@logictan/dsh-config-manager 0.1.61 → 0.1.62

package/src/security/security.test.ts

@@ -16,8 +16,6 @@ import { createLogger, type Logger } from '../utils/logger.ts';
 import { zipToBuffer, parseZip, crc32, ZipSafetyError, type ZipWriteEntry } from '../utils/zip.ts';
 import { normalizePath } from '../utils/paths.ts';
 import { sha256Hex } from '../utils/hashing.ts';
-import { CredentialsAdapter } from '../adapters/credentials.ts';
-import { parseManifest } from '../schema/manifest.ts';
 import type {
   ConfigAdapter, CredentialsFacade, ExportSection, FileSystemFacade, HostContext,
   NamespaceInfo, PatchFileFacade, PluginsFacade, SettingsFacade, SnapshotStore,
@@ -32,12 +30,6 @@ import {
   DEFAULT_SECRET_FIELD_NAMES,
 } from './secret-scanner.ts';
 import type { ValuePattern, ConfiguredSecretPatterns } from './secret-scanner.ts';
-import {
-  encryptCredentials, decryptCredentials, createEncryptionProvider,
-  SecurityError, SCHEMA_MAGIC, SCHEMA_VERSION, HEADER_LENGTH, SALT_LENGTH, IV_LENGTH,
-  SCRYPT_PARAMS,
-  encryptArchive, decryptArchive, verifyEncryptedBlob, isArchiveBlob, ARCHIVE_MAGIC,
-} from './encryption.ts';
 import {
   buildChecksums, parseChecksumsTable, verifyChecksums, verifyChecksumsJson, describeMismatches,
 } from './integrity.ts';
@@ -266,158 +258,6 @@ class MiniSettingsAdapter implements ConfigAdapter<SettingsSection> {
   async validate() { return { valid: true, issues: [] }; }
 }
 
