dsh-vault 1.2.0-rc.8 → 1.2.0

package/README-zh.md

@@ -61,6 +61,7 @@ dsh-vault 是一个面向 DeepSeek Harness 的安全加密插件：把你在使
 | `vault_health` | 保险库健康扫描：弱密码/复用凭据、未启用 2FA、不安全的 http:// 站点,以及整体安全评分（0–100） |
 | `vault_breach_check` | Watchtower 风格泄露扫描：对接 Have I Been Pwned（k-anonymity,仅发送 SHA-1 前缀）,附离线常见密码兜底 |
 | `vault_integrity` | 校验磁盘上的保险库文件可正确解密并与内存中的 store 一致 |
+| `vault_integrity` | 校验磁盘上的保险库文件可正确解密并与内存中的 store 一致 |
 | `vault_merge` | 合并一个条目到另一个；`keepSource: true` 保留源条目 |
 | `vault_quick_add` | 快速录入（标题 + 一个密钥），支持 tags/notes |
 | `vault_expiry` | 设置/清除过期（`expiresAt: 0` 移除） |
@@ -71,7 +72,9 @@ dsh-vault 是一个面向 DeepSeek Harness 的安全加密插件：把你在使
 | `vault_export` / `vault_import` | 整库加密备份/迁移（独立导出密码） |
 | `vault_fill` | 按 host/URL/用户名/标题匹配条目并返回其凭据 |
 | `vault_env` | 把标记 env 的条目（tags 含 `env`）渲染为 `KEY=VALUE` 行 |
-| `vault_templates` | 返回某类凭据（ssh/api-key/oauth 等）的推荐字段 |
+| `vault_export_bitwarden` / `vault_import_bitwarden` | Bitwarden/Vaultwarden JSON 互通（完整字段映射,支持覆盖） |
+| `vault_copy` | 复制条目（含密钥）到另一个命名保险库 |
+| `vault_templates` | 内建 + 用户自定义模板（save/list/remove,KeePassXC 风格） |
 
 **典型开发场景**：存一条 SSH 凭据（`kind: ssh` + host/port/username/password 或 privateKey），开发时让模型 `vault_search` 找主机、`vault_get` 取连接信息；存 API 网关的 `api-key`/`oauth` 条目管理 access/refresh token 轮换。
 

package/README.md

@@ -54,7 +54,7 @@ Each record has a `title`, an optional `kind`, and any combination of fields:
 | `vault_generate_password` | Generate a strong random password (length/classes/grouping) **or a memorable passphrase** (`passphrase: true`, EFF-style word list, `words`/`separator`/`wordDigits`) |
 | `vault_strength` | Zero-dependency password strength estimate (score 0–100, weak/fair/strong/very strong) |
 | `vault_rekey` | Upgrade the vault to fresh scrypt KDF parameters in place |
-| `vault_backup` | Timestamped encrypted backup with retention: prunes old copies beyond `maxBackups` (default 10) |
+| `vault_backup` | Timestamped encrypted backup with retention; optional `note` |
 | `vault_import_csv` | Bulk-import credentials from a CSV file (custom columns become fields; `overwrite: true` merges fields into existing entries instead of duplicating) |
 | `vault_apply_tags` | Bulk add/remove/replace tags on every entry matching a query (dry-run supported, no secrets) |
 | `vault_totp_uri` | Build an otpauth:// provisioning URI for a stored or bare TOTP secret |
@@ -63,6 +63,7 @@ Each record has a `title`, an optional `kind`, and any combination of fields:
 | `vault_health` | Vault health scan: weak/reused passwords, missing 2FA, insecure http:// sites, and an overall security score (0–100) |
 | `vault_breach_check` | Watchtower-style breach scan against Have I Been Pwned (k-anonymity: only the SHA-1 prefix leaves the machine), with an offline common-password fallback |
 | `vault_integrity` | Verify the on-disk vault file decrypts correctly and matches the in-memory store |
+| `vault_integrity` | Verify the on-disk vault file decrypts correctly and matches the in-memory store |
 | `vault_merge` | Merge one entry into another; `keepSource: true` keeps the source after merging |
 | `vault_quick_add` | Fast capture (title + one secret) with optional tags/notes |
 | `vault_expiry` | Set/clear expiry (`expiresAt: 0` removes it) |
@@ -73,7 +74,9 @@ Each record has a `title`, an optional `kind`, and any combination of fields:
 | `vault_export` / `vault_import` | Portable encrypted backup/migration of the whole vault (separate export password) |
 | `vault_fill` | Find the entry matching a host/URL/username/title and return its credentials |
 | `vault_env` | Render env-flagged entries (tags contain `env`) as `KEY=VALUE` lines |
-| `vault_templates` | List recommended fields for a credential kind (ssh / api-key / oauth / …) |
+| `vault_export_bitwarden` / `vault_import_bitwarden` | Bitwarden/Vaultwarden JSON interop (full field mapping, overwrite support) |
+| `vault_copy` | Copy an entry (secrets included) into another named vault |
+| `vault_templates` | Built-in + user-defined templates (save/list/remove), KeePassXC-style |
 
