dsh-vault 1.10.71 → 1.10.72

package/README-zh.md

@@ -324,6 +324,25 @@ npx dsh-vault list                                   # 或者干脆不装
 
 profile 这条路还有两个注意点:垫片可能被之后在该目录执行的 `pnpm install` 清掉;`pnpm dsh plugin --profile web add dsh-vault` 会依据包的 `dsh.bundle` 声明重整 `dsh.profile.bundles` —— 如果你自己的 patch 层**也**插入了这个插件,就会**挂两份**,要先删掉 patch 层那一行。
 
+## 泄露检查的隐私边界
+
+`vault_breach_check`(以及安全页)可以把密码拿去和 Have I Been Pwned 比对。**离开本机的只有一样东西**:
+
+```
+GET https://api.pwnedpasswords.com/range/<SHA-1(密码) 的前 5 个十六进制字符>
+Add-Padding: true
+```
+
+响应会返回该前缀桶里的**全部**后缀(几百条哈希),匹配在**本地**完成 —— 完整哈希、密码原文、以及它属于哪个条目都不会离开。如果密码已经在内置常见口令表里,**根本不会发起请求**;同一前缀的重复查询会在内存里缓存一小时。
+
+k-anonymity **没有**隐藏的东西,直说:
+
+- **5 个字符的前缀**(20 bit,约百万分之一桶)会连同你的 IP 发给 Cloudflare;
+- 能枚举候选口令的观察者,可以算出每个候选的前缀,从而看出你是否查询过那个桶 —— 这是该协议的已知局限,加请求头也解决不了;
+- `Add-Padding` 只是抹掉**响应体积**这个信号(不加它,桶的响应长度会和"该密码有多常见"相关)。
+
+如果连前缀都不想出去,就用 `online: false` —— 此时只查离线词表,覆盖率小得多,适合当筛子而不是定论。
+
 ## 强度指示
 
 列表里每个条目在标题后有一个**三星**强度指示 —— **☆☆☆ = 0 分,★★★ = 满分**,中间按半星分档。半星不是 Unicode 字符(大多数字体没有),而是把同样三个 `★` 复制一层、按百分比裁剪彩色层实现的:

package/README.md

@@ -359,6 +359,36 @@ Two more caveats on the profile route: its `.bin` shim can be pruned by a later
 patch layer *also* inserts the plugin, that mounts it twice, so remove the patch
 row first.
 
+## Privacy of the breach check
+
+`vault_breach_check` (and the security page) can check passwords against Have I
+Been Pwned. Exactly one thing leaves this machine:
+
+```
+GET https://api.pwnedpasswords.com/range/<FIRST 5 HEX CHARS OF SHA-1(password)>
+Add-Padding: true
+```
+
+The response lists every suffix in that bucket (hundreds of hashes) and the match
+is computed **locally** — the full hash, the password, and the entry it belongs to
+never leave. A password already in the bundled common-password list is answered
+offline and produces **no request at all**; repeat lookups of the same prefix are
+cached in memory for an hour.
+
+What k-anonymity does *not* hide, stated plainly:
+
+- the **five-character prefix** (20 bits, one bucket in ~1M) goes to Cloudflare,
+  together with your IP;
+- an observer who can guess candidate passwords can compute each candidate's
+  prefix and see whether you queried that bucket — that is the known limit of
+  this protocol, not something the header fixes;
+- `Add-Padding` only removes the *response-size* signal (without it, a bucket's
+  response length correlates with how common the password is).
+
+To keep even the prefix on your machine, pass `online: false` — the check then
+uses only the offline list, which is far smaller, so treat it as a screening aid
+rather than a verdict.
+
 ## Strength indicator
 
 Each entry row shows a three-star indicator after its title — **☆☆☆ = 0 score,

package/lib/breach.js

@@ -17,8 +17,9 @@ const HIBP_RANGE_URL = 'https://api.pwnedpasswords.com/range/';
 const QUERY_TIMEOUT_MS = 12_000;
 /** How long a fetched prefix range is cached in memory. */
 const CACHE_TTL_MS = 60 * 60 * 1000;
-/** Common / weak passwords checked offline (rockyou-style head). */
-const WEAK_PASSWORDS = new Set([
+/** Common / weak passwords checked offline (rockyou-style head). Also used by
+ * the strength estimator, so both agree on what "known-common" means. */
+export const WEAK_PASSWORDS = new Set([
     '123456', 'password', '12345678', 'qwerty', '123456789', '12345', '1234', '111111',
     '1234567', 'dragon', '123123', 'baseball', 'abc123', 'football', 'monkey', 'letmein',
     'shadow', 'master', '666666', 'qwertyuiop', '123321', 'mustang', '1234567890', 'michael',
@@ -42,7 +43,13 @@ export function sha1Hex(password) {
 async function queryRange(prefix) {
     const res = await fetch(`${HIBP_RANGE_URL}${prefix}`, {
         signal: AbortSignal.timeout(QUERY_TIMEOUT_MS),
-        headers: { 'User-Agent': 'dsh-vault' },
+        headers: {
+            'User-Agent': 'dsh-vault',
+            // HIBP's own privacy knob: pad every response to a similar size so an
+            // observer cannot correlate a lookup with how many passwords share that
+            // prefix (which would leak information about how common yours is).
+            'Add-Padding': 'true',
+        },
     });
     if (!res.ok)
         throw new Error(`Pwned Passwords returned HTTP ${res.status}`);