-/* ================= encryption ================= */
-
-test('encryption: 往返加密解密一致（scrypt + AES-256-GCM）', async () => {
-  const plaintext = 'DEEPSEEK_API_KEY: sk-super-secret-123\nGITHUB_TOKEN: ghp_abcdefghijklmnopqrstuvwxyz\n';
-  const { blob, info } = await encryptCredentials(plaintext, 'correct horse battery');
-  // blob 布局
-  assert.equal(Buffer.from(blob.subarray(0, 4)).toString('ascii'), SCHEMA_MAGIC);
-  assert.equal(blob[4], SCHEMA_VERSION);
-  assert.equal(blob.length, HEADER_LENGTH + Buffer.byteLength(plaintext, 'utf8'));
-  assert.equal(info.algorithm, 'aes-256-gcm');
-  assert.equal(info.kdf, 'scrypt');
-  assert.deepEqual(info.kdfParams, { ...SCRYPT_PARAMS });
-  assert.equal(info.version, 1);
-  // 解密往返
-  const decrypted = await decryptCredentials(blob, info, 'correct horse battery');
-  assert.equal(decrypted, plaintext);
-});
-
-test('encryption: 错误密码 → BAD_PASSWORD（认证失败，不泄明文）', async () => {
-  const { blob, info } = await encryptCredentials('sk-super-secret', 'right-password');
-  await assert.rejects(
-    () => decryptCredentials(blob, info, 'wrong-password'),
-    (err: unknown) => err instanceof SecurityError && err.code === 'BAD_PASSWORD',
-  );
-});
-
-test('encryption: 篡改 manifest 加密参数 → TAMPERED', async () => {
-  const { blob, info } = await encryptCredentials('sk-super-secret', 'pw-12345678');
-  // 篡改 info.authTag（元数据不一致）
-  const tampered = { ...info, authTag: Buffer.from('tampered').toString('base64') };
-  await assert.rejects(
-    () => decryptCredentials(blob, tampered, 'pw-12345678'),
-    (err: unknown) => err instanceof SecurityError && err.code === 'TAMPERED',
-  );
-  // 篡改 info.salt
-  await assert.rejects(
-    () => decryptCredentials(blob, { ...info, salt: Buffer.alloc(SALT_LENGTH, 1).toString('base64') }, 'pw-12345678'),
-    (err: unknown) => err instanceof SecurityError && err.code === 'TAMPERED',
-  );
-  // 篡改密文字节 → GCM 认证失败（归为 BAD_PASSWORD：密码错误或密文被改）
-  const flipped = Buffer.from(blob);
-  flipped[HEADER_LENGTH] = flipped[HEADER_LENGTH]! ^ 0xff;
-  await assert.rejects(
-    () => decryptCredentials(flipped, info, 'pw-12345678'),
-    (err: unknown) => err instanceof SecurityError && err.code === 'BAD_PASSWORD',
-  );
-});
-
-test('encryption: 截断 blob → TAMPERED；坏 magic → UNSUPPORTED_FORMAT', async () => {
-  const { blob, info } = await encryptCredentials('secret', 'pw-12345678');
-  await assert.rejects(
-    () => decryptCredentials(blob.subarray(0, 10), info, 'pw-12345678'),
-    (err: unknown) => err instanceof SecurityError && err.code === 'TAMPERED',
-  );
-  const badMagic = Buffer.from(blob);
-  badMagic.write('XXXX', 0, 'ascii');
-  await assert.rejects(
-    () => decryptCredentials(badMagic, info, 'pw-12345678'),
-    (err: unknown) => err instanceof SecurityError && err.code === 'UNSUPPORTED_FORMAT',
-  );
-  // kdfParams 被篡改成超大 N（DoS 向量）→ 拒绝
-  await assert.rejects(
-    () => decryptCredentials(blob, { ...info, kdfParams: { N: 2 ** 24, r: 8, p: 1, keyLength: 32 } }, 'pw-12345678'),
-    (err: unknown) => err instanceof SecurityError && err.code === 'UNSUPPORTED_FORMAT',
-  );
-});
-
-test('encryption: 每次导出 salt/iv 随机；密码绝不出现在 info 与 blob 头', async () => {
-  const password = 'my-secret-password-123';
-  const r1 = await encryptCredentials('value', password);
-  const r2 = await encryptCredentials('value', password);
-  assert.notEqual(r1.info.salt, r2.info.salt);
-  assert.notEqual(r1.info.iv, r2.info.iv);
-  const infoJson = JSON.stringify(r1.info);
-  const infoKeys = Object.keys(r1.info);
