keyshroud 0.5.1 → 0.5.3

package/dist/core.js

@@ -1,14 +1,14 @@
 // Runtime-neutral core: no pi/omp/Claude Code imports. Every caller (agent
 // extensions, CLI, MCP server, hooks) goes through these functions.
 import { execFile } from "node:child_process";
+import { randomBytes } from "node:crypto";
 import { appendFile, chmod, mkdir, readFile, realpath, rename, rm, stat, unlink, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { join, dirname } from "node:path";
 import process from "node:process";
-import * as readline from "node:readline";
 import { BRAND } from "./brand.js";
 import { buildRedactIndex } from "./redact.js";
-import { ENV_NAME_RE, legacyRefFor, parseEnvFile, parseRef } from "./refs.js";
+import { ENV_NAME_RE, isLoaderEnvName, itemNameProblem, legacyRefFor, parseEnvFile, parseRef } from "./refs.js";
 const P = BRAND.envPrefix;
 function setting(name) {
     const value = process.env[`${P}_${name}`]?.trim();
@@ -61,7 +61,10 @@ export function childEnv(extra = {}) {
     for (const [name, value] of Object.entries(process.env))
         if (value !== undefined && !VAULT_ENV_KEYS.includes(name))
             env[name] = value;
-    return { ...env, ...extra };
+    for (const [name, value] of Object.entries(extra))
+        if (!isLoaderEnvName(name))
+            env[name] = value;
+    return env;
 }
 export async function bw(args, opts = {}) {
     const session = opts.session ?? process.env.BW_SESSION;
@@ -239,8 +242,8 @@ export function ensureSession() {
 }
 async function writePrivateFile(path, content) {
     await mkdir(dirname(path), { recursive: true, mode: 0o700 });
-    const tmp = `${path}.tmp.${process.pid}`;
-    await writeFile(tmp, content, { encoding: "utf8", mode: 0o600 });
+    const tmp = `${path}.tmp.${randomBytes(6).toString("hex")}`;
+    await writeFile(tmp, content, { encoding: "utf8", mode: 0o600, flag: "wx" });
     await chmod(tmp, 0o600);
     await rename(tmp, path);
     await chmod(path, 0o600);
@@ -486,6 +489,8 @@ export async function envFileEntries(path) {
     return parseEnvFile(await readFile(path, "utf8")).map(({ name, value }) => {
         if (value.trim().startsWith("!"))
             throw new Error(`${path}: ${name} uses a shell command; env files accept only bw:// references and literals`);
+        if (isLoaderEnvName(name))
+            throw new Error(`${path}: ${name} changes what programs load or run; env files cannot set it`);
         return { name, raw: value };
     });
 }
@@ -540,6 +545,11 @@ export async function writeRedactIndex(values) {
     await writePrivateFile(REDACT_INDEX_FILE, `${JSON.stringify(index)}\n`);
     return index;
 }
+// Re-index after the wired set changes so hooks mask a new value right away.
+export async function refreshRedactIndex() {
+    const env = await resolveEntries(await authEnvEntries());
+    await writeRedactIndex(indexValues(env.secrets));
+}
 export async function readRedactIndex() {
     try {
         const parsed = JSON.parse(await readFile(REDACT_INDEX_FILE, "utf8"));
@@ -574,7 +584,17 @@ export async function getSecret(itemName) {
         throw mapItemError(error, itemName);
     }
 }
+// An agent can start add/rotate, so a dialog could be used to phish the master
+// password into an item it can then read; refuse it outright.
+async function refuseMasterPassword(secret) {
+    if (secret && secret === await readMasterPassword())
+        throw new Error("Refusing to store the vault master password as a secret");
+}
 export async function createSecretItem(opts) {
+    const problem = itemNameProblem(opts.itemName);
+    if (problem)
+        throw new Error(`Vault item name ${problem}`);
+    await refuseMasterPassword(opts.secret);
     const existing = await findItems(opts.itemName);
     if (existing.some((item) => item.name.toLowerCase() === opts.itemName.toLowerCase()))
         throw new Error(`Vault item already exists: ${opts.itemName}`);
