dsh-vault 1.10.63 → 1.10.64-rc.2

package/README-zh.md

@@ -83,7 +83,7 @@ dsh-vault 是一个面向 DeepSeek Harness 的安全加密插件：把你在使
 | `vault_vault_rename` / `vault_vault_delete` | 重命名命名库（文件移动,当前会话跟随）或永久删除（default 库受保护） |
 | `vault_match_url` | 按 URL 查找匹配的登录条目（Bitwarden/1Password 风格:精确主机、子域、父域、路径前缀;www./端口归一化）,带 0–100 评分——绝不返回密码 |
 | `vault_fill` | 按 host/URL/用户名/标题匹配条目并返回其凭据 |
-| `vault_env` | 把标记 env 的条目（tags 含 `env`）渲染为 `KEY=VALUE` 行 |
+| `vault_env` | 把标记 env 的条目（tags 含 `env`）渲染为 `KEY=VALUE` 行 —— 见[环境变量导出](#环境变量导出) |
 | `vault_export_bitwarden` / `vault_import_bitwarden` | Bitwarden/Vaultwarden JSON 互通（完整字段映射,支持覆盖） |
 | `vault_import_bitwarden_encrypted` | 解密 Bitwarden 口令保护 JSON 导出（PBKDF2/Argon2id + HKDF → AES-256-CBC + HMAC）并导入,需提供导出口令 |
 | `vault_import_manager_csv` | 密码管理器 CSV 自动识别表头：Bitwarden（login_uri/login_username/…）、1Password 8、Dashlane、NordPass、Keeper、LastPass（fav/grouping/extra）；支持 dryRun 预览 |
@@ -179,6 +179,48 @@ tarball 自带预构建 `lib/` 产物,无需构建或 allowBuilds。
 
 `dsh plugin --profile web remove dsh-vault` 卸载(同时移除依赖与 layer)。
 
+## 命令行
+
+插件把保险库交给助手,而自带的 `dsh-vault` 命令把**同一个保险库**交给 shell 与脚本 —— 于是技能里的子进程可以自己取密钥,**明文永远不进模型上下文**:
+
+```sh
+export $(dsh-vault env)                    # 带 env 标签的条目 → KEY=VALUE
+dsh-vault get my-entry --field apiKey      # 只取一个字段,仅 stdout
+dsh-vault get my-entry | pbcopy            # 该条目的主密钥
+dsh-vault export-env .env                  # 生成 0600 权限的 .env
+dsh-vault list                             # 标题/id/类型,绝不含密钥
+dsh-vault show my-entry                    # 非敏感字段的 JSON
+```
+
+主密码来源依次为:`--password-stdin` → `$DSH_VAULT_MASTER_PASSWORD`(或 `$DSH_VAULT_PASSWORD`)→ 交互式提示;它**不会**去读插件配置文件里的密码。密钥只走 stdout,其余(进度、错误)走 stderr,所以管道与 `$(...)` 都能正常用。
+
+**怎么调用。** `dsh` 本身没有"插件子命令"注册表:启动器只解析自己的参数(`--profile`、`--patch`、`--dump-config`),而 `dsh plugin …` 是把参数**原样转发给 profile 目录里的 pnpm**;`dsh-cmdline` 是给**应用型 bundle** 拥有某个 profile 的参数族的,不是让插件获得 `dsh <插件>` 命令。所以按你的场景选:
+
+```sh
+npx dsh-vault env                        # 直接用已发布包,无需安装
+pnpm --dir ~/.dsh/profiles/web exec dsh-vault env   # 用 profile 里那份
+node ~/.dsh/profiles/web/node_modules/dsh-vault/lib/cli.js env   # 一定可用
+```
+
+中间那种需要 profile 里由 `pnpm install` 生成的 bin 垫片;最后一种即使 `node_modules/dsh-vault` 只是指向工作区的软链也能用(直接执行文件)。要拿到垫片:把插件作为 profile 的真实依赖安装(`pnpm dsh plugin add dsh-vault`)并在该目录跑一次 `pnpm install`。
+
+## 环境变量导出
+
+打上 `env` 标签的条目可以用 `vault_env` / `vault_export_env` 导出为 `KEY=VALUE` 行，名字按各家工具链预期的字段名生成：
+
+| 条目 | 导出的键 |
+|---|---|
+| 标题 `DASHSCOPE` + `apiKey` | `DASHSCOPE_API_KEY` |
