dsh-vault 0.6.8 → 0.7.0

package/lib/client.js

@@ -17,48 +17,48 @@ window.__ModuleLoader__.load({
 			document.head.appendChild(tag);
 		}
 		var VaultSection_module_css_default = {
-			"addButton": "t_j5va_addButton",
-			"error": "t_j5va_error",
-			"modeAuto": "t_j5va_modeAuto",
-			"editorActions": "t_j5va_editorActions",
-			"reportTitle": "t_j5va_reportTitle",
-			"policyField": "t_j5va_policyField",
-			"rowActions": "t_j5va_rowActions",
-			"editorBody": "t_j5va_editorBody",
-			"kindFilter": "t_j5va_kindFilter",
-			"status": "t_j5va_status",
-			"modeAsk": "t_j5va_modeAsk",
-			"pinStar": "t_j5va_pinStar",
-			"rowMain": "t_j5va_rowMain",
-			"policyBar": "t_j5va_policyBar",
-			"editor": "t_j5va_editor",
-			"field": "t_j5va_field",
+			"list": "t_j5va_list",
 			"intro": "t_j5va_intro",
-			"empty": "t_j5va_empty",
+			"emptyHint": "t_j5va_emptyHint",
+			"saveButton": "t_j5va_saveButton",
+			"identity": "t_j5va_identity",
+			"copied": "t_j5va_copied",
 			"secretField": "t_j5va_secretField",
-			"toolbar": "t_j5va_toolbar",
 			"totp": "t_j5va_totp",
+			"status": "t_j5va_status",
+			"policyField": "t_j5va_policyField",
+			"reportTitle": "t_j5va_reportTitle",
+			"dangerButton": "t_j5va_dangerButton",
+			"revealButton": "t_j5va_revealButton",
+			"deleteButton": "t_j5va_deleteButton",
+			"modeReadonly": "t_j5va_modeReadonly",
+			"error": "t_j5va_error",
+			"policyBar": "t_j5va_policyBar",
+			"editorActions": "t_j5va_editorActions",
+			"rowMain": "t_j5va_rowMain",
+			"reportBox": "t_j5va_reportBox",
+			"kindFilter": "t_j5va_kindFilter",
 			"highBadge": "t_j5va_highBadge",
 			"clearButton": "t_j5va_clearButton",
-			"copied": "t_j5va_copied",
-			"identity": "t_j5va_identity",
+			"empty": "t_j5va_empty",
+			"editorBody": "t_j5va_editorBody",
+			"emptyBox": "t_j5va_emptyBox",
+			"kindIcon": "t_j5va_kindIcon",
+			"editor": "t_j5va_editor",
+			"addButton": "t_j5va_addButton",
+			"toolbar": "t_j5va_toolbar",
+			"section": "t_j5va_section",
+			"pinStar": "t_j5va_pinStar",
+			"title": "t_j5va_title",
 			"trashButton": "t_j5va_trashButton",
-			"footer": "t_j5va_footer",
-			"reportBox": "t_j5va_reportBox",
 			"row": "t_j5va_row",
-			"list": "t_j5va_list",
-			"revealButton": "t_j5va_revealButton",
-			"saveButton": "t_j5va_saveButton",
-			"dangerButton": "t_j5va_dangerButton",
-			"section": "t_j5va_section",
+			"rowActions": "t_j5va_rowActions",
 			"reportLine": "t_j5va_reportLine",
-			"deleteButton": "t_j5va_deleteButton",
-			"kindIcon": "t_j5va_kindIcon",
-			"title": "t_j5va_title",
-			"emptyHint": "t_j5va_emptyHint",
-			"modeReadonly": "t_j5va_modeReadonly",
-			"emptyBox": "t_j5va_emptyBox",
-			"searchBox": "t_j5va_searchBox"
+			"footer": "t_j5va_footer",
+			"searchBox": "t_j5va_searchBox",
+			"modeAsk": "t_j5va_modeAsk",
+			"modeAuto": "t_j5va_modeAuto",
+			"field": "t_j5va_field"
 		};
 		//#endregion
 		//#region src/client/VaultSection.tsx

