keyshroud 0.5.1 → 0.5.3

package/src/cli.ts

@@ -1,16 +1,17 @@
 #!/usr/bin/env node
-import { chmod, copyFile, mkdir, lstat, readdir, readFile, readlink, symlink, unlink, writeFile } from "node:fs/promises";
+import { chmod, copyFile, mkdir, lstat, readdir, readFile, readlink, rename, stat, symlink, unlink, writeFile } from "node:fs/promises";
 import { constants, homedir } from "node:os";
 import { fileURLToPath } from "node:url";
-import { join, resolve } from "node:path";
+import { basename, dirname, join, relative, resolve } from "node:path";
 import { spawn } from "node:child_process";
+import { randomBytes } from "node:crypto";
 import process from "node:process";
 import { BRAND } from "./brand.ts";
 import * as core from "./core.ts";
 import { runClaudeHook } from "./hooks.ts";
 import { serveMcp } from "./mcp.ts";
 import { buildRedactIndex, compileRedactIndex, createRedactor, createRedactStream, type RedactIndex } from "./redact.ts";
-import { ENV_NAME_RE, parseRef } from "./refs.ts";
+import { ENV_NAME_RE, isLoaderEnvName, isRef, itemNameProblem, looksSecret, parseDotenvStrict, parseRef, type DotenvEntry } from "./refs.ts";
 
 const usage = `Usage: ${BRAND.bin} <command> [options]
 
@@ -22,8 +23,11 @@ Secrets
   redact                           Copy stdin to stdout with vault secrets masked
   scan [paths...]                  Find vault secret values in files (exit 1 on leaks)
   env [--shell]                    List wired names (or print shell exports)
-  add --env NAME --item ITEM [--notes TEXT] [--target pi|omp|both] [--stdin]
-  rotate --item ITEM [--stdin]
+  add --env NAME --item ITEM [--notes TEXT] [--target pi|omp|both] [--stdin|--dialog]
+  import [--from F|-] [--out F] [--prefix P] [--only A,B] [--skip A,B] [--yes] [--replace] [--force]
+                                   Move secrets from a .env into the vault and write .env.refs
+                                   (dry run unless --yes; prints names only)
+  rotate --item ITEM [--stdin|--dialog]
   wire --env NAME --item ITEM [--target pi|omp|both] [--force]
   unwire --env NAME [--target pi|omp|both]
 
@@ -53,6 +57,21 @@ function targetList(value: string | undefined): string[] {
   if (value === "pi") return [targetPaths.pi];
   fail("--target must be omp, pi, or both", 2);
 }
+// --stdin: piped value. Terminal: masked prompt. Otherwise (an agent's shell):
+// a native dialog, so the agent can start the command and the user only pastes.
+async function readSecret(args: string[], prompt: string, itemName: string, envName?: string): Promise<string> {
+  if (args.includes("--stdin")) return core.readSecretFromInput({ prompt, stdin: true });
+  if (process.stdin.isTTY && !args.includes("--dialog")) return core.readSecretFromInput({ prompt, stdin: false });
+  const value = await core.readSecretFromDialog({ itemName, envName });
+  if (value) return value;
+  if (value === "") throw new Error("Empty secret");
+  fail("No terminal and no dialog here (SSH or no display). Run the command in a terminal, or pipe the value with --stdin.", 2);
+}
+function checkNames(envName: string, itemName: string): void {
+  if (isLoaderEnvName(envName)) fail(`${envName} changes what programs load or run; it cannot be wired to a secret`, 2);
+  const problem = itemNameProblem(itemName);
+  if (problem) fail(`Vault item name ${problem}`, 2);
+}
 function shellQuote(value: string): string { return `'${value.replaceAll("'", "'\\''")}'`; }
 function failureCode(error: unknown): number {
   const text = error instanceof Error ? error.message : String(error);
@@ -128,9 +147,13 @@ async function inject(args: string[]): Promise<void> {
   await core.audit("inject", refs, output ?? "stdout");
   const rendered = template.replace(pattern, (_match, raw: string) => values.get(raw) ?? "");
   if (!output) { process.stdout.write(rendered); return; }
-  try { await readFile(output); if (!args.includes("--force")) fail(`Refusing to overwrite ${output}; use --force`, 5); } catch {}
-  await writeFile(output, rendered, { mode: 0o600 });
-  await chmod(output, 0o600);
+  // lstat, and a private temp file renamed over the target, so a planted
+  // symlink (even a dangling one) is replaced instead of followed.
+  const exists = await lstat(output).then(() => true, () => false);
+  if (exists && !args.includes("--force")) fail(`Refusing to overwrite ${output}; use --force`, 5);
+  const tmp = join(dirname(resolve(output)), `.${basename(output)}.tmp.${randomBytes(6).toString("hex")}`);
+  await writeFile(tmp, rendered, { mode: 0o600, flag: "wx" });
+  await rename(tmp, output);
   console.error(`rendered ${refs.length} reference(s) into ${output} (mode 0600)`);
 }
 
@@ -171,6 +194,90 @@ async function scan(paths: string[]): Promise<void> {
   if (leaks) process.exitCode = 1;
 }
 
