dsh-vault 1.6.0-rc.8 → 1.6.0

package/README-zh.md

@@ -58,6 +58,7 @@ dsh-vault 是一个面向 DeepSeek Harness 的安全加密插件：把你在使
 | `vault_rekey` | 原地升级 scrypt KDF 参数并重加密 |
 | `vault_backup` | 带时间戳的加密备份，支持保留策略：超过 `maxBackups`（默认 10）的旧备份自动清理 |
 | `vault_import_csv` | 从 CSV 批量导入凭据（自定义列变为 fields；`overwrite: true` 合并字段到已有条目，不再产生重复） |
+| `vault_bulk_delete` | 按 query/kind/tag 或显式 ids 批量软删除条目;需 `confirm: true`（默认仅试运行）;回收站可恢复 |
 | `vault_apply_tags` | 按查询批量增/删/替换条目标签（支持 dry-run，不含密钥） |
 | `vault_totp_uri` | 为存储的或裸 TOTP 密钥生成 otpauth:// 配置 URI |
 | `vault_switch` / `vault_list` | 按名称切换当前保险库 / 列出可用保险库 |
@@ -78,6 +79,7 @@ dsh-vault 是一个面向 DeepSeek Harness 的安全加密插件：把你在使
 | `vault_backup` / `vault_backup_now` | 时间戳加密备份,文件名 `<库名>-backups-YYYY-MM-DD_HH-MM-SS-<hex>.json`（库名+日期一目了然）;自动保留最近 N 份 |
 | `vault_restore_backup` | 从备份还原:`mode: "merge"`（默认）把备份条目复制进当前库,出现在条目列表;`mode: "replace"` 整体覆盖（先写安全快照） |
 | `vault_vault_rename` / `vault_vault_delete` | 重命名命名库（文件移动,当前会话跟随）或永久删除（default 库受保护） |
+| `vault_match_url` | 按 URL 查找匹配的登录条目（Bitwarden/1Password 风格:精确主机、子域、父域、路径前缀;www./端口归一化）,带 0–100 评分——绝不返回密码 |
 | `vault_fill` | 按 host/URL/用户名/标题匹配条目并返回其凭据 |
 | `vault_env` | 把标记 env 的条目（tags 含 `env`）渲染为 `KEY=VALUE` 行 |
 | `vault_export_bitwarden` / `vault_import_bitwarden` | Bitwarden/Vaultwarden JSON 互通（完整字段映射,支持覆盖） |
@@ -100,7 +102,7 @@ dsh-vault 是一个面向 DeepSeek Harness 的安全加密插件：把你在使
 | `vault_session_close` | 关闭已打开的浏览器登录会话（已收集的 cookie 仍保留在保险库中） |
 | `vault_session_prune` | 移除已保存会话中的过期 cookie（无过期的会话 cookie 保留）;`preview: true` 只报告不修改 |
 | `vault_copy` | 复制条目（含密钥）到另一个命名保险库 |
-| `vault_templates` | 内建 + 用户自定义模板（save/list/remove,KeePassXC 风格） |
+| `vault_templates` | 内建 + 用户自定义模板（save/list/remove,KeePassXC 风格）;内建模板新增 Wi-Fi、服务器、数据库、身份、银行账户、银行卡（借鉴 1Password） | 内建 + 用户自定义模板（save/list/remove,KeePassXC 风格） |
 
 **典型开发场景**：存一条 SSH 凭据（`kind: ssh` + host/port/username/password 或 privateKey），开发时让模型 `vault_search` 找主机、`vault_get` 取连接信息；存 API 网关的 `api-key`/`oauth` 条目管理 access/refresh token 轮换。
 

