dsh-vault 1.10.64 → 1.10.66

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (5) hide show
  1. package/README-zh.md +66 -160
  2. package/README.md +93 -206
  3. package/lib/cli.js +15 -3
  4. package/lib/client.js +161 -161
  5. package/package.json +2 -2
package/README-zh.md CHANGED
@@ -181,222 +181,128 @@ tarball 自带预构建 `lib/` 产物,无需构建或 allowBuilds。
181
181
 
182
182
  ## 命令行
183
183
 
184
- 插件把保险库交给助手,而自带的 `dsh-vault` 命令把**同一个保险库**交给 shell 与脚本 —— 于是技能里的子进程可以自己取密钥,**明文永远不进模型上下文**:
184
+ 插件把保险库交给助手;自带的 `dsh-vault` 命令把**同一个保险库**交给 shell 与脚本,于是技能里的子进程可以自己取密钥,**明文永远不进模型上下文**。
185
185
 
186
- ```sh
187
- eval "$(dsh-vault env)" # 带 env 标签的条目 → KEY=VALUE
188
- dsh-vault get my-entry --field apiKey # 只取一个字段,仅 stdout
189
- dsh-vault get my-entry | pbcopy # 该条目的主密钥
190
- dsh-vault export-env .env # 生成 0600 权限的 .env
191
- dsh-vault list # id、类型、标题、环境变量名,绝不含密钥
192
- dsh-vault show my-entry # 非敏感字段的 JSON
193
- ```
186
+ ### 0. 先确认:你能敲的是哪条命令?
194
187
 
195
- > **为什么不是 `export $(dsh-vault env)`?** 命令替换会按空白拆分,而且**不会**去掉 `dsh-vault` 输出的引号 —— 值里只要有一个空格就会被拆成多个词,所有值还会带上字面引号。`eval "$(dsh-vault env)"` 才能按原样读入这些赋值;脚本里更推荐 `dsh-vault export-env .env && set -a && . ./.env && set +a`,完全不用 `eval`。
188
+ **没安装就没有 `dsh-vault` 这个可执行文件** —— 插件是 Cordis bundle,`dsh` 也没有插件子命令注册表(启动器只解析自己的参数;`dsh plugin …` 只是转发给 pnpm,所以 `dsh web exec …` 会把参数交给 web app,报 `error: too many arguments`)。看下面的例子前,先找到你那一行:
196
189
 
197
- 主密码来源依次为:`--password-stdin` → `$DSH_VAULT_MASTER_PASSWORD`(或 `$DSH_VAULT_PASSWORD`)→ 交互式提示;它**不会**去读插件配置文件里的密码。密钥只走 stdout,其余(进度、错误)走 stderr,所以管道与 `$(...)` 都能正常用。
198
-
199
- **可以用「导出的键名」代替标题** —— 脚本通常只知道这个名字:
190
+ | 你的情况 | 能敲的命令 |
191
+ |---|---|
192
+ | **源码 checkout**(`git clone` + `pnpm build`) | **`pnpm vault`** —— 或 `node lib/cli.js`、`./lib/cli.js` |
193
+ | 插件**装进了 profile** | `pnpm dsh plugin --profile web exec dsh-vault` |
194
+ | **全局安装**(`npm i -g dsh-vault`) | `dsh-vault` |
195
+ | **什么都没装** | `npx dsh-vault` |
200
196
 
201
197
  ```sh
202
- dsh-vault get DASHSCOPE_API_KEY # 派生名
203
- dsh-vault get TAVILY_TOKEN # 条目上配置的名字
204
- dsh-vault get TAVILY_TOKEN_REFRESH_TOKEN # 配置名 + 字段后缀
205
- dsh-vault get ACME_GITHUB_TOKEN --fields apikey # --field/--fields,字段名不区分大小写
206
- dsh-vault show ACME_GITHUB_TOKEN # 非敏感元数据的 JSON
207
- dsh-vault get DASHSCOPE_API_KEY | my-tool # 直接喂给工具
208
- ```
209
-
210
- 未知参数会直接报错(`--fields` 是 `--field` 的别名;`--nope` 退出码 2,不会被静默忽略)。
198
+ # 源码 checkout(就是本仓库当前的状态):
199
+ pnpm vault list
211
200
 
212
- `list` 会直接打印可复制的名字,不用猜;`[env]` 标记出真正会被 `dsh-vault env` 导出的条目:
213
-
214
- ```
215
- a1b2c3d4-… api-key DASHSCOPE → DASHSCOPE_API_KEY [env]
216
- 5db92b44-… oauth Tavily → TAVILY_TOKEN (+2) [env]
217
- 9f8e7d6c-… api-key Example Billing (sandbox) → EXAMPLE_BILLING_API_KEY
201
+ # 全局安装后(npx 同理)才是:
202
+ dsh-vault list
203
+ npx dsh-vault list
218
204
  ```
219
205
 
220
- `(+2)` 是这条目还会导出的其他键数量(如 `TAVILY_TOKEN_REFRESH_TOKEN`、`TAVILY_TOKEN_SCOPE`);`list --json` / `show` 会全部列出,并把两件事分开:
221
-
222
- | 字段 | 含义 |
223
- |---|---|
224
- | `envKeys` | **你配置的**名字(没配就是空数组) |
225
- | `exportedKeys` | 这条目**实际会导出**的名字,也就是 `get` 接受的名字 |
226
- | `envTagged` | 是否会被 `dsh-vault env` 包含(取决于 `env` 标签) |
227
-
228
- 解析顺序:**id → 标题 → `envKey` → 该条目会导出的任意键名**。`get` 与 `env` 共用同一份实现,所以 `env` 打印出来的每个名字都能用 `get` 取回。
229
-
230
- ### 怎么调用
231
-
232
- **没有安装就没有 `dsh-vault` 这个命令。** 插件是 Cordis bundle,而 `dsh` 没有插件子命令注册表:启动器只解析自己的参数(`--profile`、`--patch`、`--dump-config`),`dsh plugin …` 是**唯一**转发给 pnpm 的子命令(`dsh-cmdline` 是让**应用型 bundle** 拥有 profile 参数族,不是让插件获得 `dsh <插件>` 命令)。所以 `dsh web exec …` 会把参数交给 web app,报 `error: too many arguments`。按你的情况选:
233
-
234
- | 你的情况 | 怎么跑 CLI |
235
- |---|---|
236
- | **源码 checkout**(`git clone` + `pnpm build`) | `pnpm vault list` —— 或 `node lib/cli.js list`、`./lib/cli.js list` |
237
- | 插件**装进了 profile** | `pnpm dsh plugin --profile web exec dsh-vault list` |
238
- | **全局安装** | `dsh-vault list` |
239
- | **什么都没装** | `npx dsh-vault list` |
206
+ 下面的例子统一写成 `dsh-vault …`,**请替换成你那一行的写法**(checkout 用 `pnpm vault …`)。
240
207
 
241
- #### 源码 checkout
208
+ ### 1. `env` 是干什么的
242
209
 
243
- ```sh
244
- git clone git@github.com:Ox0400/dsh-vault.git && cd dsh-vault
245
- npm install && npm run build # 生成 lib/,含可执行的 lib/cli.js
210
+ `get` 取**一个**值,不需要任何标签。`dsh-vault env` 是另一种场景:脚本要**一次拿好几个**密钥。它把**打了 `env` 标签**的条目打印成 shell 赋值语句,让脚本自己取走:
246
211
 
247
- pnpm vault list # 仓库自带的入口(package.json script)
248
- node lib/cli.js list # 等价写法
249
- ./lib/cli.js list # 文件本身也可执行
250
- npm link # ……或把真正的 dsh-vault 放到 PATH
251
212
  ```
252
-
253
- 另外,要**开发插件**并对接 profile,还需把 checkout 软链进 profile 并加一层 patch 插入插件(本仓库平时就是这么开发的);**CLI 完全不需要这些** —— 它直接读保险库文件。手工软链的插件**没有** `node_modules/.bin/dsh-vault` 垫片,所以 `pnpm … exec` 会报 `Command "dsh-vault" not found`;要么按依赖正常安装(`pnpm dsh plugin --profile web add dsh-vault`),要么手动建垫片:
254
-
255
- ```sh
256
- ln -sf ../dsh-vault/lib/cli.js ~/.dsh/profiles/web/node_modules/.bin/dsh-vault
213
+ $ dsh-vault env
214
+ DEMO_API_KEY='sk-demo-123'
215
+ OTHER_PASSWORD='pw-not-exported'
257
216
  ```
258
217
 
