dsh-vault 1.10.66 → 1.10.68

package/README-zh.md

@@ -228,10 +228,25 @@ echo "$DEMO_API_KEY"
   "no entries are tagged for environment export";先在 UI 里给条目的标签加上 `env`,或让助手执行 `vault_update { id, tags: ["env"] }`。
 - 名字默认由标题 + 字段推导(`DASHSCOPE` + `apiKey` → `DASHSCOPE_API_KEY`);想固定名字就在条目的 `envKeys` 里指定 —— 见[环境变量导出](#环境变量导出)。
 
+
+**命名 —— 只有三个,其中两个故意都叫 `env`:**
+
+| 名字 | 是什么 | 含义 |
+|---|---|---|
+| `env` | 条目的**标签** | 决定哪些条目会被 `dsh-vault env` 导出;不打标签就不导出 |
+| `env` | **命令** | 打印带该标签的条目 |
+| `envKeys` | 条目的**字段**(可选) | 固定确切名字,例如 `["DASHSCOPE_API_KEY"]`;旧的单数写法 `envKey` 仍作为"只写一个"的简写接受 |
+
+除此之外没有任何叫 `env*` 的东西:`list --json` / `show` 只报 `envKeys`(该条目会导出的名字,也就是 `get` 接受的名字)与 `envTagged`(是否被 `env` 包含)。
+
 ### 2. 有哪些命令
 
 ```sh
-dsh-vault list                             # id、类型、标题、导出的变量名,绝不含密钥
+dsh-vault list                             # 分组显示:哪些会被 env 导出、哪些不会
+#   Exported by `env` (tag "env") — 1 entry:
+#     a1b2c3d4-…  api-key   DASHSCOPE        → DASHSCOPE_API_KEY
+#   Not exported (no "env" tag) — 1 entry; `get <name>` still works for it:
+#     9f8e7d6c-…  api-key   Example Billing  → EXAMPLE_BILLING_API_KEY
 dsh-vault get my-entry                     # 取该条目的主密钥,仅 stdout
 dsh-vault get my-entry --field apiKey      # 取指定字段
 dsh-vault get my-entry --mask              # 只确认存在,不打印值
@@ -263,7 +278,7 @@ dsh-vault export-env .env && set -a && . ./.env && set +a
 
 ### 4. 主密码
 
-依次取 `--password-stdin` → `$DSH_VAULT_MASTER_PASSWORD`(或 `$DSH_VAULT_PASSWORD`)→ 交互式提示;它**不会**去读插件配置文件里的密码,所以 CLI 既不依赖、也不会泄露 profile patch 里那份:
+依次取 `--password-stdin` → `$DSH_VAULT_MASTER_PASSWORD`(或 `$DSH_VAULT_PASSWORD`)→ 交互式提示(**输入不回显**,终端会切到 raw mode;`tests/e2e/cli-prompt.mjs` 会验证这一点);它**不会**去读插件配置文件里的密码,所以 CLI 既不依赖、也不会泄露 profile patch 里那份:
 
 ```sh
 DSH_VAULT_MASTER_PASSWORD=… pnpm vault list

package/README.md

@@ -243,10 +243,26 @@ Two things worth knowing:
   `DASHSCOPE_API_KEY`) unless the entry sets `envKeys` — see
   [Environment export](#environment-export).
 
+
+**Names — there are only three, and two of them are the word `env` on purpose:**
+
+| name | what it is | meaning |
+|---|---|---|
+| `env` | an entry **tag** | which entries `dsh-vault env` exports; nothing is exported without it |
+| `env` | the **command** | prints exactly the entries carrying that tag |
+| `envKeys` | an entry **field** (optional) | pin exact names, e.g. `["DASHSCOPE_API_KEY"]`; the old singular `envKey` is accepted as a one-element shorthand |
+
+Nothing else is called `env*`: `list --json` / `show` report `envKeys` (the names
+an entry exports — what `get` accepts) and `envTagged` (whether `env` includes it).
+
 ### 2. The commands
 
 ```sh
-dsh-vault list                             # id, kind, title, exported env name — never secrets
+dsh-vault list                             # grouped: what `env` exports vs the rest
+#   Exported by `env` (tag "env") — 1 entry:
+#     a1b2c3d4-…  api-key   DASHSCOPE        → DASHSCOPE_API_KEY
+#   Not exported (no "env" tag) — 1 entry; `get <name>` still works for it:
+#     9f8e7d6c-…  api-key   Example Billing  → EXAMPLE_BILLING_API_KEY
 dsh-vault get my-entry                     # the entry's primary secret, stdout only
 dsh-vault get my-entry --field apiKey      # one named field
 dsh-vault get my-entry --mask              # confirm it exists without printing it
@@ -284,7 +300,8 @@ dsh-vault export-env .env && set -a && . ./.env && set +a
 ### 4. The master password
 
 `--password-stdin`, then `$DSH_VAULT_MASTER_PASSWORD` (or `$DSH_VAULT_PASSWORD`),
-then an interactive prompt. It is **not** read from the plugin's config file, so
+then an interactive prompt that **hides what you type** (the terminal is switched
+to raw mode; verify with `tests/e2e/cli-prompt.mjs`). It is **not** read from the plugin's config file, so
 the CLI never depends on (or leaks) whatever the profile patch holds:
 