package/README.md

@@ -60,6 +60,7 @@ Each record has a `title`, an optional `kind`, and any combination of fields:
 | `vault_rekey` | Upgrade the vault to fresh scrypt KDF parameters in place |
 | `vault_backup` | Timestamped encrypted backup with retention; optional `note` |
 | `vault_import_csv` | Bulk-import credentials from a CSV file (custom columns become fields; `overwrite: true` merges fields into existing entries instead of duplicating) |
+| `vault_bulk_delete` | Soft-delete entries matching a query/kind/tag or explicit ids; `confirm: true` required (dry-run by default); trashed entries are restorable |
 | `vault_apply_tags` | Bulk add/remove/replace tags on every entry matching a query (dry-run supported, no secrets) |
 | `vault_totp_uri` | Build an otpauth:// provisioning URI for a stored or bare TOTP secret |
 | `vault_switch` / `vault_list` | Switch the active vault by name / list available vaults |
@@ -80,6 +81,7 @@ Each record has a `title`, an optional `kind`, and any combination of fields:
 | `vault_backup` / `vault_backup_now` | Timestamped encrypted backup named `<vault>-backups-YYYY-MM-DD_HH-MM-SS-<hex>.json` (owning vault + date visible); retention pruning keeps the newest N |
 | `vault_restore_backup` | Restore from a backup: `mode: "merge"` (default) copies the backup entries INTO the current vault so they appear in the entries list; `mode: "replace"` overwrites the whole vault with a safety snapshot first |
 | `vault_vault_rename` / `vault_vault_delete` | Rename a named vault (file moves, active session follows) or permanently delete one (default vault protected) |
+| `vault_match_url` | Find login entries matching a URL (Bitwarden/1Password-style: exact host, subdomain, parent domain, path-prefix; www./port normalization) with a 0–100 score — never returns the password |
 | `vault_fill` | Find the entry matching a host/URL/username/title and return its credentials |
 | `vault_env` | Render env-flagged entries (tags contain `env`) as `KEY=VALUE` lines |
 | `vault_export_bitwarden` / `vault_import_bitwarden` | Bitwarden/Vaultwarden JSON interop (full field mapping, overwrite support) |
@@ -102,7 +104,7 @@ Each record has a `title`, an optional `kind`, and any combination of fields:
 | `vault_session_close` | Close an open browser login session (collected cookies stay in the vault) |
 | `vault_session_prune` | Remove expired cookies from a saved session (session cookies are kept); `preview: true` reports without writing |
 | `vault_copy` | Copy an entry (secrets included) into another named vault |
-| `vault_templates` | Built-in + user-defined templates (save/list/remove), KeePassXC-style |
+| `vault_templates` | Built-in + user-defined templates (save/list/remove), KeePassXC-style; built-ins now include Wi-Fi, Server, Database, Identity, Bank account, Card (1Password-inspired) | Built-in + user-defined templates (save/list/remove), KeePassXC-style |
 
 **Typical workflows**: store an SSH credential (`kind: ssh` + host/port/username/password or privateKey) and have the model `vault_search` for the host then `vault_get` the connection details; keep `api-key`/`oauth` entries for API-gateway access/refresh token rotation.
 