@@ -599,6 +619,7 @@ export async function createSecretItem(opts) {
     return { id: String(created.id) };
 }
 export async function rotateSecretItem(opts) {
+    await refuseMasterPassword(opts.secret);
     let parsed;
     try {
         parsed = JSON.parse(await bw(["get", "item", opts.itemName]));
@@ -621,7 +642,7 @@ export async function deleteItem(id, permanent = false) {
     invalidateSecretCache();
 }
 export async function readSecretFromInput(opts) {
-    if (opts.stdin || !process.stdin.isTTY) {
+    if (opts.stdin) {
         let input = "";
         for await (const chunk of process.stdin)
             input += String(chunk);
@@ -630,13 +651,152 @@ export async function readSecretFromInput(opts) {
             throw new Error("Empty secret");
         return input;
     }
-    const rl = readline.createInterface({ input: process.stdin, output: process.stdout, terminal: true });
-    rl._writeToOutput = () => { };
-    process.stderr.write(opts.prompt);
-    const value = await new Promise((resolve) => rl.question("", resolve));
-    rl.close();
-    process.stderr.write("\n");
+    if (!process.stdin.isTTY)
+        throw new Error("No terminal to prompt on; pipe the value with --stdin");
+    const value = await readMasked(opts.prompt);
     if (!value)
         throw new Error("Empty secret");
     return value;
 }
+// Native hidden-input dialog for callers without a terminal (agent shells, MCP).
+// An agent can open it, so the wording is fixed, says who asked, and warns
+// against the master password; names are validated and passed as data (argv),
+// never as script. One dialog at a time, with a pause after a cancel. Resolves
+// null when no dialog can be shown (SSH, headless Linux, missing tools).
+const DIALOG_LOCK = join(CONFIG_DIR, "dialog.lock");
+const DIALOG_COOLDOWN_MS = 30_000;
+const DIALOG_TIMEOUT_MS = 300_000;
+export async function readSecretFromDialog(opts) {
+    if (process.env.SSH_CONNECTION || process.env.SSH_TTY)
+        return null;
+    const problem = itemNameProblem(opts.itemName);
+    if (problem)
+        throw new Error(`Vault item name ${problem}`);
+    if (opts.envName !== undefined && !ENV_NAME_RE.test(opts.envName))
+        throw new Error("Variable names must be UPPER_SNAKE_CASE");
+    const text = [
+        opts.envName ? "A program on this computer, usually an AI agent, asked to store a NEW secret." : "A program on this computer, usually an AI agent, asked to REPLACE the value of a secret.",
+        "",
+        ...(opts.envName ? [`Variable: ${opts.envName}`] : []),
+        `Vault item: ${opts.itemName}`,
+        "",
+        "This is not a login prompt. Never enter your vault master password here.",
+    ].join("\n");
+    const candidates = process.platform === "darwin"
+        ? [["osascript", ["-e", "on run argv", "-e", 'activate', "-e",
+                    'text returned of (display dialog (item 1 of argv) default answer "" with hidden answer with title "keyshroud" buttons {"Cancel", "Save"} default button "Save" cancel button "Cancel" with icon caution)',
+                    "-e", "end run", "--", text]]]
+        : process.env.DISPLAY || process.env.WAYLAND_DISPLAY
+            ? [["zenity", ["--entry", "--hide-text", "--no-markup", "--title=keyshroud", `--text=${text}`]], ["kdialog", ["--title", "keyshroud", "--password", text.replace(/[<>]/g, "")]]]
+            : [];
+    if (!candidates.length)
+        return null;
+    return withDialogLock(async () => {
+        for (const [command, args] of candidates) {
+            const result = await new Promise((resolve) => {
+                execFile(command, args, { timeout: DIALOG_TIMEOUT_MS }, (error, stdout, stderr) => resolve({ code: error ? (error.code ?? 1) : 0, stdout: String(stdout), stderr: String(stderr) }));
+            });
+            if (result.code === "ENOENT")
+                continue;
+            if (result.code === 0)
+                return result.stdout.replace(/\r?\n$/, "");