-  assert.ok(!infoKeys.some((k) => k.toLowerCase().includes('password')), 'info 不得含 password 字段');
-  assert.ok(!infoJson.includes(password), '密码值不得进入 info');
-  assert.ok(!Buffer.from(r1.blob.subarray(0, HEADER_LENGTH)).toString('utf8').includes(password));
-});
-
-test('encryption: createEncryptionProvider 对齐 core EncryptionProvider 契约', async () => {
-  const provider = createEncryptionProvider('provider-pw-123');
-  const plaintext = 'REF: value';
-  const { blob, info } = await provider.encrypt(plaintext); // encrypt 无密码参数（闭包持有）
-  const decrypted = await provider.decrypt(blob, info, 'provider-pw-123');
-  assert.equal(decrypted, plaintext);
-  // decrypt 用调用方传入的密码（换密码解密支持）
-  await assert.rejects(
-    () => provider.decrypt(blob, info, 'another-pw-123'),
-    (err: unknown) => err instanceof SecurityError && err.code === 'BAD_PASSWORD',
-  );
-});
-
-
-
-
-/* ---------------- 整体备份容器加密（encryptArchive / verifyEncryptedBlob / decryptArchive） ---------------- */
-
-test('archive: 往返加解密一致（任意二进制 ZIP 字节无损）', async () => {
-  const zipBytes = Buffer.from('PK\x03\x04this-is-a-real-zip-binary-content\u0000\x01\x02', 'binary');
-  const password = 'archive-password-123';
-  const { blob } = await encryptArchive(zipBytes, password);
-  assert.ok(isArchiveBlob(blob), 'magic DCA1 可探测');
-  assert.equal(Buffer.from(blob.subarray(0, 4)).toString('ascii'), ARCHIVE_MAGIC);
-
-  const verified = await verifyEncryptedBlob(blob, password);
-  assert.equal(verified.valid, true);
-  assert.equal(verified.ok, true);
-  assert.ok(verified.info && verified.kdf, '应返回解密参数');
-
-  const decrypted = await decryptArchive(blob, verified.info!, verified.kdf!, password);
-  assert.deepEqual(Buffer.from(decrypted), zipBytes, '解出的明文 ZIP 字节必须无损一致');
-});
-
-test('archive: 密码错误 → BAD_PASSWORD（verify 与 decrypt 都拒绝，不泄明文）', async () => {
-  const zipBytes = Buffer.from('PK\x03\x04dsh-config-plaintext');
-  const password = 'right-password';
-  const { blob } = await encryptArchive(zipBytes, password);
-  const verified = await verifyEncryptedBlob(blob, 'wrong-password');
-  assert.equal(verified.valid, true);
-  assert.equal(verified.ok, false);
-  assert.equal(verified.code, 'BAD_PASSWORD');
-  await assert.rejects(
-    () => decryptArchive(blob, verified.info!, verified.kdf!, 'wrong-password'),
-    (err: unknown) => err instanceof SecurityError && err.code === 'BAD_PASSWORD',
-  );
-});
-
-test('archive: 非容器字节 → valid=false（体积不足判 TAMPERED；magic 不符判 UNSUPPORTED_FORMAT）', async () => {
-  const tooShort = Buffer.from('PK\x03\x04plain-zip-not-encrypted');
-  assert.equal(isArchiveBlob(tooShort), false);
-  const v = await verifyEncryptedBlob(tooShort, 'pw');
-  assert.equal(v.valid, false);
-  assert.equal(v.code, 'TAMPERED', '体积不足 → TAMPERED');
-
-  // 长度足够的非容器字节 → magic 不符 → UNSUPPORTED_FORMAT
-  const fullLen = Buffer.alloc(64);
-  fullLen.write('PK\x03\x04', 0, 'binary');
-  const v2 = await verifyEncryptedBlob(fullLen, 'pw');
-  assert.equal(v2.valid, false);
-  assert.equal(v2.code, 'UNSUPPORTED_FORMAT');
-});
-
-test('archive: 篡改密文 → verify ok=false（GCM 认证失败）', async () => {
-  const { blob } = await encryptArchive(Buffer.from('sensitive-archive'), 'archive-pw-123');
-  const tampered = Buffer.from(blob);
-  tampered[tampered.length - 1] = tampered[tampered.length - 1]! ^ 0xff;
-  const verified = await verifyEncryptedBlob(tampered, 'archive-pw-123');
-  assert.equal(verified.valid, true);
-  assert.equal(verified.ok, false, '篡改后密码验证必失败');
-});
-
 /* ================= zip-security ================= */
 