 ```sh

package/lib/cli.js

@@ -17,11 +17,12 @@
  * The core is `runCli(argv, io)`, which tests drive directly without spawning.
  */
 import { chmod, mkdir, writeFile } from 'node:fs/promises';
-import { existsSync, realpathSync } from 'node:fs';
+import { existsSync, openSync, realpathSync, writeSync } from 'node:fs';
 import { createRequire } from 'node:module';
 import { dirname, resolve } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { createInterface } from 'node:readline';
+import { ReadStream } from 'node:tty';
 import { openVault, defaultVaultPath } from "./store.js";
 import { envLinesFor, envPairsForEntry, maskSecret, primarySecret } from "./env-export.js";
 function packageVersion() {
@@ -64,6 +65,10 @@ list options:
                           the count of further keys in parentheses, and [env]
                           when the entry is included in "dsh-vault env")
 
+JSON output ("list --json", "show") reports per entry:
+  envKeys                 the env names it exports (what "get" accepts)
+  envTagged               whether "dsh-vault env" includes it
+
 get options:
   --field <name>          apiKey | secret | accessToken | refreshToken | privateKey
                           | password | cardNumber | username | url | fields.<custom>
@@ -152,50 +157,63 @@ export function resolveCliVaultPath(parsed, env) {
 }
 /** Interactive prompt with echo off, read from the terminal rather than stdin. */
 async function promptHidden(prompt) {
-    const { open } = await import('node:fs/promises');
-    let handle;
+    // The terminal echoes what you type unless it is switched to raw mode: the
+    // first version of this opened /dev/tty but left echo on, so the master
+    // password appeared in clear text. Raw mode also means we handle Enter,
+    // backspace and Ctrl-C ourselves (below).
+    let fd;
     try {
-        handle = await open('/dev/tty', 'r+');
+        fd = openSync('/dev/tty', 'r+');
     }
     catch {
+        // No controlling terminal (piped input): read a plain line from stdin.
         const rl = createInterface({ input: process.stdin, output: process.stderr });
         const answer = await new Promise(res => rl.question(prompt, res));
         rl.close();
         return answer;
     }
-    const reader = handle.createReadStream();
-    const writer = handle.createWriteStream();
-    writer.write(prompt);
-    reader.setEncoding('utf8');
-    return await new Promise((res, rej) => {
-        let value = '';
-        const finish = (result) => {
-            reader.destroy();
-            void handle?.close();
-            res(result);
-        };
-        reader.on('data', (chunk) => {
-            for (const ch of String(chunk)) {
-                if (ch === '\n' || ch === '\r') {
-                    writer.write('\n');
-                    finish(value);
-                    return;
-                }
-                if (ch === '\u0003') {
-                    reader.destroy();
-                    void handle?.close();
-                    rej(new Error('aborted'));
-                    return;
-                }
-                if (ch === '\u007f' || ch === '\b') {
-                    value = value.slice(0, -1);
-                    continue;
+    const input = new ReadStream(fd);
+    input.setRawMode(true);
+    input.setEncoding('utf8');
+    writeSync(fd, prompt);
+    try {
+        return await new Promise((resolve, reject) => {
+            let value = '';
+            const finish = (result) => {
+                writeSync(fd, '\n');
+                resolve(result);
+            };
+            input.on('data', (chunk) => {
+                for (const ch of String(chunk)) {
+                    if (ch === '\n' || ch === '\r') {
+                        finish(value);
+                        return;
+                    }
+                    if (ch === '\u0003') { // Ctrl-C
+                        writeSync(fd, '\n');
+                        reject(new Error('aborted'));
+                        return;
+                    }
+                    if (ch === '\u007f' || ch === '\b') {
+                        value = value.slice(0, -1);
+                        continue;
+                    }
+                    if (ch === '\u0015') {
+                        value = '';
+                        continue;
+                    } // Ctrl-U clears the line
+                    if (ch < ' ')
+                        continue; // ignore other control characters