+| 标题 `DASHSCOPE` + `prefix: APP_` | `APP_DASHSCOPE_API_KEY` |
+| `envKey: "TAVILY_TOKEN"` + `accessToken` | `TAVILY_TOKEN` |
+| 同一条目的 `refreshToken` / `fields.scope` | `TAVILY_TOKEN_REFRESH_TOKEN` / `TAVILY_TOKEN_SCOPE` |
+
+- 字段后缀遵循惯例：`apiKey → API_KEY`、`accessToken → ACCESS_TOKEN`、`refreshToken → REFRESH_TOKEN`、`privateKey → PRIVATE_KEY`、`password → PASSWORD`、`cardNumber → CARD_NUMBER`。
+- 派生名字对不上脚本时，给条目设置**环境变量名**（可选字段 `envKey`，也可用 `vault_add`/`vault_update` 写入）：它会**原样**作为该条目主密钥的名字（不加前缀、不从标题推导），次级密钥与自定义字段则以 `<envKey>_<字段>` 挂在后面。必须是合法 POSIX 名（`[A-Za-z_][A-Za-z0-9_]*`），否则保存时直接拒绝。
+- 自定义字段同样会导出，形如 `<BASE>_<字段>`。
+
+> 升级提示：1.10.64 起键名从 `DASHSCOPE_APIKEY` 改为符合厂商惯例的 `DASHSCOPE_API_KEY`。若脚本依赖旧写法，给条目设置 `envKey` 固定名字即可。
+
 ## 工具分级(工具集)
 
 插件内置 110+ 个模型工具,但**默认只注册 11 个基础工具**(`vault_list/search/get/add/update/delete/fill/clipboard/totp/generate_password/strength`),让模型的工具目录保持精简、减少 token 开销。

package/README.md

@@ -85,7 +85,7 @@ Each record has a `title`, an optional `kind`, and any combination of fields:
 | `vault_vault_rename` / `vault_vault_delete` | Rename a named vault (file moves, active session follows) or permanently delete one (default vault protected) |
 | `vault_match_url` | Find login entries matching a URL (Bitwarden/1Password-style: exact host, subdomain, parent domain, path-prefix; www./port normalization) with a 0–100 score — never returns the password |
 | `vault_fill` | Find the entry matching a host/URL/username/title and return its credentials |
-| `vault_env` | Render env-flagged entries (tags contain `env`) as `KEY=VALUE` lines |
+| `vault_env` | Render env-flagged entries (tags contain `env`) as `KEY=VALUE` lines — see [Environment export](#environment-export) |
 | `vault_export_bitwarden` / `vault_import_bitwarden` | Bitwarden/Vaultwarden JSON interop (full field mapping, overwrite support) |
 | `vault_import_bitwarden_encrypted` | Decrypt a Bitwarden password-protected JSON export (PBKDF2/Argon2id + HKDF → AES-256-CBC + HMAC) and import it; pass the export passphrase |
 | `vault_import_manager_csv` | Password-manager CSV auto-detected by header: Bitwarden (`login_uri`/`login_username`/…), 1Password 8, Dashlane, NordPass, Keeper, LastPass (`fav`/`grouping`/`extra`); dryRun preview |
@@ -181,6 +181,72 @@ The tarball ships prebuilt `lib/` artifacts, so no build step or `allowBuilds` i
 
 `dsh plugin --profile web remove dsh-vault` uninstalls (removes both the dependency and the layer).
