keyshroud 0.5.2 → 0.5.3

package/CHANGELOG.md

@@ -5,6 +5,36 @@ All notable changes are documented here. This project follows
 
 ## [Unreleased]
 
+## [0.5.3] - 2026-10-15
+
+### Security
+Fixes from an independent audit and a multi-model review of 0.5.2.
+- The native dialog could be used by a prompt-injected agent to phish new
+  secrets, including the vault master password. It now says a program asked for
+  it and warns against the master password, refuses multi-line, control or bidi
+  characters and names over 120 characters, refuses a value equal to the master
+  password, opens one at a time with a 30 s pause after a cancel, and is audited.
+  zenity runs with `--no-markup`.
+- Env files could set `PATH`, `NODE_OPTIONS`, `LD_PRELOAD` and other loader
+  variables, so a cloned repo's `.env.refs` could run code. They are rejected
+  in env files, refused by `add`/`wire`/`secrets_request`, and never injected.
+- Streaming redaction leaked most of a secret longer than 4096 characters.
+- `secrets_run` could return a partial secret when output hit the collection
+  limit; the cut tail is now dropped before masking, with per-stream budgets.
+- `import` missed `*_PASS`, URL passwords with no username, hex keys, and known
+  key formats in names containing `PUBLIC`; `.env.refs` is now written `0600`.
+- `inject -o` replaces a planted symlink instead of writing through it; temp
+  files use random names and exclusive creation.
+
+### Changed
+- `add`/`rotate` read stdin only with `--stdin`; a multi-line paste into the
+  `*` prompt is drained and refused instead of reaching the shell.
+- `secrets_request` checks names and existing items before opening the dialog,
+  reports auth.json conflicts instead of claiming success, and returns errors.
+- Item names with leading or trailing spaces are refused (they shadowed
+  existing items). `add`, `rotate` and `secrets_request` refresh the redact
+  index and write to the audit log.
+
 ## [0.5.2] - 2026-10-15
 
 ### Added

package/README.md

@@ -61,7 +61,7 @@ webhooks, databases. The usual options are bad:
 | 🙈 **Masked output** | `keyshroud run` replaces every secret value in stdout/stderr with `<redacted:NAME>` — streaming-safe across chunk boundaries. |
 | 🪝 **Agent hooks** | The pi/omp `tool_result` hook redacts every tool result, failed ones included. Claude Code's `PostToolUse` hook redacts every *successful* tool result (Bash, Read, Grep, MCP…) — see [limits](#security-model). |
 | 🔌 **MCP server** | `keyshroud mcp` gives any MCP client `secrets_run`, `secrets_list`, `secrets_request`, `vault_status`. No tool ever returns a value. |
-| 🔗 **Commit-safe references** | `bw://item`, `bw://item/username`, `bw://item/fields/name`, `bw://item/totp` in `.env.refs` files and templates. |
+| 🔗 **Committable references** | `bw://item`, `bw://item/username`, `bw://item/fields/name`, `bw://item/totp` in `.env.refs` files and templates: names, not values. |
 | ⌨️ **Paste-to-create** | New secrets go through a masked prompt in the user's terminal or a masked popup in pi — never through the chat. |
 | 📄 **`inject`** | Render `{{ bw://… }}` templates into `0600` config files for tools that can't read env vars (`.npmrc`, kubeconfig). |
 | 🔎 **`scan`** | Find vault values that leaked into your working tree (pre-commit friendly). |
@@ -373,18 +373,30 @@ Guarantees we test for:
 
 - secret values never appear in argv, logs, diagnostics, MCP results, hook
   output, or `audit.jsonl`;
-- new secrets are read from a masked prompt or stdin, never flags;
+- new secrets are read from a masked prompt, `--stdin`, or a native dialog, never flags;
+- the dialog an agent can open says it was requested by a program, warns against the
+  master password, refuses names that are not one printable line, refuses the master
+  password itself, and opens one at a time (30 s pause after a cancel);
 - the session file, redact index, rendered templates and auth files are `0600`;
 - auth.json writes are locked and atomic and never overwrite without `--force`;
 - commands started by `run` and `secrets_run` never receive `BW_SESSION`,
   `BW_PASSWORD`, `BW_CLIENTID` or `BW_CLIENTSECRET`, so `--only` really limits
   what a command can read (inside pi/omp the agent process keeps the session for
   legacy `!bw` auth entries; its value is redacted from tool output);
-- env files may contain only references and literals — a `!command` value is
-  rejected, so a cloned repo's `.env.refs` cannot run code;
+- env files may contain only references and literals: a `!command` value is
+  rejected, and so are variables that change what programs load or run (`PATH`,
+  `NODE_OPTIONS`, `LD_*`, `DYLD_*`, `BASH_ENV`, `GIT_SSH_COMMAND`, …), which are
+  also never wired or injected;
 - an unparseable `auth.json` is never overwritten.
 
-Known limits: an agent with shell access as your user can read
+Known limits: a `.env.refs` can reference **any** item in your vault, not only the
+ones you wired, so read a cloned repo's `.env.refs` before running `--env-file`
+with it. `import` decides what is secret by heuristics and keeps everything else
+as a literal; check its plan before committing `.env.refs`. The Claude Code
+`PostToolUse` hook does not see failed commands (`PostToolUseFailure` cannot
+rewrite output) or anything a client sends as telemetry, and it only knows wired
+values, so `keyshroud get bw://…` or `run --no-mask` print in the clear; run
+secret-using commands through `keyshroud run` or `secrets_run`. An agent with shell access as your user can read
 `~/.config/keyshroud/session` and use `bw` directly — run agents in a sandbox or
 container if that matters. Redaction is exact-match, so a *partial* or transformed value
 (`${TOKEN:0:10}`, base64, a line wrapped by a tool) is not masked; values

package/dist/cli.js

@@ -4,13 +4,14 @@ import { constants, homedir } from "node:os";
 import { fileURLToPath } from "node:url";
 import { basename, dirname, join, relative, resolve } from "node:path";
 import { spawn } from "node:child_process";
+import { randomBytes } from "node:crypto";
 import process from "node:process";
 import { BRAND } from "./brand.js";
 import * as core from "./core.js";
 import { runClaudeHook } from "./hooks.js";
 import { serveMcp } from "./mcp.js";
 import { buildRedactIndex, compileRedactIndex, createRedactor, createRedactStream } from "./redact.js";
-import { ENV_NAME_RE, isRef, looksSecret, parseDotenvStrict, parseRef } from "./refs.js";
+import { ENV_NAME_RE, isLoaderEnvName, isRef, itemNameProblem, looksSecret, parseDotenvStrict, parseRef } from "./refs.js";
 const usage = `Usage: ${BRAND.bin} <command> [options]
 
