keyshroud 0.5.2 → 0.6.0

package/CHANGELOG.md

@@ -5,6 +5,48 @@ All notable changes are documented here. This project follows
 
 ## [Unreleased]
 
+## [0.6.0] - 2026-10-17
+
+### Added
+- `setup --email`: keyshroud gets its own `bw` login on a dedicated agent account
+  (`~/.config/keyshroud/bw`, keychain entry `keyshroud-master-password`), so agents
+  can no longer unlock your personal vault. `--confirm-unlock` (macOS) makes the
+  keychain ask before every unlock. Run from an agent's shell, it generates the
+  agent account's password, stores it over stdin, and hands it to you on the
+  clipboard for the signup page.
+- `migrate`: copies the items your wired names reference from the personal vault
+  into the agent account (dry run unless `--yes`, names only, originals kept).
+
+## [0.5.3] - 2026-10-15
+
+### Security
+Fixes from an independent audit and a multi-model review of 0.5.2.
+- The native dialog could be used by a prompt-injected agent to phish new
+  secrets, including the vault master password. It now says a program asked for
+  it and warns against the master password, refuses multi-line, control or bidi
+  characters and names over 120 characters, refuses a value equal to the master
+  password, opens one at a time with a 30 s pause after a cancel, and is audited.
+  zenity runs with `--no-markup`.
+- Env files could set `PATH`, `NODE_OPTIONS`, `LD_PRELOAD` and other loader
+  variables, so a cloned repo's `.env.refs` could run code. They are rejected
+  in env files, refused by `add`/`wire`/`secrets_request`, and never injected.
+- Streaming redaction leaked most of a secret longer than 4096 characters.
+- `secrets_run` could return a partial secret when output hit the collection
+  limit; the cut tail is now dropped before masking, with per-stream budgets.
+- `import` missed `*_PASS`, URL passwords with no username, hex keys, and known
+  key formats in names containing `PUBLIC`; `.env.refs` is now written `0600`.
+- `inject -o` replaces a planted symlink instead of writing through it; temp
+  files use random names and exclusive creation.
+
+### Changed
+- `add`/`rotate` read stdin only with `--stdin`; a multi-line paste into the
+  `*` prompt is drained and refused instead of reaching the shell.
+- `secrets_request` checks names and existing items before opening the dialog,
+  reports auth.json conflicts instead of claiming success, and returns errors.
+- Item names with leading or trailing spaces are refused (they shadowed
+  existing items). `add`, `rotate` and `secrets_request` refresh the redact
+  index and write to the audit log.
+
 ## [0.5.2] - 2026-10-15
 
 ### Added

package/README.md

@@ -61,7 +61,7 @@ webhooks, databases. The usual options are bad:
 | 🙈 **Masked output** | `keyshroud run` replaces every secret value in stdout/stderr with `<redacted:NAME>` — streaming-safe across chunk boundaries. |
 | 🪝 **Agent hooks** | The pi/omp `tool_result` hook redacts every tool result, failed ones included. Claude Code's `PostToolUse` hook redacts every *successful* tool result (Bash, Read, Grep, MCP…) — see [limits](#security-model). |
 | 🔌 **MCP server** | `keyshroud mcp` gives any MCP client `secrets_run`, `secrets_list`, `secrets_request`, `vault_status`. No tool ever returns a value. |
-| 🔗 **Commit-safe references** | `bw://item`, `bw://item/username`, `bw://item/fields/name`, `bw://item/totp` in `.env.refs` files and templates. |
+| 🔗 **Committable references** | `bw://item`, `bw://item/username`, `bw://item/fields/name`, `bw://item/totp` in `.env.refs` files and templates: names, not values. |
 | ⌨️ **Paste-to-create** | New secrets go through a masked prompt in the user's terminal or a masked popup in pi — never through the chat. |
 | 📄 **`inject`** | Render `{{ bw://… }}` templates into `0600` config files for tools that can't read env vars (`.npmrc`, kubeconfig). |
 | 🔎 **`scan`** | Find vault values that leaked into your working tree (pre-commit friendly). |
@@ -135,6 +135,32 @@ Optional: put `vaultwarden-api-client-id` / `vaultwarden-api-client-secret` (fro
 also re-login automatically when the `bw` session expires. Linux keyring commands
 and a headless-server option are in the [vault setup guide](examples/vaultwarden#4-let-keyshroud-unlock-without-prompting).