 
+## Command line
+
+The plugin hands the vault to the assistant; the bundled `dsh-vault` command
+hands the same vault to shells and scripts, so a skill's child process can read
+a secret **without the plaintext ever entering the model's context**:
+
+```sh
+export $(dsh-vault env)                    # env-tagged entries → KEY=VALUE
+dsh-vault get my-entry --field apiKey      # one field, stdout only
+dsh-vault get my-entry | pbcopy            # the entry's primary secret
+dsh-vault export-env .env                  # 0600 file for docker/systemd
+dsh-vault list                             # titles/ids/kinds — never secrets
+dsh-vault show my-entry                    # non-secret fields as JSON
+```
+
+The master password comes from `--password-stdin`, then
+`$DSH_VAULT_MASTER_PASSWORD` (or `$DSH_VAULT_PASSWORD`), then an interactive
+prompt; it is never read from the plugin's config file. Secrets go to stdout and
+everything else to stderr, so pipelines behave.
+
+**How to invoke it.** `dsh` itself has no plugin-subcommand registry: the
+launcher parses only its own flags (`--profile`, `--patch`, `--dump-config`) and
+`dsh plugin …` forwards raw arguments to `pnpm` inside the profile directory.
+`dsh-cmdline` exists so an *app* bundle can own a flag family of a profile, not
+so a plugin gains a `dsh <plugin>` command. So pick whichever fits:
+
+```sh
+npx dsh-vault env                        # published package, no install
+pnpm --dir ~/.dsh/profiles/web exec dsh-vault env   # profile-installed copy
+node ~/.dsh/profiles/web/node_modules/dsh-vault/lib/cli.js env   # always works
+```
+
+The middle form needs the bin shim that `pnpm install` creates inside the
+profile; the last form works even for a `node_modules/dsh-vault` symlink to a
+checkout, because it invokes the file directly. To get the shim, declare the
+plugin as a real dependency of the profile (`pnpm dsh plugin add dsh-vault`) and
+run `pnpm install` there once.
+
+## Environment export
+
+Entries tagged `env` can be materialised as `KEY=VALUE` lines (`vault_env`,
+`vault_export_env`), and their names follow the field names every toolchain
+expects:
+
+| Entry | Exported key |
+|---|---|
+| title `DASHSCOPE`, `apiKey` | `DASHSCOPE_API_KEY` |
+| title `DASHSCOPE`, `prefix: APP_` | `APP_DASHSCOPE_API_KEY` |
+| `envKey: "TAVILY_TOKEN"`, `accessToken` | `TAVILY_TOKEN` |
+| …the same entry's `refreshToken` / `fields.scope` | `TAVILY_TOKEN_REFRESH_TOKEN` / `TAVILY_TOKEN_SCOPE` |
+
+- The field suffix is vendor-standard: `apiKey → API_KEY`, `accessToken →
+  ACCESS_TOKEN`, `refreshToken → REFRESH_TOKEN`, `privateKey → PRIVATE_KEY`,
+  `password → PASSWORD`, `cardNumber → CARD_NUMBER`.
+- Set an entry's **env-var name** (optional field `envKey`, also via
+  `vault_add`/`vault_update`) when the derived name is not what your scripts
+  expect: it is used **verbatim** — no prefix, no title — for the entry's
+  primary secret, and secondary secrets/custom fields hang off it as
+  `<envKey>_<FIELD>`. It must be a valid POSIX name
+  (`[A-Za-z_][A-Za-z0-9_]*`); anything else is refused when saving.
+- Custom fields are exported too, as `<BASE>_<FIELD>`.
+
+> Upgrading: keys changed from `DASHSCOPE_APIKEY` to `DASHSCOPE_API_KEY` in
+> 1.10.64 to match vendor conventions. Set `envKey` on an entry to pin an exact
+> name if a script depends on the old spelling.
+
 ## Tool profiles
 
 The plugin ships 110+ model tools, but **registers only 11 core tools by default** (`vault_list/search/get/add/update/delete/fill/clipboard/totp/generate_password/strength`) to keep the model's tool catalog small and cheap.

package/lib/cli.js

@@ -0,0 +1,417 @@
+#!/usr/bin/env node
+/**
+ * `dsh-vault` — script-facing access to a vault, without the model in the loop.
