/core/analyzer.js

@@ -408,8 +408,9 @@ export class Analyzer {
         if (opts.confirm !== true) {
             throw new ImportNotConfirmedError(this.msg);
         }
-        // 10b. 加密不变量：加密备份必须已成功解密（decryptedCredentials 由宿主用备份密码
-        // 解开 security/secrets.enc 后注入）。未解密（undefined）一律拒绝执行——
+        // 10b. 旧版加密备份的兼容不变量：本插件已无加密层，但历史产物仍可能带
+        // manifest.security.encrypted=true。这类备份的凭据必须由宿主解密后注入
+        // （decryptedCredentials）；未注入（undefined）一律拒绝执行——
         // 不允许把加密凭据静默降级为「缺凭据照常导入」，否则加密备份与普通备份无区别。
         if (bundle.manifest.security.encrypted && opts.decryptedCredentials === undefined) {
             throw new Error(this.msg('import.encryptedPasswordRequired'));
@@ -607,8 +608,8 @@ export class Analyzer {
             .map((s) => s.ref);
         // M1：导入成功 → 快照标记 done（元数据写失败只告警，不改变导入结论）
         await this.markSnapshotStatus(snapshot.id, 'done');
-        // F1 vault 回填：导出时敏感文件（.credentials.yaml 等）明文未进备份（includeSecrets=false
-        // 时镜像到 <dataDir>/vault），导入成功后从本机 vault 回填 $DSH_HOME；vault 缺失
+        // F1 vault 回填：includeSecrets=false 的导出会把敏感文件（.credentials.yaml 等）镜像到
+        // <dataDir>/vault 而不进备份，导入成功后从本机 vault 回填 $DSH_HOME；vault 缺失
         // （跨机恢复 / 从未镜像过）记入警告提示用户重填。尽力而为：失败仅警告，不影响导入结论。
         try {
             const vaultDataDir = path.join(this.ctx.homeDir, 'dsh-config-manager');

package/lib/core/exporter.d.ts

@@ -1,6 +1,6 @@
 import type { MsgFunc } from './messages.ts';
 import type { Manifest } from '../schema/types.ts';
-import type { ConfigAdapter, EncryptionProvider, ExportOptions, ExportReport, HostContext, SecretScanner } from './types.ts';
+import type { ConfigAdapter, ExportOptions, ExportReport, HostContext, SecretScanner } from './types.ts';
 /** m1：每导出一个分区前的进度回调信息（Host 侧 run 状态更新用；section = adapter id） */
 export interface SectionProgress {
     section: string;
@@ -14,8 +14,6 @@ export interface ExporterOptions {
     adapters: ConfigAdapter[];
     /** Secret 扫描器；缺省用字段名黑名单剥离（m4 可注入强化版） */
     scanner?: SecretScanner;
-    /** 加密提供者（m4 用 node:crypto 实现）；includeSecrets 时必填；提供时备份标记 encrypted=true */
-    encryption?: EncryptionProvider | null;
     /** 插件自身版本（manifest.exporter.version） */
     exporterVersion?: string;
     now?: () => Date;
@@ -45,7 +43,6 @@ export declare class Exporter {
     private readonly ctx;
     private readonly adapters;
     private readonly scanner;
-    private readonly encryption;
     private readonly exporterVersion;
     private readonly now;
     private readonly msg;

