keyshroud 0.5.2 → 0.6.0

package/dist/core.js

@@ -1,13 +1,15 @@
 // Runtime-neutral core: no pi/omp/Claude Code imports. Every caller (agent
 // extensions, CLI, MCP server, hooks) goes through these functions.
-import { execFile } from "node:child_process";
+import { execFile, spawn } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import { existsSync } from "node:fs";
 import { appendFile, chmod, mkdir, readFile, realpath, rename, rm, stat, unlink, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { join, dirname } from "node:path";
 import process from "node:process";
 import { BRAND } from "./brand.js";
 import { buildRedactIndex } from "./redact.js";
-import { ENV_NAME_RE, legacyRefFor, parseEnvFile, parseRef } from "./refs.js";
+import { ENV_NAME_RE, isLoaderEnvName, itemNameProblem, legacyRefFor, parseEnvFile, parseRef } from "./refs.js";
 const P = BRAND.envPrefix;
 function setting(name) {
     const value = process.env[`${P}_${name}`]?.trim();
@@ -18,9 +20,24 @@ export const SESSION_FILE = join(CONFIG_DIR, "session");
 export const MASTER_PASSWORD_FILE = join(CONFIG_DIR, "master-password");
 export const REDACT_INDEX_FILE = join(CONFIG_DIR, "redact-index.json");
 export const AUDIT_FILE = join(CONFIG_DIR, "audit.jsonl");
-export const KEYCHAIN_MASTER_SERVICE = setting("KEYCHAIN_MASTER") ?? "vaultwarden-master-password";
-export const KEYCHAIN_CLIENT_ID_SERVICE = setting("KEYCHAIN_CLIENT_ID") ?? "vaultwarden-api-client-id";
-export const KEYCHAIN_CLIENT_SECRET_SERVICE = setting("KEYCHAIN_CLIENT_SECRET") ?? "vaultwarden-api-client-secret";
+// After `setup`, keyshroud keeps its own bw login (a dedicated agent account) in
+// CONFIG_DIR/bw, with its own keychain entries, so the user's personal bw login
+// and vault are never unlocked. Without it, keyshroud shares the default bw login.
+export const OWN_BW_DIR = join(CONFIG_DIR, "bw");
+export const PERSONAL_KEYCHAIN_MASTER_SERVICE = setting("PERSONAL_KEYCHAIN_MASTER") ?? "vaultwarden-master-password";
+export let OWN_BW_LOGIN = false;
+export let KEYCHAIN_MASTER_SERVICE = setting("KEYCHAIN_MASTER") ?? PERSONAL_KEYCHAIN_MASTER_SERVICE;
+export let KEYCHAIN_CLIENT_ID_SERVICE = setting("KEYCHAIN_CLIENT_ID") ?? "vaultwarden-api-client-id";
+export let KEYCHAIN_CLIENT_SECRET_SERVICE = setting("KEYCHAIN_CLIENT_SECRET") ?? "vaultwarden-api-client-secret";
+export function useOwnBwLogin() {
+    OWN_BW_LOGIN = true;
+    process.env.BITWARDENCLI_APPDATA_DIR = OWN_BW_DIR;
+    KEYCHAIN_MASTER_SERVICE = setting("KEYCHAIN_MASTER") ?? `${BRAND.bin}-master-password`;
+    KEYCHAIN_CLIENT_ID_SERVICE = setting("KEYCHAIN_CLIENT_ID") ?? `${BRAND.bin}-api-client-id`;
+    KEYCHAIN_CLIENT_SECRET_SERVICE = setting("KEYCHAIN_CLIENT_SECRET") ?? `${BRAND.bin}-api-client-secret`;
+}
+if (!process.env.BITWARDENCLI_APPDATA_DIR && existsSync(join(OWN_BW_DIR, "data.json")))
+    useOwnBwLogin();
 export const PROVIDER_KEYS = new Set([
     "anthropic", "openai", "azure-openai-responses", "deepseek", "google", "mistral",
     "groq", "cerebras", "cloudflare-ai-gateway", "cloudflare-workers-ai", "xai",
@@ -54,13 +71,16 @@ export function getAuthTargets() {
 export const referenceFor = legacyRefFor;
 // Vault credentials never reach commands run on the agent's behalf: with the
 // session token a child could dump the whole vault, defeating `--only`.