+interface ImportRow { entry: DotenvEntry; kind: "new" | "reuse" | "conflict" | "literal" | "ref"; item?: string; note?: string }
+
+async function importCommand(args: string[]): Promise<void> {
+  requireKnownFlags(args, ["--from", "--out", "--prefix", "--only", "--skip"], ["--yes", "--replace", "--force"]);
+  const from = valueAfter(args, "--from") ?? ".env";
+  const yes = args.includes("--yes"); const replace = args.includes("--replace");
+  if (replace && (from === "-" || valueAfter(args, "--out"))) fail("--replace rewrites the --from file; it cannot be combined with stdin or --out", 2);
+  if (from === "-" && process.stdin.isTTY) fail("--from - needs the .env piped on stdin", 2);
+  const baseDir = from === "-" ? process.cwd() : dirname(resolve(from));
+  const out = replace ? resolve(from) : resolve(valueAfter(args, "--out") ?? join(baseDir, ".env.refs"));
+  const prefix = valueAfter(args, "--prefix") ?? basename(baseDir);
+  if (!/^[A-Za-z0-9._-]+$/.test(prefix)) fail("--prefix may contain only letters, digits, '.', '_' and '-' (set it with --prefix)", 2);
+  const list = (flag: string) => (valueAfter(args, flag) ?? "").split(",").map((name) => name.trim()).filter(Boolean);
+  const only = list("--only"); const skip = list("--skip");
+
+  let text: string;
+  try { text = from === "-" ? await readStdin() : await readFile(from, "utf8"); } catch { fail(`Cannot read ${from}`, 2); }
+  const { entries, errors } = parseDotenvStrict(text);
+  if (errors.length) {
+    for (const error of errors) console.error(`${from}:${error.line} ${error.reason}`);
+    fail(`${errors.length} line(s) cannot be imported safely; fix them or move them out of the file`, 2);
+  }
+  for (const name of [...only, ...skip]) if (!entries.some((entry) => entry.name === name)) fail(`--only/--skip name not in ${from}: ${name}`, 2);
+
+  await core.ensureSession();
+  const existing = await core.findItems(prefix);
+  const rows: ImportRow[] = [];
+  for (const entry of entries) {
+    if (isRef(entry.value)) { rows.push({ entry, kind: "ref" }); continue; }
+    const secret = (only.length ? only.includes(entry.name) : looksSecret(entry.name, entry.value)) && !skip.includes(entry.name);
+    if (!secret) { rows.push({ entry, kind: "literal" }); continue; }
+    const item = `${prefix} ${entry.name}`;
+    const matches = existing.filter((candidate) => candidate.name.toLowerCase() === item.toLowerCase());
+    if (matches.length > 1) { rows.push({ entry, item, kind: "conflict", note: "more than one vault item has this name" }); continue; }
+    if (matches.length === 0) { rows.push({ entry, item, kind: "new" }); continue; }
+    const current = await core.resolveRef({ item: matches[0].id, field: "password" });
+    rows.push(current === entry.value
+      ? { entry, item, kind: "reuse", note: "same value already in the vault" }
+      : { entry, item, kind: "conflict", note: "vault item exists with a different value" });
+  }
+
+  const width = Math.max(4, ...rows.map((row) => row.entry.name.length));
+  console.log(`import plan for ${from} (item prefix "${prefix}")`);
+  for (const row of rows) {
+    const label = row.kind === "literal" ? "literal   kept" : row.kind === "ref" ? "reference kept"
+      : row.kind === "conflict" ? `secret    conflict: ${row.note} ("${row.item}")`
+      : `secret    ${row.kind.padEnd(8)} -> bw://${row.item}${row.note ? `  (${row.note})` : ""}`;
+    const short = row.item && row.entry.value.length < 6 ? "  [under 6 characters: stored, but too short to be masked]" : "";
+    console.log(`  ${row.entry.name.padEnd(width)}  ${label}${short}`);
+  }
+  const count = (kind: ImportRow["kind"]) => rows.filter((row) => row.kind === kind).length;
+  const toStore = rows.filter((row) => row.kind === "new" || row.kind === "reuse");
+  console.log(`${toStore.length + count("conflict")} secret(s): ${count("new")} new, ${count("reuse")} already in the vault, ${count("conflict")} conflict(s); ${count("literal")} literal(s), ${count("ref")} reference(s)`);
+  if (count("conflict")) fail("Resolve the conflicts (choose another --prefix, or rename the vault items) before importing", 5);
+  if (!toStore.length) { console.log("Nothing to import."); return; }
+  const outExists = await stat(out).then(() => true, () => false);
+  if (outExists && !replace && !args.includes("--force")) fail(`${out} already exists; use --force to overwrite it`, 5);
+  if (!yes) { console.log(`Dry run: nothing written. Re-run with --yes to create ${count("new")} item(s) and write ${out}`); return; }
+
+  const created: string[] = [];
+  for (const row of rows) {
+    if (row.kind !== "new") continue;
+    try { await core.createSecretItem({ itemName: row.item!, secret: row.entry.value, envName: row.entry.name, notes: `Imported by ${BRAND.bin} from ${basename(from === "-" ? "stdin" : from)}` }); }
+    catch { if (created.length) console.error(`Created before the failure: ${created.join(", ")}`); fail(`Failed to create the vault item for ${row.entry.name}; nothing was written to ${out}`, 3); }