package/lib/client.js

@@ -510,197 +510,197 @@ window.__ModuleLoader__.load({
 			document.head.appendChild(tag);
 		}
 		var VaultSection_module_css_default = {
-			"lenChips": "t_j5va_lenChips",
-			"totpRing": "t_j5va_totpRing",
-			"actionGroupLabel": "t_j5va_actionGroupLabel",
-			"detailActions": "t_j5va_detailActions",
-			"vaultManageRow": "t_j5va_vaultManageRow",
-			"healthBar": "t_j5va_healthBar",
-			"rowDue": "t_j5va_rowDue",
-			"dueBadge": "t_j5va_dueBadge",
-			"rowCheck": "t_j5va_rowCheck",
-			"editorBody": "t_j5va_editorBody",
-			"auditRow": "t_j5va_auditRow",
+			"brandGlyph": "t_j5va_brandGlyph",
+			"intro": "t_j5va_intro",
+			"reportTitle": "t_j5va_reportTitle",
+			"colorSwatch": "t_j5va_colorSwatch",
+			"recentLabel": "t_j5va_recentLabel",
+			"pinStar": "t_j5va_pinStar",
+			"detailItem": "t_j5va_detailItem",
+			"tagCount": "t_j5va_tagCount",
+			"pinOn": "t_j5va_pinOn",
+			"toolbarFilters": "t_j5va_toolbarFilters",
+			"title": "t_j5va_title",
+			"toolbarDivider": "t_j5va_toolbarDivider",
+			"importName": "t_j5va_importName",
+			"searchBox": "t_j5va_searchBox",
+			"recentClear": "t_j5va_recentClear",
+			"strengthFair": "t_j5va_strengthFair",
 			"totpCopy": "t_j5va_totpCopy",
-			"attachBox": "t_j5va_attachBox",
-			"exportChips": "t_j5va_exportChips",
-			"customValueInput": "t_j5va_customValueInput",
-			"toolbarMain": "t_j5va_toolbarMain",
+			"importActions": "t_j5va_importActions",
+			"auditChipActive": "t_j5va_auditChipActive",
 			"gridDetail": "t_j5va_gridDetail",
-			"toolbar": "t_j5va_toolbar",
-			"list": "t_j5va_list",
-			"favToggle": "t_j5va_favToggle",
-			"detailDeleteBtn": "t_j5va_detailDeleteBtn",
-			"exportChip": "t_j5va_exportChip",
-			"row": "t_j5va_row",
-			"addButton": "t_j5va_addButton",
-			"lockedBanner": "t_j5va_lockedBanner",
-			"detailRemain": "t_j5va_detailRemain",
-			"strengthFair": "t_j5va_strengthFair",
-			"searchBox": "t_j5va_searchBox",
+			"tabs": "t_j5va_tabs",
+			"highBadge": "t_j5va_highBadge",
+			"lockedTag": "t_j5va_lockedTag",
+			"customValueInput": "t_j5va_customValueInput",
+			"kindChip": "t_j5va_kindChip",
+			"emptyHint": "t_j5va_emptyHint",
+			"dupMerge": "t_j5va_dupMerge",
+			"importList": "t_j5va_importList",
+			"colorFieldWrap": "t_j5va_colorFieldWrap",
+			"badgeDanger": "t_j5va_badgeDanger",
+			"kindIcon": "t_j5va_kindIcon",
 			"pwBar": "t_j5va_pwBar",
-			"tagName": "t_j5va_tagName",
-			"badge": "t_j5va_badge",
-			"importActions": "t_j5va_importActions",
-			"lenChipActive": "t_j5va_lenChipActive",
-			"toolbarDivider": "t_j5va_toolbarDivider",
+			"status": "t_j5va_status",
+			"actionGroups": "t_j5va_actionGroups",
+			"actionGroupLabel": "t_j5va_actionGroupLabel",
+			"genHist": "t_j5va_genHist",
+			"badgeOk": "t_j5va_badgeOk",
+			"gridActions": "t_j5va_gridActions",
+			"pinOff": "t_j5va_pinOff",
+			"dupNames": "t_j5va_dupNames",
+			"row": "t_j5va_row",
 			"riskDanger": "t_j5va_riskDanger",
-			"badgeBtn": "t_j5va_badgeBtn",
-			"histDanger": "t_j5va_histDanger",
-			"emptyBox": "t_j5va_emptyBox",
-			"tabPane": "t_j5va_tabPane",
-			"reportLineLink": "t_j5va_reportLineLink",
-			"brandGlyphSm": "t_j5va_brandGlyphSm",
-			"strengthStars": "t_j5va_strengthStars",
-			"importDesc": "t_j5va_importDesc",
-			"actionBtn": "t_j5va_actionBtn",
-			"pwStrong": "t_j5va_pwStrong",
-			"recentChip": "t_j5va_recentChip",
-			"rowSelected": "t_j5va_rowSelected",
-			"tabs": "t_j5va_tabs",