 
+### Least privilege: a separate agent account
+
+With the steps above, keyshroud holds your master password, so an agent that runs
+`bw` as you can open your whole vault. `setup` gives keyshroud its own `bw` login
+on a dedicated account instead, which holds only the secrets agents need:
+
+```bash
+keyshroud setup --email you+agent@example.com   # opens the signup page, then stores the new
+                                                 # master password in the keychain and logs in
+keyshroud migrate                                # dry run: which wired items would be copied
+keyshroud migrate --yes                          # copy them; references keep working
+```
+
+- The agent login lives in `~/.config/keyshroud/bw` (`BITWARDENCLI_APPDATA_DIR`), its master
+  password in the keychain entry `keyshroud-master-password`. Your own `bw` login is untouched.
+- `migrate` copies the items that wired names (and any `--env-file` / `--item`) reference, with
+  the same names, then locks your personal vault again. Originals stay where they are. It needs
+  your personal master password in the keychain once; delete it afterwards (the command prints how).
+- An agent can run `setup` too. Without a terminal, keyshroud generates the agent account's
+  master password, writes it to the keychain over stdin and puts it on the clipboard; you paste
+  it into the signup page, then the agent runs `setup --registered`, which clears the clipboard.
+- `--confirm-unlock` (macOS, off by default) creates the keychain entry so macOS asks you before
+  every read, i.e. every vault unlock.
+- Self-hosted Vaultwarden with `SIGNUPS_ALLOWED=false`: invite the address from the admin page
+  (`/admin`), or allow signups for a minute, then pass `--registered` once the account exists.
+
 ## How it works
 
 ```
@@ -274,6 +300,8 @@ keyshroud import [--from F|-] [--out F] [--prefix P] [--only A,B] [--skip A,B] [
 keyshroud rotate --item ITEM [--stdin|--dialog]
 keyshroud wire --env NAME --item ITEM [--target pi|omp|both] [--force]
 keyshroud unwire --env NAME [--target pi|omp|both]
+keyshroud setup --email EMAIL [--server URL] [--confirm-unlock] [--registered]
+keyshroud migrate [--item NAME]... [--env-file F]... [--yes]
 keyshroud status | unlock | lock | doctor
 keyshroud mcp
 keyshroud hook claude <session-start|post-tool-use>
@@ -373,20 +401,32 @@ Guarantees we test for:
 
 - secret values never appear in argv, logs, diagnostics, MCP results, hook
   output, or `audit.jsonl`;
-- new secrets are read from a masked prompt or stdin, never flags;
+- new secrets are read from a masked prompt, `--stdin`, or a native dialog, never flags;
+- the dialog an agent can open says it was requested by a program, warns against the
+  master password, refuses names that are not one printable line, refuses the master
+  password itself, and opens one at a time (30 s pause after a cancel);
 - the session file, redact index, rendered templates and auth files are `0600`;
 - auth.json writes are locked and atomic and never overwrite without `--force`;
 - commands started by `run` and `secrets_run` never receive `BW_SESSION`,
   `BW_PASSWORD`, `BW_CLIENTID` or `BW_CLIENTSECRET`, so `--only` really limits
   what a command can read (inside pi/omp the agent process keeps the session for
   legacy `!bw` auth entries; its value is redacted from tool output);
-- env files may contain only references and literals — a `!command` value is
-  rejected, so a cloned repo's `.env.refs` cannot run code;
+- env files may contain only references and literals: a `!command` value is
+  rejected, and so are variables that change what programs load or run (`PATH`,
+  `NODE_OPTIONS`, `LD_*`, `DYLD_*`, `BASH_ENV`, `GIT_SSH_COMMAND`, …), which are
+  also never wired or injected;
 - an unparseable `auth.json` is never overwritten.