259
- #### npm 安装
218
+ `eval "$(dsh-vault env)"` 就是把这些赋值读进**当前 shell** —— 这通常才是你要用它的原因:
260
219
 
261
220
  ```sh
262
- # a) 装进 profile(推荐:插件与 CLI 一起就位)
263
- pnpm dsh plugin --profile web add dsh-vault
264
- pnpm dsh plugin --profile web exec dsh-vault list # --profile 必填
265
-
266
- # b) 全局安装,任何 shell 都能用 —— CLI 不需要任何 harness 包
267
- npm i -g dsh-vault
268
- dsh-vault list
269
-
270
- # c) 不安装直接用
271
- npx dsh-vault list
221
+ eval "$(dsh-vault env)" # KEY=VALUE 变成 shell 变量
222
+ echo "$DEMO_API_KEY"
272
223
  ```
273
224
 
274
- (a) 会安装 bundle,并生成 `exec` 需要的 `node_modules/.bin/dsh-vault` 垫片。(b)(c) 能直接用,是因为读命令(`list`、`get`、`env`、`show`、`verify`、`export-env`)只依赖 Node;**只有写保险库**才需要 harness 运行时,而插件环境一定有。
225
+ 两个前提要知道:
275
226
 
276
- #### 源码安装
227
+ - **只有打了 `env` 标签的条目才会被导出。** 一个都没打时,输出的是
228
+ "no entries are tagged for environment export";先在 UI 里给条目的标签加上 `env`,或让助手执行 `vault_update { id, tags: ["env"] }`。
229
+ - 名字默认由标题 + 字段推导(`DASHSCOPE` + `apiKey` → `DASHSCOPE_API_KEY`);想固定名字就在条目的 `envKeys` 里指定 —— 见[环境变量导出](#环境变量导出)。
277
230
 
278
- ```sh
279
- git clone git@github.com:Ox0400/dsh-vault.git && cd dsh-vault
280
- npm install && npm run build # 生成 lib/,含可执行的 lib/cli.js
231
+ ### 2. 有哪些命令
281
232
 
282
- node lib/cli.js list # 直接跑
283
- npm link # ……或把 dsh-vault 放到 PATH
284
- ./lib/cli.js list # 文件本身也可执行
233
+ ```sh
234
+ dsh-vault list # id、类型、标题、导出的变量名,绝不含密钥
235
+ dsh-vault get my-entry # 取该条目的主密钥,仅 stdout
236
+ dsh-vault get my-entry --field apiKey # 取指定字段
237
+ dsh-vault get my-entry --mask # 只确认存在,不打印值
238
+ dsh-vault show my-entry # 非敏感字段的 JSON
239
+ dsh-vault env # 带 env 标签的条目 → KEY=VALUE
240
+ dsh-vault export-env .env # ……或写成 0600 权限的 .env 文件
241
+ dsh-vault verify # 校验主密码,stdout 无输出
285
242
  ```
286
243
 
287
- 要**开发插件**并对接某个 profile,需要把 checkout 软链进 profile 并加一层 patch 插入插件(本仓库平时就是这么开发的);**CLI 不需要这些** —— 它直接读同一个保险库文件。
288
-
289
- #### 另外值得知道
290
-
291
- `pnpm --dir ~/.dsh/profiles/web exec dsh-vault env` 等价于 `dsh plugin` 那种写法,只是不经过启动器;`node ~/.dsh/profiles/web/node_modules/dsh-vault/lib/cli.js env` **永远可用**,即使 `node_modules/dsh-vault` 只是指向 checkout 的软链。
292
-
293
- profile 这条路有两个注意点:垫片可能被之后在该目录执行的 `pnpm install` 清掉;而 `pnpm dsh plugin --profile web add dsh-vault` 会依据包的 `dsh.bundle` 声明重整 `dsh.profile.bundles` —— 如果你自己的 patch 层**也**插入了这个插件,就会**挂两份**,要先删掉 patch 层那一行。
244
+ 密钥只走 stdout,其余(进度、错误)走 stderr,所以 `$(dsh-vault get …)` 与管道都正常;退出码 `0` 成功、`1` 运行错误、`2` 用法错误。
294
245
 
295
- 主密码来源依次为:`--password-stdin` → `$DSH_VAULT_MASTER_PASSWORD`(或 `$DSH_VAULT_PASSWORD`)→ 交互式提示;它**不会**去读插件配置文件里的密码。密钥只走 stdout,其余(进度、错误)走 stderr,所以管道与 `$(...)` 都能正常用。
246
+ ### 3. shell 引号:不是 `export $(…)`
296
247
 
297
- **可以用「导出的键名」代替标题** —— 脚本通常只知道这个名字:
248
+ 正确的是 `eval "$(dsh-vault env)"`;`export $(dsh-vault env)` 是错的。命令替换会**按空白拆分**,而且**不会**去掉 CLI 输出的引号 —— 值里只要有一个空格就会被拆成多个词,所有值还会带上字面引号:
298
249
 
299
250
  ```sh
300
- dsh-vault get DASHSCOPE_API_KEY # 派生名
301
- dsh-vault get TAVILY_TOKEN # 条目上配置的名字
302
- dsh-vault get TAVILY_TOKEN_REFRESH_TOKEN # 配置名 + 字段后缀
303
- dsh-vault get ACME_GITHUB_TOKEN --fields apikey # --field/--fields,字段名不区分大小写
304
- dsh-vault show ACME_GITHUB_TOKEN # 非敏感元数据的 JSON
305
- dsh-vault get DASHSCOPE_API_KEY | my-tool # 直接喂给工具
251
+ $ export $(dsh-vault env); echo "$WITH_SPACE"
252
+ ['pass] # 在空格处被拆断
253
+ bash: export: `here': not a valid identifier
254
+ $ eval "$(dsh-vault env)"; echo "$WITH_SPACE"
255
+ [pass word here] # 按原样读入
306
256
  ```
307
257
 
308
- 未知参数会直接报错(`--fields` 是 `--field` 的别名;`--nope` 退出码 2,不会被静默忽略)。
258
+ 脚本里更推荐用文件形式,**完全不用 `eval`**:
309
259
 
310
- `list` 会直接打印可复制的名字,不用猜;`[env]` 标记出真正会被 `dsh-vault env` 导出的条目:
311
-
312
- ```
313
- a1b2c3d4-… api-key DASHSCOPE → DASHSCOPE_API_KEY [env]
314
- 5db92b44-… oauth Tavily → TAVILY_TOKEN (+2) [env]
315
- 9f8e7d6c-… api-key Example Billing (sandbox) → EXAMPLE_BILLING_API_KEY
260
+ ```sh
261
+ dsh-vault export-env .env && set -a && . ./.env && set +a
316
262
  ```
317
263
 
318
- `(+2)` 是这条目还会导出的其他键数量(如 `TAVILY_TOKEN_REFRESH_TOKEN`、`TAVILY_TOKEN_SCOPE`);`list --json` / `show` 会全部列出,并把两件事分开:
264
+ ### 4. 主密码
319
265
 
320
- | 字段 | 含义 |
321
- |---|---|
322
- | `envKeys` | **你配置的**名字(没配就是空数组) |
323
- | `exportedKeys` | 这条目**实际会导出**的名字,也就是 `get` 接受的名字 |
324
- | `envTagged` | 是否会被 `dsh-vault env` 包含(取决于 `env` 标签) |
266
+ 依次取 `--password-stdin` → `$DSH_VAULT_MASTER_PASSWORD`(或 `$DSH_VAULT_PASSWORD`)→ 交互式提示;它**不会**去读插件配置文件里的密码,所以 CLI 既不依赖、也不会泄露 profile patch 里那份:
325
267
 
326
- 解析顺序:**id → 标题 → `envKey` → 该条目会导出的任意键名**。`get` 与 `env` 共用同一份实现,所以 `env` 打印出来的每个名字都能用 `get` 取回。
327
-
328
- ### 怎么调用
329
-
330
- **没有安装就没有 `dsh-vault` 这个命令。** 插件是 Cordis bundle,而 `dsh` 没有插件子命令注册表:启动器只解析自己的参数(`--profile`、`--patch`、`--dump-config`),`dsh plugin …` 是**唯一**转发给 pnpm 的子命令(`dsh-cmdline` 是让**应用型 bundle** 拥有 profile 参数族,不是让插件获得 `dsh <插件>` 命令)。所以 `dsh web exec …` 会把参数交给 web app,报 `error: too many arguments`。按你的情况选:
268
+ ```sh
269
+ DSH_VAULT_MASTER_PASSWORD=… pnpm vault list
270
+ printf '%s\n' "$PASSWORD" | pnpm vault list --password-stdin
271
+ ```
331
272
 