+            if (command !== "osascript" || /-128/.test(result.stderr))
+                throw new Error("Cancelled");
+            return null;
+        }
+        return null;
+    });
+}
+async function withDialogLock(fn) {
+    await mkdir(CONFIG_DIR, { recursive: true, mode: 0o700 });
+    let held = "";
+    try {
+        held = await readFile(DIALOG_LOCK, "utf8");
+    }
+    catch { }
+    const [kind, at] = held.trim().split(":");
+    const age = Date.now() - Number(at);
+    const live = (kind === "open" || kind === "cancelled") && age >= 0 && age < (kind === "cancelled" ? DIALOG_COOLDOWN_MS : DIALOG_TIMEOUT_MS + 30_000);
+    if (!live)
+        await rm(DIALOG_LOCK, { force: true });
+    try {
+        await writeFile(DIALOG_LOCK, `open:${Date.now()}\n`, { flag: "wx", mode: 0o600 });
+    }
+    catch {
+        throw new Error(kind === "cancelled" ? "The last dialog was cancelled; wait 30 seconds before asking again" : "Another keyshroud dialog is already open");
+    }
+    try {
+        const value = await fn();
+        await rm(DIALOG_LOCK, { force: true });
+        return value;
+    }
+    catch (error) {
+        if (error instanceof Error && error.message === "Cancelled")
+            await writeFile(DIALOG_LOCK, `cancelled:${Date.now()}\n`, { mode: 0o600 });
+        else
+            await rm(DIALOG_LOCK, { force: true });
+        throw error;
+    }
+}
+// Raw-mode prompt that echoes one "*" per character (capped, then a count), so
+// the user sees typing and pastes land without the value ever reaching the screen.
+function readMasked(prompt) {
+    const stdin = process.stdin;
+    const chars = [];
+    const draw = () => {
+        const shown = "*".repeat(Math.min(chars.length, 24)) + (chars.length > 24 ? ` (${chars.length} chars)` : "");
+        process.stderr.write(`\r\x1b[2K${prompt}${shown}`);
+    };
+    return new Promise((resolve, reject) => {
+        // After Enter, keep reading briefly: the rest of a multi-line paste must be
+        // consumed here (or it would reach the parent shell) and is then refused.
+        let ending;
+        let multiline = false;
+        const settle = () => {
+            clearTimeout(ending);
+            ending = setTimeout(() => finish(multiline ? new Error("Multi-line values are not supported in the prompt; pipe them with --stdin") : undefined), 100);
+        };
+        const finish = (error) => {
+            clearTimeout(ending);
+            stdin.off("data", onData);
+            stdin.setRawMode(false);
+            stdin.pause();
+            process.stderr.write("\n");
+            if (error)
+                reject(error);
+            else
+                resolve(chars.join(""));
+        };
+        const onData = (chunk) => {
+            if (ending) {
+                if (/[^\r\n]/.test(chunk))
+                    multiline = true;
+                return settle();
+            }
+            const clean = [...chunk.replace(/\x1b\[[0-9;?]*[ -/]*[@-~]|\x1b./g, "")];
+            for (const [index, ch] of clean.entries()) {
+                if (ch === "\r" || ch === "\n") {
+                    if (/[^\r\n]/.test(clean.slice(index + 1).join("")))
+                        multiline = true;
+                    return settle();
+                }
+                if (ch === "\x03")
+                    return finish(new Error("Cancelled"));
+                if (ch === "\x04")
+                    return chars.length ? finish() : finish(new Error("Cancelled"));
+                if (ch === "\x7f" || ch === "\b")
+                    chars.pop();
+                else if (ch === "\x15")
+                    chars.length = 0;
+                else if (ch >= " ")
+                    chars.push(ch);
+            }
+            draw();
+        };
+        stdin.setRawMode(true);
+        stdin.setEncoding("utf8");
+        stdin.resume();
+        stdin.on("data", onData);
+        draw();
+    });
+}