 
-Known limits: an agent with shell access as your user can read
-`~/.config/keyshroud/session` and use `bw` directly — run agents in a sandbox or
-container if that matters. Redaction is exact-match, so a *partial* or transformed value
+Known limits: a `.env.refs` can reference **any** item in your vault, not only the
+ones you wired, so read a cloned repo's `.env.refs` before running `--env-file`
+with it. `import` decides what is secret by heuristics and keeps everything else
+as a literal; check its plan before committing `.env.refs`. The Claude Code
+`PostToolUse` hook does not see failed commands (`PostToolUseFailure` cannot
+rewrite output) or anything a client sends as telemetry, and it only knows wired
+values, so `keyshroud get bw://…` or `run --no-mask` print in the clear; run
+secret-using commands through `keyshroud run` or `secrets_run`. An agent with shell access as your user can read
+`~/.config/keyshroud/session` and use `bw` directly — after `setup` that reaches
+only the agent account; otherwise run agents in a sandbox or container if that matters. Redaction is exact-match, so a *partial* or transformed value
 (`${TOKEN:0:10}`, base64, a line wrapped by a tool) is not masked; values
 shorter than 6 characters are not redacted (to avoid noise), so don't wire short
 PINs.

package/dist/cli.js

@@ -4,13 +4,14 @@ import { constants, homedir } from "node:os";
 import { fileURLToPath } from "node:url";
 import { basename, dirname, join, relative, resolve } from "node:path";
 import { spawn } from "node:child_process";
+import { randomBytes } from "node:crypto";
 import process from "node:process";
 import { BRAND } from "./brand.js";
 import * as core from "./core.js";
 import { runClaudeHook } from "./hooks.js";
 import { serveMcp } from "./mcp.js";
 import { buildRedactIndex, compileRedactIndex, createRedactor, createRedactStream } from "./redact.js";
-import { ENV_NAME_RE, isRef, looksSecret, parseDotenvStrict, parseRef } from "./refs.js";
+import { ENV_NAME_RE, isLoaderEnvName, isRef, itemNameProblem, looksSecret, parseDotenvStrict, parseRef } from "./refs.js";
 const usage = `Usage: ${BRAND.bin} <command> [options]
 
 Secrets
@@ -30,6 +31,11 @@ Secrets
   unwire --env NAME [--target pi|omp|both]
 
 Vault
+  setup --email EMAIL [--server URL] [--confirm-unlock] [--registered]
+                                   Give ${BRAND.name} its own bw login on a dedicated agent account
+  migrate [--item NAME]... [--env-file F]... [--yes]
+                                   Copy the wired items from your personal vault to that account
+                                   (dry run unless --yes; prints names only)
   status | unlock | lock | doctor
 
 Agents
@@ -63,20 +69,26 @@ function targetList(value) {
         return [targetPaths.pi];
     fail("--target must be omp, pi, or both", 2);
 }
-// Terminal: masked prompt. No terminal (an agent's shell) and no --stdin: a native
-// dialog, so the agent can start the command and the user only pastes.
-async function readSecret(args, prompt, label, itemName) {
-    const forced = args.includes("--dialog");
-    if (forced || (!args.includes("--stdin") && !process.stdin.isTTY)) {
-        const value = await core.readSecretFromDialog({ label, itemName });
-        if (value)
-            return value;
-        if (value === "")
-            throw new Error("Empty secret");
-        if (forced)
-            fail("No dialog available here (SSH or no display). Run the command in a terminal, or pipe the value with --stdin.", 2);
-    }
-    return core.readSecretFromInput({ prompt, stdin: args.includes("--stdin") });
+// --stdin: piped value. Terminal: masked prompt. Otherwise (an agent's shell):
+// a native dialog, so the agent can start the command and the user only pastes.
+async function readSecret(args, prompt, itemName, envName) {
+    if (args.includes("--stdin"))
+        return core.readSecretFromInput({ prompt, stdin: true });
+    if (process.stdin.isTTY && !args.includes("--dialog"))
+        return core.readSecretFromInput({ prompt, stdin: false });
+    const value = await core.readSecretFromDialog({ itemName, envName });
+    if (value)
+        return value;
+    if (value === "")
+        throw new Error("Empty secret");
+    fail("No terminal and no dialog here (SSH or no display). Run the command in a terminal, or pipe the value with --stdin.", 2);
+}
+function checkNames(envName, itemName) {
+    if (isLoaderEnvName(envName))
+        fail(`${envName} changes what programs load or run; it cannot be wired to a secret`, 2);
+    const problem = itemNameProblem(itemName);
+    if (problem)
+        fail(`Vault item name ${problem}`, 2);
 }
 function shellQuote(value) { return `'${value.replaceAll("'", "'\\''")}'`; }
 function failureCode(error) {
@@ -172,14 +184,14 @@ async function inject(args) {
         process.stdout.write(rendered);
         return;
     }
-    try {
-        await readFile(output);
-        if (!args.includes("--force"))
-            fail(`Refusing to overwrite ${output}; use --force`, 5);
-    }
-    catch { }
-    await writeFile(output, rendered, { mode: 0o600 });
-    await chmod(output, 0o600);
+    // lstat, and a private temp file renamed over the target, so a planted
+    // symlink (even a dangling one) is replaced instead of followed.