 test('zip-security: parseZipHardened 兼容 core 正常 ZIP', () => {
@@ -992,207 +832,6 @@ test('集成: Exporter + createSecretScanner 剥离自定义敏感字段（第
   });
 });
 
-test('集成: Exporter + EncryptionProvider 加密备份（secrets.enc + manifest + 解密恢复）', async () => {
-  await withTmp(async (dir) => {
-    const homeDir = path.join(dir, 'home');
-    const ctx = new MockHostContext(homeDir);
-    ctx.settings.ns.set('general', { value: { theme: 'dark' }, revision: 1, secrets: [] });
-    const credentialsYaml = 'DEEPSEEK_API_KEY: sk-super-secret-value\nGITHUB_TOKEN: ghp_abcdefghijklmnopqrstuvwxyz\n';
-    await ctx.fs.writeFile(path.join(homeDir, '.credentials.yaml'), Buffer.from(credentialsYaml, 'utf8'));
-
-    const adapters: ConfigAdapter[] = [new MiniSettingsAdapter()];
-    const zipPath = path.join(dir, 'enc.zip');
-    const password = 'backup-password-123';
-    const exporter = new Exporter({
-      ctx,
-      adapters,
-      scanner: createSecretScanner(),
-      encryption: createEncryptionProvider(password),
-      now: () => new Date('2026-08-14T12:00:00.000Z'),
-    });
-    const { manifest } = await exporter.export({ includeSecrets: true, outPath: zipPath });
-
-    assert.equal(manifest.security.containsSecrets, true);
-    assert.equal(manifest.security.encrypted, true);
-    assert.ok(manifest.security.encryption, '应记录加密参数');
-    assert.equal(manifest.security.encryption!.kdf, 'scrypt');
-
-    const archive = parseZip(await fs.readFile(zipPath));
-    assert.ok(archive.has('security/secrets.enc'), 'secrets.enc 应写入 ZIP');
-    // 密码绝不出现在 manifest 文本
-    const manifestText = archive.readEntryText('manifest.json');
-    assert.ok(!manifestText.includes(password), '密码不得出现在 manifest');
-    assert.ok(!manifestText.includes('sk-super-secret-value'), '明文秘密不得出现在 manifest');
-
-    // 解密恢复
-    const blob = archive.readEntry('security/secrets.enc');
-    const decrypted = await decryptCredentials(blob, manifest.security.encryption!, password);
-    assert.equal(decrypted, credentialsYaml);
-  });
-});
-
-test('集成: 加密备份导入强制密码——无解密结果拒绝，正确解密恢复凭据', async () => {
-  await withTmp(async (dir) => {
-    const homeDir = path.join(dir, 'home');
-    const src = new MockHostContext(homeDir);
-    src.settings.ns.set('general', { value: { theme: 'dark', apiKeyEnv: 'DEEPSEEK_API_KEY' }, revision: 1, secrets: [] });
-    src.credentials.values.set('DEEPSEEK_API_KEY', 'sk-super-secret-value');
-    await src.fs.writeFile(
-      path.join(homeDir, '.credentials.yaml'),
-      Buffer.from('DEEPSEEK_API_KEY: sk-super-secret-value\n', 'utf8'),
-    );
-    const credentialsAdapter = new CredentialsAdapter({ refs: async () => ['DEEPSEEK_API_KEY'] });
-    const adapters: ConfigAdapter[] = [new MiniSettingsAdapter(), credentialsAdapter];
-    const zipPath = path.join(dir, 'enc.zip');
-    const password = 'backup-password-123';
-    await new Exporter({
-      ctx: src,
-      adapters,
-      scanner: createSecretScanner(),
-      encryption: createEncryptionProvider(password),
-      now: () => new Date('2026-08-14T12:00:00.000Z'),
-    }).export({ includeSecrets: true, outPath: zipPath });
-
-    const dst = new MockHostContext(path.join(dir, 'dst-home'));
-    const importer = new Importer({ ctx: dst, adapters, snapshotStore: new MemSnapshotStore() });
-
-    // 分析层必须暴露加密标志（UI 据此要求输入解密密码）
-    const analysis = await importer.analyzeImport(zipPath);
-    assert.equal(analysis.encrypted, true);
-    assert.equal(analysis.secretCount, 1);
-
-    const plan = await importer.createImportPlan(zipPath, { strategy: 'merge', resolutions: {}, pathMappings: [] });
-    assert.ok(plan.missingSecrets.some((s) => s.ref === 'DEEPSEEK_API_KEY'));
-
-    // 1) 无解密结果：加密备份拒绝执行（不允许「无密码照样导入」）
-    await assert.rejects(
-      () => importer.executeImportPlan(zipPath, plan, { confirm: true }),
-      /解密密码才能导入/,
-    );
-    assert.equal(dst.credentials.values.has('DEEPSEEK_API_KEY'), false, '拒绝时不得写入任何凭据');
-
-    // 2) 正确解密结果（宿主用备份密码解开 secrets.enc 注入）：凭据恢复，不再要求补录
-    const archive = parseZip(await fs.readFile(zipPath));
-    const manifest = parseManifest(archive.readEntryText('manifest.json'));
-    const blob = archive.readEntry('security/secrets.enc');
-    const plaintext = await decryptCredentials(blob, manifest.security.encryption!, password);
-    const map = new Map<string, string>();
-    for (const line of plaintext.split('\n')) {
-      const m = /^([A-Za-z0-9_]+):\s*(.+)$/.exec(line.trim());
-      if (m) map.set(m[1]!, m[2]!);
-    }
-    const result = await importer.executeImportPlan(zipPath, plan, { confirm: true, decryptedCredentials: map });
-    assert.equal(result.ok, true);
-    assert.equal(result.missingSecrets.length, 0, '解密覆盖的凭据不再计入缺失');
-    assert.equal(dst.credentials.values.get('DEEPSEEK_API_KEY'), 'sk-super-secret-value');
-  });
-});
-
-test('集成: includeSecrets 无加密提供者 → 拒绝（绝不明文导出秘密）', async () => {