 **Typical workflows**: store an SSH credential (`kind: ssh` + host/port/username/password or privateKey) and have the model `vault_search` for the host then `vault_get` the connection details; keep `api-key`/`oauth` entries for API-gateway access/refresh token rotation.
 

package/lib/client.js

@@ -17,83 +17,83 @@ window.__ModuleLoader__.load({
 			document.head.appendChild(tag);
 		}
 		var VaultSection_module_css_default = {
-			"totpRing": "t_j5va_totpRing",
-			"rowActions": "t_j5va_rowActions",
-			"reportTitle": "t_j5va_reportTitle",
-			"dupMerge": "t_j5va_dupMerge",
-			"kindFilter": "t_j5va_kindFilter",
-			"clearButton": "t_j5va_clearButton",
-			"checkField": "t_j5va_checkField",
-			"retryButton": "t_j5va_retryButton",
-			"modeReadonly": "t_j5va_modeReadonly",
+			"lockedBanner": "t_j5va_lockedBanner",
+			"intro": "t_j5va_intro",
+			"toolbar": "t_j5va_toolbar",
+			"policyBar": "t_j5va_policyBar",
+			"editorBody": "t_j5va_editorBody",
 			"field": "t_j5va_field",
-			"highBadge": "t_j5va_highBadge",
-			"badgeDanger": "t_j5va_badgeDanger",
-			"trashButton": "t_j5va_trashButton",
-			"editorActions": "t_j5va_editorActions",
-			"dupNames": "t_j5va_dupNames",
-			"searchBox": "t_j5va_searchBox",
-			"pwMeter": "t_j5va_pwMeter",
-			"modeAsk": "t_j5va_modeAsk",
+			"reportLine": "t_j5va_reportLine",
+			"sortButton": "t_j5va_sortButton",
+			"deleteButton": "t_j5va_deleteButton",
+			"editor": "t_j5va_editor",
 			"healthBar": "t_j5va_healthBar",
-			"footer": "t_j5va_footer",
-			"editorBody": "t_j5va_editorBody",
-			"kindIcon": "t_j5va_kindIcon",
-			"detailItem": "t_j5va_detailItem",
-			"genOpts": "t_j5va_genOpts",
-			"addButton": "t_j5va_addButton",
-			"modeAuto": "t_j5va_modeAuto",
+			"checkField": "t_j5va_checkField",
+			"rowDue": "t_j5va_rowDue",
 			"badgeOk": "t_j5va_badgeOk",
-			"saveButton": "t_j5va_saveButton",
+			"emptyHint": "t_j5va_emptyHint",
+			"list": "t_j5va_list",
 			"section": "t_j5va_section",
-			"uriCode": "t_j5va_uriCode",
-			"srOnly": "t_j5va_srOnly",
-			"toolbar": "t_j5va_toolbar",
-			"error": "t_j5va_error",
-			"dueBadge": "t_j5va_dueBadge",
-			"rowExpired": "t_j5va_rowExpired",
-			"intro": "t_j5va_intro",
-			"rowDue": "t_j5va_rowDue",
-			"dangerButton": "t_j5va_dangerButton",
-			"pwBar": "t_j5va_pwBar",
-			"pwWeak": "t_j5va_pwWeak",
+			"rowActions": "t_j5va_rowActions",
 			"kindChip": "t_j5va_kindChip",
-			"pwLabel": "t_j5va_pwLabel",
-			"badgeWarn": "t_j5va_badgeWarn",
-			"title": "t_j5va_title",
-			"totp": "t_j5va_totp",
-			"badge": "t_j5va_badge",
-			"revealButton": "t_j5va_revealButton",
-			"scoreRing": "t_j5va_scoreRing",
-			"reportBox": "t_j5va_reportBox",
 			"emptyBox": "t_j5va_emptyBox",
-			"pinStar": "t_j5va_pinStar",
-			"reportSub": "t_j5va_reportSub",