package/dist/hooks.js

@@ -22,8 +22,8 @@ async function sessionStart() {
         await core.writeRedactIndex(core.indexValues(env.secrets));
         const names = Object.keys(env.values);
         context = names.length
-            ? `${BRAND.name}: vault secrets are available by name only: ${names.join(", ")}. Run every command that uses one through \`${BRAND.bin} run -- <command>\` (or the secrets_run MCP tool): its output is masked as <redacted:NAME> even when the command fails. Never print a secret. Never ask the user to paste a secret into chat; use \`${BRAND.bin} add\` in their terminal instead.`
-            : `${BRAND.name}: no secrets are wired yet. Ask the user to run \`${BRAND.bin} add --env NAME --item "Item"\` in their own terminal.`;
+            ? `${BRAND.name}: vault secrets are available by name only: ${names.join(", ")}. Run every command that uses one through \`${BRAND.bin} run -- <command>\` (or the secrets_run MCP tool): its output is masked as <redacted:NAME> even when the command fails. Never print a secret. Never ask the user to paste a secret into chat. To store a new one, run \`${BRAND.bin} add --env NAME --item "Item"\` (or call secrets_request): it opens a dialog on the user's desktop for the value.`
+            : `${BRAND.name}: no secrets are wired yet. To store one, run \`${BRAND.bin} add --env NAME --item "Item"\` (or call secrets_request): it opens a dialog on the user's desktop for the value.`;
     }
     catch (error) {
         context = `${BRAND.name}: the vault could not be unlocked (${error instanceof Error ? error.message : String(error)}), so tool-output redaction may be incomplete this session. Do not print or inspect secrets; ask the user to run \`${BRAND.bin} unlock\`.`;