+ *
+ * The plugin hands the vault to the assistant; this CLI hands the same vault to
+ * shells and scripts, so a skill's Python/Node child process can read a secret
+ * without the plaintext ever entering the model's context:
+ *
+ *   export $(dsh-vault env)                  # env-tagged entries as KEY=VALUE
+ *   dsh-vault get my-entry --field apiKey    # one field, stdout only
+ *   dsh-vault export-env .env                # 0600 file for docker/systemd
+ *
+ * Secrets go to stdout and everything else (progress, errors) to stderr, so
+ * `dsh-vault get … | pbcopy` and `$(dsh-vault get …)` behave.
+ *
+ * The core is `runCli(argv, io)`, which tests drive directly without spawning.
+ */
+import { chmod, mkdir, writeFile } from 'node:fs/promises';
+import { existsSync, realpathSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { createInterface } from 'node:readline';
+import { openVault, defaultVaultPath } from "./store.js";
+import { envLinesFor, maskSecret, primarySecret } from "./env-export.js";
+function packageVersion() {
+    try {
+        const require = createRequire(import.meta.url);
+        const pkg = require('../package.json');
+        return pkg.version ?? '0.0.0';
+    }
+    catch {
+        return '0.0.0';
+    }
+}
+const USAGE = `dsh-vault — encrypted credential vault, from the command line
+
+Usage:
+  dsh-vault <command> [options]
+
+Commands:
+  list                    List entries (titles, ids, kinds — never secrets)
+  get <id|title>          Print one field of an entry (default: its main secret)
+  show <id|title>         Print an entry's non-secret fields as JSON
+  env                     Print env-tagged entries as KEY=VALUE lines
+  export-env <path>       Write those lines to a file (mode 0600)
+  verify                  Check the master password (nothing on stdout)
+
+Options:
+  --vault <name>          Named vault (default: "default")
+  --path <file>           Explicit vault file (overrides --vault)
+  --password-stdin        Read the master password from the first stdin line
+  --json                  Machine-readable output
+  -h, --help              This help
+  -V, --version           Version
+
+list options:
+  --kind <k>              Only entries of this kind
+  --tag <t>               Only entries carrying this tag
+
+get options:
+  --field <name>          apiKey | secret | accessToken | refreshToken | privateKey
+                          | password | cardNumber | username | url | fields.<custom>
+  --mask                  Print a masked value (first 4 chars + ***)
+  --all                   Print the whole entry as JSON (every secret — opt-in)
+
+env options:
+  --prefix <P>            Prefix for derived key names (an explicit envKey is kept verbatim)
+  --kind <k>              Only entries of this kind
+  --keys-only             Print key names without values
+  --mask                  Print masked values
+  --file <path>           Write to a file instead of stdout
+
+The master password comes from --password-stdin, then $DSH_VAULT_MASTER_PASSWORD
+(or $DSH_VAULT_PASSWORD), then an interactive prompt. It is never read from the
+plugin's own config file.
+`;
+const BOOLEAN_FLAGS = new Set(['json', 'mask', 'keys-only', 'all', 'password-stdin', 'help', 'version']);
+function parseArgs(argv) {
+    const flags = new Map();
+    const positional = [];
+    let command = '';
+    for (let i = 0; i < argv.length; i++) {
+        const arg = argv[i];
+        if (arg === '-h' || arg === '--help') {
+            flags.set('help', true);
+            continue;
+        }
+        if (arg === '-V' || arg === '--version') {
+            flags.set('version', true);
+            continue;
+        }
+        if (arg.startsWith('--')) {
+            const eq = arg.indexOf('=');
+            const name = eq >= 0 ? arg.slice(2, eq) : arg.slice(2);
+            if (eq >= 0) {
+                flags.set(name, arg.slice(eq + 1));
+                continue;
+            }
+            const next = argv[i + 1];
+            if (BOOLEAN_FLAGS.has(name) || next === undefined || next.startsWith('-')) {
+                flags.set(name, true);
+                continue;
+            }
+            flags.set(name, next);
+            i++;
+            continue;
+        }
+        if (command === '')
+            command = arg;
+        else
+            positional.push(arg);
+    }
+    return { command, positional, flags };
+}
+function stringFlag(parsed, name) {
+    const value = parsed.flags.get(name);
+    return typeof value === 'string' ? value : undefined;
+}
+/**
+ * Vault file selection, mirroring how the plugin resolves `$DSH_HOME/vault`.