+    created.push(row.entry.name);
+  }
+  for (const row of toStore) {
+    let value: string | null = null;
+    try { value = await core.resolveRef({ item: row.item!, field: "password" }); } catch {}
+    if (value !== row.entry.value) fail(`Verification failed for ${row.entry.name}: the vault does not return the imported value; nothing was written to ${out}`, 4);
+  }
+
+  const eol = text.includes("\r\n") ? "\r\n" : "\n";
+  const lines = text.split(/\r?\n/);
+  for (const row of toStore) lines[row.entry.line - 1] = `${row.entry.exported ? "export " : ""}${row.entry.name}=bw://${row.item}`;
+  const mode = replace ? (await stat(out)).mode & 0o777 : 0o600;
+  const tmp = `${out}.tmp.${randomBytes(6).toString("hex")}`;
+  await writeFile(tmp, lines.join(eol), { mode, flag: "wx" });
+  await rename(tmp, out);
+  await core.audit("import", toStore.map((row) => row.entry.name), "cli");
+  console.log(`imported ${toStore.length} secret(s) (${created.length} new); wrote ${out}`);
+  if (!replace && from !== "-") console.log(`${from} still holds the plaintext values. Check with \`${BRAND.bin} run --env-file ${relative(process.cwd(), out) || out} -- <cmd>\`, then delete it or re-run with --replace.`);
+}
+
 async function main(): Promise<void> {
   const args = process.argv.slice(2); const command = args.shift();
   if (!command || command === "--help" || command === "-h" || command === "help") { console.log(usage); if (!command) process.exitCode = 2; return; }
@@ -226,31 +333,38 @@ async function main(): Promise<void> {
       await core.ensureSession(); process.stdout.write(await core.getSecret(item)); return;
     }
     if (command === "add") {
-      requireKnownFlags(args, ["--env", "--item", "--notes", "--target"], ["--stdin"]);
+      requireKnownFlags(args, ["--env", "--item", "--notes", "--target"], ["--stdin", "--dialog"]);
       const envName = valueAfter(args, "--env"); const itemName = valueAfter(args, "--item"); const notes = valueAfter(args, "--notes");
       if (!envName || !itemName || !ENV_NAME_RE.test(envName)) fail(usage, 2);
+      checkNames(envName, itemName);
       const reference = core.referenceFor(itemName);
       const targets = targetList(valueAfter(args, "--target"));
       await core.ensureSession();
-      const secret = await core.readSecretFromInput({ prompt: `Paste secret for ${envName}: `, stdin: args.includes("--stdin") });
+      if ((await core.findItems(itemName)).some((item) => item.name.toLowerCase() === itemName.toLowerCase())) fail(`Vault item already exists: ${itemName}`, 5);
+      const secret = await readSecret(args, `Paste secret for ${envName}: `, itemName, envName);
       await core.createSecretItem({ itemName, secret, envName, notes });
+      await core.audit("add", [envName], "cli");
       let conflict = false;
       for (const path of targets) { const result = await core.writeAuthEntry(path, envName, reference); if (!result.ok) conflict = true; }
       const verified = (await core.resolveShellValue(reference)) !== null;
+      await core.refreshRedactIndex();
       console.log(`created item=${itemName} env=${envName} targets=${targets.join(",")} verified=${verified ? "yes" : "no"}`);
       if (conflict) { console.error("Item created, but one or more auth targets already contained the environment name."); process.exitCode = 5; }
       return;
     }
+    if (command === "import") { await importCommand(args); return; }
     if (command === "rotate") {
-      requireKnownFlags(args, ["--item"], ["--stdin"]);
+      requireKnownFlags(args, ["--item"], ["--stdin", "--dialog"]);
       const itemName = valueAfter(args, "--item"); if (!itemName) fail(usage, 2);
-      await core.ensureSession(); const secret = await core.readSecretFromInput({ prompt: "Paste replacement secret: ", stdin: args.includes("--stdin") });
-      await core.rotateSecretItem({ itemName, secret }); console.log(`rotated item=${itemName}`); return;
+      await core.ensureSession(); const secret = await readSecret(args, "Paste replacement secret: ", itemName);
+      await core.rotateSecretItem({ itemName, secret }); await core.audit("rotate", [itemName], "cli"); await core.refreshRedactIndex();
+      console.log(`rotated item=${itemName}`); return;
     }
     if (command === "wire") {
       requireKnownFlags(args, ["--env", "--item", "--target"], ["--force"]);
       const envName = valueAfter(args, "--env"); const itemName = valueAfter(args, "--item");
       if (!envName || !itemName || !ENV_NAME_RE.test(envName)) fail(usage, 2);
+      if (isLoaderEnvName(envName)) fail(`${envName} changes what programs load or run; it cannot be wired to a secret`, 2);
       const reference = core.referenceFor(itemName);
       const targets = targetList(valueAfter(args, "--target"));
       for (const path of targets) { const result = await core.writeAuthEntry(path, envName, reference, { overwrite: args.includes("--force") }); if (!result.ok) fail(result.message, 5); }