-  await withTmp(async (dir) => {
-    const ctx = new MockHostContext(path.join(dir, 'home'));
-    ctx.settings.ns.set('general', { value: { theme: 'dark' }, revision: 1, secrets: [] });
-    const exporter = new Exporter({ ctx, adapters: [new MiniSettingsAdapter()], now: () => new Date() });
-    await assert.rejects(
-      () => exporter.export({ includeSecrets: true, outPath: path.join(dir, 'x.zip') }),
-      /EncryptionProvider/,
-    );
-  });
-});
-
-test('集成: 只加密不导出密钥（encryption 提供但 includeSecrets=false）→ 备份仍标记加密，但不含任何凭据值', async () => {
-  await withTmp(async (dir) => {
-    const homeDir = path.join(dir, 'home');
-    const ctx = new MockHostContext(homeDir);
-    ctx.settings.ns.set('general', { value: { theme: 'dark' }, revision: 1, secrets: [] });
-    // 存在真实凭据文件，但用户只勾了「加密备份」、未勾「导出密钥」—— 凭据值绝不能进备份
-    const credentialsYaml = 'DEEPSEEK_API_KEY: sk-super-secret-value\n';
-    await ctx.fs.writeFile(path.join(homeDir, '.credentials.yaml'), Buffer.from(credentialsYaml, 'utf8'));
-
-    const adapters: ConfigAdapter[] = [new MiniSettingsAdapter()];
-    const zipPath = path.join(dir, 'enc-only.zip');
-    const password = 'backup-password-123';
-    const exporter = new Exporter({
-      ctx,
-      adapters,
-      scanner: createSecretScanner(),
-      encryption: createEncryptionProvider(password),
-      now: () => new Date('2026-08-14T12:00:00.000Z'),
-    });
-    const { manifest } = await exporter.export({ includeSecrets: false, outPath: zipPath });
-
-    assert.equal(manifest.security.encrypted, true, '加密是独立选项：不含密钥也应标记加密');
-    assert.equal(manifest.security.containsSecrets, false, '未导出密钥：不得声称包含秘密');
-    assert.ok(manifest.security.encryption, '应记录加密参数');
-
-    const archive = parseZip(await fs.readFile(zipPath));
-    assert.ok(archive.has('security/secrets.enc'), 'secrets.enc 应写入 ZIP');
-    const blob = archive.readEntry('security/secrets.enc');
-    const decrypted = await decryptCredentials(blob, manifest.security.encryption!, password);
-    assert.equal(decrypted, '', '未导出密钥时 secrets.enc 解密内容必须为空');
-    for (const name of archive.names()) {
-      if (name === 'security/secrets.enc') continue // secrets.enc 为二进制加密内容，单独断言解密结果
-      assert.ok(
-        !archive.readEntryText(name).includes('sk-super-secret-value'),
-        `凭据值绝不得出现在备份条目 ${name} 中`,
-      )
-    }
-  });
-});
-
-test('集成: 整体加密备份容器——导出→容器→解锁→明文 ZIP→分析（完整链路）', async () => {
-  await withTmp(async (dir) => {
-    const homeDir = path.join(dir, 'home');
-    const ctx = new MockHostContext(homeDir);
-    ctx.settings.ns.set('general', { value: { theme: 'dark' }, revision: 1, secrets: [] });
-    await ctx.fs.writeFile(
-      path.join(homeDir, '.credentials.yaml'),
-      Buffer.from('DEEPSEEK_API_KEY: sk-super-secret-value\n', 'utf8'),
-    );
-    const adapters: ConfigAdapter[] = [new MiniSettingsAdapter()];
-    const password = 'archive-whole-backup-pw';
-
-    // 1) Exporter 生成明文 ZIP（注入 EncryptionProvider 以便 includeSecrets 在 ZIP 内产出 secrets.enc；
-    //    最终整体加密由外层容器完成）
-    const plainZip = path.join(dir, 'plain.zip');
-    await new Exporter({
-      ctx,
-      adapters,
-      encryption: createEncryptionProvider(password),
-      now: () => new Date(),
-    }).export({ includeSecrets: true, outPath: plainZip });
-
-    // 2) 整体加密为容器
-    const rawZip = await fs.readFile(plainZip);
-    const { blob } = await encryptArchive(rawZip, password);
-    const containerPath = path.join(dir, 'backup.zip');
-    await fs.writeFile(containerPath, blob);
-    assert.ok(isArchiveBlob(await fs.readFile(containerPath)), '落盘文件是加密容器（magic DCA1）');
-
-    // 3) 解锁（只读校验 + 解密）→ 明文 ZIP
-    const containerBytes = await fs.readFile(containerPath);
-    const verified = await verifyEncryptedBlob(containerBytes, password);
-    assert.equal(verified.valid, true);
-    assert.equal(verified.ok, true, '正确密码应通过验证');
-    const plain = await decryptArchive(containerBytes, verified.info!, verified.kdf!, password);
-    const unlockedPath = path.join(dir, 'unlocked.zip');
-    await fs.writeFile(unlockedPath, plain);
-
-    // 4) 明文 ZIP 可被 Importer 正常分析
-    const importer = new Importer({ ctx, adapters, snapshotStore: new MemSnapshotStore() });
-    const analysis = await importer.analyzeImport(unlockedPath);
-    assert.equal(analysis.valid, true);
-    assert.deepEqual(analysis.sectionsInZip, ['settings']);
-
-    // 5) 明文 ZIP 中确实包含完整凭据（includeSecrets=true 时 Exporter 在 ZIP 内写入 secrets.enc）
-    const archive = parseZip(plain);
-    assert.ok(archive.has('security/secrets.enc'), '容器解出的 ZIP 含 secrets.enc（凭据受容器整体保护）');
-    // 错误密码：verify 拒绝
-    const wrong = await verifyEncryptedBlob(containerBytes, 'wrong-password');
-    assert.equal(wrong.ok, false);
-  });
-});
-
 test('集成: Importer + parseZipOverride=createHardenedZipParser 正常解析备份', async () => {
   await withTmp(async (dir) => {
     const homeDir = path.join(dir, 'home');