-export const VAULT_ENV_KEYS = ["BW_SESSION", "BW_PASSWORD", "BW_CLIENTID", "BW_CLIENTSECRET"];
+export const VAULT_ENV_KEYS = ["BW_SESSION", "BW_PASSWORD", "BW_CLIENTID", "BW_CLIENTSECRET", "BITWARDENCLI_APPDATA_DIR"];
 export function childEnv(extra = {}) {
     const env = {};
     for (const [name, value] of Object.entries(process.env))
         if (value !== undefined && !VAULT_ENV_KEYS.includes(name))
             env[name] = value;
-    return { ...env, ...extra };
+    for (const [name, value] of Object.entries(extra))
+        if (!isLoaderEnvName(name))
+            env[name] = value;
+    return env;
 }
 export async function bw(args, opts = {}) {
     const session = opts.session ?? process.env.BW_SESSION;
@@ -185,10 +205,12 @@ export async function resolveRef(ref) {
         case "totp": return (await bw(["get", "totp", item.id])).trim() || null;
     }
 }
-async function readKeychain(service) {
+// The timeout leaves room for a macOS "allow access" prompt when the entry was
+// stored with `setup --confirm-unlock`; a missing entry still fails at once.
+export async function readKeychain(service) {
     const user = process.env.USER || process.env.LOGNAME || "";
     try {
-        const result = await runFile("security", ["find-generic-password", "-a", user, "-s", service, "-w"], { timeout: 10000, maxBuffer: 1024 * 1024 });
+        const result = await runFile("security", ["find-generic-password", "-a", user, "-s", service, "-w"], { timeout: 120000, maxBuffer: 1024 * 1024 });
         return result.stdout.trim() || null;
     }
     catch { }
@@ -238,8 +260,8 @@ export function ensureSession() {
 }
 async function writePrivateFile(path, content) {
     await mkdir(dirname(path), { recursive: true, mode: 0o700 });
-    const tmp = `${path}.tmp.${process.pid}`;
-    await writeFile(tmp, content, { encoding: "utf8", mode: 0o600 });
+    const tmp = `${path}.tmp.${randomBytes(6).toString("hex")}`;
+    await writeFile(tmp, content, { encoding: "utf8", mode: 0o600, flag: "wx" });
     await chmod(tmp, 0o600);
     await rename(tmp, path);
     await chmod(path, 0o600);
@@ -281,6 +303,129 @@ async function ensureSessionInner(existing) {
     invalidateSecretCache();
     return token;
 }
+// Store a keychain entry by letting the OS tool prompt for the value on the
+// user's terminal, so keyshroud never holds it in argv. `confirm` (macOS) trusts
+// no app, so every later read asks the user first.
+export async function storeKeychainInteractive(service, label, confirm) {
+    const user = process.env.USER || process.env.LOGNAME || "";
+    const attempts = process.platform === "darwin"
+        ? [["security", ["add-generic-password", "-U", "-a", user, "-s", service, "-l", label, ...(confirm ? ["-T", ""] : []), "-w"]]]
+        : [["secret-tool", ["store", `--label=${label}`, "service", service, "account", user]]];
+    // -U keeps an existing entry's access list, so an ask-every-time entry is recreated.
+    if (process.platform === "darwin" && confirm)
+        await runFile("security", ["delete-generic-password", "-a", user, "-s", service], { timeout: 10000, maxBuffer: 1024 * 1024 }).catch(() => { });
+    for (const [command, args] of attempts) {
+        const code = await new Promise((resolve) => {
+            const child = spawn(command, args, { stdio: "inherit" });
+            child.on("error", () => resolve(null));
+            child.on("exit", (exit) => resolve(exit));
+        });
+        if (code === 0)
+            return true;
+    }
+    return false;
+}
+// `setup` from an agent's shell (no terminal): a random master password for the
+// new agent account, written to the keychain over stdin. Nobody types it and it
+// never reaches argv or output; the user gets it via the clipboard for signup.
+export async function generateKeychainSecret(service, label, confirm) {
+    const secret = randomBytes(24).toString("base64url");
+    const user = process.env.USER || process.env.LOGNAME || "";
+    const opts = { timeout: 30000, maxBuffer: 1024 * 1024 };
+    try {
+        if (process.platform === "darwin") {
+            // `security -i` reads the command from stdin, so the value is not in argv.
+            await runFile("security", ["-i"], opts, `add-generic-password -U -a "${user}" -s "${service}" -l "${label}"${confirm ? ' -T ""' : ""} -w "${secret}"\n`);
+            await runFile("security", ["find-generic-password", "-a", user, "-s", service], opts);
+        }
+        else {
+            await runFile("secret-tool", ["store", `--label=${label}`, "service", service, "account", user], opts, secret);
+        }
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+const CLIPBOARD_TOOLS = process.platform === "darwin"
+    ? [["pbcopy", [], "pbpaste", []]]
+    : [["wl-copy", [], "wl-paste", ["--no-newline"]], ["xclip", ["-selection", "clipboard"], "xclip", ["-selection", "clipboard", "-o"]]];
+export async function copyToClipboard(text) {
+    for (const [copy, args] of CLIPBOARD_TOOLS) {
+        try {
+            await runFile(copy, args, { timeout: 10000, maxBuffer: 1024 * 1024 }, text);
+            return true;
+        }
+        catch { }
+    }
+    return false;
+}
+// Empty the clipboard only if it still holds `text`.