package/src/core.ts

@@ -1,14 +1,14 @@
 // Runtime-neutral core: no pi/omp/Claude Code imports. Every caller (agent
 // extensions, CLI, MCP server, hooks) goes through these functions.
 import { execFile } from "node:child_process";
+import { randomBytes } from "node:crypto";
 import { appendFile, chmod, mkdir, readFile, realpath, rename, rm, stat, unlink, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { join, dirname } from "node:path";
 import process from "node:process";
-import * as readline from "node:readline";
 import { BRAND } from "./brand.ts";
 import { buildRedactIndex, type RedactIndex } from "./redact.ts";
-import { ENV_NAME_RE, legacyRefFor, parseEnvFile, parseRef, type SecretRef } from "./refs.ts";
+import { ENV_NAME_RE, isLoaderEnvName, itemNameProblem, legacyRefFor, parseEnvFile, parseRef, type SecretRef } from "./refs.ts";
 
 const P = BRAND.envPrefix;
 function setting(name: string): string | undefined {
@@ -72,7 +72,8 @@ export const VAULT_ENV_KEYS: readonly string[] = ["BW_SESSION", "BW_PASSWORD", "
 export function childEnv(extra: Record<string, string> = {}): Record<string, string> {
   const env: Record<string, string> = {};
   for (const [name, value] of Object.entries(process.env)) if (value !== undefined && !VAULT_ENV_KEYS.includes(name)) env[name] = value;
-  return { ...env, ...extra };
+  for (const [name, value] of Object.entries(extra)) if (!isLoaderEnvName(name)) env[name] = value;
+  return env;
 }
 
 export async function bw(args: string[], opts: { input?: string; session?: string } = {}): Promise<string> {
@@ -252,8 +253,8 @@ export function ensureSession(): Promise<string> {
 
 async function writePrivateFile(path: string, content: string): Promise<void> {
   await mkdir(dirname(path), { recursive: true, mode: 0o700 });
-  const tmp = `${path}.tmp.${process.pid}`;
-  await writeFile(tmp, content, { encoding: "utf8", mode: 0o600 });
+  const tmp = `${path}.tmp.${randomBytes(6).toString("hex")}`;
+  await writeFile(tmp, content, { encoding: "utf8", mode: 0o600, flag: "wx" });
   await chmod(tmp, 0o600);
   await rename(tmp, path);
   await chmod(path, 0o600);
@@ -456,6 +457,7 @@ export async function resolveEntries(entries: Array<{ name: string; raw: string
 export async function envFileEntries(path: string): Promise<Array<{ name: string; raw: string }>> {
   return parseEnvFile(await readFile(path, "utf8")).map(({ name, value }) => {
     if (value.trim().startsWith("!")) throw new Error(`${path}: ${name} uses a shell command; env files accept only bw:// references and literals`);
+    if (isLoaderEnvName(name)) throw new Error(`${path}: ${name} changes what programs load or run; env files cannot set it`);
     return { name, raw: value };
   });
 }
@@ -505,6 +507,12 @@ export async function writeRedactIndex(values: Record<string, string>): Promise<
   return index;
 }
 
+// Re-index after the wired set changes so hooks mask a new value right away.
+export async function refreshRedactIndex(): Promise<void> {
+  const env = await resolveEntries(await authEnvEntries());
+  await writeRedactIndex(indexValues(env.secrets));
+}
+
 export async function readRedactIndex(): Promise<RedactIndex | null> {
   try {
     const parsed = JSON.parse(await readFile(REDACT_INDEX_FILE, "utf8")) as RedactIndex;
@@ -532,7 +540,16 @@ export async function getSecret(itemName: string): Promise<string> {
   try { return await bw(["get", "password", itemName]); } catch (error) { throw mapItemError(error, itemName); }
 }
 
+// An agent can start add/rotate, so a dialog could be used to phish the master
+// password into an item it can then read; refuse it outright.
+async function refuseMasterPassword(secret: string): Promise<void> {
+  if (secret && secret === await readMasterPassword()) throw new Error("Refusing to store the vault master password as a secret");
+}
+
 export async function createSecretItem(opts: { itemName: string; secret: string; envName?: string; notes?: string }): Promise<{ id: string }> {
+  const problem = itemNameProblem(opts.itemName);
+  if (problem) throw new Error(`Vault item name ${problem}`);
+  await refuseMasterPassword(opts.secret);
   const existing = await findItems(opts.itemName);
   if (existing.some((item) => item.name.toLowerCase() === opts.itemName.toLowerCase())) throw new Error(`Vault item already exists: ${opts.itemName}`);
   const item: Record<string, unknown> = {
@@ -549,6 +566,7 @@ export async function createSecretItem(opts: { itemName: string; secret: string;
 }
 
 export async function rotateSecretItem(opts: { itemName: string; secret: string }): Promise<{ id: string }> {
+  await refuseMasterPassword(opts.secret);
   let parsed: Record<string, unknown>;
   try { parsed = JSON.parse(await bw(["get", "item", opts.itemName])) as Record<string, unknown>; } catch (error) { throw mapItemError(error, opts.itemName); }
   const login = parsed.login && typeof parsed.login === "object" ? parsed.login as Record<string, unknown> : {};
@@ -566,19 +584,122 @@ export async function deleteItem(id: string, permanent = false): Promise<void> {
 }
 