+ *
+ * The injected environment wins over `process.env` so a caller (or a test) can
+ * point the CLI at another harness home without mutating the real one.
+ */
+export function resolveCliVaultPath(parsed, env) {
+    const explicit = stringFlag(parsed, 'path');
+    if (explicit !== undefined)
+        return resolve(explicit);
+    const name = stringFlag(parsed, 'vault') ?? 'default';
+    const home = env.DSH_HOME;
+    if (home !== undefined && home.length > 0)
+        return resolve(home, 'vault', `${name}.json`);
+    return defaultVaultPath(name);
+}
+/** Interactive prompt with echo off, read from the terminal rather than stdin. */
+async function promptHidden(prompt) {
+    const { open } = await import('node:fs/promises');
+    let handle;
+    try {
+        handle = await open('/dev/tty', 'r+');
+    }
+    catch {
+        const rl = createInterface({ input: process.stdin, output: process.stderr });
+        const answer = await new Promise(res => rl.question(prompt, res));
+        rl.close();
+        return answer;
+    }
+    const reader = handle.createReadStream();
+    const writer = handle.createWriteStream();
+    writer.write(prompt);
+    reader.setEncoding('utf8');
+    return await new Promise((res, rej) => {
+        let value = '';
+        const finish = (result) => {
+            reader.destroy();
+            void handle?.close();
+            res(result);
+        };
+        reader.on('data', (chunk) => {
+            for (const ch of String(chunk)) {
+                if (ch === '\n' || ch === '\r') {
+                    writer.write('\n');
+                    finish(value);
+                    return;
+                }
+                if (ch === '\u0003') {
+                    reader.destroy();
+                    void handle?.close();
+                    rej(new Error('aborted'));
+                    return;
+                }
+                if (ch === '\u007f' || ch === '\b') {
+                    value = value.slice(0, -1);
+                    continue;
+                }
+                value += ch;
+            }
+        });
+        reader.on('error', rej);
+    });
+}
+async function readStdinLine() {
+    const rl = createInterface({ input: process.stdin });
+    const line = await new Promise(res => rl.once('line', res));
+    rl.close();
+    return line;
+}
+/** Master password: --password-stdin, then the environment, then a prompt. */
+async function resolvePassword(parsed, io) {
+    if (parsed.flags.get('password-stdin') === true) {
+        const read = io.readStdinLine ?? readStdinLine;
+        const line = (await read()).replace(/\r?\n$/, '');
+        if (line.length === 0)
+            throw new Error('no password on stdin');
+        return line;
+    }
+    for (const key of ['DSH_VAULT_MASTER_PASSWORD', 'DSH_VAULT_PASSWORD']) {
+        const value = io.env[key];
+        if (value !== undefined && value.length > 0)
+            return value;
+    }
+    const prompt = io.readPassword ?? (process.stdin.isTTY ? promptHidden : undefined);
+    if (prompt === undefined) {
+        throw new Error('no master password: pass --password-stdin or set DSH_VAULT_MASTER_PASSWORD');
+    }
+    const typed = await prompt('Vault master password: ');
+    if (typed.length === 0)
+        throw new Error('empty master password');
+    return typed;
+}
+function findEntry(store, needle) {
+    const entries = store.list();
+    const byId = entries.find(e => e.id === needle);
+    if (byId !== undefined)
+        return byId;
+    const exact = entries.filter(e => e.title === needle);
+    if (exact.length === 1)
+        return exact[0];
+    const partial = exact.length > 0 ? exact : entries.filter(e => e.title.toLowerCase().includes(needle.toLowerCase()));
+    if (partial.length === 0)
+        throw new Error(`no entry matches "${needle}"`);
+    if (partial.length > 1) {
+        throw new Error(`"${needle}" is ambiguous (${partial.map(e => e.title).join(', ')}) — use the id`);
+    }
+    return partial[0];
+}
+/** Look one field up, supporting `fields.<name>` for custom fields. */
+function fieldValue(entry, name) {
+    if (!name.startsWith('fields.'))
