@tiphareth/dsh-hardssh 0.1.2 → 0.2.3

package/lib/types/switch/switch-subprocess.d.ts

@@ -14,15 +14,44 @@ import type { Context } from '@deepseek-ai/cordis';
 /** Route one spawn cwd to a runtime. */
 export interface SwitchSubprocessDeps {
     local: SubprocessRuntime;
-    /** The runtime for a spawn cwd (undefined = local). */
-    worldFor(cwd: string | undefined): SubprocessRuntime;
+    /**
+     * The runtime for a spawn cwd, or `undefined` for a LOCAL cwd.
+     *
+     * Deliberately `undefined` rather than "return the local runtime": deciding
+     * "is this local?" by IDENTITY-comparing the returned service against
+     * `deps.local` is not reliable, and getting it wrong made the client-search
+     * refusal below fire for LOCAL sessions — which broke glob/grep everywhere
+     * (found by real-machine testing). The routing answer is data, so it travels
+     * as data.
+     */
+    worldFor(cwd: string | undefined): SubprocessRuntime | undefined;
+    /** Bare executable names that are CLIENT tools (run locally even in a
+     *  bound workspace) — e.g. 'pwsh', 'powershell', 'cmd'. Windows-format
+     *  executables (drive/backslash paths, `*.exe/*.cmd/*.bat/*.ps1`) are
+     *  detected automatically as client binaries. */
+    clientToolNames?: ReadonlyArray<string>;
 }
 /** Workspace-routing subprocess facade. */
 export declare class SwitchSubprocessRuntime extends SubprocessRuntime {
     private readonly deps;
     constructor(ctx: Context, deps: SwitchSubprocessDeps);
-    /** The runtime for one spec (by its cwd). */
+    /** The runtime for one spec (by its cwd); undefined means LOCAL. */
     private runtimeFor;
+    /** Client binaries run on THIS machine even from a bound workspace — their
+     *  executables cannot exist on the remote POSIX host, and the spawn cwd is
+     *  the local anchor (which exists locally), so local execution is sound.
+     *  Everything else runs in the session's world (remote on a bound host).
+     *
+     *  ONE exception is refused rather than routed: a client-side SEARCH helper
+     *  (rg) in a remote-bound session would search the empty local anchor and
+     *  report "no matches" — a confidently wrong answer about the server's
+     *  contents. There is no way to make a local index-of-files tool read the
+     *  remote workspace, so the caller is told to use the remote tools.
+     *
+     *  Locality comes from the routing answer (`undefined`), never from an
+     *  identity comparison against `deps.local`: that comparison silently failed
+     *  once and refused local ripgrep launches for every session. */
+    private effectiveRuntime;
     /** @inheritdoc */
     resolveExecutable(command: string, env?: Readonly<Record<string, string>>, signal?: AbortSignal): Promise<string>;
     /** @inheritdoc */

package/lib/types/tools.d.ts

@@ -1,11 +1,12 @@
-import type { SshEngine } from './ssh/engine.ts';
-import { RemoteSearchService } from './remote-search.ts';
-import type { SshWorkspaceLedger } from './ledger.ts';
+import { type WorkspaceStoreView } from './backend.ts';
+import type { ToolOpsResolver } from './workspace-tool-ops.ts';
 /** Tool-set dependencies. */
 export interface WorkspaceToolsDeps {
-    engine: SshEngine;
-    ledger: SshWorkspaceLedger;
-    search: RemoteSearchService;
+    /** SSH-workspace record source (the generic projection store). */
+    workspaces: WorkspaceStoreView;
+    /** Bound-workspace operations provider (generic capability seam). Resolves
+     *  the calling session's cwd to its ops. */
+    ops: ToolOpsResolver;
 }
 /** Build every remote_* tool (registered by the host half). */
 export declare function makeWorkspaceTools(deps: WorkspaceToolsDeps): import("@deepseek-ai/dsh-tools").ToolDefinition[];

package/lib/types/workspace-tool-ops.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Bound-workspace operations for the `remote_*` agent tools.