+                    value += ch;
                 }
-                value += ch;
-            }
+            });
+            input.on('error', err => reject(err instanceof Error ? err : new Error(String(err))));
         });
-        reader.on('error', rej);
-    });
+    }
+    finally {
+        input.setRawMode(false);
+        input.destroy(); // owns the fd
+    }
 }
 async function readStdinLine() {
     const rl = createInterface({ input: process.stdin });
@@ -304,13 +322,12 @@ function publicFields(entry) {
             out[key] = value;
     }
     out.hasSecret = primarySecret(entry) !== undefined;
-    // Every env name this entry would export, and whether it is actually
-    // included in `dsh-vault env` (the tag decides that).
-    // `envKeys` is what the user configured; `exportedKeys` is what the entry
-    // will actually emit (and what `get` accepts). Keeping them apart is the
-    // whole point — they used to be one confusingly-similar pair of names.
-    out.envKeys = Array.isArray(entry.envKeys) ? entry.envKeys : (entry.envKey !== undefined ? [entry.envKey] : []);
-    out.exportedKeys = envPairsForEntry(entry).map(pair => pair.key);
+    // ONE name for "the env names this entry exports": `envKeys`. It used to be a
+    // configured `envKeys` plus a computed `exportedKeys`, which read as two
+    // similar things — the computed list is the useful one (it already starts with
+    // whatever was pinned), so only that is reported.
+    out.envKeys = envPairsForEntry(entry).map(pair => pair.key);
+    // Whether `dsh-vault env` includes this entry (the tag decides).
     out.envTagged = (entry.tags ?? []).includes('env');
     return out;
 }
@@ -384,18 +401,33 @@ export async function runCli(argv, io) {
                 io.out(`${JSON.stringify(entries.map(publicFields), null, 2)}\n`);
                 return 0;
             }
-            for (const entry of entries) {
+            // Group by what `env` actually does, because a bare `→ NAME` column used
+            // to read as "this is exported" for every entry: the name is only
+            // POTENTIAL until the entry carries the tag.
+            const line = (entry) => {
                 const identity = [entry.username, entry.host, entry.url]
                     .filter((v) => typeof v === 'string' && v.length > 0).join(' · ');
-                // Show the env name `get`/`env` would use, so a script author can copy
-                // it straight out of the listing (plus how many more keys follow).
                 const keys = envPairsForEntry(entry).map(pair => pair.key);
-                const envSuffix = keys.length > 0
-                    ? `  → ${keys[0]}${keys.length > 1 ? ` (+${keys.length - 1})` : ''}`
-                    : '';
-                const tagged = (entry.tags ?? []).includes('env') ? '  [env]' : '';
-                io.out(`${entry.id}  ${(entry.kind ?? 'login').padEnd(8)}  ${entry.title}`
-                    + `${identity.length > 0 ? `  (${identity})` : ''}${envSuffix}${tagged}\n`);
+                const suffix = keys.length > 0 ? `  → ${keys[0]}${keys.length > 1 ? ` (+${keys.length - 1})` : ''}` : '';
+                return `${entry.id}  ${(entry.kind ?? 'login').padEnd(8)}  ${entry.title}`
+                    + `${identity.length > 0 ? `  (${identity})` : ''}${suffix}`;
+            };
+            const tagged = entries.filter(entry => (entry.tags ?? []).includes('env'));
+            const untagged = entries.filter(entry => !(entry.tags ?? []).includes('env'));
+            if (tagged.length > 0) {
+                io.out(`Exported by \`env\` (tag "env") — ${tagged.length} ${tagged.length === 1 ? 'entry' : 'entries'}:\n`);
+                for (const entry of tagged)
+                    io.out(`  ${line(entry)}\n`);
+            }
+            else {
+                io.out('Exported by `env` (tag "env"): none.\n');
+                io.out('  `env` prints only tagged entries; add the tag to one (UI: the entry\'s tags field)\n');
+                io.out('  or ask the assistant: vault_update { id, tags: ["env"] }.\n');
+            }
+            if (untagged.length > 0) {
+                io.out(`\nNot exported (no "env" tag) — ${untagged.length} ${untagged.length === 1 ? 'entry' : 'entries'}; \`get <name>\` still works for them:\n`);
+                for (const entry of untagged)
+                    io.out(`  ${line(entry)}\n`);
             }
             return 0;
         }