-			"kindChipActive": "t_j5va_kindChipActive",
-			"listCompact": "t_j5va_listCompact",
-			"identity": "t_j5va_identity",
-			"actionPrimary": "t_j5va_actionPrimary",
 			"pwHistRow": "t_j5va_pwHistRow",
-			"genHistItem": "t_j5va_genHistItem",
+			"healthSummary": "t_j5va_healthSummary",
+			"deleteButton": "t_j5va_deleteButton",
+			"tagManagerHead": "t_j5va_tagManagerHead",
+			"reportBox": "t_j5va_reportBox",
+			"pwWeak": "t_j5va_pwWeak",
+			"rowActions": "t_j5va_rowActions",
+			"moreWrap": "t_j5va_moreWrap",
+			"pwHistTime": "t_j5va_pwHistTime",
+			"gridInput": "t_j5va_gridInput",
+			"auditChips": "t_j5va_auditChips",
+			"totpRing": "t_j5va_totpRing",
+			"histAdd": "t_j5va_histAdd",
+			"listCompact": "t_j5va_listCompact",
+			"modeAsk": "t_j5va_modeAsk",
+			"scoreRing": "t_j5va_scoreRing",
+			"strengthWeak": "t_j5va_strengthWeak",
+			"colorPalette": "t_j5va_colorPalette",
+			"toolbar": "t_j5va_toolbar",
+			"tagManager": "t_j5va_tagManager",
+			"reportSub": "t_j5va_reportSub",
+			"modeAuto": "t_j5va_modeAuto",
+			"pwMeter": "t_j5va_pwMeter",
+			"pwStrong": "t_j5va_pwStrong",
+			"customFieldRows": "t_j5va_customFieldRows",
+			"customFieldRow": "t_j5va_customFieldRow",
+			"customKeyInput": "t_j5va_customKeyInput",
+			"favToggle": "t_j5va_favToggle",
+			"strengthStrong": "t_j5va_strengthStrong",
 			"editorActions": "t_j5va_editorActions",
-			"dangerButton": "t_j5va_dangerButton",
-			"histNeutral": "t_j5va_histNeutral",
-			"kindFilter": "t_j5va_kindFilter",
-			"pwHistPwd": "t_j5va_pwHistPwd",
-			"gridActions": "t_j5va_gridActions",
-			"tabActive": "t_j5va_tabActive",
-			"inlineInput": "t_j5va_inlineInput",
-			"uriCode": "t_j5va_uriCode",
-			"tab": "t_j5va_tab",
-			"actionGroup": "t_j5va_actionGroup",
-			"kindIcon": "t_j5va_kindIcon",
-			"pinStar": "t_j5va_pinStar",
-			"backupButton": "t_j5va_backupButton",
-			"auditChipActive": "t_j5va_auditChipActive",
-			"recentLabel": "t_j5va_recentLabel",
-			"badgeActive": "t_j5va_badgeActive",
-			"inlineField": "t_j5va_inlineField",
-			"bulkItem": "t_j5va_bulkItem",
-			"saveButton": "t_j5va_saveButton",
+			"reportJump": "t_j5va_reportJump",
+			"reportLineLink": "t_j5va_reportLineLink",
+			"rowSelected": "t_j5va_rowSelected",
+			"histLink": "t_j5va_histLink",
+			"favActive": "t_j5va_favActive",
 			"srOnly": "t_j5va_srOnly",
-			"secretField": "t_j5va_secretField",
-			"genHist": "t_j5va_genHist",
-			"scoreRing": "t_j5va_scoreRing",
+			"uriCode": "t_j5va_uriCode",
+			"badgeLink": "t_j5va_badgeLink",
+			"importDesc": "t_j5va_importDesc",
 			"selectActive": "t_j5va_selectActive",
-			"auditChips": "t_j5va_auditChips",
+			"emojiBtn": "t_j5va_emojiBtn",
+			"detailBox": "t_j5va_detailBox",
+			"detailDeleteBtn": "t_j5va_detailDeleteBtn",
 			"badgeWarn": "t_j5va_badgeWarn",
-			"detailItem": "t_j5va_detailItem",
-			"colorSwatch": "t_j5va_colorSwatch",
-			"badgeLink": "t_j5va_badgeLink",
-			"customEq": "t_j5va_customEq",
-			"tagCount": "t_j5va_tagCount",
-			"recentSearch": "t_j5va_recentSearch",
-			"totp": "t_j5va_totp",
+			"sortButton": "t_j5va_sortButton",
+			"recentChip": "t_j5va_recentChip",
 			"revealButton": "t_j5va_revealButton",
-			"customFieldRow": "t_j5va_customFieldRow",
-			"genOpts": "t_j5va_genOpts",
-			"checkField": "t_j5va_checkField",
-			"resultCount": "t_j5va_resultCount",
-			"pwMeter": "t_j5va_pwMeter",
-			"tagManager": "t_j5va_tagManager",
-			"toolbarFilters": "t_j5va_toolbarFilters",