 Secrets
@@ -63,20 +64,26 @@ function targetList(value) {
         return [targetPaths.pi];
     fail("--target must be omp, pi, or both", 2);
 }
-// Terminal: masked prompt. No terminal (an agent's shell) and no --stdin: a native
-// dialog, so the agent can start the command and the user only pastes.
-async function readSecret(args, prompt, label, itemName) {
-    const forced = args.includes("--dialog");
-    if (forced || (!args.includes("--stdin") && !process.stdin.isTTY)) {
-        const value = await core.readSecretFromDialog({ label, itemName });
-        if (value)
-            return value;
-        if (value === "")
-            throw new Error("Empty secret");
-        if (forced)
-            fail("No dialog available here (SSH or no display). Run the command in a terminal, or pipe the value with --stdin.", 2);
-    }
-    return core.readSecretFromInput({ prompt, stdin: args.includes("--stdin") });
+// --stdin: piped value. Terminal: masked prompt. Otherwise (an agent's shell):
+// a native dialog, so the agent can start the command and the user only pastes.
+async function readSecret(args, prompt, itemName, envName) {
+    if (args.includes("--stdin"))
+        return core.readSecretFromInput({ prompt, stdin: true });
+    if (process.stdin.isTTY && !args.includes("--dialog"))
+        return core.readSecretFromInput({ prompt, stdin: false });
+    const value = await core.readSecretFromDialog({ itemName, envName });
+    if (value)
+        return value;
+    if (value === "")
+        throw new Error("Empty secret");
+    fail("No terminal and no dialog here (SSH or no display). Run the command in a terminal, or pipe the value with --stdin.", 2);
+}
+function checkNames(envName, itemName) {
+    if (isLoaderEnvName(envName))
+        fail(`${envName} changes what programs load or run; it cannot be wired to a secret`, 2);
+    const problem = itemNameProblem(itemName);
+    if (problem)
+        fail(`Vault item name ${problem}`, 2);
 }
 function shellQuote(value) { return `'${value.replaceAll("'", "'\\''")}'`; }
 function failureCode(error) {
@@ -172,14 +179,14 @@ async function inject(args) {
         process.stdout.write(rendered);
         return;
     }
-    try {
-        await readFile(output);
-        if (!args.includes("--force"))
-            fail(`Refusing to overwrite ${output}; use --force`, 5);
-    }
-    catch { }
-    await writeFile(output, rendered, { mode: 0o600 });
-    await chmod(output, 0o600);
+    // lstat, and a private temp file renamed over the target, so a planted
+    // symlink (even a dangling one) is replaced instead of followed.
+    const exists = await lstat(output).then(() => true, () => false);
+    if (exists && !args.includes("--force"))
+        fail(`Refusing to overwrite ${output}; use --force`, 5);
+    const tmp = join(dirname(resolve(output)), `.${basename(output)}.tmp.${randomBytes(6).toString("hex")}`);
+    await writeFile(tmp, rendered, { mode: 0o600, flag: "wx" });
+    await rename(tmp, output);
     console.error(`rendered ${refs.length} reference(s) into ${output} (mode 0600)`);
 }
 const SKIP_DIRS = new Set([".git", "node_modules", "dist", ".next", ".venv"]);
@@ -347,9 +354,9 @@ async function importCommand(args) {
     const lines = text.split(/\r?\n/);
     for (const row of toStore)
         lines[row.entry.line - 1] = `${row.entry.exported ? "export " : ""}${row.entry.name}=bw://${row.item}`;
-    const mode = replace ? (await stat(out)).mode & 0o777 : 0o644;
-    const tmp = `${out}.tmp.${process.pid}`;
-    await writeFile(tmp, lines.join(eol), { mode });
+    const mode = replace ? (await stat(out)).mode & 0o777 : 0o600;
+    const tmp = `${out}.tmp.${randomBytes(6).toString("hex")}`;
+    await writeFile(tmp, lines.join(eol), { mode, flag: "wx" });
     await rename(tmp, out);
     await core.audit("import", toStore.map((row) => row.entry.name), "cli");
     console.log(`imported ${toStore.length} secret(s) (${created.length} new); wrote ${out}`);
@@ -466,11 +473,15 @@ async function main() {
             const notes = valueAfter(args, "--notes");
             if (!envName || !itemName || !ENV_NAME_RE.test(envName))
                 fail(usage, 2);
+            checkNames(envName, itemName);
             const reference = core.referenceFor(itemName);
             const targets = targetList(valueAfter(args, "--target"));
             await core.ensureSession();
-            const secret = await readSecret(args, `Paste secret for ${envName}: `, envName, itemName);
+            if ((await core.findItems(itemName)).some((item) => item.name.toLowerCase() === itemName.toLowerCase()))
+                fail(`Vault item already exists: ${itemName}`, 5);
+            const secret = await readSecret(args, `Paste secret for ${envName}: `, itemName, envName);
             await core.createSecretItem({ itemName, secret, envName, notes });
+            await core.audit("add", [envName], "cli");
             let conflict = false;
             for (const path of targets) {
                 const result = await core.writeAuthEntry(path, envName, reference);
@@ -478,6 +489,7 @@ async function main() {
                     conflict = true;
             }
             const verified = (await core.resolveShellValue(reference)) !== null;
+            await core.refreshRedactIndex();
             console.log(`created item=${itemName} env=${envName} targets=${targets.join(",")} verified=${verified ? "yes" : "no"}`);
             if (conflict) {
                 console.error("Item created, but one or more auth targets already contained the environment name.");
@@ -495,8 +507,10 @@ async function main() {
             if (!itemName)
                 fail(usage, 2);
             await core.ensureSession();
-            const secret = await readSecret(args, "Paste replacement secret: ", `the new value of ${itemName}`, itemName);
+            const secret = await readSecret(args, "Paste replacement secret: ", itemName);
             await core.rotateSecretItem({ itemName, secret });
+            await core.audit("rotate", [itemName], "cli");
+            await core.refreshRedactIndex();
             console.log(`rotated item=${itemName}`);
             return;
         }
@@ -506,6 +520,8 @@ async function main() {
             const itemName = valueAfter(args, "--item");
             if (!envName || !itemName || !ENV_NAME_RE.test(envName))
                 fail(usage, 2);
+            if (isLoaderEnvName(envName))
+                fail(`${envName} changes what programs load or run; it cannot be wired to a secret`, 2);
             const reference = core.referenceFor(itemName);
             const targets = targetList(valueAfter(args, "--target"));
             for (const path of targets) {

package/dist/core.d.ts

@@ -78,6 +78,7 @@ export declare function buildEnvMap(): Promise<Record<string, string>>;
 export declare function redactionValues(wired?: Record<string, string>): Promise<Record<string, string>>;
 export declare function indexValues(wired?: Record<string, string>): Record<string, string>;
 export declare function writeRedactIndex(values: Record<string, string>): Promise<RedactIndex>;
+export declare function refreshRedactIndex(): Promise<void>;
 export declare function readRedactIndex(): Promise<RedactIndex | null>;
 export declare function findItems(search: string): Promise<Array<{
     id: string;
@@ -104,6 +105,6 @@ export declare function readSecretFromInput(opts: {
     stdin: boolean;
 }): Promise<string>;
 export declare function readSecretFromDialog(opts: {
-    label: string;
     itemName: string;
+    envName?: string;
 }): Promise<string | null>;