package/src/sync/transport.ts

@@ -33,9 +33,9 @@ export interface SyncSnapshotMeta {
 /** 加密快照的 sections 载荷：整个明文 sections 对象序列化后整体加密（AES-256-GCM）。 */
 export interface EncryptedSections {
   encrypted: {
-    /** 加密参数（salt/iv/authTag base64；与 security/encryption.ts 的 EncryptionInfo 对齐） */
+    /** 加密参数（salt/iv/authTag base64）；本插件已不生成，仅供读取历史快照 */
     info: EncryptionInfo;
-    /** base64：带 DSC1 头的密文（明文 = 序列化的 sections Record） */
+    /** base64 密文（明文 = 序列化的 sections Record） */
     data: string;
   };
 }
@@ -87,7 +87,7 @@ export function computeSnapshotMeta(snapshot: SyncSnapshot): SyncSnapshotMeta {
 export function sectionsEqual(remote: SyncSnapshotMeta, local: SyncSnapshotMeta): boolean {
   const r = remote.sections;
   const l = local.sections;
-  if (Object.keys(l).length === 0) return false; // 本地为空（加密快照）→ 无法比较
+  if (Object.keys(l).length === 0) return false; // 本地无分区（空快照）→ 无法比较
   if (Object.keys(r).length !== Object.keys(l).length) return false;
   for (const key of Object.keys(r)) {
     if (r[key as SectionId] !== l[key as SectionId]) return false;

package/src/ui/i18n.ts

@@ -39,11 +39,9 @@ export const uiZh = {
   'report.security': '安全：',
   'report.apiKeysExcluded': 'API 密钥已排除：',
   'report.containsSecrets': '包含密钥：',
-  'report.encrypted': '已加密：',
   'report.redacted': '{count} 个敏感字段已脱敏',
   'report.file': '文件：',
   'report.yes': '是',
-  'report.yesEncrypted': '是（加密）',
   'report.no': '否',
   'report.importedRestored': '已导入/恢复',
   'report.skipped': '跳过',
@@ -159,7 +157,6 @@ export const uiZh = {
   'sync.pushOk': '推送成功（快照 {id}）',
   'sync.pushPreviewHeadline': '将推送 {total} 个分区（{changed} 个有变化）',
   'sync.pushPreviewHint': '以上为只读预览，不会写入远端。确认后点击「推送」才真正上传。',
-  'sync.pushPreviewEncrypted': '加密快照：载荷将整体加密，各分区相对基线的变化不可比对。',
   'sync.pullFailed': '拉取失败',
   'sync.pullOk': '远端快照 {id} 差异预览：共 {count} 项变更',
   'sync.pullEmpty': '远端快照与本地一致（无变更）',
@@ -324,11 +321,9 @@ export const uiEn: Record<UiTextKey, string> = {
   'report.security': 'Security:',
   'report.apiKeysExcluded': 'API Keys excluded:',
   'report.containsSecrets': 'Contains secrets:',
-  'report.encrypted': 'Encrypted:',
   'report.redacted': '{count} sensitive field(s) redacted',
   'report.file': 'File:',
   'report.yes': 'yes',
-  'report.yesEncrypted': 'yes (encrypted)',
   'report.no': 'no',
   'report.importedRestored': 'imported/restored',
   'report.skipped': 'skipped',
@@ -440,7 +435,6 @@ export const uiEn: Record<UiTextKey, string> = {
   'sync.pushOk': 'Push succeeded (snapshot {id})',
   'sync.pushPreviewHeadline': 'Will push {total} section(s) ({changed} changed)',
   'sync.pushPreviewHint': 'Read-only preview above — nothing is written to the remote. Click "Push" to actually upload.',
-  'sync.pushPreviewEncrypted': 'Encrypted snapshot: the payload is encrypted as a whole; per-section changes vs the baseline cannot be compared.',
   'sync.pullFailed': 'Pull failed',
   'sync.pullOk': 'Remote snapshot {id} diff preview: {count} change(s)',
   'sync.pullEmpty': 'Remote snapshot matches local (no changes)',

