dsh-vault 1.2.0-rc.2 → 1.2.0-rc.3

package/lib/client.js

@@ -17,80 +17,80 @@ window.__ModuleLoader__.load({
 			document.head.appendChild(tag);
 		}
 		var VaultSection_module_css_default = {
-			"backupButton": "t_j5va_backupButton",
-			"footer": "t_j5va_footer",
-			"saveButton": "t_j5va_saveButton",
-			"emptyHint": "t_j5va_emptyHint",
-			"status": "t_j5va_status",
-			"kindIcon": "t_j5va_kindIcon",
-			"searchBox": "t_j5va_searchBox",
-			"intro": "t_j5va_intro",
-			"detailItem": "t_j5va_detailItem",
-			"policyField": "t_j5va_policyField",
-			"field": "t_j5va_field",
-			"pwFair": "t_j5va_pwFair",
-			"identity": "t_j5va_identity",
-			"checkField": "t_j5va_checkField",
-			"pwLabel": "t_j5va_pwLabel",
-			"dupGroup": "t_j5va_dupGroup",
-			"modeReadonly": "t_j5va_modeReadonly",
-			"badge": "t_j5va_badge",
-			"dupNames": "t_j5va_dupNames",
-			"badgeWarn": "t_j5va_badgeWarn",
-			"auditRow": "t_j5va_auditRow",
-			"genOptRow": "t_j5va_genOptRow",
+			"sortButton": "t_j5va_sortButton",
+			"reportLine": "t_j5va_reportLine",
+			"clearButton": "t_j5va_clearButton",
 			"rowDue": "t_j5va_rowDue",
-			"deleteButton": "t_j5va_deleteButton",
+			"dangerButton": "t_j5va_dangerButton",
 			"detailBox": "t_j5va_detailBox",
+			"scoreRing": "t_j5va_scoreRing",
 			"emptyBox": "t_j5va_emptyBox",
+			"totpRing": "t_j5va_totpRing",
+			"pwFair": "t_j5va_pwFair",
+			"policyBar": "t_j5va_policyBar",
+			"footer": "t_j5va_footer",
+			"editor": "t_j5va_editor",
+			"healthBar": "t_j5va_healthBar",
+			"lockedBanner": "t_j5va_lockedBanner",
+			"kindIcon": "t_j5va_kindIcon",
+			"pwLabel": "t_j5va_pwLabel",
 			"rowActions": "t_j5va_rowActions",
-			"kindFilter": "t_j5va_kindFilter",
+			"badge": "t_j5va_badge",
+			"editorActions": "t_j5va_editorActions",
+			"retryButton": "t_j5va_retryButton",
+			"rowMain": "t_j5va_rowMain",
 			"reportTitle": "t_j5va_reportTitle",
-			"empty": "t_j5va_empty",
-			"pwWeak": "t_j5va_pwWeak",
+			"secretField": "t_j5va_secretField",
 			"copied": "t_j5va_copied",
-			"scoreRing": "t_j5va_scoreRing",
-			"dangerButton": "t_j5va_dangerButton",
-			"pwBar": "t_j5va_pwBar",
-			"list": "t_j5va_list",
-			"error": "t_j5va_error",
-			"sortButton": "t_j5va_sortButton",
-			"editorBody": "t_j5va_editorBody",
-			"trashButton": "t_j5va_trashButton",
-			"retryButton": "t_j5va_retryButton",
-			"title": "t_j5va_title",
 			"badgeOk": "t_j5va_badgeOk",
-			"dupMerge": "t_j5va_dupMerge",
-			"reportLine": "t_j5va_reportLine",
-			"totp": "t_j5va_totp",
-			"reportSub": "t_j5va_reportSub",
-			"secretField": "t_j5va_secretField",
-			"genOpts": "t_j5va_genOpts",
-			"dueBadge": "t_j5va_dueBadge",
-			"rowMain": "t_j5va_rowMain",
-			"revealButton": "t_j5va_revealButton",
-			"pinStar": "t_j5va_pinStar",
-			"rowExpired": "t_j5va_rowExpired",
-			"pwMeter": "t_j5va_pwMeter",
-			"lockedBanner": "t_j5va_lockedBanner",
 			"modeAuto": "t_j5va_modeAuto",
-			"clearButton": "t_j5va_clearButton",
+			"addButton": "t_j5va_addButton",
 			"badgeDanger": "t_j5va_badgeDanger",
-			"modeAsk": "t_j5va_modeAsk",
-			"editorActions": "t_j5va_editorActions",
-			"policyBar": "t_j5va_policyBar",
+			"status": "t_j5va_status",
+			"reportBox": "t_j5va_reportBox",
+			"pinStar": "t_j5va_pinStar",
+			"dupMerge": "t_j5va_dupMerge",
 			"pwStrong": "t_j5va_pwStrong",
-			"healthBar": "t_j5va_healthBar",
-			"totpRing": "t_j5va_totpRing",
-			"section": "t_j5va_section",
+			"auditRow": "t_j5va_auditRow",
+			"auditIssues": "t_j5va_auditIssues",
+			"dupNames": "t_j5va_dupNames",
+			"modeAsk": "t_j5va_modeAsk",
+			"saveButton": "t_j5va_saveButton",
+			"detailItem": "t_j5va_detailItem",
+			"pwWeak": "t_j5va_pwWeak",
+			"trashButton": "t_j5va_trashButton",
+			"identity": "t_j5va_identity",
 			"toolbar": "t_j5va_toolbar",
-			"srOnly": "t_j5va_srOnly",