-			"pwStrong": "t_j5va_pwStrong",
+			"badge": "t_j5va_badge",
 			"row": "t_j5va_row",
+			"genOpts": "t_j5va_genOpts",
+			"revealButton": "t_j5va_revealButton",
+			"auditRow": "t_j5va_auditRow",
+			"saveButton": "t_j5va_saveButton",
+			"trashButton": "t_j5va_trashButton",
+			"detailItem": "t_j5va_detailItem",
 			"identity": "t_j5va_identity",
-			"rowMain": "t_j5va_rowMain",
-			"editor": "t_j5va_editor",
-			"secretField": "t_j5va_secretField",
+			"badgeDanger": "t_j5va_badgeDanger",
+			"auditIssues": "t_j5va_auditIssues",
+			"pwMeter": "t_j5va_pwMeter",
 			"pwFair": "t_j5va_pwFair",
-			"emptyHint": "t_j5va_emptyHint",
+			"reportTitle": "t_j5va_reportTitle",
+			"reportSub": "t_j5va_reportSub",
+			"copied": "t_j5va_copied",
+			"title": "t_j5va_title",
+			"dupGroup": "t_j5va_dupGroup",
+			"addButton": "t_j5va_addButton",
+			"badgeWarn": "t_j5va_badgeWarn",
 			"resultCount": "t_j5va_resultCount",
-			"genOptRow": "t_j5va_genOptRow",
+			"secretField": "t_j5va_secretField",
+			"footer": "t_j5va_footer",
+			"pinStar": "t_j5va_pinStar",
+			"uriCode": "t_j5va_uriCode",
 			"empty": "t_j5va_empty",
-			"auditRow": "t_j5va_auditRow",
-			"dupGroup": "t_j5va_dupGroup",
-			"lockedBanner": "t_j5va_lockedBanner",
-			"deleteButton": "t_j5va_deleteButton",
-			"policyField": "t_j5va_policyField",
-			"auditIssues": "t_j5va_auditIssues",
-			"status": "t_j5va_status",
-			"copied": "t_j5va_copied",
-			"reportLine": "t_j5va_reportLine",
-			"detailBox": "t_j5va_detailBox",
-			"sortButton": "t_j5va_sortButton",
+			"reportBox": "t_j5va_reportBox",
+			"scoreRing": "t_j5va_scoreRing",
+			"rowExpired": "t_j5va_rowExpired",
+			"searchBox": "t_j5va_searchBox",
+			"dangerButton": "t_j5va_dangerButton",
+			"clearButton": "t_j5va_clearButton",
+			"pwWeak": "t_j5va_pwWeak",
+			"rowMain": "t_j5va_rowMain",
+			"dupNames": "t_j5va_dupNames",
 			"backupButton": "t_j5va_backupButton",
-			"policyBar": "t_j5va_policyBar",
-			"list": "t_j5va_list"
+			"modeAsk": "t_j5va_modeAsk",
+			"totpRing": "t_j5va_totpRing",
+			"highBadge": "t_j5va_highBadge",
+			"pwStrong": "t_j5va_pwStrong",
+			"totp": "t_j5va_totp",
+			"editorActions": "t_j5va_editorActions",
+			"detailBox": "t_j5va_detailBox",
+			"srOnly": "t_j5va_srOnly",
+			"status": "t_j5va_status",
+			"error": "t_j5va_error",
+			"retryButton": "t_j5va_retryButton",
+			"policyField": "t_j5va_policyField",
+			"genOptRow": "t_j5va_genOptRow",
+			"modeReadonly": "t_j5va_modeReadonly",
+			"kindIcon": "t_j5va_kindIcon",
+			"dueBadge": "t_j5va_dueBadge",
+			"modeAuto": "t_j5va_modeAuto",
+			"kindFilter": "t_j5va_kindFilter",
+			"pwBar": "t_j5va_pwBar",
+			"pwLabel": "t_j5va_pwLabel",
+			"dupMerge": "t_j5va_dupMerge"
 		};
 		//#endregion
 		//#region src/client/VaultSection.tsx