-			"clearButton": "t_j5va_clearButton",
-			"rowActions": "t_j5va_rowActions",
-			"rowMain": "t_j5va_rowMain",
-			"headerMessage": "t_j5va_headerMessage",
-			"attachAdd": "t_j5va_attachAdd",
-			"empty": "t_j5va_empty",
-			"field": "t_j5va_field",
-			"reportBox": "t_j5va_reportBox",
-			"strengthTrack": "t_j5va_strengthTrack",
-			"colorFieldWrap": "t_j5va_colorFieldWrap",
+			"lockedBanner": "t_j5va_lockedBanner",
 			"bulkBar": "t_j5va_bulkBar",
-			"modeAsk": "t_j5va_modeAsk",
-			"histLink": "t_j5va_histLink",
-			"reportTitle": "t_j5va_reportTitle",
-			"pwFair": "t_j5va_pwFair",
-			"colorPalette": "t_j5va_colorPalette",
-			"auditWhen": "t_j5va_auditWhen",
-			"editor": "t_j5va_editor",
-			"hit": "t_j5va_hit",
-			"tagRow": "t_j5va_tagRow",
-			"histUpdate": "t_j5va_histUpdate",
-			"importList": "t_j5va_importList",
-			"emojiBtn": "t_j5va_emojiBtn",
-			"iconFieldWrap": "t_j5va_iconFieldWrap",
-			"genOptRow": "t_j5va_genOptRow",
-			"title": "t_j5va_title",
-			"tagManagerHead": "t_j5va_tagManagerHead",
-			"importRow": "t_j5va_importRow",
-			"vaultTarget": "t_j5va_vaultTarget",
-			"emptyHint": "t_j5va_emptyHint",
-			"importName": "t_j5va_importName",
-			"badgeDanger": "t_j5va_badgeDanger",
-			"detailCode": "t_j5va_detailCode",
+			"rowCheck": "t_j5va_rowCheck",
+			"customEq": "t_j5va_customEq",
 			"copied": "t_j5va_copied",
-			"healthSummary": "t_j5va_healthSummary",
-			"moreWrap": "t_j5va_moreWrap",
-			"intro": "t_j5va_intro",
-			"auditChip": "t_j5va_auditChip",
-			"policyField": "t_j5va_policyField",
-			"dupGroup": "t_j5va_dupGroup",
+			"badge": "t_j5va_badge",
 			"urlGlyph": "t_j5va_urlGlyph",
-			"auditIssues": "t_j5va_auditIssues",
-			"riskBanner": "t_j5va_riskBanner",
-			"deleteButton": "t_j5va_deleteButton",
-			"dupMerge": "t_j5va_dupMerge",
-			"favActive": "t_j5va_favActive",
-			"copyAllBtn": "t_j5va_copyAllBtn",
-			"sortButton": "t_j5va_sortButton",
-			"pinOff": "t_j5va_pinOff",
-			"dupNames": "t_j5va_dupNames",
 			"retryButton": "t_j5va_retryButton",
-			"lenChip": "t_j5va_lenChip",
-			"customKeyInput": "t_j5va_customKeyInput",
-			"actionGroups": "t_j5va_actionGroups",
-			"strengthWeak": "t_j5va_strengthWeak",
-			"pinOn": "t_j5va_pinOn",
-			"rowExpired": "t_j5va_rowExpired",
-			"customFieldRows": "t_j5va_customFieldRows",
-			"detailBox": "t_j5va_detailBox",
-			"riskWarn": "t_j5va_riskWarn",
 			"moreButton": "t_j5va_moreButton",
-			"brandGlyph": "t_j5va_brandGlyph",
-			"recentClear": "t_j5va_recentClear",
-			"policyBar": "t_j5va_policyBar",
-			"reportSub": "t_j5va_reportSub",
-			"badgeOk": "t_j5va_badgeOk",
-			"gridRow": "t_j5va_gridRow",
+			"emptyBox": "t_j5va_emptyBox",
+			"resultCount": "t_j5va_resultCount",
+			"dangerButton": "t_j5va_dangerButton",
+			"detailRemain": "t_j5va_detailRemain",
+			"pwHistPwd": "t_j5va_pwHistPwd",
+			"exportChip": "t_j5va_exportChip",
+			"vaultSwitch": "t_j5va_vaultSwitch",
+			"reportLine": "t_j5va_reportLine",
 			"gridName": "t_j5va_gridName",
-			"gridInput": "t_j5va_gridInput",
+			"rowDue": "t_j5va_rowDue",
+			"tagRow": "t_j5va_tagRow",
+			"auditWhen": "t_j5va_auditWhen",
+			"vaultManageRow": "t_j5va_vaultManageRow",
+			"hit": "t_j5va_hit",
+			"tagName": "t_j5va_tagName",
+			"actionGroup": "t_j5va_actionGroup",
+			"brandGlyphSm": "t_j5va_brandGlyphSm",
+			"auditChip": "t_j5va_auditChip",
+			"badgeBtn": "t_j5va_badgeBtn",
+			"inlineInput": "t_j5va_inlineInput",
 			"moreMenu": "t_j5va_moreMenu",