package/dist/core.js

@@ -1,13 +1,14 @@
 // Runtime-neutral core: no pi/omp/Claude Code imports. Every caller (agent
 // extensions, CLI, MCP server, hooks) goes through these functions.
 import { execFile } from "node:child_process";
+import { randomBytes } from "node:crypto";
 import { appendFile, chmod, mkdir, readFile, realpath, rename, rm, stat, unlink, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { join, dirname } from "node:path";
 import process from "node:process";
 import { BRAND } from "./brand.js";
 import { buildRedactIndex } from "./redact.js";
-import { ENV_NAME_RE, legacyRefFor, parseEnvFile, parseRef } from "./refs.js";
+import { ENV_NAME_RE, isLoaderEnvName, itemNameProblem, legacyRefFor, parseEnvFile, parseRef } from "./refs.js";
 const P = BRAND.envPrefix;
 function setting(name) {
     const value = process.env[`${P}_${name}`]?.trim();
@@ -60,7 +61,10 @@ export function childEnv(extra = {}) {
     for (const [name, value] of Object.entries(process.env))
         if (value !== undefined && !VAULT_ENV_KEYS.includes(name))
             env[name] = value;
-    return { ...env, ...extra };
+    for (const [name, value] of Object.entries(extra))
+        if (!isLoaderEnvName(name))
+            env[name] = value;
+    return env;
 }
 export async function bw(args, opts = {}) {
     const session = opts.session ?? process.env.BW_SESSION;
@@ -238,8 +242,8 @@ export function ensureSession() {
 }
 async function writePrivateFile(path, content) {
     await mkdir(dirname(path), { recursive: true, mode: 0o700 });
-    const tmp = `${path}.tmp.${process.pid}`;
-    await writeFile(tmp, content, { encoding: "utf8", mode: 0o600 });
+    const tmp = `${path}.tmp.${randomBytes(6).toString("hex")}`;
+    await writeFile(tmp, content, { encoding: "utf8", mode: 0o600, flag: "wx" });
     await chmod(tmp, 0o600);
     await rename(tmp, path);
     await chmod(path, 0o600);
@@ -485,6 +489,8 @@ export async function envFileEntries(path) {
     return parseEnvFile(await readFile(path, "utf8")).map(({ name, value }) => {
         if (value.trim().startsWith("!"))
             throw new Error(`${path}: ${name} uses a shell command; env files accept only bw:// references and literals`);
+        if (isLoaderEnvName(name))
+            throw new Error(`${path}: ${name} changes what programs load or run; env files cannot set it`);
         return { name, raw: value };
     });
 }
@@ -539,6 +545,11 @@ export async function writeRedactIndex(values) {
     await writePrivateFile(REDACT_INDEX_FILE, `${JSON.stringify(index)}\n`);
     return index;
 }
+// Re-index after the wired set changes so hooks mask a new value right away.
+export async function refreshRedactIndex() {
+    const env = await resolveEntries(await authEnvEntries());
+    await writeRedactIndex(indexValues(env.secrets));
+}
 export async function readRedactIndex() {
     try {
         const parsed = JSON.parse(await readFile(REDACT_INDEX_FILE, "utf8"));
@@ -573,7 +584,17 @@ export async function getSecret(itemName) {
         throw mapItemError(error, itemName);
     }
 }
+// An agent can start add/rotate, so a dialog could be used to phish the master
+// password into an item it can then read; refuse it outright.
+async function refuseMasterPassword(secret) {
+    if (secret && secret === await readMasterPassword())
+        throw new Error("Refusing to store the vault master password as a secret");
+}
 export async function createSecretItem(opts) {
+    const problem = itemNameProblem(opts.itemName);
+    if (problem)
+        throw new Error(`Vault item name ${problem}`);
+    await refuseMasterPassword(opts.secret);
     const existing = await findItems(opts.itemName);
     if (existing.some((item) => item.name.toLowerCase() === opts.itemName.toLowerCase()))
         throw new Error(`Vault item already exists: ${opts.itemName}`);
@@ -598,6 +619,7 @@ export async function createSecretItem(opts) {
     return { id: String(created.id) };
 }
 export async function rotateSecretItem(opts) {
+    await refuseMasterPassword(opts.secret);
     let parsed;
     try {
         parsed = JSON.parse(await bw(["get", "item", opts.itemName]));
@@ -620,7 +642,7 @@ export async function deleteItem(id, permanent = false) {
     invalidateSecretCache();
 }
 export async function readSecretFromInput(opts) {
-    if (opts.stdin || !process.stdin.isTTY) {
+    if (opts.stdin) {
         let input = "";
         for await (const chunk of process.stdin)
             input += String(chunk);
@@ -629,41 +651,92 @@ export async function readSecretFromInput(opts) {
             throw new Error("Empty secret");
         return input;
     }
+    if (!process.stdin.isTTY)
+        throw new Error("No terminal to prompt on; pipe the value with --stdin");
     const value = await readMasked(opts.prompt);
     if (!value)
         throw new Error("Empty secret");
     return value;
 }
 // Native hidden-input dialog for callers without a terminal (agent shells, MCP).
-// Names reach the dialog through env vars, so an item name cannot inject
-// AppleScript; the value comes back only on the dialog's stdout. Resolves null
-// when no dialog can be shown (SSH, headless Linux, missing tools).
+// An agent can open it, so the wording is fixed, says who asked, and warns
+// against the master password; names are validated and passed as data (argv),
+// never as script. One dialog at a time, with a pause after a cancel. Resolves
+// null when no dialog can be shown (SSH, headless Linux, missing tools).
+const DIALOG_LOCK = join(CONFIG_DIR, "dialog.lock");
+const DIALOG_COOLDOWN_MS = 30_000;
+const DIALOG_TIMEOUT_MS = 300_000;
 export async function readSecretFromDialog(opts) {
     if (process.env.SSH_CONNECTION || process.env.SSH_TTY)
         return null;
-    const text = `Paste the secret for ${opts.label}\nVault item: ${opts.itemName}`;
+    const problem = itemNameProblem(opts.itemName);
+    if (problem)
+        throw new Error(`Vault item name ${problem}`);
+    if (opts.envName !== undefined && !ENV_NAME_RE.test(opts.envName))
+        throw new Error("Variable names must be UPPER_SNAKE_CASE");
+    const text = [
+        opts.envName ? "A program on this computer, usually an AI agent, asked to store a NEW secret." : "A program on this computer, usually an AI agent, asked to REPLACE the value of a secret.",
+        "",
+        ...(opts.envName ? [`Variable: ${opts.envName}`] : []),
+        `Vault item: ${opts.itemName}`,
+        "",
+        "This is not a login prompt. Never enter your vault master password here.",
+    ].join("\n");
     const candidates = process.platform === "darwin"
-        ? [["osascript", ["-e", [
-                        'set t to "Paste the secret for " & (system attribute "KEYSHROUD_DIALOG_ENV") & return & "Vault item: " & (system attribute "KEYSHROUD_DIALOG_ITEM")',
-                        'activate',
-                        'text returned of (display dialog t default answer "" with hidden answer with title "keyshroud" buttons {"Cancel", "Save"} default button "Save" cancel button "Cancel")',
-                    ].join("\n")]]]
+        ? [["osascript", ["-e", "on run argv", "-e", 'activate', "-e",
+                    'text returned of (display dialog (item 1 of argv) default answer "" with hidden answer with title "keyshroud" buttons {"Cancel", "Save"} default button "Save" cancel button "Cancel" with icon caution)',
+                    "-e", "end run", "--", text]]]
         : process.env.DISPLAY || process.env.WAYLAND_DISPLAY
-            ? [["zenity", ["--entry", "--hide-text", "--title=keyshroud", `--text=${text}`]], ["kdialog", ["--title", "keyshroud", "--password", text]]]
+            ? [["zenity", ["--entry", "--hide-text", "--no-markup", "--title=keyshroud", `--text=${text}`]], ["kdialog", ["--title", "keyshroud", "--password", text.replace(/[<>]/g, "")]]]
             : [];
-    for (const [command, args] of candidates) {
-        const result = await new Promise((resolve) => {
-            execFile(command, args, { env: { ...process.env, KEYSHROUD_DIALOG_ENV: opts.label, KEYSHROUD_DIALOG_ITEM: opts.itemName }, timeout: 300_000 }, (error, stdout, stderr) => resolve({ code: error ? (error.code ?? 1) : 0, stdout: String(stdout), stderr: String(stderr) }));
-        });
-        if (result.code === "ENOENT")
-            continue;
-        if (result.code === 0)
-            return result.stdout.replace(/\r?\n$/, "");
-        if (command !== "osascript" || /-128/.test(result.stderr))
-            throw new Error("Cancelled");
+    if (!candidates.length)
         return null;
+    return withDialogLock(async () => {
+        for (const [command, args] of candidates) {
+            const result = await new Promise((resolve) => {
+                execFile(command, args, { timeout: DIALOG_TIMEOUT_MS }, (error, stdout, stderr) => resolve({ code: error ? (error.code ?? 1) : 0, stdout: String(stdout), stderr: String(stderr) }));
+            });
+            if (result.code === "ENOENT")
+                continue;
+            if (result.code === 0)
+                return result.stdout.replace(/\r?\n$/, "");
+            if (command !== "osascript" || /-128/.test(result.stderr))
+                throw new Error("Cancelled");
+            return null;
+        }
+        return null;
+    });
+}
+async function withDialogLock(fn) {
+    await mkdir(CONFIG_DIR, { recursive: true, mode: 0o700 });
+    let held = "";
+    try {
+        held = await readFile(DIALOG_LOCK, "utf8");
+    }
+    catch { }
+    const [kind, at] = held.trim().split(":");
+    const age = Date.now() - Number(at);
+    const live = (kind === "open" || kind === "cancelled") && age >= 0 && age < (kind === "cancelled" ? DIALOG_COOLDOWN_MS : DIALOG_TIMEOUT_MS + 30_000);
+    if (!live)
+        await rm(DIALOG_LOCK, { force: true });
+    try {
+        await writeFile(DIALOG_LOCK, `open:${Date.now()}\n`, { flag: "wx", mode: 0o600 });
+    }
+    catch {
+        throw new Error(kind === "cancelled" ? "The last dialog was cancelled; wait 30 seconds before asking again" : "Another keyshroud dialog is already open");
+    }
+    try {
+        const value = await fn();
+        await rm(DIALOG_LOCK, { force: true });
+        return value;
+    }
+    catch (error) {
+        if (error instanceof Error && error.message === "Cancelled")
+            await writeFile(DIALOG_LOCK, `cancelled:${Date.now()}\n`, { mode: 0o600 });
+        else
+            await rm(DIALOG_LOCK, { force: true });
+        throw error;
     }
-    return null;
 }
 // Raw-mode prompt that echoes one "*" per character (capped, then a count), so
 // the user sees typing and pastes land without the value ever reaching the screen.
@@ -675,7 +748,16 @@ function readMasked(prompt) {
         process.stderr.write(`\r\x1b[2K${prompt}${shown}`);
     };
     return new Promise((resolve, reject) => {
+        // After Enter, keep reading briefly: the rest of a multi-line paste must be
+        // consumed here (or it would reach the parent shell) and is then refused.
+        let ending;
+        let multiline = false;
+        const settle = () => {
+            clearTimeout(ending);
+            ending = setTimeout(() => finish(multiline ? new Error("Multi-line values are not supported in the prompt; pipe them with --stdin") : undefined), 100);
+        };
         const finish = (error) => {
+            clearTimeout(ending);
             stdin.off("data", onData);
             stdin.setRawMode(false);
             stdin.pause();
@@ -686,9 +768,18 @@ function readMasked(prompt) {
                 resolve(chars.join(""));
         };
         const onData = (chunk) => {
-            for (const ch of chunk.replace(/\x1b\[[0-9;?]*[ -/]*[@-~]|\x1b./g, "")) {
-                if (ch === "\r" || ch === "\n")
-                    return finish();
+            if (ending) {
+                if (/[^\r\n]/.test(chunk))
+                    multiline = true;
+                return settle();
+            }
+            const clean = [...chunk.replace(/\x1b\[[0-9;?]*[ -/]*[@-~]|\x1b./g, "")];
+            for (const [index, ch] of clean.entries()) {
+                if (ch === "\r" || ch === "\n") {
+                    if (/[^\r\n]/.test(clean.slice(index + 1).join("")))
+                        multiline = true;
+                    return settle();
+                }
                 if (ch === "\x03")
                     return finish(new Error("Cancelled"));
                 if (ch === "\x04")