package/lib/core/exporter.js

@@ -3,11 +3,9 @@
  *   adapter 收集各分区 → Secret 过滤 → manifest → checksum → ZIP。
  *
  * 安全不变量：
- *  - Secret 值默认永不进入导出数据（结构化分区逐一过 SecretScanner）；
- *  - includeSecrets=true 必须注入 EncryptionProvider（m4 实现），否则拒绝导出；
- *  - 注入 EncryptionProvider 时备份标记为加密（encrypted=true）：includeSecrets=false
- *    时 secrets.enc 加密空内容占位，备份仍需要密码导入，但不含任何凭据值；
- *  - 加密密码/秘密值绝不写入 manifest 与日志。
+ *  - Secret 值默认永不进入导出数据（结构化分区逐一过 SecretScanner 剥离值）；
+ *  - 备份恒为明文（encrypted=false / encryption=null）：本插件不再有加密层；
+ *  - 秘密值绝不写入 manifest 与日志。
  */
 import fs from 'node:fs/promises';
 import path from 'node:path';
@@ -138,7 +136,6 @@ export class Exporter {
     ctx;
     adapters;
     scanner;
-    encryption;
     exporterVersion;
     now;
     msg;
@@ -148,7 +145,6 @@ export class Exporter {
         this.ctx = opts.ctx;
         this.adapters = opts.adapters;
         this.scanner = opts.scanner ?? defaultSecretScanner();
-        this.encryption = opts.encryption ?? null;
         this.exporterVersion = opts.exporterVersion ?? '0.1.0';
         this.now = opts.now ?? (() => new Date());
         this.msg = opts.msg ?? msgOf(opts.ctx);
@@ -161,9 +157,6 @@ export class Exporter {
      */
     async export(options) {
         const { includeSecrets, only } = options;
-        if (includeSecrets && !this.encryption) {
-            throw new Error(this.msg('export.encryptionRequired'));
-        }
         // 1. 选定分区（only 过滤 + 默认包含）
         const selected = this.adapters
             .filter((a) => (only === undefined ? a.defaultIncluded : only.includes(a.id)))
@@ -172,6 +165,8 @@ export class Exporter {
         const sections = [];
         const warnings = [];
         const redactedHits = [];
+        /** 文件类分区实扫到的命中数：只有它能让 containsSecrets 为真（结构化分区已被剥离） */
+        let fileSectionSecretHits = 0;
         const included = [];
         const excluded = this.adapters.filter((a) => !selected.includes(a.id)).map((a) => a.id);
         // m1 埋点：每导出一个分区前上报真实进度（onSection 抛错不得中断导出）
@@ -210,6 +205,7 @@ export class Exporter {
                 if (fileHits.length > 0) {
                     // redactedHits 是**报告统计**通道（非告警通道）：仍计入全量命中（含同一文件的多行/多形态命中）。
                     redactedHits.push(...fileHits);
+                    fileSectionSecretHits += fileHits.length;
                     // 告警按**文件**去重（G-09/H1）：同一路径只告警一次。
                     // 修复前按 hit 计数，同一行同时命中「字段名」与「值形状」会产出两条同路径告警，
                     // 使少数文件就吃满上限，导致含真实明文凭据的其它文件被静默淹没（实测 redactedHits=8 而 5 条告警全属一个文件）。
@@ -239,12 +235,13 @@ export class Exporter {
             included.push({ section: adapter.id, counts: section.counts });
             warnings.push(...section.warnings);
         }
-        // 4. 组装 ZIP 条目（JSON 分区 + 文件类分区 + secrets.enc + checksums + manifest）
+        // 4. 组装 ZIP 条目（JSON 分区 + 文件类分区 + checksums + manifest）
         const entries = [];
         const sectionFlags = buildSectionFlags(sections);
-        let containsSecrets = false;
-        let encrypted = false;
-        let encryption = null;
+        // 备份恒为明文：本插件不再有加密层。containsSecrets 只认「文件类分区实扫到的命中」——
+        // 结构化分区的敏感值已被 scanner 剥离，不构成「含秘密」；文件类分区只报告不改写，
+        // 命中即代表归档里确有明文，必须如实标注。
+        const containsSecrets = fileSectionSecretHits > 0;
         for (const section of sections) {
             if (isFileSection(section.sectionId)) {
                 const prefix = SECTION_FILE_PREFIXES[section.sectionId];
@@ -262,34 +259,8 @@ export class Exporter {
                 data: Buffer.from(stringifyJsonSafe(section.data, { space: 2 }), 'utf8'),
             });
         }
-        // secrets.enc：有加密提供者即生成。includeSecrets=true 时加密真实的凭据原文；
-        // 只勾选加密（不导出密钥）时加密空内容占位，备份仍标记 encrypted（导入需密码），
-        // 但绝不把凭据值放进去（containsSecrets 保持 false；安全不变量不破）。
-        if (this.encryption) {
-            const credentialsFile = path.join(this.ctx.homeDir, '.credentials.yaml');
-            let plaintext;
-            if (includeSecrets) {
-                try {
-                    const raw = await this.ctx.fs.readFile(credentialsFile);
-                    plaintext = Buffer.from(raw).toString('utf8');
-                }
-                catch (err) {
-                    warnings.push(this.msg('export.credentialsReadFailed', { reason: err instanceof Error ? err.message : String(err) }));
-                    plaintext = '';
-                }
-            }
-            else {
-                plaintext = '';
-            }
-            const result = await this.encryption.encrypt(plaintext);
-            entries.push({ name: 'security/secrets.enc', data: result.blob });
-            encryption = result.info;
-            containsSecrets = includeSecrets && plaintext !== '';
-            encrypted = true;
-        }
         // 4b. 文件级 vault（includeSecrets=false：敏感文件明文不进归档 → 镜像到本机 vault）。
-        //     尽力而为：任何失败仅记警告，不中断导出。includeSecrets=true 时秘密已加密进归档，
-        //     无需镜像（vault 只服务于「明文不进备份」的本机留存场景）。
+        //     尽力而为：任何失败仅记警告，不中断导出。
         let vaultRefreshed = 0;
         if (!includeSecrets) {
             try {
@@ -317,8 +288,8 @@ export class Exporter {
             arch: this.ctx.arch,
             sections: sectionFlags,
             containsSecrets,
-            encrypted,
-            encryption,
+            encrypted: false,
+            encryption: null,
             exportedAt: this.now().toISOString(),
         });
         entries.push({ name: MANIFEST_FILE, data: Buffer.from(stringifyJsonSafe(manifest, { space: 2 }), 'utf8') });
@@ -333,7 +304,6 @@ export class Exporter {
             sections: Object.keys(sectionFlags).filter((k) => sectionFlags[k]),
             redactedFields: redactedHits.length,
             containsSecrets,
-            encrypted,
             vaultRefreshed,
         });
         const report = {
@@ -342,7 +312,6 @@ export class Exporter {
             security: {
                 secretsExcluded: !includeSecrets,
                 containsSecrets,
-                encrypted,
                 redactedHits: redactedHits.length,
                 vaultRefreshed,
             },