332
- | 你的情况 | 怎么跑 CLI |
333
- |---|---|
334
- | **源码 checkout**(`git clone` + `pnpm build`) | `pnpm vault list` —— 或 `node lib/cli.js list`、`./lib/cli.js list` |
335
- | 插件**装进了 profile** | `pnpm dsh plugin --profile web exec dsh-vault list` |
336
- | **全局安装** | `dsh-vault list` |
337
- | **什么都没装** | `npx dsh-vault list` |
273
+ ### 5. 安装细节
338
274
 
339
- #### 源码 checkout
275
+ **源码 checkout:**
340
276
 
341
277
  ```sh
342
278
  git clone git@github.com:Ox0400/dsh-vault.git && cd dsh-vault
343
279
  npm install && npm run build # 生成 lib/,含可执行的 lib/cli.js
344
280
 
345
- pnpm vault list # 仓库自带的入口(package.json script)
281
+ pnpm vault list # 仓库自带入口(package.json script)
346
282
  node lib/cli.js list # 等价写法
347
- ./lib/cli.js list # 文件本身也可执行
283
+ ./lib/cli.js list # 文件本身可执行
348
284
  npm link # ……或把真正的 dsh-vault 放到 PATH
349
285
  ```
350
286
 
351
- 另外,要**开发插件**并对接 profile,还需把 checkout 软链进 profile 并加一层 patch 插入插件(本仓库平时就是这么开发的);**CLI 完全不需要这些** —— 它直接读保险库文件。手工软链的插件**没有** `node_modules/.bin/dsh-vault` 垫片,所以 `pnpm … exec` 会报 `Command "dsh-vault" not found`;要么按依赖正常安装(`pnpm dsh plugin --profile web add dsh-vault`),要么手动建垫片:
287
+ 要**开发插件**并对接 profile,还需要把 checkout 软链进 profile 并加一层 patch 插入插件(本仓库平时就是这么开发的);**CLI 完全不需要这些** —— 它直接读保险库文件。手工软链的插件**没有** `.bin/dsh-vault` 垫片,`pnpm … exec` 会报 `Command "dsh-vault" not found`;要么按依赖正常安装(`pnpm dsh plugin --profile web add dsh-vault`),要么手动建垫片:
352
288
 
353
289
  ```sh
354
290
  ln -sf ../dsh-vault/lib/cli.js ~/.dsh/profiles/web/node_modules/.bin/dsh-vault
355
291
  ```
356
292
 
357
- #### npm 安装
293
+ **npm 安装:**
358
294
 
359
295
  ```sh
360
- # a) 装进 profile(推荐:插件与 CLI 一起就位)
361
- pnpm dsh plugin --profile web add dsh-vault
362
- pnpm dsh plugin --profile web exec dsh-vault list # --profile 必填
363
-
364
- # b) 全局安装,任何 shell 都能用 —— CLI 不需要任何 harness 包
365
- npm i -g dsh-vault
366
- dsh-vault list
296
+ pnpm dsh plugin --profile web add dsh-vault # 装进 profile(插件与 CLI 一起)
297
+ pnpm dsh plugin --profile web exec dsh-vault list # --profile 必填
367
298
 
368
- # c) 不安装直接用
369
- npx dsh-vault list
370
- ```
371
-
372
- (a) 会安装 bundle,并生成 `exec` 需要的 `node_modules/.bin/dsh-vault` 垫片。(b)(c) 能直接用,是因为读命令(`list`、`get`、`env`、`show`、`verify`、`export-env`)只依赖 Node;**只有写保险库**才需要 harness 运行时,而插件环境一定有。
373
-
374
- #### 源码安装
375
-
376
- ```sh
377
- git clone git@github.com:Ox0400/dsh-vault.git && cd dsh-vault
378
- npm install && npm run build # 生成 lib/,含可执行的 lib/cli.js
379
-
380
- node lib/cli.js list # 直接跑
381
- npm link # ……或把 dsh-vault 放到 PATH
382
- ./lib/cli.js list # 文件本身也可执行
383
- ```
384
-
385
- 要**开发插件**并对接某个 profile,需要把 checkout 软链进 profile 并加一层 patch 插入插件(本仓库平时就是这么开发的);**CLI 不需要这些** —— 它直接读同一个保险库文件。
386
-
387
- #### 其余等价写法
388
-
389
- `pnpm --dir ~/.dsh/profiles/web exec dsh-vault env`(不经过 dsh 启动器)与 `node ~/.dsh/profiles/web/node_modules/dsh-vault/lib/cli.js env`(一定可用,软链到工作区也行)。
390
-
391
- `pnpm dsh plugin --profile web exec …` 需要 `node_modules/.bin/dsh-vault` 垫片,它只对**在清单里声明的依赖**由 `pnpm install` 生成。如果插件是你手工 `ln -s` 进 profile 的,就没有垫片,`exec` 会报 `Command "dsh-vault" not found`;此时可以手动建:
392
-
393
- ```sh
394
- ln -sf ../dsh-vault/lib/cli.js ~/.dsh/profiles/web/node_modules/.bin/dsh-vault
299
+ npm i -g dsh-vault && dsh-vault list # 全局
300
+ npx dsh-vault list # 或者干脆不装
395
301
  ```
396
302
 
397
- 或者直接用文件路径。注意:垫片可能被之后在 profile 目录执行的 `pnpm install` 清掉;另外 `pnpm dsh plugin --profile web add dsh-vault` 会依据包的 `dsh.bundle` 声明去重整 `dsh.profile.bundles` —— 如果你自己的 patch 层**已经**插入了这个插件,那会**挂两份**,要先删掉 patch 层那一行。
303
+ 读命令(`list`、`get`、`env`、`show`、`verify`、`export-env`)只依赖 Node,所以全局与 `npx` 都能直接用;**只有写保险库**才需要 harness 运行时,而插件环境一定有。
398
304
 
399
- 主密码依次取 `--password-stdin` → `$DSH_VAULT_MASTER_PASSWORD`(或 `$DSH_VAULT_PASSWORD`)→ 交互式提示;它**不会**去读插件配置文件里的密码,所以 CLI 既不依赖、也不会泄露 profile patch 里那份。
305
+ profile 这条路还有两个注意点:垫片可能被之后在该目录执行的 `pnpm install` 清掉;`pnpm dsh plugin --profile web add dsh-vault` 会依据包的 `dsh.bundle` 声明重整 `dsh.profile.bundles` —— 如果你自己的 patch 层**也**插入了这个插件,就会**挂两份**,要先删掉 patch 层那一行。
400
306
 
401
307
  ## 环境变量导出
402
308
 
package/README.md CHANGED
@@ -183,204 +183,118 @@ The tarball ships prebuilt `lib/` artifacts, so no build step or `allowBuilds` i
183
183
 
184
184
  ## Command line
185
185
 
186
- The plugin hands the vault to the assistant; the bundled `dsh-vault` command
186
+ The plugin hands the vault to the assistant. The bundled `dsh-vault` command
187
187
  hands the same vault to shells and scripts, so a skill's child process can read
188
- a secret **without the plaintext ever entering the model's context**:
188
+ a secret **without the plaintext ever entering the model's context**.
189
189
 
190
- ```sh
191
- eval "$(dsh-vault env)" # env-tagged entries → KEY=VALUE
192
- dsh-vault get my-entry --field apiKey # one field, stdout only
193
- dsh-vault get my-entry | pbcopy # the entry's primary secret
194
- dsh-vault export-env .env # 0600 file for docker/systemd
195
- dsh-vault list # id, kind, title, env name — never secrets
196
- dsh-vault show my-entry # non-secret fields as JSON
197
- ```
190
+ ### 0. First: which command can you actually type?
198
191
 
199
- > **Why not `export $(dsh-vault env)`?** Command substitution splits on
200
- > whitespace and does not remove the quoting `dsh-vault` emits, so a value with a
201
- > space breaks into the wrong words and every value keeps its literal quotes.
202
- > `eval "$(dsh-vault env)"` reads the emitted assignments as intended;
203
- > `dsh-vault export-env .env && set -a && . ./.env && set +a` avoids `eval`
204
- > entirely and is the better choice inside a script.
192
+ **Nothing provides a `dsh-vault` binary until the package is installed** — the
193
+ plugin is a Cordis bundle, and `dsh` has no plugin-subcommand registry (the
194
+ launcher parses only its own flags; `dsh plugin …` just forwards to pnpm, so
195
+ `dsh web exec …` hands its arguments to the web app and fails with
196
+ `error: too many arguments`). Pick your row before reading the examples:
205
197
 