+export async function clearClipboardIf(text) {
+    for (const [copy, copyArgs, paste, pasteArgs] of CLIPBOARD_TOOLS) {
+        try {
+            if ((await runFile(paste, pasteArgs, { timeout: 10000, maxBuffer: 1024 * 1024 })).stdout.trim() === text)
+                await runFile(copy, copyArgs, { timeout: 10000, maxBuffer: 1024 * 1024 }, "");
+            return;
+        }
+        catch { }
+    }
+}
+// `setup`: log keyshroud's own bw login in to the agent account. stdin and
+// stderr stay on the terminal so bw can ask for a two-step login code.
+export async function loginOwnAccount(email, master) {
+    const token = await new Promise((resolve, reject) => {
+        const child = spawn("bw", ["login", email, "--passwordenv", "BW_PASSWORD", "--raw"], { env: { ...process.env, BW_PASSWORD: master }, stdio: ["inherit", "pipe", "inherit"] });
+        let out = "";
+        child.stdout.on("data", (chunk) => { out += chunk; });
+        child.on("error", reject);
+        child.on("exit", (exit) => (exit === 0 && out.trim() ? resolve(out.trim()) : reject(new Error("bw login failed"))));
+    });
+    await writePrivateFile(SESSION_FILE, `${token}\n`);
+    process.env.BW_SESSION = token;
+    try {
+        await bw(["sync", "--quiet"], { session: token });
+    }
+    catch { }
+    invalidateSecretCache();
+    return token;
+}
+// `migrate`: read the items of the bw login the user had before setup (the
+// default bw data dir), then lock it again. The values stay in memory.
+export async function readPersonalItems() {
+    const master = await readKeychain(PERSONAL_KEYCHAIN_MASTER_SERVICE);
+    if (!master)
+        throw new Error(`Personal master password not in the keychain (${PERSONAL_KEYCHAIN_MASTER_SERVICE})`);
+    const env = (extra) => {
+        const out = {};
+        for (const [name, value] of Object.entries(process.env))
+            if (value !== undefined && !VAULT_ENV_KEYS.includes(name))
+                out[name] = value;
+        return { ...out, ...extra };
+    };
+    const token = (await runFile("bw", ["unlock", "--passwordenv", "BW_PASSWORD", "--raw"], { env: env({ BW_PASSWORD: master }), timeout: 30000, maxBuffer: 4 * 1024 * 1024 })).stdout.trim();
+    if (!token)
+        throw new Error("Personal vault unlock returned no session");
+    try {
+        const parsed = JSON.parse((await runFile("bw", ["list", "items"], { env: env({ BW_SESSION: token }), timeout: 120000, maxBuffer: 256 * 1024 * 1024 })).stdout);
+        return Array.isArray(parsed) ? parsed : [];
+    }
+    finally {
+        try {
+            await runFile("bw", ["lock"], { env: env({}), timeout: 20000, maxBuffer: 1024 * 1024 });
+        }
+        catch { }
+    }
+}
+// A personal item as a new item for the agent account: no ids, folders,
+// organizations, history, attachments or per-item key (encrypted to the personal account).
+export async function copyItemToOwnVault(item) {
+    const copy = { ...item, favorite: false };
+    for (const key of ["id", "key", "object", "organizationId", "folderId", "collectionIds", "revisionDate", "creationDate", "deletedDate", "passwordHistory", "attachments"])
+        delete copy[key];
+    await bw(["create", "item"], { input: Buffer.from(JSON.stringify(copy), "utf8").toString("base64") });
+}
+export async function syncOwnVault() { await bw(["sync", "--quiet"]); invalidateSecretCache(); }
 // Forget the cached session and lock the bw CLI. The next resolve unlocks
 // again from the keychain.
 export async function lock() {
@@ -485,6 +630,8 @@ export async function envFileEntries(path) {
     return parseEnvFile(await readFile(path, "utf8")).map(({ name, value }) => {
         if (value.trim().startsWith("!"))
             throw new Error(`${path}: ${name} uses a shell command; env files accept only bw:// references and literals`);
+        if (isLoaderEnvName(name))
+            throw new Error(`${path}: ${name} changes what programs load or run; env files cannot set it`);
         return { name, raw: value };
     });
 }
@@ -539,6 +686,11 @@ export async function writeRedactIndex(values) {
     await writePrivateFile(REDACT_INDEX_FILE, `${JSON.stringify(index)}\n`);
     return index;
 }
+// Re-index after the wired set changes so hooks mask a new value right away.