package/lib/core/importer.d.ts

@@ -30,7 +30,7 @@ export interface ExecuteOptions {
     confirm: boolean;
     /** 用户补录的秘密值（仅内存） */
     secretInputs?: Record<string, string>;
-    /** 加密备份解密结果（仅内存；解密必须经 m4 encryption provider） */
+    /** 旧版加密备份的解密结果（仅内存；宿主解密后注入，本插件不再产生加密备份） */
     decryptedCredentials?: Map<string, string>;
     /** 任一项失败立即整体回滚（默认 false：单项失败如实记录并继续其余项） */
     rollbackOnError?: boolean;

package/lib/core/index.d.ts

@@ -11,4 +11,4 @@ export { computeCompatibility, describeCompatibility, describeSchemaStatus, vali
 export { ImportNotConfirmedError, ImportFailedError, } from './types.ts';
 export type * from './types.ts';
 export { MigrationStore, sanitizeEntry, queryHistory, summarizeHistory, renderExport, parseHistoryQuery, isValidMigrationKind, redactHistoryText, makeHistoryFilename, isHistoryBasename, MIGRATION_HISTORY_DIR, DEFAULT_MIGRATION_RETENTION, MIGRATION_HISTORY_SCHEMA_VERSION, type MigrationKind, type MigrationResult, type MigrationHistoryEntry, type StoredMigrationHistoryEntry, type MigrationQuery, type MigrationHistoryStats, type ExportFormat, type ReadMigrationResult, type AppendResult, type MigrationIo, type MigrationStoreOptions, type MigrationSource, } from './migration-history.ts';
-export type { ExportOptions, ExportSection, ValidationResult, HostContext, SettingsFacade, CredentialsFacade, PluginsFacade, WorkspaceFacade, PatchFileFacade, FileSystemFacade, NamespaceInfo, PluginInfo, ConfigAdapter, Portability, SecretScanner, SensitiveHit, EncryptionProvider, PlanItem, PlanItemKind, ItemResolution, GlobalConflictStrategy, ImportAnalysis, ImportDecisions, ImportPlan, ImportResult, ExecutedItem, ImportContext, SnapshotTarget, SnapshotEntry, Snapshot, SnapshotStore, RollbackReport, PathMapping, PathIssue, CompatibilityInput, CompatibilityScore, ExportReport, ApplyResult, ConflictDecision, } from './types.ts';
+export type { ExportOptions, ExportSection, ValidationResult, HostContext, SettingsFacade, CredentialsFacade, PluginsFacade, WorkspaceFacade, PatchFileFacade, FileSystemFacade, NamespaceInfo, PluginInfo, ConfigAdapter, Portability, SecretScanner, SensitiveHit, PlanItem, PlanItemKind, ItemResolution, GlobalConflictStrategy, ImportAnalysis, ImportDecisions, ImportPlan, ImportResult, ExecutedItem, ImportContext, SnapshotTarget, SnapshotEntry, Snapshot, SnapshotStore, RollbackReport, PathMapping, PathIssue, CompatibilityInput, CompatibilityScore, ExportReport, ApplyResult, ConflictDecision, } from './types.ts';

package/lib/core/messages.d.ts

@@ -15,9 +15,7 @@
 import type { MsgFunc } from './msg-types.ts';
 export type { MsgFunc, MsgParams } from './msg-types.ts';
 export declare const zh: {
-    readonly 'export.encryptionRequired': '导出包含秘密需要注入 EncryptionProvider（m4 实现），拒绝明文导出秘密';
     readonly 'export.sectionFailed': '分区 {adapter} 导出失败: {reason}';
-    readonly 'export.credentialsReadFailed': '读取凭据文件失败，跳过秘密导出: {reason}';
     readonly 'export.vaultRefreshed': '凭据明文未进入备份，已镜像到本机 vault（{count} 个文件，恢复时可回填）';
     readonly 'export.vaultRefreshSkipped': 'vault 镜像跳过 {rel}: {reason}';
     readonly 'export.vaultRefreshFailed': 'vault 镜像刷新失败（不影响导出）: {reason}';
@@ -48,9 +46,7 @@ export declare const zh: {
     readonly 'import.secretMissingDesc': '凭据 {ref} 需要补录';
     readonly 'import.secretNotProvided': '凭据未提供，需补录';
     readonly 'import.notConfirmed': '导入未确认：必须显式 confirm 后才允许修改任何数据';
-    readonly 'import.encryptedPasswordRequired': '该备份已加密，必须提供解密密码才能导入（拒绝无密码导入）';
-    readonly 'import.encryptedPasswordWrong': '解密密码错误，请重试';
-    readonly 'import.notEncryptedContainer': '该文件不是加密备份容器，无法解锁';
+    readonly 'import.encryptedPasswordRequired': '该备份含上游历史加密凭据（security.encrypted=true），本插件无解密能力：须由宿主解密后注入凭据（decryptedCredentials）才能导入';
     readonly 'import.userSkipped': '用户跳过（导入中点击「跳过当前插件」）';
     readonly 'import.userSkippedDetail': '插件 {name} 已由用户跳过，未安装';
     readonly 'import.vaultRestored': '凭据文件 {rel} 已从本机 vault 回填';