package/dist/mcp.js

@@ -7,7 +7,7 @@ import process from "node:process";
 import { BRAND } from "./brand.js";
 import * as core from "./core.js";
 import { createRedactor } from "./redact.js";
-import { ENV_NAME_RE } from "./refs.js";
+import { ENV_NAME_RE, isLoaderEnvName, itemNameProblem } from "./refs.js";
 const SUPPORTED_VERSIONS = ["2025-11-25", "2025-06-18", "2025-03-26", "2024-11-05"];
 const OUTPUT_LIMIT = 256 * 1024;
 const TOOLS = [
@@ -33,7 +33,7 @@ const TOOLS = [
     },
     {
         name: "secrets_request",
-        description: "Ask the human to store a new secret. Returns a terminal command for the user to run; the value is typed into a masked prompt and never passes through the conversation.",
+        description: "Ask the human to store a new secret. Opens a native hidden-input dialog on the user's desktop and stores the value in the vault; where no dialog can be shown, returns a terminal command for the user to run instead. The value never passes through the conversation.",
         inputSchema: {
             type: "object",
             required: ["env_name", "item_name"],
@@ -85,14 +85,14 @@ async function runTool(args) {
         detached: true,
     });
     const chunks = { stdout: [], stderr: [] };
-    // Collect generously, mask, then truncate, so a cut never splits a secret
-    // before redaction.
-    let size = 0;
+    // Collect generously per stream, mask, then truncate. If collection stopped
+    // early, the tail may end inside a secret, so it is dropped before masking.
+    const sizes = { stdout: 0, stderr: 0 };
     for (const stream of ["stdout", "stderr"]) {
         child[stream].on("data", (chunk) => {
-            if (size >= OUTPUT_LIMIT * 4)
+            if (sizes[stream] >= OUTPUT_LIMIT * 2)
                 return;
-            size += chunk.length;
+            sizes[stream] += chunk.length;
             chunks[stream].push(chunk);
         });
     }
@@ -105,9 +105,14 @@ async function runTool(args) {
         child.on("error", (error) => done(`spawn error: ${error.message}`));
     });
     clearTimeout(timer);
-    let truncated = size >= OUTPUT_LIMIT * 4;
+    let truncated = false;
     const out = (stream) => {
-        const masked = redactor.redact(Buffer.concat(chunks[stream]).toString("utf8"));
+        let raw = Buffer.concat(chunks[stream]).toString("utf8");
+        if (sizes[stream] >= OUTPUT_LIMIT * 2) {
+            truncated = true;
+            raw = raw.slice(0, redactor.safeCut(raw));
+        }
+        const masked = redactor.redact(raw);
         if (masked.length <= OUTPUT_LIMIT / 2)
             return masked;
         truncated = true;
@@ -141,8 +146,40 @@ async function callTool(name, args) {
         const itemName = String(args.item_name ?? "");
         if (!ENV_NAME_RE.test(envName) || !itemName)
             return text("env_name must be UPPER_SNAKE_CASE and item_name is required", true);
-        const purpose = typeof args.purpose === "string" && args.purpose ? ` --notes ${shellQuote(args.purpose)}` : "";
-        return text(`Ask the user to run this in their own terminal (the value is entered in a masked prompt; it must never be pasted into the chat):\n\n  ${BRAND.bin} add --env ${envName} --item ${shellQuote(itemName)}${purpose}\n\nAfter it reports verified=yes, use secrets_run with $${envName}.`);
+        if (isLoaderEnvName(envName))
+            return text(`${envName} changes what programs load or run; it cannot be wired to a secret`, true);
+        const problem = itemNameProblem(itemName);
+        if (problem)
+            return text(`item_name ${problem}`, true);
+        const notes = typeof args.purpose === "string" && args.purpose ? args.purpose.slice(0, 500) : undefined;
+        try {
+            const reference = core.referenceFor(itemName);
+            await core.ensureSession();
+            if ((await core.findItems(itemName)).some((item) => item.name.toLowerCase() === itemName.toLowerCase()))
+                return text(`Vault item already exists: ${itemName}`, true);
+            const secret = await core.readSecretFromDialog({ itemName, envName });
+            if (secret === "")
+                return text("The user saved an empty value; nothing was stored.", true);
+            if (secret !== null) {
+                await core.createSecretItem({ itemName, secret, envName, notes });
+                await core.audit("request", [envName], "mcp");
+                const conflicts = [];
+                for (const path of Object.values(core.getAuthTargets()))
+                    if (!(await core.writeAuthEntry(path, envName, reference)).ok)
+                        conflicts.push(path);
+                await core.refreshRedactIndex();
+                if (conflicts.length)
+                    return text(`created item=${itemName}, but ${envName} is already wired to another secret in ${conflicts.join(", ")} and was left unchanged. Ask the user before running \`${BRAND.bin} wire --env ${envName} --item ${shellQuote(itemName)} --force\`.`, true);
+                const verified = (await core.resolveShellValue(reference)) !== null;
+                return text(`The user entered the value in a ${BRAND.name} dialog. created item=${itemName} env=${envName} verified=${verified ? "yes" : "no"}. Use secrets_run with $${envName}.`);
+            }
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            return text(message === "Cancelled" ? "The user cancelled the dialog; nothing was stored." : message, true);
+        }
+        const purpose = notes ? ` --notes ${shellQuote(notes)}` : "";
+        return text(`No dialog can be shown here. Ask the user to run this in their own terminal (the value is entered in a masked prompt; it must never be pasted into the chat):\n\n  ${BRAND.bin} add --env ${envName} --item ${shellQuote(itemName)}${purpose}\n\nAfter it reports verified=yes, use secrets_run with $${envName}.`);
     }
     if (name === "vault_status") {
         try {

package/dist/redact.js

@@ -87,7 +87,7 @@ export function createRedactor(values) {
                 return cut;
             // Bounded fallback: cut near the end, moving forward past any complete
             // secret that straddles it, so whole matches are still replaced.
-            cut = text.length - maxLength;
+            cut = Math.max(0, text.length - maxLength);
             while (cut < text.length && straddling(cut))
                 cut++;
             return cut;

package/dist/refs.d.ts

@@ -10,7 +10,23 @@ export declare function parseRef(raw: string): SecretRef | null;
 export declare function formatRef(ref: SecretRef): string;
 export declare function legacyRefFor(itemName: string): string;
 export declare const ENV_NAME_RE: RegExp;
+export declare function isLoaderEnvName(name: string): boolean;
+export declare function itemNameProblem(name: string): string | null;
 export declare function parseEnvFile(text: string): Array<{
     name: string;
     value: string;
 }>;
+export interface DotenvEntry {
+    line: number;
+    name: string;
+    value: string;
+    exported: boolean;
+}
+export declare function parseDotenvStrict(text: string): {
+    entries: DotenvEntry[];
+    errors: Array<{
+        line: number;
+        reason: string;
+    }>;
+};
+export declare function looksSecret(name: string, value: string): boolean;