package/dist/mcp.js

@@ -7,7 +7,7 @@ import process from "node:process";
 import { BRAND } from "./brand.js";
 import * as core from "./core.js";
 import { createRedactor } from "./redact.js";
-import { ENV_NAME_RE } from "./refs.js";
+import { ENV_NAME_RE, isLoaderEnvName, itemNameProblem } from "./refs.js";
 const SUPPORTED_VERSIONS = ["2025-11-25", "2025-06-18", "2025-03-26", "2024-11-05"];
 const OUTPUT_LIMIT = 256 * 1024;
 const TOOLS = [
@@ -85,14 +85,14 @@ async function runTool(args) {
         detached: true,
     });
     const chunks = { stdout: [], stderr: [] };
-    // Collect generously, mask, then truncate, so a cut never splits a secret
-    // before redaction.
-    let size = 0;
+    // Collect generously per stream, mask, then truncate. If collection stopped
+    // early, the tail may end inside a secret, so it is dropped before masking.
+    const sizes = { stdout: 0, stderr: 0 };
     for (const stream of ["stdout", "stderr"]) {
         child[stream].on("data", (chunk) => {
-            if (size >= OUTPUT_LIMIT * 4)
+            if (sizes[stream] >= OUTPUT_LIMIT * 2)
                 return;
-            size += chunk.length;
+            sizes[stream] += chunk.length;
             chunks[stream].push(chunk);
         });
     }
@@ -105,9 +105,14 @@ async function runTool(args) {
         child.on("error", (error) => done(`spawn error: ${error.message}`));
     });
     clearTimeout(timer);
-    let truncated = size >= OUTPUT_LIMIT * 4;
+    let truncated = false;
     const out = (stream) => {
-        const masked = redactor.redact(Buffer.concat(chunks[stream]).toString("utf8"));
+        let raw = Buffer.concat(chunks[stream]).toString("utf8");
+        if (sizes[stream] >= OUTPUT_LIMIT * 2) {
+            truncated = true;
+            raw = raw.slice(0, redactor.safeCut(raw));
+        }
+        const masked = redactor.redact(raw);
         if (masked.length <= OUTPUT_LIMIT / 2)
             return masked;
         truncated = true;
@@ -141,30 +146,40 @@ async function callTool(name, args) {
         const itemName = String(args.item_name ?? "");
         if (!ENV_NAME_RE.test(envName) || !itemName)
             return text("env_name must be UPPER_SNAKE_CASE and item_name is required", true);
-        const notes = typeof args.purpose === "string" && args.purpose ? args.purpose : undefined;
+        if (isLoaderEnvName(envName))
+            return text(`${envName} changes what programs load or run; it cannot be wired to a secret`, true);
+        const problem = itemNameProblem(itemName);
+        if (problem)
+            return text(`item_name ${problem}`, true);
+        const notes = typeof args.purpose === "string" && args.purpose ? args.purpose.slice(0, 500) : undefined;
         try {
+            const reference = core.referenceFor(itemName);
             await core.ensureSession();
-            const secret = await core.readSecretFromDialog({ label: envName, itemName });
+            if ((await core.findItems(itemName)).some((item) => item.name.toLowerCase() === itemName.toLowerCase()))
+                return text(`Vault item already exists: ${itemName}`, true);
+            const secret = await core.readSecretFromDialog({ itemName, envName });
             if (secret === "")
                 return text("The user saved an empty value; nothing was stored.", true);
             if (secret !== null) {
                 await core.createSecretItem({ itemName, secret, envName, notes });
-                const reference = core.referenceFor(itemName);
+                await core.audit("request", [envName], "mcp");
+                const conflicts = [];
                 for (const path of Object.values(core.getAuthTargets()))
-                    await core.writeAuthEntry(path, envName, reference);
+                    if (!(await core.writeAuthEntry(path, envName, reference)).ok)
+                        conflicts.push(path);
+                await core.refreshRedactIndex();
+                if (conflicts.length)
+                    return text(`created item=${itemName}, but ${envName} is already wired to another secret in ${conflicts.join(", ")} and was left unchanged. Ask the user before running \`${BRAND.bin} wire --env ${envName} --item ${shellQuote(itemName)} --force\`.`, true);
                 const verified = (await core.resolveShellValue(reference)) !== null;
                 return text(`The user entered the value in a ${BRAND.name} dialog. created item=${itemName} env=${envName} verified=${verified ? "yes" : "no"}. Use secrets_run with $${envName}.`);
             }
         }
         catch (error) {
             const message = error instanceof Error ? error.message : String(error);
-            if (message === "Cancelled")
-                return text("The user cancelled the dialog; nothing was stored.", true);
-            if (/already exists/.test(message))
-                return text(message, true);
+            return text(message === "Cancelled" ? "The user cancelled the dialog; nothing was stored." : message, true);
         }
         const purpose = notes ? ` --notes ${shellQuote(notes)}` : "";
-        return text(`Ask the user to run this in their own terminal (the value is entered in a masked prompt; it must never be pasted into the chat):\n\n  ${BRAND.bin} add --env ${envName} --item ${shellQuote(itemName)}${purpose}\n\nAfter it reports verified=yes, use secrets_run with $${envName}.`);
+        return text(`No dialog can be shown here. Ask the user to run this in their own terminal (the value is entered in a masked prompt; it must never be pasted into the chat):\n\n  ${BRAND.bin} add --env ${envName} --item ${shellQuote(itemName)}${purpose}\n\nAfter it reports verified=yes, use secrets_run with $${envName}.`);
     }
     if (name === "vault_status") {
         try {

package/dist/redact.js

@@ -87,7 +87,7 @@ export function createRedactor(values) {
                 return cut;
             // Bounded fallback: cut near the end, moving forward past any complete
             // secret that straddles it, so whole matches are still replaced.
-            cut = text.length - maxLength;
+            cut = Math.max(0, text.length - maxLength);
             while (cut < text.length && straddling(cut))
                 cut++;
             return cut;

package/dist/refs.d.ts

@@ -10,6 +10,8 @@ export declare function parseRef(raw: string): SecretRef | null;
 export declare function formatRef(ref: SecretRef): string;
 export declare function legacyRefFor(itemName: string): string;
 export declare const ENV_NAME_RE: RegExp;
+export declare function isLoaderEnvName(name: string): boolean;
+export declare function itemNameProblem(name: string): string | null;
 export declare function parseEnvFile(text: string): Array<{
     name: string;
     value: string;

package/dist/refs.js

@@ -57,6 +57,21 @@ export function legacyRefFor(itemName) {
     return `!bw get password '${itemName}'`;
 }
 export const ENV_NAME_RE = /^[A-Z_][A-Z0-9_]*$/;
+// Variables that change what a child process loads or runs. Env files can come
+// from a cloned repo and agents can wire names, so neither may set these.
+const LOADER_ENV_RE = /^(?:PATH|HOME|ZDOTDIR|XDG_CONFIG_HOME|IFS|ENV|BASH_ENV|SHELLOPTS|BASHOPTS|PS4|PROMPT_COMMAND|NODE_OPTIONS|NODE_PATH|NODE_EXTRA_CA_CERTS|PYTHONPATH|PYTHONHOME|PYTHONSTARTUP|PERL5OPT|PERL5LIB|PERLLIB|RUBYOPT|RUBYLIB|JAVA_TOOL_OPTIONS|_JAVA_OPTIONS|JDK_JAVA_OPTIONS|EDITOR|VISUAL|PAGER|LESSOPEN|LESSCLOSE|BROWSER|SSH_ASKPASS|LD_\w*|DYLD_\w*|NPM_CONFIG_\w*|GIT_(?:SSH|SSH_COMMAND|EXEC_PATH|ASKPASS|EDITOR|PAGER|EXTERNAL_DIFF|PROXY_COMMAND|DIR|WORK_TREE|TEMPLATE_DIR|CONFIG\w*))$/i;
+export function isLoaderEnvName(name) { return LOADER_ENV_RE.test(name); }
+// Item names appear in native dialogs and lookups: one line of printable text,
+// no padding (lookups trim, so a padded name would shadow an existing item).
+export function itemNameProblem(name) {
+    if (!name || name !== name.trim())
+        return "must not be empty or start or end with spaces";
+    if (name.length > 120)
+        return "must be at most 120 characters";
+    if (/[\p{Cc}\p{Cf}\u2028\u2029]/u.test(name))
+        return "must be one line of printable text";
+    return null;
+}
 // Parses dotenv-style files whose values may be references:
 //   GH_TOKEN=bw://GitHub CLI token
 //   export SENTRY_DSN="bw://Sentry/fields/dsn"
@@ -140,15 +155,20 @@ export function parseDotenvStrict(text) {
     });
     return { entries, errors };
 }
-const SECRET_NAME_RE = /(SECRET|TOKEN|PASSW(?:OR)?D|PASSPHRASE|PWD|(?:^|_)KEY(?:$|_)|APIKEY|PRIVATE|CREDENTIAL|AUTH|DSN|WEBHOOK|COOKIE|SIGNING|ENCRYPT|SALT)/i;
+const SECRET_NAME_RE = /(SECRET|TOKEN|PASSW(?:OR)?D|PASSPHRASE|(?:^|_)PASS(?:$|_)|PWD|(?:^|_)KEY(?:$|_)|APIKEY|PRIVATE|CREDENTIAL|(?:^|_)CREDS?(?:$|_)|AUTH|JWT|DSN|WEBHOOK|COOKIE|SIGNING|ENCRYPT|SALT)/i;
 const SECRET_VALUE_RE = /^(?:gh[pousr]_|github_pat_|glpat-|xox[abprs]-|sk-|sk_(?:live|test)_|rk_(?:live|test)_|whsec_|AKIA|ASIA|AIza|npm_|hf_|ya29\.|eyJ)/;
-const URL_PASSWORD_RE = /^[a-z][a-z0-9+.-]*:\/\/[^\s:@/]+:[^\s@/]+@/i;
-// Local heuristic for `import`: never sends anything anywhere. Names that say
-// PUBLIC (NEXT_PUBLIC_*, VITE_PUBLIC_*) are meant to ship to browsers.
+const URL_PASSWORD_RE = /^[a-z][a-z0-9+.-]*:\/\/[^\s:@/]*:[^\s@/]+@/i;
+// Local heuristic for `import`: never sends anything anywhere. A known secret
+// format wins over the name; otherwise names with a PUBLIC segment
+// (NEXT_PUBLIC_*, VITE_PUBLIC_*) are meant to ship to browsers.
 export function looksSecret(name, value) {
-    if (!value || isRef(value) || /PUBLIC/i.test(name))
+    if (!value || isRef(value))
+        return false;
+    if (SECRET_VALUE_RE.test(value) || URL_PASSWORD_RE.test(value))
+        return true;
+    if (/(?:^|_)PUBLIC(?:$|_)/i.test(name))
         return false;
-    if (SECRET_VALUE_RE.test(value) || URL_PASSWORD_RE.test(value) || SECRET_NAME_RE.test(name))
+    if (SECRET_NAME_RE.test(name) || /^[0-9a-f]{32,}$/i.test(value))
         return true;
     return value.length >= 24 && !/\s/.test(value) && /[a-z]/.test(value) && /[A-Z]/.test(value) && /\d/.test(value);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "keyshroud",
-  "version": "0.5.2",
+  "version": "0.5.3",
   "mcpName": "io.github.dinhkarate/keyshroud",
   "description": "Let AI coding agents use your secrets without ever seeing them. Self-hosted Vaultwarden/Bitwarden, masked output, MCP server, Claude Code + pi plugins.",
   "keywords": [