package/lib/index.js

@@ -1748,7 +1748,7 @@ export async function apply(ctx, config) {
                 return { added: 0, skipped: 0, updated: 0 };
             // Header may be name,url,username,password or url,name,username,password.
             const header = rows[0].map(h => h.trim().toLowerCase());
-            const idx = {
+            let idx = {
                 name: header.indexOf('name'),
                 url: header.indexOf('url'),
                 username: header.indexOf('username'),
@@ -1756,6 +1756,10 @@ export async function apply(ctx, config) {
                 otpauth: header.indexOf('otpauth'),
                 notes: header.indexOf('notes'),
             };
+            // LastPass export order: url,username,password,extra,name,grouping,fav
+            if (idx.name < 0 && header.length >= 5 && header[4] === 'name') {
+                idx = { name: 4, url: 0, username: 1, password: 2, otpauth: -1, notes: header.indexOf('extra') };
+            }
             if (idx.name < 0 || idx.password < 0)
                 return { added: 0, skipped: rows.length - 1, updated: 0 };
             let added = 0;
@@ -2269,10 +2273,9 @@ export async function apply(ctx, config) {
             overwrite: { type: 'boolean', description: 'Replace existing entries with the same id instead of merging (default false).' },
             dryRun: { type: 'boolean', description: 'Preview how many entries would be imported without writing anything (default false).' },
         },
-        output: { schema: { type: 'object', additionalProperties: false, properties: { imported: { type: 'integer', required: true } } }, render: (_a, v) => [{ type: 'text', text: `imported ${v.imported} entries` }] },
+        output: { schema: { type: 'object', additionalProperties: false, properties: { imported: { type: 'integer', required: true }, note: { type: 'string' } } }, render: (_a, v) => [{ type: 'text', text: v.note ?? `imported ${v.imported} entries` }] },
         async execute(args) {
             assertWritable('vault_import');
-            const exportPassword = resolveExportPassword(config);
             const s = await guardStore();
             if (args.path === undefined && args.blob === undefined) {
                 throw new Error('vault_import: provide either path or blob');
@@ -2281,8 +2284,68 @@ export async function apply(ctx, config) {
                 throw new Error('vault_import: blob exceeds 64 MiB — write it to a file and pass path instead');
             }
             const blob = args.path !== undefined ? await readFile(args.path, 'utf8') : args.blob;
+            // Auto-sniff: an unencrypted Bitwarden JSON export (encrypted:false +
+            // items[]) routes to the Bitwarden importer; anything else is treated as
+            // the portable encrypted dsh-vault document.
+            try {
+                const probe = JSON.parse(blob);
+                if (probe && probe.encrypted === false && Array.isArray(probe.items)) {
+                    let added = 0;
+                    let skipped = 0;
+                    let updated = 0;
+                    for (const item of probe.items) {
+                        const title = (item.name ?? '').trim();
+                        if (!title) {
+                            skipped++;
+                            continue;
+                        }
+                        const patch = {};
+                        const login = item.login;
+                        if (login?.username !== undefined)
+                            patch.username = login.username;
+                        if (login?.password !== undefined)
+                            patch.password = login.password;
+                        if (login?.totp !== undefined)
+                            patch.otpSecret = login.totp;
+                        const uri = login?.uris?.find((u) => u.uri)?.uri;
+                        if (uri !== undefined)
+                            patch.url = uri;
+                        if (item.notes)
+                            patch.notes = item.notes;
+                        const fields = {};
+                        for (const f of item.fields ?? []) {
+                            if (f.name !== undefined && f.value !== undefined)
+                                fields[f.name] = f.value;
+                        }
+                        for (const key of ['host', 'apiKey', 'secret', 'accessToken', 'refreshToken', 'privateKey']) {
+                            if (fields[key] !== undefined) {
+                                patch[key] = fields[key];
+                                delete fields[key];
+                            }
+                        }
+                        if (Object.keys(fields).length > 0)
+                            patch.fields = fields;
+                        const existing = s.list().find(e => e.title === title);
+                        if (existing && args.overwrite !== true) {
+                            skipped++;
+                            continue;
+                        }
+                        if (existing) {
+                            await s.update(existing.id, patch);
+                            updated++;
+                        }
+                        else {
+                            await s.add({ title, ...patch });
+                            added++;
+                        }