+ *
+ * The tools resolve the CALLING SESSION's bound workspace from its cwd, then
+ * run a small set of operations (directory listing, glob / content-grep)
+ * against it. The resolver opens the bound record through WorkspaceCore and
+ * uses its `workspace.fs` / `workspace.search` capabilities. It fails closed
+ * when the provider omits a required capability rather than falling back to a
+ * second engine-backed implementation.
+ */
+import { type WorkspaceStoreView } from './backend.ts';
+import type { SshWorkspaceRecord, WorkspaceEntry } from './protocol.ts';
+import type { WorkspaceCore } from './runtime/workspace-core.ts';
+import type { RemoteGlobResult, RemoteGrepResult } from './remote-search.ts';
+/** Operations one bound workspace exposes to the remote_* tools. */
+export interface WorkspaceToolOps {
+    /** List one absolute directory path inside the workspace remote root. */
+    listDir(abs: string): Promise<WorkspaceEntry[]>;
+    /** glob filename search (pattern keeps glob semantics). */
+    glob(pattern: string): Promise<RemoteGlobResult>;
+    /** fixed-string content grep (returns matched `path:line:content` records). */
+    grep(fixedPhrase: string): Promise<RemoteGrepResult>;
+}
+/** The bound record + its ops for one session cwd. */
+export interface BoundToolOps {
+    record: SshWorkspaceRecord;
+    ops: WorkspaceToolOps;
+}
+/** Resolve the calling session cwd to a bound workspace, or null when local. */
+export type ToolOpsResolver = (cwd: string | undefined) => Promise<BoundToolOps | null>;
+/** Resolver that opens each bound record through the generic WorkspaceCore. */
+export declare function capabilityToolOpsResolver(store: WorkspaceStoreView, core: WorkspaceCore): ToolOpsResolver;
+//# sourceMappingURL=workspace-tool-ops.d.ts.map

package/lib/types/workspace.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Public workspace API entry — the stable surface third-party plugins consume.
+ * Exports only platform-neutral record/provider/connection/capability types,
+ * the `WorkspaceCore` consumer interface, and the stable provider API version.
+ *
+ * Deliberately NOT exported from here: `SshEngine`, concrete SSH connection /
+ * provider classes, the ledger/router/registry internals, and migration or
+ * legacy compatibility code — so implementation swaps never leak through this
+ * boundary (migration plan Phase 6, §「稳定导出」).
+ *
+ * @module @tiphareth/dsh-hardssh/workspace
+ */
+export type { ConnectionRef, WorkspaceAnchor, WorkspaceCapabilityMap, WorkspaceConnection, WorkspaceCreateInput, WorkspaceId, WorkspaceLocation, WorkspaceProvider, WorkspaceProviderManifest, WorkspaceProviderRef, WorkspaceRecord, WorkspaceUpdate, } from './base/model.ts';
+export { WORKSPACE_PROVIDER_API_VERSION } from './base/model.ts';
+export type { WorkspaceDirEntry, WorkspaceFileSystem, WorkspaceProcessResult, WorkspaceProcessRuntime, WorkspaceSearchHit, WorkspaceSearchService, WorkspaceStat, } from './base/capability.ts';
+export type { WorkspaceCore, WorkspaceListener, } from './runtime/workspace-core.ts';
+export type { WorkspaceRegistry } from './base/registry.ts';
+//# sourceMappingURL=workspace.d.ts.map

package/lib/vault-3gpWct2Q.js

@@ -0,0 +1,559 @@
+import { existsSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { homedir } from "node:os";
+import { createCipheriv, createDecipheriv, createHash, randomBytes, scrypt } from "node:crypto";
+//#region src/ssh/vault.ts
+/**
+* Credential vault: secrets (SSH passwords, key passphrases) encrypted at
+* rest with AES-256-GCM under a master key derived from a password via
+* scrypt (Node built-in). Each entry uses an independent random nonce and
+* binds its credential reference as GCM AAD; every ciphertext additionally
+* carries a SHA3-256 digest for integrity self-checks. Brute-force lockout
+* persists across restarts.
+*
+* The vault is deliberately dependency-free (node:crypto + fs only) and has
+* no cordis coupling, matching the HostStore style. KDF parameters are stored
+* in the file header so a later KDF upgrade never invalidates existing
+* vaults (algorithm is a stable switch point).