package/lib/core/messages.js

@@ -1,8 +1,6 @@
 export const zh = {
     // ---------- 导出 ----------
-    'export.encryptionRequired': '导出包含秘密需要注入 EncryptionProvider（m4 实现），拒绝明文导出秘密',
     'export.sectionFailed': '分区 {adapter} 导出失败: {reason}',
-    'export.credentialsReadFailed': '读取凭据文件失败，跳过秘密导出: {reason}',
     'export.vaultRefreshed': '凭据明文未进入备份，已镜像到本机 vault（{count} 个文件，恢复时可回填）',
     'export.vaultRefreshSkipped': 'vault 镜像跳过 {rel}: {reason}',
     'export.vaultRefreshFailed': 'vault 镜像刷新失败（不影响导出）: {reason}',
@@ -34,9 +32,7 @@ export const zh = {
     'import.secretMissingDesc': '凭据 {ref} 需要补录',
     'import.secretNotProvided': '凭据未提供，需补录',
     'import.notConfirmed': '导入未确认：必须显式 confirm 后才允许修改任何数据',
-    'import.encryptedPasswordRequired': '该备份已加密，必须提供解密密码才能导入（拒绝无密码导入）',
-    'import.encryptedPasswordWrong': '解密密码错误，请重试',
-    'import.notEncryptedContainer': '该文件不是加密备份容器，无法解锁',
+    'import.encryptedPasswordRequired': '该备份含上游历史加密凭据（security.encrypted=true），本插件无解密能力：须由宿主解密后注入凭据（decryptedCredentials）才能导入',
     'import.userSkipped': '用户跳过（导入中点击「跳过当前插件」）',
     'import.userSkippedDetail': '插件 {name} 已由用户跳过，未安装',
     'import.vaultRestored': '凭据文件 {rel} 已从本机 vault 回填',
@@ -297,9 +293,7 @@ export const zh = {
 };
 export const en = {
     // ---------- export ----------
-    'export.encryptionRequired': 'Encrypted export requires an EncryptionProvider (m4); refusing to export secrets in plaintext',
     'export.sectionFailed': 'Section {adapter} export failed: {reason}',
-    'export.credentialsReadFailed': 'Failed to read the credentials file; secrets export skipped: {reason}',
     'export.vaultRefreshed': 'Credential plaintext did not enter the backup; mirrored to the local vault ({count} file(s), available for restore backfill)',
     'export.vaultRefreshSkipped': 'Vault mirror skipped {rel}: {reason}',
     'export.vaultRefreshFailed': 'Vault mirror refresh failed (export unaffected): {reason}',
@@ -331,9 +325,7 @@ export const en = {
     'import.secretMissingDesc': 'Credential {ref} needs to be re-entered',
     'import.secretNotProvided': 'Credential not provided; requires re-entry',
     'import.notConfirmed': 'Import not confirmed: explicit confirm is required before any data is modified',
-    'import.encryptedPasswordRequired': 'This backup is encrypted; the decryption password is required to import it (refusing password-less import)',
-    'import.encryptedPasswordWrong': 'Wrong decryption password, please try again',
-    'import.notEncryptedContainer': 'This file is not an encrypted backup container and cannot be unlocked',
+    'import.encryptedPasswordRequired': 'This backup carries upstream-encrypted credentials (security.encrypted=true) and this plugin cannot decrypt them: a host must decrypt and inject them (decryptedCredentials) before import',
     'import.userSkipped': 'Skipped by user (clicked "Skip current plugin" during import)',
     'import.userSkippedDetail': 'Plugin {name} was skipped by the user and not installed',
     'import.vaultRestored': 'Credential file {rel} backfilled from the local vault',