-			"section": "t_j5va_section",
-			"pwWeak": "t_j5va_pwWeak",
-			"kindChip": "t_j5va_kindChip",
+			"policyField": "t_j5va_policyField",
+			"identity": "t_j5va_identity",
+			"totp": "t_j5va_totp",
+			"policyBar": "t_j5va_policyBar",
+			"strengthStars": "t_j5va_strengthStars",
+			"tabPane": "t_j5va_tabPane",
+			"clearButton": "t_j5va_clearButton",
+			"attachAdd": "t_j5va_attachAdd",
+			"exportChips": "t_j5va_exportChips",
+			"emojiPicker": "t_j5va_emojiPicker",
+			"tab": "t_j5va_tab",
+			"recentSearch": "t_j5va_recentSearch",
+			"editorBody": "t_j5va_editorBody",
+			"error": "t_j5va_error",
+			"healthBar": "t_j5va_healthBar",
+			"riskWarn": "t_j5va_riskWarn",
+			"detailCode": "t_j5va_detailCode",
+			"tabActive": "t_j5va_tabActive",
 			"vaultHeader": "t_j5va_vaultHeader",
-			"strengthFill": "t_j5va_strengthFill",
-			"strengthStrong": "t_j5va_strengthStrong",
-			"pwHistTime": "t_j5va_pwHistTime",
-			"reportJump": "t_j5va_reportJump",
-			"pwLabel": "t_j5va_pwLabel",
-			"vaultSwitch": "t_j5va_vaultSwitch",
-			"reportLine": "t_j5va_reportLine",
+			"strengthTrack": "t_j5va_strengthTrack",
+			"kindChipActive": "t_j5va_kindChipActive",
+			"importRow": "t_j5va_importRow",
+			"headerMessage": "t_j5va_headerMessage",
+			"genOptRow": "t_j5va_genOptRow",
 			"modeReadonly": "t_j5va_modeReadonly",
-			"error": "t_j5va_error",
-			"highBadge": "t_j5va_highBadge",
+			"section": "t_j5va_section",
+			"list": "t_j5va_list",
+			"empty": "t_j5va_empty",
+			"rowExpired": "t_j5va_rowExpired",
+			"attachBox": "t_j5va_attachBox",
+			"checkField": "t_j5va_checkField",
+			"toolbarMain": "t_j5va_toolbarMain",
+			"detailActions": "t_j5va_detailActions",
+			"vaultTarget": "t_j5va_vaultTarget",
 			"bulkCount": "t_j5va_bulkCount",
+			"genOpts": "t_j5va_genOpts",
 			"searchKbd": "t_j5va_searchKbd",
-			"modeAuto": "t_j5va_modeAuto",
-			"trashButton": "t_j5va_trashButton",
-			"emojiPicker": "t_j5va_emojiPicker",
 			"tagActions": "t_j5va_tagActions",
+			"copyAllBtn": "t_j5va_copyAllBtn",
+			"pwLabel": "t_j5va_pwLabel",
+			"addButton": "t_j5va_addButton",
+			"badgeActive": "t_j5va_badgeActive",
+			"lenChip": "t_j5va_lenChip",
+			"editor": "t_j5va_editor",
+			"actionPrimary": "t_j5va_actionPrimary",
+			"histUpdate": "t_j5va_histUpdate",
+			"kindFilter": "t_j5va_kindFilter",
+			"pwFair": "t_j5va_pwFair",
+			"rowMain": "t_j5va_rowMain",
+			"genHistItem": "t_j5va_genHistItem",
+			"gridRow": "t_j5va_gridRow",
+			"field": "t_j5va_field",
+			"auditIssues": "t_j5va_auditIssues",
+			"histDanger": "t_j5va_histDanger",
+			"lenChipActive": "t_j5va_lenChipActive",
+			"secretField": "t_j5va_secretField",
+			"dueBadge": "t_j5va_dueBadge",
+			"riskBanner": "t_j5va_riskBanner",
+			"dupGroup": "t_j5va_dupGroup",
+			"actionBtn": "t_j5va_actionBtn",
+			"lenChips": "t_j5va_lenChips",
+			"strengthFill": "t_j5va_strengthFill",
+			"bulkItem": "t_j5va_bulkItem",
+			"histNeutral": "t_j5va_histNeutral",
 			"detailTotp": "t_j5va_detailTotp",
-			"histAdd": "t_j5va_histAdd",
-			"status": "t_j5va_status",
+			"iconFieldWrap": "t_j5va_iconFieldWrap",
 			"pwHistBox": "t_j5va_pwHistBox",
-			"lockedTag": "t_j5va_lockedTag"
+			"inlineField": "t_j5va_inlineField",
+			"saveButton": "t_j5va_saveButton",
+			"backupButton": "t_j5va_backupButton",
+			"auditRow": "t_j5va_auditRow",
+			"trashButton": "t_j5va_trashButton"
 		};
 		//#endregion
 		//#region src/client/VaultSection.tsx