package/lib/index.js

@@ -504,6 +504,8 @@ export async function apply(ctx, config) {
             symbols: { type: 'boolean', description: 'Include symbols (default true).' },
             excludeAmbiguous: { type: 'boolean', description: 'Exclude 0/O/1/l/I (default false).' },
             group: { type: 'integer', description: 'Insert "-" every N characters (e.g. 3 → vK7-mQ2-zt9).' },
+            prefix: { type: 'string', description: 'Fixed prefix prepended to the random core (site requirements).' },
+            suffix: { type: 'string', description: 'Fixed suffix appended to the random core (site requirements).' },
         },
         output: {
             schema: {
@@ -525,6 +527,8 @@ export async function apply(ctx, config) {
                 ...(args.symbols !== undefined ? { symbols: args.symbols } : {}),
                 ...(args.excludeAmbiguous !== undefined ? { excludeAmbiguous: args.excludeAmbiguous } : {}),
                 ...(args.group !== undefined ? { group: args.group } : {}),
+                ...(args.prefix !== undefined ? { prefix: args.prefix } : {}),
+                ...(args.suffix !== undefined ? { suffix: args.suffix } : {}),
             });
             return { password, length: password.length };
         },
@@ -575,7 +579,7 @@ export async function apply(ctx, config) {
             label: { type: 'string', description: 'Account label in the URI (default: entry title or "dsh-vault").' },
             issuer: { type: 'string', description: 'Issuer name (default: "dsh-vault").' },
         },
-        output: { schema: { type: 'object', additionalProperties: false, properties: { uri: { type: 'string', required: true }, qr: { type: 'string', required: true } } }, render: (_a, v) => [{ type: 'text', text: v.uri }] },
+        output: { schema: { type: 'object', additionalProperties: false, properties: { uri: { type: 'string', required: true }, qr: { type: 'string' } } }, render: (_a, v) => [{ type: 'text', text: v.uri }] },
         async execute(args) {
             if ((args.id === undefined) === (args.secret === undefined)) {
                 throw new Error('vault_totp_uri: provide exactly one of id or secret');
@@ -757,6 +761,24 @@ export async function apply(ctx, config) {
             return { ok: issues.length === 0, issues };
         },
     }));
+    // ── vault_mask: redact likely secrets in free text ──────────────────────────
+    ctx.tools.register(defineTool({
+        name: 'vault_mask',
+        description: 'Redact likely credentials in arbitrary text (API keys, tokens, passwords, private keys) '
+            + 'so it can be logged or quoted safely. Returns the masked text and a count of redactions.',
+        parameters: { text: { type: 'string', required: true, description: 'Text to mask.' } },
+        output: { schema: { type: 'object', additionalProperties: false, properties: { masked: { type: 'string', required: true }, redacted: { type: 'integer', required: true } } }, render: (_a, v) => [{ type: 'text', text: v.masked }] },
+        async execute(args) {
+            let count = 0;
+            const masked = args.text
+                .replace(/(ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36,}/g, () => { count++; return '[REDACTED:TOKEN]'; })
+                .replace(/(npm|npms)_[A-Za-z0-9]{20,}/g, () => { count++; return '[REDACTED:NPM]'; })
+                .replace(/(sk|pk|rk|ak)_[A-Za-z0-9]{20,}/g, () => { count++; return '[REDACTED:KEY]'; })
+                .replace(/(-----BEGIN [A-Z ]*PRIVATE KEY-----)[\s\S]*?(-----END [A-Z ]*PRIVATE KEY-----)/g, () => { count++; return '[REDACTED:PRIVATE-KEY]'; })
+                .replace(/(Bearer\s+)[A-Za-z0-9._~+/-]+=*/gi, (m, p1) => { count++; return p1 + '[REDACTED:BEARER]'; });
+            return { masked, redacted: count };
+        },
+    }));
     // ── vault_recent: most recently touched entries ─────────────────────────────
     ctx.tools.register(defineTool({
         name: 'vault_recent',
@@ -936,7 +958,7 @@ export async function apply(ctx, config) {
             + 'across entries. Returns non-secret findings (entry summaries grouped by the reused value).',
         parameters: {},
         output: {
-            schema: { type: 'object', additionalProperties: false, properties: { weak: { type: 'array', required: true, items: { type: 'json' } }, reused: { type: 'array', required: true, items: { type: 'json' } } } },
+            schema: { type: 'object', additionalProperties: false, properties: { weak: { type: 'array', required: true, items: { type: 'json' } }, reused: { type: 'array', required: true, items: { type: 'json' } }, strength: { type: 'json', required: true } } },
             render: (_a, v) => [{ type: 'text', text: `weak: ${v.weak.length}, reused groups: ${v.reused.length}` }],
         },
         async execute() {

package/lib/password.js

@@ -73,6 +73,14 @@ export function generatePassword(options = {}) {
         [chars[i], chars[j]] = [chars[j], chars[i]];
     }
     let password = chars.join('');
+    const coreLength = length;
+    void coreLength;
+    if (options.prefix !== undefined && options.prefix.length > 0) {
+        password = options.prefix + password;
+    }
+    if (options.suffix !== undefined && options.suffix.length > 0) {
+        password = password + options.suffix;
+    }
     if (options.group !== undefined && options.group > 1 && password.length > options.group) {
         password = password.match(new RegExp(`.{1,${options.group}}`, 'g')).join('-');
     }

package/lib/store.js

@@ -371,13 +371,21 @@ export class VaultStore {
      */
     health() {
         const weak = [];
+        const strength = { weak: 0, fair: 0, strong: 0 };
         const passwordCounts = new Map();
         const keyCounts = new Map();
         for (const entry of this.list()) {
             const summary = toSummary(entry);
             if (entry.password !== undefined) {
-                if (entry.password.length < VaultStore.MIN_PASSWORD_LENGTH)
+                const len = entry.password.length;
+                if (len < VaultStore.MIN_PASSWORD_LENGTH) {
                     weak.push(summary);
+                    strength.weak++;
+                }
+                else if (len < 20)
+                    strength.fair++;
+                else
+                    strength.strong++;
                 const list = passwordCounts.get(entry.password) ?? [];
                 list.push(summary);
                 passwordCounts.set(entry.password, list);
@@ -394,7 +402,7 @@ export class VaultStore {
             ...[...passwordCounts.entries()].filter(([, v]) => v.length > 1),
             ...[...keyCounts.entries()].filter(([, v]) => v.length > 1),
         ].map(([value, entries]) => ({ value, entries }));
-        return { weak, reused };
+        return { weak, reused, strength };
     }
     /**
      * Export the whole vault (including trash) as a single encrypted blob under

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-vault",
-  "version": "0.6.8",
+  "version": "0.7.0",
   "description": "Encrypted credential vault for DeepSeek Harness: store and retrieve usernames, emails, phone numbers, passwords, TOTP secrets, SSH/API-key/OAuth developer credentials through model tools and a Settings UI page.",
   "type": "module",
   "license": "MIT",