 export async function readSecretFromInput(opts: { prompt: string; stdin: boolean }): Promise<string> {
-  if (opts.stdin || !process.stdin.isTTY) {
+  if (opts.stdin) {
     let input = "";
     for await (const chunk of process.stdin) input += String(chunk);
     input = input.replace(/\r?\n$/, "");
     if (!input) throw new Error("Empty secret");
     return input;
   }
-  const rl = readline.createInterface({ input: process.stdin, output: process.stdout, terminal: true });
-  (rl as unknown as { _writeToOutput: (text: string) => void })._writeToOutput = () => {};
-  process.stderr.write(opts.prompt);
-  const value = await new Promise<string>((resolve) => rl.question("", resolve));
-  rl.close();
-  process.stderr.write("\n");
+  if (!process.stdin.isTTY) throw new Error("No terminal to prompt on; pipe the value with --stdin");
+  const value = await readMasked(opts.prompt);
   if (!value) throw new Error("Empty secret");
   return value;
 }
+
+// Native hidden-input dialog for callers without a terminal (agent shells, MCP).
+// An agent can open it, so the wording is fixed, says who asked, and warns
+// against the master password; names are validated and passed as data (argv),
+// never as script. One dialog at a time, with a pause after a cancel. Resolves
+// null when no dialog can be shown (SSH, headless Linux, missing tools).
+const DIALOG_LOCK = join(CONFIG_DIR, "dialog.lock");
+const DIALOG_COOLDOWN_MS = 30_000;
+const DIALOG_TIMEOUT_MS = 300_000;
+
+export async function readSecretFromDialog(opts: { itemName: string; envName?: string }): Promise<string | null> {
+  if (process.env.SSH_CONNECTION || process.env.SSH_TTY) return null;
+  const problem = itemNameProblem(opts.itemName);
+  if (problem) throw new Error(`Vault item name ${problem}`);
+  if (opts.envName !== undefined && !ENV_NAME_RE.test(opts.envName)) throw new Error("Variable names must be UPPER_SNAKE_CASE");
+  const text = [
+    opts.envName ? "A program on this computer, usually an AI agent, asked to store a NEW secret." : "A program on this computer, usually an AI agent, asked to REPLACE the value of a secret.",
+    "",
+    ...(opts.envName ? [`Variable: ${opts.envName}`] : []),
+    `Vault item: ${opts.itemName}`,
+    "",
+    "This is not a login prompt. Never enter your vault master password here.",
+  ].join("\n");
+  const candidates: Array<[string, string[]]> = process.platform === "darwin"
+    ? [["osascript", ["-e", "on run argv", "-e", 'activate', "-e",
+        'text returned of (display dialog (item 1 of argv) default answer "" with hidden answer with title "keyshroud" buttons {"Cancel", "Save"} default button "Save" cancel button "Cancel" with icon caution)',
+        "-e", "end run", "--", text]]]
+    : process.env.DISPLAY || process.env.WAYLAND_DISPLAY
+      ? [["zenity", ["--entry", "--hide-text", "--no-markup", "--title=keyshroud", `--text=${text}`]], ["kdialog", ["--title", "keyshroud", "--password", text.replace(/[<>]/g, "")]]]
+      : [];
+  if (!candidates.length) return null;
+  return withDialogLock(async () => {
+    for (const [command, args] of candidates) {
+      const result = await new Promise<{ code: number | string | null; stdout: string; stderr: string }>((resolve) => {
+        execFile(command, args, { timeout: DIALOG_TIMEOUT_MS }, (error, stdout, stderr) => resolve({ code: error ? ((error as NodeJS.ErrnoException).code ?? 1) : 0, stdout: String(stdout), stderr: String(stderr) }));
+      });
+      if (result.code === "ENOENT") continue;
+      if (result.code === 0) return result.stdout.replace(/\r?\n$/, "");
+      if (command !== "osascript" || /-128/.test(result.stderr)) throw new Error("Cancelled");
+      return null;
+    }
+    return null;
+  });
+}
+
+async function withDialogLock<T>(fn: () => Promise<T>): Promise<T> {
+  await mkdir(CONFIG_DIR, { recursive: true, mode: 0o700 });
+  let held = "";
+  try { held = await readFile(DIALOG_LOCK, "utf8"); } catch {}
+  const [kind, at] = held.trim().split(":");
+  const age = Date.now() - Number(at);
+  const live = (kind === "open" || kind === "cancelled") && age >= 0 && age < (kind === "cancelled" ? DIALOG_COOLDOWN_MS : DIALOG_TIMEOUT_MS + 30_000);
+  if (!live) await rm(DIALOG_LOCK, { force: true });
+  try { await writeFile(DIALOG_LOCK, `open:${Date.now()}\n`, { flag: "wx", mode: 0o600 }); }
+  catch { throw new Error(kind === "cancelled" ? "The last dialog was cancelled; wait 30 seconds before asking again" : "Another keyshroud dialog is already open"); }
+  try {
+    const value = await fn();
+    await rm(DIALOG_LOCK, { force: true });
+    return value;
+  } catch (error) {
+    if (error instanceof Error && error.message === "Cancelled") await writeFile(DIALOG_LOCK, `cancelled:${Date.now()}\n`, { mode: 0o600 });
+    else await rm(DIALOG_LOCK, { force: true });
+    throw error;
+  }
+}
+
+// Raw-mode prompt that echoes one "*" per character (capped, then a count), so
+// the user sees typing and pastes land without the value ever reaching the screen.
+function readMasked(prompt: string): Promise<string> {
+  const stdin = process.stdin;
+  const chars: string[] = [];
+  const draw = () => {
+    const shown = "*".repeat(Math.min(chars.length, 24)) + (chars.length > 24 ? ` (${chars.length} chars)` : "");
+    process.stderr.write(`\r\x1b[2K${prompt}${shown}`);
+  };
+  return new Promise((resolve, reject) => {
+    // After Enter, keep reading briefly: the rest of a multi-line paste must be
+    // consumed here (or it would reach the parent shell) and is then refused.
+    let ending: ReturnType<typeof setTimeout> | undefined;
+    let multiline = false;
+    const settle = () => {
+      clearTimeout(ending);
+      ending = setTimeout(() => finish(multiline ? new Error("Multi-line values are not supported in the prompt; pipe them with --stdin") : undefined), 100);
+    };
+    const finish = (error?: Error) => {
+      clearTimeout(ending);
+      stdin.off("data", onData); stdin.setRawMode(false); stdin.pause();
+      process.stderr.write("\n");
+      if (error) reject(error); else resolve(chars.join(""));
+    };
+    const onData = (chunk: string) => {
+      if (ending) { if (/[^\r\n]/.test(chunk)) multiline = true; return settle(); }
+      const clean = [...chunk.replace(/\x1b\[[0-9;?]*[ -/]*[@-~]|\x1b./g, "")];
+      for (const [index, ch] of clean.entries()) {
+        if (ch === "\r" || ch === "\n") { if (/[^\r\n]/.test(clean.slice(index + 1).join(""))) multiline = true; return settle(); }
+        if (ch === "\x03") return finish(new Error("Cancelled"));
+        if (ch === "\x04") return chars.length ? finish() : finish(new Error("Cancelled"));
+        if (ch === "\x7f" || ch === "\b") chars.pop();
+        else if (ch === "\x15") chars.length = 0;
+        else if (ch >= " ") chars.push(ch);
+      }
+      draw();
+    };
+    stdin.setRawMode(true); stdin.setEncoding("utf8"); stdin.resume(); stdin.on("data", onData);
+    draw();
+  });
+}

package/src/hooks.ts

@@ -22,8 +22,8 @@ async function sessionStart(): Promise<string> {
     await core.writeRedactIndex(core.indexValues(env.secrets));
     const names = Object.keys(env.values);
     context = names.length
-      ? `${BRAND.name}: vault secrets are available by name only: ${names.join(", ")}. Run every command that uses one through \`${BRAND.bin} run -- <command>\` (or the secrets_run MCP tool): its output is masked as <redacted:NAME> even when the command fails. Never print a secret. Never ask the user to paste a secret into chat; use \`${BRAND.bin} add\` in their terminal instead.`
-      : `${BRAND.name}: no secrets are wired yet. Ask the user to run \`${BRAND.bin} add --env NAME --item "Item"\` in their own terminal.`;
+      ? `${BRAND.name}: vault secrets are available by name only: ${names.join(", ")}. Run every command that uses one through \`${BRAND.bin} run -- <command>\` (or the secrets_run MCP tool): its output is masked as <redacted:NAME> even when the command fails. Never print a secret. Never ask the user to paste a secret into chat. To store a new one, run \`${BRAND.bin} add --env NAME --item "Item"\` (or call secrets_request): it opens a dialog on the user's desktop for the value.`
+      : `${BRAND.name}: no secrets are wired yet. To store one, run \`${BRAND.bin} add --env NAME --item "Item"\` (or call secrets_request): it opens a dialog on the user's desktop for the value.`;
   } catch (error) {
     context = `${BRAND.name}: the vault could not be unlocked (${error instanceof Error ? error.message : String(error)}), so tool-output redaction may be incomplete this session. Do not print or inspect secrets; ask the user to run \`${BRAND.bin} unlock\`.`;
   }

package/src/mcp.ts

@@ -7,7 +7,7 @@ import process from "node:process";
 import { BRAND } from "./brand.ts";
 import * as core from "./core.ts";
 import { createRedactor } from "./redact.ts";
-import { ENV_NAME_RE } from "./refs.ts";
+import { ENV_NAME_RE, isLoaderEnvName, itemNameProblem } from "./refs.ts";
 