package/lib/index.js

@@ -62,7 +62,8 @@ import { envLinesFor, shellQuote } from "./env-export.js";
 import { openVault, defaultVaultPath } from "./store.js";
 import { totp, parseTotpSecret, hotp, base32Decode } from "./totp.js";
 import { generatePassword, generatePassphrase } from "./password.js";
-import { checkPassword } from "./breach.js";
+import { checkPassword, WEAK_PASSWORDS } from "./breach.js";
+import { estimateStrength as estimateStrengthPure } from "./password-strength.js";
 import { readChromeLogins, defaultChromeLoginData, defaultChromeLocalState } from "./chrome.js";
 import { readKeychainPasswords, listKeychainEntries } from "./keychain.js";
 import { analyzeVault, analyzeEntry } from "./watchtower.js";
@@ -6540,6 +6541,14 @@ function entryPasswordStrength(entry) {
     const secret = passwordLikeSecret(entry);
     return secret === undefined ? undefined : estimateStrength(secret).score;
 }
+/** Strength with the bundled common-password list wired in, so a known-common
+ * password cannot score well on length alone. */
+function estimateStrength(password) {
+    const { score, verdict, feedback, bits } = estimateStrengthPure(password, WEAK_PASSWORDS);
+    // The tools and the UI meter take one line of prose; the array stays available
+    // to tests and to anything that wants the individual reasons.
+    return { score, verdict, feedback: feedback.join('; '), bits };
+}
 function toSummary(entry) {
     const strength = entryPasswordStrength(entry);
     return {
@@ -7179,58 +7188,8 @@ function pickDefinedFromRecord(record) {
 }
 /** Zero-dependency password strength estimator: score 0–100 from length,
  * character-class coverage, and penalties for common weak patterns. */
-function estimateStrength(password) {
-    let score = 0;
-    const length = password.length;
-    // Length is the dominant factor.
-    score += Math.min(45, length * 3);
-    const classes = [
-        /[a-z]/.test(password),
-        /[A-Z]/.test(password),
-        /[0-9]/.test(password),
-        /[^A-Za-z0-9]/.test(password),
-    ].filter(Boolean).length;
-    score += classes * 8;
-    // Diversity bonus for longer unique characters.
-    const unique = new Set(password).size;
-    score += Math.min(15, unique);
-    // Penalties for common weak patterns.
-    let feedback = [];
-    if (length < 8)
-        feedback.push('too short (aim ≥ 12)');
-    if (/^(password|123456|qwerty|letmein|admin|welcome|abc123)$/i.test(password)) {
-        score -= 40;
-        feedback.push('common password');
-    }
-    if (/(.)\1{2,}/.test(password)) {
-        score -= 8;
-        feedback.push('repeated characters');
-    }
-    if (/^\d+$/.test(password)) {
-        score -= 15;
-        feedback.push('digits only');
-    }
-    if (/^[a-z]+$/i.test(password)) {
-        score -= 10;
-        feedback.push('letters only');
-    }
-    if (password.length > 0 && new Set(password).size <= Math.max(3, Math.floor(length / 2)))
-        feedback.push('low diversity');
-    score = Math.max(0, Math.min(100, Math.round(score)));
-    const verdict = score >= 80 ? 'very strong' : score >= 60 ? 'strong' : score >= 40 ? 'fair' : 'weak';
-    // Entropy estimate in bits: log2(pool size) per character.
-    let pool = 0;
-    if (/[a-z]/.test(password))
-        pool += 26;
-    if (/[A-Z]/.test(password))
-        pool += 26;
-    if (/[0-9]/.test(password))
-        pool += 10;
-    if (/[^A-Za-z0-9]/.test(password))
-        pool += 33;
-    const bits = password.length > 0 && pool > 0 ? Math.round(password.length * Math.log2(pool)) : 0;
-    return { score, verdict, feedback: feedback.length > 0 ? feedback.join('; ') : 'no obvious weaknesses', bits };
-}
+// Strength lives in its own module so the CLI, the tools and the UI meter all
+// share one estimator (see src/password-strength.ts).
 /** Quote a value for safe use in .env / shell export (single-quote, escaping
  * embedded single quotes the POSIX way). */
 /** Generate a random username from adjective/noun syllables + digits. */