+*
+* @module dsh-hardssh/vault
+*/
+/** File format version. */
+const FORMAT_VERSION = 1;
+/** Master key length (AES-256). */
+const KEY_BYTES = 32;
+/** AES-GCM nonce length. */
+const NONCE_BYTES = 12;
+/** Password salt length (scrypt). */
+const SALT_BYTES = 16;
+/** scrypt parameters (OWASP-ish baseline; stored per file). */
+const SCRYPT_N = 131072;
+const SCRYPT_R = 8;
+const SCRYPT_P = 1;
+/** Failed-unlock budget before lockout (persisted). */
+const LOCKOUT_THRESHOLD = 5;
+/** Lockout backoff floor (ms). */
+const LOCKOUT_FLOOR_MS = 3e4;
+/** Lockout backoff cap (ms). */
+const LOCKOUT_CAP_MS = 36e5;
+/** Fixed plaintext used to verify the unlock password. */
+const VERIFIER_TEXT = "dsh-hardssh:vault:verify:v1";
+/**
+* Directory holding the credential vault: `<home>/.dsh/ssh-secrets`.
+*
+* It IS inside `~/.dsh` (which the fs seam declares a local-infrastructure root
+* so skills and plugin config stay readable), so its protection does NOT come
+* from location — it comes from `SwitchFileSystem.deniedRoots` (fs.ts), which
+* refuses this directory on every dispatch path, resolve to write, before any
+* backend sees it.
+*
+* Residual risk, stated plainly: a command that runs on THIS machine as the
+* same user (e.g. the client-side `pwsh` tool) can still read the file. What
+* keeps the credential safe is that the file is encrypted (AES-256-GCM +
+* scrypt) AND that environment auto-unlock is off by default — so a stolen
+* ciphertext is only an offline scrypt target, not a usable credential.
+*/
+function vaultDirectory() {
+	return join(homedir(), ".dsh", "ssh-secrets");
+}
+/** Vault file location: <home>/.dsh/ssh-secrets/dsh-ssh-vault.json. */
+function vaultPath() {
+	return join(vaultDirectory(), "dsh-ssh-vault.json");
+}
+/** Pre-relocation vault location (<home>/.dsh/dsh-ssh-vault.json). */
+function legacyVaultPath() {
+	return join(homedir(), ".dsh", "dsh-ssh-vault.json");
+}
+/**
+* Move a pre-relocation vault into {@link vaultDirectory} on first use.
+*
+* Never destructive: the new location wins when both exist, and a failed move
+* falls back to copying so the source file is left in place.
+*
+* @param target - destination path (defaults to {@link vaultPath}).
+* @param legacy - source path (defaults to {@link legacyVaultPath}).
+* @returns true when a move/copy happened.
+*/
+function migrateLegacyVault(target = vaultPath(), legacy = legacyVaultPath()) {
+	if (target === legacy) return false;
+	if (existsSync(target) || !existsSync(legacy)) return false;
+	try {
+		mkdirSync(dirname(target), {
+			recursive: true,
+			mode: 448
+		});
+		try {
+			renameSync(legacy, target);
+		} catch {
+			const contents = readFileSync(legacy);
+			writeFileSync(target, contents, { mode: 384 });
+		}
+		return true;
+	} catch {
+		return false;
+	}
+}
+/** AAD for one entry. */
+function entryAad(purpose, alias) {
+	return `dsh-hardssh:v1:${purpose}:${alias}`;
+}
+/** SHA3-256 hex of a UTF-8 string. */
+function sha3_256Hex(text) {
+	return createHash("sha3-256").update(text, "utf8").digest("hex");
+}
+/** Errors raised by the vault. */
+var VaultError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.code = code;
+		this.name = "VaultError";
+	}
+};
+/** Unlocked-password or wrong-password errors. */
+var VaultLockedError = class extends VaultError {
+	constructor(message = "vault is locked — unlock it before accessing secrets") {
+		super("VAULT_LOCKED", message);
+		this.name = "VaultLockedError";
+	}
+};
+/** Wrong unlock password (with remaining attempts). */
+var VaultAuthError = class extends VaultError {
+	remaining;
+	constructor(message, remaining) {
+		super("VAULT_AUTH", message);
+		this.remaining = remaining;
+		this.name = "VaultAuthError";
+	}
+};
+/** Locked out due to repeated failures. */
+var VaultLockoutError = class extends VaultError {
+	retryAfterMs;
+	constructor(message, retryAfterMs) {
+		super("VAULT_LOCKOUT", message);
+		this.retryAfterMs = retryAfterMs;
+		this.name = "VaultLockoutError";
+	}
+};
+/**
+* The credential vault. Plain file I/O + node:crypto; no cordis dependency.