package/lib/core/types.d.ts

@@ -5,14 +5,18 @@
  * HostContext 是 m3 定义、m5 实现的 DSH Service 门面（研究报告 §3.2 的叶子方法最小集），
  * 测试用内存 mock 即可驱动完整导出→导入往返。
  */
-import type { EncryptionInfo, Manifest, SectionId, WorkspaceRecord } from '../schema/types.ts';
+import type { Manifest, SectionId, WorkspaceRecord } from '../schema/types.ts';
 import type { TombstoneKind } from '../schema/tombstones.ts';
 import type { MutationLockPort } from '../utils/env-lock.ts';
 import type { RecursiveListing } from '../utils/recursive-walk.ts';
 import type { Logger } from '../utils/logger.ts';
 import type { MsgFunc } from './messages.ts';
 export interface ExportOptions {
-    /** 是否包含真实秘密（必须配合 encryption 提供者；缺省 false = 只导状态） */
+    /**
+     * 是否把真实秘密写入备份。本插件不再有加密层（备份恒为明文），结构化分区的秘密值
+     * 始终由 SecretScanner 剥离，故本开关当前的实际作用只剩「是否刷新本机 vault 镜像」：
+     * false → 导出后把敏感文件镜像到本机 vault（明文不进归档）。
+     */
     includeSecrets: boolean;
     /** 仅导出指定分区（缺省 = 全部默认包含分区） */
     only?: SectionId[];
@@ -249,7 +253,7 @@ export interface ImportAnalysis {
         item: string;
         dependency: string;
     }[];
-    /** 备份是否加密（manifest.security.encrypted）：加密备份的凭据必须用解密密码恢复 */
+    /** 旧版加密备份标记（manifest.security.encrypted）：本插件不再产生，仅历史产物为 true */
     encrypted: boolean;
 }
 export interface ImportDecisions {
@@ -307,6 +311,7 @@ export interface ImportContext {
     resolutions: Record<string, ItemResolution>;
     /** 用户补录的秘密值（仅内存，永不落盘/日志） */
     secretInputs: Record<string, string>;
+    /** 旧版加密备份的解密结果（仅内存；宿主解密后注入） */
     decryptedCredentials?: Map<string, string>;
     log: Logger;
     /** 消息翻译器（analyzer 注入；适配器用它生成计划项描述/校验/结果消息） */
@@ -461,7 +466,6 @@ export interface ExportReport {
     security: {
         secretsExcluded: boolean;
         containsSecrets: boolean;
-        encrypted: boolean;
         redactedHits: number;
         /** 本次导出镜像到本机 vault 的敏感文件数（文件级 vault；0 或缺失 = 未镜像） */
         vaultRefreshed?: number;
@@ -491,14 +495,6 @@ export interface ConfigAdapter<TSection = unknown> {
     /** 可选：针对本 adapter 的补偿动作 */
     rollback?(entries: SnapshotEntry[], ctx: HostContext): Promise<void>;
 }
-export interface EncryptionProvider {
-    encrypt(plaintext: string): Promise<{
-        blob: Uint8Array;
-        info: EncryptionInfo;
-    }>;
-    /** authTag 校验失败必须抛错 */
-    decrypt(blob: Uint8Array, info: EncryptionInfo, password: string): Promise<string>;
-}
 /** 导入被确认前拒绝执行（安全阀） */
 export declare class ImportNotConfirmedError extends Error {
     constructor(msg?: MsgFunc);

package/lib/index.d.ts

@@ -20,8 +20,8 @@
  *    (isLoopbackRequest); LAN-exposed deployments never serve these endpoints;
  *  - uploads/exported ZIPs are staged under $DSH_HOME/dsh-config-manager/{tmp,exports}
  *    and every `path`/`zipPath` reference is confined to those roots;
- *  - the encryption password is in-memory only: used to derive the AES-256-GCM
- *    key for secrets.enc, never written to any file, manifest, or log;
+ *  - there is no encryption layer: every backup is plaintext, and secret values are
+ *    stripped by the secret scanner before they reach any file, manifest, or log;
  *  - the import execute endpoint refuses to run without `confirm: true`
  *    (core ImportNotConfirmedError safety valve).
  *