+        return entry[name];
+    return (entry.fields ?? {})[name.slice('fields.'.length)];
+}
+/** Non-secret projection of an entry, for `list --json` / `show`. */
+function publicFields(entry) {
+    const { id, title, kind, username, email, phone, host, port, url, tags, icon, color, sensitivity, favorite, createdAt, updatedAt, envKey, rotationDays, expiresAt, cardExpiry, cardHolder } = entry;
+    const optional = {
+        kind, username, email, phone, host, port, url, tags, icon, color, sensitivity,
+        favorite, envKey, rotationDays, expiresAt, cardExpiry, cardHolder, createdAt, updatedAt,
+    };
+    const out = { id, title };
+    for (const [key, value] of Object.entries(optional)) {
+        if (value !== undefined)
+            out[key] = value;
+    }
+    out.hasSecret = primarySecret(entry) !== undefined;
+    return out;
+}
+const COMMANDS = new Set(['list', 'get', 'show', 'env', 'export-env', 'verify']);
+/** Run one CLI invocation; returns the process exit code. */
+export async function runCli(argv, io) {
+    const parsed = parseArgs(argv);
+    if (parsed.flags.get('version') === true) {
+        io.out(`${packageVersion()}\n`);
+        return 0;
+    }
+    if (parsed.flags.get('help') === true || parsed.command === 'help') {
+        io.out(USAGE);
+        return 0;
+    }
+    if (parsed.command === '') {
+        io.err(USAGE);
+        return 2;
+    }
+    if (!COMMANDS.has(parsed.command)) {
+        io.err(`dsh-vault: unknown command "${parsed.command}"\n\n${USAGE}`);
+        return 2;
+    }
+    const json = parsed.flags.get('json') === true;
+    const mask = parsed.flags.get('mask') === true;
+    const keysOnly = parsed.flags.get('keys-only') === true;
+    const path = resolveCliVaultPath(parsed, io.env);
+    if (!existsSync(path)) {
+        io.err(`dsh-vault: vault not found at ${path}\n`);
+        io.err('hint: --vault <name> selects a named vault; set DSH_HOME if the vault lives elsewhere.\n');
+        return 1;
+    }
+    let store;
+    try {
+        store = await openVault({ path, masterPassword: await resolvePassword(parsed, io) });
+    }
+    catch (err) {
+        io.err(`dsh-vault: ${err instanceof Error ? err.message : String(err)}\n`);
+        return 1;
+    }
+    try {
+        if (parsed.command === 'verify') {
+            // Nothing on stdout, so `dsh-vault verify && …` is usable in scripts.
+            io.err(`dsh-vault: master password ok (${store.list().length} entries)\n`);
+            return 0;
+        }
+        if (parsed.command === 'list') {
+            const kind = stringFlag(parsed, 'kind');
+            const tag = stringFlag(parsed, 'tag');
+            const entries = store.list().filter(entry => (kind === undefined || (entry.kind ?? 'login') === kind)
+                && (tag === undefined || (entry.tags ?? []).includes(tag)));
+            if (json) {
+                io.out(`${JSON.stringify(entries.map(publicFields), null, 2)}\n`);
+                return 0;
+            }
+            for (const entry of entries) {
+                const identity = [entry.username, entry.host, entry.url]
+                    .filter((v) => typeof v === 'string' && v.length > 0).join(' · ');
+                io.out(`${entry.id}  ${(entry.kind ?? 'login').padEnd(8)}  ${entry.title}${identity.length > 0 ? `  (${identity})` : ''}\n`);
+            }
+            return 0;
+        }
+        if (parsed.command === 'show') {
+            const needle = parsed.positional[0];
+            if (needle === undefined) {
+                io.err('dsh-vault: show needs an entry id or title\n');
+                return 2;
+            }
+            io.out(`${JSON.stringify(publicFields(findEntry(store, needle)), null, 2)}\n`);
+            return 0;
+        }
+        if (parsed.command === 'get') {
+            const needle = parsed.positional[0];
+            if (needle === undefined) {
+                io.err('dsh-vault: get needs an entry id or title\n');
+                return 2;
+            }
+            const entry = findEntry(store, needle);