+    const exists = await lstat(output).then(() => true, () => false);
+    if (exists && !args.includes("--force"))
+        fail(`Refusing to overwrite ${output}; use --force`, 5);
+    const tmp = join(dirname(resolve(output)), `.${basename(output)}.tmp.${randomBytes(6).toString("hex")}`);
+    await writeFile(tmp, rendered, { mode: 0o600, flag: "wx" });
+    await rename(tmp, output);
     console.error(`rendered ${refs.length} reference(s) into ${output} (mode 0600)`);
 }
 const SKIP_DIRS = new Set([".git", "node_modules", "dist", ".next", ".venv"]);
@@ -234,6 +246,143 @@ async function scan(paths) {
     if (leaks)
         process.exitCode = 1;
 }
+// setup: keyshroud gets its own bw login (CONFIG_DIR/bw) on a separate agent
+// account, so agents never get a session for the user's personal vault.
+async function setupCommand(args) {
+    requireKnownFlags(args, ["--email", "--server"], ["--confirm-unlock", "--registered"]);
+    const email = valueAfter(args, "--email");
+    if (!email || !/^[^\s@]+@[^\s@]+$/.test(email))
+        fail("setup needs --email for a separate agent account (not your personal one)", 2);
+    let server = valueAfter(args, "--server");
+    if (!server) {
+        try {
+            server = JSON.parse(await core.bw(["status"])).serverUrl ?? undefined;
+        }
+        catch { }
+    }
+    if (!server || !/^https:\/\//.test(server))
+        fail("setup needs --server https://… (no bw server is configured)", 2);
+    const confirm = args.includes("--confirm-unlock");
+    if (confirm && process.platform !== "darwin")
+        fail("--confirm-unlock needs the macOS keychain; Linux secret-tool cannot ask before each read", 2);
+    core.useOwnBwLogin();
+    await mkdir(core.OWN_BW_DIR, { recursive: true, mode: 0o700 });
+    const status = JSON.parse(await core.bw(["status"]).catch(() => "{}"));
+    if (status.userEmail && status.userEmail.toLowerCase() !== email.toLowerCase())
+        fail(`${BRAND.name}'s bw login already belongs to ${status.userEmail}; remove ${core.OWN_BW_DIR} to start over`, 5);
+    const loggedOut = !status.status || status.status === "unauthenticated";
+    if (loggedOut)
+        await core.bw(["config", "server", server]);
+    await unlink(core.SESSION_FILE).catch(() => { });
+    console.log(`${BRAND.name} now keeps its own bw login in ${core.OWN_BW_DIR}; your personal bw login is untouched.`);
+    const signupUrl = `${server.replace(/\/$/, "")}/#/signup?email=${encodeURIComponent(email)}`;
+    if (!process.stdin.isTTY) {
+        // An agent's shell: nothing can be typed, so keyshroud picks the password.
