dsh-vault 1.10.68 → 1.10.70

package/README-zh.md

@@ -252,6 +252,11 @@ dsh-vault get my-entry --field apiKey      # 取指定字段
 dsh-vault get my-entry --mask              # 只确认存在,不打印值
 dsh-vault show my-entry                    # 非敏感字段的 JSON
 dsh-vault env                              # 带 env 标签的条目 → KEY=VALUE
+dsh-vault env --mask                       # 人类视角,两段都是 KEY=VALUE:
+#   ## exported items
+#   NPM_REGISTRY_API_KEY=npm_***
+#   ## unexported items
+#   EXAMPLE_BILLING_API_KEY=***
 dsh-vault export-env .env                  # ……或写成 0600 权限的 .env 文件
 dsh-vault verify                           # 校验主密码,stdout 无输出
 ```
@@ -319,6 +324,22 @@ npx dsh-vault list                                   # 或者干脆不装
 
 profile 这条路还有两个注意点:垫片可能被之后在该目录执行的 `pnpm install` 清掉;`pnpm dsh plugin --profile web add dsh-vault` 会依据包的 `dsh.bundle` 声明重整 `dsh.profile.bundles` —— 如果你自己的 patch 层**也**插入了这个插件,就会**挂两份**,要先删掉 patch 层那一行。
 
+## 强度指示
+
+列表里每个条目在标题后有一个**三星**强度指示 —— **☆☆☆ = 0 分,★★★ = 满分**,中间按半星分档。半星不是 Unicode 字符(大多数字体没有),而是把同样三个 `★` 复制一层、按百分比裁剪彩色层实现的:
+
+| 分数 | 显示 | 档位 |
+|---|---|---|
+| 0–8 | ☆☆☆ | 弱 |
+| 9–24 | ½☆☆ | 弱 |
+| 25–41 | ★☆☆ | 弱 |
+| 42–58 | ★½☆ | 中 |
+| 59–74 | ★★☆ | 中 |
+| 75–91 | ★★½ | 强 |
+| 92–100 | ★★★ | 强 |
+
+悬停可看到精确分数与评价。分数在 **host 侧**计算(列表本身永远拿不到密钥),针对条目的**密码或银行卡 PIN**;机器生成的 API Key、私钥**故意不评分**,免得所有密钥都是满分。
+
 ## 环境变量导出
 
 打上 `env` 标签的条目可以用 `vault_env` / `vault_export_env` 导出为 `KEY=VALUE` 行，名字按各家工具链预期的字段名生成：

package/README.md

@@ -268,6 +268,11 @@ dsh-vault get my-entry --field apiKey      # one named field
 dsh-vault get my-entry --mask              # confirm it exists without printing it
 dsh-vault show my-entry                    # non-secret metadata as JSON
 dsh-vault env                              # env-tagged entries as KEY=VALUE
+dsh-vault env --mask                       # human view, both sections as KEY=VALUE:
+#   ## exported items
+#   NPM_REGISTRY_API_KEY=npm_***
+#   ## unexported items
+#   EXAMPLE_BILLING_API_KEY=***
 dsh-vault export-env .env                  # …or write them to a 0600 file
 dsh-vault verify                           # check the master password, nothing on stdout
 ```
@@ -354,6 +359,28 @@ Two more caveats on the profile route: its `.bin` shim can be pruned by a later
 patch layer *also* inserts the plugin, that mounts it twice, so remove the patch
 row first.
 
+## Strength indicator
+
+Each entry row shows a three-star indicator after its title — **☆☆☆ = 0 score,
+★★★ = full marks** — in six half-star steps. A half star is the coloured copy of
+the same three glyphs clipped to a percentage (Unicode has no half-star glyph
+most fonts can render):
+
+| score | shows | band |
+|---|---|---|
+| 0–8 | ☆☆☆ | weak |
+| 9–24 | ½☆☆ | weak |
+| 25–41 | ★☆☆ | weak |
+| 42–58 | ★½☆ | fair |
+| 59–74 | ★★☆ | fair |
+| 75–91 | ★★½ | strong |
+| 92–100 | ★★★ | strong |
+
+Hovering it shows the exact score and verdict. The score is computed **host-side**
+(the list never receives the secret) and covers the entry's **password or card
+PIN**; machine-generated API keys and private keys are deliberately not scored,
+so every key does not sit at full marks.
+
 ## Environment export
 