package/lib/index.js

@@ -20,8 +20,8 @@
  *    (isLoopbackRequest); LAN-exposed deployments never serve these endpoints;
  *  - uploads/exported ZIPs are staged under $DSH_HOME/dsh-config-manager/{tmp,exports}
  *    and every `path`/`zipPath` reference is confined to those roots;
- *  - the encryption password is in-memory only: used to derive the AES-256-GCM
- *    key for secrets.enc, never written to any file, manifest, or log;
+ *  - there is no encryption layer: every backup is plaintext, and secret values are
+ *    stripped by the secret scanner before they reach any file, manifest, or log;
  *  - the import execute endpoint refuses to run without `confirm: true`
  *    (core ImportNotConfirmedError safety valve).
  *
@@ -70,7 +70,6 @@ import { ImportNotConfirmedError, ImportUserSkippedError } from './core/types.js
 import { createAdapters } from './adapters/index.js';
 import { HOME_PATCH_FILE, PROFILE_PATCH_FILE } from './core/patch-layers.js';
 import { createLocalPluginPackHook } from './core/local-plugin-host.js';
-import { createEncryptionProvider, decryptCredentials, decryptArchive, SecurityError, encryptArchive, isArchiveBlob, verifyEncryptedBlob } from './security/index.js';
 import { createHardenedZipParser } from './security/zip-security.js';
 import { atomicCopyFile, atomicWriteFile } from './utils/atomic-write.js';
 import { EnvironmentLockManager, runWithMutationLock, EnvironmentLockUnavailableError } from './utils/env-lock.js';
@@ -94,10 +93,9 @@ import { readUiPrefs, updateUiPrefs } from './sync/ui-prefs.js';
 import { redact } from './security/redaction.js';
 import { createConfiguredSecretScanner } from './security/secret-scanner.js';
 import { sha256Hex } from './utils/hashing.js';
-import { MANIFEST_FILE, parseManifest } from './schema/manifest.js';
 import { isFileSection, SECTION_IDS } from './schema/config.js';
 import { stringifyJsonSafe } from './utils/json.js';
-import { parseZip, zipToBuffer } from './utils/zip.js';
+import { zipToBuffer } from './utils/zip.js';
 import { isSameOrChild, normalizePath } from './utils/paths.js';
 import { createLogger } from './utils/logger.js';
 /* ---------------------------------------------------------------- identity */
@@ -106,7 +104,7 @@ export const name = 'config-manager';
 /** Services required before the engine can mount (present in every profile). */
 export const inject = ['settings', 'credentials'];
 /** Plugin version, kept in sync with package.json ("version"). */
-const PLUGIN_VERSION = '0.1.61';
+const PLUGIN_VERSION = '0.1.62';
 /** Plugin own package name — excluded from its own exported plugins list. */
 const PLUGIN_NAME = 'dsh-config-manager';
 /**
@@ -785,50 +783,6 @@ async function withTimeout(promise, ms, message) {
             clearTimeout(timer);
     }
 }
-/** Decrypt an encrypted backup's credentials (in-memory only; undefined when not applicable). */
-async function tryDecryptCredentials(zipPath, password) {
-    if (password === undefined || password === '')
-        return undefined;
-    const raw = await fs.readFile(zipPath);
-    const archive = parseZip(raw);
-    if (!archive.has(MANIFEST_FILE))
-        return undefined;
-    let manifest;
-    try {
-        manifest = parseManifest(archive.readEntryText(MANIFEST_FILE));
-    }
-    catch {
-        return undefined;
-    }
-    if (!manifest.security.encrypted || manifest.security.encryption === null)
-        return undefined;
-    if (!archive.has('security/secrets.enc'))
-        return undefined;
-    const blob = archive.readEntry('security/secrets.enc');
-    const plaintext = await decryptCredentials(blob, manifest.security.encryption, password);
-    let parsed;
-    try {
-        parsed = yaml.load(plaintext);
-    }
-    catch {
-        return undefined;
-    }
-    const map = new Map();
-    if (parsed !== null && typeof parsed === 'object') {
-        for (const [k, v] of Object.entries(parsed)) {
-            if (typeof v === 'string' && v !== '')
-                map.set(k, v);
-        }
-    }
-    return map;
-}
-/** 解密错误 → 用户可读文本：BAD_PASSWORD 只报「密码错误」（不泄内部细节），其余原文 */
-function decryptErrorText(error, msg) {
-    if (error instanceof SecurityError && error.code === 'BAD_PASSWORD') {
-        return msg('import.encryptedPasswordWrong');
-    }
-    return error instanceof Error ? error.message : String(error);
-}
 /* -------------------------------------------------- sync 路由（m-sync-ui） */
 /** 同步路由可预期的请求级错误（status 缺省 400；引擎/传输失败走 500） */
 export class SyncRouteError extends Error {
@@ -1604,13 +1558,6 @@ function makeRoutes(deps) {
         // 零写入；loopback fence 必备。
         // ------------------------------------------------------------ download
         // -------------------------------------------------------------- upload
-        // ------------------------------------------------------ decrypt-archive
-        // 整体加密备份容器的解锁（只读，零写入到任何配置）：用备份密码解密上传的加密容器，
-        // 得到明文 ZIP 写入受控临时目录并返回新 zipPath，供 analyze/plan/execute 引用。
-        // 导出时容器密码与内部 secrets.enc 密码同源（同一 password 派生两层加密），
-        // 因此顺带在明文 ZIP 上解出内部凭据覆盖清单（refs，非值）一并返回——
-        // 导入全程只需输入这一次密码，无需第二个密码校验页面。
-        // 密码仅内存随请求体传入，绝不落盘/落日志；解出的明文 ZIP 亦为临时文件，导入结束后清理。
         // ------------------------------------------------------------- analyze
         // ---------------------------------------------------------------- plan
         // ------------------------------------------------------------ progress