package/lib/client.js

@@ -495,191 +495,191 @@ window.__ModuleLoader__.load({
 			document.head.appendChild(tag);
 		}
 		var VaultSection_module_css_default = {
-			"actionGroupLabel": "t_j5va_actionGroupLabel",
-			"moreWrap": "t_j5va_moreWrap",
-			"tagManager": "t_j5va_tagManager",
-			"editorActions": "t_j5va_editorActions",
-			"customEq": "t_j5va_customEq",
-			"reportLineLink": "t_j5va_reportLineLink",
-			"dupMerge": "t_j5va_dupMerge",
-			"bulkItem": "t_j5va_bulkItem",
-			"auditChip": "t_j5va_auditChip",
-			"trashButton": "t_j5va_trashButton",
-			"pwLabel": "t_j5va_pwLabel",
-			"rowSelected": "t_j5va_rowSelected",
-			"tagManagerHead": "t_j5va_tagManagerHead",
-			"pinOff": "t_j5va_pinOff",
-			"auditChipActive": "t_j5va_auditChipActive",
-			"detailTotp": "t_j5va_detailTotp",
-			"detailItem": "t_j5va_detailItem",
-			"customFieldRows": "t_j5va_customFieldRows",
-			"toolbarMain": "t_j5va_toolbarMain",
-			"searchBox": "t_j5va_searchBox",
-			"resultCount": "t_j5va_resultCount",
-			"pinOn": "t_j5va_pinOn",
-			"copied": "t_j5va_copied",
-			"addButton": "t_j5va_addButton",
-			"kindIcon": "t_j5va_kindIcon",
-			"badge": "t_j5va_badge",
-			"genHist": "t_j5va_genHist",
-			"emojiPicker": "t_j5va_emojiPicker",
-			"tagCount": "t_j5va_tagCount",
-			"badgeOk": "t_j5va_badgeOk",
-			"dueBadge": "t_j5va_dueBadge",
-			"exportChip": "t_j5va_exportChip",
-			"status": "t_j5va_status",
-			"favToggle": "t_j5va_favToggle",
-			"importRow": "t_j5va_importRow",
-			"importActions": "t_j5va_importActions",
-			"detailDeleteBtn": "t_j5va_detailDeleteBtn",
-			"policyBar": "t_j5va_policyBar",
-			"importList": "t_j5va_importList",
-			"rowExpired": "t_j5va_rowExpired",
-			"toolbar": "t_j5va_toolbar",
-			"rowDue": "t_j5va_rowDue",
+			"reportLine": "t_j5va_reportLine",
 			"genOptRow": "t_j5va_genOptRow",
-			"revealButton": "t_j5va_revealButton",
-			"attachBox": "t_j5va_attachBox",
-			"toolbarFilters": "t_j5va_toolbarFilters",
-			"recentChip": "t_j5va_recentChip",
-			"actionBtn": "t_j5va_actionBtn",
-			"importDesc": "t_j5va_importDesc",
-			"field": "t_j5va_field",
+			"genHistItem": "t_j5va_genHistItem",
+			"healthBar": "t_j5va_healthBar",
 			"title": "t_j5va_title",
-			"identity": "t_j5va_identity",
+			"histDanger": "t_j5va_histDanger",
 			"policyField": "t_j5va_policyField",
-			"pwWeak": "t_j5va_pwWeak",
-			"brandGlyph": "t_j5va_brandGlyph",
-			"emojiBtn": "t_j5va_emojiBtn",
-			"pwHistTime": "t_j5va_pwHistTime",
-			"tagActions": "t_j5va_tagActions",
-			"clearButton": "t_j5va_clearButton",
-			"riskDanger": "t_j5va_riskDanger",
-			"customFieldRow": "t_j5va_customFieldRow",
-			"row": "t_j5va_row",
-			"scoreRing": "t_j5va_scoreRing",
-			"dupGroup": "t_j5va_dupGroup",
-			"customKeyInput": "t_j5va_customKeyInput",
-			"bulkCount": "t_j5va_bulkCount",
 			"pinStar": "t_j5va_pinStar",
-			"reportLine": "t_j5va_reportLine",
-			"pwBar": "t_j5va_pwBar",
-			"attachAdd": "t_j5va_attachAdd",
-			"actionGroup": "t_j5va_actionGroup",
-			"gridDetail": "t_j5va_gridDetail",
-			"genHistItem": "t_j5va_genHistItem",
-			"reportBox": "t_j5va_reportBox",
-			"actionPrimary": "t_j5va_actionPrimary",
-			"emptyHint": "t_j5va_emptyHint",
-			"pwHistRow": "t_j5va_pwHistRow",
+			"moreMenu": "t_j5va_moreMenu",
 			"retryButton": "t_j5va_retryButton",
+			"iconFieldWrap": "t_j5va_iconFieldWrap",