206
- The master password comes from `--password-stdin`, then
207
- `$DSH_VAULT_MASTER_PASSWORD` (or `$DSH_VAULT_PASSWORD`), then an interactive
208
- prompt; it is never read from the plugin's config file. Secrets go to stdout and
209
- everything else to stderr, so pipelines behave.
210
-
211
- **Any exported key can be named instead of a title**, which is what a script
212
- usually knows:
198
+ | your setup | the command |
199
+ |---|---|
200
+ | **source checkout** (`git clone` + `pnpm build`) | **`pnpm vault`** — or `node lib/cli.js`, or `./lib/cli.js` |
201
+ | plugin **installed into a profile** | `pnpm dsh plugin --profile web exec dsh-vault` |
202
+ | **globally installed** (`npm i -g dsh-vault`) | `dsh-vault` |
203
+ | **nothing installed** | `npx dsh-vault` |
213
204
 
214
205
  ```sh
215
- dsh-vault get DASHSCOPE_API_KEY # derived key
216
- dsh-vault get TAVILY_TOKEN # the entry's configured name
217
- dsh-vault get TAVILY_TOKEN_REFRESH_TOKEN # configured name + field suffix
218
- dsh-vault get ACME_GITHUB_TOKEN --fields apikey # --field/--fields, case-insensitive
219
- dsh-vault show ACME_GITHUB_TOKEN # non-secret metadata as JSON
220
- dsh-vault get DASHSCOPE_API_KEY | my-tool # pipe it straight in
221
- ```
222
-
223
- An unknown option is an error (`--fields apikey` is accepted as an alias of
224
- `--field apiKey`; `--nope` exits 2 rather than being ignored).
225
-
226
- `list` prints the name to copy, so a script author never has to guess it — and
227
- `[env]` marks the entries `dsh-vault env` actually emits:
206
+ # source checkout — this repository, right now:
207
+ pnpm vault list
228
208
 
209
+ # after a global install (or via npx) the same commands are:
210
+ dsh-vault list
211
+ npx dsh-vault list
229
212
  ```
230
- a1b2c3d4-… api-key DASHSCOPE → DASHSCOPE_API_KEY [env]
231
- 5db92b44-… oauth Tavily → TAVILY_TOKEN (+2) [env]
232
- 9f8e7d6c-… api-key Example Billing (sandbox) → EXAMPLE_BILLING_API_KEY
233
- ```
234
-
235
- `(+2)` counts the further keys that entry exports (`TAVILY_TOKEN_REFRESH_TOKEN`,
236
- `TAVILY_TOKEN_SCOPE`); `list --json` / `show` spell them all out, and keep the
237
- two ideas apart:
238
-
239
- | field | meaning |
240
- |---|---|
241
- | `envKeys` | the names **you configured** (empty when you configured none) |
242
- | `exportedKeys` | the names the entry **actually exports**, i.e. what `get` accepts |
243
- | `envTagged` | whether `dsh-vault env` includes this entry (the `env` tag) |
244
-
245
- Resolution order: **id → title → `envKey` → any exported key name**. `get` and
246
- `env` share one implementation, so every name `env` prints is retrievable by
247
- `get`.
248
213
 
249
- ### How to invoke it
214
+ Every example below is written as `dsh-vault …`; substitute the form from your
215
+ row (`pnpm vault …` in a checkout).
250
216
 
251
- **There is no `dsh-vault` binary unless the package is installed.** The plugin
252
- is a Cordis bundle, and `dsh` has no plugin-subcommand registry: the launcher
253
- parses only its own flags (`--profile`, `--patch`, `--dump-config`), and
254
- `dsh plugin …` is the *only* subcommand that forwards to pnpm (`dsh-cmdline`
255
- lets an *app* bundle own a flag family — not a plugin gain a `dsh <plugin>`
256
- command). So `dsh web exec …` hands `exec …` to the web app and fails with
257
- `error: too many arguments`. Pick the row that matches your setup:
217
+ ### 1. What `env` is for
258
218
 
259
- | your setup | how to run the CLI |
260
- |---|---|
261
- | **source checkout** (`git clone`, `pnpm build`) | `pnpm vault list` — or `node lib/cli.js list`, or `./lib/cli.js list` |
262
- | plugin **installed into a profile** | `pnpm dsh plugin --profile web exec dsh-vault list` |
263
- | **globally installed** | `dsh-vault list` |
264
- | **nothing installed** | `npx dsh-vault list` |
265
-
266
- #### Source checkout
219
+ `get` fetches **one** value and needs no tag. `dsh-vault env` is for the other
220
+ case: a script that needs **several** secrets at once. It prints the entries you
221
+ tagged `env` as shell assignments, so the script picks them up itself:
267
222
 
268
- ```sh
269
- git clone git@github.com:Ox0400/dsh-vault.git && cd dsh-vault
270
- npm install && npm run build # builds lib/, including executable lib/cli.js
271
-
272
- pnpm vault list # the repo's own entry point (package.json script)
273
- node lib/cli.js list # same thing, spelled out
274
- ./lib/cli.js list # the file is executable too
275
- npm link # …or put a real `dsh-vault` on PATH
223
+ ```
224
+ $ dsh-vault env
225
+ DEMO_API_KEY='sk-demo-123'
226
+ OTHER_PASSWORD='pw-not-exported'
276
227
  ```
277
228
 
278
- To develop the *plugin* against a profile you also link the checkout into the
279
- profile and add a patch layer that inserts it (how this repository is normally
280
- developed); **the CLI does not need any of that** — it reads the vault file
281
- directly. A hand-linked plugin has no `node_modules/.bin/dsh-vault` shim, so
282
- `pnpm … exec` would report `Command "dsh-vault" not found` unless you either add
283
- the dependency properly (`pnpm dsh plugin --profile web add dsh-vault`) or create
284
- the shim by hand:
229
+ `eval "$(dsh-vault env)"` reads those assignments into the **current shell** —
230
+ the usual reason to reach for it:
285
231
 
286
232
  ```sh
287
- ln -sf ../dsh-vault/lib/cli.js ~/.dsh/profiles/web/node_modules/.bin/dsh-vault
233
+ eval "$(dsh-vault env)" # KEY=VALUE lines become shell variables
234
+ echo "$DEMO_API_KEY"
288
235
  ```
289
236
 
290
- #### npm install
237
+ Two things worth knowing:
291
238
 
292
- ```sh
293
- # a) into a profile (recommended: plugin and CLI travel together)
294
- pnpm dsh plugin --profile web add dsh-vault
295
- pnpm dsh plugin --profile web exec dsh-vault list # --profile is required
239
+ - **Only `env`-tagged entries are exported.** With none tagged you get
240
+ "no entries are tagged for environment export"; tag one in the UI (the
241
+ entry's tags field) or with `vault_update { id, tags: ["env"] }`.
242
+ - The name is derived from the title and field (`DASHSCOPE` + `apiKey` →
243
+ `DASHSCOPE_API_KEY`) unless the entry sets `envKeys` — see
244
+ [Environment export](#environment-export).
296
245
 
297
- # b) globally, for any shell
298
- npm i -g dsh-vault
299
- dsh-vault list
246
+ ### 2. The commands
300
247
 
301
- # c) without installing
302
- npx dsh-vault list
248
+ ```sh
249
+ dsh-vault list # id, kind, title, exported env name — never secrets
250
+ dsh-vault get my-entry # the entry's primary secret, stdout only
251
+ dsh-vault get my-entry --field apiKey # one named field
252
+ dsh-vault get my-entry --mask # confirm it exists without printing it
253
+ dsh-vault show my-entry # non-secret metadata as JSON
254
+ dsh-vault env # env-tagged entries as KEY=VALUE
255
+ dsh-vault export-env .env # …or write them to a 0600 file
256
+ dsh-vault verify # check the master password, nothing on stdout
303
257
  ```
304
258
 