package/lib/security/index.d.ts

@@ -1,16 +1,14 @@
 /**
  * 安全模块公共出口（m4-security）：
- *  secret-scanner / encryption / integrity / zip-security / redaction。
+ *  secret-scanner / integrity / zip-security / redaction。
  *
  * 与 core 的注入点对齐：
  *  - `createSecretScanner()`        → ExporterOptions.scanner（SecretScanner 契约）
- *  - `createEncryptionProvider(pw)` → ExporterOptions.encryption（EncryptionProvider 契约）
  *  - `createHardenedZipParser()`    → ImporterOptions.parseZipOverride（(buf, limits?) => ZipArchive）
  *  - `safeExtractHardened()`        → m5 导入文件类分区落盘通道
  *  - `verifyChecksumsJson()`        → 完整性校验通道（core analyzer 已有内置校验，本模块供独立调用）
  */
 export * from './secret-scanner.ts';
-export * from './encryption.ts';
 export * from './integrity.ts';
 export * from './zip-security.ts';
 export * from './redaction.ts';

package/lib/security/index.js

@@ -1,16 +1,14 @@
 /**
  * 安全模块公共出口（m4-security）：
- *  secret-scanner / encryption / integrity / zip-security / redaction。
+ *  secret-scanner / integrity / zip-security / redaction。
  *
  * 与 core 的注入点对齐：
  *  - `createSecretScanner()`        → ExporterOptions.scanner（SecretScanner 契约）
- *  - `createEncryptionProvider(pw)` → ExporterOptions.encryption（EncryptionProvider 契约）
  *  - `createHardenedZipParser()`    → ImporterOptions.parseZipOverride（(buf, limits?) => ZipArchive）
  *  - `safeExtractHardened()`        → m5 导入文件类分区落盘通道
  *  - `verifyChecksumsJson()`        → 完整性校验通道（core analyzer 已有内置校验，本模块供独立调用）
  */
 export * from './secret-scanner.js';
-export * from './encryption.js';
 export * from './integrity.js';
 export * from './zip-security.js';
 export * from './redaction.js';

package/lib/sync/transport.d.ts

@@ -29,9 +29,9 @@ export interface SyncSnapshotMeta {
 /** 加密快照的 sections 载荷：整个明文 sections 对象序列化后整体加密（AES-256-GCM）。 */
 export interface EncryptedSections {
     encrypted: {
-        /** 加密参数（salt/iv/authTag base64；与 security/encryption.ts 的 EncryptionInfo 对齐） */
+        /** 加密参数（salt/iv/authTag base64）；本插件已不生成，仅供读取历史快照 */
         info: EncryptionInfo;
-        /** base64：带 DSC1 头的密文（明文 = 序列化的 sections Record） */
+        /** base64 密文（明文 = 序列化的 sections Record） */
         data: string;
     };
 }

package/lib/sync/transport.js

@@ -21,7 +21,7 @@ export function sectionsEqual(remote, local) {
     const r = remote.sections;
     const l = local.sections;
     if (Object.keys(l).length === 0)
-        return false; // 本地为空（加密快照）→ 无法比较
+        return false; // 本地无分区（空快照）→ 无法比较
     if (Object.keys(r).length !== Object.keys(l).length)
         return false;
     for (const key of Object.keys(r)) {

package/lib/ui/i18n.d.ts

@@ -35,11 +35,9 @@ export declare const uiZh: {
     readonly 'report.security': '安全：';
     readonly 'report.apiKeysExcluded': 'API 密钥已排除：';
     readonly 'report.containsSecrets': '包含密钥：';
-    readonly 'report.encrypted': '已加密：';
     readonly 'report.redacted': '{count} 个敏感字段已脱敏';
     readonly 'report.file': '文件：';
     readonly 'report.yes': '是';
-    readonly 'report.yesEncrypted': '是（加密）';
     readonly 'report.no': '否';
     readonly 'report.importedRestored': '已导入/恢复';
     readonly 'report.skipped': '跳过';
@@ -151,7 +149,6 @@ export declare const uiZh: {
     readonly 'sync.pushOk': '推送成功（快照 {id}）';
     readonly 'sync.pushPreviewHeadline': '将推送 {total} 个分区（{changed} 个有变化）';
     readonly 'sync.pushPreviewHint': '以上为只读预览，不会写入远端。确认后点击「推送」才真正上传。';
-    readonly 'sync.pushPreviewEncrypted': '加密快照：载荷将整体加密，各分区相对基线的变化不可比对。';
     readonly 'sync.pullFailed': '拉取失败';
     readonly 'sync.pullOk': '远端快照 {id} 差异预览：共 {count} 项变更';
     readonly 'sync.pullEmpty': '远端快照与本地一致（无变更）';