+			"dupNames": "t_j5va_dupNames",
+			"badgeLink": "t_j5va_badgeLink",
+			"totpCopy": "t_j5va_totpCopy",
+			"customFieldRows": "t_j5va_customFieldRows",
+			"detailActions": "t_j5va_detailActions",
+			"pwHistBox": "t_j5va_pwHistBox",
+			"importRow": "t_j5va_importRow",
+			"riskBanner": "t_j5va_riskBanner",
+			"recentClear": "t_j5va_recentClear",
+			"toolbarFilters": "t_j5va_toolbarFilters",
+			"detailDeleteBtn": "t_j5va_detailDeleteBtn",
+			"lenChipActive": "t_j5va_lenChipActive",
+			"editorBody": "t_j5va_editorBody",
+			"kindChip": "t_j5va_kindChip",
 			"section": "t_j5va_section",
-			"highBadge": "t_j5va_highBadge",
+			"checkField": "t_j5va_checkField",
 			"secretField": "t_j5va_secretField",
-			"pwStrong": "t_j5va_pwStrong",
-			"kindFilter": "t_j5va_kindFilter",
-			"histNeutral": "t_j5va_histNeutral",
-			"gridRow": "t_j5va_gridRow",
-			"inlineField": "t_j5va_inlineField",
+			"brandGlyph": "t_j5va_brandGlyph",
+			"urlGlyph": "t_j5va_urlGlyph",
+			"bulkBar": "t_j5va_bulkBar",
+			"reportJump": "t_j5va_reportJump",
+			"auditIssues": "t_j5va_auditIssues",
 			"genOpts": "t_j5va_genOpts",
-			"histUpdate": "t_j5va_histUpdate",
+			"pwWeak": "t_j5va_pwWeak",
+			"colorFieldWrap": "t_j5va_colorFieldWrap",
 			"actionGroups": "t_j5va_actionGroups",
-			"listCompact": "t_j5va_listCompact",
-			"editorBody": "t_j5va_editorBody",
-			"healthBar": "t_j5va_healthBar",
-			"hit": "t_j5va_hit",
-			"vaultManageRow": "t_j5va_vaultManageRow",
-			"healthSummary": "t_j5va_healthSummary",
-			"badgeDanger": "t_j5va_badgeDanger",
-			"tabPane": "t_j5va_tabPane",
-			"favActive": "t_j5va_favActive",
-			"moreMenu": "t_j5va_moreMenu",
-			"tabActive": "t_j5va_tabActive",
-			"uriCode": "t_j5va_uriCode",
-			"lenChipActive": "t_j5va_lenChipActive",
-			"kindChipActive": "t_j5va_kindChipActive",
-			"vaultSwitch": "t_j5va_vaultSwitch",
+			"inlineField": "t_j5va_inlineField",
+			"totpRing": "t_j5va_totpRing",
+			"inlineInput": "t_j5va_inlineInput",
+			"vaultTarget": "t_j5va_vaultTarget",
+			"searchKbd": "t_j5va_searchKbd",
 			"gridName": "t_j5va_gridName",
-			"gridInput": "t_j5va_gridInput",
-			"recentLabel": "t_j5va_recentLabel",
-			"recentClear": "t_j5va_recentClear",
-			"kindChip": "t_j5va_kindChip",
-			"headerMessage": "t_j5va_headerMessage",
-			"badgeWarn": "t_j5va_badgeWarn",
-			"detailActions": "t_j5va_detailActions",
+			"kindIcon": "t_j5va_kindIcon",
+			"lenChip": "t_j5va_lenChip",
+			"tagManager": "t_j5va_tagManager",
+			"editorActions": "t_j5va_editorActions",
+			"error": "t_j5va_error",
+			"tabPane": "t_j5va_tabPane",
 			"modeReadonly": "t_j5va_modeReadonly",
-			"colorSwatch": "t_j5va_colorSwatch",
-			"auditWhen": "t_j5va_auditWhen",
-			"histAdd": "t_j5va_histAdd",
-			"rowActions": "t_j5va_rowActions",
-			"selectActive": "t_j5va_selectActive",
-			"reportSub": "t_j5va_reportSub",
-			"dupNames": "t_j5va_dupNames",
-			"checkField": "t_j5va_checkField",
+			"exportChips": "t_j5va_exportChips",
+			"actionBtn": "t_j5va_actionBtn",
+			"toolbarDivider": "t_j5va_toolbarDivider",
+			"pwHistPwd": "t_j5va_pwHistPwd",
 			"intro": "t_j5va_intro",
-			"rowMain": "t_j5va_rowMain",
-			"list": "t_j5va_list",
-			"totpRing": "t_j5va_totpRing",
-			"sortButton": "t_j5va_sortButton",
-			"lenChips": "t_j5va_lenChips",