package/dist/refs.js

@@ -57,6 +57,21 @@ export function legacyRefFor(itemName) {
     return `!bw get password '${itemName}'`;
 }
 export const ENV_NAME_RE = /^[A-Z_][A-Z0-9_]*$/;
+// Variables that change what a child process loads or runs. Env files can come
+// from a cloned repo and agents can wire names, so neither may set these.
+const LOADER_ENV_RE = /^(?:PATH|HOME|ZDOTDIR|XDG_CONFIG_HOME|IFS|ENV|BASH_ENV|SHELLOPTS|BASHOPTS|PS4|PROMPT_COMMAND|NODE_OPTIONS|NODE_PATH|NODE_EXTRA_CA_CERTS|PYTHONPATH|PYTHONHOME|PYTHONSTARTUP|PERL5OPT|PERL5LIB|PERLLIB|RUBYOPT|RUBYLIB|JAVA_TOOL_OPTIONS|_JAVA_OPTIONS|JDK_JAVA_OPTIONS|EDITOR|VISUAL|PAGER|LESSOPEN|LESSCLOSE|BROWSER|SSH_ASKPASS|LD_\w*|DYLD_\w*|NPM_CONFIG_\w*|GIT_(?:SSH|SSH_COMMAND|EXEC_PATH|ASKPASS|EDITOR|PAGER|EXTERNAL_DIFF|PROXY_COMMAND|DIR|WORK_TREE|TEMPLATE_DIR|CONFIG\w*))$/i;
+export function isLoaderEnvName(name) { return LOADER_ENV_RE.test(name); }
+// Item names appear in native dialogs and lookups: one line of printable text,
+// no padding (lookups trim, so a padded name would shadow an existing item).
+export function itemNameProblem(name) {
+    if (!name || name !== name.trim())
+        return "must not be empty or start or end with spaces";
+    if (name.length > 120)
+        return "must be at most 120 characters";
+    if (/[\p{Cc}\p{Cf}\u2028\u2029]/u.test(name))
+        return "must be one line of printable text";
+    return null;
+}
 // Parses dotenv-style files whose values may be references:
 //   GH_TOKEN=bw://GitHub CLI token
 //   export SENTRY_DSN="bw://Sentry/fields/dsn"
@@ -80,3 +95,80 @@ export function parseEnvFile(text) {
     });
     return out;
 }
+// Stricter than parseEnvFile, for `import`: a misread value would be stored in
+// the vault, so anything ambiguous is reported by line number (never by value)
+// instead of guessed. Values must also read back unchanged through parseEnvFile.
+export function parseDotenvStrict(text) {
+    const entries = [];
+    const errors = [];
+    const seen = new Set();
+    text.split(/\r?\n/).forEach((raw, index) => {
+        const line = index + 1;
+        const trimmed = raw.trim();
+        if (!trimmed || trimmed.startsWith("#"))
+            return;
+        const match = /^(export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=(.*)$/.exec(trimmed);
+        if (!match) {
+            errors.push({ line, reason: "not a NAME=value line" });
+            return;
+        }
+        const rest = match[3].trim();
+        let value;
+        if (rest.startsWith("'") || rest.startsWith('"')) {
+            const end = rest.indexOf(rest[0], 1);
+            if (end < 0) {
+                errors.push({ line, reason: "unterminated quote (multiline values are not supported)" });
+                return;
+            }
+            const after = rest.slice(end + 1).trim();
+            if (after && !/^#/.test(after)) {
+                errors.push({ line, reason: "text after the closing quote" });
+                return;
+            }
+            if (after && end + 1 === rest.indexOf("#", end)) {
+                errors.push({ line, reason: "comment must be separated from the closing quote by a space" });
+                return;
+            }
+            value = rest.slice(1, end);
+            if (rest[0] === '"' && /[\\$]/.test(value)) {
+                errors.push({ line, reason: "escape sequence or $ expansion inside double quotes" });