+            if (parsed.flags.get('all') === true) {
+                io.out(`${JSON.stringify(entry, null, 2)}\n`);
+                return 0;
+            }
+            let name = stringFlag(parsed, 'field');
+            let value;
+            if (name === undefined) {
+                const primary = primarySecret(entry);
+                if (primary === undefined) {
+                    io.err(`dsh-vault: "${entry.title}" holds no secret\n`);
+                    return 1;
+                }
+                name = primary.field;
+                value = primary.value;
+            }
+            else {
+                value = fieldValue(entry, name);
+            }
+            if (typeof value !== 'string' || value.length === 0) {
+                io.err(`dsh-vault: "${entry.title}" has no field "${name}"\n`);
+                return 1;
+            }
+            const textual = name === 'username' || name === 'url' || name === 'notes' || name.startsWith('fields.');
+            const shown = mask && !textual ? maskSecret(value) : value;
+            io.out(json ? `${JSON.stringify({ id: entry.id, title: entry.title, field: name, value: shown })}\n` : `${shown}\n`);
+            return 0;
+        }
+        // env / export-env
+        const prefix = stringFlag(parsed, 'prefix') ?? '';
+        const kind = stringFlag(parsed, 'kind');
+        const lines = envLinesFor(store.list(), { prefix, ...(kind !== undefined ? { kind } : {}) });
+        const rendered = lines.map(line => {
+            if (keysOnly)
+                return line.split('=')[0] ?? line;
+            if (!mask)
+                return line;
+            const eq = line.indexOf('=');
+            return `${line.slice(0, eq)}=${maskSecret(line.slice(eq + 1).replace(/^'|'$/g, ''))}`;
+        });
+        const target = parsed.command === 'export-env' ? parsed.positional[0] : stringFlag(parsed, 'file');
+        if (parsed.command === 'export-env' && target === undefined) {
+            io.err('dsh-vault: export-env needs a file path\n');
+            return 2;
+        }
+        if (target !== undefined) {
+            const body = rendered.join('\n') + (rendered.length > 0 ? '\n' : '');
+            const file = resolve(target);
+            await mkdir(dirname(file), { recursive: true, mode: 0o700 });
+            await writeFile(file, body, { mode: 0o600 });
+            await chmod(file, 0o600);
+            io.err(keysOnly
+                ? `dsh-vault: wrote ${rendered.length} key names to ${file} (no values — --keys-only)\n`
+                : `dsh-vault: wrote ${rendered.length} lines to ${file} (mode 0600)\n`);
+            return 0;
+        }
+        io.out(rendered.join('\n') + (rendered.length > 0 ? '\n' : ''));
+        if (rendered.length === 0)
+            io.err('dsh-vault: no env-tagged entries (add the tag "env" to an entry)\n');
+        return 0;
+    }
+    catch (err) {
+        io.err(`dsh-vault: ${err instanceof Error ? err.message : String(err)}\n`);
+        return 1;
+    }
+    finally {
+        await store.lock().catch(() => { });
+    }
+}
+/**
+ * Whether this module is the process entry point (the bin shim).
+ *
+ * `import.meta.url` is the REAL path, while argv[1] may be a symlink (a profile
+ * installs `node_modules/dsh-vault` as one) and may contain characters that need
+ * URL encoding (a space in the checkout path). Compare realpaths instead of
+ * string-building a file URL, which silently failed in both cases.
+ */
+function isEntryPoint() {
+    const entry = process.argv[1];
+    if (entry === undefined)
+        return false;
+    try {
+        return realpathSync(entry) === realpathSync(fileURLToPath(import.meta.url));
+    }
+    catch {
+        return import.meta.url === pathToFileURL(entry).href;
+    }
+}
+if (isEntryPoint()) {
+    void runCli(process.argv.slice(2), {
+        out: text => process.stdout.write(text),
+        err: text => process.stderr.write(text),
+        env: process.env,
+    }).then(code => { process.exitCode = code; });
+}