 const SUPPORTED_VERSIONS = ["2025-11-25", "2025-06-18", "2025-03-26", "2024-11-05"];
 const OUTPUT_LIMIT = 256 * 1024;
@@ -35,7 +35,7 @@ const TOOLS = [
   },
   {
     name: "secrets_request",
-    description: "Ask the human to store a new secret. Returns a terminal command for the user to run; the value is typed into a masked prompt and never passes through the conversation.",
+    description: "Ask the human to store a new secret. Opens a native hidden-input dialog on the user's desktop and stores the value in the vault; where no dialog can be shown, returns a terminal command for the user to run instead. The value never passes through the conversation.",
     inputSchema: {
       type: "object",
       required: ["env_name", "item_name"],
@@ -85,13 +85,13 @@ async function runTool(args: Json): Promise<Json> {
     detached: true,
   });
   const chunks = { stdout: [] as Buffer[], stderr: [] as Buffer[] };
-  // Collect generously, mask, then truncate, so a cut never splits a secret
-  // before redaction.
-  let size = 0;
+  // Collect generously per stream, mask, then truncate. If collection stopped
+  // early, the tail may end inside a secret, so it is dropped before masking.
+  const sizes = { stdout: 0, stderr: 0 };
   for (const stream of ["stdout", "stderr"] as const) {
     child[stream].on("data", (chunk: Buffer) => {
-      if (size >= OUTPUT_LIMIT * 4) return;
-      size += chunk.length;
+      if (sizes[stream] >= OUTPUT_LIMIT * 2) return;
+      sizes[stream] += chunk.length;
       chunks[stream].push(chunk);
     });
   }
@@ -101,9 +101,11 @@ async function runTool(args: Json): Promise<Json> {
     child.on("error", (error) => done(`spawn error: ${error.message}`));
   });
   clearTimeout(timer);
-  let truncated = size >= OUTPUT_LIMIT * 4;
+  let truncated = false;
   const out = (stream: "stdout" | "stderr") => {
-    const masked = redactor.redact(Buffer.concat(chunks[stream]).toString("utf8"));
+    let raw = Buffer.concat(chunks[stream]).toString("utf8");
+    if (sizes[stream] >= OUTPUT_LIMIT * 2) { truncated = true; raw = raw.slice(0, redactor.safeCut(raw)); }
+    const masked = redactor.redact(raw);
     if (masked.length <= OUTPUT_LIMIT / 2) return masked;
     truncated = true;
     return masked.slice(0, OUTPUT_LIMIT / 2);
@@ -132,8 +134,32 @@ async function callTool(name: string, args: Json): Promise<Json> {
     const envName = String(args.env_name ?? "");
     const itemName = String(args.item_name ?? "");
     if (!ENV_NAME_RE.test(envName) || !itemName) return text("env_name must be UPPER_SNAKE_CASE and item_name is required", true);
-    const purpose = typeof args.purpose === "string" && args.purpose ? ` --notes ${shellQuote(args.purpose)}` : "";
-    return text(`Ask the user to run this in their own terminal (the value is entered in a masked prompt; it must never be pasted into the chat):\n\n  ${BRAND.bin} add --env ${envName} --item ${shellQuote(itemName)}${purpose}\n\nAfter it reports verified=yes, use secrets_run with $${envName}.`);
+    if (isLoaderEnvName(envName)) return text(`${envName} changes what programs load or run; it cannot be wired to a secret`, true);
+    const problem = itemNameProblem(itemName);
+    if (problem) return text(`item_name ${problem}`, true);
+    const notes = typeof args.purpose === "string" && args.purpose ? args.purpose.slice(0, 500) : undefined;
+    try {
+      const reference = core.referenceFor(itemName);
+      await core.ensureSession();
+      if ((await core.findItems(itemName)).some((item) => item.name.toLowerCase() === itemName.toLowerCase())) return text(`Vault item already exists: ${itemName}`, true);
+      const secret = await core.readSecretFromDialog({ itemName, envName });
+      if (secret === "") return text("The user saved an empty value; nothing was stored.", true);
+      if (secret !== null) {
+        await core.createSecretItem({ itemName, secret, envName, notes });
+        await core.audit("request", [envName], "mcp");
+        const conflicts: string[] = [];
+        for (const path of Object.values(core.getAuthTargets())) if (!(await core.writeAuthEntry(path, envName, reference)).ok) conflicts.push(path);
+        await core.refreshRedactIndex();
+        if (conflicts.length) return text(`created item=${itemName}, but ${envName} is already wired to another secret in ${conflicts.join(", ")} and was left unchanged. Ask the user before running \`${BRAND.bin} wire --env ${envName} --item ${shellQuote(itemName)} --force\`.`, true);
+        const verified = (await core.resolveShellValue(reference)) !== null;
+        return text(`The user entered the value in a ${BRAND.name} dialog. created item=${itemName} env=${envName} verified=${verified ? "yes" : "no"}. Use secrets_run with $${envName}.`);
+      }
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      return text(message === "Cancelled" ? "The user cancelled the dialog; nothing was stored." : message, true);
+    }
+    const purpose = notes ? ` --notes ${shellQuote(notes)}` : "";
+    return text(`No dialog can be shown here. Ask the user to run this in their own terminal (the value is entered in a masked prompt; it must never be pasted into the chat):\n\n  ${BRAND.bin} add --env ${envName} --item ${shellQuote(itemName)}${purpose}\n\nAfter it reports verified=yes, use secrets_run with $${envName}.`);
   }
   if (name === "vault_status") {
     try { await core.ensureSession(); } catch {}

package/src/redact.ts

@@ -81,7 +81,7 @@ export function createRedactor(values: Record<string, string>): Redactor {
       if (text.length - cut <= MAX_HOLD) return cut;
       // Bounded fallback: cut near the end, moving forward past any complete
       // secret that straddles it, so whole matches are still replaced.
-      cut = text.length - maxLength;
+      cut = Math.max(0, text.length - maxLength);
       while (cut < text.length && straddling(cut)) cut++;
       return cut;
     },

package/src/refs.ts

@@ -55,6 +55,20 @@ export function legacyRefFor(itemName: string): string {
 
 export const ENV_NAME_RE = /^[A-Z_][A-Z0-9_]*$/;
 