+                    }
+                    return { imported: added + updated, note: `sniffed Bitwarden JSON: added ${added}, updated ${updated}, skipped ${skipped}` };
+                }
+            }
+            catch { /* not JSON or not Bitwarden — fall through to encrypted import */ }
+            const exportPassword = resolveExportPassword(config);
             const count = await s.importEncrypted(blob, exportPassword, args.overwrite === true, args.dryRun === true);
-            return { imported: count };
+            return { imported: count, note: 'imported encrypted dsh-vault document' };
         },
     }));
     // ── vault_fill: find the credential that fits a target ─────────────────────
@@ -2463,6 +2526,7 @@ export async function apply(ctx, config) {
             + 'optionally filtered by kind. Writes to <vault dir>/vault-export-<ts>.csv and returns the path.',
         parameters: {
             path: { type: 'string', description: 'Optional absolute output path; defaults to <vault dir>/vault-export-<ts>.csv.' },
+            delimiter: { type: 'string', description: 'CSV delimiter (default ",").' },
             kind: { type: 'string', description: 'Only export entries of this kind (login/ssh/api-key/secret/oauth/custom).', enum: ['login', 'ssh', 'api-key', 'secret', 'oauth', 'custom'] },
             includeSecrets: { type: 'boolean', description: 'Include secret columns (password/apiKey/secret/tokens). Default false — the CSV is secret-free for safe handling.' },
             favoriteOnly: { type: 'boolean', description: 'Only export pinned (favorite) entries.' },
@@ -2486,7 +2550,8 @@ export async function apply(ctx, config) {
                 const str = v === undefined || v === null ? '' : Array.isArray(v) ? v.join(';') : String(v);
                 return `"${str.replace(/"/g, '""')}"`;
             };
-            const lines = [fields.join(',')];
+            const delim = args.delimiter ?? ',';
+            const lines = [fields.join(delim)];
             const MIN_LEN = 12;
             const now = Date.now();
             for (const e of entries) {
@@ -2497,7 +2562,7 @@ export async function apply(ctx, config) {
                 rec.no2fa = pw.length > 0 && (kind === 'login' || kind === 'ssh') && rec.otpSecret === undefined ? 'true' : 'false';
                 rec.httpSite = typeof rec.url === 'string' && /^http:\/\//i.test(rec.url) ? 'true' : 'false';
                 rec.expired = typeof rec.expiresAt === 'number' && rec.expiresAt < now ? 'true' : 'false';
-                lines.push(fields.map(f => esc(rec[f])).join(','));
+                lines.push(fields.map(f => esc(rec[f])).join(delim));
             }
             const file = args.path ?? join(dirname(resolveVaultPath(config)), `vault-export-${Date.now()}.csv`);
             await mkdir(dirname(file), { recursive: true, mode: 0o700 });
@@ -2651,8 +2716,11 @@ export async function apply(ctx, config) {
         description: 'Create a timestamped backup of the vault file (a copy of the on-disk encrypted '
             + 'document, not a plaintext export). Old backups beyond maxBackups (default 10) are pruned '
             + 'automatically (newest kept). Returns the backup path and retention stats.',
-        parameters: { maxBackups: { type: 'integer', description: 'Keep at most this many backups (default 10, min 1).' } },
-        output: { schema: { type: 'object', additionalProperties: false, properties: { path: { type: 'string', required: true }, kept: { type: 'integer', required: true }, pruned: { type: 'integer', required: true } } }, render: (_a, v) => [{ type: 'text', text: `backup written to ${v.path} (kept ${v.kept}, pruned ${v.pruned})` }] },
+        parameters: {
+            maxBackups: { type: 'integer', description: 'Keep at most this many backups (default 10, min 1).' },
+            note: { type: 'string', description: 'Optional note returned with the backup (e.g. why it was taken).' },
+        },
+        output: { schema: { type: 'object', additionalProperties: false, properties: { path: { type: 'string', required: true }, kept: { type: 'integer', required: true }, pruned: { type: 'integer', required: true }, note: { type: 'string' } } }, render: (_a, v) => [{ type: 'text', text: `backup written to ${v.path} (kept ${v.kept}, pruned ${v.pruned})${v.note !== undefined ? ' — ' + v.note : ''}` }] },
         async execute(args) {
             const s = await guardStore();
             const source = resolveVaultPath(config);
@@ -2686,7 +2754,7 @@ export async function apply(ctx, config) {
                 catch { /* best-effort */ }
             }
             void s;
-            return { path: backup, kept: Math.min(backups.length + 1, maxBackups), pruned };
+            return { path: backup, kept: Math.min(backups.length + 1, maxBackups), pruned, ...(typeof args.note === 'string' && args.note.length > 0 ? { note: args.note } : {}) };
         },
     }));
     // ── vault_import_csv: bulk import from a CSV file ───────────────────────────

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-vault",
-  "version": "1.2.0-rc.8",
+  "version": "1.2.0",
   "description": "Encrypted credential vault for DeepSeek Harness: store and retrieve usernames, emails, phone numbers, passwords, TOTP secrets, SSH/API-key/OAuth developer credentials through model tools and a Settings UI page.",
   "type": "module",
   "license": "MIT",