package/lib/ui/i18n.js

@@ -38,11 +38,9 @@ export const uiZh = {
     'report.security': '安全：',
     'report.apiKeysExcluded': 'API 密钥已排除：',
     'report.containsSecrets': '包含密钥：',
-    'report.encrypted': '已加密：',
     'report.redacted': '{count} 个敏感字段已脱敏',
     'report.file': '文件：',
     'report.yes': '是',
-    'report.yesEncrypted': '是（加密）',
     'report.no': '否',
     'report.importedRestored': '已导入/恢复',
     'report.skipped': '跳过',
@@ -158,7 +156,6 @@ export const uiZh = {
     'sync.pushOk': '推送成功（快照 {id}）',
     'sync.pushPreviewHeadline': '将推送 {total} 个分区（{changed} 个有变化）',
     'sync.pushPreviewHint': '以上为只读预览，不会写入远端。确认后点击「推送」才真正上传。',
-    'sync.pushPreviewEncrypted': '加密快照：载荷将整体加密，各分区相对基线的变化不可比对。',
     'sync.pullFailed': '拉取失败',
     'sync.pullOk': '远端快照 {id} 差异预览：共 {count} 项变更',
     'sync.pullEmpty': '远端快照与本地一致（无变更）',
@@ -320,11 +317,9 @@ export const uiEn = {
     'report.security': 'Security:',
     'report.apiKeysExcluded': 'API Keys excluded:',
     'report.containsSecrets': 'Contains secrets:',
-    'report.encrypted': 'Encrypted:',
     'report.redacted': '{count} sensitive field(s) redacted',
     'report.file': 'File:',
     'report.yes': 'yes',
-    'report.yesEncrypted': 'yes (encrypted)',
     'report.no': 'no',
     'report.importedRestored': 'imported/restored',
     'report.skipped': 'skipped',
@@ -436,7 +431,6 @@ export const uiEn = {
     'sync.pushOk': 'Push succeeded (snapshot {id})',
     'sync.pushPreviewHeadline': 'Will push {total} section(s) ({changed} changed)',
     'sync.pushPreviewHint': 'Read-only preview above — nothing is written to the remote. Click "Push" to actually upload.',
-    'sync.pushPreviewEncrypted': 'Encrypted snapshot: the payload is encrypted as a whole; per-section changes vs the baseline cannot be compared.',
     'sync.pullFailed': 'Pull failed',
     'sync.pullOk': 'Remote snapshot {id} diff preview: {count} change(s)',
     'sync.pullEmpty': 'Remote snapshot matches local (no changes)',

package/lib/ui/report.js

@@ -18,8 +18,7 @@ export function renderExportReport(report, t = zhUiT) {
     }
     lines.push(t('report.security'));
     lines.push(`  ✓ ${t('report.apiKeysExcluded')} ${report.security.secretsExcluded ? t('report.yes') : t('report.no')}`);
-    lines.push(`  ✓ ${t('report.containsSecrets')} ${report.security.containsSecrets ? t('report.yesEncrypted') : t('report.no')}`);
-    lines.push(`  ✓ ${t('report.encrypted')} ${report.security.encrypted ? t('report.yes') : t('report.no')}`);
+    lines.push(`  ✓ ${t('report.containsSecrets')} ${report.security.containsSecrets ? t('report.yes') : t('report.no')}`);
     if (report.security.redactedHits > 0)
         lines.push(`  ⚠ ${t('report.redacted', { count: String(report.security.redactedHits) })}`);
     lines.push('');

package/lib/ui/test-helpers.d.ts

@@ -46,7 +46,6 @@ export declare class MockImportPort implements ImportPort {
         confirm: boolean;
         secretInputs?: Record<string, string>;
         rollbackOnError: boolean;
-        decryptPassword?: string;
         plan?: ImportPlan;
     }[];
     constructor(opts?: {
@@ -56,14 +55,9 @@ export declare class MockImportPort implements ImportPort {
     });
     analyzeImport(): Promise<ImportAnalysis>;
     createImportPlan(_zip: string, decisions: ImportDecisions): Promise<ImportPlan>;
-    decryptArchive(zipPath: string): Promise<{
-        zipPath: string;
-        refs: string[];
-    }>;
     executeImportPlan(_zip: string, plan: ImportPlan, opts: {
         confirm: boolean;
         secretInputs?: Record<string, string>;
         rollbackOnError: boolean;
-        decryptPassword?: string;
     }): Promise<ImportResult>;
 }

package/lib/ui/test-helpers.js

@@ -20,7 +20,7 @@ export function makeExportReport(overrides = {}) {
             { section: 'plugins', counts: { plugins: 8 } },
         ],
         excluded: ['sessions', 'pluginFiles'],
-        security: { secretsExcluded: true, containsSecrets: false, encrypted: false, redactedHits: 2 },
+        security: { secretsExcluded: true, containsSecrets: false, redactedHits: 2 },
         file: { name: 'dsh-config-2026-08-14.zip', sizeBytes: 20480 },
         warnings: [],
         ...overrides,
@@ -142,10 +142,6 @@ export class MockImportPort {
         this.planCalls.push(decisions);
         return this.plan;
     }
-    async decryptArchive(zipPath) {
-        // 测试用：把传入路径视为已解锁的明文 ZIP（不真正解密），无内部凭据
-        return { zipPath, refs: [] };
-    }
     async executeImportPlan(_zip, plan, opts) {
         this.executeCalls.push({ ...opts, plan });
         return this.result;