+			"badgeDanger": "t_j5va_badgeDanger",
+			"importList": "t_j5va_importList",
+			"importName": "t_j5va_importName",
+			"actionGroup": "t_j5va_actionGroup",
+			"healthSummary": "t_j5va_healthSummary",
+			"importActions": "t_j5va_importActions",
 			"histLink": "t_j5va_histLink",
-			"modeAsk": "t_j5va_modeAsk",
-			"detailRemain": "t_j5va_detailRemain",
-			"pwHistPwd": "t_j5va_pwHistPwd",
-			"srOnly": "t_j5va_srOnly",
-			"auditIssues": "t_j5va_auditIssues",
+			"headerMessage": "t_j5va_headerMessage",
+			"attachBox": "t_j5va_attachBox",
+			"addButton": "t_j5va_addButton",
+			"rowActions": "t_j5va_rowActions",
+			"importDesc": "t_j5va_importDesc",
+			"pwHistRow": "t_j5va_pwHistRow",
+			"backupButton": "t_j5va_backupButton",
+			"pinOn": "t_j5va_pinOn",
+			"lenChips": "t_j5va_lenChips",
+			"tabs": "t_j5va_tabs",
+			"tagName": "t_j5va_tagName",
+			"recentChip": "t_j5va_recentChip",
+			"empty": "t_j5va_empty",
+			"tagCount": "t_j5va_tagCount",
+			"detailTotp": "t_j5va_detailTotp",
+			"identity": "t_j5va_identity",
+			"toolbar": "t_j5va_toolbar",
 			"badgeBtn": "t_j5va_badgeBtn",
-			"gridActions": "t_j5va_gridActions",
+			"dueBadge": "t_j5va_dueBadge",
+			"auditChip": "t_j5va_auditChip",
+			"customEq": "t_j5va_customEq",
+			"detailItem": "t_j5va_detailItem",
+			"scoreRing": "t_j5va_scoreRing",
+			"lockedTag": "t_j5va_lockedTag",
+			"list": "t_j5va_list",
+			"field": "t_j5va_field",
+			"clearButton": "t_j5va_clearButton",
+			"detailRemain": "t_j5va_detailRemain",
+			"tagManagerHead": "t_j5va_tagManagerHead",
+			"policyBar": "t_j5va_policyBar",
+			"favActive": "t_j5va_favActive",
+			"badgeWarn": "t_j5va_badgeWarn",
+			"editor": "t_j5va_editor",
+			"riskWarn": "t_j5va_riskWarn",
+			"badge": "t_j5va_badge",
+			"highBadge": "t_j5va_highBadge",
+			"exportChip": "t_j5va_exportChip",
+			"recentSearch": "t_j5va_recentSearch",
+			"gridDetail": "t_j5va_gridDetail",
+			"modeAuto": "t_j5va_modeAuto",
+			"tagActions": "t_j5va_tagActions",
+			"customValueInput": "t_j5va_customValueInput",
+			"reportSub": "t_j5va_reportSub",
 			"copyAllBtn": "t_j5va_copyAllBtn",
+			"customFieldRow": "t_j5va_customFieldRow",
 			"detailBox": "t_j5va_detailBox",
-			"saveButton": "t_j5va_saveButton",
-			"pwHistBox": "t_j5va_pwHistBox",
+			"modeAsk": "t_j5va_modeAsk",
+			"tagRow": "t_j5va_tagRow",
+			"customKeyInput": "t_j5va_customKeyInput",
+			"revealButton": "t_j5va_revealButton",
+			"reportLineLink": "t_j5va_reportLineLink",
+			"listCompact": "t_j5va_listCompact",
+			"moreWrap": "t_j5va_moreWrap",
+			"kindFilter": "t_j5va_kindFilter",
+			"colorPalette": "t_j5va_colorPalette",
+			"rowSelected": "t_j5va_rowSelected",
+			"rowDue": "t_j5va_rowDue",
+			"bulkItem": "t_j5va_bulkItem",
+			"selectActive": "t_j5va_selectActive",
 			"rowCheck": "t_j5va_rowCheck",
-			"tabs": "t_j5va_tabs",
+			"gridInput": "t_j5va_gridInput",
 			"emptyBox": "t_j5va_emptyBox",
-			"tab": "t_j5va_tab",
-			"inlineInput": "t_j5va_inlineInput",
-			"customValueInput": "t_j5va_customValueInput",
-			"bulkBar": "t_j5va_bulkBar",
-			"moreButton": "t_j5va_moreButton",
-			"modeAuto": "t_j5va_modeAuto",
-			"auditChips": "t_j5va_auditChips",
-			"totpCopy": "t_j5va_totpCopy",
-			"auditRow": "t_j5va_auditRow",
+			"dangerButton": "t_j5va_dangerButton",
+			"resultCount": "t_j5va_resultCount",