+* Construction never requires a password (status/describe work locked); the
+* master key is derived on unlock and cached in memory for the session.
+*/
+var Vault = class {
+	path;
+	document = emptyDocument();
+	unlockedKey;
+	lockTimer;
+	idleLockMs;
+	leaked = /* @__PURE__ */ new Set();
+	/** Whether `DSH_CREDENTIAL_PASSWORD` may unlock this instance at load. */
+	allowEnvUnlock;
+	/** Single-instance mutation queue. Every operation that can change the
+	*  in-memory document or persist it runs in invocation order. The tail is
+	*  always recovered so one rejected mutation never poisons later work. */
+	mutationTail = Promise.resolve();
+	constructor(filePath, options) {
+		if (filePath === void 0) migrateLegacyVault();
+		this.path = filePath ?? vaultPath();
+		this.allowEnvUnlock = options?.allowEnvUnlock === true;
+		this.load();
+		const env = this.allowEnvUnlock ? process.env.DSH_CREDENTIAL_PASSWORD : void 0;
+		if (env !== void 0 && env !== "") this.tryEnvUnlock(env);
+		const idle = options?.idleLockMs ?? 18e5;
+		if (!Number.isSafeInteger(idle) || idle < 0) throw new VaultError("VAULT_CONFIG", "idleLockMs must be a non-negative safe integer");
+		this.idleLockMs = idle;
+	}
+	load() {
+		if (!existsSync(this.path)) {
+			this.document = emptyDocument();
+			return;
+		}
+		try {
+			const parsed = JSON.parse(readFileSync(this.path, "utf8"));
+			if (!isDocument(parsed)) throw new Error("vault shape invalid");
+			this.document = parsed;
+		} catch {
+			try {
+				renameSync(this.path, `${this.path}.corrupt-${Date.now()}`);
+			} catch {}
+			this.document = emptyDocument();
+		}
+	}
+	save() {
+		this.saveDocument(this.document);
+	}
+	saveDocument(document) {
+		const dir = dirname(this.path);
+		if (!existsSync(dir)) mkdirSync(dir, {
+			recursive: true,
+			mode: 448
+		});
+		const tmp = this.path + `.tmp-${process.pid}-${randomBytes(6).toString("hex")}`;
+		try {
+			writeFileSync(tmp, JSON.stringify(document, null, 2) + "\n", {
+				encoding: "utf8",
+				mode: 384
+			});
+			renameSync(tmp, this.path);
+		} catch (error) {
+			try {
+				unlinkSync(tmp);
+			} catch {}
+			throw error;
+		}
+	}
+	deriveKey(password, kdf) {
+		return new Promise((resolve, reject) => {
+			scrypt(password, Buffer.from(kdf.saltB64, "base64"), KEY_BYTES, {
+				N: kdf.N,
+				r: kdf.r,
+				p: kdf.p,
+				maxmem: 536870912
+			}, (error, key) => {
+				if (error !== null) reject(error);
+				else resolve(key);
+			});
+		});
+	}
+	lockoutRetryAfter() {
+		const doc = this.document;
+		if (doc.meta.lockedUntil === 0) return 0;
+		const remaining = doc.meta.lockedUntil - Date.now();
+		return remaining > 0 ? remaining : 0;
+	}
+	checkLockout() {
+		const doc = this.document;
+		if (doc.meta.lockedUntil !== 0) {
+			const remaining = this.lockoutRetryAfter();
+			if (remaining > 0) throw new VaultLockoutError(`vault locked: too many failed attempts — retry after ${Math.ceil(remaining / 1e3)}s`, remaining);
+			doc.meta.attempts = 0;
+			doc.meta.lockedUntil = 0;
+		}
+	}
+	async verifyPassword(key, password) {
+		const doc = this.document;
+		const previousMeta = { ...doc.meta };
+		const persistFailure = () => {
+			try {
+				this.save();
+			} catch (error) {
+				doc.meta = previousMeta;
+				throw error;
+			}
+		};
+		const verifier = doc.verifier;
+		try {
+			const plain = this.decryptEntryBuffer(key, verifier.aad, verifier.nonceB64, verifier.ciphertextB64, verifier.tagB64);