305
- (a) creates the `.bin` shim `exec` uses. (b) and (c) work because the read
306
- commands (`list`, `get`, `env`, `show`, `verify`, `export-env`) depend on Node
307
- alone; only *writing* to a vault needs the harness runtime, which the plugin
308
- always has.
309
-
310
- #### Also worth knowing
311
-
312
- `pnpm --dir ~/.dsh/profiles/web exec dsh-vault env` is equivalent to the
313
- `dsh plugin` form without the launcher, and
314
- `node ~/.dsh/profiles/web/node_modules/dsh-vault/lib/cli.js env` always works,
315
- even when `node_modules/dsh-vault` is a symlink into a checkout.
316
-
317
- Two caveats on the profile route: the `.bin` shim can be pruned by a later
318
- `pnpm install` there, and `pnpm dsh plugin --profile web add dsh-vault`
319
- reconciles `dsh.profile.bundles` from the package's `dsh.bundle` declaration — if
320
- your own patch layer *also* inserts the plugin, that mounts it twice, so remove
321
- the patch row first.
259
+ Secrets go to stdout and everything else (progress, errors) to stderr, so
260
+ `$(dsh-vault get …)` and pipelines behave. Exit codes: `0` ok, `1` runtime
261
+ error, `2` usage error.
322
262
 
323
- The master password comes from `--password-stdin`, then
324
- `$DSH_VAULT_MASTER_PASSWORD` (or `$DSH_VAULT_PASSWORD`), then an interactive
325
- prompt; it is never read from the plugin's config file. Secrets go to stdout and
326
- everything else to stderr, so pipelines behave.
263
+ ### 3. Shell quoting: not `export $(…)`
327
264
 
328
- **Any exported key can be named instead of a title**, which is what a script
329
- usually knows:
265
+ `eval "$(dsh-vault env)"` is right; `export $(dsh-vault env)` is wrong. Command
266
+ substitution splits on whitespace and does **not** strip the quotes the CLI
267
+ emits, so a value containing a space breaks into the wrong words and every value
268
+ keeps its literal quotes:
330
269
 
331
270
  ```sh
332
- dsh-vault get DASHSCOPE_API_KEY # derived key
333
- dsh-vault get TAVILY_TOKEN # the entry's configured name
334
- dsh-vault get TAVILY_TOKEN_REFRESH_TOKEN # configured name + field suffix
335
- dsh-vault get ACME_GITHUB_TOKEN --fields apikey # --field/--fields, case-insensitive
336
- dsh-vault show ACME_GITHUB_TOKEN # non-secret metadata as JSON
337
- dsh-vault get DASHSCOPE_API_KEY | my-tool # pipe it straight in
271
+ $ export $(dsh-vault env); echo "$WITH_SPACE"
272
+ ['pass] # split at the space
273
+ bash: export: `here': not a valid identifier
274
+ $ eval "$(dsh-vault env)"; echo "$WITH_SPACE"
275
+ [pass word here] # read as intended
338
276
  ```
339
277
 
340
- An unknown option is an error (`--fields apikey` is accepted as an alias of
341
- `--field apiKey`; `--nope` exits 2 rather than being ignored).
278
+ In a script, prefer the file form — no `eval` at all:
342
279
 
343
- `list` prints the name to copy, so a script author never has to guess it — and
344
- `[env]` marks the entries `dsh-vault env` actually emits:
345
-
346
- ```
347
- a1b2c3d4-… api-key DASHSCOPE → DASHSCOPE_API_KEY [env]
348
- 5db92b44-… oauth Tavily → TAVILY_TOKEN (+2) [env]
349
- 9f8e7d6c-… api-key Example Billing (sandbox) → EXAMPLE_BILLING_API_KEY
280
+ ```sh
281
+ dsh-vault export-env .env && set -a && . ./.env && set +a
350
282
  ```
351
283
 
352
- `(+2)` counts the further keys that entry exports (`TAVILY_TOKEN_REFRESH_TOKEN`,
353
- `TAVILY_TOKEN_SCOPE`); `list --json` / `show` spell them all out, and keep the
354
- two ideas apart:
284
+ ### 4. The master password
355
285
 
356
- | field | meaning |
357
- |---|---|
358
- | `envKeys` | the names **you configured** (empty when you configured none) |
359
- | `exportedKeys` | the names the entry **actually exports**, i.e. what `get` accepts |
360
- | `envTagged` | whether `dsh-vault env` includes this entry (the `env` tag) |
286
+ `--password-stdin`, then `$DSH_VAULT_MASTER_PASSWORD` (or `$DSH_VAULT_PASSWORD`),
287
+ then an interactive prompt. It is **not** read from the plugin's config file, so
288
+ the CLI never depends on (or leaks) whatever the profile patch holds:
361
289
 
362
- Resolution order: **id → title → `envKey` → any exported key name**. `get` and
363
- `env` share one implementation, so every name `env` prints is retrievable by
364
- `get`.
365
-
366
- ### How to invoke it
367
-
368
- **There is no `dsh-vault` binary unless the package is installed.** The plugin
369
- is a Cordis bundle, and `dsh` has no plugin-subcommand registry: the launcher
370
- parses only its own flags (`--profile`, `--patch`, `--dump-config`), and
371
- `dsh plugin …` is the *only* subcommand that forwards to pnpm (`dsh-cmdline`
372
- lets an *app* bundle own a flag family — not a plugin gain a `dsh <plugin>`
373
- command). So `dsh web exec …` hands `exec …` to the web app and fails with
374
- `error: too many arguments`. Pick the row that matches your setup:
290
+ ```sh
291
+ DSH_VAULT_MASTER_PASSWORD=… pnpm vault list
292
+ printf '%s\n' "$PASSWORD" | pnpm vault list --password-stdin
293
+ ```
375
294
 
376
- | your setup | how to run the CLI |
377
- |---|---|
378
- | **source checkout** (`git clone`, `pnpm build`) | `pnpm vault list` — or `node lib/cli.js list`, or `./lib/cli.js list` |
379
- | plugin **installed into a profile** | `pnpm dsh plugin --profile web exec dsh-vault list` |
380
- | **globally installed** | `dsh-vault list` |
381
- | **nothing installed** | `npx dsh-vault list` |
295
+ ### 5. Install details
382
296
 
383
- #### Source checkout
297
+ **Source checkout:**
384
298
 
385
299
  ```sh
386
300
  git clone git@github.com:Ox0400/dsh-vault.git && cd dsh-vault
@@ -394,61 +308,34 @@ npm link # …or put a real `dsh-vault` on PATH
394
308
 
395
309
  To develop the *plugin* against a profile you also link the checkout into the
396
310
  profile and add a patch layer that inserts it (how this repository is normally
397
- developed); **the CLI does not need any of that** — it reads the vault file
398
- directly. A hand-linked plugin has no `node_modules/.bin/dsh-vault` shim, so
399
- `pnpm … exec` would report `Command "dsh-vault" not found` unless you either add
400
- the dependency properly (`pnpm dsh plugin --profile web add dsh-vault`) or create
401
- the shim by hand:
311
+ developed); **the CLI needs none of that** — it reads the vault file directly. A
312
+ hand-linked plugin has no `.bin/dsh-vault` shim, so `pnpm … exec` reports
313
+ `Command "dsh-vault" not found` unless you install it as a dependency
314
+ (`pnpm dsh plugin --profile web add dsh-vault`) or create the shim by hand:
402
315
 
403
316
  ```sh
404
317
  ln -sf ../dsh-vault/lib/cli.js ~/.dsh/profiles/web/node_modules/.bin/dsh-vault
405
318
  ```
406
319
 
407
- #### npm install
320
+ **npm install:**
408
321
 
409
322
  ```sh
410
- # a) into a profile (recommended: plugin and CLI travel together)
411
- pnpm dsh plugin --profile web add dsh-vault
412
- pnpm dsh plugin --profile web exec dsh-vault list # --profile is required
413
-
414
- # b) globally, for any shell
415
- npm i -g dsh-vault
416
- dsh-vault list
417
-
418
- # c) without installing
419
- npx dsh-vault list
420
- ```
323
+ pnpm dsh plugin --profile web add dsh-vault # into a profile (plugin + CLI together)
324
+ pnpm dsh plugin --profile web exec dsh-vault list # --profile is required
421
325
 