+        const hasEntry = Boolean(await core.readKeychain(core.KEYCHAIN_MASTER_SERVICE));
+        if (!loggedOut && (confirm || !hasEntry))
+            fail(`The agent account is already logged in; run \`${BRAND.bin} setup\` in a terminal to store its password`, 2);
+        if (loggedOut && !args.includes("--registered")) {
+            if (!hasEntry && !(await core.generateKeychainSecret(core.KEYCHAIN_MASTER_SERVICE, `${BRAND.name} agent account`, confirm)))
+                fail("Could not store a generated password (needs macOS security or Linux secret-tool)", 3);
+            const master = await core.readKeychain(core.KEYCHAIN_MASTER_SERVICE);
+            if (!master || !(await core.copyToClipboard(master)))
+                fail(`No clipboard tool; run \`${BRAND.bin} setup\` in a terminal instead`, 3);
+            spawn(process.platform === "darwin" ? "open" : "xdg-open", [signupUrl], { stdio: "ignore" }).on("error", () => { });
+            console.log(`A random master password for ${email} is in the keychain (${core.KEYCHAIN_MASTER_SERVICE}) and on the clipboard.`);
+            console.log(`Create the account at ${signupUrl} and paste it into both password fields.`);
+            console.log(`Then: ${BRAND.bin} setup --email ${email} --registered`);
+            return;
+        }
+    }
+    if (loggedOut && !args.includes("--registered")) {
+        const url = signupUrl;
+        console.log(`1. Create the agent account ${email}: ${url}`);
+        console.log("   Pick a new master password, not your personal one.");
+        spawn(process.platform === "darwin" ? "open" : "xdg-open", [url], { stdio: "ignore" }).on("error", () => { });
+        process.stdout.write("   Press Enter once the account exists. ");
+        await new Promise((resolve) => process.stdin.once("data", resolve));
+        process.stdin.pause();
+    }
+    if (confirm || !(await core.readKeychain(core.KEYCHAIN_MASTER_SERVICE))) {
+        console.log(`2. Type the agent account's master password for the keychain entry ${core.KEYCHAIN_MASTER_SERVICE}${confirm ? " (macOS will ask before every unlock)" : ""}:`);
+        if (!(await core.storeKeychainInteractive(core.KEYCHAIN_MASTER_SERVICE, `${BRAND.name} agent account`, confirm)))
+            fail("Could not store it (needs macOS security or Linux secret-tool)", 3);
+    }
+    const master = await core.readKeychain(core.KEYCHAIN_MASTER_SERVICE);
+    if (!master)
+        fail(`The keychain entry ${core.KEYCHAIN_MASTER_SERVICE} is missing or access was denied`, 3);
+    if (loggedOut)
+        await core.loginOwnAccount(email, master);
+    else
+        await core.ensureSession();
+    await core.clearClipboardIf(master);
+    await core.audit("setup", [], "cli");
+    console.log(`ready: bw login=${email} (own). Next: \`${BRAND.bin} migrate\` copies the wired secrets from your personal vault.`);
+}
+// migrate: copy the items that wired names (and env files) reference from the
+// personal vault into the agent account. Same names, so references keep working.
+async function migrateCommand(args) {
+    requireKnownFlags(args, ["--item", "--env-file"], ["--yes"]);
+    if (!core.OWN_BW_LOGIN)
+        fail(`Run \`${BRAND.bin} setup\` first: migrate copies items into ${BRAND.name}'s own agent account`, 2);
+    const entries = [...await core.authEnvEntries()];
+    for (const file of valuesAfter(args, "--env-file"))
+        entries.push(...await core.envFileEntries(file));
+    const names = new Map();
+    for (const entry of entries) {
+        try {
+            const ref = parseRef(entry.raw);
+            if (ref)
+                names.set(ref.item.toLowerCase(), ref.item);
+        }
+        catch { }
+    }
+    for (const name of valuesAfter(args, "--item"))
+        names.set(name.toLowerCase(), name);
+    await core.ensureSession();
+    const own = await core.findItems("");
+    const personal = await core.readPersonalItems();
+    const rows = [...names.values()].sort().map((name) => {
+        if (own.some((item) => item.name.toLowerCase() === name.toLowerCase() || item.id === name))
+            return { name, state: "present" };
+        const matches = personal.filter((item) => String(item.name ?? "").toLowerCase() === name.toLowerCase() || item.id === name);
+        return matches.length === 1 ? { name, state: "copy", item: matches[0] } : { name, state: matches.length ? "ambiguous" : "missing" };
+    });
+    const width = Math.max(4, ...rows.map((row) => row.name.length));
+    console.log("migrate plan (personal vault -> agent account):");
+    for (const row of rows)
+        console.log(`  ${row.name.padEnd(width)}  ${row.state === "present" ? "already in the agent account" : row.state}`);
