keyshroud 0.5.1 → 0.5.2

package/CHANGELOG.md

@@ -3,6 +3,25 @@
 All notable changes are documented here. This project follows
 [Semantic Versioning](https://semver.org/).
 
+## [Unreleased]
+
+## [0.5.2] - 2026-10-15
+
+### Added
+- `keyshroud import`: moves the secrets in a `.env` into the vault and writes
+  `.env.refs`. Dry run with names only by default, `--yes` to write; values are
+  verified after storing, never printed, and `--replace` rewrites the source
+  atomically without a backup.
+
+- `add`/`rotate` without a terminal, and the `secrets_request` MCP tool, open a
+  native hidden-input dialog (macOS `osascript`, Linux `zenity`/`kdialog`), so
+  an agent can start the command and the user only pastes. `--dialog` forces it.
+
+### Changed
+- The `add` and `rotate` prompts echo `*` per character (a count after 24) so
+  typing and pastes are visible without showing the value; Backspace, Ctrl-U
+  and Ctrl-C work as in a password prompt.
+
 ## [0.5.1] - 2026-10-14
 
 ### Added

package/README.md

@@ -19,7 +19,7 @@ secrets stay in your own self-hosted [Vaultwarden](https://github.com/dani-garci
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 [![Node](https://img.shields.io/node/v/keyshroud.svg)](package.json)
 
-[🚀 Quickstart](#quickstart) · [🔌 Supported agents](#supported-agents) · [⚙️ How it works](#how-it-works) · [❓ FAQ](#faq) · [🛡️ Security model](#security-model) · [🌐 Website](https://keyshroud.dev)
+[🚀 Quickstart](#quickstart) · [🔐 Vault setup](examples/vaultwarden#readme) · [🔌 Supported agents](#supported-agents) · [⚙️ How it works](#how-it-works) · [❓ FAQ](#faq) · [🛡️ Security model](#security-model) · [🌐 Website](https://keyshroud.dev)
 
 [🇻🇳 Tiếng Việt](i18n/README.vi.md) · [🇨🇳 简体中文](i18n/README.zh-CN.md) · [🇯🇵 日本語](i18n/README.ja-JP.md)
 
@@ -82,9 +82,9 @@ webhooks, databases. The usual options are bad:
 
 ## Use cases
 
-**"Claude Code keeps reading my `.env`."** Move the values into the vault, commit a
-`.env.refs` file with `GH_TOKEN=bw://GitHub CLI token`, and start the agent with
-`keyshroud run -- claude`. The plugin's hooks mask anything that still slips into a tool result.
+**"Claude Code keeps reading my `.env`."** Run `keyshroud import` to move the values into
+the vault and write a `.env.refs` file with lines like `GH_TOKEN=bw://myapp GH_TOKEN`, then start
+the agent with `keyshroud run --env-file .env.refs -- claude`. The plugin's hooks mask anything that still slips into a tool result.
 
 **"I already self-host Vaultwarden."** Point `bw` at it, run `keyshroud doctor`, and you
 are done — keyshroud adds no server of its own.
@@ -92,18 +92,24 @@ are done — keyshroud adds no server of its own.
 **"I like `op run` but don't want 1Password."** `keyshroud run` is the same idea —
 references in, masked output out — on a vault you host.
 
-**"My agent needs to add a new key."** It calls `secrets_request` (MCP) or `/secret` (pi);
-you type the value into a masked prompt in your own terminal. It never enters the chat.
+**"My agent needs to add a new key."** It runs `keyshroud add` or calls `secrets_request` (MCP),
+and a hidden-input dialog pops up on your desktop; in pi it is `/secret`. You paste the value
+there. It never enters the chat.
 