package/lib/client.js

@@ -17,89 +17,89 @@ window.__ModuleLoader__.load({
 			document.head.appendChild(tag);
 		}
 		var VaultSection_module_css_default = {
-			"addButton": "t_j5va_addButton",
-			"genOptRow": "t_j5va_genOptRow",
-			"kindChip": "t_j5va_kindChip",
-			"rowDue": "t_j5va_rowDue",
-			"auditIssues": "t_j5va_auditIssues",
+			"rowExpired": "t_j5va_rowExpired",
+			"toolbar": "t_j5va_toolbar",
+			"status": "t_j5va_status",
+			"badge": "t_j5va_badge",
 			"detailItem": "t_j5va_detailItem",
-			"sortButton": "t_j5va_sortButton",
-			"auditRow": "t_j5va_auditRow",
-			"tabActive": "t_j5va_tabActive",
-			"dupNames": "t_j5va_dupNames",
-			"lockedTag": "t_j5va_lockedTag",
+			"pwFair": "t_j5va_pwFair",
+			"pwStrong": "t_j5va_pwStrong",
+			"copied": "t_j5va_copied",
+			"editorBody": "t_j5va_editorBody",
+			"addButton": "t_j5va_addButton",
+			"modeAuto": "t_j5va_modeAuto",
+			"scoreRing": "t_j5va_scoreRing",
 			"tabs": "t_j5va_tabs",
-			"checkField": "t_j5va_checkField",
-			"empty": "t_j5va_empty",
+			"reportLine": "t_j5va_reportLine",
 			"secretField": "t_j5va_secretField",
-			"detailBox": "t_j5va_detailBox",
-			"pwBar": "t_j5va_pwBar",
-			"section": "t_j5va_section",
-			"emptyHint": "t_j5va_emptyHint",
+			"badgeDanger": "t_j5va_badgeDanger",
 			"backupButton": "t_j5va_backupButton",
-			"dueBadge": "t_j5va_dueBadge",
-			"title": "t_j5va_title",
-			"reportBox": "t_j5va_reportBox",
-			"pwWeak": "t_j5va_pwWeak",
-			"copied": "t_j5va_copied",
-			"list": "t_j5va_list",
-			"resultCount": "t_j5va_resultCount",
-			"healthBar": "t_j5va_healthBar",
-			"modeAsk": "t_j5va_modeAsk",
-			"editorActions": "t_j5va_editorActions",
-			"identity": "t_j5va_identity",
-			"rowMain": "t_j5va_rowMain",
-			"field": "t_j5va_field",
-			"reportTitle": "t_j5va_reportTitle",
+			"modeReadonly": "t_j5va_modeReadonly",
+			"uriCode": "t_j5va_uriCode",
 			"badgeOk": "t_j5va_badgeOk",
-			"lockedBanner": "t_j5va_lockedBanner",
-			"kindFilter": "t_j5va_kindFilter",
-			"deleteButton": "t_j5va_deleteButton",
-			"retryButton": "t_j5va_retryButton",
-			"pinStar": "t_j5va_pinStar",
-			"srOnly": "t_j5va_srOnly",
-			"scoreRing": "t_j5va_scoreRing",
-			"modeAuto": "t_j5va_modeAuto",
-			"genOpts": "t_j5va_genOpts",
-			"rowExpired": "t_j5va_rowExpired",
-			"editorBody": "t_j5va_editorBody",
-			"error": "t_j5va_error",
+			"searchBox": "t_j5va_searchBox",
 			"row": "t_j5va_row",
-			"dupGroup": "t_j5va_dupGroup",
-			"uriCode": "t_j5va_uriCode",
+			"dupNames": "t_j5va_dupNames",
+			"reportTitle": "t_j5va_reportTitle",
+			"highBadge": "t_j5va_highBadge",
+			"tabActive": "t_j5va_tabActive",
+			"error": "t_j5va_error",
+			"rowActions": "t_j5va_rowActions",
+			"pwBar": "t_j5va_pwBar",
 			"emptyBox": "t_j5va_emptyBox",
-			"toolbar": "t_j5va_toolbar",
-			"searchBox": "t_j5va_searchBox",
-			"intro": "t_j5va_intro",
-			"saveButton": "t_j5va_saveButton",
-			"pwLabel": "t_j5va_pwLabel",
-			"reportLine": "t_j5va_reportLine",
-			"revealButton": "t_j5va_revealButton",
-			"badge": "t_j5va_badge",
-			"tab": "t_j5va_tab",
-			"dupMerge": "t_j5va_dupMerge",
-			"modeReadonly": "t_j5va_modeReadonly",
-			"footer": "t_j5va_footer",
-			"pwFair": "t_j5va_pwFair",
+			"rowMain": "t_j5va_rowMain",
+			"empty": "t_j5va_empty",
+			"lockedTag": "t_j5va_lockedTag",
+			"totp": "t_j5va_totp",
+			"modeAsk": "t_j5va_modeAsk",
+			"healthBar": "t_j5va_healthBar",
+			"kindIcon": "t_j5va_kindIcon",
+			"genHist": "t_j5va_genHist",
+			"section": "t_j5va_section",
+			"totpRing": "t_j5va_totpRing",
 			"dangerButton": "t_j5va_dangerButton",
-			"status": "t_j5va_status",
-			"pwStrong": "t_j5va_pwStrong",
-			"tabPane": "t_j5va_tabPane",
-			"highBadge": "t_j5va_highBadge",
+			"reportSub": "t_j5va_reportSub",
+			"dupGroup": "t_j5va_dupGroup",
+			"genOptRow": "t_j5va_genOptRow",