package/src/ui/report.ts

@@ -30,8 +30,7 @@ export function renderExportReport(report: ExportReport, t: UiT = zhUiT): string
   }
   lines.push(t('report.security'));
   lines.push(`  ✓ ${t('report.apiKeysExcluded')} ${report.security.secretsExcluded ? t('report.yes') : t('report.no')}`);
-  lines.push(`  ✓ ${t('report.containsSecrets')} ${report.security.containsSecrets ? t('report.yesEncrypted') : t('report.no')}`);
-  lines.push(`  ✓ ${t('report.encrypted')} ${report.security.encrypted ? t('report.yes') : t('report.no')}`);
+  lines.push(`  ✓ ${t('report.containsSecrets')} ${report.security.containsSecrets ? t('report.yes') : t('report.no')}`);
   if (report.security.redactedHits > 0) lines.push(`  ⚠ ${t('report.redacted', { count: String(report.security.redactedHits) })}`);
   lines.push('');
   lines.push(`${t('report.file')} ${report.file.name} (${formatBytes(report.file.sizeBytes)})`);

package/src/ui/test-helpers.ts

@@ -33,7 +33,7 @@ export function makeExportReport(overrides: Partial<ExportReport> = {}): ExportR
       { section: 'plugins', counts: { plugins: 8 } },
     ],
     excluded: ['sessions', 'pluginFiles'],
-    security: { secretsExcluded: true, containsSecrets: false, encrypted: false, redactedHits: 2 },
+    security: { secretsExcluded: true, containsSecrets: false, redactedHits: 2 },
     file: { name: 'dsh-config-2026-08-14.zip', sizeBytes: 20480 },
     warnings: [],
     ...overrides,
@@ -149,7 +149,7 @@ export class MockImportPort implements ImportPort {
   result: ImportResult;
   analyzeCalls = 0;
   planCalls: ImportDecisions[] = [];
-  executeCalls: { confirm: boolean; secretInputs?: Record<string, string>; rollbackOnError: boolean; decryptPassword?: string; plan?: ImportPlan }[] = [];
+  executeCalls: { confirm: boolean; secretInputs?: Record<string, string>; rollbackOnError: boolean; plan?: ImportPlan }[] = [];
 
   constructor(opts: {
     analysis?: ImportAnalysis;
@@ -169,14 +169,10 @@ export class MockImportPort implements ImportPort {
     this.planCalls.push(decisions);
     return this.plan;
   }
-  async decryptArchive(zipPath: string): Promise<{ zipPath: string; refs: string[] }> {
-    // 测试用：把传入路径视为已解锁的明文 ZIP（不真正解密），无内部凭据
-    return { zipPath, refs: [] };
-  }
   async executeImportPlan(
     _zip: string,
     plan: ImportPlan,
-    opts: { confirm: boolean; secretInputs?: Record<string, string>; rollbackOnError: boolean; decryptPassword?: string },
+    opts: { confirm: boolean; secretInputs?: Record<string, string>; rollbackOnError: boolean },
   ): Promise<ImportResult> {
     this.executeCalls.push({ ...opts, plan });
     return this.result;

package/src/ui/types.ts

@@ -175,14 +175,6 @@ export interface RollbackView {
 export interface ImportPort {
   analyzeImport(zipPath: string): Promise<ImportAnalysis>;
   createImportPlan(zipPath: string, decisions: ImportDecisions): Promise<ImportPlan>;
-  /**
-   * 解锁整体加密备份（只读，零写入）：用备份密码解密上传的加密容器，得到明文 ZIP
-   * 写入受控临时目录并返回新的 zipPath，供 analyze/plan/execute 引用。
-   * 顺带返回解密覆盖的凭据 ref 名（非值）——导出时容器密码与内部 secrets.enc
-   * 密码同源，解锁即完成凭据解密验证，无需第二次密码校验。
-   * 密码仅内存，绝不落盘/落日志；解密后的明文 ZIP 亦为临时文件，导入结束后清理。
-   */
-  decryptArchive(zipPath: string, password: string): Promise<{ zipPath: string; refs: string[] }>;
   executeImportPlan(
     zipPath: string,
     plan: ImportPlan,
@@ -192,8 +184,6 @@ export interface ImportPort {
       secretInputs?: Record<string, string>;
       /** 显式回滚策略：true=任一项失败整体回滚（场景 E）；false=单项失败继续（§34.17） */
       rollbackOnError: boolean;
-      /** 加密备份的解密密码（仅内存；core 拒绝加密备份无密码执行） */
-      decryptPassword?: string;
     },
   ): Promise<ImportResult>;
 }