 ## Quickstart
 
-**Requirements:** Node.js ≥ 22.18, the Bitwarden CLI (`npm i -g @bitwarden/cli`),
-and a Vaultwarden or Bitwarden account. No server yet?
-[examples/vaultwarden](examples/vaultwarden) runs Vaultwarden behind Caddy
-(automatic HTTPS) with one `docker compose up -d`.
+**Requirements:** Node.js ≥ 22.18, the Bitwarden CLI, and a vault.
+
+**0. Get a vault** — pick one:
+
+- **Self-host Vaultwarden** (free, your server): follow
+  [examples/vaultwarden](examples/vaultwarden#readme) — Docker Compose + Caddy with automatic HTTPS,
+  from an empty VPS to `keyshroud doctor`, plus backups and hardening.
+- **Bitwarden cloud** (free account, no server): sign up at [bitwarden.com](https://bitwarden.com)
+  and skip `bw config server` below (EU accounts: `bw config server https://vault.bitwarden.eu`).
 
 ```bash
-npm install -g keyshroud
+npm install -g keyshroud @bitwarden/cli    # or: brew install bitwarden-cli
 
 # 1. Point bw at your server and log in once
 bw config server https://vault.example.com
@@ -126,7 +132,8 @@ keyshroud run -- claude          # start an agent with every wired secret availa
 
 Optional: put `vaultwarden-api-client-id` / `vaultwarden-api-client-secret` (from
 *Settings → Security → Keys → API key*) in the keychain too, and keyshroud will
-also re-login automatically when the `bw` session expires.
+also re-login automatically when the `bw` session expires. Linux keyring commands
+and a headless-server option are in the [vault setup guide](examples/vaultwarden#4-let-keyshroud-unlock-without-prompting).
 
 ## How it works
 
@@ -250,7 +257,7 @@ OpenCode: `opencode mcp add keyshroud -- keyshroud mcp`.
 |---|---|---|
 | `secrets_list` | Lists wired names (+ optional `env_file`) | resolved / unresolved names |
 | `secrets_run` | Runs a shell command with secrets injected (`only`, `env_file`, `cwd`, `timeout_ms`) | exit code + masked stdout/stderr |
-| `secrets_request` | Asks the human to store a new secret | a `keyshroud add …` command for *their* terminal |
+| `secrets_request` | Opens a hidden-input dialog on the user's desktop and stores the value | `created … verified=yes`, or a `keyshroud add …` command for *their* terminal when no dialog can be shown |
 | `vault_status` | Vault lock state, server, item count | status line |
 
 ## CLI reference
@@ -262,8 +269,9 @@ keyshroud inject [-i template] [-o out] [--force]
 keyshroud redact < log.txt
 keyshroud scan [paths...]
 keyshroud env [--shell]
-keyshroud add --env NAME --item ITEM [--notes TEXT] [--target pi|omp|both] [--stdin]
-keyshroud rotate --item ITEM [--stdin]
+keyshroud add --env NAME --item ITEM [--notes TEXT] [--target pi|omp|both] [--stdin|--dialog]
+keyshroud import [--from F|-] [--out F] [--prefix P] [--only A,B] [--skip A,B] [--yes] [--replace] [--force]
+keyshroud rotate --item ITEM [--stdin|--dialog]
 keyshroud wire --env NAME --item ITEM [--target pi|omp|both] [--force]
 keyshroud unwire --env NAME [--target pi|omp|both]
 keyshroud status | unlock | lock | doctor
@@ -278,6 +286,27 @@ keyshroud link-cli [--dir DIR] [--force]
 passes the TTY through untouched for interactive use. Force either way with
 `--mask` / `--no-mask`. `exec` is an alias of `run`.
 
+`add` and `rotate` read the value from a masked prompt that shows `*` per
+character. Without a terminal (an agent's shell), they open a native hidden-input
+dialog instead (`osascript` on macOS, `zenity` or `kdialog` on Linux), so the agent
+can start the command and you only paste. Over SSH or without a display, pipe the
+value with `--stdin`.
+
+`import` reads a `.env` (default `./.env`), decides which lines are secrets (by name, such as
+`*_TOKEN` or `*_KEY`, or by value, such as `sk-…` or a URL with a password), and prints a plan of
+names only. Nothing is written until you add `--yes`: it then creates one vault item per secret,
+named `<prefix> NAME` (prefix defaults to the directory name), reads each value back to verify it,
+and writes `.env.refs` with comments and non-secret lines kept. Re-running reuses items that already
+hold the same value and stops on a conflicting one. `--replace` rewrites the source file in place
+instead (atomically, no backup copy). Multiline values, `${VAR}` expansion and duplicate keys are
+rejected with the line number, never the value.
+
+```bash
+keyshroud import                 # dry run: which names would move
+keyshroud import --yes           # store them and write .env.refs
+keyshroud run --env-file .env.refs -- npm test
+```
+
 **Exit codes:** `0` ok · `2` usage · `3` vault locked or unavailable · `4` secret
 missing or item name ambiguous · `5` refusing to overwrite existing state.
 `run` exits with the child's code.

package/dist/cli.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
-import { chmod, copyFile, mkdir, lstat, readdir, readFile, readlink, symlink, unlink, writeFile } from "node:fs/promises";
+import { chmod, copyFile, mkdir, lstat, readdir, readFile, readlink, rename, stat, symlink, unlink, writeFile } from "node:fs/promises";
 import { constants, homedir } from "node:os";
 import { fileURLToPath } from "node:url";
-import { join, resolve } from "node:path";
+import { basename, dirname, join, relative, resolve } from "node:path";
 import { spawn } from "node:child_process";
 import process from "node:process";
 import { BRAND } from "./brand.js";
@@ -10,7 +10,7 @@ import * as core from "./core.js";
 import { runClaudeHook } from "./hooks.js";
 import { serveMcp } from "./mcp.js";
 import { buildRedactIndex, compileRedactIndex, createRedactor, createRedactStream } from "./redact.js";
-import { ENV_NAME_RE, parseRef } from "./refs.js";
+import { ENV_NAME_RE, isRef, looksSecret, parseDotenvStrict, parseRef } from "./refs.js";
 const usage = `Usage: ${BRAND.bin} <command> [options]
 
 Secrets
@@ -21,8 +21,11 @@ Secrets
   redact                           Copy stdin to stdout with vault secrets masked
   scan [paths...]                  Find vault secret values in files (exit 1 on leaks)
   env [--shell]                    List wired names (or print shell exports)
-  add --env NAME --item ITEM [--notes TEXT] [--target pi|omp|both] [--stdin]
-  rotate --item ITEM [--stdin]
+  add --env NAME --item ITEM [--notes TEXT] [--target pi|omp|both] [--stdin|--dialog]
+  import [--from F|-] [--out F] [--prefix P] [--only A,B] [--skip A,B] [--yes] [--replace] [--force]
+                                   Move secrets from a .env into the vault and write .env.refs
+                                   (dry run unless --yes; prints names only)
+  rotate --item ITEM [--stdin|--dialog]
   wire --env NAME --item ITEM [--target pi|omp|both] [--force]
   unwire --env NAME [--target pi|omp|both]
 
@@ -60,6 +63,21 @@ function targetList(value) {
         return [targetPaths.pi];
     fail("--target must be omp, pi, or both", 2);
 }
+// Terminal: masked prompt. No terminal (an agent's shell) and no --stdin: a native
+// dialog, so the agent can start the command and the user only pastes.
+async function readSecret(args, prompt, label, itemName) {
+    const forced = args.includes("--dialog");
+    if (forced || (!args.includes("--stdin") && !process.stdin.isTTY)) {
+        const value = await core.readSecretFromDialog({ label, itemName });
+        if (value)
+            return value;
+        if (value === "")
+            throw new Error("Empty secret");
+        if (forced)
+            fail("No dialog available here (SSH or no display). Run the command in a terminal, or pipe the value with --stdin.", 2);
+    }
+    return core.readSecretFromInput({ prompt, stdin: args.includes("--stdin") });
+}
 function shellQuote(value) { return `'${value.replaceAll("'", "'\\''")}'`; }
 function failureCode(error) {
     const text = error instanceof Error ? error.message : String(error);
@@ -216,6 +234,128 @@ async function scan(paths) {
     if (leaks)
         process.exitCode = 1;
 }
+async function importCommand(args) {