+			if (plain.toString("utf8") !== VERIFIER_TEXT) throw new Error("verifier mismatch");
+			plain.fill(0);
+		} catch {
+			doc.meta.attempts += 1;
+			if (doc.meta.attempts >= LOCKOUT_THRESHOLD) {
+				const backoff = backoffFor(doc.meta.attempts);
+				doc.meta.lockedUntil = Date.now() + backoff;
+				persistFailure();
+				throw new VaultLockoutError(`vault locked after ${doc.meta.attempts} failed attempts — retry after ${Math.ceil(backoff / 1e3)}s`, backoff);
+			}
+			persistFailure();
+			throw new VaultAuthError(`wrong vault password (${doc.meta.attempts}/${LOCKOUT_THRESHOLD} attempts used)`, LOCKOUT_THRESHOLD - doc.meta.attempts);
+		}
+	}
+	encryptEntryBuffer(key, aad, plaintext) {
+		const nonce = randomBytes(NONCE_BYTES);
+		const cipher = createCipheriv("aes-256-gcm", key, nonce);
+		cipher.setAAD(Buffer.from(aad, "utf8"));
+		const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+		const tag = cipher.getAuthTag();
+		return {
+			nonceB64: nonce.toString("base64"),
+			ciphertextB64: ciphertext.toString("base64"),
+			tagB64: tag.toString("base64")
+		};
+	}
+	decryptEntryBuffer(key, aad, nonceB64, ciphertextB64, tagB64) {
+		const nonce = Buffer.from(nonceB64, "base64");
+		const tag = Buffer.from(tagB64, "base64");
+		const ciphertext = Buffer.from(ciphertextB64, "base64");
+		const decipher = createDecipheriv("aes-256-gcm", key, nonce);
+		decipher.setAAD(Buffer.from(aad, "utf8"));
+		decipher.setAuthTag(tag);
+		return Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+	}
+	requireKey() {
+		if (this.unlockedKey === void 0) throw new VaultLockedError();
+		return this.unlockedKey;
+	}
+	validateMasterPassword(password) {
+		if (password.trim().length < 8) throw new VaultError("VAULT_PASSWORD_WEAK", `vault password must contain at least 8 non-whitespace characters`);
+	}
+	/** Successful credential activity extends the idle lock deadline. */
+	touch() {
+		if (this.lockTimer !== void 0) clearTimeout(this.lockTimer);
+		this.lockTimer = void 0;
+		if (this.unlockedKey === void 0 || this.idleLockMs === 0) return;
+		this.lockTimer = setTimeout(() => {
+			this.lock();
+		}, this.idleLockMs);
+		this.lockTimer.unref?.();
+	}
+	enqueueMutation(mutation) {
+		const result = this.mutationTail.then(mutation);
+		this.mutationTail = result.then(() => void 0, () => void 0);
+		return result;
+	}
+	async tryEnvUnlock(password) {
+		try {
+			await this.unlock(password);
+		} catch {}
+	}
+	/** Current status (locked / mode / entry count) — safe for UIs. */
+	status() {
+		const hasEntries = this.document.secrets.length > 0;
+		return {
+			locked: this.unlockedKey === void 0 || hasEntries === false && this.document.verifier.ciphertextB64 === "",
+			mode: this.allowEnvUnlock && process.env.DSH_CREDENTIAL_PASSWORD !== void 0 ? "env" : "password",
+			entries: this.document.secrets.length
+		};
+	}
+	/** Unlock with a password (loopback route / env). Persists lockout on failure. */
+	async unlock(password) {
+		return this.enqueueMutation(async () => {
+			this.validateMasterPassword(password);
+			if (this.unlockedKey !== void 0) {
+				this.touch();
+				return;
+			}
+			this.checkLockout();
+			const doc = this.document;
+			if (doc.verifier.ciphertextB64 === "") {
+				const salt = randomBytes(SALT_BYTES);
+				const kdf = {
+					algorithm: "scrypt",
+					N: SCRYPT_N,
+					r: SCRYPT_R,
+					p: SCRYPT_P,
+					saltB64: salt.toString("base64")
+				};