+export async function refreshRedactIndex() {
+    const env = await resolveEntries(await authEnvEntries());
+    await writeRedactIndex(indexValues(env.secrets));
+}
 export async function readRedactIndex() {
     try {
         const parsed = JSON.parse(await readFile(REDACT_INDEX_FILE, "utf8"));
@@ -573,7 +725,17 @@ export async function getSecret(itemName) {
         throw mapItemError(error, itemName);
     }
 }
+// An agent can start add/rotate, so a dialog could be used to phish the master
+// password into an item it can then read; refuse it outright.
+async function refuseMasterPassword(secret) {
+    if (secret && secret === await readMasterPassword())
+        throw new Error("Refusing to store the vault master password as a secret");
+}
 export async function createSecretItem(opts) {
+    const problem = itemNameProblem(opts.itemName);
+    if (problem)
+        throw new Error(`Vault item name ${problem}`);
+    await refuseMasterPassword(opts.secret);
     const existing = await findItems(opts.itemName);
     if (existing.some((item) => item.name.toLowerCase() === opts.itemName.toLowerCase()))
         throw new Error(`Vault item already exists: ${opts.itemName}`);
@@ -598,6 +760,7 @@ export async function createSecretItem(opts) {
     return { id: String(created.id) };
 }
 export async function rotateSecretItem(opts) {
+    await refuseMasterPassword(opts.secret);
     let parsed;
     try {
         parsed = JSON.parse(await bw(["get", "item", opts.itemName]));
@@ -620,7 +783,7 @@ export async function deleteItem(id, permanent = false) {
     invalidateSecretCache();
 }
 export async function readSecretFromInput(opts) {
-    if (opts.stdin || !process.stdin.isTTY) {
+    if (opts.stdin) {
         let input = "";
         for await (const chunk of process.stdin)
             input += String(chunk);
@@ -629,41 +792,92 @@ export async function readSecretFromInput(opts) {
             throw new Error("Empty secret");
         return input;
     }
+    if (!process.stdin.isTTY)
+        throw new Error("No terminal to prompt on; pipe the value with --stdin");
     const value = await readMasked(opts.prompt);
     if (!value)
         throw new Error("Empty secret");
     return value;
 }
 // Native hidden-input dialog for callers without a terminal (agent shells, MCP).
-// Names reach the dialog through env vars, so an item name cannot inject
-// AppleScript; the value comes back only on the dialog's stdout. Resolves null
-// when no dialog can be shown (SSH, headless Linux, missing tools).
+// An agent can open it, so the wording is fixed, says who asked, and warns
+// against the master password; names are validated and passed as data (argv),
+// never as script. One dialog at a time, with a pause after a cancel. Resolves
+// null when no dialog can be shown (SSH, headless Linux, missing tools).
+const DIALOG_LOCK = join(CONFIG_DIR, "dialog.lock");
+const DIALOG_COOLDOWN_MS = 30_000;
+const DIALOG_TIMEOUT_MS = 300_000;
 export async function readSecretFromDialog(opts) {
     if (process.env.SSH_CONNECTION || process.env.SSH_TTY)
         return null;
-    const text = `Paste the secret for ${opts.label}\nVault item: ${opts.itemName}`;
+    const problem = itemNameProblem(opts.itemName);
+    if (problem)
+        throw new Error(`Vault item name ${problem}`);
+    if (opts.envName !== undefined && !ENV_NAME_RE.test(opts.envName))
+        throw new Error("Variable names must be UPPER_SNAKE_CASE");
+    const text = [
+        opts.envName ? "A program on this computer, usually an AI agent, asked to store a NEW secret." : "A program on this computer, usually an AI agent, asked to REPLACE the value of a secret.",
+        "",
+        ...(opts.envName ? [`Variable: ${opts.envName}`] : []),
+        `Vault item: ${opts.itemName}`,
+        "",
+        "This is not a login prompt. Never enter your vault master password here.",
+    ].join("\n");
     const candidates = process.platform === "darwin"
-        ? [["osascript", ["-e", [
-                        'set t to "Paste the secret for " & (system attribute "KEYSHROUD_DIALOG_ENV") & return & "Vault item: " & (system attribute "KEYSHROUD_DIALOG_ITEM")',