+			"uriCode": "t_j5va_uriCode",
+			"row": "t_j5va_row",
+			"sortButton": "t_j5va_sortButton",
+			"actionGroupLabel": "t_j5va_actionGroupLabel",
+			"gridActions": "t_j5va_gridActions",
+			"reportBox": "t_j5va_reportBox",
+			"hit": "t_j5va_hit",
 			"detailCode": "t_j5va_detailCode",
-			"riskWarn": "t_j5va_riskWarn",
-			"recentSearch": "t_j5va_recentSearch",
-			"colorPalette": "t_j5va_colorPalette",
-			"badgeLink": "t_j5va_badgeLink",
-			"exportChips": "t_j5va_exportChips",
+			"emojiPicker": "t_j5va_emojiPicker",
 			"pwFair": "t_j5va_pwFair",
-			"vaultHeader": "t_j5va_vaultHeader",
-			"pwMeter": "t_j5va_pwMeter",
-			"riskBanner": "t_j5va_riskBanner",
+			"tabActive": "t_j5va_tabActive",
+			"genHist": "t_j5va_genHist",
+			"actionPrimary": "t_j5va_actionPrimary",
+			"favToggle": "t_j5va_favToggle",
+			"badgeOk": "t_j5va_badgeOk",
 			"deleteButton": "t_j5va_deleteButton",
-			"brandGlyphSm": "t_j5va_brandGlyphSm",
-			"lenChip": "t_j5va_lenChip",
-			"totp": "t_j5va_totp",
+			"dupGroup": "t_j5va_dupGroup",
+			"attachAdd": "t_j5va_attachAdd",
+			"kindChipActive": "t_j5va_kindChipActive",
+			"tab": "t_j5va_tab",
+			"vaultSwitch": "t_j5va_vaultSwitch",
+			"pwStrong": "t_j5va_pwStrong",
 			"reportTitle": "t_j5va_reportTitle",
+			"saveButton": "t_j5va_saveButton",
 			"lockedBanner": "t_j5va_lockedBanner",
-			"empty": "t_j5va_empty",
-			"urlGlyph": "t_j5va_urlGlyph",
-			"iconFieldWrap": "t_j5va_iconFieldWrap",
-			"tagRow": "t_j5va_tagRow",
-			"searchKbd": "t_j5va_searchKbd",
-			"error": "t_j5va_error",
-			"tagName": "t_j5va_tagName",
-			"backupButton": "t_j5va_backupButton",
-			"badgeActive": "t_j5va_badgeActive",
-			"histDanger": "t_j5va_histDanger",
-			"importName": "t_j5va_importName",
-			"dangerButton": "t_j5va_dangerButton",
-			"lockedTag": "t_j5va_lockedTag",
-			"editor": "t_j5va_editor",
-			"colorFieldWrap": "t_j5va_colorFieldWrap",
-			"vaultTarget": "t_j5va_vaultTarget",
-			"reportJump": "t_j5va_reportJump",
-			"toolbarDivider": "t_j5va_toolbarDivider"
+			"auditChips": "t_j5va_auditChips",
+			"pwMeter": "t_j5va_pwMeter",
+			"emptyHint": "t_j5va_emptyHint",
+			"brandGlyphSm": "t_j5va_brandGlyphSm",
+			"recentLabel": "t_j5va_recentLabel",
+			"trashButton": "t_j5va_trashButton",
+			"vaultManageRow": "t_j5va_vaultManageRow",
+			"rowExpired": "t_j5va_rowExpired",
+			"histUpdate": "t_j5va_histUpdate",
+			"auditChipActive": "t_j5va_auditChipActive",
+			"pwBar": "t_j5va_pwBar",
+			"vaultHeader": "t_j5va_vaultHeader",
+			"rowMain": "t_j5va_rowMain",
+			"copied": "t_j5va_copied",
+			"riskDanger": "t_j5va_riskDanger",
+			"histNeutral": "t_j5va_histNeutral",
+			"status": "t_j5va_status",
+			"searchBox": "t_j5va_searchBox",
+			"auditRow": "t_j5va_auditRow",
+			"totp": "t_j5va_totp",
+			"colorSwatch": "t_j5va_colorSwatch",
+			"gridRow": "t_j5va_gridRow",
+			"moreButton": "t_j5va_moreButton",
+			"bulkCount": "t_j5va_bulkCount",
+			"pinOff": "t_j5va_pinOff",
+			"pwLabel": "t_j5va_pwLabel",
+			"pwHistTime": "t_j5va_pwHistTime",
+			"srOnly": "t_j5va_srOnly",
+			"dupMerge": "t_j5va_dupMerge",
+			"emojiBtn": "t_j5va_emojiBtn",
+			"toolbarMain": "t_j5va_toolbarMain",
+			"histAdd": "t_j5va_histAdd",
+			"auditWhen": "t_j5va_auditWhen",
+			"badgeActive": "t_j5va_badgeActive"
 		};
 		//#endregion
 		//#region src/client/VaultSection.tsx