+    requireKnownFlags(args, ["--from", "--out", "--prefix", "--only", "--skip"], ["--yes", "--replace", "--force"]);
+    const from = valueAfter(args, "--from") ?? ".env";
+    const yes = args.includes("--yes");
+    const replace = args.includes("--replace");
+    if (replace && (from === "-" || valueAfter(args, "--out")))
+        fail("--replace rewrites the --from file; it cannot be combined with stdin or --out", 2);
+    if (from === "-" && process.stdin.isTTY)
+        fail("--from - needs the .env piped on stdin", 2);
+    const baseDir = from === "-" ? process.cwd() : dirname(resolve(from));
+    const out = replace ? resolve(from) : resolve(valueAfter(args, "--out") ?? join(baseDir, ".env.refs"));
+    const prefix = valueAfter(args, "--prefix") ?? basename(baseDir);
+    if (!/^[A-Za-z0-9._-]+$/.test(prefix))
+        fail("--prefix may contain only letters, digits, '.', '_' and '-' (set it with --prefix)", 2);
+    const list = (flag) => (valueAfter(args, flag) ?? "").split(",").map((name) => name.trim()).filter(Boolean);
+    const only = list("--only");
+    const skip = list("--skip");
+    let text;
+    try {
+        text = from === "-" ? await readStdin() : await readFile(from, "utf8");
+    }
+    catch {
+        fail(`Cannot read ${from}`, 2);
+    }
+    const { entries, errors } = parseDotenvStrict(text);
+    if (errors.length) {
+        for (const error of errors)
+            console.error(`${from}:${error.line} ${error.reason}`);
+        fail(`${errors.length} line(s) cannot be imported safely; fix them or move them out of the file`, 2);
+    }
+    for (const name of [...only, ...skip])
+        if (!entries.some((entry) => entry.name === name))
+            fail(`--only/--skip name not in ${from}: ${name}`, 2);
+    await core.ensureSession();
+    const existing = await core.findItems(prefix);
+    const rows = [];
+    for (const entry of entries) {
+        if (isRef(entry.value)) {
+            rows.push({ entry, kind: "ref" });
+            continue;
+        }
+        const secret = (only.length ? only.includes(entry.name) : looksSecret(entry.name, entry.value)) && !skip.includes(entry.name);
+        if (!secret) {
+            rows.push({ entry, kind: "literal" });
+            continue;
+        }
+        const item = `${prefix} ${entry.name}`;
+        const matches = existing.filter((candidate) => candidate.name.toLowerCase() === item.toLowerCase());
+        if (matches.length > 1) {
+            rows.push({ entry, item, kind: "conflict", note: "more than one vault item has this name" });
+            continue;
+        }
+        if (matches.length === 0) {
+            rows.push({ entry, item, kind: "new" });
+            continue;
+        }
+        const current = await core.resolveRef({ item: matches[0].id, field: "password" });
+        rows.push(current === entry.value
+            ? { entry, item, kind: "reuse", note: "same value already in the vault" }
+            : { entry, item, kind: "conflict", note: "vault item exists with a different value" });
+    }
+    const width = Math.max(4, ...rows.map((row) => row.entry.name.length));
+    console.log(`import plan for ${from} (item prefix "${prefix}")`);
+    for (const row of rows) {
+        const label = row.kind === "literal" ? "literal   kept" : row.kind === "ref" ? "reference kept"
+            : row.kind === "conflict" ? `secret    conflict: ${row.note} ("${row.item}")`
+                : `secret    ${row.kind.padEnd(8)} -> bw://${row.item}${row.note ? `  (${row.note})` : ""}`;
+        const short = row.item && row.entry.value.length < 6 ? "  [under 6 characters: stored, but too short to be masked]" : "";
+        console.log(`  ${row.entry.name.padEnd(width)}  ${label}${short}`);
+    }
+    const count = (kind) => rows.filter((row) => row.kind === kind).length;
+    const toStore = rows.filter((row) => row.kind === "new" || row.kind === "reuse");
+    console.log(`${toStore.length + count("conflict")} secret(s): ${count("new")} new, ${count("reuse")} already in the vault, ${count("conflict")} conflict(s); ${count("literal")} literal(s), ${count("ref")} reference(s)`);
+    if (count("conflict"))
+        fail("Resolve the conflicts (choose another --prefix, or rename the vault items) before importing", 5);
+    if (!toStore.length) {
+        console.log("Nothing to import.");
+        return;
+    }
+    const outExists = await stat(out).then(() => true, () => false);
+    if (outExists && !replace && !args.includes("--force"))
+        fail(`${out} already exists; use --force to overwrite it`, 5);
+    if (!yes) {
+        console.log(`Dry run: nothing written. Re-run with --yes to create ${count("new")} item(s) and write ${out}`);
+        return;
+    }
+    const created = [];
+    for (const row of rows) {
+        if (row.kind !== "new")
+            continue;
+        try {
+            await core.createSecretItem({ itemName: row.item, secret: row.entry.value, envName: row.entry.name, notes: `Imported by ${BRAND.bin} from ${basename(from === "-" ? "stdin" : from)}` });
+        }
+        catch {
+            if (created.length)
+                console.error(`Created before the failure: ${created.join(", ")}`);
+            fail(`Failed to create the vault item for ${row.entry.name}; nothing was written to ${out}`, 3);
+        }
+        created.push(row.entry.name);
+    }
+    for (const row of toStore) {
+        let value = null;
+        try {
+            value = await core.resolveRef({ item: row.item, field: "password" });
+        }
+        catch { }
+        if (value !== row.entry.value)
+            fail(`Verification failed for ${row.entry.name}: the vault does not return the imported value; nothing was written to ${out}`, 4);
+    }
+    const eol = text.includes("\r\n") ? "\r\n" : "\n";
+    const lines = text.split(/\r?\n/);
+    for (const row of toStore)
+        lines[row.entry.line - 1] = `${row.entry.exported ? "export " : ""}${row.entry.name}=bw://${row.item}`;
+    const mode = replace ? (await stat(out)).mode & 0o777 : 0o644;
+    const tmp = `${out}.tmp.${process.pid}`;
+    await writeFile(tmp, lines.join(eol), { mode });
+    await rename(tmp, out);
+    await core.audit("import", toStore.map((row) => row.entry.name), "cli");
+    console.log(`imported ${toStore.length} secret(s) (${created.length} new); wrote ${out}`);
+    if (!replace && from !== "-")
+        console.log(`${from} still holds the plaintext values. Check with \`${BRAND.bin} run --env-file ${relative(process.cwd(), out) || out} -- <cmd>\`, then delete it or re-run with --replace.`);
+}
 async function main() {
     const args = process.argv.slice(2);
     const command = args.shift();
@@ -320,7 +460,7 @@ async function main() {
             return;
         }
         if (command === "add") {
-            requireKnownFlags(args, ["--env", "--item", "--notes", "--target"], ["--stdin"]);
+            requireKnownFlags(args, ["--env", "--item", "--notes", "--target"], ["--stdin", "--dialog"]);
             const envName = valueAfter(args, "--env");
             const itemName = valueAfter(args, "--item");
             const notes = valueAfter(args, "--notes");
@@ -329,7 +469,7 @@ async function main() {
             const reference = core.referenceFor(itemName);
             const targets = targetList(valueAfter(args, "--target"));
             await core.ensureSession();
-            const secret = await core.readSecretFromInput({ prompt: `Paste secret for ${envName}: `, stdin: args.includes("--stdin") });
+            const secret = await readSecret(args, `Paste secret for ${envName}: `, envName, itemName);
             await core.createSecretItem({ itemName, secret, envName, notes });
             let conflict = false;
             for (const path of targets) {
@@ -345,13 +485,17 @@ async function main() {
             }
             return;
         }
+        if (command === "import") {
+            await importCommand(args);
+            return;
+        }
         if (command === "rotate") {