-                        'activate',
-                        'text returned of (display dialog t default answer "" with hidden answer with title "keyshroud" buttons {"Cancel", "Save"} default button "Save" cancel button "Cancel")',
-                    ].join("\n")]]]
+        ? [["osascript", ["-e", "on run argv", "-e", 'activate', "-e",
+                    'text returned of (display dialog (item 1 of argv) default answer "" with hidden answer with title "keyshroud" buttons {"Cancel", "Save"} default button "Save" cancel button "Cancel" with icon caution)',
+                    "-e", "end run", "--", text]]]
         : process.env.DISPLAY || process.env.WAYLAND_DISPLAY
-            ? [["zenity", ["--entry", "--hide-text", "--title=keyshroud", `--text=${text}`]], ["kdialog", ["--title", "keyshroud", "--password", text]]]
+            ? [["zenity", ["--entry", "--hide-text", "--no-markup", "--title=keyshroud", `--text=${text}`]], ["kdialog", ["--title", "keyshroud", "--password", text.replace(/[<>]/g, "")]]]
             : [];
-    for (const [command, args] of candidates) {
-        const result = await new Promise((resolve) => {
-            execFile(command, args, { env: { ...process.env, KEYSHROUD_DIALOG_ENV: opts.label, KEYSHROUD_DIALOG_ITEM: opts.itemName }, timeout: 300_000 }, (error, stdout, stderr) => resolve({ code: error ? (error.code ?? 1) : 0, stdout: String(stdout), stderr: String(stderr) }));
-        });
-        if (result.code === "ENOENT")
-            continue;
-        if (result.code === 0)
-            return result.stdout.replace(/\r?\n$/, "");
-        if (command !== "osascript" || /-128/.test(result.stderr))
-            throw new Error("Cancelled");
+    if (!candidates.length)
+        return null;
+    return withDialogLock(async () => {
+        for (const [command, args] of candidates) {
+            const result = await new Promise((resolve) => {
+                execFile(command, args, { timeout: DIALOG_TIMEOUT_MS }, (error, stdout, stderr) => resolve({ code: error ? (error.code ?? 1) : 0, stdout: String(stdout), stderr: String(stderr) }));
+            });
+            if (result.code === "ENOENT")
+                continue;
+            if (result.code === 0)
+                return result.stdout.replace(/\r?\n$/, "");
+            if (command !== "osascript" || /-128/.test(result.stderr))
+                throw new Error("Cancelled");
+            return null;
+        }
         return null;
+    });
+}
+async function withDialogLock(fn) {
+    await mkdir(CONFIG_DIR, { recursive: true, mode: 0o700 });
+    let held = "";
+    try {
+        held = await readFile(DIALOG_LOCK, "utf8");
+    }
+    catch { }
+    const [kind, at] = held.trim().split(":");
+    const age = Date.now() - Number(at);
+    const live = (kind === "open" || kind === "cancelled") && age >= 0 && age < (kind === "cancelled" ? DIALOG_COOLDOWN_MS : DIALOG_TIMEOUT_MS + 30_000);
+    if (!live)
+        await rm(DIALOG_LOCK, { force: true });
+    try {
+        await writeFile(DIALOG_LOCK, `open:${Date.now()}\n`, { flag: "wx", mode: 0o600 });
+    }
+    catch {
+        throw new Error(kind === "cancelled" ? "The last dialog was cancelled; wait 30 seconds before asking again" : "Another keyshroud dialog is already open");
+    }
+    try {
+        const value = await fn();
+        await rm(DIALOG_LOCK, { force: true });
+        return value;
+    }
+    catch (error) {
+        if (error instanceof Error && error.message === "Cancelled")
+            await writeFile(DIALOG_LOCK, `cancelled:${Date.now()}\n`, { mode: 0o600 });
+        else
+            await rm(DIALOG_LOCK, { force: true });
+        throw error;
     }
-    return null;
 }
 // Raw-mode prompt that echoes one "*" per character (capped, then a count), so
 // the user sees typing and pastes land without the value ever reaching the screen.
@@ -675,7 +889,16 @@ function readMasked(prompt) {
         process.stderr.write(`\r\x1b[2K${prompt}${shown}`);
     };
     return new Promise((resolve, reject) => {
+        // After Enter, keep reading briefly: the rest of a multi-line paste must be
+        // consumed here (or it would reach the parent shell) and is then refused.