+                return;
+            }
+        }
+        else {
+            value = rest.replace(/\s+#.*$/, "");
+            if (value.includes("${")) {
+                errors.push({ line, reason: "${} expansion" });
+                return;
+            }
+        }
+        if (value.startsWith("!")) {
+            errors.push({ line, reason: "value starts with '!' (env files cannot run commands)" });
+            return;
+        }
+        if (seen.has(match[2])) {
+            errors.push({ line, reason: `duplicate key ${match[2]}` });
+            return;
+        }
+        seen.add(match[2]);
+        entries.push({ line, name: match[2], value, exported: Boolean(match[1]) });
+    });
+    return { entries, errors };
+}
+const SECRET_NAME_RE = /(SECRET|TOKEN|PASSW(?:OR)?D|PASSPHRASE|(?:^|_)PASS(?:$|_)|PWD|(?:^|_)KEY(?:$|_)|APIKEY|PRIVATE|CREDENTIAL|(?:^|_)CREDS?(?:$|_)|AUTH|JWT|DSN|WEBHOOK|COOKIE|SIGNING|ENCRYPT|SALT)/i;
+const SECRET_VALUE_RE = /^(?:gh[pousr]_|github_pat_|glpat-|xox[abprs]-|sk-|sk_(?:live|test)_|rk_(?:live|test)_|whsec_|AKIA|ASIA|AIza|npm_|hf_|ya29\.|eyJ)/;
+const URL_PASSWORD_RE = /^[a-z][a-z0-9+.-]*:\/\/[^\s:@/]*:[^\s@/]+@/i;
+// Local heuristic for `import`: never sends anything anywhere. A known secret
+// format wins over the name; otherwise names with a PUBLIC segment
+// (NEXT_PUBLIC_*, VITE_PUBLIC_*) are meant to ship to browsers.
+export function looksSecret(name, value) {
+    if (!value || isRef(value))
+        return false;
+    if (SECRET_VALUE_RE.test(value) || URL_PASSWORD_RE.test(value))
+        return true;
+    if (/(?:^|_)PUBLIC(?:$|_)/i.test(name))
+        return false;
+    if (SECRET_NAME_RE.test(name) || /^[0-9a-f]{32,}$/i.test(value))
+        return true;
+    return value.length >= 24 && !/\s/.test(value) && /[a-z]/.test(value) && /[A-Z]/.test(value) && /\d/.test(value);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "keyshroud",
-  "version": "0.5.1",
+  "version": "0.5.3",
   "mcpName": "io.github.dinhkarate/keyshroud",
   "description": "Let AI coding agents use your secrets without ever seeing them. Self-hosted Vaultwarden/Bitwarden, masked output, MCP server, Claude Code + pi plugins.",
   "keywords": [

package/skills/keyshroud/SKILL.md

@@ -11,12 +11,16 @@ in output with `<redacted:NAME>`.
 
 ## Rules
 
-1. Never ask the user to paste a secret into the chat. To store one, give them
-   this command to run in **their own terminal** (masked prompt):
+1. Never ask the user to paste a secret into the chat. To store one, run this
+   yourself; it opens a hidden-input dialog on the user's desktop, and you only
+   see `created … verified=yes`:
    ```bash
    keyshroud add --env STRIPE_API_KEY --item "Stripe API key" --notes "billing service"
    ```
-   With the MCP server, call `secrets_request` instead; it returns the same command.
+   Tell the user a dialog is waiting for them, and ask for one secret at a time;
+   if they cancel, do not ask again unprompted. Never ask for the vault master
+   password. With the MCP server, call `secrets_request` instead. Over SSH or without a display there is no dialog:
+   then give the user the command to run in their own terminal.
 2. Never print, echo, `cat`, base64, or otherwise transform a secret value.
    `<redacted:NAME>` in output means the secret was used correctly. Do not try
    to recover it.