422
- (a) creates the `.bin` shim `exec` uses. (b) and (c) work because the read
423
- commands (`list`, `get`, `env`, `show`, `verify`, `export-env`) depend on Node
424
- alone; only *writing* to a vault needs the harness runtime, which the plugin
425
- always has.
426
-
427
- #### Either way
428
-
429
- Two other equivalent forms are worth knowing: `pnpm --dir ~/.dsh/profiles/web
430
- exec dsh-vault env` (no launcher involved) and `node ~/.dsh/profiles/web/node_modules/dsh-vault/lib/cli.js env`
431
- (always works, even for a symlinked checkout).
432
-
433
- `pnpm dsh plugin --profile web exec …` needs the `node_modules/.bin/dsh-vault`
434
- shim that `pnpm install` creates for a **declared** dependency. If the plugin was
435
- linked into the profile by hand (`ln -s`) it has no shim, and `exec` reports
436
- `Command "dsh-vault" not found`; either create the shim
437
-
438
- ```sh
439
- ln -sf ../dsh-vault/lib/cli.js ~/.dsh/profiles/web/node_modules/.bin/dsh-vault
326
+ npm i -g dsh-vault && dsh-vault list # globally
327
+ npx dsh-vault list # or not at all
440
328
  ```
441
329
 
442
- or use form 4. Note the shim can be pruned by a later `pnpm install` in the
443
- profile, and that `pnpm dsh plugin --profile web add dsh-vault` reconciles
444
- `dsh.profile.bundles` from the package's `dsh.bundle` declaration — if the
445
- plugin is *also* inserted by your own patch layer, that mounts it twice, so
446
- remove the patch row first.
330
+ The read commands (`list`, `get`, `env`, `show`, `verify`, `export-env`) depend
331
+ on Node alone, which is why the global and `npx` forms work. Only *writing* to a
332
+ vault needs the harness runtime, and the plugin always has it.
447
333
 
448
- The master password comes from `--password-stdin`, then
449
- `$DSH_VAULT_MASTER_PASSWORD` (or `$DSH_VAULT_PASSWORD`), then an interactive
450
- prompt; it is **not** read from the plugin's config file, so the CLI never
451
- depends on (or leaks) whatever the profile patch happens to hold.
334
+ Two more caveats on the profile route: its `.bin` shim can be pruned by a later
335
+ `pnpm install`, and `pnpm dsh plugin --profile web add dsh-vault` reconciles
336
+ `dsh.profile.bundles` from the package's `dsh.bundle` declaration — if your own
337
+ patch layer *also* inserts the plugin, that mounts it twice, so remove the patch
338
+ row first.
452
339
 
453
340
  ## Environment export
454
341
 
package/lib/cli.js CHANGED
@@ -43,7 +43,9 @@ Commands:
43
43
  list List entries with their env name (never secrets)
44
44
  get <id|title|ENVKEY> Print one field of an entry (default: its main secret)
45
45
  show <id|title|ENVKEY> Print an entry's non-secret fields as JSON
46
- env Print env-tagged entries as KEY=VALUE lines
46
+ env Print env-TAGGED entries as KEY=VALUE lines (an entry
47
+ must carry the tag "env"; "list" marks those [env]).
48
+ One value only? "get <entry>" needs no tag.
47
49
  export-env <path> Write those lines to a file (mode 0600)
48
50
  verify Check the master password (nothing on stdout)
49
51
 