+    const count = (state) => rows.filter((row) => row.state === state).length;
+    console.log(`${count("copy")} to copy, ${count("present")} already there, ${count("missing")} missing, ${count("ambiguous")} ambiguous`);
+    if (!args.includes("--yes")) {
+        console.log("Dry run: nothing copied. Re-run with --yes.");
+        return;
+    }
+    const copied = [];
+    for (const row of rows.filter((entry) => entry.state === "copy")) {
+        try {
+            await core.copyItemToOwnVault(row.item);
+            copied.push(row.name);
+        }
+        catch {
+            if (copied.length)
+                console.error(`Copied before the failure: ${copied.join(", ")}`);
+            fail(`Failed to copy ${row.name}`, 3);
+        }
+    }
+    await core.syncOwnVault();
+    const after = await core.findItems("");
+    const unverified = copied.filter((name) => !after.some((item) => item.name.toLowerCase() === name.toLowerCase()));
+    await core.audit("migrate", copied, "cli");
+    await core.refreshRedactIndex();
+    console.log(`copied ${copied.length} item(s) into the agent account; references are unchanged.`);
+    const cut = process.platform === "darwin" ? `security delete-generic-password -s ${core.PERSONAL_KEYCHAIN_MASTER_SERVICE}` : `secret-tool clear service ${core.PERSONAL_KEYCHAIN_MASTER_SERVICE} account "$USER"`;
+    console.log(`Your personal master password is still in the keychain, where any program running as you can read it. Once you no longer need it there: ${cut}`);
+    if (unverified.length)
+        fail(`Not found after copying: ${unverified.join(", ")}`, 4);
+    if (count("missing") || count("ambiguous"))
+        process.exitCode = 4;
+}
 async function importCommand(args) {
     requireKnownFlags(args, ["--from", "--out", "--prefix", "--only", "--skip"], ["--yes", "--replace", "--force"]);
     const from = valueAfter(args, "--from") ?? ".env";
@@ -347,9 +496,9 @@ async function importCommand(args) {
     const lines = text.split(/\r?\n/);
     for (const row of toStore)
         lines[row.entry.line - 1] = `${row.entry.exported ? "export " : ""}${row.entry.name}=bw://${row.item}`;
-    const mode = replace ? (await stat(out)).mode & 0o777 : 0o644;
-    const tmp = `${out}.tmp.${process.pid}`;
-    await writeFile(tmp, lines.join(eol), { mode });
+    const mode = replace ? (await stat(out)).mode & 0o777 : 0o600;
+    const tmp = `${out}.tmp.${randomBytes(6).toString("hex")}`;
+    await writeFile(tmp, lines.join(eol), { mode, flag: "wx" });
     await rename(tmp, out);
     await core.audit("import", toStore.map((row) => row.entry.name), "cli");
     console.log(`imported ${toStore.length} secret(s) (${created.length} new); wrote ${out}`);
@@ -466,11 +615,15 @@ async function main() {
             const notes = valueAfter(args, "--notes");
             if (!envName || !itemName || !ENV_NAME_RE.test(envName))
                 fail(usage, 2);
+            checkNames(envName, itemName);
             const reference = core.referenceFor(itemName);
             const targets = targetList(valueAfter(args, "--target"));
             await core.ensureSession();
-            const secret = await readSecret(args, `Paste secret for ${envName}: `, envName, itemName);
+            if ((await core.findItems(itemName)).some((item) => item.name.toLowerCase() === itemName.toLowerCase()))
+                fail(`Vault item already exists: ${itemName}`, 5);
+            const secret = await readSecret(args, `Paste secret for ${envName}: `, itemName, envName);
             await core.createSecretItem({ itemName, secret, envName, notes });
+            await core.audit("add", [envName], "cli");
             let conflict = false;
             for (const path of targets) {
                 const result = await core.writeAuthEntry(path, envName, reference);
@@ -478,6 +631,7 @@ async function main() {
                     conflict = true;
             }
             const verified = (await core.resolveShellValue(reference)) !== null;
+            await core.refreshRedactIndex();
             console.log(`created item=${itemName} env=${envName} targets=${targets.join(",")} verified=${verified ? "yes" : "no"}`);
             if (conflict) {
                 console.error("Item created, but one or more auth targets already contained the environment name.");
@@ -489,14 +643,24 @@ async function main() {
             await importCommand(args);
             return;
         }
+        if (command === "setup") {
+            await setupCommand(args);
+            return;
+        }
+        if (command === "migrate") {
+            await migrateCommand(args);
+            return;
+        }
         if (command === "rotate") {
             requireKnownFlags(args, ["--item"], ["--stdin", "--dialog"]);