package/skills/keyshroud/SKILL.md

@@ -17,8 +17,9 @@ in output with `<redacted:NAME>`.
    ```bash
    keyshroud add --env STRIPE_API_KEY --item "Stripe API key" --notes "billing service"
    ```
-   Tell the user a dialog is waiting for them. With the MCP server, call
-   `secrets_request` instead. Over SSH or without a display there is no dialog:
+   Tell the user a dialog is waiting for them, and ask for one secret at a time;
+   if they cancel, do not ask again unprompted. Never ask for the vault master
+   password. With the MCP server, call `secrets_request` instead. Over SSH or without a display there is no dialog:
    then give the user the command to run in their own terminal.
 2. Never print, echo, `cat`, base64, or otherwise transform a secret value.
    `<redacted:NAME>` in output means the secret was used correctly. Do not try

package/src/cli.ts

@@ -4,13 +4,14 @@ import { constants, homedir } from "node:os";
 import { fileURLToPath } from "node:url";
 import { basename, dirname, join, relative, resolve } from "node:path";
 import { spawn } from "node:child_process";
+import { randomBytes } from "node:crypto";
 import process from "node:process";
 import { BRAND } from "./brand.ts";
 import * as core from "./core.ts";
 import { runClaudeHook } from "./hooks.ts";
 import { serveMcp } from "./mcp.ts";
 import { buildRedactIndex, compileRedactIndex, createRedactor, createRedactStream, type RedactIndex } from "./redact.ts";
-import { ENV_NAME_RE, isRef, looksSecret, parseDotenvStrict, parseRef, type DotenvEntry } from "./refs.ts";
+import { ENV_NAME_RE, isLoaderEnvName, isRef, itemNameProblem, looksSecret, parseDotenvStrict, parseRef, type DotenvEntry } from "./refs.ts";
 
 const usage = `Usage: ${BRAND.bin} <command> [options]
 
@@ -56,17 +57,20 @@ function targetList(value: string | undefined): string[] {
   if (value === "pi") return [targetPaths.pi];
   fail("--target must be omp, pi, or both", 2);
 }
-// Terminal: masked prompt. No terminal (an agent's shell) and no --stdin: a native
-// dialog, so the agent can start the command and the user only pastes.
-async function readSecret(args: string[], prompt: string, label: string, itemName: string): Promise<string> {
-  const forced = args.includes("--dialog");
-  if (forced || (!args.includes("--stdin") && !process.stdin.isTTY)) {
-    const value = await core.readSecretFromDialog({ label, itemName });
-    if (value) return value;
-    if (value === "") throw new Error("Empty secret");
-    if (forced) fail("No dialog available here (SSH or no display). Run the command in a terminal, or pipe the value with --stdin.", 2);
-  }
-  return core.readSecretFromInput({ prompt, stdin: args.includes("--stdin") });
+// --stdin: piped value. Terminal: masked prompt. Otherwise (an agent's shell):
+// a native dialog, so the agent can start the command and the user only pastes.
+async function readSecret(args: string[], prompt: string, itemName: string, envName?: string): Promise<string> {
+  if (args.includes("--stdin")) return core.readSecretFromInput({ prompt, stdin: true });
+  if (process.stdin.isTTY && !args.includes("--dialog")) return core.readSecretFromInput({ prompt, stdin: false });
+  const value = await core.readSecretFromDialog({ itemName, envName });
+  if (value) return value;
+  if (value === "") throw new Error("Empty secret");
+  fail("No terminal and no dialog here (SSH or no display). Run the command in a terminal, or pipe the value with --stdin.", 2);
+}
+function checkNames(envName: string, itemName: string): void {
+  if (isLoaderEnvName(envName)) fail(`${envName} changes what programs load or run; it cannot be wired to a secret`, 2);
+  const problem = itemNameProblem(itemName);
+  if (problem) fail(`Vault item name ${problem}`, 2);
 }
 function shellQuote(value: string): string { return `'${value.replaceAll("'", "'\\''")}'`; }
 function failureCode(error: unknown): number {
@@ -143,9 +147,13 @@ async function inject(args: string[]): Promise<void> {
   await core.audit("inject", refs, output ?? "stdout");
   const rendered = template.replace(pattern, (_match, raw: string) => values.get(raw) ?? "");
   if (!output) { process.stdout.write(rendered); return; }
-  try { await readFile(output); if (!args.includes("--force")) fail(`Refusing to overwrite ${output}; use --force`, 5); } catch {}
-  await writeFile(output, rendered, { mode: 0o600 });
-  await chmod(output, 0o600);
+  // lstat, and a private temp file renamed over the target, so a planted
+  // symlink (even a dangling one) is replaced instead of followed.
+  const exists = await lstat(output).then(() => true, () => false);
+  if (exists && !args.includes("--force")) fail(`Refusing to overwrite ${output}; use --force`, 5);
+  const tmp = join(dirname(resolve(output)), `.${basename(output)}.tmp.${randomBytes(6).toString("hex")}`);
+  await writeFile(tmp, rendered, { mode: 0o600, flag: "wx" });
+  await rename(tmp, output);
   console.error(`rendered ${refs.length} reference(s) into ${output} (mode 0600)`);
 }
 