-            requireKnownFlags(args, ["--item"], ["--stdin"]);
+            requireKnownFlags(args, ["--item"], ["--stdin", "--dialog"]);
             const itemName = valueAfter(args, "--item");
             if (!itemName)
                 fail(usage, 2);
             await core.ensureSession();
-            const secret = await core.readSecretFromInput({ prompt: "Paste replacement secret: ", stdin: args.includes("--stdin") });
+            const secret = await readSecret(args, "Paste replacement secret: ", `the new value of ${itemName}`, itemName);
             await core.rotateSecretItem({ itemName, secret });
             console.log(`rotated item=${itemName}`);
             return;

package/dist/core.d.ts

@@ -103,3 +103,7 @@ export declare function readSecretFromInput(opts: {
     prompt: string;
     stdin: boolean;
 }): Promise<string>;
+export declare function readSecretFromDialog(opts: {
+    label: string;
+    itemName: string;
+}): Promise<string | null>;

package/dist/core.js

@@ -5,7 +5,6 @@ import { appendFile, chmod, mkdir, readFile, realpath, rename, rm, stat, unlink,
 import { homedir } from "node:os";
 import { join, dirname } from "node:path";
 import process from "node:process";
-import * as readline from "node:readline";
 import { BRAND } from "./brand.js";
 import { buildRedactIndex } from "./redact.js";
 import { ENV_NAME_RE, legacyRefFor, parseEnvFile, parseRef } from "./refs.js";
@@ -630,13 +629,83 @@ export async function readSecretFromInput(opts) {
             throw new Error("Empty secret");
         return input;
     }
-    const rl = readline.createInterface({ input: process.stdin, output: process.stdout, terminal: true });
-    rl._writeToOutput = () => { };
-    process.stderr.write(opts.prompt);
-    const value = await new Promise((resolve) => rl.question("", resolve));
-    rl.close();
-    process.stderr.write("\n");
+    const value = await readMasked(opts.prompt);
     if (!value)
         throw new Error("Empty secret");
     return value;
 }
+// Native hidden-input dialog for callers without a terminal (agent shells, MCP).
+// Names reach the dialog through env vars, so an item name cannot inject
+// AppleScript; the value comes back only on the dialog's stdout. Resolves null
+// when no dialog can be shown (SSH, headless Linux, missing tools).
+export async function readSecretFromDialog(opts) {
+    if (process.env.SSH_CONNECTION || process.env.SSH_TTY)
+        return null;
+    const text = `Paste the secret for ${opts.label}\nVault item: ${opts.itemName}`;
+    const candidates = process.platform === "darwin"
+        ? [["osascript", ["-e", [
+                        'set t to "Paste the secret for " & (system attribute "KEYSHROUD_DIALOG_ENV") & return & "Vault item: " & (system attribute "KEYSHROUD_DIALOG_ITEM")',
+                        'activate',
+                        'text returned of (display dialog t default answer "" with hidden answer with title "keyshroud" buttons {"Cancel", "Save"} default button "Save" cancel button "Cancel")',
+                    ].join("\n")]]]
+        : process.env.DISPLAY || process.env.WAYLAND_DISPLAY
+            ? [["zenity", ["--entry", "--hide-text", "--title=keyshroud", `--text=${text}`]], ["kdialog", ["--title", "keyshroud", "--password", text]]]
+            : [];
+    for (const [command, args] of candidates) {
+        const result = await new Promise((resolve) => {
+            execFile(command, args, { env: { ...process.env, KEYSHROUD_DIALOG_ENV: opts.label, KEYSHROUD_DIALOG_ITEM: opts.itemName }, timeout: 300_000 }, (error, stdout, stderr) => resolve({ code: error ? (error.code ?? 1) : 0, stdout: String(stdout), stderr: String(stderr) }));
+        });
+        if (result.code === "ENOENT")
+            continue;
+        if (result.code === 0)
+            return result.stdout.replace(/\r?\n$/, "");
+        if (command !== "osascript" || /-128/.test(result.stderr))
+            throw new Error("Cancelled");
+        return null;
+    }
+    return null;
+}
+// Raw-mode prompt that echoes one "*" per character (capped, then a count), so
+// the user sees typing and pastes land without the value ever reaching the screen.
+function readMasked(prompt) {
+    const stdin = process.stdin;
+    const chars = [];
+    const draw = () => {
+        const shown = "*".repeat(Math.min(chars.length, 24)) + (chars.length > 24 ? ` (${chars.length} chars)` : "");
+        process.stderr.write(`\r\x1b[2K${prompt}${shown}`);
+    };
+    return new Promise((resolve, reject) => {
+        const finish = (error) => {
+            stdin.off("data", onData);
+            stdin.setRawMode(false);
+            stdin.pause();
+            process.stderr.write("\n");
+            if (error)
+                reject(error);
+            else
+                resolve(chars.join(""));
+        };
+        const onData = (chunk) => {
+            for (const ch of chunk.replace(/\x1b\[[0-9;?]*[ -/]*[@-~]|\x1b./g, "")) {
+                if (ch === "\r" || ch === "\n")
+                    return finish();
+                if (ch === "\x03")
+                    return finish(new Error("Cancelled"));
+                if (ch === "\x04")
+                    return chars.length ? finish() : finish(new Error("Cancelled"));
+                if (ch === "\x7f" || ch === "\b")
+                    chars.pop();
+                else if (ch === "\x15")
+                    chars.length = 0;
+                else if (ch >= " ")
+                    chars.push(ch);
+            }
+            draw();
+        };
+        stdin.setRawMode(true);
+        stdin.setEncoding("utf8");
+        stdin.resume();
+        stdin.on("data", onData);
+        draw();
+    });
+}

package/dist/hooks.js

@@ -22,8 +22,8 @@ async function sessionStart() {
         await core.writeRedactIndex(core.indexValues(env.secrets));
         const names = Object.keys(env.values);
         context = names.length
-            ? `${BRAND.name}: vault secrets are available by name only: ${names.join(", ")}. Run every command that uses one through \`${BRAND.bin} run -- <command>\` (or the secrets_run MCP tool): its output is masked as <redacted:NAME> even when the command fails. Never print a secret. Never ask the user to paste a secret into chat; use \`${BRAND.bin} add\` in their terminal instead.`
-            : `${BRAND.name}: no secrets are wired yet. Ask the user to run \`${BRAND.bin} add --env NAME --item "Item"\` in their own terminal.`;
+            ? `${BRAND.name}: vault secrets are available by name only: ${names.join(", ")}. Run every command that uses one through \`${BRAND.bin} run -- <command>\` (or the secrets_run MCP tool): its output is masked as <redacted:NAME> even when the command fails. Never print a secret. Never ask the user to paste a secret into chat. To store a new one, run \`${BRAND.bin} add --env NAME --item "Item"\` (or call secrets_request): it opens a dialog on the user's desktop for the value.`
+            : `${BRAND.name}: no secrets are wired yet. To store one, run \`${BRAND.bin} add --env NAME --item "Item"\` (or call secrets_request): it opens a dialog on the user's desktop for the value.`;
     }
     catch (error) {
         context = `${BRAND.name}: the vault could not be unlocked (${error instanceof Error ? error.message : String(error)}), so tool-output redaction may be incomplete this session. Do not print or inspect secrets; ask the user to run \`${BRAND.bin} unlock\`.`;

package/dist/mcp.js

@@ -33,7 +33,7 @@ const TOOLS = [
     },
     {
         name: "secrets_request",
-        description: "Ask the human to store a new secret. Returns a terminal command for the user to run; the value is typed into a masked prompt and never passes through the conversation.",
+        description: "Ask the human to store a new secret. Opens a native hidden-input dialog on the user's desktop and stores the value in the vault; where no dialog can be shown, returns a terminal command for the user to run instead. The value never passes through the conversation.",
         inputSchema: {
             type: "object",
             required: ["env_name", "item_name"],
@@ -141,7 +141,29 @@ async function callTool(name, args) {
         const itemName = String(args.item_name ?? "");
         if (!ENV_NAME_RE.test(envName) || !itemName)
             return text("env_name must be UPPER_SNAKE_CASE and item_name is required", true);
-        const purpose = typeof args.purpose === "string" && args.purpose ? ` --notes ${shellQuote(args.purpose)}` : "";
+        const notes = typeof args.purpose === "string" && args.purpose ? args.purpose : undefined;
+        try {
+            await core.ensureSession();
+            const secret = await core.readSecretFromDialog({ label: envName, itemName });
+            if (secret === "")
+                return text("The user saved an empty value; nothing was stored.", true);
+            if (secret !== null) {
+                await core.createSecretItem({ itemName, secret, envName, notes });
+                const reference = core.referenceFor(itemName);
+                for (const path of Object.values(core.getAuthTargets()))
+                    await core.writeAuthEntry(path, envName, reference);
+                const verified = (await core.resolveShellValue(reference)) !== null;
+                return text(`The user entered the value in a ${BRAND.name} dialog. created item=${itemName} env=${envName} verified=${verified ? "yes" : "no"}. Use secrets_run with $${envName}.`);
+            }
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            if (message === "Cancelled")
+                return text("The user cancelled the dialog; nothing was stored.", true);
+            if (/already exists/.test(message))
+                return text(message, true);
+        }
+        const purpose = notes ? ` --notes ${shellQuote(notes)}` : "";
         return text(`Ask the user to run this in their own terminal (the value is entered in a masked prompt; it must never be pasted into the chat):\n\n  ${BRAND.bin} add --env ${envName} --item ${shellQuote(itemName)}${purpose}\n\nAfter it reports verified=yes, use secrets_run with $${envName}.`);
     }
     if (name === "vault_status") {

package/dist/refs.d.ts

@@ -14,3 +14,17 @@ export declare function parseEnvFile(text: string): Array<{
     name: string;
     value: string;
 }>;
+export interface DotenvEntry {
+    line: number;
+    name: string;
+    value: string;
+    exported: boolean;
+}
+export declare function parseDotenvStrict(text: string): {
+    entries: DotenvEntry[];
+    errors: Array<{
+        line: number;
+        reason: string;
+    }>;
+};
+export declare function looksSecret(name: string, value: string): boolean;

package/dist/refs.js

@@ -80,3 +80,75 @@ export function parseEnvFile(text) {
     });
     return out;
 }
+// Stricter than parseEnvFile, for `import`: a misread value would be stored in
+// the vault, so anything ambiguous is reported by line number (never by value)
+// instead of guessed. Values must also read back unchanged through parseEnvFile.
+export function parseDotenvStrict(text) {
+    const entries = [];
+    const errors = [];
+    const seen = new Set();
+    text.split(/\r?\n/).forEach((raw, index) => {
+        const line = index + 1;
+        const trimmed = raw.trim();
+        if (!trimmed || trimmed.startsWith("#"))
+            return;
+        const match = /^(export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=(.*)$/.exec(trimmed);
+        if (!match) {
+            errors.push({ line, reason: "not a NAME=value line" });
+            return;
+        }
+        const rest = match[3].trim();
+        let value;
+        if (rest.startsWith("'") || rest.startsWith('"')) {
+            const end = rest.indexOf(rest[0], 1);
+            if (end < 0) {
+                errors.push({ line, reason: "unterminated quote (multiline values are not supported)" });
+                return;
+            }
+            const after = rest.slice(end + 1).trim();
+            if (after && !/^#/.test(after)) {
+                errors.push({ line, reason: "text after the closing quote" });
+                return;
+            }
+            if (after && end + 1 === rest.indexOf("#", end)) {
+                errors.push({ line, reason: "comment must be separated from the closing quote by a space" });
+                return;
+            }
+            value = rest.slice(1, end);
+            if (rest[0] === '"' && /[\\$]/.test(value)) {
+                errors.push({ line, reason: "escape sequence or $ expansion inside double quotes" });
+                return;
+            }
+        }
+        else {
+            value = rest.replace(/\s+#.*$/, "");
+            if (value.includes("${")) {
+                errors.push({ line, reason: "${} expansion" });
+                return;
+            }
+        }
+        if (value.startsWith("!")) {
+            errors.push({ line, reason: "value starts with '!' (env files cannot run commands)" });
+            return;
+        }
+        if (seen.has(match[2])) {
+            errors.push({ line, reason: `duplicate key ${match[2]}` });
+            return;
+        }
+        seen.add(match[2]);
+        entries.push({ line, name: match[2], value, exported: Boolean(match[1]) });
+    });
+    return { entries, errors };
+}
+const SECRET_NAME_RE = /(SECRET|TOKEN|PASSW(?:OR)?D|PASSPHRASE|PWD|(?:^|_)KEY(?:$|_)|APIKEY|PRIVATE|CREDENTIAL|AUTH|DSN|WEBHOOK|COOKIE|SIGNING|ENCRYPT|SALT)/i;
+const SECRET_VALUE_RE = /^(?:gh[pousr]_|github_pat_|glpat-|xox[abprs]-|sk-|sk_(?:live|test)_|rk_(?:live|test)_|whsec_|AKIA|ASIA|AIza|npm_|hf_|ya29\.|eyJ)/;
+const URL_PASSWORD_RE = /^[a-z][a-z0-9+.-]*:\/\/[^\s:@/]+:[^\s@/]+@/i;
+// Local heuristic for `import`: never sends anything anywhere. Names that say
+// PUBLIC (NEXT_PUBLIC_*, VITE_PUBLIC_*) are meant to ship to browsers.
+export function looksSecret(name, value) {
+    if (!value || isRef(value) || /PUBLIC/i.test(name))
+        return false;
+    if (SECRET_VALUE_RE.test(value) || URL_PASSWORD_RE.test(value) || SECRET_NAME_RE.test(name))
+        return true;
+    return value.length >= 24 && !/\s/.test(value) && /[a-z]/.test(value) && /[A-Z]/.test(value) && /\d/.test(value);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "keyshroud",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "mcpName": "io.github.dinhkarate/keyshroud",
   "description": "Let AI coding agents use your secrets without ever seeing them. Self-hosted Vaultwarden/Bitwarden, masked output, MCP server, Claude Code + pi plugins.",
   "keywords": [

package/skills/keyshroud/SKILL.md

@@ -11,12 +11,15 @@ in output with `<redacted:NAME>`.
 
 ## Rules
 
-1. Never ask the user to paste a secret into the chat. To store one, give them
-   this command to run in **their own terminal** (masked prompt):
+1. Never ask the user to paste a secret into the chat. To store one, run this
+   yourself; it opens a hidden-input dialog on the user's desktop, and you only
+   see `created … verified=yes`:
    ```bash
    keyshroud add --env STRIPE_API_KEY --item "Stripe API key" --notes "billing service"
    ```
-   With the MCP server, call `secrets_request` instead; it returns the same command.
+   Tell the user a dialog is waiting for them. With the MCP server, call
+   `secrets_request` instead. Over SSH or without a display there is no dialog:
+   then give the user the command to run in their own terminal.
 2. Never print, echo, `cat`, base64, or otherwise transform a secret value.
    `<redacted:NAME>` in output means the secret was used correctly. Do not try
    to recover it.

package/src/cli.ts

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
-import { chmod, copyFile, mkdir, lstat, readdir, readFile, readlink, symlink, unlink, writeFile } from "node:fs/promises";
+import { chmod, copyFile, mkdir, lstat, readdir, readFile, readlink, rename, stat, symlink, unlink, writeFile } from "node:fs/promises";
 import { constants, homedir } from "node:os";
 import { fileURLToPath } from "node:url";
-import { join, resolve } from "node:path";
+import { basename, dirname, join, relative, resolve } from "node:path";
 import { spawn } from "node:child_process";
 import process from "node:process";
 import { BRAND } from "./brand.ts";
@@ -10,7 +10,7 @@ import * as core from "./core.ts";
 import { runClaudeHook } from "./hooks.ts";
 import { serveMcp } from "./mcp.ts";
 import { buildRedactIndex, compileRedactIndex, createRedactor, createRedactStream, type RedactIndex } from "./redact.ts";
-import { ENV_NAME_RE, parseRef } from "./refs.ts";
+import { ENV_NAME_RE, isRef, looksSecret, parseDotenvStrict, parseRef, type DotenvEntry } from "./refs.ts";
 
 const usage = `Usage: ${BRAND.bin} <command> [options]
 
@@ -22,8 +22,11 @@ Secrets
   redact                           Copy stdin to stdout with vault secrets masked
   scan [paths...]                  Find vault secret values in files (exit 1 on leaks)
   env [--shell]                    List wired names (or print shell exports)
-  add --env NAME --item ITEM [--notes TEXT] [--target pi|omp|both] [--stdin]
-  rotate --item ITEM [--stdin]
+  add --env NAME --item ITEM [--notes TEXT] [--target pi|omp|both] [--stdin|--dialog]
+  import [--from F|-] [--out F] [--prefix P] [--only A,B] [--skip A,B] [--yes] [--replace] [--force]
+                                   Move secrets from a .env into the vault and write .env.refs
+                                   (dry run unless --yes; prints names only)
+  rotate --item ITEM [--stdin|--dialog]
   wire --env NAME --item ITEM [--target pi|omp|both] [--force]
   unwire --env NAME [--target pi|omp|both]
 
@@ -53,6 +56,18 @@ function targetList(value: string | undefined): string[] {
   if (value === "pi") return [targetPaths.pi];
   fail("--target must be omp, pi, or both", 2);
 }
+// Terminal: masked prompt. No terminal (an agent's shell) and no --stdin: a native
+// dialog, so the agent can start the command and the user only pastes.
+async function readSecret(args: string[], prompt: string, label: string, itemName: string): Promise<string> {
+  const forced = args.includes("--dialog");
+  if (forced || (!args.includes("--stdin") && !process.stdin.isTTY)) {
+    const value = await core.readSecretFromDialog({ label, itemName });
+    if (value) return value;
+    if (value === "") throw new Error("Empty secret");
+    if (forced) fail("No dialog available here (SSH or no display). Run the command in a terminal, or pipe the value with --stdin.", 2);
+  }
+  return core.readSecretFromInput({ prompt, stdin: args.includes("--stdin") });
+}
 function shellQuote(value: string): string { return `'${value.replaceAll("'", "'\\''")}'`; }
 function failureCode(error: unknown): number {
   const text = error instanceof Error ? error.message : String(error);
@@ -171,6 +186,90 @@ async function scan(paths: string[]): Promise<void> {
   if (leaks) process.exitCode = 1;
 }
 
+interface ImportRow { entry: DotenvEntry; kind: "new" | "reuse" | "conflict" | "literal" | "ref"; item?: string; note?: string }
+
+async function importCommand(args: string[]): Promise<void> {
+  requireKnownFlags(args, ["--from", "--out", "--prefix", "--only", "--skip"], ["--yes", "--replace", "--force"]);
+  const from = valueAfter(args, "--from") ?? ".env";
+  const yes = args.includes("--yes"); const replace = args.includes("--replace");
+  if (replace && (from === "-" || valueAfter(args, "--out"))) fail("--replace rewrites the --from file; it cannot be combined with stdin or --out", 2);
+  if (from === "-" && process.stdin.isTTY) fail("--from - needs the .env piped on stdin", 2);
+  const baseDir = from === "-" ? process.cwd() : dirname(resolve(from));
+  const out = replace ? resolve(from) : resolve(valueAfter(args, "--out") ?? join(baseDir, ".env.refs"));
+  const prefix = valueAfter(args, "--prefix") ?? basename(baseDir);
+  if (!/^[A-Za-z0-9._-]+$/.test(prefix)) fail("--prefix may contain only letters, digits, '.', '_' and '-' (set it with --prefix)", 2);
+  const list = (flag: string) => (valueAfter(args, flag) ?? "").split(",").map((name) => name.trim()).filter(Boolean);
+  const only = list("--only"); const skip = list("--skip");
+
+  let text: string;
+  try { text = from === "-" ? await readStdin() : await readFile(from, "utf8"); } catch { fail(`Cannot read ${from}`, 2); }
+  const { entries, errors } = parseDotenvStrict(text);
+  if (errors.length) {
+    for (const error of errors) console.error(`${from}:${error.line} ${error.reason}`);
+    fail(`${errors.length} line(s) cannot be imported safely; fix them or move them out of the file`, 2);
+  }
+  for (const name of [...only, ...skip]) if (!entries.some((entry) => entry.name === name)) fail(`--only/--skip name not in ${from}: ${name}`, 2);
+
+  await core.ensureSession();
+  const existing = await core.findItems(prefix);
+  const rows: ImportRow[] = [];
+  for (const entry of entries) {
+    if (isRef(entry.value)) { rows.push({ entry, kind: "ref" }); continue; }
+    const secret = (only.length ? only.includes(entry.name) : looksSecret(entry.name, entry.value)) && !skip.includes(entry.name);
+    if (!secret) { rows.push({ entry, kind: "literal" }); continue; }
+    const item = `${prefix} ${entry.name}`;
+    const matches = existing.filter((candidate) => candidate.name.toLowerCase() === item.toLowerCase());
+    if (matches.length > 1) { rows.push({ entry, item, kind: "conflict", note: "more than one vault item has this name" }); continue; }
+    if (matches.length === 0) { rows.push({ entry, item, kind: "new" }); continue; }
+    const current = await core.resolveRef({ item: matches[0].id, field: "password" });
+    rows.push(current === entry.value
+      ? { entry, item, kind: "reuse", note: "same value already in the vault" }
+      : { entry, item, kind: "conflict", note: "vault item exists with a different value" });
+  }
+
+  const width = Math.max(4, ...rows.map((row) => row.entry.name.length));
+  console.log(`import plan for ${from} (item prefix "${prefix}")`);
+  for (const row of rows) {
+    const label = row.kind === "literal" ? "literal   kept" : row.kind === "ref" ? "reference kept"
+      : row.kind === "conflict" ? `secret    conflict: ${row.note} ("${row.item}")`
+      : `secret    ${row.kind.padEnd(8)} -> bw://${row.item}${row.note ? `  (${row.note})` : ""}`;
+    const short = row.item && row.entry.value.length < 6 ? "  [under 6 characters: stored, but too short to be masked]" : "";
+    console.log(`  ${row.entry.name.padEnd(width)}  ${label}${short}`);
+  }
+  const count = (kind: ImportRow["kind"]) => rows.filter((row) => row.kind === kind).length;
+  const toStore = rows.filter((row) => row.kind === "new" || row.kind === "reuse");
+  console.log(`${toStore.length + count("conflict")} secret(s): ${count("new")} new, ${count("reuse")} already in the vault, ${count("conflict")} conflict(s); ${count("literal")} literal(s), ${count("ref")} reference(s)`);
+  if (count("conflict")) fail("Resolve the conflicts (choose another --prefix, or rename the vault items) before importing", 5);
+  if (!toStore.length) { console.log("Nothing to import."); return; }
+  const outExists = await stat(out).then(() => true, () => false);
+  if (outExists && !replace && !args.includes("--force")) fail(`${out} already exists; use --force to overwrite it`, 5);
+  if (!yes) { console.log(`Dry run: nothing written. Re-run with --yes to create ${count("new")} item(s) and write ${out}`); return; }
+
+  const created: string[] = [];
+  for (const row of rows) {
+    if (row.kind !== "new") continue;
+    try { await core.createSecretItem({ itemName: row.item!, secret: row.entry.value, envName: row.entry.name, notes: `Imported by ${BRAND.bin} from ${basename(from === "-" ? "stdin" : from)}` }); }
+    catch { if (created.length) console.error(`Created before the failure: ${created.join(", ")}`); fail(`Failed to create the vault item for ${row.entry.name}; nothing was written to ${out}`, 3); }