+			"editor": "t_j5va_editor",
+			"auditIssues": "t_j5va_auditIssues",
 			"pwMeter": "t_j5va_pwMeter",
+			"srOnly": "t_j5va_srOnly",
+			"genOpts": "t_j5va_genOpts",
+			"sortButton": "t_j5va_sortButton",
+			"emptyHint": "t_j5va_emptyHint",
+			"trashButton": "t_j5va_trashButton",
+			"tab": "t_j5va_tab",
+			"rowDue": "t_j5va_rowDue",
+			"auditRow": "t_j5va_auditRow",
 			"clearButton": "t_j5va_clearButton",
-			"totpRing": "t_j5va_totpRing",
-			"policyBar": "t_j5va_policyBar",
-			"editor": "t_j5va_editor",
-			"kindIcon": "t_j5va_kindIcon",
-			"genHist": "t_j5va_genHist",
+			"resultCount": "t_j5va_resultCount",
+			"lockedBanner": "t_j5va_lockedBanner",
+			"field": "t_j5va_field",
 			"policyField": "t_j5va_policyField",
-			"totp": "t_j5va_totp",
-			"rowActions": "t_j5va_rowActions",
-			"reportSub": "t_j5va_reportSub",
+			"reportBox": "t_j5va_reportBox",
+			"editorActions": "t_j5va_editorActions",
+			"dueBadge": "t_j5va_dueBadge",
+			"footer": "t_j5va_footer",
+			"checkField": "t_j5va_checkField",
+			"detailBox": "t_j5va_detailBox",
+			"dupMerge": "t_j5va_dupMerge",
+			"pwLabel": "t_j5va_pwLabel",
+			"deleteButton": "t_j5va_deleteButton",
+			"identity": "t_j5va_identity",
+			"saveButton": "t_j5va_saveButton",
+			"revealButton": "t_j5va_revealButton",
 			"badgeWarn": "t_j5va_badgeWarn",
-			"badgeDanger": "t_j5va_badgeDanger",
-			"trashButton": "t_j5va_trashButton"
+			"policyBar": "t_j5va_policyBar",
+			"pinStar": "t_j5va_pinStar",
+			"retryButton": "t_j5va_retryButton",
+			"pwWeak": "t_j5va_pwWeak",
+			"intro": "t_j5va_intro",
+			"tabPane": "t_j5va_tabPane",
+			"kindChip": "t_j5va_kindChip",
+			"title": "t_j5va_title",
+			"kindFilter": "t_j5va_kindFilter",
+			"list": "t_j5va_list"
 		};
 		//#endregion
 		//#region src/client/VaultSection.tsx
@@ -265,6 +265,23 @@ window.__ModuleLoader__.load({
 				color: ""
 			};
 		}
+		/** Human label for a built-in template name (`builtin:wifi` → Wi-Fi). */
+		function templateLabel(name) {
+			return {
+				"builtin:login": "Login",
+				"builtin:ssh": "SSH",
+				"builtin:api-key": "API key",
+				"builtin:oauth": "OAuth",
+				"builtin:secret": "Secret",
+				"builtin:card": "Card",
+				"builtin:wifi": "Wi-Fi",
+				"builtin:server": "Server",
+				"builtin:database": "Database",
+				"builtin:identity": "Identity",
+				"builtin:bank": "Bank account",
+				"builtin:custom": "Custom"
+			}[name] ?? name;
+		}
 		/** Render the Vault settings section. */
 		function VaultSection(props) {
 			const { t, config, setAccessMode, setAutoCapture, list, search, get, add, update, remove, trash, rotation, health, duplicates, duplicateGroups, merge, history, stats, backupStatus, backup, recent, restore, undeleteAll, totp, status, switchVault, listVaults, touch, verifyAll, breachCheck, generatePassword, strength, generateUsername, templates, saveTemplate, lock, totpUri, tags, renameTag, generatorHistory, backups, deleteBackup, restoreBackup, importChrome, importFirefox, import1password, importManagerCsv, importEnpass, importBitwarden, import1pif, importKeePassXml, importKdbx, importBitwardenEncrypted, keychainImport, searchSystem, sessionOpen, sessionCollect, sessionClose, sessionListOpen, sessionListSaved, sessionSave, sessionExport, sessionGet, sessionPrune, vaultRename, vaultDelete, watchtower, export1pux, exportBitwarden, recoveryCode, verifyRecovery, recoveryStatus } = props;
@@ -3079,7 +3096,7 @@ window.__ModuleLoader__.load({
 												children: "—"
 											}), tplList.map((tpl) => /* @__PURE__ */ (0, react_jsx_runtime.jsx)("option", {
 												value: tpl.name,
-												children: tpl.name
+												children: templateLabel(tpl.name)
 											}, tpl.name))]
 										})]
 									}), editor.status === "editing" && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {