dsh-config-manager 0.1.60 → 0.1.61

package/README.md

@@ -52,7 +52,7 @@ Move your complete DeepSeek Harness setup without manually reinstalling plugins,
 
 ### Sync DSH configuration across machines
 
-Keep portable configuration synchronized between machines through a private Git repository or WebDAV — secrets never sync.
+Keep portable configuration synchronized between machines through a private Git repository or WebDAV — secrets do not sync by default (the payload is run through the SecretScanner); check "Export secrets" with an encryption password and `~/.dsh/.credentials.yaml` travels as scrypt + AES-256-GCM ciphertext inside the encrypted snapshot, so another machine can restore the credentials while the remote (Git host / WebDAV provider) only ever sees ciphertext.
 
 ### Schedule automatic full backups
 
@@ -76,7 +76,7 @@ Browse the built-in official market for ready-made configurations (model provide
 | 🔒 | **Secret safety** | API Keys are not exported by default — non-encrypted imports ask you to re-enter; encrypted backups restore them with the password |
 | ↩️ | **Automatic rollback** | Failed import restores everything automatically |
 | 📸 | **Snapshot restore** | Undo an import: whole-file restore + uninstall added plugins (CLI & GUI) |
-| 🔄 | **Remote Sync** | Push/pull portable config via **Git private repo or WebDAV** (secrets never sync) |
+| 🔄 | **Remote Sync** | Push/pull portable config via **Git private repo or WebDAV** (secrets do not sync by default; encrypted snapshots can optionally carry encrypted credentials) |
 | ⏰ | **Scheduled backups** | Full backup on a fixed cadence (6h / 12h / 24h / 7d) — set-and-forget, secrets never included |
 | 🛒 | **Config Marketplace** | Browse & one-click install community configs — supply-chain warnings + per-section approval |
 | 🗂️ | **Profiles** | Save multiple setups (Work / Personal) and switch anytime — preview + auto-backup + rollback |
@@ -248,6 +248,7 @@ Push / pull your portable config between machines through **either of two channe
 - **WebDAV auth** uses HTTP Basic: the `username` is stored in the config and may be echoed back into the UI, while the `password` is read live from the DSH credentials slot `DSH_CONFIG_MANAGER_SYNC_WEBDAV_PASSWORD` — it never appears in any sync file or log.
 - **Plugins auto-install**: when pulling diffs, plugins that are new in the backup are **installed automatically** on confirm — no manual per-item ticking in the diff list. Only **version-conflict** plugins still ask you to pick "Keep Current / Use Imported".
 - **Push preview before uploading** — the Push button first shows a read-only preview of what will be sent (sections + per-section counts + changed-vs-baseline markers, first-baseline notice) and only writes the remote after you confirm.
+- **Secrets do not sync by default**: every section goes through the `SecretScanner` (sensitive field values stripped) and the credential section is structurally excluded. With "Export secrets" checked and an encryption password set, `~/.dsh/.credentials.yaml` travels as scrypt + AES-256-GCM ciphertext in a **separate credentials payload** of the encrypted snapshot (never inside any section); the receiving side decrypts it into per-ref "credential migration" items that are written back to the local credential store (`credentials.set`) only after you confirm. The password is memory-only and never persisted or logged; **auto sync never carries credentials** (it has no password and skips encrypted snapshots).
 
 ### 🛒 Configuration Marketplace
 

package/README.zh-CN.md

@@ -13,7 +13,7 @@ DSH Config Manager 是一个 DeepSeek Harness 配置备份与迁移插件：一
 - Profiles（配置档案）
 - Workspace / AGENTS.md
 
-把当前 DeepSeek Harness 环境导出为可移植备份，在另一台电脑上一键恢复；也支持通过 Git / WebDAV 跨机同步（密钥永不参与同步）；还能通过内置**配置市场**浏览、一键安装社区分享的现成配置。
+把当前 DeepSeek Harness 环境导出为可移植备份，在另一台电脑上一键恢复；也支持通过 Git / WebDAV 跨机同步（密钥默认不同步，勾选「导出密钥」并加密后可随加密快照迁移）；还能通过内置**配置市场**浏览、一键安装社区分享的现成配置。
 
 [English](README.md) · [简体中文](README.zh-CN.md)
 
@@ -52,7 +52,7 @@ DSH 是你的 AI 助手工作台，里面存着你的各种设置：模型配置
 
 ### 在多台电脑间同步 DSH 配置
 
-通过私有 Git 仓库或 WebDAV 在多台电脑间保持可移植配置同步——密钥永不参与同步。
+通过私有 Git 仓库或 WebDAV 在多台电脑间保持可移植配置同步——密钥默认不参与同步（同步载荷会被 SecretScanner 剥离）；勾选「导出密钥」并设置加密密码后，`~/.dsh/.credentials.yaml` 会以 scrypt + AES-256-GCM 密文随加密快照上行，换机后可随同步写回本机凭据，远端（Git 仓库 / WebDAV 服务商）全程只见密文。
 