+			"kindFilter": "t_j5va_kindFilter",
+			"badgeWarn": "t_j5va_badgeWarn",
+			"searchBox": "t_j5va_searchBox",
+			"genOpts": "t_j5va_genOpts",
+			"pwBar": "t_j5va_pwBar",
+			"intro": "t_j5va_intro",
+			"totp": "t_j5va_totp",
+			"dupGroup": "t_j5va_dupGroup",
+			"reportSub": "t_j5va_reportSub",
+			"pwMeter": "t_j5va_pwMeter",
 			"highBadge": "t_j5va_highBadge",
+			"section": "t_j5va_section",
+			"checkField": "t_j5va_checkField",
+			"error": "t_j5va_error",
+			"field": "t_j5va_field",
+			"empty": "t_j5va_empty",
+			"title": "t_j5va_title",
+			"rowExpired": "t_j5va_rowExpired",
+			"modeReadonly": "t_j5va_modeReadonly",
+			"emptyHint": "t_j5va_emptyHint",
 			"row": "t_j5va_row",
-			"reportBox": "t_j5va_reportBox",
-			"editor": "t_j5va_editor",
-			"auditIssues": "t_j5va_auditIssues",
-			"addButton": "t_j5va_addButton"
+			"dueBadge": "t_j5va_dueBadge",
+			"deleteButton": "t_j5va_deleteButton",
+			"revealButton": "t_j5va_revealButton",
+			"backupButton": "t_j5va_backupButton",
+			"genOptRow": "t_j5va_genOptRow",
+			"srOnly": "t_j5va_srOnly",
+			"list": "t_j5va_list",
+			"policyField": "t_j5va_policyField",
+			"editorBody": "t_j5va_editorBody"
 		};
 		//#endregion
 		//#region src/client/VaultSection.tsx

package/lib/index.js

@@ -1574,7 +1574,36 @@ export async function apply(ctx, config) {
                     xml += `<username>${x(e.username ?? e.email)}</username>\n`;
                     xml += `<password>${x(e.password)}</password>\n`;
                     xml += `<url>${x(e.url)}</url>\n`;
-                    xml += `<notes>${x(e.notes)}</notes>\n</entry>\n`;
+                    xml += `<notes>${x(e.notes)}</notes>\n`;
+                    if (e.otpSecret !== undefined) {
+                        const uri = e.otpSecret.startsWith('otpauth://') ? e.otpSecret : `otpauth://totp/${encodeURIComponent(e.title)}?secret=${e.otpSecret}`;
+                        xml += `<otp><name>dsh-vault</name><otpauth>${x(uri)}</otpauth></otp>\n`;
+                    }
+                    const strings = [];
+                    if (e.host !== undefined)
+                        strings.push(['host', e.host]);
+                    if (e.port !== undefined)
+                        strings.push(['port', e.port]);
+                    if (e.apiKey !== undefined)
+                        strings.push(['apiKey', e.apiKey]);
+                    if (e.secret !== undefined)
+                        strings.push(['secret', e.secret]);
+                    if (e.accessToken !== undefined)
+                        strings.push(['accessToken', e.accessToken]);
+                    if (e.refreshToken !== undefined)
+                        strings.push(['refreshToken', e.refreshToken]);
+                    if (e.privateKey !== undefined)
+                        strings.push(['privateKey', e.privateKey]);
+                    if (e.expiresAt !== undefined)
+                        strings.push(['expiresAt', e.expiresAt]);
+                    if (e.rotationDays !== undefined)
+                        strings.push(['rotationDays', e.rotationDays]);
+                    for (const [k, v] of Object.entries(e.fields ?? {}))
+                        strings.push([k, v]);
+                    for (const [k, v] of strings) {
+                        xml += `<String><Key>${x(k)}</Key><Value>${x(v)}</Value></String>\n`;
+                    }
+                    xml += `</entry>\n`;
                 }
                 xml += `</group>\n`;
             }
@@ -1638,6 +1667,8 @@ export async function apply(ctx, config) {
                 url: header.indexOf('url'),
                 username: header.indexOf('username'),
                 password: header.indexOf('password'),
+                otpauth: header.indexOf('otpauth'),
+                notes: header.indexOf('notes'),