package/lib/security/encryption.d.ts

@@ -1,85 +0,0 @@
-import type { EncryptionInfo } from '../schema/types.ts';
-import type { EncryptionProvider } from '../core/types.ts';
-export declare const SCHEMA_MAGIC = "DSC1";
-export declare const SCHEMA_VERSION = 1;
-/** 整体加密备份容器的 magic（D C A rchive）：头部布局同 secrets.enc，kdf 参数用默认常量 */
-export declare const ARCHIVE_MAGIC = "DCA1";
-export declare const ARCHIVE_VERSION = 1;
-/** 探测字节是否为整体加密备份容器（上传/下载时判定 containerType） */
-export declare function isArchiveBlob(buf: Uint8Array): boolean;
-export declare const SCRYPT_PARAMS: {
-    readonly N: 16384;
-    readonly r: 8;
-    readonly p: 1;
-    readonly keyLength: 32;
-};
-export declare const SALT_LENGTH = 16;
-export declare const IV_LENGTH = 12;
-export declare const TAG_LENGTH = 16;
-/** magic(4) + version(1) + salt(16) + iv(12) + authTag(16) */
-export declare const HEADER_LENGTH: number;
-export type SecurityErrorCode = 'BAD_PASSWORD' | 'TAMPERED' | 'UNSUPPORTED_FORMAT';
-export declare class SecurityError extends Error {
-    readonly code: SecurityErrorCode;
-    constructor(code: SecurityErrorCode, message: string);
-}
-/** KDF 参数值域校验（防 manifest 被篡改成超大 N 导致 DoS；非法即拒绝） */
-export declare function validateKdfParams(params: unknown): params is EncryptionInfo['kdfParams'];
-/** 派生密钥（scrypt，参数可来自 manifest；默认常量） */
-export declare function deriveKey(password: string, salt: Uint8Array, params?: EncryptionInfo['kdfParams']): Promise<Buffer>;
-/** 加密 .credentials.yaml 原文 → { blob, info }（info 直接进 manifest.security.encryption） */
-export declare function encryptCredentials(plaintext: string, password: string): Promise<{
-    blob: Uint8Array;
-    info: EncryptionInfo;
-}>;
-/** 解密 secrets.enc（authTag 校验失败抛 BAD_PASSWORD；元数据不一致抛 TAMPERED） */
-export declare function decryptCredentials(blob: Uint8Array, info: EncryptionInfo, password: string): Promise<string>;
-/**
- * 创建 core `EncryptionProvider`（对齐 core/types.ts 契约）。
- * encrypt 使用闭包持有密码；decrypt 使用调用方传入的密码（支持换密码解密）。
- */
-export declare function createEncryptionProvider(password: string): EncryptionProvider;
-/**
- * 加密完整 ZIP 字节 → 加密容器 blob。
- *
- * 布局（DCA1，与 secrets.enc 同构，kdf 参数用默认常量）：
- *   magic "DCA1"(4B) + version(1B) + salt(16B) + iv(12B) + authTag(16B) + ciphertext(plainZIP)
- *
- * 语义：整个备份（manifest / 各分区 JSON / sessions / 插件文件 / secrets.enc……）
- * 全部进入 ciphertext，磁盘上无法看到任何明文内容。verifyEncryptedBlob 用于
- * 校验密码正确（GCM authTag 通过）且返回真实解密用的随机参数。
- */
-export declare function encryptArchive(plainZip: Uint8Array, password: string): Promise<{
-    blob: Uint8Array;
-    info: EncryptionInfo;
-    kdf: {
-        salt: Buffer;
-        iv: Buffer;
-    };
-}>;
-/** 容器版解密：用「先验真实参数」校验密码并解密（—— 调用方必须先用 verifyEncryptedBlob 拿到 info/kdf） */
-export declare function decryptArchive(blob: Uint8Array, info: EncryptionInfo, kdfParam: {
-    salt: Buffer;
-    iv: Buffer;
-}, password: string): Promise<Uint8Array>;
-export interface EncryptedBlobInfo {
-    /** 容器是否合法（magic/version/header 校验通过） */
-    valid: boolean;
-    /** 密码是否正确（GCM authTag 认证通过）；valid=false 时恒 false */
-    ok: boolean;
-    /** 解密所需参数（valid && ok 时有效；用默认常量派生 key） */
-    info: EncryptionInfo | null;
-    kdf: {
-        salt: Buffer;
-        iv: Buffer;
-    } | null;
-    /** 错误码（供上层转用户可读错误）：BAD_PASSWORD / TAMPERED / UNSUPPORTED_FORMAT */
-    code: SecurityErrorCode | null;
-}
-/**
- * 校验加密备份容器并验证密码（只读，零解密返回内容）。
- * - 容器不合法（非 DCA1 / 截断 / 参数异常）→ valid=false + code
- * - 密码正确 → ok=true + 返回随机参数（后续 decryptArchive 用之）
- * - 密码错误 → ok=false + code=BAD_PASSWORD
- */
-export declare function verifyEncryptedBlob(blob: Uint8Array, password: string): Promise<EncryptedBlobInfo>;