+        let ending;
+        let multiline = false;
+        const settle = () => {
+            clearTimeout(ending);
+            ending = setTimeout(() => finish(multiline ? new Error("Multi-line values are not supported in the prompt; pipe them with --stdin") : undefined), 100);
+        };
         const finish = (error) => {
+            clearTimeout(ending);
             stdin.off("data", onData);
             stdin.setRawMode(false);
             stdin.pause();
@@ -686,9 +909,18 @@ function readMasked(prompt) {
                 resolve(chars.join(""));
         };
         const onData = (chunk) => {
-            for (const ch of chunk.replace(/\x1b\[[0-9;?]*[ -/]*[@-~]|\x1b./g, "")) {
-                if (ch === "\r" || ch === "\n")
-                    return finish();
+            if (ending) {
+                if (/[^\r\n]/.test(chunk))
+                    multiline = true;
+                return settle();
+            }
+            const clean = [...chunk.replace(/\x1b\[[0-9;?]*[ -/]*[@-~]|\x1b./g, "")];
+            for (const [index, ch] of clean.entries()) {
+                if (ch === "\r" || ch === "\n") {
+                    if (/[^\r\n]/.test(clean.slice(index + 1).join("")))
+                        multiline = true;
+                    return settle();
+                }
                 if (ch === "\x03")
                     return finish(new Error("Cancelled"));
                 if (ch === "\x04")

package/dist/mcp.js

@@ -7,7 +7,7 @@ import process from "node:process";
 import { BRAND } from "./brand.js";
 import * as core from "./core.js";
 import { createRedactor } from "./redact.js";
-import { ENV_NAME_RE } from "./refs.js";
+import { ENV_NAME_RE, isLoaderEnvName, itemNameProblem } from "./refs.js";
 const SUPPORTED_VERSIONS = ["2025-11-25", "2025-06-18", "2025-03-26", "2024-11-05"];
 const OUTPUT_LIMIT = 256 * 1024;
 const TOOLS = [
@@ -85,14 +85,14 @@ async function runTool(args) {
         detached: true,
     });
     const chunks = { stdout: [], stderr: [] };
-    // Collect generously, mask, then truncate, so a cut never splits a secret
-    // before redaction.
-    let size = 0;
+    // Collect generously per stream, mask, then truncate. If collection stopped
+    // early, the tail may end inside a secret, so it is dropped before masking.
+    const sizes = { stdout: 0, stderr: 0 };
     for (const stream of ["stdout", "stderr"]) {
         child[stream].on("data", (chunk) => {
-            if (size >= OUTPUT_LIMIT * 4)
+            if (sizes[stream] >= OUTPUT_LIMIT * 2)
                 return;
-            size += chunk.length;
+            sizes[stream] += chunk.length;
             chunks[stream].push(chunk);
         });
     }
@@ -105,9 +105,14 @@ async function runTool(args) {
         child.on("error", (error) => done(`spawn error: ${error.message}`));
     });
     clearTimeout(timer);
-    let truncated = size >= OUTPUT_LIMIT * 4;
+    let truncated = false;
     const out = (stream) => {
-        const masked = redactor.redact(Buffer.concat(chunks[stream]).toString("utf8"));
+        let raw = Buffer.concat(chunks[stream]).toString("utf8");
+        if (sizes[stream] >= OUTPUT_LIMIT * 2) {
+            truncated = true;
+            raw = raw.slice(0, redactor.safeCut(raw));
+        }
+        const masked = redactor.redact(raw);
         if (masked.length <= OUTPUT_LIMIT / 2)
             return masked;
         truncated = true;
@@ -141,30 +146,40 @@ async function callTool(name, args) {
         const itemName = String(args.item_name ?? "");
         if (!ENV_NAME_RE.test(envName) || !itemName)
             return text("env_name must be UPPER_SNAKE_CASE and item_name is required", true);
-        const notes = typeof args.purpose === "string" && args.purpose ? args.purpose : undefined;
+        if (isLoaderEnvName(envName))
+            return text(`${envName} changes what programs load or run; it cannot be wired to a secret`, true);
+        const problem = itemNameProblem(itemName);
+        if (problem)
+            return text(`item_name ${problem}`, true);
+        const notes = typeof args.purpose === "string" && args.purpose ? args.purpose.slice(0, 500) : undefined;
         try {
+            const reference = core.referenceFor(itemName);
             await core.ensureSession();
-            const secret = await core.readSecretFromDialog({ label: envName, itemName });
+            if ((await core.findItems(itemName)).some((item) => item.name.toLowerCase() === itemName.toLowerCase()))
+                return text(`Vault item already exists: ${itemName}`, true);
+            const secret = await core.readSecretFromDialog({ itemName, envName });