+				const key = await this.deriveKey(password, kdf);
+				const box = this.encryptEntryBuffer(key, entryAad("host.password", "vault-verify"), Buffer.from(VERIFIER_TEXT, "utf8"));
+				const next = {
+					...doc,
+					kdf,
+					verifier: {
+						...box,
+						aad: entryAad("host.password", "vault-verify")
+					}
+				};
+				try {
+					this.saveDocument(next);
+				} catch (error) {
+					key.fill(0);
+					throw error;
+				}
+				this.document = next;
+				this.unlockedKey = key;
+				this.touch();
+				return;
+			}
+			const key = await this.deriveKey(password, doc.kdf);
+			try {
+				await this.verifyPassword(key, password);
+			} catch (error) {
+				key.fill(0);
+				throw error;
+			}
+			this.unlockedKey = key;
+			this.touch();
+		});
+	}
+	/** Lock: drop the in-memory key. JS strings cannot be zeroized; the Buffer
+	*  key is wiped. */
+	lock() {
+		if (this.lockTimer !== void 0) clearTimeout(this.lockTimer);
+		this.lockTimer = void 0;
+		if (this.unlockedKey !== void 0) {
+			this.unlockedKey.fill(0);
+			this.unlockedKey = void 0;
+		}
+		this.leaked.clear();
+	}
+	/** Store one secret, returning a random ref. Requires unlock. */
+	async store(purpose, alias, secret) {
+		return this.enqueueMutation(() => {
+			const key = this.requireKey();
+			const ref = "vlt_" + randomBytes(16).toString("hex");
+			const aad = entryAad(purpose, alias);
+			const box = this.encryptEntryBuffer(key, aad, Buffer.from(secret, "utf8"));
+			const data = `${box.nonceB64}${box.ciphertextB64}${box.tagB64}`;
+			const entry = {
+				ref,
+				purpose,
+				alias,
+				...box,
+				aad,
+				sha3: sha3_256Hex(data)
+			};
+			this.document.secrets.push(entry);
+			try {
+				this.save();
+			} catch (error) {
+				this.document.secrets.pop();
+				throw error;
+			}
+			this.touch();
+			return ref;
+		});
+	}
+	/** Reveal one secret (unlock required); registers it for redaction. */
+	async reveal(ref) {
+		const key = this.requireKey();
+		const entry = this.document.secrets.find((candidate) => candidate.ref === ref);
+		if (entry === void 0) throw new VaultError("VAULT_MISSING", `no secret for ref '${ref}'`);
+		if (sha3_256Hex(`${entry.nonceB64}${entry.ciphertextB64}${entry.tagB64}`) !== entry.sha3) throw new VaultError("VAULT_CORRUPTED", `entry '${ref}' failed its SHA3-256 integrity check`);
+		const plain = this.decryptEntryBuffer(key, entry.aad, entry.nonceB64, entry.ciphertextB64, entry.tagB64);
+		const text = plain.toString("utf8");
+		plain.fill(0);
+		this.leaked.add(text);
+		this.touch();
+		return text;
+	}
+	/** Delete one secret (host delete / cleanup). */
+	async remove(ref) {
+		return this.enqueueMutation(() => {
+			this.requireKey();
+			const before = this.document.secrets;
+			const next = before.filter((entry) => entry.ref !== ref);
+			if (next.length !== before.length) {
+				this.document.secrets = next;
+				try {
+					this.save();
+				} catch (error) {
+					this.document.secrets = before;
+					throw error;
+				}
+			}
+			this.touch();
+		});
+	}
+	/** Rekey with a new password: decrypt all, re-encrypt under a fresh KDF. */
+	async rekey(newPassword) {
+		return this.enqueueMutation(async () => {
+			this.validateMasterPassword(newPassword);
+			const key = this.requireKey();
+			const doc = this.document;
+			const plaintexts = [];
+			for (const entry of doc.secrets) {
+				const plain = this.decryptEntryBuffer(key, entry.aad, entry.nonceB64, entry.ciphertextB64, entry.tagB64);