             };
             if (idx.name < 0 || idx.password < 0)
                 return { added: 0, skipped: rows.length - 1, updated: 0 };
@@ -1660,6 +1691,8 @@ export async function apply(ctx, config) {
                     ...(idx.url >= 0 && idx.url < row.length && row[idx.url] ? { url: row[idx.url] } : {}),
                     ...(idx.username >= 0 && idx.username < row.length && row[idx.username] ? { username: row[idx.username] } : {}),
                     ...(idx.password >= 0 && idx.password < row.length && row[idx.password] ? { password: row[idx.password] } : {}),
+                    ...(idx.otpauth >= 0 && idx.otpauth < row.length && row[idx.otpauth] ? { otpSecret: row[idx.otpauth] } : {}),
+                    ...(idx.notes >= 0 && idx.notes < row.length && row[idx.notes] ? { notes: row[idx.notes] } : {}),
                 };
                 const existing = s.list().find(e => e.title === name);
                 if (existing && !args.overwrite) {
@@ -2338,6 +2371,146 @@ export async function apply(ctx, config) {
             return { path: file, count: entries.length };
         },
     }));
+    // ── vault_import_bitwarden: import a Bitwarden JSON export ─────────────────
+    ctx.tools.register(defineTool({
+        name: 'vault_import_bitwarden',
+        description: 'Import a Bitwarden (or Vaultwarden) JSON export: maps each item into a vault entry '
+            + '(title, username/password, totp, notes, url, favorite, custom fields). Same-title entries are '
+            + 'skipped unless overwrite is set. Returns added/skipped/updated counts.',
+        parameters: {
+            path: { type: 'string', required: true, description: 'Absolute path of the Bitwarden .json export.' },
+            overwrite: { type: 'boolean', description: 'Update existing entries with the same title (default false).' },
+        },
+        output: { schema: { type: 'object', additionalProperties: false, properties: { added: { type: 'integer', required: true }, skipped: { type: 'integer', required: true }, updated: { type: 'integer', required: true } } }, render: (_a, v) => [{ type: 'text', text: `imported ${v.added}, updated ${v.updated}, skipped ${v.skipped}` }] },
+        async execute(args) {
+            assertWritable('vault_import_bitwarden');
+            const s = await guardStore();
+            const raw = JSON.parse(await readFile(args.path, 'utf8'));
+            const items = Array.isArray(raw.items) ? raw.items : [];
+            let added = 0;
+            let skipped = 0;
+            let updated = 0;
+            for (const item of items) {
+                const title = (item.name ?? '').trim();
+                if (!title) {
+                    skipped++;
+                    continue;
+                }
+                const patch = {};
+                const login = item.login;
+                if (login?.username !== undefined)
+                    patch.username = login.username;
+                if (login?.password !== undefined)
+                    patch.password = login.password;
+                if (login?.totp !== undefined)
+                    patch.otpSecret = login.totp;
+                const uri = login?.uris?.find(u => u.uri)?.uri;
+                if (uri !== undefined)
+                    patch.url = uri;
+                if (item.notes !== undefined && item.notes !== null)
+                    patch.notes = item.notes;
+                if (item.favorite === true)
+                    patch.favorite = true;
+                const fields = {};
+                for (const f of item.fields ?? []) {
+                    if (f.name !== undefined && f.value !== undefined)
+                        fields[f.name] = f.value;
+                }
+                // Promote known custom fields back onto the entry model.