             if (secret === "")
                 return text("The user saved an empty value; nothing was stored.", true);
             if (secret !== null) {
                 await core.createSecretItem({ itemName, secret, envName, notes });
-                const reference = core.referenceFor(itemName);
+                await core.audit("request", [envName], "mcp");
+                const conflicts = [];
                 for (const path of Object.values(core.getAuthTargets()))
-                    await core.writeAuthEntry(path, envName, reference);
+                    if (!(await core.writeAuthEntry(path, envName, reference)).ok)
+                        conflicts.push(path);
+                await core.refreshRedactIndex();
+                if (conflicts.length)
+                    return text(`created item=${itemName}, but ${envName} is already wired to another secret in ${conflicts.join(", ")} and was left unchanged. Ask the user before running \`${BRAND.bin} wire --env ${envName} --item ${shellQuote(itemName)} --force\`.`, true);
                 const verified = (await core.resolveShellValue(reference)) !== null;
                 return text(`The user entered the value in a ${BRAND.name} dialog. created item=${itemName} env=${envName} verified=${verified ? "yes" : "no"}. Use secrets_run with $${envName}.`);
             }
         }
         catch (error) {
             const message = error instanceof Error ? error.message : String(error);
-            if (message === "Cancelled")
-                return text("The user cancelled the dialog; nothing was stored.", true);
-            if (/already exists/.test(message))
-                return text(message, true);
+            return text(message === "Cancelled" ? "The user cancelled the dialog; nothing was stored." : message, true);
         }
         const purpose = notes ? ` --notes ${shellQuote(notes)}` : "";
-        return text(`Ask the user to run this in their own terminal (the value is entered in a masked prompt; it must never be pasted into the chat):\n\n  ${BRAND.bin} add --env ${envName} --item ${shellQuote(itemName)}${purpose}\n\nAfter it reports verified=yes, use secrets_run with $${envName}.`);
+        return text(`No dialog can be shown here. Ask the user to run this in their own terminal (the value is entered in a masked prompt; it must never be pasted into the chat):\n\n  ${BRAND.bin} add --env ${envName} --item ${shellQuote(itemName)}${purpose}\n\nAfter it reports verified=yes, use secrets_run with $${envName}.`);
     }
     if (name === "vault_status") {
         try {

package/dist/redact.js

@@ -87,7 +87,7 @@ export function createRedactor(values) {
                 return cut;
             // Bounded fallback: cut near the end, moving forward past any complete
             // secret that straddles it, so whole matches are still replaced.
-            cut = text.length - maxLength;
+            cut = Math.max(0, text.length - maxLength);
             while (cut < text.length && straddling(cut))
                 cut++;
             return cut;

package/dist/refs.d.ts

@@ -10,6 +10,8 @@ export declare function parseRef(raw: string): SecretRef | null;
 export declare function formatRef(ref: SecretRef): string;
 export declare function legacyRefFor(itemName: string): string;
 export declare const ENV_NAME_RE: RegExp;
+export declare function isLoaderEnvName(name: string): boolean;
+export declare function itemNameProblem(name: string): string | null;
 export declare function parseEnvFile(text: string): Array<{
     name: string;
     value: string;

package/dist/refs.js

@@ -57,6 +57,21 @@ export function legacyRefFor(itemName) {
     return `!bw get password '${itemName}'`;
 }
 export const ENV_NAME_RE = /^[A-Z_][A-Z0-9_]*$/;
+// Variables that change what a child process loads or runs. Env files can come
+// from a cloned repo and agents can wire names, so neither may set these.
+const LOADER_ENV_RE = /^(?:PATH|HOME|ZDOTDIR|XDG_CONFIG_HOME|IFS|ENV|BASH_ENV|SHELLOPTS|BASHOPTS|PS4|PROMPT_COMMAND|NODE_OPTIONS|NODE_PATH|NODE_EXTRA_CA_CERTS|PYTHONPATH|PYTHONHOME|PYTHONSTARTUP|PERL5OPT|PERL5LIB|PERLLIB|RUBYOPT|RUBYLIB|JAVA_TOOL_OPTIONS|_JAVA_OPTIONS|JDK_JAVA_OPTIONS|EDITOR|VISUAL|PAGER|LESSOPEN|LESSCLOSE|BROWSER|SSH_ASKPASS|LD_\w*|DYLD_\w*|NPM_CONFIG_\w*|GIT_(?:SSH|SSH_COMMAND|EXEC_PATH|ASKPASS|EDITOR|PAGER|EXTERNAL_DIFF|PROXY_COMMAND|DIR|WORK_TREE|TEMPLATE_DIR|CONFIG\w*))$/i;
+export function isLoaderEnvName(name) { return LOADER_ENV_RE.test(name); }
+// Item names appear in native dialogs and lookups: one line of printable text,
+// no padding (lookups trim, so a padded name would shadow an existing item).