package/lib/password-strength.js

@@ -0,0 +1,170 @@
+/**
+ * Password strength, dependency-free.
+ *
+ * Two layers:
+ *
+ * 1. **Composition** — length, character classes and diversity, the cheap
+ *    signals every meter uses.
+ * 2. **Patterns** — what a cracker actually exploits: a known-common password
+ *    (including l33t and trailing-digit variants), a keyboard walk, a sequence,
+ *    a date, a repeated block, or "one word plus digits" (`Sunflower22`).
+ *
+ * A pattern does not just shave points: it **caps** the score, because a
+ * dictionary word with a capital and a couple of digits is not 67/100 material
+ * no matter how long it is. Composition alone rated exactly that kind of
+ * password "strong", which is the bug this module exists to fix.
+ *
+ * It is deliberately not zxcvbn: no bundled dictionary, no frequency ranking.
+ * The one wordlist it consults is the offline common-password set from
+ * `breach.ts`, so the strength meter and the breach report agree on what
+ * "known-common" means.
+ */
+import { WEAK_PASSWORDS } from "./breach.js";
+/** Substitute the usual l33t characters so `P@ssw0rd` matches `password`. */
+function deLeet(password) {
+    return password
+        .toLowerCase()
+        .replace(/[4@]/g, 'a')
+        .replace(/[3€]/g, 'e')
+        .replace(/[1!|]/g, 'i')
+        .replace(/0/g, 'o')
+        .replace(/[5$]/g, 's')
+        .replace(/7\+/g, 't');
+}
+/** The password with digits/symbols trimmed off both ends (for dictionary hits). */
+function coreLetters(password) {
+    return password.toLowerCase().replace(/^[^a-z]+|[^a-z]+$/g, '');
+}
+const KEYBOARD_RUNS = ['qwertyuiop', 'asdfghjkl', 'zxcvbnm', '1234567890', 'qazwsx', '1qaz2wsx'];
+const SEQUENCES = ['abcdefghijklmnopqrstuvwxyz', '01234567890'];
+/** True when the text contains a straight run of ≥4 characters from `source`. */
+function hasRun(text, source) {
+    for (let i = 0; i + 4 <= text.length; i++) {
+        const chunk = text.slice(i, i + 4);
+        if (source.includes(chunk))
+            return true;
+        if (source.includes([...chunk].reverse().join('')))
+            return true;
+    }
+    return false;
+}
+/** True for a repeated block: `abcabcabc`, `121212`. */
+function isRepeatedBlock(password) {
+    for (let size = 1; size <= Math.floor(password.length / 3); size++) {
+        const block = password.slice(0, size);
+        if (block.repeat(Math.ceil(password.length / size)).slice(0, password.length) === password)
+            return true;
+    }
+    return false;
+}
+/**
+ * True for a plausible date or year. Deliberately strict about separators: a
+ * bare four-digit run is a PIN or a sequence (`1111`), not a date, and calling it
+ * one used to add noise to the feedback.
+ */
+function hasDate(text) {
+    if (/(19|20)\d{2}/.test(text))
+        return true;
+    return /\d{1,2}[\/\-.]\d{1,2}[\/\-.]\d{2,4}/.test(text);
+}
+/** Score one password; `common` defaults to the bundled offline list. */
+export function estimateStrength(password, common = WEAK_PASSWORDS) {
+    const feedback = [];
+    const patterns = [];
+    const lower = password.toLowerCase();
+    const deLeeted = deLeet(password);
+    const letters = coreLetters(password);
+    // ---- layer 1: composition ------------------------------------------------
+    let score = Math.min(45, password.length * 3);
+    const classes = [/[a-z]/, /[A-Z]/, /[0-9]/, /[^A-Za-z0-9]/].filter(re => re.test(password)).length;
+    score += classes * 8;
+    score += Math.min(15, new Set(password).size);
+    if (password.length < 8)
+        feedback.push('too short (aim ≥ 12)');
+    if (/^\d+$/.test(password)) {
+        score -= 15;
+        feedback.push('digits only');