+                for (const key of ['host', 'port', 'apiKey', 'secret', 'accessToken', 'refreshToken', 'privateKey', 'expiresAt', 'rotationDays']) {
+                    if (fields[key] !== undefined) {
+                        ;
+                        patch[key] = key === 'port' || key === 'expiresAt' || key === 'rotationDays' ? Number(fields[key]) : fields[key];
+                        delete fields[key];
+                    }
+                }
+                if (Object.keys(fields).length > 0)
+                    patch.fields = fields;
+                const existing = s.list().find(e => e.title === title);
+                if (existing && !args.overwrite) {
+                    skipped++;
+                    continue;
+                }
+                if (existing && args.overwrite) {
+                    await s.update(existing.id, patch);
+                    updated++;
+                    continue;
+                }
+                await s.add({ title, ...patch });
+                added++;
+            }
+            return { added, skipped, updated };
+        },
+    }));
+    // ── vault_export_bitwarden: Bitwarden-compatible JSON export ───────────────
+    ctx.tools.register(defineTool({
+        name: 'vault_export_bitwarden',
+        description: 'Export entries in the Bitwarden JSON format (encrypted:false) so they can be '
+            + 'imported into Bitwarden, Vaultwarden, or other tools that accept that format. Contains '
+            + 'plaintext secrets — write it to a protected file. Returns the output path and count.',
+        parameters: { path: { type: 'string', required: true, description: 'Absolute output .json path.' } },
+        output: { schema: { type: 'object', additionalProperties: false, properties: { path: { type: 'string', required: true }, count: { type: 'integer', required: true } } }, render: (_a, v) => [{ type: 'text', text: `exported ${v.count} entries to ${v.path}` }] },
+        async execute(args) {
+            assertWritable('vault_export_bitwarden');
+            const s = await guardStore();
+            const items = [];
+            for (const e of s.list()) {
+                const uris = e.url !== undefined ? [{ match: null, uri: e.url }] : null;
+                const login = {};
+                if (e.username !== undefined)
+                    login.username = e.username;
+                if (e.email !== undefined && login.username === undefined)
+                    login.username = e.email;
+                if (e.password !== undefined)
+                    login.password = e.password;
+                if (e.otpSecret !== undefined)
+                    login.totp = e.otpSecret;
+                if (uris !== null)
+                    login.uris = uris;
+                const fields = [];
+                for (const [k, v] of Object.entries(e.fields ?? {})) {
+                    if (typeof v === 'string' || typeof v === 'number' || typeof v === 'boolean') {
+                        fields.push({ name: k, value: String(v), type: 0 });
+                    }
+                }
+                if (e.host !== undefined)
+                    fields.push({ name: 'host', value: e.host, type: 0 });
+                if (e.port !== undefined)
+                    fields.push({ name: 'port', value: String(e.port), type: 0 });
+                if (e.apiKey !== undefined)
+                    fields.push({ name: 'apiKey', value: e.apiKey, type: 0 });
+                if (e.secret !== undefined)
+                    fields.push({ name: 'secret', value: e.secret, type: 0 });
+                if (e.accessToken !== undefined)
+                    fields.push({ name: 'accessToken', value: e.accessToken, type: 0 });
+                if (e.refreshToken !== undefined)
+                    fields.push({ name: 'refreshToken', value: e.refreshToken, type: 0 });
+                if (e.privateKey !== undefined)
+                    fields.push({ name: 'privateKey', value: e.privateKey, type: 0 });
+                if (e.rotationDays !== undefined)
+                    fields.push({ name: 'rotationDays', value: String(e.rotationDays), type: 0 });
+                if (e.expiresAt !== undefined)
+                    fields.push({ name: 'expiresAt', value: String(e.expiresAt), type: 0 });
+                items.push({
+                    id: e.id,
+                    organizationId: null,
+                    folderId: null,
+                    type: 1,
+                    reprompt: 0,
+                    name: e.title,
+                    notes: e.notes ?? null,
+                    favorite: e.favorite === true,
+                    login: Object.keys(login).length > 0 ? login : null,
+                    fields: fields.length > 0 ? fields : null,
+                    collectionIds: null,
+                });
+            }
+            const doc = { encrypted: false, folders: [], items };
+            await mkdir(dirname(args.path), { recursive: true, mode: 0o700 });
+            await writeFile(args.path, JSON.stringify(doc, null, 2), { mode: 0o600 });
+            return { path: args.path, count: items.length };
+        },
+    }));
     // ── vault_backup: one-shot backup with a timestamped filename ───────────────
     ctx.tools.register(defineTool({
         name: 'vault_backup',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-vault",
-  "version": "1.2.0-rc.2",
+  "version": "1.2.0-rc.3",
   "description": "Encrypted credential vault for DeepSeek Harness: store and retrieve usernames, emails, phone numbers, passwords, TOTP secrets, SSH/API-key/OAuth developer credentials through model tools and a Settings UI page.",
   "type": "module",
   "license": "MIT",