             const itemName = valueAfter(args, "--item");
             if (!itemName)
                 fail(usage, 2);
             await core.ensureSession();
-            const secret = await readSecret(args, "Paste replacement secret: ", `the new value of ${itemName}`, itemName);
+            const secret = await readSecret(args, "Paste replacement secret: ", itemName);
             await core.rotateSecretItem({ itemName, secret });
+            await core.audit("rotate", [itemName], "cli");
+            await core.refreshRedactIndex();
             console.log(`rotated item=${itemName}`);
             return;
         }
@@ -506,6 +670,8 @@ async function main() {
             const itemName = valueAfter(args, "--item");
             if (!envName || !itemName || !ENV_NAME_RE.test(envName))
                 fail(usage, 2);
+            if (isLoaderEnvName(envName))
+                fail(`${envName} changes what programs load or run; it cannot be wired to a secret`, 2);
             const reference = core.referenceFor(itemName);
             const targets = targetList(valueAfter(args, "--target"));
             for (const path of targets) {
@@ -582,6 +748,7 @@ async function main() {
             }
             catch { }
             const s = await core.getStatus();
+            console.log(`bw login=${core.OWN_BW_LOGIN ? `own agent account (${core.OWN_BW_DIR})` : `shared with your personal bw (run: ${BRAND.bin} setup)`}`);
             console.log(`bw version=${s.version ?? "missing (install @bitwarden/cli)"}`);
             console.log(`bw server=${s.serverUrl ?? "unconfigured (run: bw config server <url>)"}`);
             console.log(`session=${s.status}`);

package/dist/core.d.ts

@@ -5,9 +5,13 @@ export declare const SESSION_FILE: string;
 export declare const MASTER_PASSWORD_FILE: string;
 export declare const REDACT_INDEX_FILE: string;
 export declare const AUDIT_FILE: string;
-export declare const KEYCHAIN_MASTER_SERVICE: string;
-export declare const KEYCHAIN_CLIENT_ID_SERVICE: string;
-export declare const KEYCHAIN_CLIENT_SECRET_SERVICE: string;
+export declare const OWN_BW_DIR: string;
+export declare const PERSONAL_KEYCHAIN_MASTER_SERVICE: string;
+export declare let OWN_BW_LOGIN: boolean;
+export declare let KEYCHAIN_MASTER_SERVICE: string;
+export declare let KEYCHAIN_CLIENT_ID_SERVICE: string;
+export declare let KEYCHAIN_CLIENT_SECRET_SERVICE: string;
+export declare function useOwnBwLogin(): void;
 export declare const PROVIDER_KEYS: ReadonlySet<string>;
 export interface VaultStatus {
     status: string;
@@ -39,8 +43,17 @@ export interface VaultItem {
 }
 export declare function invalidateSecretCache(): void;
 export declare function resolveRef(ref: SecretRef): Promise<string | null>;
+export declare function readKeychain(service: string): Promise<string | null>;
 export declare function keychainPresence(): Promise<Record<string, boolean>>;
 export declare function ensureSession(): Promise<string>;
+export declare function storeKeychainInteractive(service: string, label: string, confirm: boolean): Promise<boolean>;
+export declare function generateKeychainSecret(service: string, label: string, confirm: boolean): Promise<boolean>;
+export declare function copyToClipboard(text: string): Promise<boolean>;
+export declare function clearClipboardIf(text: string): Promise<void>;
+export declare function loginOwnAccount(email: string, master: string): Promise<string>;
+export declare function readPersonalItems(): Promise<Array<Record<string, unknown>>>;
+export declare function copyItemToOwnVault(item: Record<string, unknown>): Promise<void>;
+export declare function syncOwnVault(): Promise<void>;
 export declare function lock(): Promise<void>;
 export declare function audit(action: string, names: string[], consumer: string): Promise<void>;
 export declare function getStatus(): Promise<VaultStatus>;
@@ -78,6 +91,7 @@ export declare function buildEnvMap(): Promise<Record<string, string>>;
 export declare function redactionValues(wired?: Record<string, string>): Promise<Record<string, string>>;
 export declare function indexValues(wired?: Record<string, string>): Record<string, string>;
 export declare function writeRedactIndex(values: Record<string, string>): Promise<RedactIndex>;
+export declare function refreshRedactIndex(): Promise<void>;
 export declare function readRedactIndex(): Promise<RedactIndex | null>;
 export declare function findItems(search: string): Promise<Array<{
     id: string;
@@ -104,6 +118,6 @@ export declare function readSecretFromInput(opts: {
     stdin: boolean;
 }): Promise<string>;
 export declare function readSecretFromDialog(opts: {
-    label: string;
     itemName: string;
+    envName?: string;
 }): Promise<string | null>;