+    }
+    else if (/^[a-z]+$/i.test(password)) {
+        score -= 10;
+        feedback.push('letters only');
+    }
+    if (/(.)\1{2,}/.test(password)) {
+        score -= 8;
+        patterns.push('repeats');
+        feedback.push('repeated characters');
+    }
+    // ---- layer 2: patterns, each of which caps the score ---------------------
+    //
+    // The caps are length-aware for the *soft* patterns. A year inside a 30
+    // character passphrase (`CorrectHorseBatteryStaple!2024`) is not what makes it
+    // guessable, but the same year in an 8 character password is. A known-common
+    // password and a repeated block stay capped no matter how long they are: those
+    // are weak at any length.
+    const long = password.length >= 20;
+    let cap = 100;
+    const isCommon = (value) => common.has(value) || common.has(deLeet(value));
+    if (isCommon(lower) || isCommon(deLeeted)) {
+        cap = Math.min(cap, 5);
+        patterns.push('common');
+        feedback.push('found in common-password lists');
+    }
+    else if (letters.length >= 4 && isCommon(letters)) {
+        // a known word plus a suffix/prefix: `sunshine2024`, `Passw0rd!`
+        cap = Math.min(cap, long ? 50 : 25);
+        patterns.push('common-word');
+        feedback.push('a common password with numbers or symbols around it');
+    }
+    else if (/^[a-z]{5,}\d{1,4}!?$/i.test(password) || /^\d{1,4}[a-z]{5,}!?$/i.test(password)) {
+        // one dictionary-looking word plus a short number: `Sunflower22`
+        cap = Math.min(cap, long ? 65 : 45);
+        patterns.push('word+digits');
+        feedback.push('looks like a word plus digits — a dictionary attack covers it');
+    }
+    if (KEYBOARD_RUNS.some(run => hasRun(lower, run))) {
+        cap = Math.min(cap, long ? 50 : 30);
+        patterns.push('keyboard');
+        feedback.push('keyboard pattern (qwerty / asdf / 1234)');
+    }
+    if (SEQUENCES.some(seq => hasRun(lower, seq))) {
+        cap = Math.min(cap, long ? 50 : 35);
+        patterns.push('sequence');
+        feedback.push('sequential characters (abcd / 4321)');
+    }
+    if (hasDate(password)) {
+        cap = Math.min(cap, long ? 70 : 45);
+        patterns.push('date');
+        feedback.push('contains a date or year');
+    }
+    if (isRepeatedBlock(password)) {
+        cap = Math.min(cap, 30);
+        patterns.push('repeat-block');
+        feedback.push('a short block repeated over and over');
+    }
+    if (new Set(password).size <= Math.max(3, Math.floor(password.length / 2))) {
+        patterns.push('low-diversity');
+        feedback.push('low character diversity');
+    }
+    score = Math.max(0, Math.min(100, Math.round(Math.min(score, cap))));
+    const verdict = score >= 80 ? 'very strong' : score >= 60 ? 'strong' : score >= 40 ? 'fair' : 'weak';
+    // Naive entropy: pool size per character. Reported next to the score, not
+    // used to derive it — a 20-character `qwertyqwertyqwertyq` has plenty of bits
+    // and is still terrible.
+    let pool = 0;
+    if (/[a-z]/.test(password))
+        pool += 26;
+    if (/[A-Z]/.test(password))
+        pool += 26;
+    if (/[0-9]/.test(password))
+        pool += 10;
+    if (/[^A-Za-z0-9]/.test(password))
+        pool += 33;
+    const bits = password.length > 0 && pool > 0 ? Math.round(password.length * Math.log2(pool)) : 0;
+    return {
+        score,
+        verdict,
+        feedback: feedback.length > 0 ? feedback : ['no obvious weaknesses'],
+        bits,
+        patterns,
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-vault",
-  "version": "1.10.71",
+  "version": "1.10.72",
   "bin": {
     "dsh-vault": "./lib/cli.js"
   },