+    created.push(row.entry.name);
+  }
+  for (const row of toStore) {
+    let value: string | null = null;
+    try { value = await core.resolveRef({ item: row.item!, field: "password" }); } catch {}
+    if (value !== row.entry.value) fail(`Verification failed for ${row.entry.name}: the vault does not return the imported value; nothing was written to ${out}`, 4);
+  }
+
+  const eol = text.includes("\r\n") ? "\r\n" : "\n";
+  const lines = text.split(/\r?\n/);
+  for (const row of toStore) lines[row.entry.line - 1] = `${row.entry.exported ? "export " : ""}${row.entry.name}=bw://${row.item}`;
+  const mode = replace ? (await stat(out)).mode & 0o777 : 0o644;
+  const tmp = `${out}.tmp.${process.pid}`;
+  await writeFile(tmp, lines.join(eol), { mode });
+  await rename(tmp, out);
+  await core.audit("import", toStore.map((row) => row.entry.name), "cli");
+  console.log(`imported ${toStore.length} secret(s) (${created.length} new); wrote ${out}`);
+  if (!replace && from !== "-") console.log(`${from} still holds the plaintext values. Check with \`${BRAND.bin} run --env-file ${relative(process.cwd(), out) || out} -- <cmd>\`, then delete it or re-run with --replace.`);
+}
+
 async function main(): Promise<void> {
   const args = process.argv.slice(2); const command = args.shift();
   if (!command || command === "--help" || command === "-h" || command === "help") { console.log(usage); if (!command) process.exitCode = 2; return; }
@@ -226,13 +325,13 @@ async function main(): Promise<void> {
       await core.ensureSession(); process.stdout.write(await core.getSecret(item)); return;
     }
     if (command === "add") {
-      requireKnownFlags(args, ["--env", "--item", "--notes", "--target"], ["--stdin"]);
+      requireKnownFlags(args, ["--env", "--item", "--notes", "--target"], ["--stdin", "--dialog"]);
       const envName = valueAfter(args, "--env"); const itemName = valueAfter(args, "--item"); const notes = valueAfter(args, "--notes");
       if (!envName || !itemName || !ENV_NAME_RE.test(envName)) fail(usage, 2);
       const reference = core.referenceFor(itemName);
       const targets = targetList(valueAfter(args, "--target"));
       await core.ensureSession();
-      const secret = await core.readSecretFromInput({ prompt: `Paste secret for ${envName}: `, stdin: args.includes("--stdin") });
+      const secret = await readSecret(args, `Paste secret for ${envName}: `, envName, itemName);
       await core.createSecretItem({ itemName, secret, envName, notes });
       let conflict = false;
       for (const path of targets) { const result = await core.writeAuthEntry(path, envName, reference); if (!result.ok) conflict = true; }
@@ -241,10 +340,11 @@ async function main(): Promise<void> {
       if (conflict) { console.error("Item created, but one or more auth targets already contained the environment name."); process.exitCode = 5; }
       return;
     }
+    if (command === "import") { await importCommand(args); return; }
     if (command === "rotate") {
-      requireKnownFlags(args, ["--item"], ["--stdin"]);
+      requireKnownFlags(args, ["--item"], ["--stdin", "--dialog"]);
       const itemName = valueAfter(args, "--item"); if (!itemName) fail(usage, 2);
-      await core.ensureSession(); const secret = await core.readSecretFromInput({ prompt: "Paste replacement secret: ", stdin: args.includes("--stdin") });
+      await core.ensureSession(); const secret = await readSecret(args, "Paste replacement secret: ", `the new value of ${itemName}`, itemName);
       await core.rotateSecretItem({ itemName, secret }); console.log(`rotated item=${itemName}`); return;
     }
     if (command === "wire") {

package/src/core.ts

@@ -5,7 +5,6 @@ import { appendFile, chmod, mkdir, readFile, realpath, rename, rm, stat, unlink,
 import { homedir } from "node:os";
 import { join, dirname } from "node:path";
 import process from "node:process";
-import * as readline from "node:readline";
 import { BRAND } from "./brand.ts";
 import { buildRedactIndex, type RedactIndex } from "./redact.ts";
 import { ENV_NAME_RE, legacyRefFor, parseEnvFile, parseRef, type SecretRef } from "./refs.ts";
@@ -573,12 +572,67 @@ export async function readSecretFromInput(opts: { prompt: string; stdin: boolean
     if (!input) throw new Error("Empty secret");
     return input;
   }
-  const rl = readline.createInterface({ input: process.stdin, output: process.stdout, terminal: true });
-  (rl as unknown as { _writeToOutput: (text: string) => void })._writeToOutput = () => {};
-  process.stderr.write(opts.prompt);
-  const value = await new Promise<string>((resolve) => rl.question("", resolve));
-  rl.close();
-  process.stderr.write("\n");
+  const value = await readMasked(opts.prompt);
   if (!value) throw new Error("Empty secret");
   return value;
 }
+
+// Native hidden-input dialog for callers without a terminal (agent shells, MCP).
+// Names reach the dialog through env vars, so an item name cannot inject
+// AppleScript; the value comes back only on the dialog's stdout. Resolves null
+// when no dialog can be shown (SSH, headless Linux, missing tools).
+export async function readSecretFromDialog(opts: { label: string; itemName: string }): Promise<string | null> {
+  if (process.env.SSH_CONNECTION || process.env.SSH_TTY) return null;
+  const text = `Paste the secret for ${opts.label}\nVault item: ${opts.itemName}`;
+  const candidates: Array<[string, string[]]> = process.platform === "darwin"
+    ? [["osascript", ["-e", [
+        'set t to "Paste the secret for " & (system attribute "KEYSHROUD_DIALOG_ENV") & return & "Vault item: " & (system attribute "KEYSHROUD_DIALOG_ITEM")',
+        'activate',
+        'text returned of (display dialog t default answer "" with hidden answer with title "keyshroud" buttons {"Cancel", "Save"} default button "Save" cancel button "Cancel")',
+      ].join("\n")]]]
+    : process.env.DISPLAY || process.env.WAYLAND_DISPLAY
+      ? [["zenity", ["--entry", "--hide-text", "--title=keyshroud", `--text=${text}`]], ["kdialog", ["--title", "keyshroud", "--password", text]]]
+      : [];
+  for (const [command, args] of candidates) {
+    const result = await new Promise<{ code: number | string | null; stdout: string; stderr: string }>((resolve) => {
+      execFile(command, args, { env: { ...process.env, KEYSHROUD_DIALOG_ENV: opts.label, KEYSHROUD_DIALOG_ITEM: opts.itemName }, timeout: 300_000 },
+        (error, stdout, stderr) => resolve({ code: error ? ((error as NodeJS.ErrnoException).code ?? 1) : 0, stdout: String(stdout), stderr: String(stderr) }));
+    });
+    if (result.code === "ENOENT") continue;
+    if (result.code === 0) return result.stdout.replace(/\r?\n$/, "");
+    if (command !== "osascript" || /-128/.test(result.stderr)) throw new Error("Cancelled");
+    return null;
+  }
+  return null;
+}
+
+// Raw-mode prompt that echoes one "*" per character (capped, then a count), so
+// the user sees typing and pastes land without the value ever reaching the screen.
+function readMasked(prompt: string): Promise<string> {
+  const stdin = process.stdin;
+  const chars: string[] = [];
+  const draw = () => {
+    const shown = "*".repeat(Math.min(chars.length, 24)) + (chars.length > 24 ? ` (${chars.length} chars)` : "");
+    process.stderr.write(`\r\x1b[2K${prompt}${shown}`);
+  };
+  return new Promise((resolve, reject) => {
+    const finish = (error?: Error) => {
+      stdin.off("data", onData); stdin.setRawMode(false); stdin.pause();
+      process.stderr.write("\n");
+      if (error) reject(error); else resolve(chars.join(""));
+    };
+    const onData = (chunk: string) => {
+      for (const ch of chunk.replace(/\x1b\[[0-9;?]*[ -/]*[@-~]|\x1b./g, "")) {
+        if (ch === "\r" || ch === "\n") return finish();
+        if (ch === "\x03") return finish(new Error("Cancelled"));
+        if (ch === "\x04") return chars.length ? finish() : finish(new Error("Cancelled"));