 Entries tagged `env` can be materialised as `KEY=VALUE` lines (`vault_env`,

package/lib/cli.js

@@ -24,7 +24,7 @@ import { fileURLToPath, pathToFileURL } from 'node:url';
 import { createInterface } from 'node:readline';
 import { ReadStream } from 'node:tty';
 import { openVault, defaultVaultPath } from "./store.js";
-import { envLinesFor, envPairsForEntry, maskSecret, primarySecret } from "./env-export.js";
+import { envLinesFor, envPairsForEntry, maskSecret, primarySecret, shellQuote } from "./env-export.js";
 function packageVersion() {
     try {
         const require = createRequire(import.meta.url);
@@ -80,7 +80,9 @@ env options:
   --prefix <P>            Prefix for derived key names (an explicit envKey is kept verbatim)
   --kind <k>              Only entries of this kind
   --keys-only             Print key names without values
-  --mask                  Print masked values
+  --mask                  Human view: masked values PLUS an "unexported items"
+                          section (what the tag currently leaves out)
+  --explain               Same two-section view with the real values
   --file <path>           Write to a file instead of stdout
 
 Exported lines are shell-quoted (KEY='value'), so read them with
@@ -357,7 +359,7 @@ export async function runCli(argv, io) {
         list: ['kind', 'tag'],
         get: ['field', 'fields', 'mask', 'all'],
         show: [],
-        env: ['prefix', 'kind', 'keys-only', 'mask', 'file'],
+        env: ['prefix', 'kind', 'keys-only', 'mask', 'explain', 'file'],
         'export-env': ['prefix', 'kind', 'keys-only'],
         verify: [],
     };
@@ -479,7 +481,8 @@ export async function runCli(argv, io) {
         // env / export-env
         const prefix = stringFlag(parsed, 'prefix') ?? '';
         const kind = stringFlag(parsed, 'kind');
-        const lines = envLinesFor(store.list(), { prefix, ...(kind !== undefined ? { kind } : {}) });
+        const matching = store.list().filter(entry => kind === undefined || (entry.kind ?? 'login') === kind);
+        const lines = envLinesFor(matching, { prefix, ...(kind !== undefined ? { kind } : {}) });
         const rendered = lines.map(line => {
             if (keysOnly)
                 return line.split('=')[0] ?? line;
@@ -488,6 +491,27 @@ export async function runCli(argv, io) {
             const eq = line.indexOf('=');
             return `${line.slice(0, eq)}=${maskSecret(line.slice(eq + 1).replace(/^'|'$/g, ''))}`;
         });
+        // `--mask` is the human view (masked values are useless to a script), so it
+        // also lists what is NOT exported. Without it the output stays pure
+        // `KEY=VALUE`, which is what `eval "$(…)"` and pipelines need.
+        const explain = mask || parsed.flags.get('explain') === true;
+        const unexported = matching.filter(entry => !(entry.tags ?? []).includes('env'));
+        /** `KEY=***` for entries that are not exported (names visible, values not). */
+        const envPairsForEntryPairs = (entries) => pairsOf(entries, true).map(line => `${line.slice(0, line.indexOf('='))}=***`);
+        /** KEY=VALUE pairs of the given entries, de-duplicated, first entry wins. */
+        const pairsOf = (entries, masked) => {
+            const seen = new Set();
+            const out = [];
+            for (const entry of entries) {
+                for (const pair of envPairsForEntry(entry, prefix)) {
+                    if (seen.has(pair.key))
+                        continue;
+                    seen.add(pair.key);
+                    out.push(`${pair.key}=${masked ? maskSecret(pair.value) : shellQuote(pair.value)}`);
+                }
+            }
+            return out;
+        };
         const target = parsed.command === 'export-env' ? parsed.positional[0] : stringFlag(parsed, 'file');
         if (parsed.command === 'export-env' && target === undefined) {
             io.err('dsh-vault: export-env needs a file path\n');
@@ -504,6 +528,28 @@ export async function runCli(argv, io) {
                 : `dsh-vault: wrote ${rendered.length} lines to ${file} (mode 0600)\n`);
             return 0;
         }
+        if (explain) {
+            // Both sections use the same KEY=VALUE shape, so a name can be copied from
+            // either one. The unexported values stay masked even under --explain: the
+            // tag is what says "this one is meant for a shell".
+            io.out('## exported items\n');
+            if (rendered.length > 0)
+                io.out(`${rendered.join('\n')}\n`);
+            else
+                io.out('  (none — no entry carries the "env" tag)\n');
+            io.out('\n## unexported items\n');
+            // A fixed placeholder, not `maskSecret`: these did not opt into export, so
+            // not even a four-character prefix of a password should be shown.
+            const hidden = envPairsForEntryPairs(unexported);
+            if (hidden.length > 0) {
+                io.out(`${hidden.join('\n')}\n`);
+                io.out('  not exported (no "env" tag) — values hidden. `get <name>` still reads them.\n');
+            }
+            else {
+                io.out('  (none — every entry is exported)\n');
+            }
+            return 0;
+        }
         io.out(rendered.join('\n') + (rendered.length > 0 ? '\n' : ''));
         if (rendered.length === 0) {
             // The usual first-run wall: `env` only exports entries tagged `env`, and