@@ -261,9 +269,9 @@ async function importCommand(args: string[]): Promise<void> {
   const eol = text.includes("\r\n") ? "\r\n" : "\n";
   const lines = text.split(/\r?\n/);
   for (const row of toStore) lines[row.entry.line - 1] = `${row.entry.exported ? "export " : ""}${row.entry.name}=bw://${row.item}`;
-  const mode = replace ? (await stat(out)).mode & 0o777 : 0o644;
-  const tmp = `${out}.tmp.${process.pid}`;
-  await writeFile(tmp, lines.join(eol), { mode });
+  const mode = replace ? (await stat(out)).mode & 0o777 : 0o600;
+  const tmp = `${out}.tmp.${randomBytes(6).toString("hex")}`;
+  await writeFile(tmp, lines.join(eol), { mode, flag: "wx" });
   await rename(tmp, out);
   await core.audit("import", toStore.map((row) => row.entry.name), "cli");
   console.log(`imported ${toStore.length} secret(s) (${created.length} new); wrote ${out}`);
@@ -328,14 +336,18 @@ async function main(): Promise<void> {
       requireKnownFlags(args, ["--env", "--item", "--notes", "--target"], ["--stdin", "--dialog"]);
       const envName = valueAfter(args, "--env"); const itemName = valueAfter(args, "--item"); const notes = valueAfter(args, "--notes");
       if (!envName || !itemName || !ENV_NAME_RE.test(envName)) fail(usage, 2);
+      checkNames(envName, itemName);
       const reference = core.referenceFor(itemName);
       const targets = targetList(valueAfter(args, "--target"));
       await core.ensureSession();
-      const secret = await readSecret(args, `Paste secret for ${envName}: `, envName, itemName);
+      if ((await core.findItems(itemName)).some((item) => item.name.toLowerCase() === itemName.toLowerCase())) fail(`Vault item already exists: ${itemName}`, 5);
+      const secret = await readSecret(args, `Paste secret for ${envName}: `, itemName, envName);
       await core.createSecretItem({ itemName, secret, envName, notes });
+      await core.audit("add", [envName], "cli");
       let conflict = false;
       for (const path of targets) { const result = await core.writeAuthEntry(path, envName, reference); if (!result.ok) conflict = true; }
       const verified = (await core.resolveShellValue(reference)) !== null;
+      await core.refreshRedactIndex();
       console.log(`created item=${itemName} env=${envName} targets=${targets.join(",")} verified=${verified ? "yes" : "no"}`);
       if (conflict) { console.error("Item created, but one or more auth targets already contained the environment name."); process.exitCode = 5; }
       return;
@@ -344,13 +356,15 @@ async function main(): Promise<void> {
     if (command === "rotate") {
       requireKnownFlags(args, ["--item"], ["--stdin", "--dialog"]);
       const itemName = valueAfter(args, "--item"); if (!itemName) fail(usage, 2);
-      await core.ensureSession(); const secret = await readSecret(args, "Paste replacement secret: ", `the new value of ${itemName}`, itemName);
-      await core.rotateSecretItem({ itemName, secret }); console.log(`rotated item=${itemName}`); return;
+      await core.ensureSession(); const secret = await readSecret(args, "Paste replacement secret: ", itemName);
+      await core.rotateSecretItem({ itemName, secret }); await core.audit("rotate", [itemName], "cli"); await core.refreshRedactIndex();
+      console.log(`rotated item=${itemName}`); return;
     }
     if (command === "wire") {
       requireKnownFlags(args, ["--env", "--item", "--target"], ["--force"]);
       const envName = valueAfter(args, "--env"); const itemName = valueAfter(args, "--item");
       if (!envName || !itemName || !ENV_NAME_RE.test(envName)) fail(usage, 2);
+      if (isLoaderEnvName(envName)) fail(`${envName} changes what programs load or run; it cannot be wired to a secret`, 2);
       const reference = core.referenceFor(itemName);
       const targets = targetList(valueAfter(args, "--target"));
       for (const path of targets) { const result = await core.writeAuthEntry(path, envName, reference, { overwrite: args.includes("--force") }); if (!result.ok) fail(result.message, 5); }

package/src/core.ts

@@ -1,13 +1,14 @@
 // Runtime-neutral core: no pi/omp/Claude Code imports. Every caller (agent
 // extensions, CLI, MCP server, hooks) goes through these functions.
 import { execFile } from "node:child_process";
+import { randomBytes } from "node:crypto";
 import { appendFile, chmod, mkdir, readFile, realpath, rename, rm, stat, unlink, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { join, dirname } from "node:path";
 import process from "node:process";
 import { BRAND } from "./brand.ts";
 import { buildRedactIndex, type RedactIndex } from "./redact.ts";
-import { ENV_NAME_RE, legacyRefFor, parseEnvFile, parseRef, type SecretRef } from "./refs.ts";
+import { ENV_NAME_RE, isLoaderEnvName, itemNameProblem, legacyRefFor, parseEnvFile, parseRef, type SecretRef } from "./refs.ts";
 
 const P = BRAND.envPrefix;
 function setting(name: string): string | undefined {
@@ -71,7 +72,8 @@ export const VAULT_ENV_KEYS: readonly string[] = ["BW_SESSION", "BW_PASSWORD", "
 export function childEnv(extra: Record<string, string> = {}): Record<string, string> {
   const env: Record<string, string> = {};
   for (const [name, value] of Object.entries(process.env)) if (value !== undefined && !VAULT_ENV_KEYS.includes(name)) env[name] = value;
-  return { ...env, ...extra };
+  for (const [name, value] of Object.entries(extra)) if (!isLoaderEnvName(name)) env[name] = value;
+  return env;
 }
 
 export async function bw(args: string[], opts: { input?: string; session?: string } = {}): Promise<string> {
@@ -251,8 +253,8 @@ export function ensureSession(): Promise<string> {
 
 async function writePrivateFile(path: string, content: string): Promise<void> {
   await mkdir(dirname(path), { recursive: true, mode: 0o700 });
-  const tmp = `${path}.tmp.${process.pid}`;
-  await writeFile(tmp, content, { encoding: "utf8", mode: 0o600 });
+  const tmp = `${path}.tmp.${randomBytes(6).toString("hex")}`;
+  await writeFile(tmp, content, { encoding: "utf8", mode: 0o600, flag: "wx" });
   await chmod(tmp, 0o600);
   await rename(tmp, path);
   await chmod(path, 0o600);
@@ -455,6 +457,7 @@ export async function resolveEntries(entries: Array<{ name: string; raw: string
 export async function envFileEntries(path: string): Promise<Array<{ name: string; raw: string }>> {
   return parseEnvFile(await readFile(path, "utf8")).map(({ name, value }) => {
     if (value.trim().startsWith("!")) throw new Error(`${path}: ${name} uses a shell command; env files accept only bw:// references and literals`);
+    if (isLoaderEnvName(name)) throw new Error(`${path}: ${name} changes what programs load or run; env files cannot set it`);
     return { name, raw: value };
   });
 }
@@ -504,6 +507,12 @@ export async function writeRedactIndex(values: Record<string, string>): Promise<
   return index;
 }
 
+// Re-index after the wired set changes so hooks mask a new value right away.
+export async function refreshRedactIndex(): Promise<void> {
+  const env = await resolveEntries(await authEnvEntries());
+  await writeRedactIndex(indexValues(env.secrets));
+}
+
 export async function readRedactIndex(): Promise<RedactIndex | null> {
   try {
     const parsed = JSON.parse(await readFile(REDACT_INDEX_FILE, "utf8")) as RedactIndex;
@@ -531,7 +540,16 @@ export async function getSecret(itemName: string): Promise<string> {
   try { return await bw(["get", "password", itemName]); } catch (error) { throw mapItemError(error, itemName); }
 }
 
+// An agent can start add/rotate, so a dialog could be used to phish the master
+// password into an item it can then read; refuse it outright.
+async function refuseMasterPassword(secret: string): Promise<void> {
+  if (secret && secret === await readMasterPassword()) throw new Error("Refusing to store the vault master password as a secret");
+}
+
 export async function createSecretItem(opts: { itemName: string; secret: string; envName?: string; notes?: string }): Promise<{ id: string }> {
+  const problem = itemNameProblem(opts.itemName);
+  if (problem) throw new Error(`Vault item name ${problem}`);
+  await refuseMasterPassword(opts.secret);
   const existing = await findItems(opts.itemName);
   if (existing.some((item) => item.name.toLowerCase() === opts.itemName.toLowerCase())) throw new Error(`Vault item already exists: ${opts.itemName}`);
   const item: Record<string, unknown> = {
@@ -548,6 +566,7 @@ export async function createSecretItem(opts: { itemName: string; secret: string;
 }
 
 export async function rotateSecretItem(opts: { itemName: string; secret: string }): Promise<{ id: string }> {
+  await refuseMasterPassword(opts.secret);
   let parsed: Record<string, unknown>;
   try { parsed = JSON.parse(await bw(["get", "item", opts.itemName])) as Record<string, unknown>; } catch (error) { throw mapItemError(error, opts.itemName); }
   const login = parsed.login && typeof parsed.login === "object" ? parsed.login as Record<string, unknown> : {};
@@ -565,45 +584,82 @@ export async function deleteItem(id: string, permanent = false): Promise<void> {
 }
 
 export async function readSecretFromInput(opts: { prompt: string; stdin: boolean }): Promise<string> {
-  if (opts.stdin || !process.stdin.isTTY) {
+  if (opts.stdin) {
     let input = "";
     for await (const chunk of process.stdin) input += String(chunk);
     input = input.replace(/\r?\n$/, "");
     if (!input) throw new Error("Empty secret");
     return input;
   }
+  if (!process.stdin.isTTY) throw new Error("No terminal to prompt on; pipe the value with --stdin");
   const value = await readMasked(opts.prompt);
   if (!value) throw new Error("Empty secret");
   return value;
 }
 