+        if (ch === "\x7f" || ch === "\b") chars.pop();
+        else if (ch === "\x15") chars.length = 0;
+        else if (ch >= " ") chars.push(ch);
+      }
+      draw();
+    };
+    stdin.setRawMode(true); stdin.setEncoding("utf8"); stdin.resume(); stdin.on("data", onData);
+    draw();
+  });
+}

package/src/hooks.ts

@@ -22,8 +22,8 @@ async function sessionStart(): Promise<string> {
     await core.writeRedactIndex(core.indexValues(env.secrets));
     const names = Object.keys(env.values);
     context = names.length
-      ? `${BRAND.name}: vault secrets are available by name only: ${names.join(", ")}. Run every command that uses one through \`${BRAND.bin} run -- <command>\` (or the secrets_run MCP tool): its output is masked as <redacted:NAME> even when the command fails. Never print a secret. Never ask the user to paste a secret into chat; use \`${BRAND.bin} add\` in their terminal instead.`
-      : `${BRAND.name}: no secrets are wired yet. Ask the user to run \`${BRAND.bin} add --env NAME --item "Item"\` in their own terminal.`;
+      ? `${BRAND.name}: vault secrets are available by name only: ${names.join(", ")}. Run every command that uses one through \`${BRAND.bin} run -- <command>\` (or the secrets_run MCP tool): its output is masked as <redacted:NAME> even when the command fails. Never print a secret. Never ask the user to paste a secret into chat. To store a new one, run \`${BRAND.bin} add --env NAME --item "Item"\` (or call secrets_request): it opens a dialog on the user's desktop for the value.`
+      : `${BRAND.name}: no secrets are wired yet. To store one, run \`${BRAND.bin} add --env NAME --item "Item"\` (or call secrets_request): it opens a dialog on the user's desktop for the value.`;
   } catch (error) {
     context = `${BRAND.name}: the vault could not be unlocked (${error instanceof Error ? error.message : String(error)}), so tool-output redaction may be incomplete this session. Do not print or inspect secrets; ask the user to run \`${BRAND.bin} unlock\`.`;
   }

package/src/mcp.ts

@@ -35,7 +35,7 @@ const TOOLS = [
   },
   {
     name: "secrets_request",
-    description: "Ask the human to store a new secret. Returns a terminal command for the user to run; the value is typed into a masked prompt and never passes through the conversation.",
+    description: "Ask the human to store a new secret. Opens a native hidden-input dialog on the user's desktop and stores the value in the vault; where no dialog can be shown, returns a terminal command for the user to run instead. The value never passes through the conversation.",
     inputSchema: {
       type: "object",
       required: ["env_name", "item_name"],
@@ -132,7 +132,24 @@ async function callTool(name: string, args: Json): Promise<Json> {
     const envName = String(args.env_name ?? "");
     const itemName = String(args.item_name ?? "");
     if (!ENV_NAME_RE.test(envName) || !itemName) return text("env_name must be UPPER_SNAKE_CASE and item_name is required", true);
-    const purpose = typeof args.purpose === "string" && args.purpose ? ` --notes ${shellQuote(args.purpose)}` : "";
+    const notes = typeof args.purpose === "string" && args.purpose ? args.purpose : undefined;
+    try {
+      await core.ensureSession();
+      const secret = await core.readSecretFromDialog({ label: envName, itemName });
+      if (secret === "") return text("The user saved an empty value; nothing was stored.", true);
+      if (secret !== null) {
+        await core.createSecretItem({ itemName, secret, envName, notes });
+        const reference = core.referenceFor(itemName);
+        for (const path of Object.values(core.getAuthTargets())) await core.writeAuthEntry(path, envName, reference);
+        const verified = (await core.resolveShellValue(reference)) !== null;
+        return text(`The user entered the value in a ${BRAND.name} dialog. created item=${itemName} env=${envName} verified=${verified ? "yes" : "no"}. Use secrets_run with $${envName}.`);
+      }
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      if (message === "Cancelled") return text("The user cancelled the dialog; nothing was stored.", true);
+      if (/already exists/.test(message)) return text(message, true);
+    }
+    const purpose = notes ? ` --notes ${shellQuote(notes)}` : "";
     return text(`Ask the user to run this in their own terminal (the value is entered in a masked prompt; it must never be pasted into the chat):\n\n  ${BRAND.bin} add --env ${envName} --item ${shellQuote(itemName)}${purpose}\n\nAfter it reports verified=yes, use secrets_run with $${envName}.`);
   }
   if (name === "vault_status") {

package/src/refs.ts

@@ -74,3 +74,52 @@ export function parseEnvFile(text: string): Array<{ name: string; value: string
   });
   return out;
 }
+
+export interface DotenvEntry { line: number; name: string; value: string; exported: boolean }
+
+// Stricter than parseEnvFile, for `import`: a misread value would be stored in
+// the vault, so anything ambiguous is reported by line number (never by value)
+// instead of guessed. Values must also read back unchanged through parseEnvFile.
+export function parseDotenvStrict(text: string): { entries: DotenvEntry[]; errors: Array<{ line: number; reason: string }> } {
+  const entries: DotenvEntry[] = [];
+  const errors: Array<{ line: number; reason: string }> = [];
+  const seen = new Set<string>();
+  text.split(/\r?\n/).forEach((raw, index) => {
+    const line = index + 1;
+    const trimmed = raw.trim();
+    if (!trimmed || trimmed.startsWith("#")) return;
+    const match = /^(export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=(.*)$/.exec(trimmed);
+    if (!match) { errors.push({ line, reason: "not a NAME=value line" }); return; }
+    const rest = match[3].trim();
+    let value: string;
+    if (rest.startsWith("'") || rest.startsWith('"')) {
+      const end = rest.indexOf(rest[0], 1);
+      if (end < 0) { errors.push({ line, reason: "unterminated quote (multiline values are not supported)" }); return; }
+      const after = rest.slice(end + 1).trim();
+      if (after && !/^#/.test(after)) { errors.push({ line, reason: "text after the closing quote" }); return; }
+      if (after && end + 1 === rest.indexOf("#", end)) { errors.push({ line, reason: "comment must be separated from the closing quote by a space" }); return; }
+      value = rest.slice(1, end);
+      if (rest[0] === '"' && /[\\$]/.test(value)) { errors.push({ line, reason: "escape sequence or $ expansion inside double quotes" }); return; }
+    } else {
+      value = rest.replace(/\s+#.*$/, "");
+      if (value.includes("${")) { errors.push({ line, reason: "${} expansion" }); return; }
+    }
+    if (value.startsWith("!")) { errors.push({ line, reason: "value starts with '!' (env files cannot run commands)" }); return; }
+    if (seen.has(match[2])) { errors.push({ line, reason: `duplicate key ${match[2]}` }); return; }
+    seen.add(match[2]);
+    entries.push({ line, name: match[2], value, exported: Boolean(match[1]) });
+  });
+  return { entries, errors };
+}
+
+const SECRET_NAME_RE = /(SECRET|TOKEN|PASSW(?:OR)?D|PASSPHRASE|PWD|(?:^|_)KEY(?:$|_)|APIKEY|PRIVATE|CREDENTIAL|AUTH|DSN|WEBHOOK|COOKIE|SIGNING|ENCRYPT|SALT)/i;
+const SECRET_VALUE_RE = /^(?:gh[pousr]_|github_pat_|glpat-|xox[abprs]-|sk-|sk_(?:live|test)_|rk_(?:live|test)_|whsec_|AKIA|ASIA|AIza|npm_|hf_|ya29\.|eyJ)/;
+const URL_PASSWORD_RE = /^[a-z][a-z0-9+.-]*:\/\/[^\s:@/]+:[^\s@/]+@/i;
+
+// Local heuristic for `import`: never sends anything anywhere. Names that say
+// PUBLIC (NEXT_PUBLIC_*, VITE_PUBLIC_*) are meant to ship to browsers.
+export function looksSecret(name: string, value: string): boolean {
+  if (!value || isRef(value) || /PUBLIC/i.test(name)) return false;
+  if (SECRET_VALUE_RE.test(value) || URL_PASSWORD_RE.test(value) || SECRET_NAME_RE.test(name)) return true;
+  return value.length >= 24 && !/\s/.test(value) && /[a-z]/.test(value) && /[A-Z]/.test(value) && /\d/.test(value);
+}