+export function itemNameProblem(name) {
+    if (!name || name !== name.trim())
+        return "must not be empty or start or end with spaces";
+    if (name.length > 120)
+        return "must be at most 120 characters";
+    if (/[\p{Cc}\p{Cf}\u2028\u2029]/u.test(name))
+        return "must be one line of printable text";
+    return null;
+}
 // Parses dotenv-style files whose values may be references:
 //   GH_TOKEN=bw://GitHub CLI token
 //   export SENTRY_DSN="bw://Sentry/fields/dsn"
@@ -140,15 +155,20 @@ export function parseDotenvStrict(text) {
     });
     return { entries, errors };
 }
-const SECRET_NAME_RE = /(SECRET|TOKEN|PASSW(?:OR)?D|PASSPHRASE|PWD|(?:^|_)KEY(?:$|_)|APIKEY|PRIVATE|CREDENTIAL|AUTH|DSN|WEBHOOK|COOKIE|SIGNING|ENCRYPT|SALT)/i;
+const SECRET_NAME_RE = /(SECRET|TOKEN|PASSW(?:OR)?D|PASSPHRASE|(?:^|_)PASS(?:$|_)|PWD|(?:^|_)KEY(?:$|_)|APIKEY|PRIVATE|CREDENTIAL|(?:^|_)CREDS?(?:$|_)|AUTH|JWT|DSN|WEBHOOK|COOKIE|SIGNING|ENCRYPT|SALT)/i;
 const SECRET_VALUE_RE = /^(?:gh[pousr]_|github_pat_|glpat-|xox[abprs]-|sk-|sk_(?:live|test)_|rk_(?:live|test)_|whsec_|AKIA|ASIA|AIza|npm_|hf_|ya29\.|eyJ)/;
-const URL_PASSWORD_RE = /^[a-z][a-z0-9+.-]*:\/\/[^\s:@/]+:[^\s@/]+@/i;
-// Local heuristic for `import`: never sends anything anywhere. Names that say
-// PUBLIC (NEXT_PUBLIC_*, VITE_PUBLIC_*) are meant to ship to browsers.
+const URL_PASSWORD_RE = /^[a-z][a-z0-9+.-]*:\/\/[^\s:@/]*:[^\s@/]+@/i;
+// Local heuristic for `import`: never sends anything anywhere. A known secret
+// format wins over the name; otherwise names with a PUBLIC segment
+// (NEXT_PUBLIC_*, VITE_PUBLIC_*) are meant to ship to browsers.
 export function looksSecret(name, value) {
-    if (!value || isRef(value) || /PUBLIC/i.test(name))
+    if (!value || isRef(value))
+        return false;
+    if (SECRET_VALUE_RE.test(value) || URL_PASSWORD_RE.test(value))
+        return true;
+    if (/(?:^|_)PUBLIC(?:$|_)/i.test(name))
         return false;
-    if (SECRET_VALUE_RE.test(value) || URL_PASSWORD_RE.test(value) || SECRET_NAME_RE.test(name))
+    if (SECRET_NAME_RE.test(name) || /^[0-9a-f]{32,}$/i.test(value))
         return true;
     return value.length >= 24 && !/\s/.test(value) && /[a-z]/.test(value) && /[A-Z]/.test(value) && /\d/.test(value);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "keyshroud",
-  "version": "0.5.2",
+  "version": "0.6.0",
   "mcpName": "io.github.dinhkarate/keyshroud",
   "description": "Let AI coding agents use your secrets without ever seeing them. Self-hosted Vaultwarden/Bitwarden, masked output, MCP server, Claude Code + pi plugins.",
   "keywords": [

package/skills/keyshroud/SKILL.md

@@ -17,8 +17,9 @@ in output with `<redacted:NAME>`.
    ```bash
    keyshroud add --env STRIPE_API_KEY --item "Stripe API key" --notes "billing service"
    ```
-   Tell the user a dialog is waiting for them. With the MCP server, call
-   `secrets_request` instead. Over SSH or without a display there is no dialog:
+   Tell the user a dialog is waiting for them, and ask for one secret at a time;
+   if they cancel, do not ask again unprompted. Never ask for the vault master
+   password. With the MCP server, call `secrets_request` instead. Over SSH or without a display there is no dialog:
    then give the user the command to run in their own terminal.
 2. Never print, echo, `cat`, base64, or otherwise transform a secret value.
    `<redacted:NAME>` in output means the secret was used correctly. Do not try
@@ -77,3 +78,6 @@ keyshroud scan .          # exits 1 and lists file:line NAME for any leaked valu
 `0` ok · `2` usage · `3` vault locked/unavailable (ask the user to run
 `keyshroud unlock`) · `4` secret missing or item name ambiguous · `5` would
 overwrite existing state.
+
+`setup` and `migrate` are for the user: they touch the personal vault. If an item
+is missing after `setup`, ask the user to run `keyshroud migrate --item "NAME"`.