+// Variables that change what a child process loads or runs. Env files can come
+// from a cloned repo and agents can wire names, so neither may set these.
+const LOADER_ENV_RE = /^(?:PATH|HOME|ZDOTDIR|XDG_CONFIG_HOME|IFS|ENV|BASH_ENV|SHELLOPTS|BASHOPTS|PS4|PROMPT_COMMAND|NODE_OPTIONS|NODE_PATH|NODE_EXTRA_CA_CERTS|PYTHONPATH|PYTHONHOME|PYTHONSTARTUP|PERL5OPT|PERL5LIB|PERLLIB|RUBYOPT|RUBYLIB|JAVA_TOOL_OPTIONS|_JAVA_OPTIONS|JDK_JAVA_OPTIONS|EDITOR|VISUAL|PAGER|LESSOPEN|LESSCLOSE|BROWSER|SSH_ASKPASS|LD_\w*|DYLD_\w*|NPM_CONFIG_\w*|GIT_(?:SSH|SSH_COMMAND|EXEC_PATH|ASKPASS|EDITOR|PAGER|EXTERNAL_DIFF|PROXY_COMMAND|DIR|WORK_TREE|TEMPLATE_DIR|CONFIG\w*))$/i;
+export function isLoaderEnvName(name: string): boolean { return LOADER_ENV_RE.test(name); }
+
+// Item names appear in native dialogs and lookups: one line of printable text,
+// no padding (lookups trim, so a padded name would shadow an existing item).
+export function itemNameProblem(name: string): string | null {
+  if (!name || name !== name.trim()) return "must not be empty or start or end with spaces";
+  if (name.length > 120) return "must be at most 120 characters";
+  if (/[\p{Cc}\p{Cf}\u2028\u2029]/u.test(name)) return "must be one line of printable text";
+  return null;
+}
+
 // Parses dotenv-style files whose values may be references:
 //   GH_TOKEN=bw://GitHub CLI token
 //   export SENTRY_DSN="bw://Sentry/fields/dsn"
@@ -74,3 +88,55 @@ export function parseEnvFile(text: string): Array<{ name: string; value: string
   });
   return out;
 }
+
+export interface DotenvEntry { line: number; name: string; value: string; exported: boolean }
+
+// Stricter than parseEnvFile, for `import`: a misread value would be stored in
+// the vault, so anything ambiguous is reported by line number (never by value)
+// instead of guessed. Values must also read back unchanged through parseEnvFile.
+export function parseDotenvStrict(text: string): { entries: DotenvEntry[]; errors: Array<{ line: number; reason: string }> } {
+  const entries: DotenvEntry[] = [];
+  const errors: Array<{ line: number; reason: string }> = [];
+  const seen = new Set<string>();
+  text.split(/\r?\n/).forEach((raw, index) => {
+    const line = index + 1;
+    const trimmed = raw.trim();
+    if (!trimmed || trimmed.startsWith("#")) return;
+    const match = /^(export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=(.*)$/.exec(trimmed);
+    if (!match) { errors.push({ line, reason: "not a NAME=value line" }); return; }
+    const rest = match[3].trim();
+    let value: string;
+    if (rest.startsWith("'") || rest.startsWith('"')) {
+      const end = rest.indexOf(rest[0], 1);
+      if (end < 0) { errors.push({ line, reason: "unterminated quote (multiline values are not supported)" }); return; }
+      const after = rest.slice(end + 1).trim();
+      if (after && !/^#/.test(after)) { errors.push({ line, reason: "text after the closing quote" }); return; }
+      if (after && end + 1 === rest.indexOf("#", end)) { errors.push({ line, reason: "comment must be separated from the closing quote by a space" }); return; }
+      value = rest.slice(1, end);
+      if (rest[0] === '"' && /[\\$]/.test(value)) { errors.push({ line, reason: "escape sequence or $ expansion inside double quotes" }); return; }
+    } else {
+      value = rest.replace(/\s+#.*$/, "");
+      if (value.includes("${")) { errors.push({ line, reason: "${} expansion" }); return; }
+    }
+    if (value.startsWith("!")) { errors.push({ line, reason: "value starts with '!' (env files cannot run commands)" }); return; }
+    if (seen.has(match[2])) { errors.push({ line, reason: `duplicate key ${match[2]}` }); return; }
+    seen.add(match[2]);
+    entries.push({ line, name: match[2], value, exported: Boolean(match[1]) });
+  });
+  return { entries, errors };
+}
+
+const SECRET_NAME_RE = /(SECRET|TOKEN|PASSW(?:OR)?D|PASSPHRASE|(?:^|_)PASS(?:$|_)|PWD|(?:^|_)KEY(?:$|_)|APIKEY|PRIVATE|CREDENTIAL|(?:^|_)CREDS?(?:$|_)|AUTH|JWT|DSN|WEBHOOK|COOKIE|SIGNING|ENCRYPT|SALT)/i;
+const SECRET_VALUE_RE = /^(?:gh[pousr]_|github_pat_|glpat-|xox[abprs]-|sk-|sk_(?:live|test)_|rk_(?:live|test)_|whsec_|AKIA|ASIA|AIza|npm_|hf_|ya29\.|eyJ)/;
+const URL_PASSWORD_RE = /^[a-z][a-z0-9+.-]*:\/\/[^\s:@/]*:[^\s@/]+@/i;
+
+// Local heuristic for `import`: never sends anything anywhere. A known secret
+// format wins over the name; otherwise names with a PUBLIC segment
+// (NEXT_PUBLIC_*, VITE_PUBLIC_*) are meant to ship to browsers.
+export function looksSecret(name: string, value: string): boolean {
+  if (!value || isRef(value)) return false;
+  if (SECRET_VALUE_RE.test(value) || URL_PASSWORD_RE.test(value)) return true;
+  if (/(?:^|_)PUBLIC(?:$|_)/i.test(name)) return false;
+  if (SECRET_NAME_RE.test(name) || /^[0-9a-f]{32,}$/i.test(value)) return true;
+  return value.length >= 24 && !/\s/.test(value) && /[a-z]/.test(value) && /[A-Z]/.test(value) && /\d/.test(value);
+}