package/lib/index.js

@@ -4549,7 +4549,7 @@ export async function apply(ctx, config) {
                     const m = /^(.*)\.json$/.exec(entry);
                     if (!m)
                         continue;
-                    if (['access', 'meta'].includes(m[1]) || m[1].startsWith('vault-export-') || isBackupFile(entry))
+                    if (isNonVaultFile(m[1]) || isBackupFile(entry))
                         continue;
                     names.push(m[1]);
                 }
@@ -4594,7 +4594,7 @@ export async function apply(ctx, config) {
                     const m = /^(.*)\.json$/.exec(entry);
                     if (!m)
                         continue;
-                    if (['access', 'meta'].includes(m[1]) || m[1].startsWith('vault-export-') || isBackupFile(entry))
+                    if (isNonVaultFile(m[1]) || isBackupFile(entry))
                         continue;
                     names.push(m[1]);
                 }
@@ -6611,9 +6611,12 @@ function resolveVaultPath(config) {
  * `access-<name>.json`, so two vaults in the same directory never share (or
  * overwrite) each other's mode / auto-capture / auto-lock settings. */
 /** Files that live beside vaults but are NOT vaults: sidecars and metadata. */
+/** Files that live beside vaults but are NOT vaults: sidecars and metadata.
+ * Accepts the name with or without its `.json` suffix. */
 function isNonVaultFile(name) {
-    return name === 'access' || name.startsWith('access-') || name === 'tools' || name === 'meta'
-        || name.endsWith('-audit') || name.startsWith('vault-export-');
+    const base = name.replace(/\.json$/i, '');
+    return base === 'access' || base.startsWith('access-') || base === 'tools' || base === 'meta'
+        || base.endsWith('-audit') || base.startsWith('vault-export-');
 }
 function accessPolicyFile(config) {
     const path = resolveVaultPath(config);
@@ -6981,7 +6984,7 @@ async function listVaultRoster(config, activeName) {
             const m = /^(.*)\.json$/.exec(entry);
             if (!m)
                 continue;
-            if (['access', 'meta'].includes(m[1]) || m[1].startsWith('vault-export-') || isBackupFile(entry))
+            if (isNonVaultFile(m[1]) || isBackupFile(entry))
                 continue;
             names.push(m[1]);
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-vault",
-  "version": "1.10.66",
+  "version": "1.10.68",
   "bin": {
     "dsh-vault": "./lib/cli.js"
   },
@@ -87,6 +87,7 @@
     "scan:public": "node scripts/secret-scan.mjs --public",
     "e2e:theme": "node tests/e2e/theme-check.mjs",
     "e2e:polish": "node tests/e2e/polish-check.mjs",
-    "e2e:contrast": "node tests/e2e/contrast-audit.mjs"
+    "e2e:contrast": "node tests/e2e/contrast-audit.mjs",
+    "e2e:prompt": "node tests/e2e/cli-prompt.mjs"
   }
 }