 ### 定时自动全量备份
 
@@ -76,7 +76,7 @@ DSH 是你的 AI 助手工作台，里面存着你的各种设置：模型配置
 | 🔒 | **密钥安全** | API Key 默认不导出；非加密导入后提醒重新填写，加密备份用密码解锁恢复 |
 | ↩️ | **自动回滚** | 导入失败自动恢复原样，不会弄坏现有配置 |
 | 📸 | **快照恢复** | 撤销一次导入：整文件还原 + 卸载新增插件（CLI 与 GUI 均支持） |
-| 🔄 | **远程同步** | 通过 **Git 私有仓库或 WebDAV** 推送 / 拉取可移植配置（密钥永不参与同步） |
+| 🔄 | **远程同步** | 通过 **Git 私有仓库或 WebDAV** 推送 / 拉取可移植配置（密钥默认不参与同步；加密快照可选携带密文凭据） |
 | ⏰ | **定时全量备份** | 按固定周期（6h / 12h / 24h / 7d）自动全量备份，一劳永逸，密钥永不包含 |
 | 🛒 | **配置市场** | 浏览并一键安装社区分享的配置——供应链警示 + 逐分区批准 |
 | 🗂️ | **配置档案 Profiles** | 保存多套配置（工作 / 个人），随时切换 |
@@ -243,6 +243,7 @@ dsh plugin --profile web add dsh-config-manager@latest
 - **切换通道重新开始**：Git 与 WebDAV 的快照 / 共同祖先**互不共享**。切换通道后，同步从新远端的空基线重新开始——请先推送一个新快照。
 - **WebDAV 认证**采用 HTTP Basic：`username` 存配置、可在界面回显；`password` 则实时从 DSH credentials 槽位 `DSH_CONFIG_MANAGER_SYNC_WEBDAV_PASSWORD` 读取——绝不出现于任何同步文件或日志。
 - **插件自动安装**：拉取差异时，备份里新增的插件会在确认导入时**自动安装**，无需在差异列表里逐项手动勾选；只有**版本冲突**的插件仍需要你决定「保留当前 / 采用备份」。
+- **密钥默认不同步**：同步载荷逐分区过 `SecretScanner`（敏感字段值剥离），凭据分区结构性排除。勾选「导出密钥」并设置加密密码后，`~/.dsh/.credentials.yaml` 以 scrypt + AES-256-GCM 密文作为**独立凭据载荷**随加密快照上行（不放进任何分区）；拉取侧解密后生成逐条「凭据迁移」项，你确认采纳才写回本机凭据（`credentials.set`）。加密密码仅存内存，绝不落盘 / 落日志；**自动同步恒不含凭据**（无密码可用，遇到加密快照会跳过）。
 
 ### 🛒 配置市场（Marketplace）
 

package/lib/client.d.ts

@@ -687,6 +687,7 @@ declare const uiZh: {
   readonly 'sync.pushPreviewHeadline': '将推送 {total} 个分区（{changed} 个有变化）';
   readonly 'sync.pushPreviewHint': '以上为只读预览，不会写入远端。确认后点击「推送」才真正上传。';
   readonly 'sync.pushPreviewEncrypted': '加密快照：载荷将整体加密，各分区相对基线的变化不可比对。';
+  readonly 'sync.pushPreviewCredentials': '本次推送包含真实凭据值（已随载荷整体加密；远端只见密文）。';
   readonly 'sync.pullFailed': '拉取失败';
   readonly 'sync.pullOk': '远端快照 {id} 差异预览：共 {count} 项变更';
   readonly 'sync.pullEmpty': '远端快照与本地一致（无变更）';
@@ -1111,6 +1112,8 @@ interface SyncPushPreview {
   remoteSnapshotCount: number;
   /** 加密快照：载荷将整体加密（分区计数与基线比较不可得） */
   encrypted: boolean;
+  /** 本次推送是否真的会带上凭据载荷（.credentials.yaml 可读且非空；issue #38） */
+  credentialsIncluded: boolean;
   message?: string;
 }
 //#endregion
@@ -2724,7 +2727,7 @@ type ConfigManagerKey = keyof typeof zh$3;
  */
 declare const zh$2: {
   readonly 'section.label': '远程同步';
-  readonly 'section.description': '通过 Git 私有仓库在设备间同步可移植配置（密钥永不参与同步）';
+  readonly 'section.description': '通过 Git 私有仓库在设备间同步可移植配置（密钥默认不同步；勾选「导出密钥」并加密后可随加密快照迁移）';
   readonly privateRepoHint: '安全要求：同步仓库必须为私有仓库（public 仓库会公开你的配置内容）。认证 token 仅用于仓库访问，绝不写入同步文件、提交内容或日志。';
   readonly 'config.title': '仓库配置';
   readonly 'config.repoUrl': '仓库地址';
@@ -2843,7 +2846,7 @@ declare const zh$2: {
   readonly 'mode.passwordMismatch': '两次输入的密码不一致';
   readonly 'mode.passwordRequired': '加密必须设置密码';
   readonly 'mode.includeSecrets': '导出密钥';
-  readonly 'mode.includeSecretsHint': '把真实凭据值写入加密快照（勾选时自动选中加密；密钥绝不进入未加密快照）。';
+  readonly 'mode.includeSecretsHint': '把真实凭据值（~/.dsh/.credentials.yaml）写入加密快照，可在另一台机器上随同步一并写回本机凭据；勾选时自动选中加密，密钥绝不进入未加密快照。';
   readonly 'mode.encryptAutosyncNotice': '加密快照仅通过手动推送/拉取使用；自动同步无密码，遇到加密快照会跳过并在历史中提示。';
   readonly 'mode.decryptPassword': '解密密码（加密快照拉取/同步用，可选）';
   readonly 'mode.decryptPasswordHint': '拉取或一键同步遇到加密快照时输入；不输入则加密快照无法读取（自动同步会跳过并在历史中提示）。';