 // Native hidden-input dialog for callers without a terminal (agent shells, MCP).
-// Names reach the dialog through env vars, so an item name cannot inject
-// AppleScript; the value comes back only on the dialog's stdout. Resolves null
-// when no dialog can be shown (SSH, headless Linux, missing tools).
-export async function readSecretFromDialog(opts: { label: string; itemName: string }): Promise<string | null> {
+// An agent can open it, so the wording is fixed, says who asked, and warns
+// against the master password; names are validated and passed as data (argv),
+// never as script. One dialog at a time, with a pause after a cancel. Resolves
+// null when no dialog can be shown (SSH, headless Linux, missing tools).
+const DIALOG_LOCK = join(CONFIG_DIR, "dialog.lock");
+const DIALOG_COOLDOWN_MS = 30_000;
+const DIALOG_TIMEOUT_MS = 300_000;
+
+export async function readSecretFromDialog(opts: { itemName: string; envName?: string }): Promise<string | null> {
   if (process.env.SSH_CONNECTION || process.env.SSH_TTY) return null;
-  const text = `Paste the secret for ${opts.label}\nVault item: ${opts.itemName}`;
+  const problem = itemNameProblem(opts.itemName);
+  if (problem) throw new Error(`Vault item name ${problem}`);
+  if (opts.envName !== undefined && !ENV_NAME_RE.test(opts.envName)) throw new Error("Variable names must be UPPER_SNAKE_CASE");
+  const text = [
+    opts.envName ? "A program on this computer, usually an AI agent, asked to store a NEW secret." : "A program on this computer, usually an AI agent, asked to REPLACE the value of a secret.",
+    "",
+    ...(opts.envName ? [`Variable: ${opts.envName}`] : []),
+    `Vault item: ${opts.itemName}`,
+    "",
+    "This is not a login prompt. Never enter your vault master password here.",
+  ].join("\n");
   const candidates: Array<[string, string[]]> = process.platform === "darwin"
-    ? [["osascript", ["-e", [
-        'set t to "Paste the secret for " & (system attribute "KEYSHROUD_DIALOG_ENV") & return & "Vault item: " & (system attribute "KEYSHROUD_DIALOG_ITEM")',
-        'activate',
-        'text returned of (display dialog t default answer "" with hidden answer with title "keyshroud" buttons {"Cancel", "Save"} default button "Save" cancel button "Cancel")',
-      ].join("\n")]]]
+    ? [["osascript", ["-e", "on run argv", "-e", 'activate', "-e",
+        'text returned of (display dialog (item 1 of argv) default answer "" with hidden answer with title "keyshroud" buttons {"Cancel", "Save"} default button "Save" cancel button "Cancel" with icon caution)',
+        "-e", "end run", "--", text]]]
     : process.env.DISPLAY || process.env.WAYLAND_DISPLAY
-      ? [["zenity", ["--entry", "--hide-text", "--title=keyshroud", `--text=${text}`]], ["kdialog", ["--title", "keyshroud", "--password", text]]]
+      ? [["zenity", ["--entry", "--hide-text", "--no-markup", "--title=keyshroud", `--text=${text}`]], ["kdialog", ["--title", "keyshroud", "--password", text.replace(/[<>]/g, "")]]]
       : [];
-  for (const [command, args] of candidates) {
-    const result = await new Promise<{ code: number | string | null; stdout: string; stderr: string }>((resolve) => {
-      execFile(command, args, { env: { ...process.env, KEYSHROUD_DIALOG_ENV: opts.label, KEYSHROUD_DIALOG_ITEM: opts.itemName }, timeout: 300_000 },
-        (error, stdout, stderr) => resolve({ code: error ? ((error as NodeJS.ErrnoException).code ?? 1) : 0, stdout: String(stdout), stderr: String(stderr) }));
-    });
-    if (result.code === "ENOENT") continue;
-    if (result.code === 0) return result.stdout.replace(/\r?\n$/, "");
-    if (command !== "osascript" || /-128/.test(result.stderr)) throw new Error("Cancelled");
+  if (!candidates.length) return null;
+  return withDialogLock(async () => {
+    for (const [command, args] of candidates) {
+      const result = await new Promise<{ code: number | string | null; stdout: string; stderr: string }>((resolve) => {
+        execFile(command, args, { timeout: DIALOG_TIMEOUT_MS }, (error, stdout, stderr) => resolve({ code: error ? ((error as NodeJS.ErrnoException).code ?? 1) : 0, stdout: String(stdout), stderr: String(stderr) }));
+      });
+      if (result.code === "ENOENT") continue;
+      if (result.code === 0) return result.stdout.replace(/\r?\n$/, "");
+      if (command !== "osascript" || /-128/.test(result.stderr)) throw new Error("Cancelled");
+      return null;
+    }
     return null;
+  });
+}
+
+async function withDialogLock<T>(fn: () => Promise<T>): Promise<T> {
+  await mkdir(CONFIG_DIR, { recursive: true, mode: 0o700 });
+  let held = "";
+  try { held = await readFile(DIALOG_LOCK, "utf8"); } catch {}
+  const [kind, at] = held.trim().split(":");
+  const age = Date.now() - Number(at);
+  const live = (kind === "open" || kind === "cancelled") && age >= 0 && age < (kind === "cancelled" ? DIALOG_COOLDOWN_MS : DIALOG_TIMEOUT_MS + 30_000);
+  if (!live) await rm(DIALOG_LOCK, { force: true });
+  try { await writeFile(DIALOG_LOCK, `open:${Date.now()}\n`, { flag: "wx", mode: 0o600 }); }
+  catch { throw new Error(kind === "cancelled" ? "The last dialog was cancelled; wait 30 seconds before asking again" : "Another keyshroud dialog is already open"); }
+  try {
+    const value = await fn();
+    await rm(DIALOG_LOCK, { force: true });
+    return value;
+  } catch (error) {
+    if (error instanceof Error && error.message === "Cancelled") await writeFile(DIALOG_LOCK, `cancelled:${Date.now()}\n`, { mode: 0o600 });
+    else await rm(DIALOG_LOCK, { force: true });
+    throw error;
   }
-  return null;
 }
 
 // Raw-mode prompt that echoes one "*" per character (capped, then a count), so
@@ -616,14 +672,25 @@ function readMasked(prompt: string): Promise<string> {
     process.stderr.write(`\r\x1b[2K${prompt}${shown}`);
   };
   return new Promise((resolve, reject) => {
+    // After Enter, keep reading briefly: the rest of a multi-line paste must be
+    // consumed here (or it would reach the parent shell) and is then refused.
+    let ending: ReturnType<typeof setTimeout> | undefined;
+    let multiline = false;
+    const settle = () => {
+      clearTimeout(ending);
+      ending = setTimeout(() => finish(multiline ? new Error("Multi-line values are not supported in the prompt; pipe them with --stdin") : undefined), 100);
+    };
     const finish = (error?: Error) => {
+      clearTimeout(ending);
       stdin.off("data", onData); stdin.setRawMode(false); stdin.pause();
       process.stderr.write("\n");
       if (error) reject(error); else resolve(chars.join(""));
     };
     const onData = (chunk: string) => {
-      for (const ch of chunk.replace(/\x1b\[[0-9;?]*[ -/]*[@-~]|\x1b./g, "")) {
-        if (ch === "\r" || ch === "\n") return finish();
+      if (ending) { if (/[^\r\n]/.test(chunk)) multiline = true; return settle(); }
+      const clean = [...chunk.replace(/\x1b\[[0-9;?]*[ -/]*[@-~]|\x1b./g, "")];
+      for (const [index, ch] of clean.entries()) {
+        if (ch === "\r" || ch === "\n") { if (/[^\r\n]/.test(clean.slice(index + 1).join(""))) multiline = true; return settle(); }
         if (ch === "\x03") return finish(new Error("Cancelled"));
         if (ch === "\x04") return chars.length ? finish() : finish(new Error("Cancelled"));
         if (ch === "\x7f" || ch === "\b") chars.pop();

package/src/mcp.ts

@@ -7,7 +7,7 @@ import process from "node:process";
 import { BRAND } from "./brand.ts";
 import * as core from "./core.ts";
 import { createRedactor } from "./redact.ts";
-import { ENV_NAME_RE } from "./refs.ts";
+import { ENV_NAME_RE, isLoaderEnvName, itemNameProblem } from "./refs.ts";
 