+				plaintexts.push({
+					purpose: entry.purpose,
+					alias: entry.alias,
+					value: plain.toString("utf8")
+				});
+				plain.fill(0);
+			}
+			const salt = randomBytes(SALT_BYTES);
+			const kdf = {
+				algorithm: "scrypt",
+				N: SCRYPT_N,
+				r: SCRYPT_R,
+				p: SCRYPT_P,
+				saltB64: salt.toString("base64")
+			};
+			const newKey = await this.deriveKey(newPassword, kdf);
+			try {
+				const box = this.encryptEntryBuffer(newKey, entryAad("host.password", "vault-verify"), Buffer.from(VERIFIER_TEXT, "utf8"));
+				const secrets = plaintexts.map(({ purpose, alias, value }, index) => {
+					const aad = entryAad(purpose, alias);
+					const b = this.encryptEntryBuffer(newKey, aad, Buffer.from(value, "utf8"));
+					const data = `${b.nonceB64}${b.ciphertextB64}${b.tagB64}`;
+					return {
+						ref: rekeyOriginalRef(doc.secrets[index]),
+						purpose,
+						alias,
+						...b,
+						aad,
+						sha3: sha3_256Hex(data)
+					};
+				});
+				const next = {
+					...doc,
+					kdf,
+					verifier: {
+						...box,
+						aad: entryAad("host.password", "vault-verify")
+					},
+					meta: {
+						attempts: 0,
+						lockedUntil: 0
+					},
+					secrets
+				};
+				this.saveDocument(next);
+				key.fill(0);
+				this.document = next;
+				this.unlockedKey = newKey;
+				this.touch();
+			} catch (error) {
+				newKey.fill(0);
+				throw error;
+			} finally {
+				for (const item of plaintexts) item.value = "";
+			}
+		});
+	}
+	/** Redact every leaked secret value in `text` (Leak Guard light). */
+	redact(text) {
+		if (this.leaked.size === 0) return text;
+		let out = text;
+		for (const value of this.leaked) if (value.length > 0) out = out.split(value).join("[REDACTED]");
+		return out;
+	}
+	/** Dispose: wipe the key and stop the idle timer. */
+	dispose() {
+		if (this.lockTimer !== void 0) clearTimeout(this.lockTimer);
+		this.lock();
+	}
+};
+/** Empty vault document. */
+function emptyDocument() {
+	return {
+		version: FORMAT_VERSION,
+		kdf: {
+			algorithm: "scrypt",
+			N: SCRYPT_N,
+			r: SCRYPT_R,
+			p: SCRYPT_P,
+			saltB64: ""
+		},
+		verifier: {
+			nonceB64: "",
+			ciphertextB64: "",
+			tagB64: "",
+			aad: ""
+		},
+		meta: {
+			attempts: 0,
+			lockedUntil: 0
+		},
+		secrets: []
+	};
+}
+/** Lockout backoff: exponential, floored, capped. */
+function backoffFor(attempts) {
+	const exponent = Math.min(attempts - LOCKOUT_THRESHOLD, 6);
+	const backoff = LOCKOUT_FLOOR_MS * Math.pow(2, exponent);
+	return Math.min(backoff, LOCKOUT_CAP_MS);
+}
+/** Guard: a parsed JSON value is a valid vault document. */
+function isDocument(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const doc = value;
+	return typeof doc.version === "number" && typeof doc.kdf === "object" && doc.kdf !== null && typeof doc.kdf.algorithm === "string" && typeof doc.verifier === "object" && doc.verifier !== null && typeof doc.meta === "object" && doc.meta !== null && Array.isArray(doc.secrets);
+}
+/** The ref to reuse for the index-th entry during rekey (preserves identity). */
+function rekeyOriginalRef(entry) {
+	return entry?.ref ?? "vlt_" + randomBytes(16).toString("hex");
+}
+//#endregion
+export { legacyVaultPath as n, vaultDirectory as r, Vault as t };

package/lib/workspace.js

@@ -0,0 +1,2 @@
+import { t as WORKSPACE_PROVIDER_API_VERSION } from "./model-Cp7f70Mb.js";
+export { WORKSPACE_PROVIDER_API_VERSION };