@@ -471,8 +473,18 @@ export async function runCli(argv, io) {
471
473
  return 0;
472
474
  }
473
475
  io.out(rendered.join('\n') + (rendered.length > 0 ? '\n' : ''));
474
- if (rendered.length === 0)
475
- io.err('dsh-vault: no env-tagged entries (add the tag "env" to an entry)\n');
476
+ if (rendered.length === 0) {
477
+ // The usual first-run wall: `env` only exports entries tagged `env`, and
478
+ // that tag exists so a shell never receives every secret in the vault.
479
+ io.err('dsh-vault: nothing to export — no entry carries the "env" tag.\n');
480
+ io.err(' `env` exports only entries whose tags include "env"; that tag is what\n');
481
+ io.err(' keeps the rest of the vault (cards, notes, unrelated logins) out of your shell.\n');
482
+ io.err(' Tag one entry and run it again:\n');
483
+ io.err(' UI: Settings → Credentials → the entry → tags → env\n');
484
+ io.err(' assistant: vault_update { id, tags: ["env"] }\n');
485
+ io.err(' `dsh-vault list` marks tagged entries with [env] and shows the name each exports.\n');
486
+ io.err(' Only need one value? `dsh-vault get <entry>` needs no tag at all.\n');
487
+ }
476
488
  return 0;
477
489
  }
478
490
  catch (err) {
package/lib/client.js CHANGED
@@ -495,191 +495,191 @@ window.__ModuleLoader__.load({
495
495
  document.head.appendChild(tag);
496
496
  }
497
497
  var VaultSection_module_css_default = {
498
- "detailDeleteBtn": "t_j5va_detailDeleteBtn",
499
- "recentSearch": "t_j5va_recentSearch",
500
- "genHist": "t_j5va_genHist",
501
- "auditChips": "t_j5va_auditChips",
502
- "iconFieldWrap": "t_j5va_iconFieldWrap",
503
- "rowCheck": "t_j5va_rowCheck",
504
- "lenChip": "t_j5va_lenChip",
505
- "tabs": "t_j5va_tabs",
506
- "customKeyInput": "t_j5va_customKeyInput",
507
- "kindChipActive": "t_j5va_kindChipActive",
508
- "headerMessage": "t_j5va_headerMessage",
509
- "tagCount": "t_j5va_tagCount",
510
- "pwMeter": "t_j5va_pwMeter",
511
- "reportJump": "t_j5va_reportJump",
512
- "pwFair": "t_j5va_pwFair",
513
- "rowMain": "t_j5va_rowMain",
514
- "retryButton": "t_j5va_retryButton",
515
- "lenChipActive": "t_j5va_lenChipActive",
516
- "pwLabel": "t_j5va_pwLabel",
517
- "detailRemain": "t_j5va_detailRemain",
498
+ "actionGroupLabel": "t_j5va_actionGroupLabel",
499
+ "moreWrap": "t_j5va_moreWrap",
500
+ "tagManager": "t_j5va_tagManager",
518
501
  "editorActions": "t_j5va_editorActions",
519
- "searchBox": "t_j5va_searchBox",
520
- "tabPane": "t_j5va_tabPane",
502
+ "customEq": "t_j5va_customEq",
503
+ "reportLineLink": "t_j5va_reportLineLink",
504
+ "dupMerge": "t_j5va_dupMerge",
505
+ "bulkItem": "t_j5va_bulkItem",
506
+ "auditChip": "t_j5va_auditChip",
521
507
  "trashButton": "t_j5va_trashButton",
522
- "tagManager": "t_j5va_tagManager",
508
+ "pwLabel": "t_j5va_pwLabel",
509
+ "rowSelected": "t_j5va_rowSelected",
510
+ "tagManagerHead": "t_j5va_tagManagerHead",
511
+ "pinOff": "t_j5va_pinOff",
512
+ "auditChipActive": "t_j5va_auditChipActive",
513
+ "detailTotp": "t_j5va_detailTotp",
514
+ "detailItem": "t_j5va_detailItem",
515
+ "customFieldRows": "t_j5va_customFieldRows",
516
+ "toolbarMain": "t_j5va_toolbarMain",
517
+ "searchBox": "t_j5va_searchBox",
518
+ "resultCount": "t_j5va_resultCount",
519
+ "pinOn": "t_j5va_pinOn",
520
+ "copied": "t_j5va_copied",
521
+ "addButton": "t_j5va_addButton",
522
+ "kindIcon": "t_j5va_kindIcon",
523
+ "badge": "t_j5va_badge",
524
+ "genHist": "t_j5va_genHist",
525
+ "emojiPicker": "t_j5va_emojiPicker",
526
+ "tagCount": "t_j5va_tagCount",
527
+ "badgeOk": "t_j5va_badgeOk",
528
+ "dueBadge": "t_j5va_dueBadge",
529
+ "exportChip": "t_j5va_exportChip",
530
+ "status": "t_j5va_status",
523
531
  "favToggle": "t_j5va_favToggle",
524
- "selectActive": "t_j5va_selectActive",
525
- "tagName": "t_j5va_tagName",
526
- "pinStar": "t_j5va_pinStar",
527
- "pwHistTime": "t_j5va_pwHistTime",
532
+ "importRow": "t_j5va_importRow",
528
533
  "importActions": "t_j5va_importActions",
529
- "brandGlyph": "t_j5va_brandGlyph",
530
- "customValueInput": "t_j5va_customValueInput",
531
- "sortButton": "t_j5va_sortButton",
532
- "auditWhen": "t_j5va_auditWhen",
533
- "backupButton": "t_j5va_backupButton",
534
- "gridActions": "t_j5va_gridActions",
535
- "genOpts": "t_j5va_genOpts",
534
+ "detailDeleteBtn": "t_j5va_detailDeleteBtn",
535
+ "policyBar": "t_j5va_policyBar",
536
+ "importList": "t_j5va_importList",
537
+ "rowExpired": "t_j5va_rowExpired",
538
+ "toolbar": "t_j5va_toolbar",
539
+ "rowDue": "t_j5va_rowDue",
540
+ "genOptRow": "t_j5va_genOptRow",
541
+ "revealButton": "t_j5va_revealButton",
542
+ "attachBox": "t_j5va_attachBox",
536
543
  "toolbarFilters": "t_j5va_toolbarFilters",
537
- "vaultSwitch": "t_j5va_vaultSwitch",
538
- "status": "t_j5va_status",
539
- "auditChipActive": "t_j5va_auditChipActive",
540
- "title": "t_j5va_title",
541
- "auditRow": "t_j5va_auditRow",
542
- "bulkCount": "t_j5va_bulkCount",
544
+ "recentChip": "t_j5va_recentChip",
545
+ "actionBtn": "t_j5va_actionBtn",
546
+ "importDesc": "t_j5va_importDesc",
543
547
  "field": "t_j5va_field",
544
- "badge": "t_j5va_badge",
545
- "revealButton": "t_j5va_revealButton",
548
+ "title": "t_j5va_title",
549
+ "identity": "t_j5va_identity",
550
+ "policyField": "t_j5va_policyField",
546
551
  "pwWeak": "t_j5va_pwWeak",
547
- "exportChip": "t_j5va_exportChip",
548
- "reportBox": "t_j5va_reportBox",
549
- "bulkItem": "t_j5va_bulkItem",
550
- "healthBar": "t_j5va_healthBar",
551
- "attachBox": "t_j5va_attachBox",
552
- "histAdd": "t_j5va_histAdd",
553
- "secretField": "t_j5va_secretField",
554
- "auditIssues": "t_j5va_auditIssues",
555
- "histDanger": "t_j5va_histDanger",
556
- "searchKbd": "t_j5va_searchKbd",
557
- "emptyHint": "t_j5va_emptyHint",
558
- "tabActive": "t_j5va_tabActive",
559
- "dupGroup": "t_j5va_dupGroup",
560
- "importName": "t_j5va_importName",
561
- "badgeBtn": "t_j5va_badgeBtn",
562
- "srOnly": "t_j5va_srOnly",
563
- "riskWarn": "t_j5va_riskWarn",
564
- "detailCode": "t_j5va_detailCode",
552
+ "brandGlyph": "t_j5va_brandGlyph",
553
+ "emojiBtn": "t_j5va_emojiBtn",
554
+ "pwHistTime": "t_j5va_pwHistTime",
555
+ "tagActions": "t_j5va_tagActions",
556
+ "clearButton": "t_j5va_clearButton",
557
+ "riskDanger": "t_j5va_riskDanger",
558
+ "customFieldRow": "t_j5va_customFieldRow",
559
+ "row": "t_j5va_row",
565
560
  "scoreRing": "t_j5va_scoreRing",
566
- "genHistItem": "t_j5va_genHistItem",
567
- "importDesc": "t_j5va_importDesc",
568
- "pinOff": "t_j5va_pinOff",
561
+ "dupGroup": "t_j5va_dupGroup",
562
+ "customKeyInput": "t_j5va_customKeyInput",
563
+ "bulkCount": "t_j5va_bulkCount",
564
+ "pinStar": "t_j5va_pinStar",
569
565
  "reportLine": "t_j5va_reportLine",
570
- "importList": "t_j5va_importList",
571
- "list": "t_j5va_list",
566
+ "pwBar": "t_j5va_pwBar",
567
+ "attachAdd": "t_j5va_attachAdd",
568
+ "actionGroup": "t_j5va_actionGroup",
569
+ "gridDetail": "t_j5va_gridDetail",
570
+ "genHistItem": "t_j5va_genHistItem",
571
+ "reportBox": "t_j5va_reportBox",
572
+ "actionPrimary": "t_j5va_actionPrimary",
573
+ "emptyHint": "t_j5va_emptyHint",
572
574
  "pwHistRow": "t_j5va_pwHistRow",
573
- "modeAsk": "t_j5va_modeAsk",
574
- "customFieldRows": "t_j5va_customFieldRows",
575
- "identity": "t_j5va_identity",
575
+ "retryButton": "t_j5va_retryButton",
576
+ "section": "t_j5va_section",
577
+ "highBadge": "t_j5va_highBadge",
578
+ "secretField": "t_j5va_secretField",
579
+ "pwStrong": "t_j5va_pwStrong",
576
580
  "kindFilter": "t_j5va_kindFilter",
577
- "actionBtn": "t_j5va_actionBtn",
578
- "lenChips": "t_j5va_lenChips",
579
- "emptyBox": "t_j5va_emptyBox",
580
- "auditChip": "t_j5va_auditChip",
581
- "lockedBanner": "t_j5va_lockedBanner",
582
- "rowDue": "t_j5va_rowDue",
583
581
  "histNeutral": "t_j5va_histNeutral",
582
+ "gridRow": "t_j5va_gridRow",
583
+ "inlineField": "t_j5va_inlineField",
584
+ "genOpts": "t_j5va_genOpts",
585
+ "histUpdate": "t_j5va_histUpdate",
586
+ "actionGroups": "t_j5va_actionGroups",
587
+ "listCompact": "t_j5va_listCompact",
588
+ "editorBody": "t_j5va_editorBody",
589