 const SUPPORTED_VERSIONS = ["2025-11-25", "2025-06-18", "2025-03-26", "2024-11-05"];
 const OUTPUT_LIMIT = 256 * 1024;
@@ -85,13 +85,13 @@ async function runTool(args: Json): Promise<Json> {
     detached: true,
   });
   const chunks = { stdout: [] as Buffer[], stderr: [] as Buffer[] };
-  // Collect generously, mask, then truncate, so a cut never splits a secret
-  // before redaction.
-  let size = 0;
+  // Collect generously per stream, mask, then truncate. If collection stopped
+  // early, the tail may end inside a secret, so it is dropped before masking.
+  const sizes = { stdout: 0, stderr: 0 };
   for (const stream of ["stdout", "stderr"] as const) {
     child[stream].on("data", (chunk: Buffer) => {
-      if (size >= OUTPUT_LIMIT * 4) return;
-      size += chunk.length;
+      if (sizes[stream] >= OUTPUT_LIMIT * 2) return;
+      sizes[stream] += chunk.length;
       chunks[stream].push(chunk);
     });
   }
@@ -101,9 +101,11 @@ async function runTool(args: Json): Promise<Json> {
     child.on("error", (error) => done(`spawn error: ${error.message}`));
   });
   clearTimeout(timer);
-  let truncated = size >= OUTPUT_LIMIT * 4;
+  let truncated = false;
   const out = (stream: "stdout" | "stderr") => {
-    const masked = redactor.redact(Buffer.concat(chunks[stream]).toString("utf8"));
+    let raw = Buffer.concat(chunks[stream]).toString("utf8");
+    if (sizes[stream] >= OUTPUT_LIMIT * 2) { truncated = true; raw = raw.slice(0, redactor.safeCut(raw)); }
+    const masked = redactor.redact(raw);
     if (masked.length <= OUTPUT_LIMIT / 2) return masked;
     truncated = true;
     return masked.slice(0, OUTPUT_LIMIT / 2);
@@ -132,25 +134,32 @@ async function callTool(name: string, args: Json): Promise<Json> {
     const envName = String(args.env_name ?? "");
     const itemName = String(args.item_name ?? "");
     if (!ENV_NAME_RE.test(envName) || !itemName) return text("env_name must be UPPER_SNAKE_CASE and item_name is required", true);
-    const notes = typeof args.purpose === "string" && args.purpose ? args.purpose : undefined;
+    if (isLoaderEnvName(envName)) return text(`${envName} changes what programs load or run; it cannot be wired to a secret`, true);
+    const problem = itemNameProblem(itemName);
+    if (problem) return text(`item_name ${problem}`, true);
+    const notes = typeof args.purpose === "string" && args.purpose ? args.purpose.slice(0, 500) : undefined;
     try {
+      const reference = core.referenceFor(itemName);
       await core.ensureSession();
-      const secret = await core.readSecretFromDialog({ label: envName, itemName });
+      if ((await core.findItems(itemName)).some((item) => item.name.toLowerCase() === itemName.toLowerCase())) return text(`Vault item already exists: ${itemName}`, true);
+      const secret = await core.readSecretFromDialog({ itemName, envName });
       if (secret === "") return text("The user saved an empty value; nothing was stored.", true);
       if (secret !== null) {
         await core.createSecretItem({ itemName, secret, envName, notes });
-        const reference = core.referenceFor(itemName);
-        for (const path of Object.values(core.getAuthTargets())) await core.writeAuthEntry(path, envName, reference);
+        await core.audit("request", [envName], "mcp");
+        const conflicts: string[] = [];
+        for (const path of Object.values(core.getAuthTargets())) if (!(await core.writeAuthEntry(path, envName, reference)).ok) conflicts.push(path);
+        await core.refreshRedactIndex();
+        if (conflicts.length) return text(`created item=${itemName}, but ${envName} is already wired to another secret in ${conflicts.join(", ")} and was left unchanged. Ask the user before running \`${BRAND.bin} wire --env ${envName} --item ${shellQuote(itemName)} --force\`.`, true);
         const verified = (await core.resolveShellValue(reference)) !== null;
         return text(`The user entered the value in a ${BRAND.name} dialog. created item=${itemName} env=${envName} verified=${verified ? "yes" : "no"}. Use secrets_run with $${envName}.`);
       }
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      if (message === "Cancelled") return text("The user cancelled the dialog; nothing was stored.", true);
-      if (/already exists/.test(message)) return text(message, true);
+      return text(message === "Cancelled" ? "The user cancelled the dialog; nothing was stored." : message, true);
     }
     const purpose = notes ? ` --notes ${shellQuote(notes)}` : "";
-    return text(`Ask the user to run this in their own terminal (the value is entered in a masked prompt; it must never be pasted into the chat):\n\n  ${BRAND.bin} add --env ${envName} --item ${shellQuote(itemName)}${purpose}\n\nAfter it reports verified=yes, use secrets_run with $${envName}.`);
+    return text(`No dialog can be shown here. Ask the user to run this in their own terminal (the value is entered in a masked prompt; it must never be pasted into the chat):\n\n  ${BRAND.bin} add --env ${envName} --item ${shellQuote(itemName)}${purpose}\n\nAfter it reports verified=yes, use secrets_run with $${envName}.`);
   }
   if (name === "vault_status") {
     try { await core.ensureSession(); } catch {}

package/src/redact.ts

@@ -81,7 +81,7 @@ export function createRedactor(values: Record<string, string>): Redactor {
       if (text.length - cut <= MAX_HOLD) return cut;
       // Bounded fallback: cut near the end, moving forward past any complete
       // secret that straddles it, so whole matches are still replaced.
-      cut = text.length - maxLength;
+      cut = Math.max(0, text.length - maxLength);
       while (cut < text.length && straddling(cut)) cut++;
       return cut;
     },

package/src/refs.ts

@@ -55,6 +55,20 @@ export function legacyRefFor(itemName: string): string {
 
 export const ENV_NAME_RE = /^[A-Z_][A-Z0-9_]*$/;
 
+// Variables that change what a child process loads or runs. Env files can come
+// from a cloned repo and agents can wire names, so neither may set these.
+const LOADER_ENV_RE = /^(?:PATH|HOME|ZDOTDIR|XDG_CONFIG_HOME|IFS|ENV|BASH_ENV|SHELLOPTS|BASHOPTS|PS4|PROMPT_COMMAND|NODE_OPTIONS|NODE_PATH|NODE_EXTRA_CA_CERTS|PYTHONPATH|PYTHONHOME|PYTHONSTARTUP|PERL5OPT|PERL5LIB|PERLLIB|RUBYOPT|RUBYLIB|JAVA_TOOL_OPTIONS|_JAVA_OPTIONS|JDK_JAVA_OPTIONS|EDITOR|VISUAL|PAGER|LESSOPEN|LESSCLOSE|BROWSER|SSH_ASKPASS|LD_\w*|DYLD_\w*|NPM_CONFIG_\w*|GIT_(?:SSH|SSH_COMMAND|EXEC_PATH|ASKPASS|EDITOR|PAGER|EXTERNAL_DIFF|PROXY_COMMAND|DIR|WORK_TREE|TEMPLATE_DIR|CONFIG\w*))$/i;
+export function isLoaderEnvName(name: string): boolean { return LOADER_ENV_RE.test(name); }
+
+// Item names appear in native dialogs and lookups: one line of printable text,
+// no padding (lookups trim, so a padded name would shadow an existing item).
+export function itemNameProblem(name: string): string | null {
+  if (!name || name !== name.trim()) return "must not be empty or start or end with spaces";
+  if (name.length > 120) return "must be at most 120 characters";
+  if (/[\p{Cc}\p{Cf}\u2028\u2029]/u.test(name)) return "must be one line of printable text";
+  return null;
+}
+
 // Parses dotenv-style files whose values may be references:
 //   GH_TOKEN=bw://GitHub CLI token
 //   export SENTRY_DSN="bw://Sentry/fields/dsn"
@@ -112,14 +126,17 @@ export function parseDotenvStrict(text: string): { entries: DotenvEntry[]; error
   return { entries, errors };
 }
 
-const SECRET_NAME_RE = /(SECRET|TOKEN|PASSW(?:OR)?D|PASSPHRASE|PWD|(?:^|_)KEY(?:$|_)|APIKEY|PRIVATE|CREDENTIAL|AUTH|DSN|WEBHOOK|COOKIE|SIGNING|ENCRYPT|SALT)/i;
+const SECRET_NAME_RE = /(SECRET|TOKEN|PASSW(?:OR)?D|PASSPHRASE|(?:^|_)PASS(?:$|_)|PWD|(?:^|_)KEY(?:$|_)|APIKEY|PRIVATE|CREDENTIAL|(?:^|_)CREDS?(?:$|_)|AUTH|JWT|DSN|WEBHOOK|COOKIE|SIGNING|ENCRYPT|SALT)/i;
 const SECRET_VALUE_RE = /^(?:gh[pousr]_|github_pat_|glpat-|xox[abprs]-|sk-|sk_(?:live|test)_|rk_(?:live|test)_|whsec_|AKIA|ASIA|AIza|npm_|hf_|ya29\.|eyJ)/;
-const URL_PASSWORD_RE = /^[a-z][a-z0-9+.-]*:\/\/[^\s:@/]+:[^\s@/]+@/i;
+const URL_PASSWORD_RE = /^[a-z][a-z0-9+.-]*:\/\/[^\s:@/]*:[^\s@/]+@/i;
 
-// Local heuristic for `import`: never sends anything anywhere. Names that say
-// PUBLIC (NEXT_PUBLIC_*, VITE_PUBLIC_*) are meant to ship to browsers.
+// Local heuristic for `import`: never sends anything anywhere. A known secret
+// format wins over the name; otherwise names with a PUBLIC segment
+// (NEXT_PUBLIC_*, VITE_PUBLIC_*) are meant to ship to browsers.
 export function looksSecret(name: string, value: string): boolean {
-  if (!value || isRef(value) || /PUBLIC/i.test(name)) return false;
-  if (SECRET_VALUE_RE.test(value) || URL_PASSWORD_RE.test(value) || SECRET_NAME_RE.test(name)) return true;
+  if (!value || isRef(value)) return false;
+  if (SECRET_VALUE_RE.test(value) || URL_PASSWORD_RE.test(value)) return true;
+  if (/(?:^|_)PUBLIC(?:$|_)/i.test(name)) return false;
+  if (SECRET_NAME_RE.test(name) || /^[0-9a-f]{32,}$/i.test(value)) return true;
   return value.length >= 24 && !/\s/.test(value) && /[a-z]/.test(value) && /[A-Z]/.test(value) && /\d/.test(value);
 }