+ "healthBar": "t_j5va_healthBar",
584
590
  "hit": "t_j5va_hit",
591
+ "vaultManageRow": "t_j5va_vaultManageRow",
592
+ "healthSummary": "t_j5va_healthSummary",
593
+ "badgeDanger": "t_j5va_badgeDanger",
594
+ "tabPane": "t_j5va_tabPane",
595
+ "favActive": "t_j5va_favActive",
596
+ "moreMenu": "t_j5va_moreMenu",
597
+ "tabActive": "t_j5va_tabActive",
585
598
  "uriCode": "t_j5va_uriCode",
586
- "attachAdd": "t_j5va_attachAdd",
587
- "kindIcon": "t_j5va_kindIcon",
588
- "copied": "t_j5va_copied",
599
+ "lenChipActive": "t_j5va_lenChipActive",
600
+ "kindChipActive": "t_j5va_kindChipActive",
601
+ "vaultSwitch": "t_j5va_vaultSwitch",
602
+ "gridName": "t_j5va_gridName",
603
+ "gridInput": "t_j5va_gridInput",
604
+ "recentLabel": "t_j5va_recentLabel",
605
+ "recentClear": "t_j5va_recentClear",
606
+ "kindChip": "t_j5va_kindChip",
607
+ "headerMessage": "t_j5va_headerMessage",
608
+ "badgeWarn": "t_j5va_badgeWarn",
609
+ "detailActions": "t_j5va_detailActions",
610
+ "modeReadonly": "t_j5va_modeReadonly",
611
+ "colorSwatch": "t_j5va_colorSwatch",
612
+ "auditWhen": "t_j5va_auditWhen",
613
+ "histAdd": "t_j5va_histAdd",
614
+ "rowActions": "t_j5va_rowActions",
615
+ "selectActive": "t_j5va_selectActive",
616
+ "reportSub": "t_j5va_reportSub",
617
+ "dupNames": "t_j5va_dupNames",
618
+ "checkField": "t_j5va_checkField",
619
+ "intro": "t_j5va_intro",
620
+ "rowMain": "t_j5va_rowMain",
621
+ "list": "t_j5va_list",
589
622
  "totpRing": "t_j5va_totpRing",
590
- "policyField": "t_j5va_policyField",
591
- "dupMerge": "t_j5va_dupMerge",
592
- "reportLineLink": "t_j5va_reportLineLink",
623
+ "sortButton": "t_j5va_sortButton",
624
+ "lenChips": "t_j5va_lenChips",
625
+ "histLink": "t_j5va_histLink",
626
+ "modeAsk": "t_j5va_modeAsk",
627
+ "detailRemain": "t_j5va_detailRemain",
628
+ "pwHistPwd": "t_j5va_pwHistPwd",
629
+ "srOnly": "t_j5va_srOnly",
630
+ "auditIssues": "t_j5va_auditIssues",
631
+ "badgeBtn": "t_j5va_badgeBtn",
632
+ "gridActions": "t_j5va_gridActions",
633
+ "copyAllBtn": "t_j5va_copyAllBtn",
634
+ "detailBox": "t_j5va_detailBox",
635
+ "saveButton": "t_j5va_saveButton",
593
636
  "pwHistBox": "t_j5va_pwHistBox",
594
- "intro": "t_j5va_intro",
595
- "vaultHeader": "t_j5va_vaultHeader",
596
- "reportTitle": "t_j5va_reportTitle",
597
- "detailItem": "t_j5va_detailItem",
598
- "clearButton": "t_j5va_clearButton",
599
- "exportChips": "t_j5va_exportChips",
600
- "actionGroup": "t_j5va_actionGroup",
637
+ "rowCheck": "t_j5va_rowCheck",
638
+ "tabs": "t_j5va_tabs",
639
+ "emptyBox": "t_j5va_emptyBox",
640
+ "tab": "t_j5va_tab",
601
641
  "inlineInput": "t_j5va_inlineInput",
602
- "addButton": "t_j5va_addButton",
603
- "dueBadge": "t_j5va_dueBadge",
604
- "emojiPicker": "t_j5va_emojiPicker",
605
- "recentChip": "t_j5va_recentChip",
606
- "actionPrimary": "t_j5va_actionPrimary",
607
- "listCompact": "t_j5va_listCompact",
608
- "customFieldRow": "t_j5va_customFieldRow",
609
- "gridDetail": "t_j5va_gridDetail",
610
- "checkField": "t_j5va_checkField",
611
- "copyAllBtn": "t_j5va_copyAllBtn",
612
- "pwBar": "t_j5va_pwBar",
613
- "pwHistPwd": "t_j5va_pwHistPwd",
614
- "moreMenu": "t_j5va_moreMenu",
615
- "highBadge": "t_j5va_highBadge",
616
- "pwStrong": "t_j5va_pwStrong",
617
- "importRow": "t_j5va_importRow",
618
- "colorSwatch": "t_j5va_colorSwatch",
619
- "toolbarMain": "t_j5va_toolbarMain",
620
- "empty": "t_j5va_empty",
642
+ "customValueInput": "t_j5va_customValueInput",
643
+ "bulkBar": "t_j5va_bulkBar",
644
+ "moreButton": "t_j5va_moreButton",
645
+ "modeAuto": "t_j5va_modeAuto",
646
+ "auditChips": "t_j5va_auditChips",
647
+ "totpCopy": "t_j5va_totpCopy",
648
+ "auditRow": "t_j5va_auditRow",
649
+ "detailCode": "t_j5va_detailCode",
650
+ "riskWarn": "t_j5va_riskWarn",
651
+ "recentSearch": "t_j5va_recentSearch",
621
652
  "colorPalette": "t_j5va_colorPalette",
622
- "toolbarDivider": "t_j5va_toolbarDivider",
623
- "detailActions": "t_j5va_detailActions",
624
- "section": "t_j5va_section",
625
- "urlGlyph": "t_j5va_urlGlyph",
626
- "resultCount": "t_j5va_resultCount",
627
- "pinOn": "t_j5va_pinOn",
628
653
  "badgeLink": "t_j5va_badgeLink",
629
- "histLink": "t_j5va_histLink",
630
- "saveButton": "t_j5va_saveButton",
631
- "moreButton": "t_j5va_moreButton",
654
+ "exportChips": "t_j5va_exportChips",
655
+ "pwFair": "t_j5va_pwFair",
656
+ "vaultHeader": "t_j5va_vaultHeader",
657
+ "pwMeter": "t_j5va_pwMeter",
658
+ "riskBanner": "t_j5va_riskBanner",
632
659
  "deleteButton": "t_j5va_deleteButton",
633
- "editor": "t_j5va_editor",
634
- "totpCopy": "t_j5va_totpCopy",
635
- "editorBody": "t_j5va_editorBody",
636
- "badgeOk": "t_j5va_badgeOk",
637
- "genOptRow": "t_j5va_genOptRow",
638
- "kindChip": "t_j5va_kindChip",
639
- "vaultTarget": "t_j5va_vaultTarget",
640
- "rowExpired": "t_j5va_rowExpired",
641
- "tagRow": "t_j5va_tagRow",
642
- "inlineField": "t_j5va_inlineField",
660
+ "brandGlyphSm": "t_j5va_brandGlyphSm",
661
+ "lenChip": "t_j5va_lenChip",
643
662
  "totp": "t_j5va_totp",
663
+ "reportTitle": "t_j5va_reportTitle",
664
+ "lockedBanner": "t_j5va_lockedBanner",
665
+ "empty": "t_j5va_empty",
666
+ "urlGlyph": "t_j5va_urlGlyph",
667
+ "iconFieldWrap": "t_j5va_iconFieldWrap",
668
+ "tagRow": "t_j5va_tagRow",
669
+ "searchKbd": "t_j5va_searchKbd",
670
+ "error": "t_j5va_error",
671
+ "tagName": "t_j5va_tagName",
672
+ "backupButton": "t_j5va_backupButton",
644
673
  "badgeActive": "t_j5va_badgeActive",
645
- "moreWrap": "t_j5va_moreWrap",
646
- "bulkBar": "t_j5va_bulkBar",
647
- "modeReadonly": "t_j5va_modeReadonly",
648
- "colorFieldWrap": "t_j5va_colorFieldWrap",
649
- "rowSelected": "t_j5va_rowSelected",
650
- "rowActions": "t_j5va_rowActions",
674
+ "histDanger": "t_j5va_histDanger",
675
+ "importName": "t_j5va_importName",
651
676
  "dangerButton": "t_j5va_dangerButton",
652
- "toolbar": "t_j5va_toolbar",
653
- "badgeDanger": "t_j5va_badgeDanger",
654
- "brandGlyphSm": "t_j5va_brandGlyphSm",
655
- "reportSub": "t_j5va_reportSub",
656
- "tagActions": "t_j5va_tagActions",
657
- "recentClear": "t_j5va_recentClear",
658
- "gridName": "t_j5va_gridName",
659
- "healthSummary": "t_j5va_healthSummary",
660
- "detailTotp": "t_j5va_detailTotp",
661
- "policyBar": "t_j5va_policyBar",
662
- "vaultManageRow": "t_j5va_vaultManageRow",
663
- "gridInput": "t_j5va_gridInput",
664
- "dupNames": "t_j5va_dupNames",
665
- "actionGroupLabel": "t_j5va_actionGroupLabel",
666
- "badgeWarn": "t_j5va_badgeWarn",
667
- "detailBox": "t_j5va_detailBox",
668
- "error": "t_j5va_error",
669
- "riskBanner": "t_j5va_riskBanner",
670
- "tab": "t_j5va_tab",
671
677
  "lockedTag": "t_j5va_lockedTag",
672
- "gridRow": "t_j5va_gridRow",
673
- "recentLabel": "t_j5va_recentLabel",
674
- "histUpdate": "t_j5va_histUpdate",
675
- "riskDanger": "t_j5va_riskDanger",
676
- "modeAuto": "t_j5va_modeAuto",
677
- "favActive": "t_j5va_favActive",
678
- "emojiBtn": "t_j5va_emojiBtn",
679
- "tagManagerHead": "t_j5va_tagManagerHead",
680
- "customEq": "t_j5va_customEq",
681
- "row": "t_j5va_row",
682
- "actionGroups": "t_j5va_actionGroups"
678
+ "editor": "t_j5va_editor",
679
+ "colorFieldWrap": "t_j5va_colorFieldWrap",
680
+ "vaultTarget": "t_j5va_vaultTarget",
681
+ "reportJump": "t_j5va_reportJump",
682
+ "toolbarDivider": "t_j5va_toolbarDivider"
683
683
  };
684
684
  //#endregion
685
685
  //#region src/client/VaultSection.tsx
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "dsh-vault",
3
- "version": "1.10.64",
3
+ "version": "1.10.66",
4
4
  "bin": {
5
5
  "dsh-vault": "./lib/cli.js"
6
6
  },
@@ -77,7 +77,7 @@
77
77
  },
78
78
  "scripts": {
79
79
  "build": "npm run build:host && npm run build:client",
80
- "build:host": "tsc -p tsconfig.host.json && node -e \"require('node:fs').chmodSync('lib/cli.js', 0o755)\"",
80
+ "build:host": "tsc -p tsconfig.host.json && node -e \"require('node:fs').chmodSync('lib/cli.js', 0o755)\" && node lib/cli.js --version > /dev/null && echo \"host build ok (cli starts)\"",
81
81
  "build:client": "tsdown",
82
82
  "vault": "node lib/cli.js",
83
83
  "prepare": "npm run build",